contextecf-codeledger 0.10.7

package/LICENSE

@@ -0,0 +1,61 @@
+CodeLedger Core Engine License
+Version 1.0, 2025
+
+Copyright (c) 2025 Intelligent Context AI, Inc.
+All rights reserved.
+
+GRANT OF LICENSE
+
+Subject to the terms of this license, Intelligent Context AI, Inc. ("Licensor")
+grants you a non-exclusive, non-transferable, revocable license to use the
+CodeLedger Core Engine binary ("Software") under the following conditions:
+
+1. INDIVIDUAL USE (FREE)
+   You may use the Software for personal, non-commercial development work
+   at no cost. This includes individual developers using the Software on
+   their own projects or contributing to open-source projects.
+
+2. OPEN-SOURCE PROJECTS (FREE)
+   You may use the Software in open-source projects licensed under
+   OSI-approved licenses at no cost.
+
+3. COMMERCIAL USE (LICENSE REQUIRED)
+   Use of the Software in commercial settings, including but not limited to:
+   - CI/CD pipelines
+   - Team development environments (>1 developer)
+   - Enterprise deployments
+   - Products or services that incorporate the Software
+   requires a CodeLedger Pro license. Contact team@codeledger.dev for pricing.
+
+RESTRICTIONS
+
+You may NOT:
+- Reverse engineer, decompile, or disassemble the Software
+- Redistribute the Software as a standalone product
+- Remove or modify any license notices or proprietary markings
+- Use the Software to build a competing product or service
+
+PRIVACY GUARANTEE
+
+The Software:
+- Runs entirely on your local machine
+- Makes no network calls
+- Collects no telemetry, analytics, or usage data
+- Does not transmit your source code or any data to external services
+
+DISCLAIMER
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED. IN NO EVENT SHALL THE LICENSOR BE LIABLE FOR ANY CLAIM, DAMAGES, OR
+OTHER LIABILITY ARISING FROM THE USE OF THE SOFTWARE.
+
+TERMINATION
+
+This license terminates automatically if you breach any of its terms.
+Upon termination, you must destroy all copies of the Software.
+
+CONTACT
+
+Intelligent Context AI, Inc.
+team@codeledger.dev
+https://codeledger.dev/license

package/README.md

@@ -0,0 +1,31 @@
+# contextecf-codeledger — CodeLedger by ContextECF
+
+**Deterministic, bounded context selection for AI coding agents.**
+Published by [ContextECF](https://codeledger.dev) (Intelligent Context AI, Inc.).
+
+This is the **unscoped mirror** of [`@codeledger/cli`](https://www.npmjs.com/package/@codeledger/cli). Both packages install the exact same binary. Use whichever you prefer:
+
+```bash
+npm install -g contextecf-codeledger   # this package
+npm install -g @codeledger/cli          # scoped original
+```
+
+## Why two packages?
+
+An unrelated package named `codeledger` (unscoped, no `@`) exists on npm by a different author. AI coding agents often guess `npm install codeledger` and install the wrong thing. This unscoped `contextecf-codeledger` package gives agents (and humans) a discoverable name that works on the first try.
+
+## Quick start
+
+```bash
+codeledger init
+codeledger activate --task "describe your task"
+codeledger mcp start   # for Claude Desktop / Cursor MCP integration
+```
+
+## Links
+
+- Website: https://codeledger.dev
+- Demo: https://demo.codeledger.dev
+- Source: https://github.com/codeledgerECF/codeledger
+- npm (scoped): https://www.npmjs.com/package/@codeledger/cli
+- npm (unscoped): https://www.npmjs.com/package/contextecf-codeledger

package/bin/codeledger.js

@@ -0,0 +1,67 @@
+#!/usr/bin/env node
+/*
+ * CodeLedger npm launcher — thin shim (unscoped mirror).
+ *
+ * This is the unscoped mirror of @codeledger/cli. Both packages install
+ * the exact same hardened binary. You can install either:
+ *
+ *   npm install -g contextecf-codeledger   (this package)
+ *   npm install -g @codeledger/cli          (scoped original)
+ *
+ * This file contains no engine code. All CodeLedger functionality lives
+ * inside the hardened binary downloaded during postinstall.
+ */
+
+'use strict';
+
+const { spawnSync } = require('node:child_process');
+const { existsSync } = require('node:fs');
+const { join } = require('node:path');
+const { homedir, platform } = require('node:os');
+
+const { version } = require('../package.json');
+
+const CACHE_DIR =
+  process.env.CODELEDGER_CACHE_DIR ||
+  join(homedir(), '.cache', 'codeledger', 'bin');
+
+const BINARY_NAME =
+  platform() === 'win32'
+    ? `codeledger-hardened-v${version}.exe`
+    : `codeledger-hardened-v${version}`;
+
+const BINARY_PATH = join(CACHE_DIR, BINARY_NAME);
+
+function die(msg, code = 1) {
+  process.stderr.write(`codeledger: ${msg}\n`);
+  process.exit(code);
+}
+
+if (!existsSync(BINARY_PATH)) {
+  const installerPath = join(__dirname, '..', 'scripts', 'postinstall.js');
+  die(
+    [
+      `hardened binary for v${version} not found at ${BINARY_PATH}.`,
+      '',
+      'The postinstall step may have been skipped (e.g. --ignore-scripts).',
+      'Recover with one of:',
+      `  1. npm rebuild contextecf-codeledger`,
+      `  2. node "${installerPath}"`,
+      `  3. Re-run the install without --ignore-scripts`,
+      '',
+      'Or download the binary manually from:',
+      `  https://github.com/codeledgerECF/codeledger/releases/tag/v${version}`,
+    ].join('\n'),
+  );
+}
+
+const result = spawnSync(BINARY_PATH, process.argv.slice(2), {
+  stdio: 'inherit',
+  env: process.env,
+});
+
+if (result.error) {
+  die(`failed to spawn binary: ${result.error.message}`);
+}
+
+process.exit(result.status ?? 1);

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "contextecf-codeledger",
+  "version": "0.10.7",
+  "mcpName": "io.github.codeledgerECF/codeledger",
+  "description": "CodeLedger by ContextECF — deterministic context selection for AI coding agents. This is the unscoped mirror of @codeledger/cli; both install the same binary.",
+  "type": "commonjs",
+  "bin": {
+    "codeledger": "./bin/codeledger.js"
+  },
+  "scripts": {
+    "postinstall": "node scripts/postinstall.js"
+  },
+  "files": [
+    "bin/",
+    "scripts/",
+    "README.md",
+    "LICENSE"
+  ],
+  "dependencies": {},
+  "engines": {
+    "node": ">=18"
+  },
+  "repository": {
+    "type": "git",
+    "url": "github:codeledgerECF/codeledger-blackbox"
+  },
+  "license": "SEE LICENSE IN LICENSE",
+  "keywords": [
+    "codeledger",
+    "contextecf",
+    "context",
+    "ai",
+    "claude",
+    "cursor",
+    "windsurf",
+    "codex",
+    "mcp",
+    "mcp-server"
+  ],
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/scripts/postinstall.js

@@ -0,0 +1,285 @@
+#!/usr/bin/env node
+/*
+ * CodeLedger postinstall — download + verify the hardened binary.
+ *
+ * Runs automatically on `npm install -g @codeledger/cli`. Downloads the
+ * platform-specific hardened binary from the GitHub Release for this
+ * exact version, verifies its SHA256 against SHA256SUMS-v<version>.txt
+ * (also downloaded from the release), and writes it to the cache dir.
+ *
+ * Environment variables (all optional):
+ *   CODELEDGER_SKIP_POSTINSTALL=1   — skip entirely (air-gapped installs)
+ *   CODELEDGER_BINARY_URL=<url>     — override the release download base URL
+ *                                     (for corporate mirrors / internal CDNs).
+ *                                     Must serve the same filenames and a
+ *                                     SHA256SUMS-v<version>.txt sibling file.
+ *   CODELEDGER_CACHE_DIR=<path>     — override the cache directory
+ *                                     (default: ~/.cache/codeledger/bin)
+ *
+ * This file contains no engine logic. It only fetches, verifies, and writes
+ * bytes. Safe to inspect, safe to mirror, safe to audit.
+ */
+
+'use strict';
+
+const https = require('node:https');
+const { URL } = require('node:url');
+const { createHash } = require('node:crypto');
+const {
+  mkdirSync,
+  writeFileSync,
+  chmodSync,
+  existsSync,
+  unlinkSync,
+} = require('node:fs');
+const { join } = require('node:path');
+const { homedir, platform, arch } = require('node:os');
+
+const { version } = require('../package.json');
+
+// ─── config ──────────────────────────────────────────────────────────────────
+
+if (process.env.CODELEDGER_SKIP_POSTINSTALL === '1') {
+  console.log(
+    'codeledger: CODELEDGER_SKIP_POSTINSTALL=1 set, skipping hardened binary download.',
+  );
+  process.exit(0);
+}
+
+// Skip when running inside the blackbox monorepo itself (dev mode). The
+// presence of pnpm-workspace.yaml two directories up is a reliable signal
+// that we're not a real end-user install — we're running during `pnpm
+// install` from the workspace root, and the release binary for this
+// version may not even exist yet.
+try {
+  const path = require('node:path');
+  const fs = require('node:fs');
+  const workspaceRoot = path.resolve(__dirname, '..', '..', '..');
+  if (fs.existsSync(path.join(workspaceRoot, 'pnpm-workspace.yaml'))) {
+    console.log(
+      'codeledger: in-workspace dev install detected, skipping hardened binary download.',
+    );
+    process.exit(0);
+  }
+} catch {
+  // fall through to normal install
+}
+
+// darwin-x64 is temporarily absent from v0.10.6 — no working Intel
+// Mac runner on the release CI plan as of 2026-04-09. Intel Mac
+// users hit the "unsupported platform" soft-fail below, which tells
+// them to download manually from the GitHub Release. Re-add when a
+// working Intel Mac runner label exists (see release-dispatch.yml
+// matrix comment).
+const PLATFORM_MAP = {
+  'darwin-arm64': 'darwin-arm64',
+  'linux-x64': 'linux-x64',
+};
+
+const platformKey = `${platform()}-${arch()}`;
+const platformSuffix = PLATFORM_MAP[platformKey];
+
+if (!platformSuffix) {
+  console.error(
+    `codeledger: unsupported platform ${platformKey}. Supported: ${Object.keys(
+      PLATFORM_MAP,
+    ).join(', ')}`,
+  );
+  console.error(
+    `codeledger: v${version} does not provide a hardened binary for ${platformKey}.`,
+  );
+  console.error(
+    'codeledger: you can still run from source by cloning the blackbox repo.',
+  );
+  // Fail softly: don't block `npm install` for unsupported platforms. The
+  // bin shim will tell the user what happened when they first run `codeledger`.
+  process.exit(0);
+}
+
+// Binaries are hosted on the PUBLIC codeledgerECF/codeledger repo
+// releases (not the private codeledger-blackbox repo — its release
+// assets are not anonymously downloadable). The release pipeline in
+// codeledger-blackbox builds the binaries, then a promote_binaries
+// job uploads them cross-repo to the public release using a PAT.
+// Users' `npm install -g @codeledger/cli` fetches from the public
+// URL with no auth required.
+const RELEASE_BASE =
+  process.env.CODELEDGER_BINARY_URL ||
+  `https://github.com/codeledgerECF/codeledger/releases/download/v${version}`;
+
+const BINARY_REMOTE_NAME = `codeledger-hardened-${platformSuffix}-v${version}`;
+const BINARY_URL = `${RELEASE_BASE}/${BINARY_REMOTE_NAME}`;
+const CHECKSUMS_URL = `${RELEASE_BASE}/SHA256SUMS-v${version}.txt`;
+
+const CACHE_DIR =
+  process.env.CODELEDGER_CACHE_DIR ||
+  join(homedir(), '.cache', 'codeledger', 'bin');
+const BINARY_LOCAL_NAME = `codeledger-hardened-v${version}`;
+const BINARY_LOCAL_PATH = join(CACHE_DIR, BINARY_LOCAL_NAME);
+
+// ─── http ────────────────────────────────────────────────────────────────────
+
+function fetchBufferOnce(url, redirectDepth = 0) {
+  if (redirectDepth > 5) {
+    return Promise.reject(new Error(`too many redirects fetching ${url}`));
+  }
+  return new Promise((resolve, reject) => {
+    const req = https.get(
+      url,
+      {
+        headers: {
+          'User-Agent': `codeledger-installer/${version}`,
+          Accept: 'application/octet-stream',
+        },
+      },
+      (res) => {
+        if (
+          (res.statusCode === 301 ||
+            res.statusCode === 302 ||
+            res.statusCode === 307 ||
+            res.statusCode === 308) &&
+          res.headers.location
+        ) {
+          res.resume();
+          const next = new URL(res.headers.location, url).toString();
+          fetchBufferOnce(next, redirectDepth + 1).then(resolve, reject);
+          return;
+        }
+        if (res.statusCode !== 200) {
+          res.resume();
+          const err = new Error(`HTTP ${res.statusCode} fetching ${url}`);
+          err.statusCode = res.statusCode;
+          reject(err);
+          return;
+        }
+        const chunks = [];
+        res.on('data', (c) => chunks.push(c));
+        res.on('end', () => resolve(Buffer.concat(chunks)));
+        res.on('error', reject);
+      },
+    );
+    req.on('error', reject);
+    req.setTimeout(60_000, () => {
+      req.destroy(new Error(`timeout fetching ${url}`));
+    });
+  });
+}
+
+// Retry wrapper that tolerates the post-publish race window.
+//
+// The release pipeline publishes the npm wrapper BEFORE the hardened
+// binaries land on the public GitHub release (see the Phase 1d comment
+// in release-dispatch.yml). For up to ~10 minutes after a user first
+// sees @codeledger/cli@<version> on npm, the hardened binary URL may
+// 404. This wrapper retries 404s with exponential backoff (10s, 20s,
+// 40s, 60s, 60s, 60s, 60s, 60s, 60s, 60s → 450s total) so installs
+// during the race window eventually succeed instead of hard-failing.
+//
+// Non-404 errors (DNS, network, timeouts) fail fast — retrying a DNS
+// failure won't help.
+async function fetchBuffer(url) {
+  const backoffs = [10, 20, 40, 60, 60, 60, 60, 60, 60, 60]; // seconds
+  let lastErr;
+  for (let i = 0; i <= backoffs.length; i++) {
+    try {
+      return await fetchBufferOnce(url);
+    } catch (err) {
+      lastErr = err;
+      // Only retry on 404 — everything else is a hard failure
+      if (err.statusCode !== 404) throw err;
+      if (i === backoffs.length) break;
+      const wait = backoffs[i];
+      console.log(
+        `codeledger:   404 fetching ${url.split('/').pop()} — retrying in ${wait}s ` +
+          `(attempt ${i + 1}/${backoffs.length + 1}, ride race window)`,
+      );
+      await new Promise((r) => setTimeout(r, wait * 1000));
+    }
+  }
+  throw lastErr;
+}
+
+// ─── checksum parsing ───────────────────────────────────────────────────────
+
+function findExpectedSha(checksumsText, filename) {
+  // SHA256SUMS format: "<hex>  <filename>\n" per line (coreutils sha256sum)
+  const lines = checksumsText.split('\n');
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) continue;
+    const parts = trimmed.split(/\s+/);
+    if (parts.length < 2) continue;
+    const [hex, ...nameParts] = parts;
+    const name = nameParts.join(' ').replace(/^\*/, ''); // strip binary-mode prefix
+    if (name === filename) {
+      return hex.toLowerCase();
+    }
+  }
+  return null;
+}
+
+// ─── main ────────────────────────────────────────────────────────────────────
+
+async function main() {
+  console.log(`codeledger: installing v${version} hardened binary for ${platformKey}`);
+  console.log(`  source:   ${BINARY_URL}`);
+
+  const [checksumsBuf, binary] = await Promise.all([
+    fetchBuffer(CHECKSUMS_URL),
+    fetchBuffer(BINARY_URL),
+  ]);
+  const checksums = checksumsBuf.toString('utf8');
+
+  const expectedSha = findExpectedSha(checksums, BINARY_REMOTE_NAME);
+  if (!expectedSha) {
+    throw new Error(
+      `${BINARY_REMOTE_NAME} not listed in SHA256SUMS-v${version}.txt — cannot verify binary integrity`,
+    );
+  }
+
+  const actualSha = createHash('sha256').update(binary).digest('hex');
+  if (actualSha !== expectedSha) {
+    throw new Error(
+      `SHA256 mismatch for ${BINARY_REMOTE_NAME}:\n  expected ${expectedSha}\n  got      ${actualSha}`,
+    );
+  }
+
+  mkdirSync(CACHE_DIR, { recursive: true });
+
+  // Atomic-ish write: write to tmp, rename
+  const tmpPath = `${BINARY_LOCAL_PATH}.tmp`;
+  if (existsSync(tmpPath)) unlinkSync(tmpPath);
+  writeFileSync(tmpPath, binary);
+  chmodSync(tmpPath, 0o755);
+  if (existsSync(BINARY_LOCAL_PATH)) unlinkSync(BINARY_LOCAL_PATH);
+  // rename via fs for portability
+  require('node:fs').renameSync(tmpPath, BINARY_LOCAL_PATH);
+
+  console.log(`codeledger: installed ${BINARY_LOCAL_PATH}`);
+  console.log(`  sha256:   ${actualSha}`);
+  console.log('codeledger: run `codeledger --version` to verify');
+}
+
+// Only run main() when invoked directly (npm postinstall, node scripts/postinstall.js).
+// When require()'d from tests, just export the helper functions.
+if (require.main === module) {
+  main().catch((err) => {
+    console.error(`codeledger: postinstall failed — ${err.message}`);
+    console.error('');
+    console.error('Recovery options:');
+    console.error('  1. Retry: npm rebuild @codeledger/cli');
+    console.error('  2. Air-gapped install:');
+    console.error('       CODELEDGER_SKIP_POSTINSTALL=1 npm install -g @codeledger/cli');
+    console.error('     then manually place the binary at:');
+    console.error(`       ${BINARY_LOCAL_PATH}`);
+    console.error('  3. Use a mirror:');
+    console.error('       CODELEDGER_BINARY_URL=https://your-mirror/path npm install -g @codeledger/cli');
+    console.error('');
+    console.error(
+      `Manual download: https://github.com/codeledgerECF/codeledger-blackbox/releases/tag/v${version}`,
+    );
+    process.exit(1);
+  });
+}
+
+module.exports = { findExpectedSha, PLATFORM_MAP };