cxpher 2.0.3 → 2.0.5

package/CHANGELOG.md

@@ -0,0 +1,195 @@
+# Changelog
+
+All notable changes to `cXpher` are recorded here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [2.0.5] - 2026-05-23
+
+### Added
+
+### Changed
+
+### Fixed
+
+---
+
+## [2.0.4] - 2026-05-23
+
+### Added
+
+### Changed
+
+### Fixed
+
+---
+
+## [2.0.3] - 2026-05-23
+
+### Added
+
+### Changed
+
+### Fixed
+
+---
+
+## [2.0.2] - 2026-05-23
+
+### Added
+
+### Changed
+
+### Fixed
+
+---
+
+## [2.0.1] - 2026-05-23
+
+### Security Posture Overhaul
+
+This is the headline release. The compiled-binary runtime has been re-architected from the ground up to push pure-software source protection as far as it will go. Every binary produced by `cxpher compile`, `cxpher compile-all`, and `cxpher compiler` now ships with a multi-layer protection stack covering all three host platforms (Linux, macOS, Windows).
+
+The protections operate at three levels - key handling, runtime environment integrity, and source delivery to the JS interpreter - and they compound. The result is a binary that, on every supported platform, no longer leaves the decrypted JavaScript on disk at any point, refuses to run under common debugger configurations, and exits silently if its own execution timing is consistent with single-step inspection. Implementation specifics are intentionally not enumerated here. The protections are designed to be felt, not catalogued.
+
+What you'll notice as a developer:
+
+- **No build artifacts on your project disk.** The intermediate C stub, generated headers, AES vendor, and any other transient files now build inside a unique temporary directory and are wiped before the binary is returned. Your project tree stays clean. The `--keep-build` escape hatch has been removed entirely so nothing can be accidentally left behind.
+- **No decrypted JavaScript on disk at runtime.** The compiled binary's primary execution path streams the decrypted source directly into the interpreter through an in-memory channel. No filesystem entry is ever created in the primary path. A fallback path is retained for the rare cases where the primary cannot fire, and that fallback uses a random short-lived temp path with restrictive permissions and immediate cleanup.
+- **Native debugger-resistance per platform.** Linux, macOS, and Windows each ship platform-specific runtime checks that detect debugger attachment and exit silently. The exits are silent on purpose so an attacker can't trivially learn which check fired.
+- **Per-build, per-byte randomised key handling.** The AES key used to encrypt your source is reconstructed at runtime from independently random per-byte material that's shuffled before being written into the binary. Every build produces a fully different layout - no two binaries share keys or fragment ordering.
+- **Argument fidelity preserved.** Original command-line arguments are passed to the wrapped script through an out-of-band channel so the runtime never has to materialise them on disk or expose them in process listings.
+
+### Added - packaging & developer surface
+
+- **Local package resolution in `cxpher add`.** `cxpher add ./pkg`, `cxpher add ../sibling`, `cxpher add /abs/path`, `cxpher add ~/lib`, `cxpher add file:./pkg`, `cxpher add link:./pkg`, `cxpher add portal:./pkg`, and the explicit `cxpher add myname@file:./pkg` alias form. Local manifests are read off disk. The registry is bypassed entirely for local specs. `link:` / `portal:` symlink-install instead of hard-link, so live edits in the source dir are picked up by the consumer immediately.
+- **Multi-registry fallback chain.** Packument fetches walk an ordered list of registries and short-circuit on the first 200. Default chain: npm → yarn → jsr → github packages. Custom primaries from `~/.cxpher/config.json` (`registry`, `registries[]`) prepend; `scopeRegistries` routes specific scopes directly. 401/403 are treated as miss-and-continue rather than fatal.
+- **`compile-all` (alias `ca`).** Single command produces every default binary plus a generated cross-platform CLI wrapper into `dist/`. Default is 4 binaries (linux × x64/x86, win × x64/x86). `--arm` extends to 8 (adds ARM64 + ARM32 for both linux and win). `--cli-only` / `--cli` skips binaries and just (re)writes `dist/cli.js`.
+- **`compiler` (alias `cp`).** Interactive multi-select picker. Lists every target with installed/missing toolchain status, plus a CLI-wrapper checkbox, plus an "All" entry at the top that auto-expands to every target. Follow-up select picks the compile mode. Missing toolchains trigger an install/skip/abort prompt.
+- **`install-toolchain` (aliases `it` / `toolchain`).** Detects host OS, distro, host architecture and available package manager (pacman + yay/paru, apt-get, dnf, zypper, apk, brew, scoop, choco, winget). Per-target install fallback chain walks ordered steps, verifies after each, falls through to the next on failure. For `linux-arm32` the chain tries the Linaro precompiled binary, then the official Arm GNU toolchain download from developer.arm.com, then build-from-source. Includes a `xcode-clt` install method that triggers `xcode-select --install` on macOS hosts and a `llvm-mingw-postlink` post-install symlink hook that wires `aarch64-w64-mingw32-*` and `armv7-w64-mingw32-*` binaries into `/usr/local/bin/` after Arch installs.
+- **ARM target support across the board.** Flags `--arm` (defaults to arm64), `--arm64`, `--arm32`. Cross-compile detection added for Linux ARM64 / ARM32 and Windows ARM64 / ARM32 via llvm-mingw. `arm32`, `arm64`, `aarch64`, `armv7`, `armv7l`, `armhf`, and `arm` are all recognised by `--arch` and `--target` parsing.
+- **macOS targets recognised as native on darwin hosts.** `darwin-x64` and `darwin-arm64` are detected as installed when native `clang` plus `xcode-select -p` both resolve.
+- **Three-way `dist/` overwrite prompt.** `--alongside` / `--overwrite` overwrites only the targets being built and leaves the rest of `dist/` intact. `--backup` copies `dist/` to the next free `dist_backup_NNN/` then wipes. `--wipe` deletes `dist/` with no backup. `--dist <choice>` is the value-flag form. Non-TTY contexts default to `alongside`, so Makefiles and CI never hang on the prompt.
+- **`cxpher --version` / `-v` / `version`.** Prints the cxpher version cleanly from any position on the command line.
+
+### Changed
+
+- **Argument parser.** Flags now have a known-name allowlist (`VALUE_FLAGS` for value-taking, `BOOLEAN_FLAGS` for boolean). Unknown flags pass through into positional, which means script arguments survive to the wrapped program. Duplicate occurrences of a known flag also pass through after the first, so the same flag can be both an `cxpher` flag and a script flag in the same invocation. POSIX `--` separator forces everything after into positional. Leading-flag commands (`cxpher --version`) now parse correctly.
+- **`--cache` opt-in.** The build cache is OFF by default. Pass `--cache` to enable. The previous `--no-cache` flag has been retired.
+- **`compile --cli-only`.** Routes to the same wrapper-only fast path as `compile-all --cli-only`.
+- **Default output suffix.** `cxpher compile -l` now produces `<name>-linux-x64`, `-l32` produces `<name>-linux-x86`, and so on. Always symmetric - artifacts from different targets never collide.
+- **Build directory.** No longer created inside the project. Each compile gets a fresh temp directory under the OS temp root and that directory is wiped before the binary is returned.
+
+### Removed
+
+- **`--keep-build`** - gone. Build artifacts are always cleaned up.
+- **`--no-cache`** - gone. Cache is opt-in via `--cache`.
+
+### Fixed
+
+- `cxpher add ./local-package` previously hit `registry.npmjs.org/./local-package` and returned `Package not found`. Local specs are now detected before any registry call.
+- `cxpher add` with an explicit local alias (`cxpher add mypkg@file:./other`) preserves the user-supplied name in `package.json` and the install layout.
+- Hardlinked local installs no longer recurse into the source package's own `node_modules/` or `.git/`.
+- `compile-all <entry>` with the entry as a positional after a boolean flag (e.g. `compile-all --wipe agentics.js`) used to consume the entry as the flag's value. Now correctly preserved as positional.
+- Interactive prompts no longer hang in non-TTY contexts (Makefile, CI). Sensible defaults fire automatically.
+
+---
+
+## [1.2.5]
+
+### Added
+
+- **Local package resolution.** `cxpher add` now correctly handles local paths and never falls through to the npm registry when one is supplied. Supported forms: `cxpher add ./pkg`, `cxpher add ../sibling`, `cxpher add /abs/path`, `cxpher add ~/lib`, `cxpher add file:./pkg`, `cxpher add link:./pkg`, `cxpher add portal:./pkg`, and the explicit `cxpher add myname@file:./pkg` alias form. The local package's `package.json` is read off disk for name, version and transitive deps - the registry is bypassed entirely for the local spec.
+- **`link:` / `portal:` symlink installs.** Where `file:` hard-links the local tree into `node_modules/`, `link:` and `portal:` create a directory symlink instead, so live edits to the source dir are picked up immediately by the consumer. Hardlinked installs skip the source's own `node_modules/`, `.git`, and `.cxpher-stored` to avoid recursion explosions.
+- **Multi-registry fallback chain in `client.js`.** Packument fetches now walk an ordered list of registries and short-circuit on the first 200. Default chain: npm → yarn → jsr → github packages. Custom primary registries from `~/.cxpher/config.json` (`registry`, `registries[]`) are prepended. Per-scope routes via `scopeRegistries['@my-scope']` are honoured before the global chain. 401/403 are treated as "not found here, try the next one" rather than fatal errors. Failure messages summarise every attempt.
+- **`compile-all` command (`cxpher compile-all`, alias `cxpher ca`).** Single command that produces every default binary plus a generated cross-platform CLI wrapper in `dist/`. Default produces 4 binaries (linux-x64, linux-x86, win-x64, win-x86). The `--arm` flag extends this to 8 (adds linux-arm64, linux-arm32, win-arm64, win-arm32). On an existing `dist/`, a select prompt asks whether to back it up (copies to the next free `dist_backup_NNN/` in the project root) or wipe and continue. The generated `dist/cli.js` is a Node wrapper that detects `process.platform` and `process.arch` and execs the matching binary from the same directory.
+- **`compile-all --cli-only` / `--cli`.** Skip every binary, just (re)write `dist/cli.js` with the package name from `cxpher.json` or `package.json`. Useful for refreshing the wrapper after a manual edit or rename without rebuilding everything.
+- **ARM compilation targets.** New flags: `--arm` (defaults to arm64), `--arm64`, `--arm32`. Cross-compile detection adds `aarch64-linux-gnu-gcc` / `aarch64-linux-musl-gcc` for Linux ARM64, `arm-linux-gnueabihf-gcc` / `arm-linux-gnueabi-gcc` for Linux ARM32, and `aarch64-w64-mingw32-clang` / `armv7-w64-mingw32-clang` (llvm-mingw) for Windows ARM. `arm32`, `arm64`, `aarch64`, `armv7`, `armv7l`, `armhf`, and `arm` are all recognised by `--arch` and `--target` parsing.
+- **Default output suffix `-<platform>-<arch>` on every cross-target build.** `cxpher compile -l` now produces `<name>-linux-x64`, `-l32` produces `<name>-linux-x86`, `-w --arm` produces `<name>-win-arm64`, and so on. The suffix is applied whenever any platform flag (`-l`/`-w`/`-m`/`--target`) is set and `--out` is not. Explicit `--out` still wins and is used verbatim.
+- **`install-toolchain` command (`cxpher install-toolchain`, alias `cxpher it` / `cxpher toolchain`).** Detects the host OS, distro, host architecture and available package manager (pacman + yay/paru, apt-get, dnf, zypper, apk, brew, scoop, choco, winget), shows a status report of every cross-compile target with installed/missing flags, and either installs the requested set non-interactively (`--all`, `--arm`, `--x86`, `--win`, `--linux`, or explicit target names like `linux-arm32`) or pops a multiselect for the user to pick. Repo packages route through the system package manager with sudo. AUR / chaotic-aur packages route through yay or paru without sudo. Targets with no native package (Windows ARM on debian/fedora/suse/alpine, macOS cross from anything) are reported with a manual-install URL instead of a silent skip.
+- **Per-target install fallback chain.** Each target now carries an ordered list of install steps. The installer walks the chain in order, verifies after each attempt with `checkInstalled`, and only moves on if the current step fails or installs without putting the expected binary on PATH. For `linux-arm32` on Arch: 1) Linaro precompiled binary (fast, fails when snapshots.linaro.org is unreachable), 2) official ARM GNU toolchain from developer.arm.com (manual download to `/opt/cxpher-toolchains/` + symlinks to `/usr/local/bin/`), 3) build from source via the `arm-linux-gnueabihf-gcc` AUR package (slow). Linux ARM64 has the same chain minus the source build. Windows ARM on Arch tries chaotic-aur first then falls back to an AUR precompiled toolchain. The `arm-official` install method is generic and reusable from any other target that maps to an Arm-published triplet.
+- **`detectCompiler` accepts the `arm-none-` Arm-official naming.** The official Arm GNU toolchain ships binaries as `arm-none-linux-gnueabihf-gcc` and `aarch64-none-linux-gnu-gcc`. The cross-compiler detector now recognises both the standard (`arm-linux-gnueabihf-gcc`) and the Arm-official names. The install method also symlinks the Arm names to the standard names in `/usr/local/bin/` so existing tooling that hardcodes the standard name keeps working.
+- **`compiler` command (`cxpher compiler`, alias `cxpher cp`).** Interactive compile picker. Multiselect lists every target (linux × x64/x86/arm64/arm32, win × x64/x86/arm64/arm32, darwin × x64/arm64) annotated with installed/missing toolchain status, plus a final "CLI wrapper (dist/cli.js)" entry, plus an "All" entry at the top that auto-expands to every target including the CLI wrapper. Once targets are picked, a follow-up select chooses the compile mode: Standard (encrypted native binary), Standalone (`--standalone`, embeds Node), or Plain bundle (`--no-encrypt`). Any missing toolchains trigger the same install/skip/abort prompt as `compile-all`. Each target compiles with the chosen mode flags, and if the CLI wrapper was picked, it's written to `dist/cli.js` at the end. `compiler` shares the same existing-dist prompt as `compile-all`, so picking targets while a `dist/` exists asks before overwriting.
+- **`multiselect` prompt supports `disabled` options and `onToggle` callbacks.** Options can carry a static `disabled: true` boolean or a `disabled: (selected) => boolean` function evaluated on every render. Disabled options render dimmed and refuse space-toggle. An optional `onToggle(value, selected)` hook fires after every successful toggle so callers can mutate the selection set in response to a pick - used by `compiler` to clear all other selections when the "All" entry is checked and re-enable them when it's unchecked.
+- **Warn glyph spacing in `log.js`.** The warn replacement now always emits two spaces after the `⚠` glyph instead of preserving the original whitespace, so warn lines no longer visually crowd the next character on terminals that render the warning sign at full width.
+- **`compile-all` automatic toolchain preflight.** Before any compile fires, `compile-all` checks every selected target against the toolchain detector. If any are missing, the user is offered three options via a select prompt: install the missing toolchains via the package manager and continue, skip the missing targets and build the rest, or abort. `--yes` / `-y` auto-picks install. Any per-target compile failures during the loop now warn and skip instead of aborting the whole batch, so one missing dependency never nukes the other seven binaries.
+- **Three-way existing-`dist/` prompt.** The select shown when `cxpher compile-all` or `cxpher compiler` hits an existing `dist/` now offers three options instead of two: **Install alongside existing files** (overwrite only the targets being built, leave everything else in `dist/` untouched), **Backup current dist** (copies to the next free `dist_backup_NNN/` then wipes), and **Wipe and start fresh** (delete `dist/` with no backup). Default remains backup.
+- **`llvm-mingw` post-install symlink hook.** On Arch, `llvm-mingw` from chaotic-aur / AUR installs into `/opt/llvm-mingw/bin/` which is not on `$PATH`. The `win-arm64` / `win-arm32` install steps now chain into a `llvm-mingw-postlink` post-install method that symlinks every `aarch64-w64-mingw32-*` and `armv7-w64-mingw32-*` binary into `/usr/local/bin/`, so the cross-compilers are immediately resolvable after install with no manual `PATH` editing.
+- **macOS native toolchain detection and install.** `checkInstalled` on a darwin host now treats `darwin-x64` and `darwin-arm64` as installed when native `clang` plus `xcode-select -p` both resolve - those are the prerequisites for `clang -arch x86_64` and `clang -arch arm64` native compiles. The `darwin-x64` and `darwin-arm64` entries in `PACKAGE_MAP` now have a `macos` step that runs the new `xcode-clt` install method, which calls `xcode-select --install` to trigger Apple's GUI installer for the Command Line Tools. The Linux/BSD cross paths via osxcross are still listed as `manual` steps. Label cleaned up from "macOS x64 (cross)" / "macOS ARM64 (cross)" to plain "macOS x64" / "macOS ARM64" since they're native on a Mac host.
+
+### Changed
+
+- **`fetchPackument` resolution flow.** Previously raised `Package not found` on the first 404 from npm. Now records the outcome per registry, falls through on 404 / 401 / 403, and only throws when every registry in the chain has rejected the name. Successful results are still cached against the package name (not the registry), so subsequent lookups hit the cache regardless of which registry served the packument.
+- **`resolveTree` accepts and threads `opts.cwd`.** Required for local-spec resolution (`file:./...` paths must resolve relative to the project root, not `process.cwd()` of whatever spawned cxpher). `add`, `install`, and `remove` all pass `cwd` through to the resolver.
+- **`installPackages` re-resolves local paths from the spec at install time.** The lockfile stores the user-supplied spec (e.g. `file:./local/pkg`) so a project can move between machines and the local references re-resolve against the new project root. The absolute path stored in the lockfile is treated as a hint, not the source of truth.
+- **Output suffix logic in `compile.js` always includes the arch segment.** Previously suffixed only when arch was non-default (e.g. `-linux` for x64, `-linux-x86` for x86). Now produces a symmetric `-<platform>-<arch>` every time the suffix fires, so artifacts from `-l` and `-l32` never collide and dist/ contents read consistently.
+- **`detectCompiler` refactored.** Replaced the inline `try { execSync ... } catch` blocks with a small `tryCmd` helper and added explicit branches for ARM cross-compilation. Native ARM Linux compilation (running on an ARM device) falls through to the standard `gcc` / `clang` / `cc` chain unchanged.
+
+### Fixed
+
+- `cxpher add ./local-package` previously hit `registry.npmjs.org/./local-package` and returned `Package not found`. Local specs are now detected before any registry call.
+- `cxpher add` with an explicit local alias (`cxpher add mypkg@file:./other`) wrote the dependency under the manifest's name instead of `mypkg`. The user-supplied name is now preserved in `package.json` and the install layout.
+- Hardlinked local installs no longer recurse into the source package's own `node_modules/` or `.git/`, which previously caused the install to run for minutes on workspaces with deep dependency trees.
+
+## [1.0.0] - 2026-05-21
+
+### Added
+
+- **32-bit (x86) native binary targets.** Compile to genuine 32-bit ELF or PE32 executables for Linux and Windows. Cross-compiles use `i686-w64-mingw32-gcc` for windows-x86 and `gcc -m32` for linux-x86 (requires the 32-bit toolchain - `lib32-gcc-libs` on Arch, `gcc-multilib` on Debian/Ubuntu, `glibc-devel.i686` on Fedora). Build cache is keyed on arch so x64 and x86 outputs never collide.
+- `--arch <arch>` flag - explicit target architecture (`x64`, `x86`, `arm64`). Defaults to `x64` for backwards compatibility with every prior recipe.
+- Compound target strings: `--target linux-x86`, `--target win-arm64`, `--target darwin-x64` etc. The arch suffix is parsed out automatically.
+- Six new shorthand flags: `-w32` `-l32` `-m32` for 32-bit Windows · Linux · macOS, and `-w64` `-l64` `-m64` as explicit aliases for the default 64-bit shorthand.
+- **Yarn-style implicit script execution.** Running `cxpher <script-name>` (where `<script-name>` is defined in `package.json` `scripts`) now executes that script directly - no need for `cxpher run <script-name>`. Built-in subcommand names (`install`, `compile`, `add`, etc.) still win precedence.
+- **Modern interactive prompt module.** `cxpher init` (without `-y`) now drives a clack-prompts–style flow with arrow-key selection menus, validated text inputs, raw-mode key handling, and clean cancellation via `Esc` / `Ctrl+C`. New primitives: `intro`, `outro`, `note`, `cancel`, `text`, `select`, `confirm`, `multiselect`, `promptSpinner`.
+- **Select menus in `cxpher init`** replace plain text prompts where the answer is one of a known set:
+  - **Template** - `default` · `cli` · `server` · `bare` with hints describing each scaffold.
+  - **Module system** - `module` (ESM) vs `commonjs` (CJS).
+  - **License** - `MIT`, `Apache-2.0`, `GPL-3.0-or-later`, `BSD-3-Clause`, `ISC`, `MPL-2.0`, `UNLICENSED`, plus a `Custom · type SPDX ID` fallback that drops you into a text input for anything else.
+
+### Changed
+
+- **Help screen rewritten** in a clack-style rail layout: rounded corner anchors, dimmed gray `│` rail, section markers (`◇`) with bold-white titles, and `○` row markers in front of every command. Single teal accent on structural markers, violet accent for emphasised data, bright white for content, dimmed gray for descriptions. No more rainbow logging, no more ASCII double-line boxes.
+- **`compile` output redesigned** to match the new aesthetic. The old `╔══╗` framing is replaced with a `┌` opening anchor and a `└` closing anchor. Every line of progress sits inside a gray `│` rail with green `✓` for completed steps and teal `◇` for sections in flight. ASCII box-drawing in any log line is now automatically suppressed by `log.js`, so older paths render cleanly without manual changes.
+- **`log.js` modernised.** Status prefixes are translated at render time - `+` → `✓`, `-` → `✗`, `!` → `⚠`, `⟐` → `◇`, `?` → `◆`. The mint default text color is now bright white, the cyan accent is now the premium teal, and a violet accent has been added for numeric / quantitative emphasis. Every line is automatically wrapped in the dim `│` rail.
+- **`createSpinner` upgraded.** The braille spinner frames are replaced with a circle fill set (`○ ◔ ◑ ◕ ●`) that reads more clearly at low refresh rates. Active spinner glyph uses the teal accent. Success / warn / error stops use semantic green / yellow / red.
+- **`install` summary repainted.** Category arrows (`↗` from-store, `↓` fetched, `≡` up-to-date, `⊡` binaries-linked) now share a single teal accent instead of four different colors. Counts render in the violet emphasis color, descriptions in gray.
+- **`cxpher verify` and `cxpher init` headers** use the same `┌` opening anchor pattern as `compile`, so every command flow now visually reads top-to-bottom inside a single rail.
+- **Standalone (`--standalone` / `--sea`) builds now guard against cross-arch builds.** Because Node SEA embeds the running interpreter, the host arch must match the requested arch. Mismatched combinations now exit with a clear error pointing back at the non-standalone path, which supports cross-arch via gcc / mingw.
+- **`--version` reads from `package.json`** instead of a hardcoded string, so the version reported on the CLI is always the published version.
+
+### Fixed
+
+- Interactive prompts no longer duplicate the question line on submit. `clearPrev` previously left the first line of the prior render in place when it cleared the buffer. The loop now moves up before each clear so every prior line is wiped before the final draw.
+- `--target linux-x86` and similar compound forms correctly drive the 32-bit toolchain selection. The arch was previously being stripped from the target string before arch resolution ran, so the build silently fell back to x64. Arch resolution now runs before target normalisation.
+
+## [0.4.1] - 2026-05-14
+
+### Added
+
+- `cxpher verify <binary>` - inspect any cxpher-compiled binary and print its embedded metadata block plus the full license header from the entry file. Works on linux, darwin and windows binaries produced by cxpher.
+- `cxpher config` - interactively edit project metadata (license, author, copyright, company, website, description) stored in `package.json`. Existing values are shown as defaults. Press enter to keep, type `-` to clear.
+- `cxpher config -g` / `--global` - same flow targeting the global config at `~/.cxpher/config.json`. Project values always override global at compile time.
+- `cxpher config -l` / `--list` - read-only listing of the current resolved metadata for either project or global scope.
+- License header auto-extraction. During compile, the first `/** ... */` block comment at the top of the entry file is detected if it contains `@license`, `Copyright`, `License`, or `SPDX-License-Identifier`, and embedded verbatim into the binary alongside the metadata.
+- Metadata embedding pipeline. Every compiled binary now carries a `===CXPHER_META_START===` / `===CXPHER_META_END===` block in the C stub's read-only data segment, surviving both `-O2` optimization and `strip`. Fields populated from a three-tier resolver: entry-directory `package.json` > compile cwd `package.json` > `~/.cxpher/config.json`. Embedded fields: `name`, `version`, `license`, `author`, `copyright`, `company`, `website`, `description`, plus the license header.
+- Init command now prompts for `license`, `author`, `copyright`, `company` and `website`, defaulting to the global config values, and offers to save the entered values back to the global defaults at the end of the run.
+- Loud build failure on unresolved imports. When the bundler cannot resolve a bare import and the package is not declared external, compile exits 1 with a clear list of the unresolved specifiers and a hint to run `cxpher install` or use `--external`. Mirrors `bun build` behaviour.
+
+### Changed
+
+- `needsBundling` heuristic in `compile.js` now triggers bundling on any non-builtin import (relative or bare), instead of requiring `node_modules` to sit directly in the compile cwd. Fixes silent skip-bundling when `node_modules` lives in the entry's directory rather than the working directory.
+- `bundler.js` now returns the list of unresolved external imports alongside the bundle content so `compile.js` can fail the build instead of silently producing a broken binary.
+
+### Fixed
+
+- `assetResolver.scanRefs` no longer treats `..`, `.`, parent-traversal paths (`../foo`) or absolute paths as embeddable asset references. Previously the regex matched `join(__dirname, '..', ...)` calls and attempted to embed the entire parent directory tree, which crashed with `Invalid string length` on large codebases.
+- `package.json` build script now explicitly compiles `src/cli.js` rather than relying on `pkg.main` auto-detection, which was resolving to the dist launcher shim and producing a self-referencing broken binary.
+
+---
+
+## [0.3.x] - prior
+
+- AES-256-CTR encrypted JS payload embedded in a C stub
+- Cross-compile to linux / darwin / win via gcc / clang / mingw
+- Asset resolver embeds referenced files into a runtime virtual filesystem
+- Build cache keyed on source hash + build flags
+- Standalone (Node SEA) compile mode
+- Package manager primitives: `install`, `add`, `remove`, `run`, `build`, `compile`, `clean`, `info`, `why`, `list`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cxpher",
-  "version": "2.0.3",
+  "version": "2.0.5",
   "type": "module",
   "description": "Agentics Package Manager — Encrypted native binary compiler + package manager for JavaScript",
   "main": "bin/cXpher.js",
@@ -13,7 +13,9 @@
   "files": [
     "bin/",
     "cli-wrapper.cjs",
-    "install.cjs"
+    "install.cjs",
+    "README.md",
+    "CHANGELOG.md"
   ],
   "cxpher": {
     "brand": "cXpher"
@@ -21,7 +23,7 @@
   "scripts": {
     "postinstall": "node install.cjs",
     "build": "make clean; make install",
-    "publish": "npm publish --access public"
+    "publish": "for x in bump git publish-main publish-platforms; do make $x; done"
   },
   "keywords": [
     "package-manager",
@@ -50,15 +52,15 @@
   "author": "Connor Etherington <connor@agentics.co.za>",
   "license": "MIT",
   "optionalDependencies": {
-    "cxpher-darwin-arm64": "2.0.3",
-    "cxpher-darwin-x64": "2.0.3",
-    "cxpher-linux-arm32": "2.0.3",
-    "cxpher-linux-arm64": "2.0.3",
-    "cxpher-linux-x64": "2.0.3",
-    "cxpher-linux-x86": "2.0.3",
-    "cxpher-win-arm32": "2.0.3",
-    "cxpher-win-arm64": "2.0.3",
-    "cxpher-win-x64": "2.0.3",
-    "cxpher-win-x86": "2.0.3"
+    "cxpher-darwin-arm64": "2.0.5",
+    "cxpher-darwin-x64": "2.0.5",
+    "cxpher-linux-arm32": "2.0.5",
+    "cxpher-linux-arm64": "2.0.5",
+    "cxpher-linux-x64": "2.0.5",
+    "cxpher-linux-x86": "2.0.5",
+    "cxpher-win-arm32": "2.0.5",
+    "cxpher-win-arm64": "2.0.5",
+    "cxpher-win-x64": "2.0.5",
+    "cxpher-win-x86": "2.0.5"
   }
 }