corgea-cli 1.9.0__tar.gz → 1.9.2__tar.gz

{corgea_cli-1.9.0 → corgea_cli-1.9.2}/.github/workflows/npm-publish.yml

@@ -51,7 +51,7 @@ jobs:
         shell: bash
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: refs/tags/${{ needs.prepare.outputs.tag_name }}
 

{corgea_cli-1.9.0 → corgea_cli-1.9.2}/.github/workflows/release-binaries.yml

@@ -40,7 +40,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ inputs.tag || github.ref }}
 

{corgea_cli-1.9.0 → corgea_cli-1.9.2}/.github/workflows/release.yml

@@ -31,7 +31,7 @@ jobs:
             target: x86
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Prepare resilient maturin download for manylinux Docker
         run: |
           bin_dir="${RUNNER_TEMP}/maturin-docker-bin"
@@ -96,7 +96,7 @@ jobs:
           - runner: windows-latest
             target: x86
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Build wheels
         uses: PyO3/maturin-action@v1
         with:
@@ -118,7 +118,7 @@ jobs:
           - runner: macos-14
             target: aarch64
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Build wheels
         uses: PyO3/maturin-action@v1
         with:
@@ -133,7 +133,7 @@ jobs:
   sdist:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Build sdist
         uses: PyO3/maturin-action@v1
         with:

corgea_cli-1.9.2/.github/workflows/staging-contract.yml

@@ -0,0 +1,34 @@
+name: Staging vuln-api contract
+
+# The deterministic staging-target contract tests are #[ignore]d so the
+# default `./harness ci` gate stays hermetic (no network). This scheduled,
+# non-blocking job runs them against the live staging worker so endpoint /
+# schema / seed drift is caught out-of-band instead of shipping undetected.
+# It does not gate PRs — failures here signal "the staging contract moved",
+# not "this PR is broken".
+
+on:
+  schedule:
+    # Daily at 07:00 UTC.
+    - cron: "0 7 * * *"
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+jobs:
+  staging-contract:
+    name: vuln-api staging contract (non-blocking)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache cargo
+        uses: Swatinem/rust-cache@v2
+
+      - name: Run ignored staging contract tests
+        run: cargo test --test vuln_api_contract -- --ignored

{corgea_cli-1.9.0 → corgea_cli-1.9.2}/.github/workflows/test.yml

@@ -13,7 +13,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable

{corgea_cli-1.9.0 → corgea_cli-1.9.2}/.github/workflows/update_docs..yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Run AI Docs Sync
         uses: Corgea/internal_actions/sync-docs-action@main

{corgea_cli-1.9.0 → corgea_cli-1.9.2}/Cargo.lock

@@ -105,6 +105,18 @@ dependencies = [
  "derive_arbitrary",
 ]
 
+[[package]]
+name = "async-compression"
+version = "0.4.42"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e79b3f8a79cccc2898f31920fc69f304859b3bd567490f75ebf51ae1c792a9ac"
+dependencies = [
+ "compression-codecs",
+ "compression-core",
+ "pin-project-lite",
+ "tokio",
+]
+
 [[package]]
 name = "atomic-waker"
 version = "1.1.2"
@@ -287,6 +299,23 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
 
+[[package]]
+name = "compression-codecs"
+version = "0.4.38"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce2548391e9c1929c21bf6aa2680af86fe4c1b33e6cea9ac1cfeec0bd11218cf"
+dependencies = [
+ "compression-core",
+ "flate2",
+ "memchr",
+]
+
+[[package]]
+name = "compression-core"
+version = "0.4.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc14f565cf027a105f7a44ccf9e5b424348421a1d8952a8fc9d499d313107789"
+
 [[package]]
 name = "constant_time_eq"
 version = "0.3.1"
@@ -340,10 +369,11 @@ checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
 [[package]]
 name = "corgea"
-version = "1.9.0"
+version = "1.9.2"
 dependencies = [
  "chrono",
  "clap",
+ "corgea",
  "dirs",
  "env_logger",
  "git2",
@@ -359,6 +389,7 @@ dependencies = [
  "quick-xml",
  "regex",
  "reqwest",
+ "semver",
  "serde",
  "serde_derive",
  "serde_json",
@@ -419,9 +450,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.18"
+version = "0.9.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
 dependencies = [
  "crossbeam-utils",
 ]
@@ -1548,9 +1579,9 @@ dependencies = [
 
 [[package]]
 name = "quick-xml"
-version = "0.36.2"
+version = "0.41.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f7649a7b4df05aed9ea7ec6f628c67c9953a43869b8bc50929569b2999d443fe"
+checksum = "e660451e55124f798a69a5af3f49ccfbefbd41910eefd25caf2393e1f3473ec1"
 dependencies = [
  "memchr",
 ]
@@ -1625,6 +1656,7 @@ version = "0.12.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d0946410b9f7b082a427e4ef5c8ff541a88b357bc6c637c40db3a68ac70a36f"
 dependencies = [
+ "async-compression",
  "base64",
  "bytes",
  "cookie",
@@ -1651,6 +1683,7 @@ dependencies = [
  "sync_wrapper",
  "tokio",
  "tokio-native-tls",
+ "tokio-util",
  "tower",
  "tower-http",
  "tower-service",
@@ -1760,6 +1793,12 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "semver"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+
 [[package]]
 name = "serde"
 version = "1.0.228"

{corgea_cli-1.9.0 → corgea_cli-1.9.2}/Cargo.toml

@@ -1,17 +1,31 @@
 [package]
 name = "corgea"
-version = "1.9.0"
+version = "1.9.2"
 edition = "2021"
 readme = "README.md"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
+[[bin]]
+name = "corgea"
+path = "src/main.rs"
+
+[features]
+# Compiles the in-crate vuln-api test stub (`vuln_api_stub`). Enabled for all
+# test builds via the self dev-dependency below; never part of release builds.
+test-stub = []
+
+[dev-dependencies]
+corgea = { path = ".", features = ["test-stub"] }
+tempfile = "3.12.0"
+
 [dependencies]
 clap = { version = "4.4.13", features = ["derive"] }
 dirs = "5.0.1"
 reqwest = { version = "0.12.23", default-features = false, features = [
     "blocking",
     "cookies",
+    "gzip",
     "json",
     "multipart",
     "native-tls",
@@ -20,6 +34,7 @@ reqwest = { version = "0.12.23", default-features = false, features = [
 toml = "0.8.8"
 log = "0.4"
 env_logger = "0.11"
+semver = "1"
 serde = { version = "1.0.195", features = ["derive"] }
 serde_json = "1.0.111"
 serde_derive = "1.0.195"
@@ -27,7 +42,7 @@ uuid = { version = "1.7.0", features = ["v4"] }
 which = "6.0.0"
 zip = "2.3.0"
 tempfile = "3.12.0"
-quick-xml = "0.36.1"
+quick-xml = "0.41"
 ignore = "0.4"
 globset = "0.4"
 termcolor = "1.1"
@@ -46,3 +61,7 @@ serde_yaml_ng = "0.10"
 
 [target.'cfg(not(target_os = "windows"))'.dependencies]
 openssl = { version = "0.10", features = ["vendored"] }
+
+[profile.release]
+strip = true
+lto = "thin"

{corgea_cli-1.9.0 → corgea_cli-1.9.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: corgea-cli
-Version: 1.9.0
+Version: 1.9.2
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers

{corgea_cli-1.9.0 → corgea_cli-1.9.2}/README.md

@@ -50,6 +50,42 @@ corgea deps policy init --exist-ok     # write starter policy, or keep existing
 
 See [Dependency Scanning (CLI)](https://docs.corgea.app/cli/deps) for the full flag and exit-code reference.
 
+## Install Gate
+
+Prefix a package-manager install with `corgea` to vet every package it would
+install — named **and transitive** — against Corgea's vulnerability API *before*
+anything lands on disk. Known-vulnerable or malicious versions block the install;
+a clean set runs the underlying command untouched. Works with `pip`, `npm`,
+`yarn`, `pnpm`, and `uv`.
+
+No token required — baseline public CVE checks run out of the box. Try it:
+
+```bash
+corgea npm install lodash@4.17.20      # blocks: known-vulnerable (CVE-2025-13465), exits 1
+corgea pip install requests            # resolves, checks the verdict, then runs pip
+corgea npm install axios@^1.0.0        # ranges resolve to a concrete version first
+corgea pip --force install <pkg>       # print findings but install anyway
+corgea pip list                        # non-install subcommands pass straight through
+```
+
+`corgea pip install` and `corgea npm install` resolve the **full would-install
+set** (named + transitive) via a safe dry-run, so a vulnerable *transitive*
+dependency blocks too. Blocked findings steer to the fix: each advisory shows
+`fixed in <version>`, and the gate prints the safe version to install instead.
+
+The gate also blocks **freshly published** packages — anything published within
+the recency window (default 14 days) — to catch just-shipped typosquats and
+hijacks before advisory feeds catch up. It is on by default; turn it off with
+`recency_gate = false` in `~/.corgea/config.toml`, retune the window with
+`recency_threshold_days`, or pass `--force` for a one-off install.
+
+Logging in (`corgea login`) upgrades the gate to authenticated enforcement —
+unverifiable packages, resolution errors, and lookup failures then fail closed
+(public mode warns and continues). Wrapper flags (`--force`, `--json`) go between
+the manager and its command: `corgea npm --force install <pkg>`.
+
+See [the CLI docs](https://docs.corgea.app/cli) for the full flag and exit-code reference.
+
 ## Development Setup
 
 ### Prerequisites

corgea_cli-1.9.2/RELEASING.md

@@ -0,0 +1,127 @@
+# Releasing the Corgea CLI
+
+The `corgea` CLI ships to three channels, all driven by **one git tag**:
+
+| Channel | Package | Install |
+|---|---|---|
+| npm | `@corgea/cli` (scoped, bundles native binaries) | `npm install -g @corgea/cli` |
+| PyPI | `corgea-cli` (maturin-built wheels) | `pip install corgea-cli` |
+| GitHub Release | `corgea-<target>.zip` (raw binaries) | download from the [Releases page](https://github.com/Corgea/cli/releases) |
+
+Pushing an annotated `vX.Y.Z` tag to `main` fans out to three GitHub Actions workflows that build and publish all three. **Publishing is automated; the changelog is not** (see [Release notes](#release-notes)).
+
+## Versioning
+
+- **`Cargo.toml` `version` is the single source of truth.** Follow [SemVer](https://semver.org/).
+- **PyPI** reads it automatically: `pyproject.toml` sets `dynamic = ["version"]`, so maturin takes the version from `Cargo.toml`.
+- **npm** does *not* read `Cargo.toml`. `package.json` pins a placeholder (`0.0.0`); the real version is set from the **tag name** at publish time (`npm version <X.Y.Z> --no-git-tag-version` in `npm-publish.yml`).
+- **The tag, `Cargo.toml`, and the published version must agree.** Bump `Cargo.toml` to `X.Y.Z` *before* tagging `vX.Y.Z`, or PyPI ships a different version than npm/GitHub.
+- **Tags must be `v`-prefixed** (`v1.9.1`, not `1.9.1`). npm auto-publish keys off the tag starting with `v`; a non-`v` tag skips the npm publish entirely (this happened once with `1.8.8`).
+
+## Prerequisites
+
+- Write access to `Corgea/cli` and the [`gh`](https://cli.github.com/) CLI authenticated.
+- These repository secrets are already configured in CI (no per-release action needed): `PYPI_API_TOKEN`, `NPM_TOKEN`, `GITHUB_TOKEN`.
+- A clean checkout of `main` with all release-bound PRs already merged.
+
+## Release procedure
+
+1. **Land all changes on `main`** through reviewed PRs. Nothing ships that isn't on `main`.
+
+2. **Bump the version.** Edit `Cargo.toml` `version = "X.Y.Z"` and merge it to `main`. This is the only manual version edit; PyPI and npm derive theirs from it and the tag.
+
+3. **Gate on the merge commit.** From a clean `main`:
+   ```bash
+   git checkout main
+   git pull --ff-only
+   ./harness ci   # strict clippy (-D warnings), format check, dep audit, tests, coverage ≥ 13%
+   ```
+   Do not tag if `./harness ci` is red.
+
+4. **Tag and push.** Two equivalent options:
+
+   **a. Tag, then add notes (matches existing history):**
+   ```bash
+   git tag -a vX.Y.Z -m "vX.Y.Z"
+   git push origin vX.Y.Z
+   # after the release exists, fill notes (see below)
+   ```
+
+   **b. Create the GitHub Release + tag + notes in one step (recommended):**
+   ```bash
+   gh release create vX.Y.Z --target main --generate-notes
+   ```
+   `--generate-notes` produces the same "What's Changed / Full Changelog" body used by past releases. The tag push then triggers the publish workflows.
+
+5. **Watch the workflows, in this order** (Actions tab):
+
+   | # | Workflow | File | Publishes |
+   |---|---|---|---|
+   | 1 | **CI** | `release.yml` | wheels → **PyPI** (`corgea-cli`), on tag |
+   | 2 | **Native Binary Release** | `release-binaries.yml` | 6 target zips → **GitHub Release** |
+   | 3 | **Publish npm Package** | `npm-publish.yml` | bundles binaries → **npm** (`@corgea/cli`) |
+
+   Workflow 3 is triggered by workflow 2 completing successfully (and only when the tag is `v`-prefixed). If it does not auto-start, dispatch it manually:
+   ```bash
+   gh workflow run npm-publish.yml -f tag=vX.Y.Z
+   ```
+
+## What gets built
+
+- **PyPI wheels** (`release.yml`): Linux (x86_64, x86), Windows (x64, x86), macOS (x86_64, aarch64), plus an sdist. Asserts `manylinux2014` tags for broad Linux compatibility.
+- **Native binaries** (`release-binaries.yml`): `x86_64-unknown-linux-gnu`, `x86_64-unknown-linux-musl`, `aarch64-unknown-linux-gnu`, `x86_64-apple-darwin`, `aarch64-apple-darwin`, `x86_64-pc-windows-msvc`.
+- **npm binary bundling** (`npm-publish.yml` → `scripts/npm/bundle-binaries.js`): downloads the GitHub Release zips and lays them out as `vendor/<target>/corgea/corgea`. At runtime `bin/corgea.js` selects the binary for the host OS/arch. npm ships 5 of the 6 targets (Linux x64 uses the musl build).
+
+## Release notes
+
+There is **no automated changelog** — no `CHANGELOG.md`, no release-please/git-cliff, and the workflows do not set `generate_release_notes`. `release-binaries.yml` creates the GitHub Release with an **empty body**.
+
+Generate notes with GitHub's built-in feature, either via `gh release create … --generate-notes` (step 4b) or the **"Generate release notes"** button when editing the release. The established format is:
+
+```
+## What's Changed
+* <PR title> by @<author> in <PR link>
+...
+**Full Changelog**: https://github.com/Corgea/cli/compare/<prev>...vX.Y.Z
+```
+
+Release notes live on the GitHub Release, not in the repository, so updating them needs **no PR**.
+
+## Post-release verification
+
+Smoke-test every channel:
+
+```bash
+# npm
+npm install -g @corgea/cli@X.Y.Z
+corgea --version
+
+# PyPI (isolated)
+python3 -m venv /tmp/corgea-smoke
+/tmp/corgea-smoke/bin/pip install corgea-cli==X.Y.Z
+/tmp/corgea-smoke/bin/corgea --version
+```
+
+Confirm registry state:
+
+```bash
+npm view @corgea/cli version dist-tags
+python3 -m pip index versions corgea-cli
+gh release view vX.Y.Z
+```
+
+## Rollback
+
+Published package versions are **immutable** — you cannot overwrite `X.Y.Z` on npm or PyPI. **Roll forward:** fix, bump to the next patch (`X.Y.Z+1`), and release again. If a bad npm version must be discouraged, `npm deprecate '@corgea/cli@X.Y.Z' "reason"`.
+
+## Known issues
+
+- **npm idempotency guard checks the wrong name.** `npm-publish.yml` runs `npm view "corgea-cli@<version>"` (unscoped) to decide whether to skip, but the package is `@corgea/cli` (scoped). The guard never matches, so it never skips; re-running on an already-published version fails at `npm publish` instead of skipping cleanly. **Publishing itself is correct** (`npm publish` uses `package.json` → `@corgea/cli`), which is why releases succeed — only the skip optimization is broken. Fix: query `@corgea/cli`.
+- **`bin/corgea.js` reinstall hint is wrong.** Its "binary missing" message says `npm install -g corgea-cli@latest`; the npm package is `@corgea/cli`. (`corgea-cli` is the *PyPI* name.)
+- **npm auto-publish requires a `v`-prefixed tag.** Non-`v` tags build PyPI + binaries but skip npm; use the manual dispatch in step 5.
+
+## Reference
+
+- Workflows: `.github/workflows/release.yml`, `release-binaries.yml`, `npm-publish.yml`
+- Quality gate: `./harness ci` (see `AGENTS.md`)
+- Packaging: `Cargo.toml`, `pyproject.toml`, `package.json`, `bin/corgea.js`, `scripts/npm/bundle-binaries.js`

{corgea_cli-1.9.0 → corgea_cli-1.9.2}/harness

@@ -268,7 +268,7 @@ cmd_pre_commit() {
     printf "\n%s[pre-commit]%s\n\n" "$BLUE" "$RESET"
     # Check-only: never rewrite the working tree behind the commit.
     # Mirrors the CI gate so anything that passes here passes there.
-    run "Clippy (strict)" 0 -- cargo clippy -- -D warnings
+    run "Clippy (strict)" 0 -- cargo clippy --all-targets -- -D warnings
     run "Format check" 0 -- cargo fmt --check
     cmd_test
 }
@@ -282,7 +282,7 @@ cmd_check() {
     [ $? -eq 0 ] && passed=$(( passed + 1 )) || failed=$(( failed + 1 ))
     run "Format" 1 -- cargo fmt
     [ $? -eq 0 ] && passed=$(( passed + 1 )) || failed=$(( failed + 1 ))
-    run "Clippy (strict)" 1 -- cargo clippy -- -D warnings
+    run "Clippy (strict)" 1 -- cargo clippy --all-targets -- -D warnings
     [ $? -eq 0 ] && passed=$(( passed + 1 )) || failed=$(( failed + 1 ))
     run_with_summary "Tests" 1 -- cargo test
     [ $? -eq 0 ] && passed=$(( passed + 1 )) || failed=$(( failed + 1 ))
@@ -304,7 +304,7 @@ cmd_check() {
 
 cmd_ci() {
     printf "\n%s[ci]%s\n\n" "$BLUE" "$RESET"
-    run "Clippy (strict)" 0 -- cargo clippy -- -D warnings
+    run "Clippy (strict)" 0 -- cargo clippy --all-targets -- -D warnings
     run "Format check" 0 -- cargo fmt --check
     _cmd_audit_inner 1
     if ! cargo llvm-cov --version >/dev/null 2>&1; then