release-skill 0.2.0 → 0.2.1

package/adapters/workbuddy/bin/release-skill.mjs

@@ -0,0 +1,54 @@
+#!/usr/bin/env node
+/**
+ * release-skill CLI entry point.
+ *
+ * Loads the self-contained bundle (release-skill.bundle.mjs) which runs
+ * without node_modules. Fails closed with a clear error when the bundle
+ * is missing — never falls back to source CLI in installed state.
+ */
+
+import { stat } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const bundlePath = join(__dirname, 'release-skill.bundle.mjs');
+
+let bundleExists = false;
+try {
+  const st = await stat(bundlePath);
+  bundleExists = st.isFile();
+} catch {
+  // Bundle does not exist.
+}
+
+if (!bundleExists) {
+  // Fail closed with static text only: never interpolate bundlePath (or any
+  // other machine-specific value) so a copied/installed launcher cannot leak
+  // absolute paths, usernames, or host layout on stdout/stderr. This branch
+  // is self-contained by design — it must not import src/* or rely on the
+  // missing bundle's redaction helpers.
+  console.error(
+    `Error: release-skill bundle not found (release-skill.bundle.mjs).\n` +
+    `The self-contained bundle is required for installed-plugin execution.\n` +
+    `Reinstall the plugin, or run 'node scripts/build-bundle.mjs' in a source checkout to rebuild it.`,
+  );
+  process.exit(1);
+}
+
+// The bundle owns the command lifecycle: its entry awaits command completion
+// and exits with the real business exit code (success, business errors,
+// handled async rejections, unknown commands). The launcher only guards the
+// load itself: if the bundle cannot be evaluated (corrupt or incompatible
+// build), fail closed with static text only — module-load failures carry
+// absolute paths in their messages, so the failure is never interpolated.
+try {
+  await import(bundlePath);
+} catch {
+  console.error(
+    `Error: release-skill bundle failed to load (release-skill.bundle.mjs).\n` +
+    `The self-contained bundle is required for installed-plugin execution.\n` +
+    `Reinstall the plugin, or run 'node scripts/build-bundle.mjs' in a source checkout to rebuild it.`,
+  );
+  process.exit(1);
+}

package/adapters/workbuddy/native/safe-write/binding.gyp

@@ -0,0 +1,41 @@
+{
+  "variables": {
+    "test_seam%": "0"
+  },
+  "targets": [
+    {
+      "target_name": "safe_write",
+      "sources": ["src/safe_write.cc"],
+      "include_dirs": [],
+      "cflags!": ["-fno-exceptions"],
+      "cflags_cc!": ["-fno-exceptions"],
+      "cflags_cc": ["-std=c++20"],
+      "defines": ["NAPI_VERSION=9"],
+      "conditions": [
+        [
+          "test_seam==1",
+          {
+            "defines": ["SAFE_WRITE_TEST_SEAM=1"]
+          }
+        ],
+        [
+          "OS=='mac'",
+          {
+            "xcode_settings": {
+              "GCC_ENABLE_CPP_EXCEPTIONS": "YES",
+              "CLANG_CXX_LANGUAGE_STANDARD": "c++20",
+              "MACOSX_DEPLOYMENT_TARGET": "11.0",
+              "GCC_GENERATE_DEBUGGING_SYMBOLS": "NO"
+            }
+          }
+        ],
+        [
+          "OS=='linux'",
+          {
+            "cflags_cc": ["-std=c++20"]
+          }
+        ]
+      ]
+    }
+  ]
+}

package/adapters/workbuddy/native/safe-write/prebuilds.json

@@ -0,0 +1,24 @@
+{
+  "comment": "Registered Node-API prebuilds. Each entry is loaded only after path, file identity, exports, and SHA-256 verification.",
+  "prebuilds": {
+    "darwin-arm64": {
+      "path": "prebuilds/darwin-arm64/safe_write.node",
+      "sha256": "f5ffc367a1c49fed812dc430246cd8b07fb722653cc9738acabcedb17d6bab67",
+      "exports": [
+        "openRoot",
+        "openDir",
+        "readEntry",
+        "readFile",
+        "createTemp",
+        "rename",
+        "abortTemp",
+        "mkdir",
+        "rmdir",
+        "unlink",
+        "chmod",
+        "fsync",
+        "close"
+      ]
+    }
+  }
+}