@bobfrankston/msger 0.1.412 → 0.1.413

package/cli.js

@@ -3,9 +3,14 @@
  * msger CLI - uses universal CLI from msgcommon
  */
 import { runCli } from '@bobfrankston/msgcommon';
-import { showMessageBox } from './shower.js';
+import { showMessageBox, installLinuxDeps } from './shower.js';
 import packageJson from './package.json' with { type: 'json' };
 import path from 'path';
+// Handled before runCli: this is a setup command, not a message box, and it
+// has to work on a machine where msger cannot start at all.
+if (process.argv.slice(2).some(a => a === '--install-deps' || a === '-install-deps')) {
+    process.exit(installLinuxDeps());
+}
 const HELP_TEXT = `
 msger v${packageJson.version} - Fast, lightweight, cross-platform message box (Rust-powered)
 
@@ -23,6 +28,7 @@ Options:
   -url <url|file|dir>     Load URL directly in webview (no template, no buttons)
                           A local file or directory works too; a directory loads its index.html
   -hash <fragment>        Hash fragment to append to URL (requires -url). Leading # optional.
+  --install-deps          Linux: install the WebKitGTK runtime msger needs (uses sudo)
   -buttons <label...>     Specify button labels (e.g., -buttons Yes No Cancel)
   -ok                     Add OK button
   -cancel                 Add Cancel button

package/msger-native/builder/postinstall.js

@@ -13,6 +13,7 @@
  */
 import fs from "fs";
 import path from "path";
+import { spawnSync } from "child_process";
 import { fileURLToPath } from "url";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -202,33 +203,81 @@ if (!isWindows) {
     }
 }
 
-// Step 5: Linux — warn now if the WebKitGTK runtime is missing.
+// Step 5: Linux — make sure the WebKitGTK runtime msger links against exists.
 //
-// npm cannot install it for you: it's an OS package, apt needs root, and the
-// package name differs per distro — so all msger can do is check and tell you.
-// Without this the first run dies with a bare loader error ("libwebkit2gtk-4.1
-// .so.0: cannot open shared object file", exit 127) that reads like a broken
-// msger rather than a missing dependency (Bob 2026-07-31, fresh Pi 4 with a
-// Lite image; a Pi with the full desktop already has it via other packages).
+// msger renders with the SYSTEM webview (that's why it's 7 MB, not 300), so
+// without WebKitGTK the binary cannot start at all — the loader fails with a
+// bare "libwebkit2gtk-4.1.so.0: cannot open shared object file" and exit 127,
+// which reads like a broken msger rather than a missing dependency (Bob
+// 2026-07-31, fresh Pi 4 on a Lite image; a full desktop image already has it).
+//
+// Install it automatically ONLY when that can't hurt or hang:
+//   - we already have root (a global npm install on the Pi does) or passwordless
+//     sudo, so nothing escalates and nothing prompts;
+//   - apt-get is present (the scriptable front end);
+//   - MSGER_SKIP_DEPS isn't set.
+// Anything else — unprivileged install, sudo that would ask for a password,
+// unknown distro — falls back to telling the user. An npm script must never
+// block on a password prompt: unattended installs would hang forever.
 if (!isWindows && process.platform === "linux") {
     const soNames = ["libwebkit2gtk-4.1.so.0", "libjavascriptcoregtk-4.1.so.0"];
     const libDirs = [
         "/usr/lib", "/usr/local/lib", "/lib",
         `/usr/lib/${process.arch === "arm64" ? "aarch64" : "x86_64"}-linux-gnu`,
     ];
-    const found = soNames.every(so =>
+    const haveWebkit = () => soNames.every(so =>
         libDirs.some(dir => { try { return fs.existsSync(path.join(dir, so)); } catch { return false; } })
     );
-    if (!found) {
-        console.log("");
-        console.log("  msger: WARNING — the WebKitGTK runtime was not found.");
-        console.log("         msger renders with the system webview and cannot");
-        console.log("         start without it. Install it with:");
-        console.log("");
-        console.log("           sudo apt install libwebkit2gtk-4.1-0");
-        console.log("");
-        console.log("         (runtime only; -dev is needed just to build msger)");
-        console.log("");
+
+    if (!haveWebkit()) {
+        const isRoot = typeof process.getuid === "function" && process.getuid() === 0;
+        const hasAptGet = fs.existsSync("/usr/bin/apt-get");
+        // `sudo -n true` succeeds only when sudo needs no password.
+        const sudoNoPassword = !isRoot && hasAptGet &&
+            spawnSync("sudo", ["-n", "true"], { stdio: "ignore" }).status === 0;
+        const canInstall = hasAptGet && (isRoot || sudoNoPassword) && process.env.MSGER_SKIP_DEPS !== "1";
+
+        if (canInstall) {
+            const prefix = isRoot ? [] : ["sudo", "-n"];
+            const args = [...prefix, "apt-get", "install", "-y", "libwebkit2gtk-4.1-0"];
+            console.log("");
+            console.log("  msger: WebKitGTK runtime missing — installing it now:");
+            console.log(`         ${args.join(" ")}`);
+            const run = (a) => spawnSync(a[0], a.slice(1), {
+                stdio: "inherit",
+                // -y alone isn't enough; some packages still ask without this.
+                env: { ...process.env, DEBIAN_FRONTEND: "noninteractive" },
+            });
+            let res = run(args);
+            if (res.status !== 0) {
+                // Usual cause is a stale package index (404 on the .deb).
+                console.log("  msger: retrying after apt-get update…");
+                run([...prefix, "apt-get", "update"]);
+                res = run(args);
+            }
+            if (res.status === 0 && haveWebkit()) {
+                console.log("  msger: WebKitGTK installed — msger is ready to run.");
+                console.log("");
+            } else {
+                console.log("");
+                console.log("  msger: WARNING — automatic install of WebKitGTK failed.");
+                console.log("         Run this by hand, then msger will work:");
+                console.log("");
+                console.log("           sudo apt install libwebkit2gtk-4.1-0");
+                console.log("");
+            }
+        } else {
+            console.log("");
+            console.log("  msger: WARNING — the WebKitGTK runtime was not found.");
+            console.log("         msger renders with the system webview and cannot");
+            console.log("         start without it. Install it with:");
+            console.log("");
+            console.log("           sudo apt install libwebkit2gtk-4.1-0");
+            console.log("         or:  msger --install-deps");
+            console.log("");
+            console.log("         (runtime only; -dev is needed just to build msger)");
+            console.log("");
+        }
     }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/msger",
-  "version": "0.1.412",
+  "version": "0.1.413",
   "description": "Fast, lightweight, cross-platform message box - Rust-powered alternative to msgview",
   "type": "module",
   "main": "./index.js",

package/shower.d.ts

@@ -95,6 +95,23 @@ export declare function setAppName(name: string): void;
  *  provision so Rust's window icon search picks it up. Per-call `icon` in
  *  `MessageBoxOptions` still takes precedence. */
 export declare function setAppIcon(iconPath: string): void;
+/** The right package for this distro. Only the runtime library — building
+ *  msger additionally needs the -dev package, which is not msger's business to
+ *  install on a machine that only runs it. */
+export declare function webkitInstallCommand(): string;
+/** `msger --install-deps` — install the WebKitGTK runtime msger links against.
+ *
+ *  Deliberately NOT done from postinstall: an npm script that shells out to
+ *  `sudo apt` escalates privilege behind the user's back, blocks forever on a
+ *  password prompt in any non-interactive install (CI, containers, unattended
+ *  provisioning), and guesses wrong on distros it doesn't know. postinstall
+ *  detects and tells; installing stays an explicit, interactive choice.
+ *
+ *  Returns the process exit code to use. */
+export declare function installLinuxDeps(): number;
+/** Is the WebKitGTK runtime msger links against present? Mirrors the check in
+ *  msger-native/builder/postinstall.js — keep the two in step. */
+export declare function hasWebkitRuntime(): boolean;
 /**
  * Show a message box dialog using native Rust implementation (extended version)
  * @param options Message box configuration

package/shower.js

@@ -1,4 +1,4 @@
-import { spawn, execFileSync } from 'child_process';
+import { spawn, spawnSync, execFileSync } from 'child_process';
 import { platform } from 'os';
 import path from 'path';
 import { pathToFileURL } from 'url';
@@ -81,9 +81,83 @@ function missingWebkitHint(stderr) {
     if (!/libwebkit2gtk|libjavascriptcoregtk/.test(stderr))
         return '';
     return '\n\nmsger needs the WebKitGTK runtime, which this system does not have.\n' +
-        '  sudo apt install libwebkit2gtk-4.1-0\n' +
+        `  ${webkitInstallCommand()}\n` +
+        'or let msger run it for you:\n' +
+        '  msger --install-deps\n' +
         '(runtime only — the -dev package is needed just for building msger.)';
 }
+/** The right package for this distro. Only the runtime library — building
+ *  msger additionally needs the -dev package, which is not msger's business to
+ *  install on a machine that only runs it. */
+export function webkitInstallCommand() {
+    const has = (cmd) => fs.existsSync(`/usr/bin/${cmd}`) || fs.existsSync(`/bin/${cmd}`);
+    if (has('apt'))
+        return 'sudo apt install libwebkit2gtk-4.1-0';
+    if (has('dnf'))
+        return 'sudo dnf install webkit2gtk4.1';
+    if (has('pacman'))
+        return 'sudo pacman -S webkit2gtk-4.1';
+    if (has('zypper'))
+        return 'sudo zypper install libwebkit2gtk-4_1-0';
+    return 'install the WebKitGTK 4.1 runtime for your distribution';
+}
+/** `msger --install-deps` — install the WebKitGTK runtime msger links against.
+ *
+ *  Deliberately NOT done from postinstall: an npm script that shells out to
+ *  `sudo apt` escalates privilege behind the user's back, blocks forever on a
+ *  password prompt in any non-interactive install (CI, containers, unattended
+ *  provisioning), and guesses wrong on distros it doesn't know. postinstall
+ *  detects and tells; installing stays an explicit, interactive choice.
+ *
+ *  Returns the process exit code to use. */
+export function installLinuxDeps() {
+    if (platform() !== 'linux') {
+        console.error('--install-deps is for Linux; nothing to install on ' + platform());
+        return 1;
+    }
+    if (hasWebkitRuntime()) {
+        console.log('WebKitGTK runtime is already present — nothing to do.');
+        return 0;
+    }
+    const command = webkitInstallCommand();
+    if (!command.startsWith('sudo ')) {
+        console.error(`msger could not identify this distribution's package manager.\nPlease ${command}.`);
+        return 1;
+    }
+    console.log(`Running: ${command}`);
+    const [cmd, ...args] = command.split(' ');
+    // stdio inherit so sudo's password prompt actually reaches the terminal.
+    const res = spawnSync(cmd, args, { stdio: 'inherit' });
+    if (res.error) {
+        console.error(`Could not run ${cmd}: ${res.error.message}`);
+        return 1;
+    }
+    if (res.status !== 0)
+        return res.status ?? 1;
+    if (!hasWebkitRuntime()) {
+        console.error('Install reported success but the WebKitGTK runtime is still not visible.');
+        return 1;
+    }
+    console.log('WebKitGTK runtime installed — msger is ready to run.');
+    return 0;
+}
+/** Is the WebKitGTK runtime msger links against present? Mirrors the check in
+ *  msger-native/builder/postinstall.js — keep the two in step. */
+export function hasWebkitRuntime() {
+    if (platform() !== 'linux')
+        return true;
+    const soNames = ['libwebkit2gtk-4.1.so.0', 'libjavascriptcoregtk-4.1.so.0'];
+    const arch = process.arch === 'arm64' ? 'aarch64' : 'x86_64';
+    const libDirs = ['/usr/lib', '/usr/local/lib', '/lib', `/usr/lib/${arch}-linux-gnu`];
+    return soNames.every(so => libDirs.some(dir => {
+        try {
+            return fs.existsSync(path.join(dir, so));
+        }
+        catch {
+            return false;
+        }
+    }));
+}
 /** Raspberry Pi: WebKitGTK's DMABUF rendering path is broken on the vc4/v3d
  *  driver — the page comes up as interlaced shredded scanlines instead of
  *  content (verified on a Pi 5 / Debian 13 / WebKitGTK 2.50.6 Wayland session,