fix(security): harden checksum, pin CDN with SRI, cleanup dead code

examples/kothaset.yaml

@@ -21,7 +21,3 @@ instructions:
   - Be creative and diverse in topics and approaches
   - Vary the style and complexity of responses
   - Use clear and concise language
-
-logging:
-  level: info
-  format: text

internal/cli/generate.go

@@ -14,7 +14,6 @@ import (
 	"github.com/schollz/progressbar/v3"
 	"github.com/spf13/cobra"
 
-	"github.com/shantoislamdev/kothaset/internal/fsutil"
 	"github.com/shantoislamdev/kothaset/internal/generator"
 	log "github.com/shantoislamdev/kothaset/internal/log"
 	"github.com/shantoislamdev/kothaset/internal/output"
@@ -134,29 +133,6 @@ func runGenerate(cmd *cobra.Command, _ []string) error {
 		if genModel == "" {
 			genModel = cp.Config.Model
 		}
-
-		// Guardrails against accidentally resuming into a different run target.
-		if cmd.Flags().Changed("schema") && cp.Config.Schema != "" && genSchema != cp.Config.Schema {
-			return fmt.Errorf("resume schema mismatch: checkpoint=%s current=%s", cp.Config.Schema, genSchema)
-		}
-		if cmd.Flags().Changed("provider") && cp.Config.Provider != "" && genProvider != cp.Config.Provider {
-			return fmt.Errorf("resume provider mismatch: checkpoint=%s current=%s", cp.Config.Provider, genProvider)
-		}
-		if cmd.Flags().Changed("model") && cp.Config.Model != "" && genModel != cp.Config.Model {
-			return fmt.Errorf("resume model mismatch: checkpoint=%s current=%s", cp.Config.Model, genModel)
-		}
-		if cmd.Flags().Changed("input") && cp.Config.InputFile != "" && genInputFile != cp.Config.InputFile {
-			return fmt.Errorf("resume input mismatch: checkpoint=%s current=%s", cp.Config.InputFile, genInputFile)
-		}
-		if cmd.Flags().Changed("output") && cp.Config.OutputPath != "" {
-			sameOutput, err := fsutil.PathsEqual(genOutput, cp.Config.OutputPath)
-			if err != nil {
-				return fmt.Errorf("failed to compare output path with checkpoint output path: %w", err)
-			}
-			if !sameOutput {
-				return fmt.Errorf("resume output mismatch: checkpoint=%s current=%s", cp.Config.OutputPath, genOutput)
-			}
-		}
 	}
 
 	if genInputFile == "" {

internal/cli/root.go

@@ -79,6 +79,8 @@ func init() {
 	rootCmd.PersistentFlags().BoolVarP(&verbose, "verbose", "v", false, "enable debug logging")
 	rootCmd.PersistentFlags().BoolVarP(&quiet, "quiet", "q", false, "suppress non-error output")
 
+	rootCmd.MarkFlagsMutuallyExclusive("verbose", "quiet")
+
 	// Register subcommands
 	rootCmd.AddCommand(versionCmd)
 	rootCmd.AddCommand(initCmd)

internal/config/config.go

@@ -130,11 +130,6 @@ func (d *Duration) UnmarshalYAML(unmarshal func(interface{}) error) error {
 	}
 }
 
-// MarshalYAML implements yaml.Marshaler
-func (d Duration) MarshalYAML() (interface{}, error) {
-	return d.String(), nil
-}
-
 // DefaultConfig returns a configuration with sensible defaults
 func DefaultConfig() *Config {
 	return &Config{

internal/config/loader.go

@@ -135,9 +135,6 @@ func LoadSecretsConfig(secretsPath string) (*SecretsConfig, error) {
 		if p.Type == "" {
 			return nil, fmt.Errorf("provider %s type is required", p.Name)
 		}
-		if p.Type != "openai" {
-			return nil, fmt.Errorf("unsupported provider type: %s", p.Type)
-		}
 	}
 
 	return secrets, nil

internal/provider/errors.go

@@ -9,14 +9,14 @@ import (
 type ErrorKind string
 
 const (
-	ErrKindValidation    ErrorKind = "validation"     // Invalid request parameters
-	ErrKindAuth          ErrorKind = "auth"           // Authentication failure
-	ErrKindRateLimit     ErrorKind = "rate_limit"     // Rate limit exceeded
-	ErrKindQuota         ErrorKind = "quota"          // Quota exceeded
-	ErrKindNetwork       ErrorKind = "network"        // Network connectivity issue
-	ErrKindTimeout       ErrorKind = "timeout"        // Request timeout
-	ErrKindServer        ErrorKind = "server"         // Provider server error
-	ErrKindContentFilter ErrorKind = "content_filter" // Content filtered
+	ErrKindValidation ErrorKind = "validation" // Invalid request parameters
+	ErrKindAuth       ErrorKind = "auth"       // Authentication failure
+	ErrKindRateLimit  ErrorKind = "rate_limit" // Rate limit exceeded
+
+	ErrKindNetwork ErrorKind = "network" // Network connectivity issue
+	ErrKindTimeout ErrorKind = "timeout" // Request timeout
+	ErrKindServer  ErrorKind = "server"  // Provider server error
+
 	ErrKindContextLength ErrorKind = "context_length" // Context too long
 	ErrKindUnknown       ErrorKind = "unknown"        // Unknown error
 )

internal/provider/provider.go

@@ -96,21 +96,3 @@ type TokenUsage struct {
 	CompletionTokens int `json:"completion_tokens"`
 	TotalTokens      int `json:"total_tokens"`
 }
-
-// StreamChunk represents a piece of a streaming response
-type StreamChunk struct {
-	// Content is the text delta
-	Content string `json:"content"`
-
-	// Done indicates the stream is complete
-	Done bool `json:"done"`
-
-	// FinishReason when Done is true
-	FinishReason string `json:"finish_reason,omitempty"`
-
-	// Usage when Done is true
-	Usage *TokenUsage `json:"usage,omitempty"`
-
-	// Error if something went wrong
-	Error error `json:"error,omitempty"`
-}

internal/provider/registry.go

@@ -141,16 +141,6 @@ func (r *Registry) Close() error {
 
 // Global registry functions
 
-// RegisterFactory registers a factory in the global registry
-func RegisterFactory(providerType string, factory Factory) {
-	globalRegistry.RegisterFactory(providerType, factory)
-}
-
-// Register adds a provider to the global registry
-func Register(name string, provider Provider) error {
-	return globalRegistry.Register(name, provider)
-}
-
 // Get retrieves a provider from the global registry
 func Get(name string) (Provider, error) {
 	return globalRegistry.Get(name)

internal/schema/classification.go

@@ -69,7 +69,7 @@ func (s *ClassificationSchema) GeneratePrompt(ctx context.Context, opts PromptOp
 	}
 
 	if opts.Topic != "" {
-		sb.WriteString(fmt.Sprintf("Category/Domain: %s\n", opts.Topic))
+		fmt.Fprintf(&sb, "Category/Domain: %s\n", opts.Topic)
 	}
 
 	// Get labels from variables if provided
@@ -83,7 +83,7 @@ func (s *ClassificationSchema) GeneratePrompt(ctx context.Context, opts PromptOp
 	sb.WriteString("\n")
 
 	if len(labels) > 0 {
-		sb.WriteString(fmt.Sprintf("Available labels: %s\n\n", strings.Join(labels, ", ")))
+		fmt.Fprintf(&sb, "Available labels: %s\n\n", strings.Join(labels, ", "))
 		sb.WriteString(`Generate a text sample and assign the most appropriate label:
 
 {

internal/schema/preference.go

@@ -63,10 +63,10 @@ func (s *PreferenceSchema) GeneratePrompt(ctx context.Context, opts PromptOption
 	}
 
 	if opts.Topic != "" {
-		sb.WriteString(fmt.Sprintf("Topic: %s\n", opts.Topic))
+		fmt.Fprintf(&sb, "Topic: %s\n", opts.Topic)
 	}
 	if opts.Category != "" {
-		sb.WriteString(fmt.Sprintf("Category: %s\n", opts.Category))
+		fmt.Fprintf(&sb, "Category: %s\n", opts.Category)
 	}
 
 	sb.WriteString("\n")

internal/schema/registry.go

@@ -78,11 +78,6 @@ func (r *Registry) List() []string {
 
 // Global registry functions
 
-// Register adds a schema to the global registry
-func Register(schema Schema) error {
-	return globalRegistry.Register(schema)
-}
-
 // Get retrieves a schema from the global registry
 func Get(name string) (Schema, error) {
 	return globalRegistry.Get(name)

internal/schema/registry_test.go

@@ -138,16 +138,10 @@ func TestGlobalRegistry(t *testing.T) {
 
 	mGlobal := &mockSchema{name: "global_mock"}
 
-	// Test Register
-	err := Register(mGlobal)
+	// Register via the registry directly
+	err := globalRegistry.Register(mGlobal)
 	if err != nil {
-		t.Errorf("Global Register failed: %v", err)
-	}
-
-	// Duplicate registration should fail
-	err = Register(mGlobal)
-	if err == nil {
-		t.Error("Global Register should fail on duplicate")
+		t.Errorf("Register failed: %v", err)
 	}
 
 	// Test Get

npm/scripts/postinstall.js

@@ -198,14 +198,14 @@ async function main() {
       const checksums = await downloadChecksums(VERSION);
       const releaseName = path.basename(new URL(url).pathname);
       const expectedHash = checksums[releaseName];
-      if (expectedHash) {
-        await verifyChecksum(archivePath, expectedHash);
-        console.log('Checksum verified.');
-      } else {
-        console.warn(`Warning: no checksum found for ${releaseName}`);
+      if (!expectedHash) {
+        throw new Error(`no checksum entry for ${releaseName} in checksums.txt`);
       }
+      await verifyChecksum(archivePath, expectedHash);
+      console.log('Checksum verified.');
     } catch (checksumErr) {
-      console.warn(`Warning: checksum verification skipped: ${checksumErr.message}`);
+      console.error(`Checksum verification failed: ${checksumErr.message}`);
+      throw checksumErr;
     }
 
     // Extract

website/index.html

@@ -17,7 +17,9 @@
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
     <link href="https://fonts.googleapis.com/css2?family=EB+Garamond:ital,wght@0,400;0,500;0,600;1,400;1,500;1,600&family=Inter:wght@300;400;500;600&display=swap" rel="stylesheet">
     <link rel="stylesheet" href="css/style.css">
-    <script src="https://unpkg.com/lucide@latest"></script>
+    <script src="https://unpkg.com/lucide@1.16.0/dist/umd/lucide.min.js"
+            integrity="sha384-ZgnJ3Zpr70Xoify35DjOZWqHib1iYJBpYpQUIEpDASG9+fJ745WzNQuC004dwU0W"
+            crossorigin="anonymous"></script>
     <script src="js/main.js" defer></script>
 </head>
 <body>