feat: two-day supply-chain quarantine in scaffolded workspaces

[pyramation]

Summary

Supersedes #40 — same shape as that PR (a pnpm-policy.yaml per template, the generated block in pnpm-workspace.yaml, policy/policy:check scripts, and a CI drift check), with the wait cut from 14 days to 2 and no README prose.

minimumReleaseAge: 2d      # 2880 minutes in the generated block
allowBuilds: []            # no dependency runs an install script
blockExoticSubdeps: true   # transitive deps come from the registry, not git/URL
exceptions: []

Two days is where the tradeoff sits for a scaffold: a hijacked account or typosquat is normally caught and yanked within hours to a day, so the wait still removes the sharp edge, while nobody is blocked for a fortnight from taking a legitimate release.

allowBuilds and exceptions are empty but present, commented with the shape of an entry, so approving a native build or waiving the wait for a same-day security fix is a two-line edit plus pnpm run policy — and an until: on a waiver makes policy:check fail rather than let it live forever.

One rough edge: nothing is locked on the very first install, so it resolves every version fresh and trips on anything younger than the wait (including pnpm-policy itself right after a release). pnpm install --config.minimumReleaseAge=0 once gets past it; after the lockfile is committed, installs replay it and the wait only applies to versions being added.

Verified by scaffolding pnpm/workspace into a temp dir: first install with the escape flag, then policy:check reports a match, then --frozen-lockfile re-installs clean.

Link to Devin session: https://app.devin.ai/sessions/ffa3b012deac4eb7afb8f49a9af9f9ca
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pnpm-policy@​0.2.2

View full report