cli4ai 1.0.0 → 1.0.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cli4ai",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "The package manager for AI CLI tools - cli4ai.com",
   "type": "module",
   "bin": {

package/src/bin.ts

@@ -92,10 +92,8 @@ function checkUpdatesInBackground(): void {
     const packages = getNpmGlobalPackages();
     if (packages.length > 0) {
       // Spawn a background process to check updates and cache results
-      const child = Bun.spawn(['sh', '-c', `
-        # Quick npm check (with timeout)
-        timeout 3 npm view cli4ai version 2>/dev/null > /tmp/.cli4ai-update-check 2>&1 &
-      `], {
+      const { spawn } = require('child_process');
+      const child = spawn('sh', ['-c', 'timeout 3 npm view cli4ai version 2>/dev/null > /tmp/.cli4ai-update-check 2>&1 &'], {
         detached: true,
         stdio: ['ignore', 'ignore', 'ignore']
       });

package/src/commands/add.ts

@@ -18,6 +18,7 @@ import {
 } from '../core/config.js';
 import { lockPackage, computeDirectoryIntegrity, type LockedPackage } from '../core/lockfile.js';
 import { linkPackageDirect, isBinInPath, getPathInstructions } from '../core/link.js';
+import { getRegistryIntegrity, verifyPackageIntegrity } from '../core/registry.js';
 
 interface AddOptions {
   local?: boolean;
@@ -217,11 +218,10 @@ async function downloadFromNpm(packageName: string, targetDir: string): Promise<
 /**
  * Check if a CLI tool is available
  */
-async function checkCliTool(name: string): Promise<boolean> {
+function checkCliTool(name: string): boolean {
   try {
-    const proc = Bun.spawn(['which', name], { stdout: 'pipe', stderr: 'pipe' });
-    await proc.exited;
-    return proc.exitCode === 0;
+    const result = spawnSync('which', [name], { stdio: 'pipe' });
+    return result.status === 0;
   } catch {
     return false;
   }
@@ -369,7 +369,7 @@ export async function addCommand(packages: string[], options: AddOptions): Promi
     for (const peer of plan.peerDependencies) {
       // Check if it's a CLI tool (not a cli4ai package reference)
       if (!peer.version.includes('cli4ai')) {
-        const available = await checkCliTool(peer.name);
+        const available = checkCliTool(peer.name);
         if (!available) {
           peerWarnings.push(`${peer.name} is not installed on your system`);
         }
@@ -417,6 +417,27 @@ export async function addCommand(packages: string[], options: AddOptions): Promi
         await installNpmDependencies(result.path, plan.manifest.dependencies);
       }
 
+      // SECURITY: Verify integrity against registry
+      let integrity: string | undefined;
+      try {
+        const verification = await verifyPackageIntegrity(result.name, result.path);
+        integrity = verification.actual;
+
+        if (verification.expected) {
+          if (verification.valid) {
+            log(`  integrity: ${integrity.slice(0, 20)}... ✓`);
+          } else {
+            log(`  ⚠️  Integrity mismatch!`);
+            log(`     Expected: ${verification.expected.slice(0, 30)}...`);
+            log(`     Actual:   ${verification.actual.slice(0, 30)}...`);
+          }
+        } else {
+          log(`  integrity: ${integrity.slice(0, 20)}...`);
+        }
+      } catch (err) {
+        log(`  warning: could not compute integrity hash`);
+      }
+
       // Link to PATH for global installs
       if (options.global) {
         result.binPath = linkPackageDirect(plan.manifest, result.path);
@@ -424,15 +445,6 @@ export async function addCommand(packages: string[], options: AddOptions): Promi
       } else {
         log(`✓ ${result.name}@${result.version}`);
 
-        // SECURITY: Compute integrity hash for the installed package
-        let integrity: string | undefined;
-        try {
-          integrity = computeDirectoryIntegrity(result.path);
-          log(`  integrity: ${integrity.slice(0, 20)}...`);
-        } catch (err) {
-          log(`  warning: could not compute integrity hash`);
-        }
-
         // Update lockfile (only for local/project installs)
         const lockedPkg: LockedPackage = {
           name: result.name,

package/src/core/registry.ts

@@ -0,0 +1,165 @@
+/**
+ * Package Registry
+ *
+ * Fetches and caches package metadata from cli4ai.com registry.
+ * Provides integrity hashes for verification.
+ */
+
+import { createHash } from 'crypto';
+import { readdirSync, readFileSync, existsSync } from 'fs';
+import { join } from 'path';
+
+const REGISTRY_URL = 'https://cli4ai.com/registry/packages.json';
+const CACHE_TTL = 5 * 60 * 1000; // 5 minutes
+
+interface RegistryPackage {
+  name: string;
+  version: string;
+  description: string;
+  integrity: string;
+  readme: string;
+  commands: Record<string, { description: string; args?: Array<{ name: string; required: boolean }> }>;
+  dependencies: Record<string, string>;
+  env: Record<string, { required: boolean; description: string }>;
+  category: string;
+  keywords: string[];
+  author: string;
+  license: string;
+  runtime: string;
+  mcp: boolean;
+  repository: string;
+  homepage: string;
+  npm: string;
+  updatedAt: string;
+}
+
+interface Registry {
+  version: number;
+  generatedAt: string;
+  packages: RegistryPackage[];
+}
+
+// In-memory cache
+let cachedRegistry: Registry | null = null;
+let cacheTimestamp = 0;
+
+/**
+ * Fetch registry from cli4ai.com
+ */
+export async function fetchRegistry(): Promise<Registry | null> {
+  // Return cached if fresh
+  if (cachedRegistry && Date.now() - cacheTimestamp < CACHE_TTL) {
+    return cachedRegistry;
+  }
+
+  try {
+    const response = await fetch(REGISTRY_URL, {
+      headers: { 'Accept': 'application/json' },
+      signal: AbortSignal.timeout(10000), // 10 second timeout
+    });
+
+    if (!response.ok) {
+      return null;
+    }
+
+    const registry = await response.json() as Registry;
+    cachedRegistry = registry;
+    cacheTimestamp = Date.now();
+    return registry;
+  } catch {
+    // Return cached even if stale, or null if no cache
+    return cachedRegistry;
+  }
+}
+
+/**
+ * Get package info from registry
+ */
+export async function getRegistryPackage(name: string): Promise<RegistryPackage | null> {
+  const registry = await fetchRegistry();
+  if (!registry) return null;
+
+  return registry.packages.find(p => p.name === name) || null;
+}
+
+/**
+ * Get integrity hash for a package from registry
+ */
+export async function getRegistryIntegrity(name: string): Promise<string | null> {
+  const pkg = await getRegistryPackage(name);
+  return pkg?.integrity || null;
+}
+
+/**
+ * Get all package names from registry
+ */
+export async function getRegistryPackageNames(): Promise<string[]> {
+  const registry = await fetchRegistry();
+  if (!registry) return [];
+  return registry.packages.map(p => p.name);
+}
+
+/**
+ * Compute SHA-512 integrity hash for a directory
+ * Same algorithm as used by generate-registry.ts
+ */
+export function computeDirectoryIntegrity(dirPath: string): string {
+  const hash = createHash('sha512');
+
+  function processDir(dir: string) {
+    const entries = readdirSync(dir, { withFileTypes: true }).sort((a, b) =>
+      a.name.localeCompare(b.name)
+    );
+
+    for (const entry of entries) {
+      const fullPath = join(dir, entry.name);
+
+      // Skip node_modules and hidden files
+      if (entry.name === 'node_modules' || entry.name.startsWith('.')) {
+        continue;
+      }
+
+      if (entry.isDirectory()) {
+        processDir(fullPath);
+      } else if (entry.isFile()) {
+        // Include relative path in hash for structure integrity
+        const relativePath = fullPath.slice(dirPath.length + 1);
+        hash.update(relativePath);
+        hash.update(readFileSync(fullPath));
+      }
+    }
+  }
+
+  processDir(dirPath);
+  return `sha512-${hash.digest('base64')}`;
+}
+
+/**
+ * Verify package integrity against registry
+ */
+export async function verifyPackageIntegrity(
+  packageName: string,
+  packagePath: string
+): Promise<{ valid: boolean; expected: string | null; actual: string }> {
+  const expected = await getRegistryIntegrity(packageName);
+  const actual = computeDirectoryIntegrity(packagePath);
+
+  if (!expected) {
+    // Package not in registry, can't verify
+    return { valid: true, expected: null, actual };
+  }
+
+  return {
+    valid: expected === actual,
+    expected,
+    actual,
+  };
+}
+
+/**
+ * Clear the registry cache
+ */
+export function clearRegistryCache(): void {
+  cachedRegistry = null;
+  cacheTimestamp = 0;
+}