@everme/cli 0.1.0-beta.4 → 0.2.0

package/README.md

@@ -1,13 +1,13 @@
 # @everme/cli
 
-npm-distributed installer for [EverMe CLI](https://github.com/alwaysday1/everme). Detects your platform on install, downloads the matching pre-built binary from GitHub Releases, verifies its SHA-256 checksum, and exposes it as the `evercli` command.
+npm-distributed installer for [EverMe CLI](https://github.com/EverMind-AI/EverMe-CLI). Detects your platform on install, downloads the matching pre-built binary from GitHub Releases, verifies its SHA-256 checksum, and exposes it as the `evercli` command.
 
 ```bash
-npm install -g @everme/cli@beta
+npm install -g @everme/cli
 evercli --help
 
 # or, no install
-npx @everme/cli@beta --version
+npx @everme/cli --version
 ```
 
 ## What this package does
@@ -15,7 +15,7 @@ npx @everme/cli@beta --version
 `@everme/cli` is a thin Node-side installer + runner; the actual CLI is a pre-compiled binary downloaded on first install. On `npm install`:
 
 1. Detect platform / arch (darwin/linux/windows × amd64/arm64)
-2. Download the matching archive from `https://github.com/alwaysday1/everme/releases/download/v<version>/evercli_<os>_<arch>.{tar.gz|zip}`
+2. Download the matching archive from `https://github.com/EverMind-AI/EverMe-CLI/releases/download/v<version>/evercli_<os>_<arch>.{tar.gz|zip}`
 3. Verify SHA-256 against the `sha256sums.txt` shipped inside this npm package
 4. Extract and place the binary under the package's `bin/` directory
 5. The `evercli` shim (`scripts/run.js`) execs that binary with your args
@@ -26,7 +26,7 @@ If `postinstall` was skipped (some `npx` flows, restricted CI), the installer ru
 
 The installer tries download sources in this order:
 
-1. `https://github.com/alwaysday1/everme/releases/...` (canonical)
+1. `https://github.com/EverMind-AI/EverMe-CLI/releases/...` (canonical)
 2. The npm registry's binary mirror path (`<registry>/-/binary/everme-cli/...`), if your `npm_config_registry` is non-default
 3. `https://registry.npmmirror.com/-/binary/everme-cli/...` (always tried as final fallback)
 
@@ -41,11 +41,6 @@ export EVERCLI_API_BASE_URL=https://memory.acme-internal.com
 evercli auth login
 ```
 
-## Release channels
-
-- `@everme/cli@beta` — pre-release builds
-- `@everme/cli@latest` — stable releases
-
 ## License
 
 Apache-2.0.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everme/cli",
-  "version": "0.1.0-beta.4",
+  "version": "0.2.0",
   "description": "EverMe CLI — npm wrapper that downloads and runs the platform-native evercli binary on first use.",
   "license": "Apache-2.0",
   "bin": {
@@ -41,11 +41,11 @@
   "homepage": "https://everme.evermind.ai",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/alwaysday1/everme.git",
+    "url": "git+https://github.com/EverMind-AI/EverMe-CLI.git",
     "directory": "plugins/cli"
   },
   "bugs": {
-    "url": "https://github.com/alwaysday1/everme/issues"
+    "url": "https://github.com/EverMind-AI/EverMe-CLI/issues"
   },
   "publishConfig": {
     "access": "public",

package/scripts/install.js

@@ -25,12 +25,8 @@ const os = require("os");
 const crypto = require("crypto");
 const { execFileSync } = require("child_process");
 
-// Keep prerelease suffix (e.g. "0.1.0-beta.1") intact — GoReleaser tags
-// match package.json version verbatim, so stripping after `-` would build
-// TAG = cli/v0.1.0 for a 0.1.0-beta.1 publish and 404 against the real
-// cli/v0.1.0-beta.1 release.
 const VERSION = require("../package.json").version;
-const REPO = "alwaysday1/everme";
+const REPO = "EverMind-AI/EverMe-CLI";
 const NAME = "evercli";
 
 // Allowlist gates the *initial* request URL. curl --location follows redirects
@@ -182,16 +178,24 @@ function extractZipWindows(archivePath, destDir) {
 
 /**
  * Look up the SHA256 checksum for the archive from sha256sums.txt that ships
- * inside this npm package. If the file is missing (e.g. local dev pack), warn
- * and skip — the goreleaser CI is expected to copy sha256sums.txt before
- * publishing.
+ * inside this npm package. sha256sums.txt is listed in package.json::files,
+ * so a real `npm install` will always include it. A missing file is either
+ * a tampered tarball or a broken publish — in both cases skipping the check
+ * defeats the integrity model, so we hard-fail instead of warning.
+ *
+ * The workspace dev-install path is already short-circuited above
+ * (`__dirname.includes("/node_modules/")`), so this branch is only ever
+ * reached for installs that MUST verify.
  */
 function getExpectedChecksum(archive, checksumsDir) {
   const dir = checksumsDir || path.join(__dirname, "..");
   const checksumsPath = path.join(dir, "sha256sums.txt");
   if (!fs.existsSync(checksumsPath)) {
-    console.error("[WARN] sha256sums.txt not found, skipping checksum verification");
-    return null;
+    throw new Error(
+      `[SECURITY] sha256sums.txt missing at ${checksumsPath}; refusing to install ` +
+        `an unverified binary. The file ships with the npm package — its absence ` +
+        `indicates tampering or a broken release.`,
+    );
   }
   const content = fs.readFileSync(checksumsPath, "utf8");
   for (const line of content.split("\n")) {
@@ -207,8 +211,34 @@ function getExpectedChecksum(archive, checksumsDir) {
   throw new Error(`Checksum entry not found for ${archive}`);
 }
 
+/**
+ * Defends against zip-slip: an archive can ship `evercli` as a symlink to
+ * `/etc/passwd` (or any path outside tmpDir). copyFileSync follows symlinks,
+ * so without this check the extracted "binary" we ship to <pkg>/bin could
+ * be sourced from anywhere. lstat catches the symlink case (we reject non-
+ * regular files); realpath resolves what the path actually points at and we
+ * assert it stays within tmpDir.
+ */
+function assertInsideDir(dir, candidate) {
+  const stat = fs.lstatSync(candidate);
+  if (!stat.isFile()) {
+    throw new Error(
+      `[SECURITY] Extracted entry is not a regular file (mode=${stat.mode.toString(8)}); ` +
+        `refusing to install. Path: ${candidate}`,
+    );
+  }
+  const realDir = fs.realpathSync(dir);
+  const realCandidate = fs.realpathSync(candidate);
+  const sep = path.sep;
+  if (realCandidate !== realDir && !realCandidate.startsWith(realDir + sep)) {
+    throw new Error(
+      `[SECURITY] Extracted path escapes archive root: ${realCandidate} not under ${realDir}`,
+    );
+  }
+  return realCandidate;
+}
+
 function verifyChecksum(archivePath, expectedHash) {
-  if (expectedHash === null) return;
   // Stream to keep RSS constant; archives can be ~10MB+.
   const hash = crypto.createHash("sha256");
   const fd = fs.openSync(archivePath, "r");
@@ -260,11 +290,27 @@ function install() {
     if (isWindows) {
       extractZipWindows(archivePath, tmpDir);
     } else {
-      execFileSync("tar", ["-xzf", archivePath, "-C", tmpDir], { stdio: "ignore" });
+      // --no-same-owner / --no-same-permissions matter when postinstall
+      // runs as root (e.g. system-wide npm install) — without them, a
+      // hostile archive could set setuid/world-writable modes on the
+      // extracted binary. The flags are accepted by both GNU tar (Linux)
+      // and BSD tar (macOS). Modern tar already rejects ".." paths by
+      // default; the post-extraction realpath check below is the second
+      // line of defense against zip-slip via symlinks.
+      execFileSync(
+        "tar",
+        [
+          "-xzf", archivePath,
+          "-C", tmpDir,
+          "--no-same-owner",
+          "--no-same-permissions",
+        ],
+        { stdio: "ignore" },
+      );
     }
 
     const binaryName = NAME + (isWindows ? ".exe" : "");
-    const extractedBinary = path.join(tmpDir, binaryName);
+    const extractedBinary = assertInsideDir(tmpDir, path.join(tmpDir, binaryName));
     fs.copyFileSync(extractedBinary, dest);
     fs.chmodSync(dest, 0o755);
     console.log(`${NAME} v${VERSION} installed successfully`);
@@ -331,5 +377,6 @@ module.exports = {
   getExpectedChecksum,
   verifyChecksum,
   assertAllowedHost,
+  assertInsideDir,
   resolveMirrorUrls,
 };

package/scripts/run.js

@@ -22,6 +22,7 @@
 
 const { execFileSync } = require("child_process");
 const fs = require("fs");
+const os = require("os");
 const path = require("path");
 
 const NAME = "evercli";
@@ -83,6 +84,17 @@ if (args[0] === "install") {
   try {
     execFileSync(bin, args, { stdio: "inherit" });
   } catch (e) {
-    process.exit(e.status || 1);
+    // Preserve the child's exit semantics. execFileSync throws an Error
+    // whose `.status` is the exit code OR null when the child was killed
+    // by a signal (`.signal` is set instead). Mapping signal → 128+N
+    // matches POSIX shell convention so callers (CI, parent shells) can
+    // distinguish SIGINT (130) from a clean exit 1.
+    if (typeof e.status === "number") {
+      process.exit(e.status);
+    }
+    if (e.signal && os.constants.signals && os.constants.signals[e.signal]) {
+      process.exit(128 + os.constants.signals[e.signal]);
+    }
+    process.exit(1);
   }
 }

package/sha256sums.txt

@@ -1,6 +1,6 @@
-a6ab8e5b6b7d1d2dd93eef809b6d2523e864736815af67ccd065bd8b0f60d75f  evercli_darwin_amd64.tar.gz
-108bdd23380d51f02968bb89c3a7ca6763f6104b2b439b7ae21fe388c57158f7  evercli_darwin_arm64.tar.gz
-fe6e0d27158378406359c3362a04cc34573e12a1613437f0637b84dbe9d928f2  evercli_linux_amd64.tar.gz
-243ad1bf61c5f10ba19f053bbba0d92cd68545f5dd39846aa7618f6e2a2cf2ca  evercli_linux_arm64.tar.gz
-fc321f0b50e891e97391d2565addbf52f21b4049471629630b57169cffe56421  evercli_windows_amd64.zip
-b76bcf4ba7f42669459e1d352f05faa36d08cc86ae5c54069892e61db149fec0  evercli_windows_arm64.zip
+7bce844f7be7d8ae4515a0584fb602b30cb4a26ec16f4acd8bbcf6a554603626  evercli_darwin_amd64.tar.gz
+3d5fdf715d8ea348297c257775793d5174206a0ddf0fdf99ef20ce1b51256b8d  evercli_darwin_arm64.tar.gz
+d1a09150783a2af6ec0faf06cd219ef6f788dc91ac948add73e7bd41c47d7cdf  evercli_linux_amd64.tar.gz
+3f4ab86ebe5fc5bb81b6ad5caeb503a2b81eca1b89796272e3c8e443cd472f48  evercli_linux_arm64.tar.gz
+359a83fd8d08050633be64f183afe27531a647458fc55311af3387183e4e6cc8  evercli_windows_amd64.zip
+0e87459ddc517169111d944e6140a19e4a21bb094dbc2f9b9f1f51a99b80c56e  evercli_windows_arm64.zip