archgate 0.39.0 → 0.40.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "archgate",
-  "version": "0.39.0",
+  "version": "0.40.0",
   "description": "Enforce Architecture Decision Records as executable rules — for both humans and AI agents",
   "keywords": [
     "adr",
@@ -24,10 +24,10 @@
     "url": "git+https://github.com/archgate/cli.git"
   },
   "bin": {
-    "archgate": "bin/archgate.cjs"
+    "archgate": "shims/npm/archgate.cjs"
   },
   "files": [
-    "bin/archgate.cjs"
+    "shims/npm/archgate.cjs"
   ],
   "os": [
     "darwin",
@@ -67,11 +67,11 @@
     "czg": "1.13.1",
     "fast-check": "4.8.0",
     "inquirer": "13.4.3",
-    "knip": "6.14.1",
+    "knip": "6.14.2",
     "meriyah": "7.1.0",
     "oxfmt": "0.51.0",
     "oxlint": "1.66.0",
-    "posthog-node": "5.35.0",
+    "posthog-node": "5.35.1",
     "zod": "4.4.3"
   },
   "peerDependencies": {

package/{bin → shims/npm}/archgate.cjs

@@ -2,24 +2,32 @@
 "use strict";
 
 const { execFileSync, execSync } = require("child_process");
+const crypto = require("crypto");
 const https = require("https");
 const zlib = require("zlib");
 const path = require("path");
 const fs = require("fs");
 const os = require("os");
 
-function getArtifactName() {
-  const { platform, arch } = process;
-  if (platform === "darwin" && arch === "arm64") return "archgate-darwin-arm64";
-  if (platform === "linux" && arch === "x64") return "archgate-linux-x64";
-  if (platform === "win32" && arch === "x64") return "archgate-win32-x64";
+function getArtifactName(platform, arch) {
+  const p = platform || process.platform;
+  const a = arch || process.arch;
+  if (p === "darwin" && a === "arm64") return "archgate-darwin-arm64";
+  if (p === "linux" && a === "x64") return "archgate-linux-x64";
+  if (p === "win32" && a === "x64") return "archgate-win32-x64";
   throw new Error(
-    `Unsupported platform: ${platform}/${arch}\narchgate supports darwin/arm64, linux/x64, and win32/x64.`
+    `Unsupported platform: ${p}/${a}\narchgate supports darwin/arm64, linux/x64, and win32/x64.`
   );
 }
 
-function getBinaryName() {
-  return process.platform === "win32" ? "archgate.exe" : "archgate";
+function getBinaryName(platform) {
+  return (platform || process.platform) === "win32"
+    ? "archgate.exe"
+    : "archgate";
+}
+
+function getArchiveExt(platform) {
+  return (platform || process.platform) === "win32" ? "zip" : "tar.gz";
 }
 
 function getCacheDir() {
@@ -28,7 +36,7 @@ function getCacheDir() {
 
 function getPackageVersion() {
   const pkg = JSON.parse(
-    fs.readFileSync(path.join(__dirname, "..", "package.json"), "utf8")
+    fs.readFileSync(path.join(__dirname, "..", "..", "package.json"), "utf8")
   );
   return pkg.version;
 }
@@ -72,6 +80,48 @@ function stripNulls(str) {
   return idx === -1 ? str : str.slice(0, idx);
 }
 
+/**
+ * Download a URL into a Buffer, following redirects.
+ */
+async function downloadToBuffer(url) {
+  const res = await fetchWithRedirects(url);
+  const chunks = [];
+  await new Promise((resolve, reject) => {
+    res.on("data", (chunk) => chunks.push(chunk));
+    res.on("end", resolve);
+    res.on("error", reject);
+  });
+  return Buffer.concat(chunks);
+}
+
+/**
+ * Verify SHA256 checksum of a buffer against the companion .sha256 file.
+ * The .sha256 file format is: "<hex-sha256>  <filename>\n"
+ */
+async function verifySha256(archiveBuffer, checksumUrl, version, fetchFn) {
+  const download = fetchFn || downloadToBuffer;
+  let checksumData;
+  try {
+    checksumData = await download(checksumUrl);
+  } catch {
+    // If checksum file is unavailable, skip verification with a warning
+    console.error(
+      "archgate: warning: checksum file not available, skipping verification"
+    );
+    return;
+  }
+  const expectedHash = checksumData.toString("utf8").trim().split(/\s+/u)[0];
+  const actualHash = crypto
+    .createHash("sha256")
+    .update(archiveBuffer)
+    .digest("hex");
+  if (actualHash !== expectedHash) {
+    throw new Error(
+      `checksum verification failed for v${version} (expected ${expectedHash}, got ${actualHash})`
+    );
+  }
+}
+
 /**
  * Download the platform binary from GitHub Releases and cache it.
  * Returns the path to the downloaded binary.
@@ -81,27 +131,26 @@ async function downloadBinary() {
   const version = getPackageVersion();
   const binaryName = getBinaryName();
   const isWin = process.platform === "win32";
-  const ext = isWin ? "zip" : "tar.gz";
+  const ext = getArchiveExt();
 
-  const url = `https://github.com/archgate/cli/releases/download/v${version}/${artifactName}.${ext}`;
+  const baseUrl = `https://github.com/archgate/cli/releases/download/v${version}/${artifactName}`;
+  const url = `${baseUrl}.${ext}`;
+  const checksumUrl = `${baseUrl}.${ext}.sha256`;
   console.error(`archgate: binary not found, downloading v${version}...`);
 
   const cacheDir = getCacheDir();
   fs.mkdirSync(cacheDir, { recursive: true });
   const destPath = path.join(cacheDir, binaryName);
 
+  // Download archive and verify checksum (shared across platforms)
+  const archiveBuffer = await downloadToBuffer(url);
+  await verifySha256(archiveBuffer, checksumUrl, version);
+
   if (isWin) {
-    // Download zip to temp file, extract with PowerShell
-    const res = await fetchWithRedirects(url);
-    const chunks = [];
-    await new Promise((resolve, reject) => {
-      res.on("data", (chunk) => chunks.push(chunk));
-      res.on("end", resolve);
-      res.on("error", reject);
-    });
+    // Extract zip with PowerShell
     const tmpZip = path.join(cacheDir, "archgate-download.zip");
     const tmpExtract = path.join(cacheDir, "archgate-extract");
-    fs.writeFileSync(tmpZip, Buffer.concat(chunks));
+    fs.writeFileSync(tmpZip, archiveBuffer);
     try {
       fs.mkdirSync(tmpExtract, { recursive: true });
       execSync(
@@ -114,17 +163,24 @@ async function downloadBinary() {
       }
       fs.copyFileSync(extractedBinary, destPath);
     } finally {
-      try { fs.unlinkSync(tmpZip); } catch { /* cleanup */ }
-      try { fs.rmSync(tmpExtract, { recursive: true, force: true }); } catch { /* cleanup */ }
+      try {
+        fs.unlinkSync(tmpZip);
+      } catch {
+        /* cleanup */
+      }
+      try {
+        fs.rmSync(tmpExtract, { recursive: true, force: true });
+      } catch {
+        /* cleanup */
+      }
     }
   } else {
-    // Download tar.gz, extract binary using inline tar parser
-    const res = await fetchWithRedirects(url);
+    // Extract binary from tar.gz using inline tar parser
     await new Promise((resolve, reject) => {
       const gunzip = zlib.createGunzip();
       const chunks = [];
 
-      res.pipe(gunzip);
+      gunzip.end(archiveBuffer);
       gunzip.on("data", (chunk) => chunks.push(chunk));
       gunzip.on("end", () => {
         const data = Buffer.concat(chunks);
@@ -138,9 +194,7 @@ async function downloadBinary() {
           if (header.every((b) => b === 0)) break;
 
           let name = stripNulls(header.subarray(0, 100).toString("utf8"));
-          const prefix = stripNulls(
-            header.subarray(345, 500).toString("utf8")
-          );
+          const prefix = stripNulls(header.subarray(345, 500).toString("utf8"));
           if (prefix) name = `${prefix}/${name}`;
 
           const sizeStr = stripNulls(
@@ -204,4 +258,17 @@ async function main() {
   }
 }
 
-main();
+// When required as a module (tests), export helpers without running main().
+// When executed directly (npm bin), run the CLI passthrough.
+if (require.main === module) {
+  main();
+}
+
+module.exports = {
+  getArtifactName,
+  getBinaryName,
+  getArchiveExt,
+  getCacheDir,
+  stripNulls,
+  verifySha256,
+};