@autter/cli 1.6.8

package/README.md

@@ -0,0 +1,32 @@
+# @autter/cli
+
+**[Autter](https://autter.dev) is an open source git extension that records which lines of your code were written by AI** — tied to the agent, model, and prompt that produced them.
+
+This package is a thin bootstrapper: it downloads the official native `autter` binary for your platform (macOS, Linux, or Windows; x64 or arm64) into `~/.autter/bin`, verifies its checksum against the GitHub release, and exposes the `autter` command through your npm global bin. The binary location is shared with the [shell installers](https://docs.autter.dev/cli/install), so hooks and the background service's self-updates keep working no matter how autter was installed.
+
+## Install
+
+```bash
+npm install -g @autter/cli
+autter onboard
+```
+
+Or bootstrap without a global install:
+
+```bash
+npx @autter/cli onboard
+```
+
+The package version matches the CLI release, so `npm install -g @autter/cli@<version>` installs that exact release.
+
+## Environment variables
+
+- `AUTTER_NPM_SKIP_DOWNLOAD=1` — skip the postinstall binary download (it happens on first run instead).
+- `AUTTER_RELEASE_TAG=vX.Y.Z` — install a specific release.
+- `AUTTER_NO_INSTALL_PING=1` — disable the anonymous install-count ping (OS, architecture, and version only).
+
+## Links
+
+- [Documentation](https://docs.autter.dev)
+- [GitHub repository](https://github.com/Autter-dev/autter-cli)
+- [Other install methods](https://docs.autter.dev/cli/install) (`curl`, PowerShell, Nix)

package/bin/autter.js

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+'use strict';
+
+// Launcher for the native autter binary at ~/.autter/bin. The fast path is a
+// single existence check; the download in install.js only runs when the
+// postinstall was skipped (--ignore-scripts, offline CI) or the binary was
+// removed.
+
+const fs = require('node:fs');
+const { spawnSync } = require('node:child_process');
+const { binaryDest, ensureBinary } = require('../install.js');
+
+async function main() {
+  let bin = binaryDest();
+  if (!fs.existsSync(bin)) {
+    try {
+      bin = (await ensureBinary()).bin;
+    } catch (err) {
+      console.error(`autter: could not install the native binary: ${err.message}`);
+      console.error('autter: alternative installer: curl -fsSL https://api.autter.dev/install.sh | bash');
+      process.exit(1);
+    }
+  }
+
+  // Let the child own Ctrl-C: without this the node wrapper dies on SIGINT
+  // while autter (e.g. `autter onboard`) is still restoring its terminal.
+  const noop = () => {};
+  process.on('SIGINT', noop);
+  process.on('SIGTERM', noop);
+
+  const result = spawnSync(bin, process.argv.slice(2), { stdio: 'inherit' });
+  if (result.error) {
+    console.error(`autter: failed to run ${bin}: ${result.error.message}`);
+    process.exit(1);
+  }
+  if (result.signal) {
+    process.removeListener('SIGINT', noop);
+    process.removeListener('SIGTERM', noop);
+    process.kill(process.pid, result.signal);
+    return;
+  }
+  process.exit(result.status === null ? 1 : result.status);
+}
+
+main();

package/install.js

@@ -0,0 +1,236 @@
+#!/usr/bin/env node
+'use strict';
+
+// npm bootstrapper for the autter CLI.
+//
+// npm distributes a thin launcher, not the binary itself: this script fetches
+// the official release binary for the current platform into ~/.autter/bin --
+// the same location the curl/PowerShell installers use and the location the
+// autter daemon self-upgrades in place. Keeping one canonical binary path
+// means hooks, the daemon, and every install method stay in agreement, and
+// the npm global bin directory (already on PATH) provides the `autter`
+// command via bin/autter.js.
+//
+// The package version is stamped to the CLI release tag at publish time, so
+// `npm i -g @autter/cli@1.7.0` fetches the v1.7.0 binaries. The in-repo placeholder
+// version (0.0.0-dev) resolves to the latest release instead.
+//
+// Escape hatches:
+//   AUTTER_NPM_SKIP_DOWNLOAD=1  skip the postinstall download entirely
+//   AUTTER_RELEASE_TAG=vX.Y.Z   install a specific release (parity with install.sh)
+//   AUTTER_NO_INSTALL_PING=1    disable the anonymous install ping
+
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+
+const pkg = require('./package.json');
+
+const REPO = 'autter-dev/autter-cli';
+// Public write-only project token, same one embedded in install.sh; used for
+// a single anonymous install-count event. Opt out with AUTTER_NO_INSTALL_PING=1.
+const INSTALL_PING_API_KEY = 'phc_aWveMd1bPhuEYtFnCS1G2IHgln3iGQqjfIdkfnuolxI';
+const INSTALL_PING_HOST = 'https://us.i.posthog.com';
+
+const OS_NAMES = { darwin: 'macos', linux: 'linux', win32: 'windows' };
+const CPU_NAMES = { x64: 'x64', arm64: 'arm64' };
+
+function assetName() {
+  const osName = OS_NAMES[process.platform];
+  const cpuName = CPU_NAMES[process.arch];
+  if (!osName || !cpuName) {
+    throw new Error(
+      `no prebuilt autter binary for ${process.platform}/${process.arch}. ` +
+        'See https://github.com/autter-dev/autter-cli#installation for supported platforms.'
+    );
+  }
+  return `autter-${osName}-${cpuName}${osName === 'windows' ? '.exe' : ''}`;
+}
+
+function installDir() {
+  return path.join(os.homedir(), '.autter', 'bin');
+}
+
+function binaryDest() {
+  return path.join(installDir(), process.platform === 'win32' ? 'autter.exe' : 'autter');
+}
+
+function releaseTag() {
+  const override = process.env.AUTTER_RELEASE_TAG;
+  if (override && override !== 'latest') return override;
+  if (pkg.version === '0.0.0-dev') return 'latest';
+  return `v${pkg.version}`;
+}
+
+function downloadUrl(tag, file) {
+  return tag === 'latest'
+    ? `https://github.com/${REPO}/releases/latest/download/${file}`
+    : `https://github.com/${REPO}/releases/download/${tag}/${file}`;
+}
+
+async function fetchBuffer(url) {
+  const res = await fetch(url, { redirect: 'follow' });
+  if (!res.ok) {
+    throw new Error(`download failed (HTTP ${res.status}) for ${url}`);
+  }
+  return Buffer.from(await res.arrayBuffer());
+}
+
+// Verify against the release's checksums.txt (`<sha256>  <asset>` lines).
+// Releases before v1.6.8 shipped no checksums file; skip with a warning then.
+async function verifyChecksum(buf, asset, tag) {
+  let checksums;
+  try {
+    checksums = (await fetchBuffer(downloadUrl(tag, 'checksums.txt'))).toString('utf8');
+  } catch {
+    console.warn(`autter: no checksums.txt for release ${tag}; skipping checksum verification`);
+    return;
+  }
+  const entry = checksums
+    .split('\n')
+    .map((line) => line.trim().split(/\s+/))
+    .find((parts) => parts[1] === asset);
+  if (!entry) {
+    throw new Error(`no checksum entry for ${asset} in release ${tag}`);
+  }
+  const actual = crypto.createHash('sha256').update(buf).digest('hex');
+  if (actual !== entry[0]) {
+    throw new Error(`checksum mismatch for ${asset}: expected ${entry[0]}, got ${actual}`);
+  }
+}
+
+// `autter --version` prints the bare version ("1.6.8", or "1.6.8 (debug)").
+function installedVersion(bin) {
+  try {
+    const out = execFileSync(bin, ['--version'], { encoding: 'utf8', timeout: 10_000 });
+    return out.trim().split(/\s+/)[0] || null;
+  } catch {
+    return null;
+  }
+}
+
+function reportInstallPing(tag) {
+  if (process.env.AUTTER_NO_INSTALL_PING === '1') return Promise.resolve();
+  const safeTag = String(tag).replace(/[^A-Za-z0-9._-]/g, '');
+  console.log(
+    'Counting this install with an anonymous ping (OS, architecture, and version only). ' +
+      'Set AUTTER_NO_INSTALL_PING=1 to disable.'
+  );
+  return fetch(`${INSTALL_PING_HOST}/capture/`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    signal: AbortSignal.timeout(5_000),
+    body: JSON.stringify({
+      api_key: INSTALL_PING_API_KEY,
+      event: 'install_script_run',
+      distinct_id: crypto.randomUUID(),
+      properties: {
+        os: OS_NAMES[process.platform],
+        arch: CPU_NAMES[process.arch],
+        release_tag: safeTag,
+        trigger: 'install',
+        source: 'npm',
+      },
+    }),
+  }).catch(() => {});
+}
+
+// Make sure the native binary exists at ~/.autter/bin, downloading it when
+// missing or (for a pinned package version) when a different version is
+// present. Returns { bin, downloaded }.
+async function ensureBinary() {
+  const asset = assetName(); // throws early on unsupported platforms
+  const dest = binaryDest();
+  const tag = releaseTag();
+
+  if (fs.existsSync(dest)) {
+    if (tag === 'latest') {
+      // An existing install is authoritative; the autter daemon keeps it fresh.
+      return { bin: dest, downloaded: false };
+    }
+    const current = installedVersion(dest);
+    if (current === tag.replace(/^v/, '')) {
+      return { bin: dest, downloaded: false };
+    }
+    console.log(`autter: replacing version ${current ?? 'unknown'} at ${dest} with ${tag}`);
+  }
+
+  console.log(`autter: downloading ${asset} (release: ${tag})...`);
+  const buf = await fetchBuffer(downloadUrl(tag, asset));
+  if (buf.length === 0) {
+    throw new Error('downloaded file is empty');
+  }
+  await verifyChecksum(buf, asset, tag);
+
+  fs.mkdirSync(installDir(), { recursive: true });
+  const tmp = path.join(installDir(), `autter.tmp.${process.pid}`);
+  fs.writeFileSync(tmp, buf, { mode: 0o755 });
+  try {
+    fs.renameSync(tmp, dest);
+  } catch (err) {
+    // Windows cannot rename over a running binary; retry after removing it.
+    try {
+      fs.rmSync(dest, { force: true });
+      fs.renameSync(tmp, dest);
+    } catch {
+      fs.rmSync(tmp, { force: true });
+      throw err;
+    }
+  }
+
+  if (process.platform === 'darwin') {
+    try {
+      execFileSync('xattr', ['-d', 'com.apple.quarantine', dest], { stdio: 'ignore' });
+    } catch {
+      // Attribute not present or xattr unavailable; nothing to clean.
+    }
+  }
+
+  await reportInstallPing(tag);
+  return { bin: dest, downloaded: true };
+}
+
+// postinstall entry point. Never fails the surrounding `npm install`: on any
+// error it warns and defers to bin/autter.js, which retries on first run.
+async function main() {
+  if (process.env.AUTTER_NPM_SKIP_DOWNLOAD === '1') {
+    console.log('autter: AUTTER_NPM_SKIP_DOWNLOAD=1, skipping binary download');
+    return;
+  }
+
+  let result;
+  try {
+    result = await ensureBinary();
+  } catch (err) {
+    console.warn(`autter: could not install the native binary now (${err.message})`);
+    console.warn('autter: it will be downloaded on first run instead');
+    return;
+  }
+
+  if (!result.downloaded) {
+    return;
+  }
+
+  // Mirror install.sh: wire up agent/editor integrations right away. The
+  // daemon re-checks hooks daily, so a failure here is non-fatal.
+  try {
+    execFileSync(result.bin, ['install-hooks'], { stdio: 'inherit', timeout: 120_000 });
+  } catch {
+    console.warn("autter: could not set up IDE/agent hooks; run 'autter install-hooks' manually");
+  }
+
+  console.log('');
+  console.log(`autter installed at ${result.bin}`);
+  console.log("Run 'autter onboard' to finish setup (local-only mode or connect to autter.dev).");
+}
+
+module.exports = { assetName, binaryDest, ensureBinary, releaseTag };
+
+if (require.main === module) {
+  main().catch((err) => {
+    // Belt and braces: postinstall must never break `npm install`.
+    console.warn(`autter: postinstall failed (${err.message})`);
+  });
+}

package/package.json

@@ -0,0 +1,51 @@
+{
+  "name": "@autter/cli",
+  "version": "1.6.8",
+  "description": "Git-native AI authorship tracking: records which lines were written by AI agents and links them to the agent, model, and prompt. This package is a thin bootstrapper that installs the native autter binary.",
+  "license": "Apache-2.0",
+  "homepage": "https://autter.dev",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Autter-dev/autter-cli.git",
+    "directory": "npm"
+  },
+  "bugs": "https://github.com/Autter-dev/autter-cli/issues",
+  "keywords": [
+    "ai",
+    "git",
+    "authorship",
+    "attribution",
+    "blame",
+    "coding-agents",
+    "claude",
+    "copilot",
+    "cursor",
+    "codex"
+  ],
+  "bin": {
+    "autter": "bin/autter.js"
+  },
+  "files": [
+    "bin/autter.js",
+    "install.js",
+    "README.md"
+  ],
+  "scripts": {
+    "postinstall": "node install.js"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "os": [
+    "darwin",
+    "linux",
+    "win32"
+  ],
+  "cpu": [
+    "x64",
+    "arm64"
+  ],
+  "publishConfig": {
+    "access": "public"
+  }
+}