[codex] Improve Socket score drivers (#39)

* Improve Socket score drivers

* Address review feedback

Author: andrewkoltsov

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Keep this file aligned with the trusted GitHub maintainers for the repository.
+* @andrewkoltsov

.github/workflows/release.yml

@@ -82,6 +82,24 @@ jobs:
         if: steps.npm_status.outputs.published != 'true'
         run: npm publish --provenance
 
+      - name: Verify published package attestations
+        env:
+          PACKAGE_NAME: librus-sdk
+          PACKAGE_VERSION: ${{ steps.package_metadata.outputs.version }}
+        run: |
+          for attempt in 1 2 3; do
+            if node ./scripts/verify-published-package.mjs "$PACKAGE_NAME" "$PACKAGE_VERSION"; then
+              exit 0
+            fi
+
+            if [ "$attempt" -eq 3 ]; then
+              echo "Published package metadata for $PACKAGE_NAME@$PACKAGE_VERSION did not expose attestations/signatures after 3 attempts." >&2
+              exit 1
+            fi
+
+            sleep 5
+          done
+
       - name: Check whether GitHub Release already exists
         id: release_status
         env:

CHANGELOG.md

@@ -6,6 +6,22 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+### Added
+
+- Release automation now verifies the published npm package still exposes
+  provenance attestations and registry signatures after
+  `npm publish --provenance`.
+- Repository ownership metadata now includes `.github/CODEOWNERS`, and release
+  docs now spell out maintainer continuity expectations.
+
+### Changed
+
+- CLI startup now uses Node's built-in `.env` file loader instead of shipping
+  `dotenv` as a runtime dependency.
+- CLI text rendering now uses an internal formatter instead of `cliui`,
+  reducing the published runtime dependency footprint while preserving the
+  existing text/json command surface.
+
 ## [0.3.2] - 2026-04-01
 
 ### Fixed

docs/releasing.md

@@ -34,6 +34,8 @@ The release workflow in
 - confirm the pushed tag matches `package.json`
 - require the tagged commit to be reachable from `origin/master`
 - publish to npm if that version is not already present
+- verify the published npm package still exposes provenance attestations and
+  registry signatures after `npm publish --provenance`
 - create the GitHub Release from the matching `CHANGELOG.md` section
 
 ## Release Notes Policy
@@ -69,6 +71,17 @@ continues to publish to npmjs only.
 6. Push the tag to GitHub.
 7. Verify that the release workflow publishes the package and creates the
    GitHub Release.
+8. Confirm the workflow's published-package verification step succeeds.
+
+## Maintainer Continuity
+
+- Keep `.github/CODEOWNERS` aligned with the trusted GitHub maintainers who can
+  review and land changes.
+- Keep at least two trusted maintainers on GitHub and npm before enforcing an
+  approving-review requirement on `master`, so branch protection does not
+  deadlock releases.
+- After maintainers change, re-check `master` branch protection so the required
+  status checks still include the CI validation gate and CodeQL analysis.
 
 ## Homepage Value For Badge Evidence
 

package-lock.json

@@ -64,17 +64,15 @@
   "license": "MIT",
   "dependencies": {
     "@valibot/to-json-schema": "^1.6.0",
-    "cliui": "^9.0.1",
     "commander": "^14.0.0",
-    "dotenv": "^17.2.3",
     "fetch-cookie": "^3.1.0",
     "parse5": "^8.0.0",
     "tough-cookie": "^6.0.1",
     "valibot": "^1.3.1"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@types/node": "^25.5.0",
+    "@types/node": "^20.19.37",
     "@vitest/coverage-v8": "^4.1.2",
     "eslint": "^10.1.0",
     "eslint-config-prettier": "^10.1.8",

package.json

@@ -0,0 +1,94 @@
+import { execFileSync } from "node:child_process";
+import { resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+
+export function assertPublishedPackageSecurityMetadata(metadata, packageSpec) {
+  if (!metadata || typeof metadata !== "object") {
+    throw new Error(
+      `npm view returned no package metadata for ${packageSpec}.`,
+    );
+  }
+
+  const dist =
+    "dist" in metadata && metadata.dist && typeof metadata.dist === "object"
+      ? metadata.dist
+      : null;
+  const attestations =
+    dist &&
+    "attestations" in dist &&
+    dist.attestations &&
+    typeof dist.attestations === "object"
+      ? dist.attestations
+      : null;
+  const provenance =
+    attestations &&
+    "provenance" in attestations &&
+    attestations.provenance &&
+    typeof attestations.provenance === "object"
+      ? attestations.provenance
+      : null;
+  const signatures =
+    dist && "signatures" in dist && Array.isArray(dist.signatures)
+      ? dist.signatures
+      : [];
+
+  if (!attestations || typeof attestations.url !== "string") {
+    throw new Error(
+      `Published package ${packageSpec} is missing npm attestations metadata.`,
+    );
+  }
+
+  if (!provenance || typeof provenance.predicateType !== "string") {
+    throw new Error(
+      `Published package ${packageSpec} is missing provenance details.`,
+    );
+  }
+
+  if (signatures.length === 0) {
+    throw new Error(
+      `Published package ${packageSpec} is missing npm registry signatures.`,
+    );
+  }
+}
+
+export function verifyPublishedPackage(packageName, packageVersion) {
+  const packageSpec = packageVersion
+    ? `${packageName}@${packageVersion}`
+    : packageName;
+  const stdout = fetchPublishedPackageMetadata(packageSpec);
+  const metadata = JSON.parse(stdout);
+
+  assertPublishedPackageSecurityMetadata(metadata, packageSpec);
+}
+
+export function fetchPublishedPackageMetadata(packageSpec) {
+  try {
+    return execFileSync("npm", ["view", packageSpec, "--json"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+  } catch (error) {
+    const message =
+      error instanceof Error && error.message
+        ? error.message
+        : "Unknown npm view failure.";
+
+    throw new Error(
+      `Failed to fetch package metadata for ${packageSpec} from npm registry: ${message}`,
+      { cause: error },
+    );
+  }
+}
+
+if (import.meta.url === pathToFileURL(resolve(process.argv[1] ?? "")).href) {
+  const [, , packageName, packageVersion] = process.argv;
+
+  if (!packageName) {
+    console.error(
+      "Usage: node ./scripts/verify-published-package.mjs <package-name> [version]",
+    );
+    process.exitCode = 1;
+  } else {
+    verifyPublishedPackage(packageName, packageVersion);
+  }
+}