crowbar-cli 0.1.0__tar.gz → 0.1.1__tar.gz

{crowbar_cli-0.1.0 → crowbar_cli-0.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: crowbar-cli
-Version: 0.1.0
+Version: 0.1.1
 Summary: Retrieve CVEs and index them inside your codebase. One SQLite+FTS5 index, one CLI, one MCP server.
 Project-URL: Homepage, https://github.com/kushvinth/crowbar
 Project-URL: Repository, https://github.com/kushvinth/crowbar

{crowbar_cli-0.1.0 → crowbar_cli-0.1.1}/crowbar/__init__.py

@@ -1,3 +1,3 @@
 """crowbar - local vulnerability intelligence, terminal-first."""
 
-__version__ = "0.1.0"  # x-release-please-version
+__version__ = "0.1.1"  # x-release-please-version

{crowbar_cli-0.1.0 → crowbar_cli-0.1.1}/docs/LAUNCH.md

@@ -27,7 +27,7 @@ to `main`, `release-please` opens/updates a release PR; merging it tags
 
 So after the one-time setup, **publishing = merge the release PR**.
 
-The first cut is pinned: `release-as: 0.1.0` in `release-please-config.json` makes the release PR propose 0.1.0 whatever the commits since say. **Delete that line right after v0.1.0 is tagged**, or every later release PR proposes 0.1.0 again.
+v0.1.0 was cut with a temporary `release-as: 0.1.0` pin in `release-please-config.json`, removed once tagged; versions now follow the Conventional Commits since the last release.
 
 Registries publish only once switched on: set the repo variables `PUBLISH_NPM` / `PUBLISH_PYPI` to `true` (Settings > Secrets and variables > Actions > Variables). npm needs `NPM_TOKEN` to be a granular token with "bypass 2FA" enabled; PyPI needs the trusted publisher (owner `kushvinth`, repo `crowbar`, workflow `release.yml`, environment `pypi`). To publish an existing release to a registry switched on later, run the `release` workflow by hand with that tag (e.g. `gh workflow run release -f tag=v0.1.0`); versions already on a registry are skipped.
 

{crowbar_cli-0.1.0 → crowbar_cli-0.1.1}/scripts/install.mjs

@@ -81,10 +81,21 @@ export function describe(step, remove = false) {
   }
 }
 
-function backup(file, stamp) {
-  if (!fs.existsSync(file)) return null;
+// One read per file: the backup and the edit both start from this text, so
+// nothing can change the file between a check and its use.
+function readText(file) {
+  try {
+    return fs.readFileSync(file, "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT") return null;
+    throw e;
+  }
+}
+
+function backup(file, text, stamp) {
+  if (text === null) return null;
   const dst = `${file}.crowbar-backup-${stamp}`;
-  fs.copyFileSync(file, dst);
+  fs.writeFileSync(dst, text);
   return dst;
 }
 
@@ -104,11 +115,12 @@ export function apply(step, stamp = Date.now()) {
     return "registered";
   }
   fs.mkdirSync(path.dirname(step.file), { recursive: true });
-  const text = fs.existsSync(step.file) ? fs.readFileSync(step.file, "utf8") : "";
+  const original = readText(step.file);
+  const text = original ?? "";
   if (step.kind === "toml") {
     const header = `[${step.table}]`;
     if (text.split(/\r?\n/).some((l) => l.trim() === header)) return "already registered";
-    const saved = backup(step.file, stamp);
+    const saved = backup(step.file, original, stamp);
     const sep = text && !text.endsWith("\n") ? "\n\n" : text ? "\n" : "";
     fs.writeFileSync(step.file, `${text}${sep}${header}\n${step.body}`);
     return saved ? `updated (backup ${path.basename(saved)})` : "created";
@@ -120,7 +132,7 @@ export function apply(step, stamp = Date.now()) {
     // JSONC with comments or a broken file: leave it alone rather than rewrite it
     throw new Error(`${step.file} is not plain JSON - add crowbar by hand (npx crowbar-cli prints the block)`);
   }
-  const saved = backup(step.file, stamp);
+  const saved = backup(step.file, original, stamp);
   step.mutate(cfg);
   fs.writeFileSync(step.file, JSON.stringify(cfg, null, 2) + "\n");
   return saved ? `updated (backup ${path.basename(saved)})` : "created";
@@ -141,8 +153,8 @@ export function unapply(step, stamp = Date.now()) {
     if (r.status !== 0) throw new Error((r.stderr || r.stdout || "failed").trim());
     return "unregistered";
   }
-  if (!fs.existsSync(step.file)) return "not registered";
-  const text = fs.readFileSync(step.file, "utf8");
+  const text = readText(step.file);
+  if (text === null) return "not registered";
   if (step.kind === "toml") {
     const lines = text.split(/\r?\n/);
     const start = lines.findIndex((l) => l.trim() === `[${step.table}]`);
@@ -151,7 +163,7 @@ export function unapply(step, stamp = Date.now()) {
     while (end < lines.length && !(/^\s*\[/.test(lines[end]) && !lines[end].trim().startsWith(`[${step.table}.`))) end++;
     let from = start;      // and takes the blank lines setup put before it
     while (from > 0 && !lines[from - 1].trim()) from--;
-    const saved = backup(step.file, stamp);
+    const saved = backup(step.file, text, stamp);
     const rest = [...lines.slice(0, from), ...(from && end < lines.length ? [""] : []), ...lines.slice(end)];
     fs.writeFileSync(step.file, rest.join("\n").replace(/\n*$/, rest.some((l) => l.trim()) ? "\n" : ""));
     return `removed (backup ${path.basename(saved)})`;
@@ -162,9 +174,10 @@ export function unapply(step, stamp = Date.now()) {
   } catch {
     throw new Error(`${step.file} is not plain JSON - remove crowbar by hand`);
   }
-  if (!cfg[step.key]?.crowbar) return "not registered";
-  const saved = backup(step.file, stamp);
-  delete cfg[step.key].crowbar;
+  const servers = Object.hasOwn(cfg, step.key) ? cfg[step.key] : null;
+  if (!servers || typeof servers !== "object" || !Object.hasOwn(servers, "crowbar")) return "not registered";
+  const saved = backup(step.file, text, stamp);
+  delete servers.crowbar;
   fs.writeFileSync(step.file, JSON.stringify(cfg, null, 2) + "\n");
   return `removed (backup ${path.basename(saved)})`;
 }