@domsync/darwin-x64 1.0.0 → 1.1.0

package/README.md

@@ -19,9 +19,17 @@ The cask works on macOS and, with Homebrew 6.0 or newer, on Linux.
 npm (macOS, Linux and Windows):
 
 ```sh
-npm i -g domsync
+npm i -g @domsync/cli
 ```
 
+Go (any platform with a Go toolchain, built from source):
+
+```sh
+go install github.com/neiromaster/domsync/cmd/domsync@latest
+```
+
+`go install` places the binary in `$GOBIN` (or `$HOME/go/bin`). The toolchain version is pinned in `go.mod`.
+
 Install script (macOS and Linux):
 
 ```sh
@@ -141,7 +149,9 @@ After a successful sync the `-` lines disappear from the local file: the domain
 
 Within each section, patterns are sorted; section order is otherwise preserved; the `other_section` is last. The local file is rewritten as a snapshot of the merged state, comments included. When the local file has sections, the router file contains `# [section]` headers followed by the same sorted patterns; a flat local file produces a flat router file. Router-only domains are added to `other_section`; if the local file already has that section it is reused, so a second one is never created.
 
-An empty local file, or a plan whose final list would be empty, is an error: domsync refuses to wipe the router.
+A missing local file is treated as an empty list, so the first run bootstraps the local snapshot from the router: every router domain is adopted and written locally. An empty local file with an empty router is a no-op. A plan whose final list would be empty while the router is not is an error: domsync refuses to wipe the router.
+
+Concurrent runs are refused. A run holds an exclusive lock on `<source.domains>.domsync.lock` from the moment the configuration is loaded until every write and post-write command has finished, so a cron job and a manual run cannot interleave their reads and writes. The lock file stays on disk after the run; the lock itself is released by the operating system when the process exits, including after a crash.
 
 ### Router file validation
 
@@ -185,12 +195,23 @@ YAML parsing is strict: unknown fields, multiple YAML documents and an empty fil
 
 Config validation runs before SSH is dialled: a missing key file, a missing `known_hosts`, or an empty `target.ssh_key` with `SSH_AUTH_SOCK` unset fails with exit code 1 before any connection is attempted.
 
+## Validation
+
+`domsync validate` loads the configuration and parses the local list without opening an SSH connection. It covers everything `domsync` checks before dialing the router — the config schema, path resolution, the existence of `target.ssh_key` and `target.known_hosts`, and the local list syntax — and nothing that needs the router.
+
+```sh
+domsync validate
+domsync --json validate
+```
+
+Exit codes follow the table below: `1` for a configuration or read error and `2` for an invalid local list. With `--json` the output is one object with `ok`, `config`, `domains`, `total` and `sections`; on failure it carries an `error` object with the exit code and message.
+
 ## Exit codes
 
 | Code | Meaning |
 |---|---|
 | `0` | Success, including "no changes". Also `--help` and `--version`. |
-| `1` | Usage or configuration error, local file read/write error, or log write error. |
+| `1` | Usage or configuration error, local file read/write error, log write error, or another run holding the local lock. |
 | `2` | Validation error in the local list or the router provider file, including `--strict` warnings, and an empty final list. |
 | `3` | SSH connection, authentication, host-key or remote read/write/verify error. |
 | `4` | Update error, including the Homebrew/npm refusal. |
@@ -221,10 +242,10 @@ domsync does not replace binaries installed by Homebrew or npm. The install meth
 
 ```text
 domsync установлен через Homebrew. Обновление: brew upgrade --cask domsync
-domsync установлен через npm. Обновление: npm i -g domsync@latest
+domsync установлен через npm. Обновление: npm i -g @domsync/cli@latest
 ```
 
-So update those installs with `brew upgrade --cask domsync` or `npm i -g domsync@latest`. The same refusal applies to `domsync update --check`, because install detection happens first. A standalone binary is replaced atomically after its archive has been checked against `checksums.txt`.
+So update those installs with `brew upgrade --cask domsync` or `npm i -g @domsync/cli@latest`. The same refusal applies to `domsync update --check`, because install detection happens first. A standalone binary is replaced atomically after its archive has been checked against `checksums.txt`.
 
 ## Output
 
@@ -251,7 +272,7 @@ domsync: 14 доменов, 3 секции
 
 ## Security
 
-- **Strict host key checking.** Every connection verifies the router key against `known_hosts` using `golang.org/x/crypto/ssh/knownhosts`, whether authentication uses a key file or the ssh-agent. An unknown key aborts with its SHA-256 fingerprint and a `ssh-keyscan` hint; a changed key aborts naming both the presented and the expected fingerprints. TOFU does not exist in v1.
+- **Strict host key checking.** Every connection verifies the router key against `known_hosts` using `golang.org/x/crypto/ssh/knownhosts`, whether authentication uses a key file or the ssh-agent. An unknown key aborts with its SHA-256 fingerprint and a `ssh-keyscan` hint; a changed key aborts naming both the presented and the expected fingerprints. TOFU does not exist in v1. The host key type is negotiated from the algorithms recorded for the host in `known_hosts`, so a host with only one recorded key type is not rejected merely because the server also offers another.
 - **Updates in v1 rely on SHA-256 only.** The binary checks the downloaded archive against `checksums.txt` from the release and extracts only the expected executable, rejecting path traversal. GoReleaser also publishes a cosign keyless signature bundle (`checksums.txt.sigstore.json`) and GitHub build attestations; these are for manual verification, not checked by the CLI. To verify a release by hand:
 
   ```sh
@@ -289,13 +310,17 @@ go test ./internal/domainlist -run '^$' -fuzz FuzzParseRemote -fuzztime 30s
 
 Tagging `v*` runs `.github/workflows/release.yml`. Maintainers need:
 
-- **No npm token.** The `npm` job requests `id-token: write` and `.github/scripts/publish-npm.sh` publishes the `domsync` launcher and the six `@domsync/<os>-<cpu>` platform packages through [trusted publishing](https://docs.npmjs.com/trusted-publishers/): npm exchanges the GitHub OIDC token for a short-lived credential and attaches provenance. Each of the seven package names needs a trusted publisher configured on npmjs.com (`neiromaster` / `domsync` / `release.yml`, no environment), or on the command line with `npm trust github <package> --file release.yml --repo neiromaster/domsync --allow-publish`.
-  npm only accepts a trusted publisher for a package that already exists, so the first release is published once by a maintainer: run `npm login` (2FA), then, after the GitHub release exists, `GITHUB_TOKEN=$(gh auth token) GITHUB_REF_NAME=<tag> GITHUB_REPOSITORY=neiromaster/domsync ./.github/scripts/publish-npm.sh`. After that, tag pushes publish without credentials.
+- **No npm token.** The `npm` job requests `id-token: write` and `.github/scripts/publish-npm.sh` publishes the `@domsync/cli` launcher and the six `@domsync/<os>-<cpu>` platform packages through [trusted publishing](https://docs.npmjs.com/trusted-publishers/): npm exchanges the GitHub OIDC token for a short-lived credential and attaches provenance. Each of the seven package names needs a trusted publisher configured on npmjs.com (`neiromaster` / `domsync` / `release.yml`, no environment), or on the command line with `npm trust github <package> --file release.yml --repo neiromaster/domsync --allow-publish`.
+  npm only accepts a trusted publisher for a package that already exists, so the first release is published once by a maintainer: run `npm login` (2FA), then, after the GitHub release exists, `GITHUB_TOKEN=$(gh auth token) GITHUB_REF_NAME=<tag> GITHUB_REPOSITORY=neiromaster/domsync ./.github/scripts/publish-npm.sh`. After that, tag pushes publish without credentials. The script generates provenance only inside GitHub Actions, so the bootstrap version is published without it.
 - A `neiromaster/homebrew-tap` repository and a `HOMEBREW_TAP_TOKEN` secret with write access to it, used by the cask publisher.
 - A **public** repository. The Scorecard workflow sets `publish_results: true`, which requires public visibility.
 
 GoReleaser builds the archives, `checksums.txt`, the cosign bundle and SBOMs, publishes the GitHub release and the Homebrew cask; the release workflow adds build provenance attestations and then publishes the npm packages.
 
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for the development setup, commit conventions and the pull request workflow. Report vulnerabilities privately as described in [SECURITY.md](SECURITY.md).
+
 ## License
 
 MIT

package/package.json

@@ -1 +1 @@
-{"name":"@domsync/darwin-x64","version":"1.0.0","os":"darwin","cpu":"x64","files":["domsync","domsync.exe"],"license":"MIT","repository":{"type":"git","url":"https://github.com/neiromaster/domsync"},"publishConfig":{"provenance":false,"access":"public"}}
+{"name":"@domsync/darwin-x64","version":"1.1.0","os":"darwin","cpu":"x64","files":["domsync","domsync.exe"],"license":"MIT","repository":{"type":"git","url":"git+https://github.com/neiromaster/domsync.git"},"publishConfig":{"provenance":true,"access":"public"}}