fundamentum-cli 0.1.6 → 0.2.1

package/README.md

@@ -27,6 +27,13 @@ npx fundamentum-cli apply OWNER/REPO
 
 Works on **macOS** and **Linux** (`x64` and `arm64`) and **Windows** (`x64`). Postinstall downloads the matching prebuilt binary from GitHub Releases with embedded SHA-256 verification.
 
+A git checkout keeps `package.json` at `0.0.0` and will not download a binary. Build it locally instead:
+
+```bash
+go build -o npm/bin/fundamentum .
+# Windows: go build -o npm/bin/fundamentum.exe .
+```
+
 > **npm 9+ / Ubuntu 26+ note:** npm's `allow-scripts` security policy may block the postinstall
 > script, so the binary won't be downloaded at install time. No worries — if `fundamentum` is invoked
 > without a binary present it detects this and downloads automatically. You can also trigger it
@@ -79,10 +86,17 @@ Built for solo devs and small teams who want their repos to feel like they were
 |---------|---------|
 | `apply OWNER/REPO` | Harden an existing repo |
 | `init OWNER/REPO` | Create a new repo, then harden it |
+| `audit OWNER/REPO` | Verify the repo matches the harden baseline |
+| `export` | Write a portable JSON baseline (`-o` for a file) |
 | `--dry-run` | Preview the full plan without applying |
-| `--pr` | Batch file changes into a pull request |
+| `--pr` | Batch file changes into a PR; settings/security/protection still apply live |
 | `--no-overwrite` | Only add missing files, never touch existing ones |
 | `--advanced-security` | Enable GHAS (secret scanning, push protection) on private/internal repos (paid) |
+| `--strict` | Fail the run when any core harden step fails, including optional tag/security items |
+| `--require-checks` | Required status-check contexts for protect-main (comma-separated; default: jobs for the resolved `--ci` pack) |
+| `--ci` | CI pack: `auto` (detect go/node/python/rust, else generic), `go`, `node`, `python`, `rust`, `generic`, or `none` |
+| `--preset` | Named baseline: `oss` (no prompts), `private` (solo, no GHAS prompt), `strict` (`--strict` + GHAS) |
+| `--from` | Load a portable JSON baseline from `export` |
 
 ## Prerequisites
 

package/install.js

@@ -18,6 +18,8 @@ const RELEASE_HOSTS = new Set([
   "github-releases.githubusercontent.com",
 ]);
 
+const binaryName = process.platform === "win32" ? "fundamentum.exe" : "fundamentum";
+
 const PLATFORM_MAP = {
   linux: "linux",
   darwin: "darwin",
@@ -171,8 +173,6 @@ function extract(buffer, archiveName, binDir) {
       spawnOrFail("tar", ["-xzf", archivePath, "-C", tmpDir], "tar");
     }
 
-    // Find the binary in the extracted files
-    const binaryName = process.platform === "win32" ? "fundamentum.exe" : "fundamentum";
     const extractedBinary = path.join(tmpDir, binaryName);
 
     if (!fs.existsSync(extractedBinary)) {
@@ -197,7 +197,15 @@ async function main() {
   );
   const version = getPackageVersion(pkg);
   if (version === "0.0.0") {
-    console.error("fundamentum: skipping binary download for development version");
+    console.error(
+      "fundamentum: package version is 0.0.0 (git checkout / unpublished).\n" +
+        "The release installer will not download a binary from here.\n" +
+        "Build locally instead:\n" +
+        "  go build -o npm/bin/" +
+        binaryName +
+        " .\n" +
+        "Or install a published release: npm install -g fundamentum-cli"
+    );
     return;
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fundamentum-cli",
-  "version": "0.1.6",
+  "version": "0.2.1",
   "description": "Bootstrap and harden GitHub repos for OSS collaboration — community files, branch protection, security features, and starter workflows in one command.",
   "license": "MIT",
   "repository": {
@@ -57,10 +57,10 @@
     "bin/"
   ],
   "binaryChecksums": {
-    "fundamentum_0.1.6_darwin_amd64.tar.gz": "61e98ed2ea92e1cf7371a651f77893c0d0491b1ac7f2076b6c2c3913c3bee3eb",
-    "fundamentum_0.1.6_darwin_arm64.tar.gz": "ae03e391fe3f19ba5520a45ab5b80f8a34c72190179652a1838dc27aef6fdf69",
-    "fundamentum_0.1.6_linux_amd64.tar.gz": "427b616fb310af78532237723b858b4a3946405261207db8f013cfe0599a3add",
-    "fundamentum_0.1.6_linux_arm64.tar.gz": "fec30c53d5c1c5621281688b40d55859644130a526b61239a6f72cd5cab1fba8",
-    "fundamentum_0.1.6_windows_amd64.zip": "6a1d53fb7de1f047d14690bbafd598cce5cc93831605b5c58ede441fcf0e0fc1"
+    "fundamentum_0.2.1_darwin_amd64.tar.gz": "9b2e7663d4cc1ecb4a68dbebffd3c767163e8c4b3e289664a57b580a3c83038c",
+    "fundamentum_0.2.1_darwin_arm64.tar.gz": "2c3f781edda93765b1bd497cdb8ae96d0a33defff85402803fb3ba48988cfe90",
+    "fundamentum_0.2.1_linux_amd64.tar.gz": "0bbc0b978b416963bb0fe1a708b8b441ea48906cb7b9877e6469006fe27177cf",
+    "fundamentum_0.2.1_linux_arm64.tar.gz": "4eac1f23e17429da60d7689a366aadab53d6cdb251de0571c87ca9968fa10030",
+    "fundamentum_0.2.1_windows_amd64.zip": "4f0f645f2f03d9a59853aff9cc86f9de44458715cf35c94571be56178df30318"
   }
 }

package/run.js

@@ -37,10 +37,34 @@ function runBinary() {
   });
 }
 
+function isDevCheckout() {
+  try {
+    const pkg = JSON.parse(
+      fs.readFileSync(path.join(__dirname, "package.json"), "utf8")
+    );
+    return pkg.version === "0.0.0";
+  } catch (_) {
+    return false;
+  }
+}
+
 // If the binary is missing, postinstall was likely blocked by npm's allow-scripts
 // security policy. Attempt a lazy download, but the package dir may be root-owned
 // (e.g. sudo npm install -g). In that case, surface a clear recovery message.
 if (!fs.existsSync(binaryPath)) {
+  if (isDevCheckout()) {
+    console.error(
+      "fundamentum: binary not found and package version is 0.0.0 (git checkout).\n" +
+        "install.js will not download a release binary in this state.\n" +
+        "Build locally:\n" +
+        "  go build -o npm/bin/" +
+        binaryName +
+        " .\n" +
+        "Or install a published release: npm install -g fundamentum-cli"
+    );
+    process.exit(1);
+  }
+
   const installScript = path.join(__dirname, "install.js");
 
   // Check if we can write to the package dir before attempting the download.