mirror of
https://github.com/getpaseo/paseo.git
synced 2026-07-29 12:01:31 +00:00
9dd5c6e5f3
* Patch production dependency advisories
* ci: harden dependency installs with npm ci --ignore-scripts
- Replace npm install with npm ci --ignore-scripts across all workflows
to enforce lockfile parity and block dependency postinstall scripts.
- Run npm run postinstall explicitly after install so our root patch
script still applies (the only legitimate postinstall use in this
repo); dep lifecycle scripts stay blocked.
- Add lockfile-lint and npm audit signatures to the lint job to catch
registry-host tampering and verify cryptographic signatures.
- Regenerate package-lock.json to match bumped package.json versions.
* ci: drop --ignore-scripts; rely on npm ci + lockfile-lint + audit signatures
Lavamoat allow-scripts only traverses root deps; it can't see workspace
deps like electron, esbuild, sharp. Without proper monorepo support, an
allowlist would be incomplete and electron's binary download breaks.
Keep the rest of the security stack:
- npm ci (strict lockfile parity)
- lockfile-lint (resolved-host check)
- npm audit signatures (cryptographic verification)
Real script-blocking would need pnpm 10+ migration. Tracking separately.
* ci(nix-build): use PR head SHA so fork checkouts work
The previous `ref: ${{ github.head_ref || github.ref }}` made
actions/checkout fetch a branch name that only exists on the fork,
not origin. Use the PR head SHA instead — origin mirrors PR commits
via refs/pull/N/head, so this works for fork PRs without changing
the push-to-main auto-commit behavior.
---------
Co-authored-by: Mohamed Boudra <boudra.moha@gmail.com>
44 lines
1.1 KiB
JSON
44 lines
1.1 KiB
JSON
{
|
|
"name": "@getpaseo/cli",
|
|
"version": "0.1.71",
|
|
"description": "Paseo CLI - control your AI coding agents from the command line",
|
|
"bin": {
|
|
"paseo": "bin/paseo"
|
|
},
|
|
"files": [
|
|
"bin",
|
|
"dist"
|
|
],
|
|
"type": "module",
|
|
"publishConfig": {
|
|
"access": "public"
|
|
},
|
|
"scripts": {
|
|
"build": "node -e \"require('node:fs').rmSync('dist',{ recursive: true, force: true })\" && tsc -p tsconfig.json --incremental false",
|
|
"prepack": "npm run build",
|
|
"typecheck": "tsgo --noEmit",
|
|
"test": "npm run test:local",
|
|
"test:local": "tsx tests/run-all.ts",
|
|
"test:e2e": "npm run test:local",
|
|
"test:e2e:lifecycle": "npx tsx tests/e2e/agent-lifecycle.test.ts"
|
|
},
|
|
"dependencies": {
|
|
"@clack/prompts": "^1.0.0",
|
|
"@getpaseo/server": "0.1.71",
|
|
"chalk": "^5.3.0",
|
|
"commander": "^12.0.0",
|
|
"mime-types": "^2.1.35",
|
|
"tree-kill": "^1.2.2",
|
|
"ws": "^8.14.2",
|
|
"yaml": "^2.8.4"
|
|
},
|
|
"devDependencies": {
|
|
"@types/mime-types": "^3.0.1",
|
|
"@types/ws": "^8.5.8",
|
|
"tsx": "^4.6.0",
|
|
"typescript": "^5.2.2",
|
|
"vitest": "^3.2.4",
|
|
"zx": "^8.8.5"
|
|
}
|
|
}
|