shardstitch 0.0.9 → 0.0.10

package/README.md

@@ -1,65 +1,71 @@
-# ShardStitch
-
-**"Rate limit reached." "Context window full." "VRAM out of memory."**
-
-Your code is half-written. Your plan is in your head. ShardStitch captures your entire session — git diff, changed files, dependency graph, intent — and stitches it into the next AI tool. One hotkey. Keep building like nothing happened.
-
-## Install
-
-```bash
-npm install shardstitch
-npx shardstitch
-```
-
-## What it does
-
-When Claude, Cursor, Codex, or Gemini locks you out mid-session, ShardStitch:
-
-1. **Scans your project** — git diff, changed files, recent commits, your notes
-2. **Builds a dependency graph** — impact radius, architecture communities — and warns the next AI what's dangerous to touch
-3. **Generates a continuation prompt** formatted for the target tool
-4. **Injects it** into the tool's pickup file (CLAUDE.md, AGENTS.md, GEMINI.md, .cursorrules) for automatic discovery
-
-Under 30 seconds, end to end.
-
-## Not just for switching tools
-
-The same trick fixes a bloated session in the *same* tool. Long AI chats accumulate a huge context tree — token burn climbs, responses slow down, and eventually you hit "Service is busy" even with quota left. ShardStitch is the clean-restart button: extract a compact context, open a fresh window of the same tool, paste, keep going.
-
-## 22 supported AI tools
-
-Claude Code, Claude Desktop, Cursor, Codex CLI, Gemini CLI, Windsurf, Aider, Kiro, Amazon Q Developer, DeepSeek, OpenCode, Trae, Factory Droid, OpenClaw, Amp, Cline, Roo Code, Kilo Code, Crush, Kimi, Qwen Code, and Antigravity.
-
-**Coming soon:** Cody, Continue, Replit Agent, JetBrains AI, Tabnine.
-
-## 7 surfaces
-
-- **Web dashboard** — scan, generate, copy, download
-- **VS Code / Cursor extension** — Alt+G hotkey
-- **MCP server** — Claude Code and Cursor call it directly
-- **CLI** — `npx shardstitch` or `shardstitch capture`
-- **Desktop app** — standalone Windows exe
-- **Autosave hooks** — auto-inject on session end
-- **Local LLM failover** — Ollama, vLLM, LM Studio (zero cloud)
-
-## Key features
-
-- **Per-agent formatting** — 22 format adapters, one for each tool
-- **AI task router** — semantic matching picks the best tool for each task
-- **Persistent memory** — project decisions survive across sessions
-- **Team coordination** — shared `.shardstitch/` directory
-- **Tamper-evident audit trail** — hash-chained timeline logs
-- **Dependency graph analysis** — impact radius, god nodes, architecture communities
-
-## 100% local
-
-Your code never leaves your machine. No cloud, no telemetry, no account required. All processing happens on your hardware.
-
-## Links
-
-- Website: https://shardstitch.com
-- GitHub: https://github.com/shardstitch/shardstitch
-- X / Twitter: https://x.com/ShardStitch
-- VS Code / Cursor Extension: https://marketplace.visualstudio.com/items?itemName=shardstitch.shardstitch
-- Changelog: https://github.com/shardstitch/shardstitch/releases
-- Support: support@shardstitch.com
+# ShardStitch
+
+**"Rate limit reached." "Context window full." "VRAM out of memory."**
+
+Your code is half-written. Your plan is in your head. ShardStitch captures your entire session — git diff, changed files, dependency graph, intent — and stitches it into the next AI tool. One hotkey. Keep building like nothing happened.
+
+## Install
+
+```bash
+npm install -g shardstitch              # installs the launcher
+shardstitch install <your-license-key>  # after purchase — downloads & activates the app
+shardstitch                             # launch the dashboard
+```
+
+ShardStitch is a **one-time purchase** (no subscription). `npm install` gives you the
+installer; activate it with the license key from your purchase email. Get a key at
+[shardstitch.com](https://shardstitch.com).
+
+## What it does
+
+When Claude, Cursor, Codex, or Gemini locks you out mid-session, ShardStitch:
+
+1. **Scans your project** — git diff, changed files, recent commits, your notes
+2. **Builds a dependency graph** — impact radius, architecture communities — and warns the next AI what's dangerous to touch
+3. **Generates a continuation prompt** formatted for the target tool
+4. **Injects it** into the tool's pickup file (CLAUDE.md, AGENTS.md, GEMINI.md, .cursorrules) for automatic discovery
+
+Under 30 seconds, end to end.
+
+## Not just for switching tools
+
+The same trick fixes a bloated session in the *same* tool. Long AI chats accumulate a huge context tree — token burn climbs, responses slow down, and eventually you hit "Service is busy" even with quota left. ShardStitch is the clean-restart button: extract a compact context, open a fresh window of the same tool, paste, keep going.
+
+## 23 supported AI tools
+
+Claude Code, Claude Desktop, Cursor, Codex CLI, Gemini CLI, Windsurf, Aider, Kiro, Amazon Q Developer, DeepSeek, OpenCode, Trae, Factory Droid, OpenClaw, Amp, Cline, Roo Code, Kilo Code, Crush, Kimi, Qwen Code, Antigravity, and Grok.
+
+## 7 surfaces
+
+- **Web dashboard** — scan, generate, copy, download
+- **VS Code / Cursor extension** — Alt+G hotkey
+- **MCP server** — Claude Code, Cursor, and Windsurf call it directly
+- **CLI** — `npx shardstitch` or `shardstitch capture`
+- **Desktop app** — standalone Windows exe
+- **Autosave hooks** — auto-inject on session end
+- **Local LLM failover** — Ollama, vLLM, LM Studio (zero cloud)
+
+## Key features
+
+- **Per-agent formatting** — 22 per-agent format adapters across the 23 supported tools
+- **AI task router** — semantic matching picks the best tool for each task
+- **Persistent memory** — project decisions survive across sessions
+- **Team coordination** — shared `.shardstitch/` directory
+- **Tamper-evident audit trail** — hash-chained timeline logs
+- **Dependency graph analysis** — impact radius, god nodes, architecture communities
+
+## Local-first
+
+Your code and conversations never leave your machine — no telemetry, no cloud
+processing. The **only** network call is a single HTTPS request at activation to
+validate your license key; everything else runs entirely on your hardware.
+Activation needs a license key, not an account.
+
+## Links
+
+- Website: https://shardstitch.com
+- GitHub: https://github.com/shardstitch/shardstitch
+- X / Twitter: https://x.com/ShardStitch
+- VS Code / Cursor Extension: https://marketplace.visualstudio.com/items?itemName=shardstitch.shardstitch
+- Changelog: https://github.com/shardstitch/shardstitch/releases
+- Support: support@shardstitch.com

package/cli.js

@@ -17,13 +17,21 @@ const ACTIVATION_FILE = join(os.homedir(), ".shardstitch", "activation.json");
 const MACHINE_SALT = "shardstitch-activation/1";
 
 // --- Supply-chain hardening -------------------------------------------------
-// The binary SHA-256 is baked into this file at release time. No external
-// checksums.json needed — Polar delivers the file, we verify the hash locally.
-// Update these after every build before publishing.
-const CHECKSUMS = {
+// The binary is downloaded over HTTPS and its SHA-256 is verified against the
+// hashes EMBEDDED in this published package BEFORE it is ever made executable
+// or run. Embedding (rather than fetching a manifest from the same host that
+// serves the binary) means a compromised download origin cannot swap the
+// binary without also defeating npm's own package integrity — a strictly
+// stronger trust anchor. Downloads (and any redirects) are additionally
+// restricted to an allowlist of trusted hosts. See SECURITY.md.
+//
+// Keep in lockstep with packages/pypi/shardstitch/__init__.py _CHECKSUMS.
+// Regenerate with: python tools/gen_checksums.py. An empty string means "no
+// binary published for this platform yet" — cmdInstall fails CLOSED on it.
+const EMBEDDED_CHECKSUMS = {
   windows: "14642911d2f2fee8baf92ad30948b96e01dbd66167bab3ab0cbf443a33ea58a6",
-  linux:   "14642911d2f2fee8baf92ad30948b96e01dbd66167bab3ab0cbf443a33ea58a6",
-  mac:     "14642911d2f2fee8baf92ad30948b96e01dbd66167bab3ab0cbf443a33ea58a6",
+  linux: "",
+  mac: "",
 };
 const TRUSTED_DOWNLOAD_HOST_SUFFIXES = [
   "shardstitch.com",
@@ -184,7 +192,6 @@ function sha256File(path) {
   });
 }
 
-
 async function cmdInstall(key) {
   key = key.trim();
   console.log();
@@ -247,7 +254,7 @@ async function cmdInstall(key) {
   // on our pinned domain BEFORE making it executable or running it. Fails closed.
   const allowUnverified = process.argv.includes("--allow-unverified");
   try {
-    const expected = (CHECKSUMS[PLATFORM] || "").toLowerCase();
+    const expected = (EMBEDDED_CHECKSUMS[PLATFORM] || "").toLowerCase();
     const actual = (await sha256File(exePath)).toLowerCase();
     if (!expected) {
       throw new Error(`no published checksum for platform "${PLATFORM}"`);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "shardstitch",
-  "version": "0.0.9",
-  "description": "ShardStitch — capture your AI coding session (git diff, dependency graph, intent) and stitch it into the next tool. 22 AI tools supported. 100% local, zero telemetry. https://shardstitch.com",
+  "version": "0.0.10",
+  "description": "ShardStitch — capture your AI coding session (git diff, dependency graph, intent) and stitch it into the next tool. 23 AI tools supported. Local-first, no telemetry. https://shardstitch.com",
   "homepage": "https://shardstitch.com",
   "bugs": {
     "url": "https://github.com/shardstitch/shardstitch/issues"