Add verify-deps + precheck for supply-chain freshness checks (npm + pnpm + Python)

[Ibrahimrahhal]

Summary

This PR adds two complementary commands for supply-chain freshness checking:

1. corgea verify-deps — point at a project, scan its lockfiles, flag installed-version freshness against the registry.
2. corgea precheck <pkg-mgr> ... — wrap an install command (npm install, pnpm add, pip install, ...), resolve what would actually be installed, and refuse to run when a resolved version was published within the threshold.

# Inspect what is already installed
corgea verify-deps                          # 2-day window, prod deps, npm + python
corgea verify-deps --threshold 7d --fail    # CI gate (exit 1 on hit)
corgea verify-deps --fail-unpinned          # CI gate on unfrozen deps

# Block bad installs at install time
corgea precheck npm install axios@^1.0.0 --save-dev
corgea precheck pnpm add @types/node@latest
corgea precheck pip install requests==2.31.0
corgea precheck pip install -r requirements.txt --fail-unpinned
corgea precheck npm install                # bare install verifies the lockfile

verify-deps capabilities

• Ecosystems: npm and Python (selectable via --ecosystem npm|python|all).
• npm sources: package-lock.json (v1, v2, v3), npm-shrinkwrap.json, pnpm-lock.yaml (v5, v6, v9), and yarn.lock (classic). Non-registry deps (git / file / link / workspace) are skipped.
• Python sources: poetry.lock, Pipfile.lock, uv.lock, and requirements.txt (==-pinned lines only).
• Threshold: human-friendly durations -- 2d (default), 48h, 30m, 1w. Bare numbers are interpreted as days.
• --fail: exit 1 if any recent dep is found.
• --fail-unpinned: exit 1 if any dep can't be verified because it isn't pinned -- package.json / pyproject.toml / Pipfile / requirements.in without a matching lockfile, or unpinned requirements.txt lines.
• --json: machine-readable output -- results, unpinned, summary, sources, scanned_at, threshold_seconds.
• Honours CORGEA_NPM_REGISTRY / CORGEA_PYPI_REGISTRY overrides.

precheck capabilities

• Wrappers: npm, yarn, pnpm, pip (alias pip3). Subcommands other than install / add / i are forwarded straight through (so corgea precheck npm view ... still works).
• Spec resolution against the public registry before exec:
  • npm: bare name, @latest, any dist-tag (@next, @beta, ...), exact versions, full semver ranges (^1.0.0, ~1.2.0, >=1.0.0 <2.0.0). Both Rust-style comma-separated and npm-style space-separated ranges are accepted.
  • PyPI: bare name, ==X, and PEP 440 specifiers >=, <=, >, <, !=, ~= with comma-separated AND. Exact pins are honoured precisely; other specifiers fall back to "highest matching stable" using semver ordering after a PyPI->semver normalisation step.
• Edge cases handled: scoped npm names (@types/node@1.0.0), npm aliases (npm:other@1.0.0), workspace specs, git/URL/file/path specs, pip extras (requests[security]==2.31.0), env markers (requests==2.31.0; python_version >= "3.7"), and pip flag-with-value pairs (-r FILE, -c FILE, -e PATH, --requirement=FILE, --editable=PATH). Unverifiable specs (git / URL / file / editable) are reported as "skipped", never block.
• Bare npm install / pip install: verify the existing lockfile via the same verify-deps machinery, then exec.
• pip install -r FILE: reads the file (any name, not just requirements.txt) and runs registry verification on each line; unpinned lines flow through --fail-unpinned.
• Behaviour:
  • Default — recent finding exits 1 without running the install.
  • --no-fail — demote to a printed warning; install still runs.
  • --check-only — never exec, regardless of result.
  • --fail-unpinned — also fail on unverifiable specs and unpinned -r lines.
  • --json — machine-readable output.
• Exec passthrough: uses which to resolve the manager binary (handles .cmd shims on Windows) and preserves the manager's exit code, including signal-based termination on Unix (128+sig).

Implementation Notes

• PyPI: per-version JSON endpoint (/pypi/<name>/<version>/json) for verify-deps; full /pypi/<name>/json for precheck range resolution. Names URL-encoded; results normalised per PEP 503 before display.
• npm: package metadata endpoint with time[<version>] lookup. Scoped names encoded as @types%2fnode. Abbreviated metadata format avoided because it omits time.
• pnpm: line-based parser handles all three key conventions: v5/v6 (/lodash/4.17.21), v6+ at-sign (/lodash@4.17.21), and v9 (lodash@4.17.21, '@types/node@20.10.5'). Peer-dep suffixes are stripped from the version (both 1.0.0_react@18.0.0 v6 and 1.0.0(react@18.0.0) v9). Dev/prod classification uses the per-package dev: field on v6, and falls back to walking importers.dependencies / importers.devDependencies on v9.
• Unfrozen-dep detection: discovery returns a warnings: Vec<UnpinnedWarning> alongside deps. Lightweight TOML / JSON parsers confirm a manifest actually declares dependencies (placeholder files don't trigger warnings).
• Range resolution: new npm_resolve and pypi_resolve in the registry module use semver = "1" for the Rust-side ordering / matching. parse_npm_range normalises npm-style space ranges to comma-separated for the Rust crate.
• Isolation: registry HTTP client is separate from the rest of the CLI so the user's Corgea auth header is never sent to a third party.

Tests

• 52 hermetic unit tests covering threshold parsing, duration formatting, ecosystem parsing, name normalisation, lockfile parsers (npm v1, npm v3, yarn classic, pnpm v5/v6/v9 with dev classification + peer suffix stripping, requirements.txt with VCS escape-hatch handling, poetry, Pipfile, uv), discover-level warnings for missing-lockfile scenarios, install-command parsing for npm and pip across all spec shapes, and the -- boundary in flag stripping.
• 13 #[ignore]-gated live integration tests against registry.npmjs.org and pypi.org covering: publish-time lookup (left-pad@1.3.0, requests@2.31.0, Flask@2.3.2, error paths) plus dist-tag / exact / range / specifier resolution (npm Latest/Exact/Range/space-Range/unknown-tag, PyPI Latest/Exact/Specifier).

cargo test                                                   # 52 passed, 13 ignored
cargo test -- --ignored verify_deps::registry::tests::live   # 13 passed (live)

Walkthroughs

npm + Python freshness:

verify_deps_demo.log

pnpm-lock.yaml (v9, real pnpm install --lockfile-only):

verify_deps_pnpm_demo.log

--fail-unpinned (mixed npm + Python project, no lockfiles):

verify_deps_fail_unpinned_demo.log

precheck (live registry resolution, real recent publish caught):

precheck_demo.log

3) RECENT publish caught - `pnpm add @types/node@latest` blocks:
   ⚠ @types/node@latest → @types/node@25.9.1  published 1d 20h ago at 2026-05-19 17:49:12 UTC
   Refusing to run install. Pass --no-fail to proceed anyway.
   (exit: 1)

Files

• src/verify_deps/mod.rs — verify-deps command core, options, threshold parsing, run loop, report aggregation, UnpinnedWarning type.
• src/verify_deps/npm.rs — npm/yarn/pnpm lockfile parsers, package.json-without-lockfile detection.
• src/verify_deps/python.rs — poetry/Pipfile/uv/requirements parsers + PEP 503 name normalisation, pyproject.toml / Pipfile / requirements.in warnings, unpinned-line detection.
• src/verify_deps/registry.rs — npmjs.org and PyPI lookups + new npm_resolve / pypi_resolve for precheck.
• src/verify_deps/report.rs — text and JSON renderers.
• src/precheck/mod.rs — precheck command core, dispatch, exec passthrough.
• src/precheck/parse.rs — install-command argument parser for npm/yarn/pnpm/pip with all spec edge cases.
• src/main.rs — clap subcommand wiring (verify-deps, precheck).
• Cargo.toml — adds semver = "1".
• skills/corgea/SKILL.md — command reference and CI workflow snippets.

Open follow-ups (left out of this PR on purpose)

• Wrappers for poetry add, pipenv install, uv add, npx — same machinery, just dispatch + arg parsing.
• Honouring per-command --registry flags.
• Support for npm || OR ranges (not natively supported by the Rust semver crate).

_{To show artifacts inline, enable in settings.}