@armurai/pentestswarm 0.2.0

package/README.md

@@ -0,0 +1,40 @@
+# @armurai/pentestswarm
+
+One-command install of [Pentest Swarm AI](https://github.com/Armur-Ai/Pentest-Swarm-AI):
+
+```bash
+npm install -g @armurai/pentestswarm
+pentestswarm run
+```
+
+The package is scoped to the `@armurai` org, but the installed command is just
+`pentestswarm`.
+
+This package is a thin delivery wrapper: on install it downloads the prebuilt
+Go binary for your platform from the matching GitHub release (`vX.Y.Z`), and
+the `pentestswarm` command execs it directly. The real program is the Go
+binary — see the main repo for docs.
+
+## Publishing (maintainers)
+
+The package `version` MUST match a published GitHub release tag (the
+postinstall downloads `pentestswarm-<os>-<arch>` from
+`releases/download/v<version>/`). To cut a release:
+
+1. Tag + push (`git tag vX.Y.Z && git push origin vX.Y.Z`) → GoReleaser builds
+   the per-platform binaries and publishes the GitHub release.
+2. Bump `npm/package.json` `version` to `X.Y.Z`.
+3. `cd npm && npm publish` — `publishConfig.access` is already `public`, so the
+   scoped package publishes publicly without the `--access public` flag. Needs
+   `npm login` to the `@armurai` org (member with publish rights).
+
+To let the `@armurai:<team>` team manage the package after the first publish:
+
+```bash
+npm access grant read-write armurai:<team> @armurai/pentestswarm
+```
+
+A CI step can automate 2–3 on release via an npm **automation** token stored as
+the `NPM_TOKEN` GitHub Actions secret. Consider migrating to per-platform
+`optionalDependencies` packages (esbuild-style) later to avoid a postinstall
+network fetch.

package/bin/cli.js

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+// Thin shim: exec the real (Go) pentestswarm binary fetched by install.js,
+// forwarding all args, stdio, and the exit code — so `pentestswarm …` behaves
+// exactly like the native binary, including the interactive TUI.
+"use strict";
+const path = require("path");
+const fs = require("fs");
+const { spawnSync } = require("child_process");
+
+const ext = process.platform === "win32" ? ".exe" : "";
+const bin = path.join(__dirname, "pentestswarm" + ext);
+
+if (!fs.existsSync(bin)) {
+  console.error(
+    "pentestswarm: binary not found — the postinstall download may have failed.\n" +
+      "Reinstall (npm i -g @armurai/pentestswarm), or install from\n" +
+      "https://github.com/Armur-Ai/Pentest-Swarm-AI/releases"
+  );
+  process.exit(1);
+}
+
+const res = spawnSync(bin, process.argv.slice(2), { stdio: "inherit" });
+if (res.error) {
+  console.error("pentestswarm:", res.error.message);
+  process.exit(1);
+}
+process.exit(res.status === null ? 1 : res.status);

package/install.js

@@ -0,0 +1,68 @@
+#!/usr/bin/env node
+// postinstall: fetch the prebuilt pentestswarm binary matching this package's
+// version + the host platform from the GitHub release, into ./bin. The Go
+// binary is the real program; this npm package is just a delivery vehicle so
+// `npm i -g pentestswarm` works like any other CLI.
+"use strict";
+const fs = require("fs");
+const path = require("path");
+const https = require("https");
+
+const REPO = "Armur-Ai/Pentest-Swarm-AI";
+const version = "v" + require("./package.json").version;
+
+// Map Node's platform/arch onto the GoReleaser artifact names
+// (pentestswarm-<goos>-<goarch>).
+const osMap = { darwin: "darwin", linux: "linux", win32: "windows" };
+const archMap = { x64: "amd64", arm64: "arm64" };
+const goos = osMap[process.platform];
+const goarch = archMap[process.arch];
+
+if (!goos || !goarch) {
+  console.error(
+    `pentestswarm: unsupported platform ${process.platform}/${process.arch}.\n` +
+      `Install from https://github.com/${REPO}/releases instead.`
+  );
+  process.exit(0); // don't hard-fail the whole npm install
+}
+
+const ext = goos === "windows" ? ".exe" : "";
+const asset = `pentestswarm-${goos}-${goarch}`;
+const url = `https://github.com/${REPO}/releases/download/${version}/${asset}`;
+const binDir = path.join(__dirname, "bin");
+const dest = path.join(binDir, "pentestswarm" + ext);
+
+function download(u, file, redirects) {
+  if (redirects > 10) return file.destroy(new Error("too many redirects"));
+  https
+    .get(u, { headers: { "User-Agent": "pentestswarm-npm" } }, (res) => {
+      if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+        res.resume();
+        return download(res.headers.location, file, (redirects || 0) + 1);
+      }
+      if (res.statusCode !== 200) {
+        return file.destroy(new Error(`HTTP ${res.statusCode} for ${u}`));
+      }
+      res.pipe(file);
+    })
+    .on("error", (e) => file.destroy(e));
+}
+
+fs.mkdirSync(binDir, { recursive: true });
+const out = fs.createWriteStream(dest, { mode: 0o755 });
+out.on("finish", () => {
+  try {
+    fs.chmodSync(dest, 0o755);
+  } catch (_) {}
+  console.log(`pentestswarm ${version} installed (${goos}/${goarch}).`);
+});
+out.on("error", (e) => {
+  console.error(
+    `pentestswarm: could not download the binary (${e.message}).\n` +
+      `Grab it from https://github.com/${REPO}/releases or use the install script.`
+  );
+  // Exit 0 so a transient download hiccup doesn't break the user's whole
+  // `npm install`; the bin shim reports a clear error if the binary is absent.
+  process.exit(0);
+});
+download(url, out, 0);

package/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@armurai/pentestswarm",
+  "publishConfig": {
+    "access": "public"
+  },
+  "version": "0.2.0",
+  "description": "Autonomous AI-powered penetration-testing swarm — one command, real vulns.",
+  "keywords": ["security", "pentest", "bug-bounty", "ai", "swarm", "appsec", "cli"],
+  "homepage": "https://github.com/Armur-Ai/Pentest-Swarm-AI",
+  "bugs": "https://github.com/Armur-Ai/Pentest-Swarm-AI/issues",
+  "license": "AGPL-3.0-only",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Armur-Ai/Pentest-Swarm-AI.git",
+    "directory": "npm"
+  },
+  "bin": {
+    "pentestswarm": "bin/cli.js"
+  },
+  "files": [
+    "bin/cli.js",
+    "install.js"
+  ],
+  "scripts": {
+    "postinstall": "node install.js"
+  },
+  "engines": {
+    "node": ">=16"
+  },
+  "os": ["darwin", "linux", "win32"],
+  "cpu": ["x64", "arm64"]
+}