fundamentum-cli 0.1.5 → 0.2.0

package/README.md

@@ -27,6 +27,13 @@ npx fundamentum-cli apply OWNER/REPO
 
 Works on **macOS** and **Linux** (`x64` and `arm64`) and **Windows** (`x64`). Postinstall downloads the matching prebuilt binary from GitHub Releases with embedded SHA-256 verification.
 
+A git checkout keeps `package.json` at `0.0.0` and will not download a binary. Build it locally instead:
+
+```bash
+go build -o npm/bin/fundamentum .
+# Windows: go build -o npm/bin/fundamentum.exe .
+```
+
 > **npm 9+ / Ubuntu 26+ note:** npm's `allow-scripts` security policy may block the postinstall
 > script, so the binary won't be downloaded at install time. No worries — if `fundamentum` is invoked
 > without a binary present it detects this and downloads automatically. You can also trigger it
@@ -79,10 +86,17 @@ Built for solo devs and small teams who want their repos to feel like they were
 |---------|---------|
 | `apply OWNER/REPO` | Harden an existing repo |
 | `init OWNER/REPO` | Create a new repo, then harden it |
+| `audit OWNER/REPO` | Verify the repo matches the harden baseline |
+| `export` | Write a portable JSON baseline (`-o` for a file) |
 | `--dry-run` | Preview the full plan without applying |
-| `--pr` | Batch file changes into a pull request |
+| `--pr` | Batch file changes into a PR; settings/security/protection still apply live |
 | `--no-overwrite` | Only add missing files, never touch existing ones |
 | `--advanced-security` | Enable GHAS (secret scanning, push protection) on private/internal repos (paid) |
+| `--strict` | Fail the run when any core harden step fails, including optional tag/security items |
+| `--require-checks` | Required status-check contexts for protect-main (comma-separated; default: jobs for the resolved `--ci` pack) |
+| `--ci` | CI pack: `auto` (detect go/node/python/rust, else generic), `go`, `node`, `python`, `rust`, `generic`, or `none` |
+| `--preset` | Named baseline: `oss` (no prompts), `private` (solo, no GHAS prompt), `strict` (`--strict` + GHAS) |
+| `--from` | Load a portable JSON baseline from `export` |
 
 ## Prerequisites
 

package/install.js

@@ -18,6 +18,8 @@ const RELEASE_HOSTS = new Set([
   "github-releases.githubusercontent.com",
 ]);
 
+const binaryName = process.platform === "win32" ? "fundamentum.exe" : "fundamentum";
+
 const PLATFORM_MAP = {
   linux: "linux",
   darwin: "darwin",
@@ -171,8 +173,6 @@ function extract(buffer, archiveName, binDir) {
       spawnOrFail("tar", ["-xzf", archivePath, "-C", tmpDir], "tar");
     }
 
-    // Find the binary in the extracted files
-    const binaryName = process.platform === "win32" ? "fundamentum.exe" : "fundamentum";
     const extractedBinary = path.join(tmpDir, binaryName);
 
     if (!fs.existsSync(extractedBinary)) {
@@ -197,7 +197,15 @@ async function main() {
   );
   const version = getPackageVersion(pkg);
   if (version === "0.0.0") {
-    console.error("fundamentum: skipping binary download for development version");
+    console.error(
+      "fundamentum: package version is 0.0.0 (git checkout / unpublished).\n" +
+        "The release installer will not download a binary from here.\n" +
+        "Build locally instead:\n" +
+        "  go build -o npm/bin/" +
+        binaryName +
+        " .\n" +
+        "Or install a published release: npm install -g fundamentum-cli"
+    );
     return;
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fundamentum-cli",
-  "version": "0.1.5",
+  "version": "0.2.0",
   "description": "Bootstrap and harden GitHub repos for OSS collaboration — community files, branch protection, security features, and starter workflows in one command.",
   "license": "MIT",
   "repository": {
@@ -57,10 +57,10 @@
     "bin/"
   ],
   "binaryChecksums": {
-    "fundamentum_0.1.5_darwin_amd64.tar.gz": "92f051cb4eaba47cd09b31a0011fc682f272488323c10e36ddaca5121fac24ea",
-    "fundamentum_0.1.5_darwin_arm64.tar.gz": "c6d69c3c30195e74e834471c2eed8121fbd4b59a2f502e5831abc1933dd34e9f",
-    "fundamentum_0.1.5_linux_amd64.tar.gz": "375d2578f4f9ef0c836bb86295dbc6976b27ff0608c3bd0ebdce5665e540dcf0",
-    "fundamentum_0.1.5_linux_arm64.tar.gz": "404b56dc51a8209086b93f92d345026adf452f0460c67a1e701fcf3d728488e8",
-    "fundamentum_0.1.5_windows_amd64.zip": "cd78b7916a5f7f2b1c48b922585d562b0bd593326802514f244221dced5168ad"
+    "fundamentum_0.2.0_darwin_amd64.tar.gz": "ac98ef35f9d9b98dee08bae90f183f01ce73b6df3bd96ac9b0247e1cd99bab12",
+    "fundamentum_0.2.0_darwin_arm64.tar.gz": "440abfc2188ad9f2c8446a33295607bf48d8600500f9d6495e96fd5a818c6d45",
+    "fundamentum_0.2.0_linux_amd64.tar.gz": "a95a08f3aa3fcc66ae16c70727715924c3954fc7135d1d708bdc50f9935ebdb2",
+    "fundamentum_0.2.0_linux_arm64.tar.gz": "b5b860ee8fb564e5fd504b29432aa993f982c0257697da7f308664aad6c8ca41",
+    "fundamentum_0.2.0_windows_amd64.zip": "6a77d313bdca82db855a8d611d962e8e86e6b97665fff7649baf1c6a69a33a02"
   }
 }

package/run.js

@@ -37,10 +37,34 @@ function runBinary() {
   });
 }
 
+function isDevCheckout() {
+  try {
+    const pkg = JSON.parse(
+      fs.readFileSync(path.join(__dirname, "package.json"), "utf8")
+    );
+    return pkg.version === "0.0.0";
+  } catch (_) {
+    return false;
+  }
+}
+
 // If the binary is missing, postinstall was likely blocked by npm's allow-scripts
 // security policy. Attempt a lazy download, but the package dir may be root-owned
 // (e.g. sudo npm install -g). In that case, surface a clear recovery message.
 if (!fs.existsSync(binaryPath)) {
+  if (isDevCheckout()) {
+    console.error(
+      "fundamentum: binary not found and package version is 0.0.0 (git checkout).\n" +
+        "install.js will not download a release binary in this state.\n" +
+        "Build locally:\n" +
+        "  go build -o npm/bin/" +
+        binaryName +
+        " .\n" +
+        "Or install a published release: npm install -g fundamentum-cli"
+    );
+    process.exit(1);
+  }
+
   const installScript = path.join(__dirname, "install.js");
 
   // Check if we can write to the package dir before attempting the download.