fundamentum-cli 0.1.0 → 0.1.2

package/README.md

@@ -2,15 +2,13 @@
 
 **One command to make your GitHub repo look (and behave) like a pro open-source project.**
 
-[npm](https://www.npmjs.com/package/fundamentum-cli) · [GitHub](https://github.com/jpvelasco/fundamentum)
+[GitHub](https://github.com/jpvelasco/fundamentum)
 
 Fundamentum bootstraps and hardens GitHub repos for OSS collaboration — community health files, branch protection, secret scanning, and starter CI workflows. You bring the code, it brings the polish.
 
 <p align="center">
   <a href="https://github.com/jpvelasco/fundamentum/actions/workflows/ci.yml"><img src="https://github.com/jpvelasco/fundamentum/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
   <a href="https://github.com/jpvelasco/fundamentum/releases/latest"><img src="https://img.shields.io/github/v/release/jpvelasco/fundamentum" alt="Release"></a>
-  <a href="https://www.npmjs.com/package/fundamentum-cli"><img src="https://img.shields.io/npm/v/fundamentum-cli" alt="npm"></a>
-  <a href="https://www.npmjs.com/package/fundamentum-cli"><img src="https://img.shields.io/npm/dm/fundamentum-cli" alt="npm downloads"></a>
   <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/License-MIT-blue.svg" alt="MIT License"></a>
 </p>
 
@@ -27,7 +25,7 @@ npx fundamentum-cli --version
 npx fundamentum-cli apply OWNER/REPO
 ```
 
-Works on **macOS**, **Linux**, and **Windows** — `x64` and `arm64`. Postinstall downloads the matching prebuilt binary from GitHub Releases with embedded SHA-256 verification.
+Works on **macOS** and **Linux** (`x64` and `arm64`) and **Windows** (`x64`). Postinstall downloads the matching prebuilt binary from GitHub Releases with embedded SHA-256 verification.
 
 > **npm 9+ / Ubuntu 26+ note:** npm's `allow-scripts` security policy may block the postinstall
 > script, so the binary won't be downloaded at install time. No worries — if `fundamentum` is invoked

package/install.js

@@ -29,6 +29,17 @@ const ARCH_MAP = {
   arm64: "arm64",
 };
 
+function getPackageVersion(pkg) {
+  const version = pkg.version;
+
+  // Validate semver format to prevent URL injection
+  if (!/^\d+\.\d+\.\d+(-[a-zA-Z0-9.]+)?(\+[a-zA-Z0-9.]+)?$/.test(version)) {
+    throw new Error(`Invalid version format: ${version}`);
+  }
+
+  return version;
+}
+
 function getArchiveName(version, platform, arch) {
   const os = PLATFORM_MAP[platform];
   const cpu = ARCH_MAP[arch];
@@ -178,7 +189,7 @@ async function main() {
   const pkg = JSON.parse(
     fs.readFileSync(path.join(__dirname, "package.json"), "utf8")
   );
-  const version = pkg.version;
+  const version = getPackageVersion(pkg);
   if (version === "0.0.0") {
     console.error("fundamentum: skipping binary download for development version");
     return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fundamentum-cli",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Bootstrap and harden GitHub repos for OSS collaboration — community files, branch protection, security features, and starter workflows in one command.",
   "license": "MIT",
   "repository": {
@@ -57,10 +57,10 @@
     "bin/"
   ],
   "binaryChecksums": {
-    "fundamentum_0.1.0_darwin_amd64.tar.gz": "9d7be6fbfee6414005932547e1cc2cef54580739a5a265573942c80bb5fd28d9",
-    "fundamentum_0.1.0_darwin_arm64.tar.gz": "e50920a5522c9739899e30aa8f9414ac8a66bfcea4b91ef98e2c38f407d54b75",
-    "fundamentum_0.1.0_linux_amd64.tar.gz": "1772182f6c1d6a13b0e23bafb01ce89a8b9316895b778ce7a38ce2a9409fff16",
-    "fundamentum_0.1.0_linux_arm64.tar.gz": "5506f3002cdd4fad7ee641dfb023672c80d0e8934602906e9c8bb35a643da4ab",
-    "fundamentum_0.1.0_windows_amd64.zip": "ba5d12e8a0dbcae168adf7f68141910e0536c186f2921adba000a5b486f68853"
+    "fundamentum_0.1.2_darwin_amd64.tar.gz": "3a80afe84553b993fed503fcceee2d206c57dc023ad93c719f37837903bc53e4",
+    "fundamentum_0.1.2_darwin_arm64.tar.gz": "6554bb025c3d166c12fe50dde2209546b23c42822ffebfaf34c14528ecd335a2",
+    "fundamentum_0.1.2_linux_amd64.tar.gz": "3e827ed72c7ff851fa01f7b834dbaf1962bece2caf862154c3f62cf27bc66262",
+    "fundamentum_0.1.2_linux_arm64.tar.gz": "0c5dd67a622553124bbfe6d480e691d895dab1fddf0461e9f42f81db87e9d0d4",
+    "fundamentum_0.1.2_windows_amd64.zip": "5c0867554b208e6bf502eee9fb5897a67ae94d88ab41031a5f70169fabe9de08"
   }
 }