npm - ai-rulez - Versions diffs - 4.24.2 → 5.0.0 - Mend

ai-rulez 4.24.2 → 5.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/README.md CHANGED Viewed

@@ -5,7 +5,7 @@
 <h1 align="center">ai-rulez</h1>
 <p align="center">
-  <strong>A complete development workflow for AI coding tools</strong>
+  <strong>The standards-compliant lifecycle tool for agent knowledge and capabilities: author, generate, bundle, validate, govern, publish</strong>
 </p>
 <p align="center">
@@ -21,247 +21,133 @@
   <a href="https://goldziher.github.io/ai-rulez/examples/"><strong>Examples</strong></a>
 </p>
----
-## The Problem
-Every AI coding tool wants its own config: Claude needs `CLAUDE.md`, Cursor wants `.cursor/rules/`, Copilot expects `.github/copilot-instructions.md`. Each has different formats, frontmatter, and directory conventions. If you use more than one tool, you're maintaining duplicate rules that inevitably drift apart.
+---
-## The Solution
+## What it is
-Write your rules, context, skills, agents, and commands once in `.ai-rulez/`. Run `generate`. Get native configs for every tool you use.
+ai-rulez is a standards-compliant lifecycle tool for agent knowledge and capabilities. You keep rules, context, skills,
+agents, commands, hooks, permissions and MCP servers in one source of truth, `.ai-rulez/`, and ai-rulez takes them
+through the whole lifecycle:
-```bash
-npx ai-rulez@latest init && npx ai-rulez@latest generate
+```text
+author  ->  generate  ->  bundle  ->  lint / validate  ->  govern  ->  publish
 ```
-Prefer the project-level [`.config/` convention](https://github.com/pi0/config-dir)? `ai-rulez` auto-discovers `.config/ai-rulez/` as well, and `ai-rulez init --config-dir .config/ai-rulez` scaffolds it.
-ai-rulez generates correct, tool-native output for **15 platforms**: Claude, Cursor, Windsurf, Copilot, Gemini, Cline, Continue.dev, Codex, OpenCode, Hermes, Amp, Junie, Antigravity, Xum, and pi. Each preset respects the target tool's conventions — proper frontmatter, directory structure, file extensions, agent formats.
-For a tool that isn't built in, a custom preset can point at a declarative **provider spec** (`provider = ".ai-rulez/providers/my-tool.toml"`) and get the same full feature set as a built-in — root instructions file, skills/agents/commands, per-agent frontmatter, and MCP sidecars. See [Custom Presets](docs/configuration.md#provider-backed-presets-full-parity).
-Set `agents_md = true` to write `AGENTS.md` and `.agents/skills/` once for the tools that read them (Codex, Cursor, Copilot, Gemini, Claude through an `@AGENTS.md` shim, and more) instead of one copy per tool. Off by default. See [docs/agents-md.md](docs/agents-md.md).
-## Generate Plugins, Not Just Config
-ai-rulez doesn't only write config into _your_ repo — it also packages your project as **distributable plugins**. Run `ai-rulez generate --plugin` and the same `.ai-rulez/` source (skills, commands, agents, MCP servers) becomes installable **plugin bundles and a marketplace index** for Claude, Cursor, Codex, Gemini, Kimi, OpenCode, Factory, and Hermes Agent. An opt-in **Agent Plugins** runtime (`runtimes = ["agent-plugins"]`) additionally emits portable [Agent Plugins 1.0.0](https://agent-plugins.org) packages.
+| Stage | What happens | Commands | Docs |
+| ----- | ------------ | -------- | ---- |
+| **Author** | Rules, context, skills, agents, commands and checks as markdown in `.ai-rulez/`, with domains, profiles, roles and includes. `.ai-rulez/` is an [OKF](docs/okf.md) bundle: OKF is the internal format, and `init`, `add` and the MCP tools write it. A pre-OKF tree still loads, with a deprecation notice; `migrate okf` converts it. | `init`, `add`, `convert`, `import`, `migrate okf` | [Author](docs/configuration.md) |
+| **Generate** | Native files for 52 harnesses (Claude Code, Cursor, Codex, Copilot, Gemini CLI, OpenCode, Devin, Kilo and more), per project or per user. | `generate`, `doctor`, `clean` | [Harnesses](docs/harnesses.md) |
+| **Bundle** | Distributable plugin bundles, an Agent Plugins package, an OKF bundle, an ARD manifest, `AGENTS.md` and `llms.txt`. | `generate --plugin`, `export okf` | [Plugins](docs/plugins.md) |
+| **Lint and validate** | Content and security checks with stable `AR` codes, plus each standard's own schema or rules. | `validate`, `scan`, `okf validate`, `verify` | [Validate](docs/strict-validation.md) |
+| **Govern** | A content-pinning lock, reviewer approvals, Sigstore signing, an organization policy and an SBOM. | `lock`, `approve`, `sign`, `verify --attestation`, `sbom` | [Trust model](docs/trust-model.md) |
+| **Publish** | Reproducible, checksummed release artifacts to GitHub releases, npm, OCI and marketplaces. | `publish` | [Publish](docs/publish.md) |
+## Standards
+The claim is "standards compliant", so each format ai-rulez names is generated or bundled from the same sources and
+checked against that standard's own schema or rules. A standard is marked **supported** when the code generates it and
+validates it today, and **planned** when it does not yet.
+[docs/standards.md](docs/standards.md) carries the pinned spec version, the conformance test suite and the known gaps for
+each row, and is the source of truth for test status.
+| Standard | Status | Generate / bundle | Lint / validate |
+| -------- | ------ | ----------------- | --------------- |
+| [OKF](docs/okf.md) (Open Knowledge Format, v0.2), the internal format of `.ai-rulez/` | supported | `export okf`, the `okf` preset | `okf validate` |
+| [Agent Plugins](docs/agent-plugins.md) (agent-plugins.org) | supported | `generate --plugin`, `publish --emit agent-plugins` | `validate --strict` (AR9O codes) |
+| [ARD](docs/ard.md) (Agentic Resource Discovery, a proposal) | supported | `publish --emit ard` | `validate` (entry schema, URN grammar) |
+| [Agent Skills](docs/skills.md) (agentskills.io) | supported | `generate` | `validate` (frontmatter checks; partial) |
+| [AGENTS.md](docs/agents-md.md) | supported | `generate` | `validate` |
+| [llms.txt](docs/llms-txt.md) | supported | the `llms-txt` preset | `validate` |
+| MCP server config | supported | `generate` | `validate` (partial) |
+| MCP server card | planned | not generated | none |
+| [CycloneDX / SPDX SBOM](docs/sbom.md) | supported | `sbom` | `sbom --check` |
+| [in-toto / DSSE / Sigstore](docs/signing.md) | supported | `sign` | `verify --attestation` |
+| [OpenTelemetry (OTLP)](docs/telemetry.md) | supported | `telemetry export --to otlp` | not applicable |
+| "Agent bundle" | planned | spec to be confirmed | spec to be confirmed |
+## Quick start
 ```bash
-ai-rulez generate --plugin           # write plugin bundles + marketplace.json
-ai-rulez generate --plugin --dry-run # preview
-ai-rulez verify --plugin             # prove committed output matches its sources
+npx ai-rulez@latest init                 # author: scaffold .ai-rulez/ with config.toml
 ```
-Write MCP launch commands and hooks once with the canonical `${PLUGIN_ROOT}` variable — a hook either runs a command already on the consumer’s machine or bundles a project script into the plugin’s `hooks/` directory, so it works in a fresh clone — and each runtime gets its own manifest with the variable and hook format rewritten to fit. Hermes generation emits both a project plugin and a buildable Python entry-point package. Use `plugin.content_root` to keep distributable skills separate from contributor governance. Supports single-plugin repos and monorepos (`[marketplace].members`), plus a Claude statusline passthrough. See [Authoring Plugins](docs/plugins.md).
-## What Ships Out of the Box
-ai-rulez isn't just a config generator. It ships with **33 builtin domains** containing opinionated rules, skills, agents, and workflows that establish a professional development baseline immediately.
-### Auto-Included Domains
-Set `builtins` in your config — `true` for every domain, or a list to pick — and these seven come along
-without being named, unless you exclude one with `!`. Omit the `builtins` field entirely and no builtin
-content is loaded at all.
-Each one ships **always-on content** (rules, or context such as the agent roster) that is read on every
-request — rules in `.claude/rules/` under the default split mode (inlined into `CLAUDE.md` with
-`[rules] mode = "inline"`), context and the agent roster in `CLAUDE.md` — and some also ship
-**on-demand skills**, whose body costs nothing until the assistant loads it.
-| Domain               | Always-on rules                                                                                                            | On-demand skills                        |
-| -------------------- | -------------------------------------------------------------------------------------------------------------------------- | --------------------------------------- |
-| **ai-governance**    | No AI signatures in commits. Concise communication. Read before write. Minimal changes. Systematic debugging. Verification before claiming success. Critical review of subagent output. Reasoning stated for non-obvious decisions. | —                                       |
-| **git-workflow**     | Atomic commits. Conventional commit messages. Safe operations. Branch hygiene.                                             | —                                       |
-| **security**         | Secrets handling. Input validation. Least privilege.                                                                       | `owasp-quick-reference`, `dependency-awareness` |
-| **token-efficiency** | Context preservation. Output awareness.                                                                                    | `task-runner`, `incremental-approach`   |
-| **testing**          | Tests ship with the behaviour change; failing test before a bug fix; full suite before committing.                         | `tdd-workflow`, `testing-conventions`   |
-| **code-quality**     | —                                                                                                                          | `code-quality-standards`, `error-handling` |
-| **agent-delegation** | Multi-agent coordination and delegation patterns (emitted as context).                                                      | —                                       |
-### Builtin Agents
-Specialized agents ready to use as subagents:
-| Agent                | Domain        | Model  | What it does                                                                     |
-| -------------------- | ------------- | ------ | -------------------------------------------------------------------------------- |
-| **code-reviewer**      | ai-governance     | sonnet | Reviews changes for correctness, security, and conventions. Reports by severity. |
-| **test-writer**        | testing           | sonnet | Writes tests following strict TDD. Fails first, then implements.                 |
-| **security-auditor**   | security          | sonnet | Audits dependencies, scans for CVEs, reviews input validation.                   |
-| **docs-writer**        | ai-governance     | sonnet | Writes clear, concise documentation. No fluff.                                   |
-| **devops-engineer**    | cicd              | sonnet | CI/CD pipelines, GitHub Actions, Docker, deployment automation.                  |
-| **release-engineer**   | cicd              | sonnet | Version management, changelogs, multi-registry publishing.                       |
-| **ffi-engineer**       | polyglot-bindings | sonnet | Native FFI and cross-language binding work.                                      |
-| **polyglot-architect** | polyglot-bindings | opus   | Cross-language architecture and binding design.                                  |
-### Opt-in Domains
-Enable these based on your stack:
-**Languages** (10): `rust`, `python`, `typescript`, `go`, `java`, `ruby`, `php`, `elixir`, `csharp`, `r`
-**Bindings** (10): `pyo3`, `napi-rs`, `magnus`, `ext-php-rs`, `rustler`, `wasm`, `jni-rs`, `extendr`, `cgo`, `vite-plus`
-**Operational**: `cicd`, `docker`, `observability`, `documentation`, `polyglot-bindings`, `default-commands`
 ```toml
 # .ai-rulez/config.toml
-builtins = ["rust", "python", "pyo3", "cicd", "docker", "default-commands"]
-```
-Anything scoped to one technology or one activity is emitted as an **on-demand Agent Skill**
-(`.claude/skills/<id>/SKILL.md`) rather than inlined into `CLAUDE.md`, so the always-loaded file stays
-small and the guidance arrives only when it is relevant: every language and binding domain,
-`polyglot-bindings`, `security`'s OWASP and dependency references, all of `code-quality`, most of
-`testing`, `token-efficiency`'s `task-runner` and `incremental-approach`, and the whole of `docker` and
-`observability`. What stays inline is behavioural governance that has to land before the first file is
-read — `ai-governance`, `git-workflow`, `security`'s secrets and boundary rules, and the one `testing`
-rule that says tests ship with the change. `!domain` and `!domain/name` exclusions work for skill
-entries too, so an exclusion written against a rule keeps working after it becomes a skill.
-## Content Types
-| Type         | Purpose                        | Example                                |
-| ------------ | ------------------------------ | -------------------------------------- |
-| **Rules**    | What AI must/must not do       | Security standards, coding conventions |
-| **Context**  | What AI should know            | Architecture docs, domain knowledge    |
-| **Skills**   | Reusable prompts and workflows | Deployment checklist, review protocol  |
-| **Agents**   | Specialized AI personas        | Code reviewer, performance engineer    |
-| **Commands** | Slash commands across tools    | `/review`, `/deploy`, `/test`          |
-## Organization at Scale
-ai-rulez scales from solo projects to large organizations:
-**Domains** — Group content by feature, language, or team:
-```text
-.ai-rulez/domains/backend/rules/
-.ai-rulez/domains/frontend/rules/
-```
-**Profiles** — Generate different configs for different audiences:
-```toml
-[profiles]
-backend = ["backend", "database"]
-frontend = ["frontend", "ui"]
+presets = ["claude", "cursor", "codex", "copilot", "gemini"]   # any of the 52 harnesses
 ```
-**Remote Includes** — Share rules across repositories:
-```toml
-[[includes]]
-name = "company-standards"
-source = "https://github.com/company/ai-rules.git"
-merge_strategy = "local-override"
+```bash
+npx ai-rulez@latest generate             # generate: write native files for each preset
+npx ai-rulez@latest validate --strict    # validate: content and security checks, warnings fail
+npx ai-rulez@latest lock                 # govern: pin includes, skills and authored content in ai-rulez.lock
+npx ai-rulez@latest export okf           # bundle: an OKF bundle of your knowledge in docs/okf
 ```
-Include sources can use a bare/flattened layout — expose `rules/`, `context/`, `skills/`, `agents/`
-directly (at the repo root or a sub-path via `path = "modules/core"`) with no `.ai-rulez/` wrapper.
-Recommended for shared, skill-first modules.
-**Native rules folders** — Rules are written to each tool's own rules folder (`.claude/rules`, `.cursor/rules`, `.github/instructions`, `.windsurf/rules`, ...) with native `paths`/`globs` frontmatter, so path-scoped rules load only when relevant. `split` is the default since 4.22.0; set `[rules] mode = "inline"` to keep rules in the root files. See [docs/rules.md](docs/rules.md).
-**Local configuration** — Personal, machine-local content and settings that never get committed:
+Day-to-day:
 ```bash
-ai-rulez add rule my-scratch-notes --local   # → .ai-rulez/local/rules/, generates .claude/rules/my-scratch-notes.local.md
-ai-rulez local set presets '["codex", "!cursor"]'   # → .ai-rulez/config.local.toml overlay
+ai-rulez generate --watch                # regenerate on every change to .ai-rulez/
+ai-rulez generate --check                # CI: exit 2 when committed outputs differ from the sources
+ai-rulez doctor                          # read-only diagnostics: drift, removed presets, missing tools
+ai-rulez generate --user                 # the same, for your home directory (~/.claude, ~/.codex, ...)
 ```
-`.ai-rulez/local/`, the `config.local.*` overlay and the generated `*.local.*` outputs are gitignored
-unconditionally, and `generate` refuses to let local config change tracked shared files (use
-`--no-local` for the teammate view). See [docs/local-overrides.md](docs/local-overrides.md).
+Prefer the project-level [`.config/` convention](https://github.com/pi0/config-dir)? ai-rulez also discovers
+`.config/ai-rulez/`, and `ai-rulez init --config-dir .config/ai-rulez` scaffolds it.
-**Reasoning effort across providers** — Tune how hard each AI tool thinks:
-```yaml
-# .ai-rulez/agents/security-reviewer.md
----
-name: security-reviewer
-description: Reviews code for security regressions
-effort: high
----
-```
+## Bundle and publish
-```toml
-# .ai-rulez/config.toml
-[defaults]
-effort = "medium"  # global default for every supported preset
+Bundling and publishing need a `[plugin]` block (`name`, `version` and `description`) in `config.toml`:
-[defaults.effort_by_preset]
-codex = "high"     # overrides the global default for Codex
-claude = "xhigh"   # …and for Claude
+```bash
+ai-rulez generate --plugin               # plugin bundles and a marketplace index from the [plugin] block
+ai-rulez export okf                      # an OKF bundle of your rules, context and skills (docs/okf)
+ai-rulez publish --emit agent-plugins --emit ard --dry-run
+ai-rulez publish --to github-release --execute --yes
 ```
-Accepted values: `low`, `medium`, `high`, `xhigh`, `max`, `inherit`. ai-rulez emits the right field per preset:
-- **Claude** — `effort` in `.claude/agents/*.md` frontmatter (per-agent)
-- **Codex** — `model_reasoning_effort` in `.codex/config.toml` and `.codex/agents/*.toml`
-- **Amp** — `amp.anthropic.effort` in `.amp/settings.json` (global)
-- **Windsurf** — `reasoning_effort` in `.windsurf/agents/*.md` frontmatter (per-agent)
-- **Opencode** — `variant` in `.opencode/agents/*.md` frontmatter (per-agent); a separate key beside the agent's `provider/model`
-- **Xum** — `ai.thinkingLevel` in `.xum/agents/*.md` frontmatter (per-agent)
-- **pi** — `thinking` in `.pi/agents/*.md` frontmatter (per-agent)
-Each preset maps the value to its own vocabulary; tools without a documented config surface (Cursor, Copilot, Gemini, etc.) are silently skipped. See [docs/configuration.md](docs/configuration.md#defaults) for the full mapping table.
+`publish` runs a preflight first (`validate --strict`, `lock --check`, `verify --plugin`, a secret scan and the policy
+gates), writes a byte-reproducible tar.gz with `SHA256SUMS`, and uploads only when you pass `--execute --yes`. See
+[Publish](docs/publish.md) and [Authoring plugins](docs/plugins.md).
-**Per-preset model selection for subagents** — Model strings differ per provider, so the same agent can declare a different model for each preset it targets:
-```yaml
-# .ai-rulez/agents/research-helper.md
----
-name: research-helper
-description: Multi-provider research subagent
-claude_model: opus
-copilot_model: gpt-5
-cursor_model: claude-3.7-sonnet
----
-```
+Pi packages are opt-in with `[plugin] runtimes = ["pi"]`: skills and prompt templates can be installed
+from Git or npm. Publishing to npm preserves Pi and OpenCode runtime metadata while using the
+configured scope and plugin name for the released package.
-```toml
-# .ai-rulez/config.toml — project-wide defaults
-[defaults.model_by_preset]
-claude = "sonnet"   # used when an agent doesn't set its own claude_model
-copilot = "gpt-5"
-```
+## Validate
-Per-agent `<preset>_model` wins over `defaults.model_by_preset`; the legacy single `model:` field on an agent is the lowest-priority fallback for backward compatibility.
-**Installed Skills** — Pull reusable skills from external repos:
-```toml
-[[installed_skills]]
-name = "kreuzberg"
-source = "https://github.com/kreuzberg-dev/kreuzberg"
+```bash
+ai-rulez validate                        # config plus content checks, exit 2 on findings
+ai-rulez validate --explain AR001        # what a rule checks and how to suppress it
+ai-rulez validate --format sarif --output ai-rulez.sarif
+ai-rulez okf validate docs/okf           # lint any OKF bundle, ai-rulez's or a third party's
+ai-rulez generate --check                # generated files still match their sources
 ```
-**Committing generated output** — every generated file carries a `Content-Hash` and a `Source-Hash` line. `Source-Hash` covers the whole source set, so editing one skill rewrites a line in every generated file. If you commit the output, keep headers stable:
+## Govern
-```toml
-[header]
-hashes = "content"   # "full" (default) | "content" (Content-Hash only) | "none"
+```bash
+ai-rulez lock                            # pin remote includes, installed skills and authored content
+ai-rulez approve --list                  # what still needs a reviewer's approval
+ai-rulez sign --lock                     # a Sigstore bundle (DSSE over an in-toto statement) for the lock
+ai-rulez verify --attestation            # check it offline against the [signing] policy
+ai-rulez sbom -o ai-bom.cdx.json         # CycloneDX 1.6 (or --type spdx-json)
 ```
-## MCP Server
+An organization [policy](docs/policy.md) sets tighten-only floors a repository cannot loosen. See the
+[trust model](docs/trust-model.md).
-ai-rulez includes a built-in MCP server with 36 tools that lets AI assistants manage their own governance. Add rules, update context, generate configs — all programmatically.
+## Operate
-```toml
-[[mcp_servers]]
-name = "ai-rulez"
-command = "npx"
-args = ["-y", "ai-rulez@latest", "mcp"]
-```
+- **MCP server.** `ai-rulez mcp` lets an assistant manage the configuration; with `--serve-skills` it serves skills on
+  demand. See [MCP server](docs/mcp-server.md).
+- **Telemetry.** Item-load records with an optional OTLP export. See [telemetry](docs/telemetry.md).
+- **Evals and improve.** `ai-rulez eval` scores skills; `improve` (experimental) optimizes them behind a held-out eval
+  gate. See [evals](docs/evals.md) and [improve](docs/improve.md).
+- **Cost and inventory.** `tokens`, `cost`, `catalog` and `search` report what the configuration contains and costs.
-Or let `generate` add it for you. With `[mcp] self_server = true` the entry is merged into the project `.mcp.json`, pinned to the running ai-rulez version, without touching hand-authored servers or `.claude/settings.json`:
-```toml
-[mcp]
-self_server = true
-```
+Existing project on 4.x? Run `ai-rulez migrate v5 --dry-run`, then see [Migrating to v5](docs/migration-v5.md).
 ## Installation
@@ -323,6 +209,17 @@ pipx install ai-rulez
 </details>
+<details>
+<summary><strong>Go</strong></summary>
+```bash
+go install github.com/Goldziher/ai-rulez/v5/cmd/ai-rulez@latest
+```
+The module path needs `/v5`; without it `@latest` resolves to an old build.
+</details>
 <details>
 <summary><strong>pre-commit hook</strong></summary>
@@ -331,7 +228,7 @@ Add to `.pre-commit-config.yaml`:
 ```yaml
 repos:
   - repo: https://github.com/Goldziher/ai-rulez
-    rev: v4.24.2
+    rev: v5.0.0
     hooks:
       - id: ai-rulez-recursive # generate outputs across the repo
       - id: ai-rulez-validate # dry-run validation
@@ -346,13 +243,14 @@ Available hook ids: `ai-rulez-validate`, `ai-rulez-generate`,
 <summary><strong>poly hook source</strong></summary>
 Add ai-rulez as a managed source in your existing `poly.toml` and select the hooks your
-repository needs. This requires AI-Rulez 4.9.0+ and Poly 0.14.0+:
+repository needs. This requires Poly 0.14.0+; pin `revision` to the AI-Rulez release you want (the
+hooks run that release):
 ```toml
 [[hooks.sources]]
 id = "ai-rulez"
 git = "https://github.com/Goldziher/ai-rulez.git"
-revision = "v4.24.2"
+revision = "v5.0.0"
 hooks = ["ai-rulez-recursive", "ai-rulez-plugin-verify"]
 ```
@@ -387,12 +285,12 @@ pre-commit:
 ```
 Hooks run on each developer's machine and would otherwise load that developer's gitignored
-`config.local.*` overlay and `.ai-rulez/local/` content. Pass `--no-local` (also accepted by `validate`
+`config.local.toml` overlay and `.ai-rulez/local/` content. Pass `--no-local` (also accepted by `validate`
 and `tokens`) where a hook should see only the shared configuration, as a teammate or CI does. If you do
 not, `generate` still refuses to write local-derived changes into tracked shared files; never add
 `--allow-local-drift` to a hook. See [Poly hooks guide](docs/poly-hooks.md#machine-local-configuration-in-hooks).
-In a monorepo, `ai-rulez generate --recursive` and `ai-rulez validate --recursive` (`-r`) process every nested
+In a monorepo, `ai-rulez generate --recursive` and `ai-rulez validate --recursive` process every nested
 `.ai-rulez/` root, report all failures, and exit non-zero if any root failed.
 Or run `ai-rulez init --setup-hooks` while initializing a repo to wire hooks in automatically.

package/install.js CHANGED Viewed

@@ -42,6 +42,22 @@ async function getExpectedChecksum(checksumPath, filename) {
   }
 }
+// Fails closed: a missing checksums file, a missing entry, or a mismatch all
+// throw, so an archive is never trusted without a verified digest.
+async function verifyArchiveChecksum(archivePath, checksumPath, archiveName) {
+  if (!fs.existsSync(checksumPath)) {
+    throw new Error("Checksum verification failed: checksums.txt is unavailable");
+  }
+  const expectedHash = await getExpectedChecksum(checksumPath, archiveName);
+  if (!expectedHash) {
+    throw new Error(`Checksum verification failed: no checksum for ${archiveName} in checksums.txt`);
+  }
+  const actualHash = await calculateSHA256(archivePath);
+  if (actualHash !== expectedHash) {
+    throw new Error(`Checksum verification failed. Expected: ${expectedHash}, Got: ${actualHash}`);
+  }
+}
 function getPlatform() {
   const platform = process.platform;
   const arch = process.arch;
@@ -339,26 +355,19 @@ async function install(isPostInstall = false) {
     const checksumPath = path.join(__dirname, "checksums.txt");
     try {
       await downloadBinary(checksumUrl, checksumPath);
-    } catch (_checksumError) {
-      console.warn("Warning: Could not download checksums, skipping verification");
+    } catch (checksumError) {
+      throw new Error(`Could not download checksums.txt, refusing to install unverified: ${checksumError.message}`);
     }
     await downloadBinary(downloadUrl, archivePath);
-    if (fs.existsSync(checksumPath)) {
-      console.log("Verifying checksum...");
-      const expectedHash = await getExpectedChecksum(checksumPath, archiveName);
-      if (expectedHash) {
-        const actualHash = await calculateSHA256(archivePath);
-        if (actualHash !== expectedHash) {
-          throw new Error(
-            `Checksum verification failed. Expected: ${expectedHash}, Got: ${actualHash}`,
-          );
-        }
-        console.log("✓ Checksum verified");
-      }
-      fs.unlinkSync(checksumPath);
+    console.log("Verifying checksum...");
+    try {
+      await verifyArchiveChecksum(archivePath, checksumPath, archiveName);
+    } finally {
+      fs.rmSync(checksumPath, { force: true });
     }
+    console.log("✓ Checksum verified");
     console.log("Extracting binary...");
@@ -379,6 +388,14 @@ async function install(isPostInstall = false) {
         fs.unlinkSync(binaryPath);
       }
       fs.renameSync(extractedPath, binaryPath);
+      // A Windows archive may ship liter_llm_ffi.dll beside ai-rulez.exe; the loader needs it there.
+      if (os === "windows") {
+        for (const name of fs.readdirSync(tempExtractDir)) {
+          if (name.toLowerCase().endsWith(".dll")) {
+            fs.renameSync(path.join(tempExtractDir, name), path.join(binDir, name));
+          }
+        }
+      }
     }
     fs.rmSync(tempExtractDir, { recursive: true, force: true });
@@ -452,6 +469,7 @@ if (typeof module !== "undefined" && module.exports) {
     extractArchive,
     calculateSHA256,
     getExpectedChecksum,
+    verifyArchiveChecksum,
     install,
   };
 }

package/package.json CHANGED Viewed

@@ -1,39 +1,63 @@
 {
   "name": "ai-rulez",
-  "version": "4.24.2",
-  "description": "Complete AI development workflow for 15 AI coding tools. Ships with builtin rules, agents, and conventions. Generate native configs for Claude, Cursor, Copilot, Windsurf, Gemini, Codex and more from a single source.",
+  "version": "5.0.0",
+  "description": "Standards-compliant lifecycle tool for agent knowledge and capabilities. Author rules, skills, agents and MCP servers once; generate for 52 harnesses; bundle as OKF, Agent Plugins and ARD; validate against each standard; govern with signing, approvals and policy; publish.",
   "keywords": [
+    "agent-plugins",
+    "agent-skills",
     "agents",
+    "agents-md",
     "ai",
     "ai-assistant",
     "ai-development",
     "ai-rules",
+    "ard",
     "assistant-configuration",
     "automation",
+    "baz",
     "claude",
+    "claude-code",
     "cli",
     "cline",
     "code-generation",
+    "code-review",
+    "codex",
     "config",
     "configuration",
-    "continue-dev",
     "copilot",
     "cursor",
+    "cyclonedx",
     "developer-tools",
     "development",
+    "devin",
     "gemini",
     "generator",
     "git-hooks",
     "go",
     "golang",
+    "governance",
+    "hooks",
+    "in-toto",
+    "lifecycle",
+    "llms-txt",
     "mcp",
     "model-context-protocol",
     "monorepo",
+    "okf",
+    "opencode",
+    "permissions",
     "pre-commit",
     "presets",
     "productivity",
+    "publish",
     "rules",
-    "windsurf",
+    "sbom",
+    "sigstore",
+    "skills",
+    "spdx",
+    "standards",
+    "supply-chain",
+    "validation",
     "workflow"
   ],
   "homepage": "https://goldziher.github.io/ai-rulez/",