@createsomething/ground-mcp 0.3.0 → 0.3.3

package/README.md

@@ -46,8 +46,41 @@ Both commands print JSON evidence. `ground diff` only returns files inside the
 requested directory and resolves Git paths from the repository root, so it is
 safe to run from a package inside a monorepo.
 
-The release package includes the native Apple Silicon binaries directly; other
-supported platforms download the matching verified release asset during install.
+### Diff coverage
+
+Every batch, diff, and duplicate-function response has a
+`verification_status`; `ground diff` also returns the same status per requested
+check in `check_coverage.<check>.status`. The contract is explicit:
+
+- `PASS`: the check completed for the relevant supported files and found no issue.
+- `FAIL`: the check found an issue or could not complete because of a read/parse failure.
+- `NOT_APPLICABLE`: no changed file needs that check.
+- `UNSUPPORTED`: relevant source exists, but the requested check cannot analyze its language (including Svelte duplicate-function scans).
+- `TIMEOUT`: duplicate analysis reached its deadline before a complete result was available.
+
+`ground analyze` and `ground diff` accept `--timeout-ms` (120000 by default).
+The MCP equivalents accept `timeout_ms`; a deadline returns `TIMEOUT`, never a
+clean result. `ground diff` includes `.mjs` with JavaScript source analysis.
+Its `changed_files` and `changed_file_list` fields remain the analyzable-file
+view; read `discovered_changed_files`, `analyzable_changed_files`, and
+`excluded_changed_files` for the full Git scope. Per-check coverage also names
+`unsupported_changed_files` and `excluded_changed_files`, so a clean claim is
+valid only with `PASS`.
+
+Ground 0.3.3 keeps `ground diff`'s complete changed-file coverage and makes
+source traversal deterministic and cycle-safe. Diff mode parses the complete
+corpus but only compares pairs involving changed files. Standalone broad
+duplicate scans retain their safety bound and report their non-pass status with
+`scan_complete: false` when the bound is hit.
+
+The release package ships thin command wrappers for every platform. Install
+downloads the matching versioned release asset and verifies its SHA-256 against
+that release's `SHA256SUMS` manifest before extracting it. Record the artifact
+that produced a receipt with:
+
+```bash
+ground build-info --json
+```
 
 ## The Problem
 
@@ -196,7 +229,7 @@ The npm package downloads a platform-specific binary on install. If that failed:
 
 ```bash
 # Check if the binary exists
-ls node_modules/@createsomething/ground-mcp/bin/
+ls node_modules/@createsomething/ground-mcp/bin/native/
 
 # Re-install
 npm install @createsomething/ground-mcp

package/bin/ground-mcp.js

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+
+require('./run-native').runNative('ground-mcp');

package/bin/ground.js

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+
+require('./run-native').runNative('ground');

package/bin/native/.gitkeep

@@ -0,0 +1 @@
+

package/bin/run-native.js

@@ -0,0 +1,27 @@
+const { spawnSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+
+function runNative(binaryName) {
+  const extension = process.platform === 'win32' ? '.exe' : '';
+  const binary = path.join(__dirname, 'native', `${binaryName}${extension}`);
+
+  if (!fs.existsSync(binary)) {
+    console.error(
+      `Ground MCP native binary is unavailable at ${binary}. Reinstall @createsomething/ground-mcp to complete the verified release-asset download.`
+    );
+    process.exitCode = 1;
+    return;
+  }
+
+  const result = spawnSync(binary, process.argv.slice(2), { stdio: 'inherit' });
+  if (result.error) {
+    console.error(`Ground MCP could not start ${binaryName}: ${result.error.message}`);
+    process.exitCode = 1;
+    return;
+  }
+
+  process.exitCode = result.status ?? 1;
+}
+
+module.exports = { runNative };

package/install.js

@@ -7,10 +7,10 @@
  */
 
 const { execSync } = require('child_process');
+const { createHash } = require('crypto');
 const fs = require('fs');
 const https = require('https');
 const path = require('path');
-const zlib = require('zlib');
 
 const REPO = 'createsomethingtoday/create-something-monorepo';
 const VERSION = require('./package.json').version;
@@ -51,20 +51,24 @@ function getDownloadUrl(binaryName, platform = process.platform) {
   return `https://github.com/${REPO}/releases/download/ground-v${VERSION}/ground-${binaryName}.${ext}`;
 }
 
-function hasBundledNativeBinaries() {
-  // The npm artifact includes a release-built Apple Silicon bootstrap pair.
-  // Other platforms continue through the release-asset downloader below.
-  if (getPlatformKey() !== 'darwin-arm64') return false;
-
-  const binDir = path.join(__dirname, 'bin');
-  return ['ground', 'ground-mcp'].every((name) => {
-    const binary = path.join(binDir, name);
-    try {
-      return fs.statSync(binary).isFile() && (fs.statSync(binary).mode & 0o111) !== 0;
-    } catch {
-      return false;
-    }
-  });
+function getChecksumsUrl() {
+  return `https://github.com/${REPO}/releases/download/ground-v${VERSION}/SHA256SUMS`;
+}
+
+function verifyArchiveIntegrity(archive, assetName, checksums) {
+  const expected = checksums
+    .split(/\r?\n/)
+    .map((line) => line.trim().match(/^([a-f0-9]{64})\s+\*?(.+)$/i))
+    .find((match) => match?.[2] === assetName)?.[1];
+
+  if (!expected) {
+    throw new Error(`Release checksum manifest does not contain a checksum for ${assetName}`);
+  }
+
+  const actual = createHash('sha256').update(archive).digest('hex');
+  if (actual !== expected.toLowerCase()) {
+    throw new Error(`Release checksum mismatch for ${assetName}`);
+  }
 }
 
 async function download(url) {
@@ -119,16 +123,11 @@ async function install() {
     return;
   }
 
-  if (hasBundledNativeBinaries()) {
-    console.log('Ground MCP: Using bundled darwin-arm64 binaries');
-    return;
-  }
-
   console.log('Ground MCP: Installing binary...');
   
   const binaryName = getBinaryName();
   const url = getDownloadUrl(binaryName);
-  const binDir = path.join(__dirname, 'bin');
+  const binDir = path.join(__dirname, 'bin', 'native');
   
   console.log(`Platform: ${getPlatformKey()}`);
   console.log(`Downloading: ${url}`);
@@ -141,6 +140,8 @@ async function install() {
     
     // Download archive
     const buffer = await download(url);
+    const checksums = await download(getChecksumsUrl());
+    verifyArchiveIntegrity(buffer, path.basename(url), checksums.toString('utf8'));
     console.log(`Downloaded ${(buffer.length / 1024 / 1024).toFixed(2)} MB`);
     
     // Extract based on platform
@@ -203,5 +204,8 @@ if (require.main === module) {
 }
 
 module.exports = {
+  download,
   getDownloadUrl,
+  getChecksumsUrl,
+  verifyArchiveIntegrity,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@createsomething/ground-mcp",
-  "version": "0.3.0",
+  "version": "0.3.3",
   "description": "Grounded claims for code. MCP server that prevents AI hallucination in code analysis.",
   "author": "CREATE SOMETHING <hello@createsomething.io>",
   "license": "MIT",
@@ -48,11 +48,12 @@
     "css-analysis"
   ],
   "bin": {
-    "ground": "bin/ground",
-    "ground-mcp": "bin/ground-mcp"
+    "ground": "bin/ground.js",
+    "ground-mcp": "bin/ground-mcp.js"
   },
   "scripts": {
     "postinstall": "node install.js",
+    "prepublishOnly": "node release-verify.js",
     "pilot:build": "cargo build --release --manifest-path ../Cargo.toml --bin ground --bin ground-mcp",
     "pilot:benchmark": "tsx pilot/benchmark.ts",
     "pilot:check": "tsc --noEmit -p pilot/tsconfig.json",

package/bin/.gitkeep

@@ -1,4 +0,0 @@
-# Binary files are downloaded during npm install
-# This directory will contain:
-# - ground-mcp (or ground-mcp.exe on Windows)
-# - ground (or ground.exe on Windows)