feat: gate updates behind vet supply-chain checksHEADmain

update now holds inputs and skills back by a cooldown, has Claude review
third-party diffs, and reports CVE changes before switching. Homebrew taps
are pinned through nix-homebrew, and npm/pnpm get install policies.

1 files changed, 26 insertions, 0 deletions

diff --git a/modules/home/supply-chain.nix b/modules/home/supply-chain.nix
new file mode 100644
index 0000000..43c5f3b
--- /dev/null
+++ b/modules/home/supply-chain.nix
@@ -0,0 +1,26 @@
+{ pkgs, lib, ... }:
+
+let
+  # Most registry compromises are caught and unpublished within days, so a
+  # week-old version has had time to be noticed. Lifecycle scripts are
+  # already blocked by pnpm unless a project allows them.
+  pnpmConfig = ''
+    minimumReleaseAge: 10080
+    trustPolicy: no-downgrade
+    blockExoticSubdeps: true
+  '';
+in
+{
+  # pnpm reads $XDG_CONFIG_HOME/pnpm/config.yaml, and on macOS falls back to
+  # ~/Library/Preferences/pnpm when XDG_CONFIG_HOME is unset (GUI apps, editors).
+  xdg.configFile."pnpm/config.yaml".text = pnpmConfig;
+  home.file."Library/Preferences/pnpm/config.yaml" = lib.mkIf pkgs.stdenv.isDarwin {
+    text = pnpmConfig;
+  };
+
+  # An env var rather than ~/.npmrc, which `npm login` must be able to write.
+  # pnpm ignores it. Explicit `npm run <script>` still runs.
+  home.sessionVariables.npm_config_ignore_scripts = "true";
+
+  home.packages = [ pkgs.osv-scanner ];
+}