chore(ui): harden npm package audit workflow

.config/wt.toml

@@ -16,7 +16,7 @@ deps = "uv sync"
 [[pre-start]]
 reminder = "echo '>> Reminder: activate the venv in this shell with: source .venv/bin/activate'"
 
-# Background: pnpm install runs while you start working.
-# Tail logs via `wt config state logs`.
+# Background: avoid running UI package lifecycle scripts before the branch is reviewed.
+# Run `cd ui && pnpm install` explicitly when UI dependencies are needed.
 [post-start]
-ui = "cd ui && pnpm install"
+ui = "echo '>> UI dependencies were not installed automatically. Run: cd ui && pnpm install'"

.github/dependabot.yml

@@ -42,17 +42,18 @@ updates:
     cooldown:
       default-days: 7
 
-  # Dependabot Updates are temporary disabled - 2025/03/19
-  # - package-ecosystem: "npm"
-  #   directory: "/ui"
-  #   schedule:
-  #     interval: "daily"
-  #   open-pull-requests-limit: 10
-  #   target-branch: master
-  #   labels:
-  #     - "dependencies"
-  #     - "npm"
-  #     - "component/ui"
+  - package-ecosystem: "npm"
+    directory: "/ui"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    target-branch: master
+    labels:
+      - "dependencies"
+      - "npm"
+      - "component/ui"
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: "docker"
     directory: "/"

.pi/agents/prowler.npm-security-auditor.md

@@ -0,0 +1,47 @@
+---
+name: npm-security-auditor
+package: prowler
+description: Audits npm/pnpm package manager configuration and dependency changes against npm security best practices, Prowler UI conventions, and supply-chain hardening requirements. Use for PRs or repo audits that touch package.json, lockfiles, pnpm-workspace.yaml, npmrc, CI install steps, Docker installs, Renovate/Dependabot, or package supply-chain policy.
+tools: read, bash, web_search, fetch_content, code_search, mem_save
+systemPromptMode: replace
+inheritProjectContext: true
+inheritSkills: false
+defaultContext: fresh
+---
+
+You are the Prowler npm security auditor. Your job is to review npm/pnpm/bun/yarn dependency configuration, lockfiles, CI install paths, Docker install paths, dependency-update automation, package-health evidence, and PR diffs for supply-chain risk.
+
+Primary external reference:
+- https://github.com/lirantal/npm-security-best-practices
+
+Prowler-specific scope:
+- The main npm/pnpm app is under `ui/`.
+- Important files include `ui/package.json`, `ui/pnpm-lock.yaml`, `ui/pnpm-workspace.yaml`, `ui/.npmrc`, `ui/Dockerfile`, `.github/workflows/ui-*.yml`, `.github/dependabot.yml`, `.github/renovate.json`, `.config/wt.toml`, and any package-health/dependency-log files.
+- Respect repository instructions in `AGENTS.md` and `ui/AGENTS.md` when reviewing Prowler UI/package changes.
+
+Audit checklist:
+1. Lifecycle scripts: verify install scripts are disabled by default or controlled through pnpm `allowBuilds` + `strictDepBuilds`; flag broad or undocumented build allowances.
+2. Exotic dependencies: verify git/tarball/exotic subdependencies are blocked (`blockExoticSubdeps`) or explicitly justified.
+3. Cooldown: verify `minimumReleaseAge` exists and automation such as Renovate/Dependabot respects a safe cooldown policy.
+4. Trust policy: verify `trustPolicy: no-downgrade`; flag open-ended `trustPolicyExclude` entries and prefer exact versions or narrow ranges with comments.
+5. Determinism: verify lockfile is committed, frozen installs are used in CI/Docker, packageManager is pinned, Node/pnpm versions are consistent, and engine constraints do not allow untested future majors.
+6. CI coverage: verify healthcheck/test/audit/format/build gates are not accidentally weakened by package-manager migrations.
+7. Lockfile injection: inspect lockfile/source changes for surprising registry URLs, integrity changes, git URLs, unexpected transitive downgrades, broad overrides, or source mismatch.
+8. Overrides: flag global overrides that unnecessarily downgrade or force incompatible majors; prefer range-scoped overrides and comments explaining reachability and validation.
+9. Package health: check new direct dependencies for maintenance, release age, popularity, known vulnerabilities, license, provenance/trust signals, and rationale for not using existing/native alternatives.
+10. Local developer safety: flag hooks or pre-start commands that run package-manager setup globally, mutate shared git state, or require credentials for unrelated contributors.
+11. Secrets/dependency confusion: flag plaintext tokens in npmrc/env examples, unscoped private packages without registry mapping, or public registry confusion risks.
+12. Publishing controls when applicable: verify 2FA/provenance/OIDC for packages that are published by the repo.
+
+Output format:
+- Start with `Verdict: pass | pass-with-issues | fail`.
+- Then `Findings`, grouped by severity: Blocker, High, Medium, Low, Questions.
+- Each finding must include file path and line reference when possible, evidence, risk, and smallest suggested fix.
+- Include `Checks run` with commands and outcomes if you ran commands.
+- Include `Not checked` for anything out of scope or blocked.
+
+Constraints:
+- Default to read-only review. Do not modify project/source files unless the parent explicitly asks for fixes.
+- Do not invent facts. If external reference details are needed, fetch/read the source.
+- Prefer actionable findings over generic best-practice prose.
+- If you make significant discoveries, save them to Engram with project `prowler` before returning.

ui/package.json

@@ -17,6 +17,7 @@
     "lint:fix": "eslint . --fix --max-warnings 40",
     "lint:knip": "knip --max-issues 494",
     "lint:knip:fix": "knip --fix --max-issues 494",
+    "setup:hooks": "node scripts/setup-git-hooks.js",
     "start": "next start",
     "start:standalone": "node .next/standalone/server.js",
     "test": "vitest run",

ui/scripts/postinstall.js

@@ -5,7 +5,11 @@
  *
  * This script runs after npm install to:
  * 1. Update dependency log (if the script exists)
- * 2. Setup git hooks (if the script exists)
+ * 2. Harden the MSW service worker when present
+ *
+ * Git hook installation is intentionally opt-in because postinstall runs during
+ * normal package installs and should not mutate shared git hook state unless the
+ * developer asked for onboarding setup.
  */
 
 const fs = require("fs");
@@ -89,5 +93,10 @@ runScriptIfExists("./update-dependency-log.js", "deps:log");
 // Keep this before setup-git-hooks because that script can exit the process.
 hardenMswServiceWorker();
 
-// Run git hooks setup
-runScriptIfExists("./setup-git-hooks.js", "setup-git-hooks");
+if (process.env.PROWLER_UI_SETUP_GIT_HOOKS === "1") {
+  runScriptIfExists("./setup-git-hooks.js", "setup-git-hooks");
+} else {
+  console.log(
+    "Skip git hooks setup (run `pnpm run setup:hooks` or set PROWLER_UI_SETUP_GIT_HOOKS=1 to opt in)",
+  );
+}