@workrail/cli 0.5.9 → 0.6.0

package/README.md

@@ -36,43 +36,43 @@ The CLI automatically downloads the correct binary for your platform during inst
 
 ## Quick Start
 
-1. **Authenticate** (opens browser):
+1. **Run guided setup**:
 
    ```bash
-   workrail auth login
+   workrail setup
    ```
 
-2. **Link your repository** to a Workrail project:
+   On a new installation, the same guided flow starts automatically in an
+   interactive terminal. It connects your account, links repositories to your
+   Default Project, offers optional GitHub context and autosync, and runs your
+   first sync.
 
-   ```bash
-   workrail link
-   ```
-
-3. **Sync your work** (captures commit metadata, not source code):
+2. **Sync your work** (captures metadata, not source code):
 
    ```bash
    workrail sync
    ```
 
-4. **Create an entry manually** (for non-code achievements):
+3. **Create an entry manually** (for non-code achievements):
 
    ```bash
    workrail entry add
    ```
 
-5. **Enable autosync** (optional - runs sync on a schedule):
+4. **Enable autosync** (optional - runs sync on a schedule):
 
    ```bash
    workrail autosync enable
    ```
 
-6. **View your dashboard** at [workrail.dev](https://workrail.dev)
+5. **View your dashboard** at [workrail.dev](https://workrail.dev)
 
 ## Common Commands
 
 | Command                     | Description                             |
 | --------------------------- | --------------------------------------- |
 | `workrail auth login`       | Authenticate via browser OAuth          |
+| `workrail setup`            | Run or revisit guided onboarding        |
 | `workrail auth status`      | Check authentication status             |
 | `workrail link`             | Link current repo to a Workrail project |
 | `workrail sync`             | Sync commits and create entries         |
@@ -86,7 +86,15 @@ The CLI automatically downloads the correct binary for your platform during inst
 
 ## Privacy
 
-Workrail syncs **metadata only** (commit hashes, timestamps, messages). Your source code never leaves your machine. [Read more about our privacy practices](https://workrail.dev/privacy).
+Workrail syncs **metadata only** (commit hashes, timestamps, messages). Your
+source code never leaves your machine.
+
+Optional GitHub context uses your locally authenticated GitHub CLI to add
+repository-scoped PR and issue titles, descriptions, labels, dates, links, and
+deterministic commit relationships. It does not request source, diffs, comments,
+reviews, checks, or authentication tokens.
+
+[Read more about our privacy practices](https://workrail.dev/privacy).
 
 ## Updating
 

package/bin/workrail.js

@@ -3,8 +3,11 @@
 const fs = require("node:fs");
 const path = require("node:path");
 const https = require("node:https");
-const crypto = require("node:crypto");
 const { spawn } = require("node:child_process");
+const {
+	loadPackagedChecksums,
+	verifyArtifact,
+} = require("../lib/integrity.cjs");
 
 function resolveBinaryName() {
 	const platform = process.platform;
@@ -19,6 +22,10 @@ function resolveBinaryName() {
 	return null;
 }
 
+function resolveHelperBinaryName(binaryName) {
+	return binaryName.replace(/^workrail-/, "workrail-gh-collector-");
+}
+
 const binName = resolveBinaryName();
 if (!binName) {
 	console.error(`Unsupported platform: ${process.platform} ${process.arch}`);
@@ -26,6 +33,14 @@ if (!binName) {
 }
 
 const binPath = path.join(__dirname, "native", binName);
+const helperName = resolveHelperBinaryName(binName);
+const helperPath = path.join(
+	__dirname,
+	"native",
+	process.platform === "win32"
+		? "workrail-gh-collector.exe"
+		: "workrail-gh-collector",
+);
 
 function getPackageVersion() {
 	const pkgPath = path.join(__dirname, "..", "package.json");
@@ -39,24 +54,6 @@ function getPackageVersion() {
 	return null;
 }
 
-function sha256File(filePath) {
-	const hash = crypto.createHash("sha256");
-	hash.update(fs.readFileSync(filePath));
-	return hash.digest("hex");
-}
-
-function parseChecksums(text) {
-	const map = new Map();
-	for (const line of text.split("\n")) {
-		const trimmed = line.trim();
-		if (!trimmed) continue;
-		const parts = trimmed.split(/\s+/);
-		if (parts.length < 2) continue;
-		map.set(parts[parts.length - 1], parts[0]);
-	}
-	return map;
-}
-
 function download(url) {
 	return new Promise((resolve, reject) => {
 		https
@@ -82,8 +79,11 @@ function download(url) {
 	});
 }
 
-async function ensureBinaryInstalled(binaryPath, binaryName) {
-	if (fs.existsSync(binaryPath)) return;
+async function ensureBinaryInstalled(binaryPath, binaryName, checksums) {
+	if (fs.existsSync(binaryPath)) {
+		verifyArtifact(binaryPath, binaryName, checksums);
+		return;
+	}
 
 	const version = getPackageVersion();
 	if (!version) {
@@ -96,7 +96,6 @@ async function ensureBinaryInstalled(binaryPath, binaryName) {
 		process.env.WORKRAIL_BINARY_BASE_URL ||
 		`https://cli.workrail.dev/workrail/v${version}`;
 	const binUrl = `${baseUrl}/${binaryName}`;
-	const checksumsUrl = `${baseUrl}/checksums.txt`;
 
 	fs.mkdirSync(path.dirname(binaryPath), { recursive: true });
 	console.error(
@@ -104,27 +103,18 @@ async function ensureBinaryInstalled(binaryPath, binaryName) {
 	);
 
 	const binaryBytes = await download(binUrl);
-	fs.writeFileSync(binaryPath, binaryBytes);
+	const temporaryPath = `${binaryPath}.download`;
+	fs.writeFileSync(temporaryPath, binaryBytes, { mode: 0o600 });
 
 	try {
-		const checksumsText = (await download(checksumsUrl)).toString("utf8");
-		const checksums = parseChecksums(checksumsText);
-		const expected = checksums.get(binaryName);
-		if (!expected) {
-			throw new Error(`No checksum entry found for ${binaryName}`);
-		}
-		const actual = sha256File(binaryPath);
-		if (actual !== expected) {
-			throw new Error(
-				`Checksum mismatch for ${binaryName}. expected=${expected} actual=${actual}`,
-			);
-		}
+		verifyArtifact(temporaryPath, binaryName, checksums);
+		fs.renameSync(temporaryPath, binaryPath);
 		if (process.platform !== "win32") {
 			fs.chmodSync(binaryPath, 0o755);
 		}
 	} catch (error) {
 		try {
-			fs.unlinkSync(binaryPath);
+			fs.unlinkSync(temporaryPath);
 		} catch {}
 		throw error;
 	}
@@ -140,7 +130,9 @@ function printInstallHelp() {
 
 async function main() {
 	try {
-		await ensureBinaryInstalled(binPath, binName);
+		const checksums = loadPackagedChecksums(path.join(__dirname, ".."));
+		await ensureBinaryInstalled(binPath, binName, checksums);
+		await ensureBinaryInstalled(helperPath, helperName, checksums);
 	} catch (error) {
 		console.error(
 			`[workrail] Failed to install native binary: ${error instanceof Error ? error.message : String(error)}`,
@@ -154,7 +146,13 @@ async function main() {
 		process.exit(1);
 	}
 
-	const child = spawn(binPath, process.argv.slice(2), { stdio: "inherit" });
+	const child = spawn(binPath, process.argv.slice(2), {
+		stdio: "inherit",
+		env: {
+			...process.env,
+			PATH: `${path.dirname(helperPath)}${path.delimiter}${process.env.PATH || ""}`,
+		},
+	});
 
 	child.on("error", (err) => {
 		console.error(`Failed to run Workrail binary: ${err.message}`);

package/lib/integrity.cjs

@@ -0,0 +1,59 @@
+const crypto = require("node:crypto");
+const fs = require("node:fs");
+const path = require("node:path");
+
+function parseChecksums(text) {
+	const checksums = new Map();
+	for (const [index, line] of text.split("\n").entries()) {
+		const trimmed = line.trim();
+		if (!trimmed) continue;
+		const match = trimmed.match(/^([a-fA-F0-9]{64})\s+\*?([^/\\]+)$/);
+		if (!match) {
+			throw new Error(`Invalid checksum manifest line ${index + 1}`);
+		}
+		checksums.set(match[2], match[1].toLowerCase());
+	}
+	if (checksums.size === 0) throw new Error("Checksum manifest is empty");
+	return checksums;
+}
+
+function loadPackagedChecksums(packageRoot) {
+	const manifestPath = path.join(packageRoot, "release-checksums.txt");
+	try {
+		return parseChecksums(fs.readFileSync(manifestPath, "utf8"));
+	} catch (error) {
+		throw new Error(
+			`Trusted release checksum manifest is unavailable: ${error instanceof Error ? error.message : String(error)}`,
+		);
+	}
+}
+
+function sha256File(filePath) {
+	const hash = crypto.createHash("sha256");
+	hash.update(fs.readFileSync(filePath));
+	return hash.digest("hex");
+}
+
+function verifyArtifact(filePath, artifactName, checksums) {
+	const expected = checksums.get(artifactName);
+	if (!expected) throw new Error(`No trusted checksum for ${artifactName}`);
+	const actual = sha256File(filePath);
+	if (actual !== expected) {
+		throw new Error(
+			`Checksum mismatch for ${artifactName}. expected=${expected} actual=${actual}`,
+		);
+	}
+}
+
+function verifyRequiredArtifacts(distRoot, artifactNames, checksums) {
+	for (const artifactName of artifactNames) {
+		verifyArtifact(path.join(distRoot, artifactName), artifactName, checksums);
+	}
+}
+
+module.exports = {
+	loadPackagedChecksums,
+	parseChecksums,
+	verifyArtifact,
+	verifyRequiredArtifacts,
+};

package/package.json

@@ -1,17 +1,20 @@
 {
 	"name": "@workrail/cli",
-	"version": "0.5.9",
+	"version": "0.6.0",
 	"description": "Workrail CLI - Track your engineering work and build a career record",
 	"license": "UNLICENSED",
 	"bin": {
 		"workrail": "bin/workrail.js"
 	},
 	"scripts": {
+		"prepack": "node ./scripts/prepare-release.mjs",
 		"postinstall": "node ./scripts/postinstall.mjs"
 	},
 	"files": [
 		"bin",
+		"lib",
 		"scripts",
+		"release-checksums.txt",
 		"README.md"
 	],
 	"publishConfig": {

package/release-checksums.txt

@@ -0,0 +1,10 @@
+6b5aa61e2bb1733a3b5c8a66684586c015c32c565f77ea51b6273c7d66d89c25  workrail-darwin-arm64
+20325c936a2032d5ee35fa02357e232ecd67c246e670319f78e980d3ea6ab0ac  workrail-darwin-x64
+2a51c9e382cb0c184dd42fabcc72e7e6d6589657934b73f8154191d19afcb0c3  workrail-gh-collector-darwin-arm64
+3393e24280097c2430d088d8c4c0407f0d7c912cdade416652b0e55b3c617737  workrail-gh-collector-darwin-x64
+cd98378b00252c1a3337a402961ddb80f76a4c826b7b40c45b5e76dde32e58cb  workrail-gh-collector-linux-arm64
+4f2d59e4e95d59d22cfb4ea6fc1533d9fde9b5964fa6eae91d0ab1b5857b5c14  workrail-gh-collector-linux-x64
+315139c4108cb6ae327fb57fecc6f1a0f4fdc5317c92674f5c189cef4ba03ee5  workrail-gh-collector-windows-x64.exe
+9b039c7d533c722f1230a9391015ec9daed98649d59bb85365003edbcccaadb0  workrail-linux-arm64
+d10d8af7660c2f92c5a69669023685086d431f0fabb95c5ba6e375f9b8748be9  workrail-linux-x64
+2402bafae25d263bf1a3aa667a124b07fe35a1857f2d45b0550b9e6ea8d35584  workrail-windows-x64.exe

package/scripts/postinstall.mjs

@@ -1,16 +1,40 @@
-import crypto from "node:crypto";
 import fs from "node:fs";
 import https from "node:https";
 import path from "node:path";
+import { createRequire } from "node:module";
 import { fileURLToPath } from "node:url";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
+const require = createRequire(import.meta.url);
+const {
+	loadPackagedChecksums,
+	verifyArtifact,
+} = require("../lib/integrity.cjs");
 
 const pkgPath = path.join(__dirname, "..", "package.json");
 const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
 const version = pkg.version;
 
+function isMonorepoSourceCheckout() {
+	const packageRoot = path.resolve(__dirname, "..");
+	const repositoryRoot = path.resolve(packageRoot, "../..");
+	try {
+		const repositoryPackage = JSON.parse(
+			fs.readFileSync(path.join(repositoryRoot, "package.json"), "utf8"),
+		);
+		return (
+			repositoryPackage.private === true &&
+			Array.isArray(repositoryPackage.workspaces) &&
+			repositoryPackage.workspaces.includes("packages/*") &&
+			fs.realpathSync(packageRoot) ===
+				path.join(fs.realpathSync(repositoryRoot), "packages", "cli-wrapper")
+		);
+	} catch {
+		return false;
+	}
+}
+
 const baseUrl =
 	process.env.WORKRAIL_BINARY_BASE_URL ||
 	`https://cli.workrail.dev/workrail/v${version}`;
@@ -28,6 +52,10 @@ function resolveBinaryName() {
 	return null;
 }
 
+function resolveHelperBinaryName(binaryName) {
+	return binaryName.replace(/^workrail-/, "workrail-gh-collector-");
+}
+
 function downloadToFile(url, dest) {
 	return new Promise((resolve, reject) => {
 		const file = fs.createWriteStream(dest);
@@ -44,45 +72,14 @@ function downloadToFile(url, dest) {
 	});
 }
 
-function downloadText(url) {
-	return new Promise((resolve, reject) => {
-		let data = "";
-		https
-			.get(url, (res) => {
-				if (res.statusCode !== 200) {
-					reject(new Error(`Download failed (${res.statusCode}) for ${url}`));
-					return;
-				}
-				res.setEncoding("utf8");
-				res.on("data", (chunk) => (data += chunk));
-				res.on("end", () => resolve(data));
-			})
-			.on("error", (err) => reject(err));
-	});
-}
-
-function sha256File(filePath) {
-	const hash = crypto.createHash("sha256");
-	const data = fs.readFileSync(filePath);
-	hash.update(data);
-	return hash.digest("hex");
-}
-
-function parseChecksums(text) {
-	const map = new Map();
-	for (const line of text.split("\n")) {
-		const trimmed = line.trim();
-		if (!trimmed) continue;
-		const parts = trimmed.split(/\s+/);
-		if (parts.length < 2) continue;
-		const hash = parts[0];
-		const file = parts[parts.length - 1];
-		map.set(file, hash);
+async function main() {
+	if (isMonorepoSourceCheckout()) {
+		console.log(
+			"[workrail] Source checkout detected; skipping native binary installation.",
+		);
+		return;
 	}
-	return map;
-}
 
-async function main() {
 	const binaryName = resolveBinaryName();
 	if (!binaryName) {
 		console.warn(
@@ -94,32 +91,36 @@ async function main() {
 	const nativeDir = path.join(__dirname, "..", "bin", "native");
 	fs.mkdirSync(nativeDir, { recursive: true });
 
-	const binUrl = `${baseUrl}/${binaryName}`;
-	const checksumsUrl = `${baseUrl}/checksums.txt`;
-	const targetPath = path.join(nativeDir, binaryName);
+	const checksums = loadPackagedChecksums(path.join(__dirname, ".."));
+	const helperBinaryName = resolveHelperBinaryName(binaryName);
+	const artifacts = [
+		{ remoteName: binaryName, targetName: binaryName },
+		{
+			remoteName: helperBinaryName,
+			targetName:
+				process.platform === "win32"
+					? "workrail-gh-collector.exe"
+					: "workrail-gh-collector",
+		},
+	];
 
 	console.log(
 		`📦 Installing Workrail CLI for ${process.platform} (${process.arch})...`,
 	);
-	await downloadToFile(binUrl, targetPath);
-
-	console.log("🔒 Verifying download...");
-	const checksums = parseChecksums(await downloadText(checksumsUrl));
-	const expected = checksums.get(binaryName);
-
-	if (!expected) {
-		throw new Error(`No checksum entry found for ${binaryName}`);
-	}
-
-	const actual = sha256File(targetPath);
-	if (actual !== expected) {
-		throw new Error(
-			`Checksum mismatch for ${binaryName}. expected=${expected} actual=${actual}`,
-		);
-	}
-
-	if (process.platform !== "win32") {
-		fs.chmodSync(targetPath, 0o755);
+	for (const artifact of artifacts) {
+		const targetPath = path.join(nativeDir, artifact.targetName);
+		const temporaryPath = `${targetPath}.download`;
+		try {
+			await downloadToFile(`${baseUrl}/${artifact.remoteName}`, temporaryPath);
+			console.log(`🔒 Verifying ${artifact.remoteName}...`);
+			verifyArtifact(temporaryPath, artifact.remoteName, checksums);
+			fs.renameSync(temporaryPath, targetPath);
+		} finally {
+			if (fs.existsSync(temporaryPath)) fs.unlinkSync(temporaryPath);
+		}
+		if (process.platform !== "win32") {
+			fs.chmodSync(targetPath, 0o755);
+		}
 	}
 
 	console.log("✅ Workrail CLI installed successfully!");

package/scripts/prepare-release.mjs

@@ -0,0 +1,53 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
+
+const require = createRequire(import.meta.url);
+const {
+	parseChecksums,
+	verifyRequiredArtifacts,
+} = require("../lib/integrity.cjs");
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const packageRoot = path.resolve(__dirname, "..");
+const repoRoot = path.resolve(packageRoot, "../..");
+
+const packageJson = JSON.parse(
+	fs.readFileSync(path.join(packageRoot, "package.json"), "utf8"),
+);
+const denoJson = JSON.parse(
+	fs.readFileSync(path.join(repoRoot, "apps/cli/deno.json"), "utf8"),
+);
+if (packageJson.version !== denoJson.version) {
+	throw new Error(
+		`CLI version mismatch: npm=${packageJson.version} deno=${denoJson.version}`,
+	);
+}
+
+const source = path.join(repoRoot, "apps/cli/dist/checksums.txt");
+const contents = fs.readFileSync(source, "utf8");
+const checksums = parseChecksums(contents);
+const required = [
+	"workrail-darwin-arm64",
+	"workrail-darwin-x64",
+	"workrail-linux-arm64",
+	"workrail-linux-x64",
+	"workrail-windows-x64.exe",
+	"workrail-gh-collector-darwin-arm64",
+	"workrail-gh-collector-darwin-x64",
+	"workrail-gh-collector-linux-arm64",
+	"workrail-gh-collector-linux-x64",
+	"workrail-gh-collector-windows-x64.exe",
+];
+for (const artifact of required) {
+	if (!checksums.has(artifact))
+		throw new Error(`Missing checksum for ${artifact}`);
+}
+verifyRequiredArtifacts(path.dirname(source), required, checksums);
+
+fs.writeFileSync(path.join(packageRoot, "release-checksums.txt"), contents, {
+	mode: 0o644,
+});
+console.log(
+	`Embedded trusted checksums for Workrail CLI v${packageJson.version}`,
+);