flamerjs 1.1.0 → 1.1.1

package/CHANGELOG.md

@@ -0,0 +1,141 @@
+# Changelog
+
+All notable changes to flamer are recorded here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this project
+adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [1.0.0] - 2026-10-24
+
+### Added
+
+- Rust and C++ native workers under `native/core` for coordinated native
+  processing.
+- Versioned JSONL worker protocol with TypeScript integration through
+  `--engine all|typescript|rust|cpp`.
+- Dedicated native Rust and C++ build/test workflows.
+- Architecture documentation covering runtime layers, protocol, and fallback
+  behavior.
+
+### Fixed
+
+- Native execution failures are explicit for targeted workers and safely fall
+  back to TypeScript in the default `all` mode.
+
+## [1.1.1] - 2026-10-24
+
+### Fixed
+
+- Align the main npm package and native worker package versions.
+- Publish all supported Linux, macOS, and Windows x64/arm64 native packages.
+- Include the changelog and architecture documentation in the npm tarball.
+
+## [1.1.0] - 2026-10-24
+
+### Added
+
+- Optional platform-specific npm packages containing both native workers.
+- Release automation for Linux x64, macOS x64/arm64, and Windows x64 native
+  packages.
+- A native package builder and explicit Rust/C++ build-phase output.
+- `scripts/install.sh` with npm installation and guarded native release-asset
+  installation paths.
+- The default `flamer .` execution coordinates TypeScript, Rust, and C++
+  together, with pure TypeScript fallback when native workers are unavailable.
+- Rust owns shared file metrics and Rust-specific checks; C++ owns C/C++-specific
+  checks, so the workers no longer perform the same analysis.
+
+### Fixed
+
+- CI now builds before tests that execute the bundled CLI.
+- Node 18 builds use a compatible pinned tsup release.
+- Conventional Commit validation accepts the `ci` type.
+
+- Dedicated Codecov coverage reporting and CodeQL analysis workflows.
+
+## [0.1.6] - 2026-10-24
+
+### Fixed
+
+- Updated the README Quick Start to use the published `flamerjs` package with
+  `npx`, local installation, and global installation examples.
+- Updated CLI examples to use the published `flamerjs` command while retaining
+  the source checkout workflow for contributors.
+
+## [0.1.5] - 2026-10-24
+
+### Added
+
+- Human-readable terminal output is now the default CLI mode, with severity
+  grouping, clean scan summaries, and TTY-aware ANSI colors.
+- `--color` and `--no-color` flags for controlling terminal colors.
+- High-confidence detection for explicit not-implemented errors and empty
+  error handlers.
+- npm packaging metadata, a `flamerjs` command alias, and automated publishing
+  to npm and GitHub Packages on version tags.
+
+### Fixed
+
+- README and CI test-count checks now follow the current TypeScript test suite.
+- CLI, contributor, and agent documentation now matches the `src/` and `dist/`
+  project layout.
+
+### Removed
+
+- Bun as a project development dependency and lockfile.
+- JSON as the default interactive output mode; JSON remains available with
+  `--format json`.
+
+## [0.1.0] - 2026-10-02
+
+First public release.
+
+### Added
+
+- Single-pass tree scanner covering 25 languages across 70 file extensions:
+  JavaScript, TypeScript, Python, Rust, Go, C, C++, C#, Java, Kotlin, Scala,
+  Terraform, HCL, Docker, SQL, Ruby, PHP, Shell, PowerShell, Haskell, Elixir,
+  Lua, R, Solidity, Swift, Dart, Zig, and Jupyter notebooks.
+- Eight analyzers, each isolated so one throwing does not stop the rest:
+  `universal`, `notebooks`, `scaffolding`, `testing`, `git`, `node`, `python`,
+  `systems`.
+- Redacted credential detection for 14 credential shapes, with test and fixture
+  paths exempt so a repository's own fake secrets are not reported.
+- Adaptive bloat detection with per-language baselines, so a large generated
+  file is not scored as though a human wrote every line.
+- Per-language test coverage ratios, so a mostly-Terraform repository is not
+  graded as though it were all application code.
+- The roast persona in `SKILL.md`, including a confirmation gate, an audit mode
+  that drops the character, and an instruction to defer deep security analysis
+  to the `poison` skill when it is installed.
+- JSON output by default with a human-readable `--format summary`.
+
+### Performance
+
+Measured on a 3.0 GB monorepo of 98,161 files, 71,150 of them source:
+**3.60s before, 2.10s after**, with byte-identical findings.
+
+- Newline discovery uses `indexOf` rather than a per-character `charCodeAt`
+  loop. Measured 3.7x faster on a 525 MB corpus; `split` measured slower than
+  both while also allocating an array of every line.
+- The credential scanner gates 13 of its 14 patterns behind a literal substring
+  test, so the regex engine never runs against a file that cannot contain that
+  shape of credential. The assignment pattern is intentionally left ungated
+  because its names match case insensitively and an incomplete gate would be a
+  silently dropped rule.
+- Line numbers for a credential finding are resolved by binary search over a
+  lazily built offset table. The previous approach sliced and split the text
+  once per match, which is up to 280 times on a single file.
+
+### Notes
+
+- Zero runtime dependencies. Node 18 or newer, no install step.
+- `poison` is a separate project. Flamer does not import it, and the handoff is
+  a runtime capability check in `SKILL.md` rather than a code dependency.
+
+[Unreleased]: https://github.com/dummy3ye/flamer/compare/v1.1.1...HEAD
+[1.1.1]: https://github.com/dummy3ye/flamer/releases/tag/v1.1.1
+[1.1.0]: https://github.com/dummy3ye/flamer/releases/tag/v1.1.0
+[1.0.0]: https://github.com/dummy3ye/flamer/releases/tag/v1.0.0
+[0.1.6]: https://github.com/dummy3ye/flamer/releases/tag/v0.1.6
+[0.1.5]: https://github.com/dummy3ye/flamer/releases/tag/v0.1.5
+[0.1.0]: https://github.com/OWNER/flamer/releases/tag/v0.1.0

package/dist/cli.js

@@ -2910,7 +2910,14 @@ import { createRequire } from "module";
 var require2 = createRequire(import.meta.url);
 function nativePackageName() {
   const platform = `${process.platform}-${process.arch}`;
-  const supported = /* @__PURE__ */ new Set(["linux-x64", "darwin-x64", "darwin-arm64", "win32-x64"]);
+  const supported = /* @__PURE__ */ new Set([
+    "linux-x64",
+    "linux-arm64",
+    "darwin-x64",
+    "darwin-arm64",
+    "win32-x64",
+    "win32-arm64"
+  ]);
   return supported.has(platform) ? `@dummy3ye/flamer-native-${platform}` : null;
 }
 function packagedWorkerPath(worker) {

package/docs/ARCHITECTURE.md

@@ -0,0 +1,175 @@
+# Flamer architecture
+
+Flamer is a Node.js CLI with a coordinated native execution layer. TypeScript
+owns the public interface, repository traversal, generic analyzers, findings,
+fallback behavior, and report format. Rust and C++ run together as specialized
+workers with non-overlapping responsibilities. Native findings are validated
+and merged into the TypeScript report; they are not alternative scanners.
+
+## Runtime layers
+
+```text
+CLI (src/cli.ts)
+  ├─ argument parsing and terminal/JSON output
+  ├─ repository detection and scope selection
+  ├─ TypeScript scanner and analyzers
+  └─ native worker adapter (src/native.ts)
+       ├─ Rust worker: native/core/rust
+       │    ├─ shared file metrics
+       │    └─ Rust-specific analysis
+       └─ C++ worker: native/core/cpp
+            └─ C/C++-specific analysis
+```
+
+### TypeScript layer
+
+The TypeScript CLI is the default and source of truth. `src/scan.ts` walks and
+reads files once, `src/detect.ts` builds project profiles, and registered
+analyzers turn the collected context into findings. This path works with the
+published npm package and does not require Rust, C++, Cargo, or CMake.
+
+### Native layer
+
+The native layer is intentionally separate from generic analyzer logic. Rust
+receives all selected files for shared byte/newline metrics and receives Rust
+files for Rust-specific checks. C++ receives only C and C++ files for
+C/C++-specific checks. These jobs run concurrently in `all` mode, so no worker
+repeats another worker's language analysis.
+
+Rust is built from `native/core/rust/Cargo.toml` and exposes a reusable library
+plus a thin JSONL binary. C++ is built with CMake from
+`native/core/cpp/CMakeLists.txt` and exposes a public header, analyzer
+implementation, and protocol executable.
+
+The current native checks are deliberately small but real: Rust reports
+`.unwrap()` usage and C++ reports the non-portable
+`#include <bits/stdc++.h>` include. Additional expensive, language-specific
+work can be added without moving report ownership out of TypeScript.
+
+## Engine selection
+
+The CLI accepts:
+
+| Engine       | Behavior                                                                                                                              |
+| ------------ | ------------------------------------------------------------------------------------------------------------------------------------- |
+| `all`        | Default; runs TypeScript, Rust, and C++ together. Falls back to the TypeScript-only report if any native job is unavailable or fails. |
+| `typescript` | Runs only the TypeScript implementation.                                                                                              |
+| `rust`       | Runs TypeScript plus Rust metrics and Rust analysis; fails if Rust is unavailable.                                                    |
+| `cpp`        | Runs TypeScript plus C++ analysis; fails if C++ is unavailable.                                                                       |
+
+The workers can be overridden with `FLAMER_RUST_CORE` and `FLAMER_CPP_CORE`:
+
+```bash
+FLAMER_RUST_CORE="$PWD/native/core/rust/target/release/flamer-core" \
+FLAMER_CPP_CORE="$PWD/native/core/cpp/build/flamer-core-cpp" \
+  node dist/cli.js .
+```
+
+## Worker protocol
+
+Workers communicate over newline-delimited JSON (JSONL):
+
+```json
+{ "protocol": 1, "operation": "file_metrics", "root": ".", "files": ["README.md"] }
+```
+
+Each request produces exactly one response on stdout. The operation determines
+the worker contract:
+
+| Worker | Operation       | Input files        | Responsibility                           |
+| ------ | --------------- | ------------------ | ---------------------------------------- |
+| Rust   | `file_metrics`  | all selected files | byte, newline, and readable-file metrics |
+| Rust   | `rust_analysis` | Rust files         | Rust-specific findings                   |
+| C++    | `cpp_analysis`  | C/C++ files        | C/C++-specific findings                  |
+
+Example response:
+
+```json
+{
+  "protocol": 1,
+  "ok": true,
+  "operation": "file_metrics",
+  "metrics": { "files": 1, "bytes": 1234, "lines": 42 },
+  "errors": [],
+  "duration_ms": 1
+}
+```
+
+Stdout is reserved for protocol messages. Diagnostics belong on stderr.
+Unknown protocol versions, operations, malformed responses, non-zero exits, and
+timeouts are errors. The TypeScript adapter validates the response before using
+it.
+
+## Build and test
+
+```bash
+npm test
+npm run native:build
+npm run native:test
+```
+
+The individual projects can also be built directly:
+
+```bash
+cargo build --release --manifest-path native/core/rust/Cargo.toml
+cmake -S native/core/cpp -B native/core/cpp/build -DCMAKE_BUILD_TYPE=Release
+cmake --build native/core/cpp/build --config Release
+```
+
+The npm native scripts validate that Cargo and CMake are installed and return
+an actionable error when either toolchain is missing. The C++ CMake project
+also exports `compile_commands.json` and contains a protocol smoke test.
+
+Native builds are checked independently in the Native Rust and Native C++
+GitHub Actions workflows. Compiled output is ignored and is not committed.
+
+## Release and installation roadmap
+
+The npm package remains the required installation:
+
+```bash
+npm install --global flamerjs
+```
+
+`flamerjs` declares platform-specific native packages under the publisher scope
+as optional
+dependencies. npm installs only the package matching the host OS and CPU:
+
+```text
+flamerjs
+└── @dummy3ye/flamer-native-linux-x64
+    ├── bin/flamer-core
+    └── bin/flamer-core-cpp
+```
+
+At runtime `src/native.ts` resolves both workers from that package. If npm
+skips the optional package, the package is unavailable for the platform, or a
+worker cannot start, default `all` mode falls back to TypeScript. The source
+build command creates the same package shape:
+
+```bash
+npm run native:build:all
+npm run native:package -- linux-x64
+```
+
+The release workflow must build and publish both workers for each supported
+OS/architecture package before that platform is advertised as native-enabled.
+The standalone installer and release archives can use the same worker
+artifacts.
+
+The eventual bundled release keeps the TypeScript CLI as the orchestration
+layer and packages both Rust and C++ workers. They are not alternatives:
+standard execution starts both, while the explicit engine flags are for
+debugging, benchmarking, and degraded environments.
+
+## Design constraints
+
+- Keep npm installation functional with Node.js alone; native packages remain
+  optional.
+- Keep findings and report semantics in TypeScript.
+- Keep workers deterministic and communicate only through the versioned
+  protocol; stdout is protocol-only and diagnostics use stderr.
+- Keep native execution fallback-safe until platform packaging and release
+  binaries are mature.
+- Do not duplicate generic analyzer work in native workers.
+- Add a benchmark before moving more work out of the TypeScript scanner.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flamerjs",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "Language-agnostic code health auditor that walks a repository once and reports what is wrong with it",
   "license": "MIT",
   "type": "module",
@@ -20,12 +20,18 @@
     "flamerjs": "./dist/cli.js"
   },
   "files": [
-    "dist"
+    "dist",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md",
+    "docs/ARCHITECTURE.md"
   ],
   "optionalDependencies": {
     "@dummy3ye/flamer-native-darwin-arm64": "1.1.1",
     "@dummy3ye/flamer-native-darwin-x64": "1.1.1",
+    "@dummy3ye/flamer-native-linux-arm64": "1.1.1",
     "@dummy3ye/flamer-native-linux-x64": "1.1.1",
+    "@dummy3ye/flamer-native-win32-arm64": "1.1.1",
     "@dummy3ye/flamer-native-win32-x64": "1.1.1"
   },
   "scripts": {