oathbound 0.1.0 → 0.1.2

package/README.md

@@ -80,4 +80,4 @@ The content hash algorithm is deterministic: files are sorted lexicographically
 
 ## License
 
-Apache 2.0
+Business Source License 1.1 (BUSL-1.1). The Change Date is 2028-03-04, after which the code is available under Apache 2.0.

package/cli.ts

@@ -7,19 +7,20 @@ import { writeFileSync, readFileSync, unlinkSync, existsSync, readdirSync, statS
 import { join, relative } from 'node:path';
 import { tmpdir } from 'node:os';
 
-const VERSION = '0.1.0';
+const VERSION = '0.1.2';
 
 // --- Supabase ---
 const SUPABASE_URL = 'https://mjnfqagwuewhgwbtrdgs.supabase.co';
 const SUPABASE_ANON_KEY = 'sb_publishable_T-rk0azNRqAMLLGCyadyhQ_ulk9685n';
 
-// --- ANSI ---
-const TEAL = '\x1b[38;2;63;168;164m'; // brand teal #3fa8a4
-const GREEN = '\x1b[32m';
-const RED = '\x1b[31m';
-const DIM = '\x1b[2m';
-const BOLD = '\x1b[1m';
-const RESET = '\x1b[0m';
+// --- ANSI (respect NO_COLOR standard: https://no-color.org) ---
+const USE_COLOR = process.env.NO_COLOR === undefined && process.stderr.isTTY;
+const TEAL = USE_COLOR ? '\x1b[38;2;63;168;164m' : ''; // brand teal #3fa8a4
+const GREEN = USE_COLOR ? '\x1b[32m' : '';
+const RED = USE_COLOR ? '\x1b[31m' : '';
+const DIM = USE_COLOR ? '\x1b[2m' : '';
+const BOLD = USE_COLOR ? '\x1b[1m' : '';
+const RESET = USE_COLOR ? '\x1b[0m' : '';
 
 // --- Types ---
 interface SkillRow {
@@ -67,7 +68,7 @@ function spinner(text: string): { stop: () => void } {
   return {
     stop() {
       clearInterval(interval);
-      process.stdout.write('\r\x1b[2K');
+      process.stdout.write(USE_COLOR ? '\r\x1b[2K' : '\n');
     },
   };
 }
@@ -180,8 +181,14 @@ async function readStdin(): Promise<string> {
 
 // --- Verify (SessionStart hook) ---
 async function verify(): Promise<void> {
-  const input = JSON.parse(await readStdin());
-  const sessionId: string = input.session_id;
+  let input: Record<string, unknown>;
+  try {
+    input = JSON.parse(await readStdin());
+  } catch {
+    process.stderr.write('oathbound verify: invalid JSON on stdin\n');
+    process.exit(1);
+  }
+  const sessionId: string = input.session_id as string;
   if (!sessionId) {
     process.stderr.write('oathbound verify: no session_id in stdin\n');
     process.exit(1);
@@ -243,10 +250,13 @@ async function verify(): Promise<void> {
   for (const [name, localHash] of Object.entries(localHashes)) {
     const registryHash = registryHashes.get(name);
     if (!registryHash) {
+      process.stderr.write(`${DIM}   ${name}: ${localHash} (not in registry)${RESET}\n`);
       rejected.push({ name, reason: 'not in registry' });
     } else if (localHash !== registryHash) {
+      process.stderr.write(`${RED}   ${name}: ${localHash} ≠ ${registryHash}${RESET}\n`);
       rejected.push({ name, reason: `content hash mismatch (local: ${localHash.slice(0, 8)}…, registry: ${registryHash.slice(0, 8)}…)` });
     } else {
+      process.stderr.write(`${GREEN}   ${name}: ${localHash} ✓${RESET}\n`);
       verified[name] = localHash;
     }
   }
@@ -273,9 +283,15 @@ async function verify(): Promise<void> {
 
 // --- Verify --check (PreToolUse hook) ---
 async function verifyCheck(): Promise<void> {
-  const input = JSON.parse(await readStdin());
-  const sessionId: string = input.session_id;
-  const skillName: string | undefined = input.tool_input?.skill;
+  let input: Record<string, unknown>;
+  try {
+    input = JSON.parse(await readStdin());
+  } catch {
+    process.stderr.write('oathbound verify --check: invalid JSON on stdin\n');
+    process.exit(1);
+  }
+  const sessionId: string = input.session_id as string;
+  const skillName: string | undefined = (input.tool_input as Record<string, unknown> | undefined)?.skill as string | undefined;
 
   if (!sessionId || !skillName) {
     // Can't verify — allow through (non-skill invocation or missing context)
@@ -288,7 +304,13 @@ async function verifyCheck(): Promise<void> {
     process.exit(0);
   }
 
-  const state: SessionState = JSON.parse(readFileSync(stateFile, 'utf-8'));
+  let state: SessionState;
+  try {
+    state = JSON.parse(readFileSync(stateFile, 'utf-8'));
+  } catch {
+    process.stderr.write('oathbound verify --check: corrupt session state file\n');
+    process.exit(1);
+  }
 
   // Extract just the skill name (strip namespace/ prefix if present)
   const baseName = skillName.includes(':') ? skillName.split(':').pop()! : skillName;
@@ -312,6 +334,7 @@ async function verifyCheck(): Promise<void> {
   const sessionHash = state.verified[baseName];
 
   if (!sessionHash) {
+    process.stderr.write(`${RED}   ${baseName}: ${currentHash} (not verified at session start)${RESET}\n`);
     console.log(JSON.stringify({
       hookSpecificOutput: {
         hookEventName: 'PreToolUse',
@@ -323,6 +346,7 @@ async function verifyCheck(): Promise<void> {
   }
 
   if (currentHash !== sessionHash) {
+    process.stderr.write(`${RED}   ${baseName}: ${currentHash} ≠ ${sessionHash} (tampered)${RESET}\n`);
     console.log(JSON.stringify({
       hookSpecificOutput: {
         hookEventName: 'PreToolUse',
@@ -333,6 +357,8 @@ async function verifyCheck(): Promise<void> {
     process.exit(0);
   }
 
+  process.stderr.write(`${GREEN}   ${baseName}: ${currentHash} ✓${RESET}\n`);
+
   // Hash matches — allow
   process.exit(0);
 }
@@ -373,19 +399,29 @@ async function pull(skillArg: string): Promise<void> {
   }
 
   const buffer = Buffer.from(await blob.arrayBuffer());
-  const tarFile = `${name}.tar.gz`;
+  const tarFile = join(tmpdir(), `oathbound-${name}-${Date.now()}.tar.gz`);
 
   // 3. Hash and verify
   const verify = spinner('Verifying...');
   const hash = createHash('sha256').update(buffer).digest('hex');
   verify.stop();
 
+  console.log(`${DIM}   tar hash: ${hash}${RESET}`);
+
   if (hash !== skill.tar_hash) {
+    console.log(`${RED}   expected: ${skill.tar_hash}${RESET}`);
     fail('Verification failed', `Downloaded file does not match expected hash for ${fullName}`);
   }
 
   // 4. Find target directory and extract
-  const skillsDir = findSkillsDir();
+  let skillsDir = findSkillsDir();
+  if (!skillsDir.endsWith('.claude/skills') && !skillsDir.includes('.claude/skills')) {
+    // findSkillsDir() fell back to cwd — create .claude/skills instead of extracting into project root
+    skillsDir = join(process.cwd(), '.claude', 'skills');
+    const { mkdirSync } = await import('node:fs');
+    mkdirSync(skillsDir, { recursive: true });
+    console.log(`${DIM}   Created ${skillsDir}${RESET}`);
+  }
   writeFileSync(tarFile, buffer);
   try {
     execFileSync('tar', ['-xf', tarFile, '-C', skillsDir], { stdio: 'pipe' });

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "oathbound",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Install verified Claude Code skills from the Oath Bound registry",
-  "license": "Apache-2.0",
+  "license": "BUSL-1.1",
   "author": "Josh Anderson",
   "homepage": "https://oathbound.ai",
   "repository": {