@agentbridgehq/agentbridge 0.1.0

package/README.md

@@ -0,0 +1,28 @@
+# agentbridge
+
+The supply chain for agent extensions — install any agent plugin into any agent
+client.
+
+```bash
+npm install -g @agentbridgehq/agentbridge
+agentbridge clients
+```
+
+**Node is a dependency of installing, never of running.** This package downloads
+a static Go binary for your platform on install and verifies its SHA-256 against
+the release's signed checksum file before writing anything. After that, Node is
+not involved: the command you run is the binary.
+
+That verification is not optional. `npm` postinstall scripts are a well-worn
+supply-chain vector, and a tool whose whole argument is about knowing where your
+plugins came from cannot have an installer that downloads a binary and trusts it.
+
+Other ways to install, both of which also verify:
+
+```bash
+brew install agentbridge/tap/agentbridge
+curl -fsSL https://raw.githubusercontent.com/agentbridge/agentbridge/main/install.sh | sh
+```
+
+Source, documentation and issues:
+https://github.com/agentbridgehq/agentbridge

package/bin/agentbridge

@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+'use strict';
+
+// Thin shim: run the downloaded binary and pass everything through.
+//
+// Node is a dependency of *installing*, never of running. The binary is a
+// static executable, so once it is in place this shim only forwards stdio,
+// arguments and the exit code — which matters because agentbridge is itself
+// launched by agent clients as an MCP server wrapper (`agentbridge run`), where
+// anything that mangles signals or exit codes would be a real fault.
+
+const path = require('path');
+const fs = require('fs');
+const { spawnSync } = require('child_process');
+const { binaryPath } = require('../platform');
+
+// Asked of platform.js rather than rebuilt here: this shim is itself called
+// agentbridge and lives in bin/, so a path computed independently is one
+// mistake away from resolving to this file and spawning itself.
+const binary = binaryPath(path.join(__dirname, '..'), process.platform);
+
+if (!fs.existsSync(binary)) {
+  process.stderr.write(
+    'agentbridge: the binary is missing. Reinstall with `npm install -g agentbridge`,\n' +
+      'or install another way: https://github.com/agentbridgehq/agentbridge\n'
+  );
+  process.exit(1);
+}
+
+const result = spawnSync(binary, process.argv.slice(2), { stdio: 'inherit' });
+
+if (result.error) {
+  process.stderr.write(`agentbridge: ${result.error.message}\n`);
+  process.exit(1);
+}
+// A process killed by a signal has no exit code; report it the way a shell
+// would rather than exiting 0 and claiming success.
+process.exit(result.status === null ? 1 : result.status);

package/install.js

@@ -0,0 +1,125 @@
+'use strict';
+
+// Downloads the agentbridge binary for this platform.
+//
+// The package ships no binaries. Publishing six platforms' worth would make the
+// tarball enormous for every user, and the alternative — optional
+// platform-specific packages — multiplies the number of things that must be
+// published in lockstep. Fetching one at install time keeps the package small
+// and the release process single-artifact.
+//
+// The checksum is verified before anything is written. npm postinstall scripts
+// are a well-worn supply-chain vector, and a tool that argues about the
+// provenance of plugins cannot have an installer that downloads a binary and
+// trusts it.
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const zlib = require('zlib');
+const crypto = require('crypto');
+const { execFileSync } = require('child_process');
+const { artifactFor, binaryPath } = require('./platform');
+
+const REPO = 'agentbridgehq/agentbridge';
+const VERSION = require('./package.json').version;
+const BASE =
+  process.env.AGENTBRIDGE_BASE_URL ||
+  `https://github.com/${REPO}/releases/download/v${VERSION}`;
+
+async function fetchBuffer(url) {
+  const res = await fetch(url, { redirect: 'follow' });
+  if (!res.ok) {
+    throw new Error(`${url}: HTTP ${res.status}`);
+  }
+  return Buffer.from(await res.arrayBuffer());
+}
+
+function sha256(buf) {
+  return crypto.createHash('sha256').update(buf).digest('hex');
+}
+
+// verifyChecksum refuses anything the checksums file does not list, rather than
+// skipping verification when the entry is absent — an unlisted artifact is the
+// case this check exists to catch.
+function verifyChecksum(name, buf, checksums) {
+  const line = checksums
+    .split('\n')
+    .map((l) => l.trim())
+    .find((l) => l.endsWith(` ${name}`) || l.endsWith(`  ${name}`));
+
+  if (!line) {
+    throw new Error(`checksums.txt does not list ${name}; refusing to install`);
+  }
+
+  const expected = line.split(/\s+/)[0];
+  const actual = sha256(buf);
+  if (expected !== actual) {
+    throw new Error(
+      `checksum mismatch for ${name}\n  expected ${expected}\n  actual   ${actual}\nDo not use this download.`
+    );
+  }
+}
+
+// extract pulls the single binary out of the archive.
+//
+// tar and unzip are invoked rather than depended on: adding an archive library
+// would put third-party code in the install path of a security tool for the
+// sake of one file.
+function extract(archivePath, artifact, destDir) {
+  if (archivePath.endsWith('.zip')) {
+    execFileSync('unzip', ['-o', '-q', archivePath, artifact.binary, '-d', destDir], {
+      stdio: 'inherit',
+    });
+    return;
+  }
+  execFileSync('tar', ['-xzf', archivePath, '-C', destDir, artifact.binary], {
+    stdio: 'inherit',
+  });
+}
+
+async function main() {
+  const artifact = artifactFor(VERSION, process.platform, process.arch);
+  const target = binaryPath(__dirname, process.platform);
+  const destDir = path.dirname(target);
+
+  if (fs.existsSync(target)) {
+    return;
+  }
+
+  process.stderr.write(`agentbridge v${VERSION} (${artifact.os}/${artifact.arch})\n`);
+
+  const [archive, checksums] = await Promise.all([
+    fetchBuffer(`${BASE}/${artifact.name}`),
+    fetchBuffer(`${BASE}/checksums.txt`).then((b) => b.toString('utf8')),
+  ]);
+
+  verifyChecksum(artifact.name, archive, checksums);
+  process.stderr.write('  checksum  ok\n');
+
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'agentbridge-'));
+  try {
+    const archivePath = path.join(tmp, artifact.name);
+    fs.writeFileSync(archivePath, archive);
+
+    fs.mkdirSync(destDir, { recursive: true });
+    extract(archivePath, artifact, destDir);
+    fs.chmodSync(target, 0o755);
+
+    process.stderr.write(`  installed ${target}\n`);
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+}
+
+main().catch((err) => {
+  process.stderr.write(`\nagentbridge install failed: ${err.message}\n\n`);
+  process.stderr.write(
+    'Install another way instead:\n' +
+      '  brew install agentbridge/tap/agentbridge\n' +
+      `  curl -fsSL https://raw.githubusercontent.com/${REPO}/main/install.sh | sh\n`
+  );
+  process.exit(1);
+});
+
+module.exports = { verifyChecksum, sha256 };

package/package.json

@@ -0,0 +1,17 @@
+{
+  "name": "@agentbridgehq/agentbridge",
+  "version": "0.1.0",
+  "description": "The supply chain for agent extensions — install any agent plugin into any agent client",
+  "license": "Apache-2.0",
+  "author": "Masih Moloodian <masihmoloodian@gmail.com>",
+  "homepage": "https://github.com/agentbridgehq/agentbridge",
+  "repository": { "type": "git", "url": "git+https://github.com/agentbridgehq/agentbridge.git" },
+  "keywords": ["agent", "plugins", "mcp", "agent-plugins", "skills", "cli"],
+  "bin": { "agentbridge": "bin/agentbridge" },
+  "files": ["bin/", "install.js", "platform.js", "README.md"],
+  "scripts": {
+    "postinstall": "node install.js",
+    "test": "node --test"
+  },
+  "engines": { "node": ">=18" }
+}

package/platform.js

@@ -0,0 +1,84 @@
+'use strict';
+
+const path = require('path');
+
+// Mapping from Node's platform names to the release artifacts.
+//
+// Separated from the installer so it can be tested without a network, because
+// this is where a distribution bug hides best: a wrong mapping produces a
+// confident download of a binary for the wrong architecture, and the failure
+// surfaces much later as "exec format error" with nothing pointing back here.
+
+const PLATFORMS = {
+  darwin: 'darwin',
+  linux: 'linux',
+  win32: 'windows',
+};
+
+const ARCHS = {
+  x64: 'amd64',
+  arm64: 'arm64',
+};
+
+/**
+ * Resolve the release artifact for a platform and architecture.
+ *
+ * @param {string} version release version, with or without a leading "v"
+ * @param {string} platform Node's process.platform
+ * @param {string} arch Node's process.arch
+ */
+function artifactFor(version, platform, arch) {
+  const os = PLATFORMS[platform];
+  const goarch = ARCHS[arch];
+
+  if (!os || !goarch) {
+    // Naming both the unsupported pair and the supported set turns a dead end
+    // into something the reader can act on.
+    throw new Error(
+      `agentbridge does not publish a binary for ${platform}/${arch}.\n` +
+        `Supported: ${supportedPairs().join(', ')}.\n` +
+        `Build from source instead: https://github.com/agentbridgehq/agentbridge`
+    );
+  }
+
+  const stripped = String(version).replace(/^v/, '');
+  const ext = os === 'windows' ? 'zip' : 'tar.gz';
+
+  return {
+    os,
+    arch: goarch,
+    // Must match archives.name_template in .goreleaser.yaml. A drift test in
+    // the Go suite keeps the two from separating.
+    name: `agentbridge_${stripped}_${os}_${goarch}.${ext}`,
+    binary: os === 'windows' ? 'agentbridge.exe' : 'agentbridge',
+  };
+}
+
+function supportedPairs() {
+  const out = [];
+  for (const platform of Object.keys(PLATFORMS)) {
+    for (const arch of Object.keys(ARCHS)) {
+      out.push(`${platform}/${arch}`);
+    }
+  }
+  return out;
+}
+
+// binaryPath is where the downloaded executable lives, and it is deliberately
+// not bin/.
+//
+// bin/agentbridge is the shim npm links onto the PATH, and it is shipped in the
+// package. Downloading the real binary to that same name meant three things
+// claimed one path: the installer's "already present?" check saw the shim and
+// skipped the download, and the shim then found "the binary" — itself — and
+// spawned it, recursing until something ran out. `npm i -g @agentbridgehq/agentbridge`
+// produced a command that hung on first use.
+//
+// The shim and the installer both ask this function, so the two cannot drift
+// apart again.
+function binaryPath(packageRoot, platform) {
+  const name = platform === 'win32' ? 'agentbridge.exe' : 'agentbridge';
+  return path.join(packageRoot, 'vendor', name);
+}
+
+module.exports = { artifactFor, supportedPairs, binaryPath, PLATFORMS, ARCHS };