v0.6.4

Install

Homebrew:

brew install LucasSantana-Dev/tap/sharekit

pip / pipx:

pip install sharekit
pipx install sharekit

npm:

npm install -g @lucassantana/sharekit

Direct download:

• macOS ARM64
• macOS x64
• Linux x64
• Linux ARM64
• Windows x64

v0.6.3

Install

Homebrew:

brew install LucasSantana-Dev/tap/sharekit

pip / pipx:

pip install sharekit
pipx install sharekit

npm:

npm install -g @lucassantana/sharekit

Direct download:

• macOS ARM64
• macOS x64
• Linux x64
• Linux ARM64
• Windows x64

v0.6.2

Install

Homebrew:

brew install LucasSantana-Dev/tap/sharekit

pip / pipx:

pip install sharekit
pipx install sharekit

npm:

npm install -g @lucassantana/sharekit

Direct download:

• macOS ARM64
• macOS x64
• Linux x64
• Linux ARM64
• Windows x64

v0.6.1

Install

Homebrew:

brew install LucasSantana-Dev/tap/sharekit

pip / pipx:

pip install sharekit
pipx install sharekit

npm:

npm install -g @lucassantana/sharekit

Direct download:

• macOS ARM64
• macOS x64
• Linux x64
• Linux ARM64
• Windows x64

v0.6.0

Install

Homebrew:

brew install LucasSantana-Dev/tap/sharekit

pip / pipx:

pip install sharekit
pipx install sharekit

npm:

npm install -g @lucassantana/sharekit

Direct download:

• macOS ARM64
• macOS x64
• Linux x64
• Linux ARM64
• Windows x64

v0.4.0 — security hardening + init --force

Security

• Path traversal protection — applied.json entries now bounds-checked against ~/.home before any fs.rmSync/cp. Entries outside home are skipped. (#111)
• Safe JSON parsing — applied.json reads in restore/uninstall/rollback now wrapped in try-catch with shape validation; clear error on corrupt backup instead of raw Node stack trace. (#111)
• Input validation — parseUserRef rejects empty username, empty ref, path separators, and .. traversal patterns. (#112)
• Cache path containment — fetchProfile verifies the resolved cache directory stays inside cacheRoot before any file/git operation. (#112)
• DOM XSS fix — stargazers_count from GitHub API now type-coerced before innerHTML in docs/index.html.
• Scanner improvement — bearer token regex narrowed to JWT prefix (eyJ) to reduce false positives from prose in docs.

Features

• init --force — overwrite an existing sharekit-profile/ directory (useful after interrupted runs). Without --force, the error message now says "Use --force to overwrite." (#110)

Dependencies

• @types/node upgraded to v26
• typescript upgraded to v6.0 (added "types": ["node"] to tsconfig)

Docs

• SECURITY.md new Trust Model section: sandboxing, path bounds enforcement, hooks trust model, applied.json note, symlink note (#104)
• README.md links to SECURITY.md

Tests

• 132 tests (was 109 in v0.3.0)
• New: test/backup-security.test.ts, test/fetch.test.ts
• New: --include-hooks tests with real hook fixtures, init --force coverage

v0.3.0 — discover profiles

sharekit search — discover published profiles. GitHub is the registry: any repo named sharekit-profile shows up.

npx @lucassantana/sharekit search           # list published profiles
npx @lucassantana/sharekit search react      # filter
npx @lucassantana/sharekit install <user>    # install one

Plus a browser directory (docs/index.html, GitHub Pages). No server, no account — just GitHub.

Full workflow profile to try: npx @lucassantana/sharekit install LucasSantana-Dev (CLAUDE.md + 65 skills + a file-based memory system).