anomalift 0.1.0

package/README.md

@@ -0,0 +1,103 @@
+# anomalift (npm)
+
+Find the mistakes your coding agent repeats, and stop them.
+
+```sh
+npx anomalift
+```
+
+Or install it:
+
+```sh
+npm install -g anomalift
+```
+
+## What this package actually is
+
+A shim, and nothing more. It does not contain anomalift, and it cannot build
+it. The real program is a single Rust binary; this package downloads nothing at
+install time and runs no install scripts. What it does is declare one optional
+dependency per platform, each containing one prebuilt binary:
+
+| package                  | os       | cpu     | release asset                  |
+| ------------------------ | -------- | ------- | ------------------------------ |
+| `anomalift-darwin-arm64` | `darwin` | `arm64` | `anomalift-macos-arm64`        |
+| `anomalift-darwin-x64`   | `darwin` | `x64`   | `anomalift-macos-x86_64`       |
+| `anomalift-linux-x64`    | `linux`  | `x64`   | `anomalift-linux-x86_64`       |
+| `anomalift-linux-arm64`  | `linux`  | `arm64` | `anomalift-linux-arm64`        |
+| `anomalift-windows-x64`    | `win32`  | `x64`   | `anomalift-windows-x86_64.exe` |
+
+The names are unscoped rather than `@anomalift/*` because a scoped package
+needs the npm organisation to exist before the first publish, and publishes
+private unless every publish remembers `--access public`. Getting either wrong
+ships a wrapper whose dependencies nobody can install.
+
+npm reads the `os` and `cpu` fields, installs the one package that matches the
+machine, and silently skips the other four. `bin/anomalift.js` then resolves
+that package and execs the binary inside it, forwarding stdio and propagating
+the exit code. That last part matters: anomalift is meant to run in scripts and
+pre-commit hooks, and a swallowed non-zero exit turns "this found problems"
+into "this passed".
+
+You do not need Rust, and nothing is compiled on your machine.
+
+## If you would rather not involve npm
+
+The binary is the product; npm is one of three ways to get it.
+
+```sh
+# macOS / Linux
+curl -fsSL https://raw.githubusercontent.com/kailash16dev/Anomalift/main/install.sh | sh
+
+# Windows (PowerShell)
+irm https://raw.githubusercontent.com/kailash16dev/Anomalift/main/install.ps1 | iex
+```
+
+Both verify the published SHA-256 before installing. So does nothing about npm,
+which is worth knowing: `npm install` trusts the registry and its own lockfile
+integrity hashes instead.
+
+## Windows on ARM
+
+There is no native arm64 Windows build, so `anomalift-windows-x64` is what a
+Windows ARM machine gets. It runs under the OS's x64 emulation. `install.ps1`
+does the same thing and says so when it does.
+
+## Publishing a release
+
+One command, and it refuses rather than guesses:
+
+```sh
+gh release download v0.1.0 --dir dist        # the workflow's artifacts
+scripts/npm-release.sh --assets ./dist --dry-run
+scripts/npm-release.sh --assets ./dist
+```
+
+The release workflow also runs this on a tag when an `NPM_TOKEN` secret exists,
+so publishing by hand is the fallback rather than the routine.
+
+What the script checks before anything leaves the machine, because
+`npm publish` cannot be taken back — npm refuses to reuse a version number even
+after `npm unpublish`:
+
+- **every asset is present**, so a half-published release is impossible
+- **all six manifests agree on the version.** The wrapper pins its optional
+  dependencies exactly; a mismatch means npm installs no platform package at
+  all and every user gets "platform package is not installed"
+- **no binary carries local paths.** The compiler bakes absolute source paths
+  into panic locations, so a laptop build published as-is puts the
+  maintainer's home directory in front of everyone. The workflow remaps them
+- **the executable bit is set.** npm preserves the mode from the tarball, and a
+  binary published without it fails with `EACCES` on every machine, after the
+  version is already public
+- **each tarball contains exactly what it should** — the binary and the
+  manifest, nothing else
+- **platform packages publish first, wrapper last.** The other order leaves a
+  window where `npm install anomalift` resolves to a version whose
+  dependencies do not exist yet
+
+Then verify from an empty directory:
+
+```sh
+npx --yes anomalift@latest --version
+```

package/bin/anomalift.js

@@ -0,0 +1,166 @@
+#!/usr/bin/env node
+"use strict";
+
+// Shim. Finds the prebuilt binary that npm installed for this machine, runs it,
+// and gets out of the way.
+//
+// The whole point of shipping on npm is that `npx anomalift` works for someone
+// who has Node and nothing else - no Rust, no cargo, no compiler. So this file
+// must never try to build anything, and must never be more than a hop.
+//
+// CommonJS on purpose: a `bin` entry is resolved and run directly by npm, and
+// ESM here would break on any consumer whose package.json says "type": "module"
+// in the wrong direction. `require` always works.
+
+const fs = require("fs");
+const path = require("path");
+const { spawnSync } = require("child_process");
+
+// npm reads the `os` and `cpu` fields of each optional dependency and installs
+// only the one that matches, silently skipping the others - that is the whole
+// trick. It also means exactly one of these is ever present on disk, so we do
+// not choose between them, we just ask for the one this machine needs.
+//
+// Unscoped names on purpose: a scoped package needs the npm organisation to
+// exist before the first publish, and publishes as private unless every single
+// publish remembers `--access public`. Getting that wrong ships a root package
+// whose dependencies nobody can install.
+const PLATFORM_PACKAGES = {
+  "darwin-arm64": "anomalift-darwin-arm64",
+  "darwin-x64": "anomalift-darwin-x64",
+  "linux-x64": "anomalift-linux-x64",
+  "linux-arm64": "anomalift-linux-arm64",
+  "win32-x64": "anomalift-windows-x64",
+};
+
+const REPO = "kailash16dev/Anomalift";
+
+// process.arch reports the architecture of the *Node process*, not the CPU. An
+// x64 Node under Rosetta on Apple Silicon says "x64", and will then get the
+// x86_64 build - slower, but correct, and the alternative is running an arm64
+// binary that machine's Node cannot even spawn.
+const key = process.platform + "-" + process.arch;
+const pkgName = PLATFORM_PACKAGES[key];
+
+function fail(message) {
+  process.stderr.write("\nanomalift: " + message + "\n\n");
+  process.exit(1);
+}
+
+function installHint() {
+  return (
+    "Install the binary directly instead - it does not involve npm at all:\n\n" +
+    "  macOS / Linux   curl -fsSL https://raw.githubusercontent.com/" +
+    REPO +
+    "/main/install.sh | sh\n" +
+    "  Windows         irm https://raw.githubusercontent.com/" +
+    REPO +
+    "/main/install.ps1 | iex"
+  );
+}
+
+if (!pkgName) {
+  fail(
+    "no prebuilt binary exists for " +
+      key +
+      ".\n\n" +
+      "This package only wraps binaries produced by the release workflow; it\n" +
+      "cannot build from source. Supported: " +
+      Object.keys(PLATFORM_PACKAGES).join(", ") +
+      ".\n\n" +
+      "If you need " +
+      key +
+      ", build it with `cargo build --release` from the repo."
+  );
+}
+
+const exe = process.platform === "win32" ? "anomalift.exe" : "anomalift";
+
+let pkgRoot;
+try {
+  // Resolve the *manifest*, not the binary, and join the rest by hand.
+  // require.resolve throws the same MODULE_NOT_FOUND when the target file is
+  // absent, so resolving `<pkg>/bin/anomalift` directly cannot tell "npm never
+  // installed this package" apart from "this package was published without its
+  // binary in it" - and the second is a botched release needing a completely
+  // different fix. Resolving package.json, which is always there if the
+  // package is, separates the two.
+  //
+  // The platform packages deliberately have no "exports" field, which is what
+  // keeps this legal: an "exports" map seals off every subpath not listed in
+  // it, package.json included.
+  pkgRoot = path.dirname(require.resolve(pkgName + "/package.json"));
+} catch (err) {
+  // A stack trace here helps nobody. The realistic causes are all install-time
+  // and all have the same two fixes.
+  fail(
+    "the platform package " +
+      pkgName +
+      " is not installed.\n\n" +
+      "npm skips optional dependencies when installed with --no-optional or\n" +
+      "--omit=optional, and some CI caches restore a lockfile that predates the\n" +
+      "platform packages. Try:\n\n" +
+      "  npm install --force " +
+      pkgName +
+      "\n\n" +
+      installHint()
+  );
+}
+
+const binPath = path.join(pkgRoot, "bin", exe);
+
+if (!fs.existsSync(binPath)) {
+  fail(
+    "the platform package " +
+      pkgName +
+      " resolved but its binary is missing:\n  " +
+      binPath +
+      "\n\n" +
+      "That package was published without the binary copied in, or the install\n" +
+      "was interrupted. " +
+      installHint()
+  );
+}
+
+const result = spawnSync(binPath, process.argv.slice(2), {
+  stdio: "inherit",
+  // Do not use `shell: true`. Arguments here are file paths and globs from a
+  // user's command line, and a shell would re-interpret every quote and space
+  // in them - and would also be an injection hole in any script that builds an
+  // anomalift invocation from repository contents.
+  shell: false,
+});
+
+if (result.error) {
+  if (result.error.code === "EACCES") {
+    fail(
+      "the binary is not executable:\n  " +
+        binPath +
+        "\n\n" +
+        "npm normally preserves the executable bit from the published tarball.\n" +
+        "Fix it with `chmod +x " +
+        binPath +
+        "`, or reinstall."
+    );
+  }
+  fail("failed to run " + binPath + ": " + result.error.message);
+}
+
+// Exit code propagation is the reason this file is not a one-liner. anomalift
+// is meant to be used in scripts and pre-commit hooks, where a swallowed
+// non-zero exit turns "this found problems" into "this passed".
+if (result.signal) {
+  // A child killed by a signal exits with status === null, and reporting 0 for
+  // that would be a lie. Re-raise the same signal on ourselves so the parent
+  // shell sees a signalled death, which is what it would see without this shim
+  // in the middle. Windows has no real signals, so fall through to 1 if we are
+  // somehow still alive afterwards.
+  try {
+    process.kill(process.pid, result.signal);
+  } catch (err) {
+    /* not fatal - handled by the exit below */
+  }
+  process.exit(1);
+}
+
+process.exit(result.status === null ? 1 : result.status);

package/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "anomalift",
+  "version": "0.1.0",
+  "description": "Find the mistakes your coding agent repeats, and stop them. Wraps a prebuilt binary; no Rust toolchain required.",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kailash16dev/Anomalift.git"
+  },
+  "homepage": "https://github.com/kailash16dev/Anomalift#readme",
+  "bugs": {
+    "url": "https://github.com/kailash16dev/Anomalift/issues"
+  },
+  "keywords": [
+    "cli",
+    "code-review",
+    "static-analysis",
+    "coding-agent"
+  ],
+  "bin": {
+    "anomalift": "bin/anomalift.js"
+  },
+  "files": [
+    "bin/anomalift.js",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=16"
+  },
+  "optionalDependencies": {
+    "anomalift-darwin-arm64": "0.1.0",
+    "anomalift-darwin-x64": "0.1.0",
+    "anomalift-linux-x64": "0.1.0",
+    "anomalift-linux-arm64": "0.1.0",
+    "anomalift-windows-x64": "0.1.0"
+  }
+}