@bigbrainforge/setup 3.21.0 → 3.23.0

package/README.md

@@ -38,7 +38,7 @@ resolves this package itself (it lives on the public npm registry, not your
 Forge instance) — if a later step fails and you need to run setup again, use:
 
 ```
-npx --@bigbrainforge:registry=https://registry.npmjs.org @bigbrainforge/setup
+npx --@bigbrainforge:registry=https://registry.npmjs.org "@bigbrainforge/setup"
 ```
 
 This one-shot override is what any printed "rerun" fix hint means when it

package/dist/setup.cjs

@@ -224,7 +224,21 @@ var require_sanitize_terminal = __commonJS({
       const text = value === null || value === void 0 ? "" : String(value);
       return text.replace(TERMINAL_CONTROL_RE, "");
     }
-    module2.exports = { sanitizeForTerminal: sanitizeForTerminal2 };
+    function printableRegistryTarget2(target) {
+      const cleaned = sanitizeForTerminal2(target);
+      try {
+        const u = new URL(cleaned);
+        if (u.username || u.password) {
+          u.username = "";
+          u.password = "";
+          return u.toString();
+        }
+        return cleaned;
+      } catch {
+        return cleaned.replace(/\/\/[^@/\s]*@/, "//");
+      }
+    }
+    module2.exports = { sanitizeForTerminal: sanitizeForTerminal2, printableRegistryTarget: printableRegistryTarget2 };
   }
 });
 
@@ -297,9 +311,17 @@ var require_discover_instance = __commonJS({
         }
       }
       config.mcp_url = instanceUrl.replace(/\/$/, "");
-      fs.mkdirSync(path2.dirname(target), { recursive: true });
-      fs.writeFileSync(target, `${JSON.stringify(config, null, 2)}
+      try {
+        fs.mkdirSync(path2.dirname(target), { recursive: true });
+        fs.writeFileSync(target, `${JSON.stringify(config, null, 2)}
 `, "utf8");
+      } catch (err) {
+        return {
+          ok: false,
+          unwritable: true,
+          error: `could not pin mcp_url into ${target} (${err && err.code ? err.code : String(err && err.message)}) \u2014 make that path writable, then rerun`
+        };
+      }
       return { ok: true, mcp_url: config.mcp_url };
     }
     function sameHost(a, b) {
@@ -389,17 +411,26 @@ var require_discover_instance = __commonJS({
       if (conflict) {
         return conflict;
       }
+      let pinError = null;
       if (!pinned || !sameHost(pinned, discovered)) {
         const pinResult = pinInstanceUrl(io, discovered);
         if (!pinResult.ok) {
-          return failure("discovery_unreachable", pinResult.error);
+          if (!pinResult.unwritable) {
+            return failure("discovery_unreachable", pinResult.error);
+          }
+          pinError = pinResult.error;
+          const warn = typeof io.warn === "function" ? io.warn : (line) => process.stderr.write(`${sanitizeForTerminal2(line)}
+`);
+          warn(pinError);
         }
       }
       return {
         ok: true,
         instance_url: discovered,
         deployment_model: deploymentModel,
-        source: "discovery"
+        source: "discovery",
+        pinned: pinError === null,
+        ...pinError === null ? {} : { pin_error: pinError }
       };
     }
     module2.exports = { discoverInstance: discoverInstance2, DEFAULT_LICENSING_URL: DEFAULT_LICENSING_URL2, isSecureUrl: isSecureUrl2 };
@@ -681,7 +712,8 @@ var require_plugin_bundle = __commonJS({
         const dest = path2.join(tmp, "unpacked");
         fs.mkdirSync(dest);
         try {
-          execFileSync("tar", ["-xzf", tgz, "-C", dest, "--strip-components=1"], {
+          execFileSync("tar", ["-xzf", "bundle.tgz", "-C", "unpacked", "--strip-components=1"], {
+            cwd: tmp,
             stdio: ["ignore", "pipe", "pipe"]
           });
         } catch (err) {
@@ -1005,12 +1037,20 @@ var {
   assertSafeVersion
 } = require_plugin_bundle();
 var { resolveSpawn } = require_exec_cli();
-var { sanitizeForTerminal } = require_sanitize_terminal();
+var {
+  sanitizeForTerminal,
+  printableRegistryTarget
+} = require_sanitize_terminal();
 var { isPromptAbort, promptAbortError } = require_prompt_abort();
 var LICENSE_RE = /^forge_lic_[0-9A-Za-z]{43}$/;
 var DEFAULT_LICENSING_URL = "https://licensing.bigbrainforge.com";
 var DEFAULT_DIST_URL = "https://licensing.bigbrainforge.com";
-var RERUN_SETUP_CMD = "npx --@bigbrainforge:registry=https://registry.npmjs.org @bigbrainforge/setup";
+var RERUN_SETUP_CMD = (
+  // The package name is double-quoted per the repo shell-safety contract
+  // (no bare `@`-leading argv token in operator-facing text — PowerShell
+  // splatting consumes some `@…` shapes; the quotes are inert in bash/zsh).
+  'npx --@bigbrainforge:registry=https://registry.npmjs.org "@bigbrainforge/setup"'
+);
 function runShim(io, cmd, args) {
   const platform = io.platform ?? process.platform;
   const env = io.env ?? process.env;
@@ -1143,7 +1183,10 @@ async function runSetup(argv, io = defaultIo()) {
     env: io.env,
     fetchImpl: discoveryFetch,
     forceDiscovery: true,
-    acceptNewInstance
+    acceptNewInstance,
+    warn: () => {
+    }
+    // pinned:false is reported below, once
   });
   if (!discovered.ok) {
     return fail(
@@ -1160,6 +1203,14 @@ async function runSetup(argv, io = defaultIo()) {
       ) : `check network egress to ${licensingUrl} (it must be on your allowlist)`
     );
   }
+  if (discovered.pinned === false) {
+    return fail(
+      io,
+      "instance pin",
+      discovered.pin_error,
+      `make that path writable (usually permissions on ~/.claude/forge), then rerun: ${RERUN_SETUP_CMD}`
+    );
+  }
   print(`\u2713 instance pinned: ${discovered.instance_url} (${discovered.deployment_model})`);
   let npmrc;
   try {
@@ -1174,8 +1225,9 @@ async function runSetup(argv, io = defaultIo()) {
   }
   if (npmrc.status === "declined") {
     const legacyNote = npmrc.replacedLegacy ? " (a legacy npm.pkg.github.com credential line found alongside it was removed)" : "";
+    const printableTarget = printableRegistryTarget(npmrc.foreignScopeTarget);
     print(
-      npmrc.foreignScopeTarget === "" ? `! npm NOT seeded \u2014 ~/.npmrc has a malformed @bigbrainforge:registry= line (no value). Fix or remove that line, then rerun setup; otherwise no action is needed.${legacyNote}` : `! npm NOT seeded \u2014 @bigbrainforge:registry already points at ${npmrc.foreignScopeTarget} (an enterprise proxy or other custom config). If that isn't your organization's proxy, remove that line from ~/.npmrc and rerun setup; otherwise no action is needed.${legacyNote}`
+      npmrc.foreignScopeTarget === "" ? `! npm NOT seeded \u2014 ~/.npmrc has a malformed @bigbrainforge:registry= line (no value). Fix or remove that line, then rerun setup; otherwise no action is needed.${legacyNote}` : `! npm NOT seeded \u2014 @bigbrainforge:registry already points at ${printableTarget} (an enterprise proxy or other custom config). If that isn't your organization's proxy, remove that line from ~/.npmrc and rerun setup; otherwise no action is needed.${legacyNote}`
     );
   } else {
     print(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bigbrainforge/setup",
-  "version": "3.21.0",
+  "version": "3.23.0",
   "description": "Forge workstation setup — paste one license, get a working Forge install.",
   "license": "UNLICENSED",
   "homepage": "https://github.com/bigbrainforge/forge",