@boxes-dev/cli 1.0.573

package/bin/dvb

@@ -0,0 +1,9 @@
+#!/bin/sh
+DEVBOX_DIR="${DEVBOX_HOME:-$HOME/.devbox}"
+STANDALONE_DIR="$DEVBOX_DIR/standalone/current"
+if [ ! -x "$STANDALONE_DIR/dvb" ]; then
+  echo "dvb: standalone runtime not installed." >&2
+  echo "Run: npm install -g @boxes-dev/cli" >&2
+  exit 1
+fi
+exec "$STANDALONE_DIR/dvb" "$@"

package/bin/dvbd

@@ -0,0 +1,9 @@
+#!/bin/sh
+DEVBOX_DIR="${DEVBOX_HOME:-$HOME/.devbox}"
+STANDALONE_DIR="$DEVBOX_DIR/standalone/current"
+if [ ! -x "$STANDALONE_DIR/dvbd" ]; then
+  echo "dvbd: standalone runtime not installed." >&2
+  echo "Run: npm install -g @boxes-dev/cli" >&2
+  exit 1
+fi
+exec "$STANDALONE_DIR/dvbd" "$@"

package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@boxes-dev/cli",
+  "version": "1.0.573",
+  "description": "Boxes.dev CLI (standalone, includes bundled Node runtime)",
+  "license": "UNLICENSED",
+  "publishConfig": {
+    "access": "public"
+  },
+  "bin": {
+    "dvb": "./bin/dvb",
+    "dvbd": "./bin/dvbd"
+  },
+  "files": [
+    "bin/dvb",
+    "bin/dvbd",
+    "scripts/postinstall.cjs",
+    "scripts/postinstall.mjs"
+  ],
+  "scripts": {
+    "postinstall": "node scripts/postinstall.cjs"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "os": [
+    "darwin",
+    "linux"
+  ],
+  "cpu": [
+    "arm64",
+    "x64"
+  ]
+}

package/scripts/postinstall.cjs

@@ -0,0 +1,19 @@
+// CJS wrapper for postinstall — spawns the ESM postinstall script.
+// npm postinstall runs with the package's Node, which may be 18+ without
+// native ESM support in all contexts. This wrapper ensures compatibility.
+const { execFileSync } = require("node:child_process");
+const path = require("node:path");
+
+try {
+  execFileSync(
+    process.execPath,
+    [path.join(__dirname, "postinstall.mjs")],
+    { stdio: "inherit", env: { ...process.env } },
+  );
+} catch (err) {
+  // Non-zero exit from the ESM script.
+  if (err.status != null) {
+    process.exit(err.status);
+  }
+  throw err;
+}

package/scripts/postinstall.mjs

@@ -0,0 +1,221 @@
+/**
+ * @boxes-dev/cli postinstall script.
+ *
+ * Downloads the platform-specific standalone archive from deploy.boxes.dev,
+ * verifies its SHA256 checksum, extracts it, validates it, and promotes it
+ * to ~/.devbox/standalone/current/.
+ */
+
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import { createHash } from "node:crypto";
+import { pipeline } from "node:stream/promises";
+import { execFileSync } from "node:child_process";
+
+// ---------------------------------------------------------------------------
+// Configuration
+// ---------------------------------------------------------------------------
+
+// Build-time profile: if set to "dev" at build time, use the dev deploy host.
+// For the published npm package this is baked in; for local dev testing,
+// override via DEVBOX_STANDALONE_MANIFEST_URL env var.
+const DEFAULT_MANIFEST_URL = "https://deploy.boxes.dev/cli/latest.json";
+const DEV_MANIFEST_URL = "https://deploy-dev.boxes.dev/cli/latest.json";
+
+function getManifestUrl() {
+  // Explicit override for testing.
+  if (process.env.DEVBOX_STANDALONE_MANIFEST_URL) {
+    return process.env.DEVBOX_STANDALONE_MANIFEST_URL;
+  }
+  // Build-time profile detection: the published package always uses prod.
+  // Local dev builds set DEVBOX_BUILD_PROFILE=dev.
+  if (process.env.DEVBOX_BUILD_PROFILE === "dev") {
+    return DEV_MANIFEST_URL;
+  }
+  return DEFAULT_MANIFEST_URL;
+}
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function getDevboxDir() {
+  return process.env.DEVBOX_HOME || path.join(os.homedir(), ".devbox");
+}
+
+function getPlatformKey() {
+  const platform = process.platform; // "darwin" or "linux"
+  const arch = process.arch; // "arm64" or "x64"
+  return `${platform}-${arch}`;
+}
+
+/** SHA-256 hex digest of a file. */
+function sha256File(filePath) {
+  const hash = createHash("sha256");
+  hash.update(fs.readFileSync(filePath));
+  return hash.digest("hex");
+}
+
+/** Fetch JSON from a URL. */
+async function fetchJson(url) {
+  const res = await fetch(url);
+  if (!res.ok) {
+    throw new Error(`Failed to fetch ${url}: ${res.status} ${res.statusText}`);
+  }
+  return res.json();
+}
+
+/** Download a URL to a file. */
+async function downloadFile(url, dest) {
+  const res = await fetch(url);
+  if (!res.ok) {
+    throw new Error(`Failed to download ${url}: ${res.status} ${res.statusText}`);
+  }
+  const fileStream = fs.createWriteStream(dest);
+  await pipeline(res.body, fileStream);
+}
+
+// ---------------------------------------------------------------------------
+// Main
+// ---------------------------------------------------------------------------
+
+async function main() {
+  const platformKey = getPlatformKey();
+  const devboxDir = getDevboxDir();
+  const standaloneDir = path.join(devboxDir, "standalone");
+
+  console.log(`@boxes-dev/cli: installing standalone dvb for ${platformKey}...`);
+
+  // 1. Fetch manifest
+  const manifestUrl = getManifestUrl();
+  let manifest;
+  try {
+    manifest = await fetchJson(manifestUrl);
+  } catch (err) {
+    console.error(
+      `@boxes-dev/cli: failed to fetch manifest from ${manifestUrl}`,
+    );
+    console.error(`  ${err.message}`);
+    console.error(
+      `\nIf you are offline, you can retry later with: npm install -g @boxes-dev/cli`,
+    );
+    process.exit(1);
+  }
+
+  const archiveInfo = manifest.archives?.[platformKey];
+  if (!archiveInfo) {
+    console.error(
+      `@boxes-dev/cli: no archive available for platform ${platformKey}`,
+    );
+    console.error(`Available platforms: ${Object.keys(manifest.archives || {}).join(", ")}`);
+    process.exit(1);
+  }
+
+  const version = manifest.version;
+  const versionDir = path.join(
+    standaloneDir,
+    `${version}-${platformKey}`,
+  );
+  const currentLink = path.join(standaloneDir, "current");
+
+  // 2. Check if already installed at this version
+  if (fs.existsSync(versionDir) && fs.existsSync(path.join(versionDir, "dvb"))) {
+    // Check if current symlink already points here.
+    try {
+      const currentTarget = fs.readlinkSync(currentLink);
+      if (path.resolve(standaloneDir, currentTarget) === versionDir ||
+          currentTarget === versionDir) {
+        console.log(
+          `@boxes-dev/cli: standalone dvb v${version} already installed, skipping.`,
+        );
+        return;
+      }
+    } catch {
+      // Symlink doesn't exist or can't be read — continue to update it.
+    }
+    // Version dir exists but symlink is stale/missing — just update symlink.
+    updateCurrentSymlink(standaloneDir, currentLink, versionDir, version);
+    return;
+  }
+
+  // 3. Download archive
+  fs.mkdirSync(standaloneDir, { recursive: true });
+  const tmpSuffix = `${version}-${platformKey}-${Date.now()}`;
+  const tmpDir = path.join(standaloneDir, `.tmp-${tmpSuffix}`);
+  const tarballPath = path.join(standaloneDir, `.download-${tmpSuffix}.tar.gz`);
+
+  try {
+    console.log(`@boxes-dev/cli: downloading dvb v${version}...`);
+    await downloadFile(archiveInfo.url, tarballPath);
+
+    // 4. Verify SHA256
+    const actualHash = sha256File(tarballPath);
+    if (actualHash !== archiveInfo.sha256) {
+      throw new Error(
+        `SHA256 mismatch:\n  expected: ${archiveInfo.sha256}\n  actual:   ${actualHash}`,
+      );
+    }
+    console.log(`@boxes-dev/cli: SHA256 verified.`);
+
+    // 5. Extract to tmp directory
+    fs.mkdirSync(tmpDir, { recursive: true });
+    execFileSync("tar", [
+      "xzf",
+      tarballPath,
+      "-C",
+      tmpDir,
+      "--strip-components=1",
+    ]);
+
+    // 6. Validate: run dvb --help
+    try {
+      execFileSync(path.join(tmpDir, "dvb"), ["--help"], {
+        stdio: "pipe",
+        timeout: 15_000,
+      });
+    } catch (err) {
+      throw new Error(
+        `Validation failed: ./dvb --help exited with code ${err.status}`,
+      );
+    }
+
+    // 7. Promote: rename tmp to version dir
+    if (fs.existsSync(versionDir)) {
+      fs.rmSync(versionDir, { recursive: true });
+    }
+    fs.renameSync(tmpDir, versionDir);
+
+    // 8. Update current symlink
+    updateCurrentSymlink(standaloneDir, currentLink, versionDir, version);
+
+    console.log(`@boxes-dev/cli: successfully installed dvb v${version}`);
+  } catch (err) {
+    console.error(`@boxes-dev/cli: installation failed: ${err.message}`);
+    // Clean up
+    try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch {}
+    process.exit(1);
+  } finally {
+    // Always clean up the tarball
+    try { fs.unlinkSync(tarballPath); } catch {}
+  }
+}
+
+function updateCurrentSymlink(standaloneDir, currentLink, versionDir, version) {
+  // Atomic symlink update: create a temp symlink and rename it over the old one.
+  const tmpLink = path.join(standaloneDir, `.current-tmp-${Date.now()}`);
+  try {
+    // Use relative path for the symlink so it works if devbox dir is moved.
+    const relTarget = path.relative(standaloneDir, versionDir);
+    fs.symlinkSync(relTarget, tmpLink);
+    fs.renameSync(tmpLink, currentLink);
+  } catch {
+    // Fallback: remove and recreate.
+    try { fs.unlinkSync(tmpLink); } catch {}
+    try { fs.unlinkSync(currentLink); } catch {}
+    const relTarget = path.relative(standaloneDir, versionDir);
+    fs.symlinkSync(relTarget, currentLink);
+  }
+}
+
+main();