@codeledger/cli - npm Package Compare versions

Comparing version 0.10.52 to 0.10.53

NOTICE

+CodeLedger CLI Wrapper Notice
+
+The npm package @codeledger/cli is a thin JavaScript wrapper licensed under
+the MIT License in LICENSE.
+
+During installation, the wrapper may download a platform-specific CodeLedger
+hardened binary from the matching GitHub Release. That downloaded binary is
+not part of the npm wrapper source package and is governed by LICENSE-CORE.
+
+The wrapper contains no CodeLedger engine source, scoring formulas, or model
+weights. It fetches, verifies, caches, and launches the hardened binary.

bin/codeledger.js

@@ -69,3 +69,2 @@ #!/usr/bin/env node
     env: { ...process.env, CODELEDGER_DELEGATED: '1' },
-    shell: runtime.kind === 'wrapper',
   });
@@ -72,0 +71,0 @@ if (result.error) {

LICENSE

@@ -1,61 +0,21 @@
-CodeLedger Core Engine License
-Version 1.0, 2025
+MIT License
 
-Copyright (c) 2025 Intelligent Context AI, Inc.
-All rights reserved.
+Copyright (c) 2026 Intelligent Context AI, Inc.
 
-GRANT OF LICENSE
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
 
-Subject to the terms of this license, Intelligent Context AI, Inc. ("Licensor")
-grants you a non-exclusive, non-transferable, revocable license to use the
-CodeLedger Core Engine binary ("Software") under the following conditions:
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
 
-1. INDIVIDUAL USE (FREE)
-   You may use the Software for personal, non-commercial development work
-   at no cost. This includes individual developers using the Software on
-   their own projects or contributing to open-source projects.
-
-2. OPEN-SOURCE PROJECTS (FREE)
-   You may use the Software in open-source projects licensed under
-   OSI-approved licenses at no cost.
-
-3. COMMERCIAL USE (LICENSE REQUIRED)
-   Use of the Software in commercial settings, including but not limited to:
-   - CI/CD pipelines
-   - Team development environments (>1 developer)
-   - Enterprise deployments
-   - Products or services that incorporate the Software
-   requires a CodeLedger Pro license. Contact [e-mail] for pricing.
-
-RESTRICTIONS
-
-You may NOT:
-- Reverse engineer, decompile, or disassemble the Software
-- Redistribute the Software as a standalone product
-- Remove or modify any license notices or proprietary markings
-- Use the Software to build a competing product or service
-
-PRIVACY GUARANTEE
-
-The Software:
-- Runs entirely on your local machine
-- Makes no network calls
-- Collects no telemetry, analytics, or usage data
-- Does not transmit your source code or any data to external services
-
-DISCLAIMER
-
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED. IN NO EVENT SHALL THE LICENSOR BE LIABLE FOR ANY CLAIM, DAMAGES, OR
-OTHER LIABILITY ARISING FROM THE USE OF THE SOFTWARE.
-
-TERMINATION
-
-This license terminates automatically if you breach any of its terms.
-Upon termination, you must destroy all copies of the Software.
-
-CONTACT
-
-Intelligent Context AI, Inc.
[e-mail]
-https://codeledger.dev/license
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package.json

 {
   "name": "@codeledger/cli",
-  "version": "0.10.52",
+  "version": "0.10.53",
   "mcpName": "io.github.codeledgerECF/codeledger",
@@ -14,3 +14,5 @@ "description": "Official ContextECF CodeLedger CLI wrapper. Installs the hardened binary from GitHub Releases; zero engine code ships in this package.",
     "README.md",
-    "LICENSE"
+    "LICENSE",
+    "LICENSE-CORE",
+    "NOTICE"
   ],
@@ -28,3 +30,3 @@ "dependencies": {},
   },
-  "license": "SEE LICENSE IN LICENSE",
+  "license": "MIT",
   "keywords": [
@@ -31,0 +33,0 @@ "codeledger",

README.md

@@ -30,2 +30,8 @@ # @codeledger/cli — ContextECF CodeLedger
 
+Installation downloads and verifies the binary only. It does not rewrite repo
+hooks, vendored runtimes, or ambient setup by default. After install, run
+`cd your-repo && codeledger ready`. Existing repos can opt into the ambient
+refresh step with `codeledger upgrade`, or by setting `CODELEDGER_RUN_UPGRADE=1`
+during installation.
+
 No engine code, scoring logic, or formulas ship to npm. The wrapper is
@@ -108,2 +114,3 @@ ~30 KB of plain JavaScript that fetches, verifies, and launches the
 | `CODELEDGER_SKIP_POSTINSTALL=1` | Skip the binary download during `npm install`. Useful for air-gapped environments. You are responsible for placing the binary at the expected cache path afterwards. |
+| `CODELEDGER_RUN_UPGRADE=1` | After a successful binary download, also run `codeledger upgrade`. This is opt-in because upgrade may refresh repo-local wrappers, hooks, and ambient setup. |
 | `CODELEDGER_BINARY_URL=<url>` | Override the download base URL. Use this to fetch the binary from a corporate mirror or internal CDN. The URL must serve the same filenames as the GitHub Release, plus a `SHA256SUMS-v<version>.txt` sibling. |
@@ -148,5 +155,7 @@ | `CODELEDGER_CACHE_DIR=<path>` | Override the cache directory (default `~/.cache/codeledger/bin`). |
 
-See `LICENSE`. The CodeLedger binary itself is governed by the
-CodeLedger Core Engine License.
+The npm wrapper is MIT licensed; see `LICENSE`.
 
+The downloaded CodeLedger hardened binary is governed by the CodeLedger Core
+Engine License; see `LICENSE-CORE`. `NOTICE` describes the wrapper/binary split.
+
 ## Source
@@ -153,0 +162,0 @@

scripts/postinstall.js

@@ -12,2 +12,4 @@ #!/usr/bin/env node
  *   CODELEDGER_SKIP_POSTINSTALL=1   — skip entirely (air-gapped installs)
+ *   CODELEDGER_RUN_UPGRADE=1        — after the binary download succeeds,
+ *                                     also run `codeledger upgrade`
  *   CODELEDGER_BINARY_URL=<url>     — override the release download base URL
@@ -132,2 +134,3 @@ *                                     (for corporate mirrors / internal CDNs).
 const BINARY_LOCAL_PATH = join(CACHE_DIR, BINARY_LOCAL_NAME);
+const FETCH_TIMEOUT_MS = 60_000;
 
@@ -144,2 +147,3 @@ // ─── http ────────────────────────────────────────────────────────────────────
       {
+        timeout: FETCH_TIMEOUT_MS,
         headers: {
@@ -177,3 +181,3 @@ 'User-Agent': `codeledger-installer/${version}`,
     req.on('error', reject);
-    req.setTimeout(60_000, () => {
+    req.setTimeout(FETCH_TIMEOUT_MS, () => {
       req.destroy(new Error(`timeout fetching ${url}`));
@@ -274,28 +278,26 @@ });
 
-  // Auto-run `codeledger upgrade` so users get a fully wired ambient setup
-  // in a single `npm install -g @codeledger/cli` command — no manual upgrade
-  // or vendor step needed. We use the bin wrapper path directly rather than
-  // relying on the global bin symlink being on PATH during postinstall.
-  const { spawnSync } = require('node:child_process');
-  const path = require('node:path');
-  const fs = require('node:fs');
-  const codeledgerBin = path.join(__dirname, '..', 'bin', 'codeledger.js');
-  // INIT_CWD is set by npm to the directory the user invoked npm from.
-  // Prefer it when it contains a .codeledger/ directory so upgrade runs
-  // against the user's repo rather than HOME, keeping the repo-local
-  // vendored CLI current. Fall back to HOME for the global ambient case.
-  const initCwd = process.env['INIT_CWD'];
-  const homeCwd = process.env['HOME'] ?? process.env['USERPROFILE'] ?? process.cwd();
-  const upgradeCwd =
-    initCwd && fs.existsSync(path.join(initCwd, '.codeledger')) ? initCwd : homeCwd;
-  console.log('codeledger: running upgrade to complete ambient setup...');
-  const upgradeResult = spawnSync(process.execPath, [codeledgerBin, 'upgrade'], {
-    stdio: 'inherit',
-    cwd: upgradeCwd,
-    env: { ...process.env, CODELEDGER_SKIP_AMBIENT_ACTIVATION: '1' },
-  });
-  if ((upgradeResult.status ?? 0) !== 0) {
-    console.log('');
-    console.log('codeledger: upgrade step encountered an issue. Run manually:');
-    console.log('  codeledger upgrade');
+  console.log('codeledger: install complete.');
+  console.log('  Next: cd your-repo && codeledger ready');
+  console.log('  Existing repos can refresh ambient hooks/runtime with: codeledger upgrade');
+
+  if (process.env.CODELEDGER_RUN_UPGRADE === '1') {
+    const { spawnSync } = require('node:child_process');
+    const path = require('node:path');
+    const fs = require('node:fs');
+    const codeledgerBin = path.join(__dirname, '..', 'bin', 'codeledger.js');
+    const initCwd = process.env['INIT_CWD'];
+    const homeCwd = process.env['HOME'] ?? process.env['USERPROFILE'] ?? process.cwd();
+    const upgradeCwd =
+      initCwd && fs.existsSync(path.join(initCwd, '.codeledger')) ? initCwd : homeCwd;
+    console.log('codeledger: CODELEDGER_RUN_UPGRADE=1 set, running upgrade...');
+    const upgradeResult = spawnSync(process.execPath, [codeledgerBin, 'upgrade'], {
+      stdio: 'inherit',
+      cwd: upgradeCwd,
+      env: { ...process.env, CODELEDGER_SKIP_AMBIENT_ACTIVATION: '1' },
+    });
+    if ((upgradeResult.status ?? 0) !== 0) {
+      console.log('');
+      console.log('codeledger: upgrade step encountered an issue. Run manually:');
+      console.log('  codeledger upgrade');
+    }
   }
@@ -302,0 +304,0 @@ }

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Unidentified License

License

Something that seems like a license was found, but its contents could not be matched with a known license.

Fixed alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Unidentified License

License

Something that seems like a license was found, but its contents could not be matched with a known license.

Improved metrics

Total package byte prevSize

28533

8.1%

Number of package files

7

40%

Number of lines in readme file

163

5.84%

No dependency changes