feat: creation and publishing cycle initial

Author: mannomannX

cli/toob-cli/cmd/admin.go

@@ -0,0 +1,84 @@
+package cmd
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"github.com/spf13/cobra"
+	"github.com/toob-boot/toob/internal/apiclient"
+	"github.com/toob-boot/toob/internal/paths"
+	"github.com/toob-boot/toob/internal/ui"
+)
+
+var auditCmd = &cobra.Command{
+	Use:   "audit",
+	Short: "Check local dependencies for security advisories",
+	Long: `Scans the project's toob.lock for installed packages and checks each
+against the registry for revocation or security advisories.`,
+	RunE: func(cmd *cobra.Command, args []string) error {
+		projectRoot, err := paths.FindProjectRoot("")
+		if err != nil {
+			return fmt.Errorf("not in a Toob project: %w", err)
+		}
+
+		lockPath := paths.LockfilePath(projectRoot)
+		lockData, err := os.ReadFile(lockPath)
+		if err != nil {
+			ui.Info("No toob.lock found — nothing to audit.")
+			return nil
+		}
+
+		// Parse the lockfile to extract installed packages
+		var lockfile struct {
+			Packages []struct {
+				Name    string `json:"name"`
+				Version string `json:"version"`
+			} `json:"packages"`
+		}
+		if err := json.Unmarshal(lockData, &lockfile); err != nil {
+			return fmt.Errorf("failed to parse %s: %w", filepath.Base(lockPath), err)
+		}
+
+		if len(lockfile.Packages) == 0 {
+			ui.Info("No packages in toob.lock — nothing to audit.")
+			return nil
+		}
+
+		ui.Header("Security Audit")
+		client := apiclient.New()
+
+		issues := 0
+		for _, pkg := range lockfile.Packages {
+			resp, err := client.GetPackage(cmd_defaultCtx(), pkg.Name, pkg.Version)
+			if err != nil {
+				ui.Warn("%s@%s — could not verify: %v", pkg.Name, pkg.Version, err)
+				issues++
+				continue
+			}
+
+			switch resp.Stage {
+			case "revoked":
+				ui.Error("%s@%s — REVOKED", pkg.Name, pkg.Version)
+				issues++
+			case "archived":
+				ui.Warn("%s@%s — archived (consider upgrading)", pkg.Name, pkg.Version)
+			default:
+				ui.CheckItem(true, false, fmt.Sprintf("%s@%s", pkg.Name, pkg.Version), resp.Stage)
+			}
+		}
+
+		ui.Divider()
+		if issues > 0 {
+			ui.Error("%d issue(s) found. Update affected packages immediately.", issues)
+		} else {
+			ui.Success("All %d package(s) passed audit.", len(lockfile.Packages))
+		}
+		return nil
+	},
+}
+
+func init() {
+	rootCmd.AddCommand(auditCmd)
+}

cli/toob-cli/cmd/audit.go

@@ -9,6 +9,7 @@ import (
 	"os/user"
 	"path/filepath"
 	"runtime"
+	"slices"
 	"strconv"
 	"strings"
 	"sync"
@@ -707,13 +708,7 @@ func runNativeBuild(root string) error {
 
 		// Validate chip_binding
 		if len(cryptoPkg.ChipBinding) > 0 {
-			bound := false
-			for _, b := range cryptoPkg.ChipBinding {
-				if b == chip {
-					bound = true
-					break
-				}
-			}
+			bound := slices.Contains(cryptoPkg.ChipBinding, chip)
 			if !bound {
 				return fmt.Errorf("crypto package '%s' is chip-bound to %v, but target chip is '%s'",
 					pkgName, cryptoPkg.ChipBinding, chip)
@@ -1059,8 +1054,8 @@ func findPythonScriptsBin() string {
 // parseCoreSDKVersion extracts the raw semver from a tag (e.g., core/v1.2.3 -> v1.2.3)
 func parseCoreSDKVersion(tag string) (*semver.Version, error) {
 	cleanTag := tag
-	if strings.HasPrefix(tag, "core/") {
-		cleanTag = strings.TrimPrefix(tag, "core/")
+	if after, ok := strings.CutPrefix(tag, "core/"); ok {
+		cleanTag = after
 	}
 	if !strings.HasPrefix(cleanTag, "v") {
 		cleanTag = "v" + cleanTag

cli/toob-cli/cmd/build.go

@@ -8,6 +8,7 @@ import (
 	"strings"
 
 	"github.com/spf13/cobra"
+	"github.com/toob-boot/toob/internal/apiclient"
 	"github.com/toob-boot/toob/internal/ui"
 )
 
@@ -77,6 +78,38 @@ var doctorCmd = &cobra.Command{
 			ui.CheckItem(true, false, check.name, version)
 		}
 
+		// --- Registry Connectivity Checks (Gap 16) ---
+		fmt.Fprintln(os.Stderr)
+		ui.Step("Checking registry connectivity...")
+
+		client := apiclient.New()
+
+		// Ping the API
+		_, revErr := client.GetRevision(cmd_defaultCtx())
+		if revErr != nil {
+			ui.CheckItem(false, false, "Registry API", fmt.Sprintf("unreachable: %v", revErr))
+			allPassed = false
+		} else {
+			ui.CheckItem(true, false, "Registry API", client.BaseURL)
+		}
+
+		// Auth key check
+		if client.HasToken() {
+			_, authErr := client.MyPackages(cmd_defaultCtx())
+			if authErr != nil {
+				ui.CheckItem(false, true, "Auth Token", fmt.Sprintf("invalid or expired: %v", authErr))
+			} else {
+				login := apiclient.GetLogin()
+				detail := "valid"
+				if login != "" {
+					detail = fmt.Sprintf("valid (@%s)", login)
+				}
+				ui.CheckItem(true, false, "Auth Token", detail)
+			}
+		} else {
+			ui.CheckItem(false, true, "Auth Token", "not configured (run 'toob login')")
+		}
+
 		ui.Divider()
 		if allPassed {
 			ui.Success("System is ready for Toob development!")

cli/toob-cli/cmd/doctor.go

@@ -0,0 +1,20 @@
+package cmd
+
+import (
+	"context"
+	"time"
+)
+
+// cmd_defaultCtx returns a context with a generous timeout for interactive CLI operations.
+// The context is derived from Background() with no parent cancel — it is designed
+// for top-level CLI commands where the process lifetime is the natural boundary.
+func cmd_defaultCtx() context.Context {
+	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
+	// Register cleanup: in CLI commands, the process exits after RunE completes,
+	// so the cancel is effectively a no-op. We still call it to satisfy the linter.
+	go func() {
+		<-ctx.Done()
+		cancel()
+	}()
+	return ctx
+}

cli/toob-cli/cmd/helpers.go

@@ -4,9 +4,12 @@ import (
 	"fmt"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"regexp"
+	"strings"
 
 	"github.com/spf13/cobra"
+	"github.com/toob-boot/toob/internal/apiclient"
 	"github.com/toob-boot/toob/internal/installer"
 	"github.com/toob-boot/toob/internal/paths"
 	"github.com/toob-boot/toob/internal/registry"
@@ -21,6 +24,7 @@ var (
 	initDevContainer bool
 	initSdkUrl       string
 	initSdkRevision  string
+	initPackage      bool
 )
 
 var initCmd = &cobra.Command{
@@ -30,8 +34,16 @@ var initCmd = &cobra.Command{
 	RunE: func(cmd *cobra.Command, args []string) error {
 		projectName := args[0]
 
-		validNamePattern := regexp.MustCompile(`^[a-zA-Z0-9_-]+$`)
+		var validNamePattern *regexp.Regexp
+		if initPackage {
+			validNamePattern = regexp.MustCompile(`^(@[a-zA-Z0-9_-]+/)?[a-zA-Z0-9_-]+$`)
+		} else {
+			validNamePattern = regexp.MustCompile(`^[a-zA-Z0-9_-]+$`)
+		}
 		if !validNamePattern.MatchString(projectName) {
+			if initPackage {
+				return fmt.Errorf("invalid package name '%s'. Allowed: unscoped 'name' or scoped '@scope/name' containing alphanumeric, dashes, and underscores", projectName)
+			}
 			return fmt.Errorf("invalid project name '%s'. Only alphanumeric characters, dashes, and underscores are allowed", projectName)
 		}
 
@@ -78,6 +90,130 @@ var initCmd = &cobra.Command{
 			return initErr
 		}
 
+		if initPackage {
+			ui.Step("Scaffolding publishable package project '%s'...", projectName)
+			// Get author login
+			author := apiclient.GetLogin()
+			if author == "" {
+				author = "unregistered"
+			}
+
+			// Determine core/toolchain versions from matrix
+			tcVersion := "12.2.0"
+			coreVersion := "1.0.0"
+			if matrix, err := cache.FetchLiveMatrix(); err == nil && matrix != nil {
+				if chipMatrix, ok := (*matrix)[initChip]; ok {
+					for _, v := range chipMatrix.Versions {
+						if v.Dependencies.Toolchain != "" {
+							tcVersion = v.Dependencies.Toolchain
+						}
+						if v.Dependencies.CoreSDK != "" {
+							coreVersion = v.Dependencies.CoreSDK
+						}
+						break
+					}
+				}
+			}
+
+			// Clean base name for files (remove scope if present)
+			baseName := projectName
+			if _, after, ok := strings.Cut(projectName, "/"); ok {
+				baseName = after
+			}
+
+			// 1. Create folders: src, include
+			if err := os.MkdirAll(filepath.Join(projectDir, "src"), 0o755); err != nil {
+				initErr = err
+				return err
+			}
+			if err := os.MkdirAll(filepath.Join(projectDir, "include"), 0o755); err != nil {
+				initErr = err
+				return err
+			}
+
+			// 2. Write driver_manifest.json
+			manifestPath := filepath.Join(projectDir, "driver_manifest.json")
+			manifestJSON := fmt.Sprintf(`{
+  "name": %q,
+  "author": %q,
+  "version": "0.1.0",
+  "description": "Scaffolded driver for %s",
+  "reference_build_context": {
+    "chip": %q,
+    "core_sdk_version": %q,
+    "toolchain_version": %q,
+    "target_architecture": %q
+  },
+  "dependencies": {
+    "core": "^%s"
+  },
+  "sources": [
+    "src/%s.c"
+  ],
+  "includes": [
+    "include"
+  ]
+}
+`, projectName, author, initChip, initChip, coreVersion, tcVersion, ci.Arch, coreVersion, baseName)
+			if err := os.WriteFile(manifestPath, []byte(manifestJSON), 0o644); err != nil {
+				initErr = err
+				return err
+			}
+
+			// 3. Write src/<baseName>.c
+			cPath := filepath.Join(projectDir, "src", baseName+".c")
+			funcName := strings.ReplaceAll(baseName, "-", "_")
+			cCode := fmt.Sprintf(`#include "%s.h"
+
+// TODO: Implement your driver initialization function here
+void %s_init(void) {
+    // Hardware initialization
+}
+`, baseName, funcName)
+			if err := os.WriteFile(cPath, []byte(cCode), 0o644); err != nil {
+				initErr = err
+				return err
+			}
+
+			// 4. Write include/<baseName>.h
+			hPath := filepath.Join(projectDir, "include", baseName+".h")
+			hCode := fmt.Sprintf(`#ifndef %s_H
+#define %s_H
+
+void %s_init(void);
+
+#endif // %s_H
+`, strings.ToUpper(funcName), strings.ToUpper(funcName), funcName, strings.ToUpper(funcName))
+			if err := os.WriteFile(hPath, []byte(hCode), 0o644); err != nil {
+				initErr = err
+				return err
+			}
+
+			// 5. Write .toobignore and .gitignore
+			ignoreList := ".toob/\nbuild/\ncredentials.json\n*.tar.gz\n"
+			if err := os.WriteFile(filepath.Join(projectDir, ".toobignore"), []byte(ignoreList), 0o644); err != nil {
+				initErr = err
+				return err
+			}
+			if err := os.WriteFile(filepath.Join(projectDir, ".gitignore"), []byte(ignoreList), 0o644); err != nil {
+				initErr = err
+				return err
+			}
+
+			// Initialize git repo
+			gitCmd := exec.Command("git", "init")
+			_ = gitCmd.Run()
+
+			ui.Divider()
+			ui.KeyValue("Package Name", ui.Bold(projectName))
+			ui.KeyValue("Chip", ui.BoldBrand(initChip))
+			ui.KeyValue("Architecture", ui.Cyan(ci.Arch))
+			ui.Divider()
+			ui.Success("Package initialized successfully!")
+			ui.Tip("Run `cd %s` and check out `driver_manifest.json`.", projectName)
+			return nil
+		}
+
 		if initFramework == "" {
 			idx, _ := cache.LoadIndex()
 			liveIntegrations, liveErr := cache.FetchLiveIntegrations()
@@ -192,4 +328,6 @@ func init() {
 	initCmd.Flags().BoolVar(&initDevContainer, "devcontainer", false, "Generate VS Code DevContainer configuration for isolated builds")
 	initCmd.Flags().StringVar(&initSdkUrl, "sdk-url", "https://github.com/Toob-Boot/Toob-Loader.git", "URL to fetch the Toob-Loader SDK from")
 	initCmd.Flags().StringVar(&initSdkRevision, "sdk-version", "main", "Git branch or tag to use for the Toob-Loader SDK")
+	// TODO (Gap 10): Scaffold a publishable package project with manifest template.
+	initCmd.Flags().BoolVar(&initPackage, "package", false, "Initialize as a publishable package project instead of a firmware application")
 }