@claudinite/cli 1.61009.3 → 1.61011.1

package/launch

@@ -19,11 +19,11 @@
 # blocks the stop, and the next stop attempt hits it again, in a loop.
 #
 # Bootstrap: the @claudinite/cli packages carry this file as their bin, so
-# `npx --yes @claudinite/cli init --packs ...` runs it from the package
-# npx unpacked, through a symlink. Run with init and no settings file beside
-# it, it takes the version and the binary's hash from the package's own
-# manifest.json, fetches and checks the binary as above, caches it with the
-# manifest and manifest.sig.json, and execs cn init, which verifies that
+# `npx --yes @claudinite/cli adopt <packs>` runs it from the package
+# npx unpacked, through a symlink. Run with adopt in a repository holding no
+# settings file (or with the retired init), it takes the version and the
+# binary's hash from the package's own manifest.json, fetches and checks the binary as above, caches it with the
+# manifest and manifest.sig.json, and execs cn adopt, which verifies that
 # signature before it writes anything. Windows is not covered: npm's shim
 # for a sh script there is the desktop work.
 # Any other command run through that bin runs the member's own pin, the
@@ -93,13 +93,41 @@ unreachable() {
   esac
 }
 
-matches() {
-  printf '%s\n' "$1" | grep -Eqx "$2"
+# The shapes a value must have, by shell patterns alone: the launcher runs
+# once per session and per workflow step, and each tool it starts costs a
+# process.
+digits() {
+  case $1 in '' | *[!0-9]*) return 1 ;; esac
+}
+is_version() {
+  case $1 in *.*.*) ;; *) return 1 ;; esac
+  set -- "${1%%.*}" "${1#*.}"
+  set -- "$1" "${2%%.*}" "${2#*.}"
+  digits "$1" && digits "$2" && digits "$3"
+}
+is_package() {
+  case $1 in @claudinite/cli | @claudinite/cli-rc) ;; *) return 1 ;; esac
+}
+is_pin() {
+  case $1 in sha512-*==) ;; *) return 1 ;; esac
+  set -- "${1#sha512-}"
+  set -- "${1%==}"
+  [ "${#1}" -eq 86 ] || return 1
+  case $1 in *[!A-Za-z0-9+/]*) return 1 ;; esac
+}
+
+# dir_of PATH sets dir to PATH's folder, as dirname would.
+dir_of() {
+  case $1 in
+    */*) dir=${1%/*}; [ -n "$dir" ] || dir=/ ;;
+    *) dir=. ;;
+  esac
 }
 
 # Step 1: the pin, from exactly one settings file.
 
-here=$(cd "$(dirname "$0")" && pwd) || refuse "cannot locate the .claudinite folder"
+dir_of "$0"
+here=$(cd "$dir" && pwd) || refuse "cannot locate the .claudinite folder"
 
 # Run as the npm package's bin, through the symlink npm made.
 self=$0
@@ -107,10 +135,11 @@ while [ -L "$self" ]; do
   link=$(readlink "$self") || break
   case $link in
     /*) self=$link ;;
-    *) self=$(dirname "$self")/$link ;;
+    *) dir_of "$self"; self=$dir/$link ;;
   esac
 done
-pkgdir=$(cd "$(dirname "$self")" && pwd) || refuse "cannot locate the launcher's folder"
+dir_of "$self"
+pkgdir=$(cd "$dir" && pwd) || refuse "cannot locate the launcher's folder"
 bootstrap=
 if [ -f "$pkgdir/manifest.json" ] && [ -f "$pkgdir/package.json" ]; then
   if [ "${1:-}" = init ]; then
@@ -131,6 +160,9 @@ if [ -f "$pkgdir/manifest.json" ] && [ -f "$pkgdir/package.json" ]; then
       esac
     done
     here=$(cd "$repo" && pwd)/.claudinite || refuse "cannot locate the repository $repo"
+    if [ "${1:-}" = adopt ] && [ ! -f "$here/settings.yaml" ] && [ ! -f "$here/settings.toml" ] && [ ! -f "$here/settings.json" ]; then
+      bootstrap=1
+    fi
   fi
 fi
 
@@ -145,37 +177,82 @@ done
 
 if [ -n "$bootstrap" ]; then
   settings=$pkgdir/manifest.json
-  [ -f "$pkgdir/manifest.sig.json" ] || refuse "$pkgdir holds no manifest.sig.json, and cn init never runs from an unsigned manifest"
+  [ -f "$pkgdir/manifest.sig.json" ] || refuse "$pkgdir holds no manifest.sig.json, and cn adopt never runs from an unsigned manifest"
 else
   [ "$count" -eq 1 ] || refuse "exactly one of .claudinite/settings.yaml, .claudinite/settings.toml or .claudinite/settings.json must exist, found $count in ${here%/.claudinite}"
   settings=$here/settings.$format
 fi
 
-if [ "$format" = json ] && [ -z "$bootstrap" ]; then
-  engines=$(tr -d '\r\n' < "$settings" | grep -o '"engine"[[:blank:]]*:' | wc -l | tr -d ' ')
-  [ "$engines" -eq 1 ] || refuse "$settings must hold exactly one \"engine\" object, found $engines"
-fi
-
-# The lines of the engine block, one key per line. No parser: the values the
-# launcher needs are plain quoted strings, read with a strict pattern.
-engine_block() {
-  case $format in
-    yaml) awk '/^engine:[ \t]*$/ { inb = 1; next } inb && /^[^ \t]/ { inb = 0 } inb { print }' "$settings" ;;
-    toml) awk '/^\[engine\][ \t]*$/ { inb = 1; next } inb && /^[ \t]*\[/ { inb = 0 } inb { print }' "$settings" ;;
-    json) tr -d '\r\n' < "$settings" | sed -n 's/.*"engine"[[:blank:]]*:[[:blank:]]*{\([^{}]*\)}.*/\1/p' | tr ',' '\n' ;;
-  esac
-}
-
-# engine_value KEY: the key's quoted string, or empty when the key is absent.
-# A key present twice, or not holding a plain quoted string, is refused.
-engine_value() {
-  case $format in toml) sep='=' ;; *) sep=':' ;; esac
-  lines=$(engine_block | grep -E "^[[:blank:]]*\"?$1\"?[[:blank:]]*${sep}")
-  [ -z "$lines" ] && return 0
-  [ "$(printf '%s\n' "$lines" | wc -l | tr -d ' ')" -eq 1 ] || { echo "duplicate"; return 0; }
-  value=$(printf '%s\n' "$lines" | sed -n "s/^[[:blank:]]*\"\{0,1\}$1\"\{0,1\}[[:blank:]]*${sep}[[:blank:]]*\"\([^\"]*\)\"[[:blank:]]*\$/\1/p")
-  [ -n "$value" ] || value=malformed
-  printf '%s\n' "$value"
+# The engine block's values, read in one pass. No parser: the values the
+# launcher needs are plain quoted strings, read with a strict pattern. A key
+# absent reads empty; a key present twice reads "duplicate", and one not
+# holding a plain quoted string, or a releases value not naming a GitHub
+# repository, "malformed". The pass also counts a JSON file's engine keys and
+# decodes the pin to the lowercase hex the hash tools print.
+read_pin() {
+  awk -v format="$format" -v repo='[A-Za-z0-9-]+/[A-Za-z0-9_-][A-Za-z0-9._-]*' '
+  function value(key,   sep, n, i, line, v, found) {
+    sep = (format == "toml") ? "=" : ":"
+    n = 0
+    for (i = 1; i <= nlines; i++) {
+      line = lines[i]
+      if (line ~ ("^[ \t]*\"?" key "\"?[ \t]*" sep)) { n++; found = line }
+    }
+    if (n == 0) return ""
+    if (n > 1) return "duplicate"
+    if (found !~ ("^[ \t]*\"?" key "\"?[ \t]*" sep "[ \t]*\"[^\"]*\"[ \t]*$")) return "malformed"
+    v = found
+    sub("^[ \t]*\"?" key "\"?[ \t]*" sep "[ \t]*\"", "", v)
+    sub("\"[ \t]*$", "", v)
+    return (v == "") ? "malformed" : v
+  }
+  function hex(b64,   a, h, i, c, bits, nb, p, byte, out) {
+    a = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
+    for (i = 0; i < 64; i++) dv[substr(a, i + 1, 1)] = i
+    h = "0123456789abcdef"
+    bits = 0; nb = 0; out = ""
+    for (i = 1; i <= length(b64); i++) {
+      c = substr(b64, i, 1)
+      if (c == "=") break
+      bits = bits * 64 + dv[c]; nb += 6
+      if (nb >= 8) {
+        nb -= 8; p = 2 ^ nb
+        byte = int(bits / p); bits -= byte * p
+        out = out substr(h, int(byte / 16) + 1, 1) substr(h, byte % 16 + 1, 1)
+      }
+    }
+    return out
+  }
+  { all = all $0 }
+  format == "yaml" && /^engine:[ \t]*$/ { inb = 1; next }
+  format == "yaml" && inb && /^[^ \t]/ { inb = 0 }
+  format == "toml" && /^\[engine\][ \t]*$/ { inb = 1; next }
+  format == "toml" && inb && /^[ \t]*\[/ { inb = 0 }
+  format != "json" && inb { lines[++nlines] = $0 }
+  END {
+    engines = 0
+    if (format == "json") {
+      gsub(/\r/, "", all)
+      rest = all
+      while (match(rest, /"engine"[ \t]*:/)) { engines++; rest = substr(rest, RSTART + RLENGTH) }
+      block = ""
+      rest = all
+      while (match(rest, /"engine"[ \t]*:[ \t]*\{[^{}]*\}/)) {
+        block = substr(rest, RSTART, RLENGTH); rest = substr(rest, RSTART + RLENGTH)
+      }
+      sub(/^"engine"[ \t]*:[ \t]*\{/, "", block); sub(/\}$/, "", block)
+      nlines = split(block, lines, ",")
+    }
+    pin = value("manifest")
+    print engines
+    print value("version")
+    print pin
+    print value("package")
+    releases = value("releases")
+    if (releases != "" && releases !~ ("^" repo "$")) releases = "malformed"
+    print releases
+    print (pin ~ /^sha512-/) ? hex(substr(pin, 8)) : ""
+  }' "$settings"
 }
 
 if [ -n "$bootstrap" ]; then
@@ -183,36 +260,43 @@ if [ -n "$bootstrap" ]; then
   # manifest's own hash stands in for the pin.
   version=$(sed -n 's/^ *"version": *"\([0-9]*\.[0-9]*\.[0-9]*\)",\{0,1\}$/\1/p' "$pkgdir/manifest.json" | head -n 1)
   package=$(sed -n 's/^ *"name": *"\(@claudinite\/cli[-a-z]*\)",\{0,1\}$/\1/p' "$pkgdir/package.json" | head -n 1)
-  matches "$version" '[0-9]+\.[0-9]+\.[0-9]+' || refuse "$pkgdir/manifest.json names no version"
-  matches "$package" '@claudinite/cli(-rc)?' \
+  is_version "$version" || refuse "$pkgdir/manifest.json names no version"
+  is_package "$package" \
     || refuse "$pkgdir/package.json must name \"@claudinite/cli\" or \"@claudinite/cli-rc\""
 else
-  version=$(engine_value version)
-  manifest_pin=$(engine_value manifest)
-  package=$(engine_value package)
+  pinned=$(read_pin) || refuse "cannot read $settings"
+  engines=0 version='' manifest_pin='' package='' releases='' pin_hex=''
+  { read -r engines; read -r version; read -r manifest_pin; read -r package; read -r releases; read -r pin_hex; } <<EOF
+$pinned
+EOF
+  if [ "$format" = json ]; then
+    [ "$engines" -eq 1 ] || refuse "$settings must hold exactly one \"engine\" object, found $engines"
+  fi
   [ -n "$package" ] || package=@claudinite/cli
-  releases=$(engine_value releases)
 
-  matches "$version" '[0-9]+\.[0-9]+\.[0-9]+' \
+  is_version "$version" \
     || refuse "engine.version in $settings must be a quoted version like \"1.60928.1\""
-  matches "$manifest_pin" 'sha512-[A-Za-z0-9+/]{86}==' \
+  is_pin "$manifest_pin" \
     || refuse "engine.manifest in $settings must be a quoted sha512-... integrity string"
-  matches "$package" '@claudinite/cli(-rc)?' \
+  is_package "$package" \
     || refuse "engine.package in $settings must be \"@claudinite/cli\" or \"@claudinite/cli-rc\""
-  [ -z "$releases" ] || matches "$releases" '[A-Za-z0-9-]+/[A-Za-z0-9_-][A-Za-z0-9._-]*' \
-    || refuse "engine.releases in $settings must be a quoted GitHub repository like \"owner/name\""
+  case $releases in
+    '' | */*) ;;
+    *) refuse "engine.releases in $settings must be a quoted GitHub repository like \"owner/name\"" ;;
+  esac
 fi
 
-case $(uname -s) in
+uname=$(uname -s -m)
+case ${uname% *} in
   Linux) os=linux ;;
   Darwin) os=darwin ;;
   MINGW*|MSYS*|CYGWIN*) os=windows ;;
-  *) refuse "unsupported operating system $(uname -s)" ;;
+  *) refuse "unsupported operating system ${uname% *}" ;;
 esac
-case $(uname -m) in
+case ${uname##* } in
   x86_64|amd64) arch=x64 ;;
   aarch64|arm64) arch=arm64 ;;
-  *) refuse "unsupported processor $(uname -m)" ;;
+  *) refuse "unsupported processor ${uname##* }" ;;
 esac
 bin=cn
 bin_re=cn
@@ -224,14 +308,14 @@ fi
 platform=$os-$arch
 
 if command -v sha256sum >/dev/null 2>&1; then
-  sha256() { sha256sum < "$1" | cut -d' ' -f1; }
-  sha512() { sha512sum < "$1" | cut -d' ' -f1; }
+  sha256() { set -- "$(sha256sum < "$1")"; printf '%s\n' "${1%% *}"; }
+  sha512() { set -- "$(sha512sum < "$1")"; printf '%s\n' "${1%% *}"; }
 elif command -v shasum >/dev/null 2>&1; then
-  sha256() { shasum -a 256 < "$1" | cut -d' ' -f1; }
-  sha512() { shasum -a 512 < "$1" | cut -d' ' -f1; }
+  sha256() { set -- "$(shasum -a 256 < "$1")"; printf '%s\n' "${1%% *}"; }
+  sha512() { set -- "$(shasum -a 512 < "$1")"; printf '%s\n' "${1%% *}"; }
 elif command -v openssl >/dev/null 2>&1; then
-  sha256() { openssl dgst -sha256 < "$1" | sed 's/.*= *//'; }
-  sha512() { openssl dgst -sha512 < "$1" | sed 's/.*= *//'; }
+  sha256() { set -- "$(openssl dgst -sha256 < "$1")"; printf '%s\n' "${1##* }"; }
+  sha512() { set -- "$(openssl dgst -sha512 < "$1")"; printf '%s\n' "${1##* }"; }
 else
   refuse "no SHA-256 tool found (sha256sum, shasum or openssl)"
 fi
@@ -239,31 +323,11 @@ for tool in curl tar; do
   command -v "$tool" >/dev/null 2>&1 || refuse "$tool is not installed; the launcher needs it to fetch the engine"
 done
 
-# The pin's SHA-512 as lowercase hex, to compare with the hash tools' output;
-# the bootstrap's pin is the hash of the manifest npx unpacked.
+# The bootstrap's pin is the hash of the manifest npx unpacked, as the
+# lowercase hex the hash tools print; a settings file's pin was decoded to
+# that hex as it was read.
 if [ -n "$bootstrap" ]; then
   pin_hex=$(sha512 "$pkgdir/manifest.json")
-else
-  pin_hex=$(printf '%s\n' "${manifest_pin#sha512-}" | awk '
-  BEGIN {
-    a = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
-    for (i = 0; i < 64; i++) v[substr(a, i + 1, 1)] = i
-    h = "0123456789abcdef"
-  }
-  {
-    bits = 0; nb = 0; out = ""
-    for (i = 1; i <= length($0); i++) {
-      c = substr($0, i, 1)
-      if (c == "=") break
-      bits = bits * 64 + v[c]; nb += 6
-      if (nb >= 8) {
-        nb -= 8; p = 2 ^ nb
-        byte = int(bits / p); bits -= byte * p
-        out = out substr(h, int(byte / 16) + 1, 1) substr(h, byte % 16 + 1, 1)
-      }
-    }
-    print out
-  }')
 fi
 
 # This platform's SHA-256 from a manifest.json whose hash matched the pin.
@@ -285,15 +349,33 @@ private_dir() {
   fi
   [ -L "$1" ] && refuse "the cache directory $1 is a symbolic link"
   [ "$os" = windows ] && return 0
+  # shellcheck disable=SC3067 # -O is in every sh the launcher runs under (dash, bash, busybox, zsh)
+  [ -O "$1" ] || private_refused "$1"
+}
+# private_refused names the mode and owner found on a cache folder that is
+# not mode 0700 and owned by you.
+private_refused() {
   # shellcheck disable=SC2012 # ls -ldn is the portable way to read mode and uid
   set -- "$1" "$(ls -ldn "$1" | awk '{ print $1 " " $3 }')"
-  case $2 in
-    "drwx------ $(id -u)"|"drwx------. $(id -u)"|"drwx------+ $(id -u)"|"drwx------@ $(id -u)") ;;
-    *) refuse "the cache directory $1 must be mode 0700 and owned by you (found ${2% *})" ;;
-  esac
+  refuse "the cache directory $1 must be mode 0700 and owned by you (found ${2% *})"
 }
 private_dir "$cache_root"
 private_dir "$vdir"
+# One find answers both folders' modes, printing each one that is exactly
+# 0700.
+if [ "$os" != windows ]; then
+  private=$(find "$cache_root" "$vdir" -prune -perm 0700)
+  for d in "$cache_root" "$vdir"; do
+    case "
+$private
+" in
+      *"
+$d
+"*) ;;
+      *) private_refused "$d" ;;
+    esac
+  done
+fi
 
 cached_ok() {
   [ -f "$vdir/manifest.json" ] && [ -f "$vdir/$bin" ] || return 1
@@ -308,7 +390,7 @@ if ! cached_ok; then
 
   # Step 3: download by exact tarball URL, HTTPS only, with a size cap.
 
-  matches "$max_bytes" '[0-9]+' || refuse "CLAUDINITE_MAX_DOWNLOAD_BYTES must be a number"
+  digits "$max_bytes" || refuse "CLAUDINITE_MAX_DOWNLOAD_BYTES must be a number"
   # A whole transfer may take as long as the cap at about 220 kB/s, and never
   # less than 30 s: the 64 MiB default allows about 300 s. --max-filesize
   # bounds only the compressed size, so the wall clock is what stops a
@@ -378,10 +460,13 @@ fi
 
 # Step 5: link, unpack, run.
 
-mkdir -p "$here/bin" || refuse "cannot create $here/bin"
-if ! ln -sfn "$vdir/$bin" "$here/bin/$bin" 2>/dev/null; then
-  rm -f "$here/bin/$bin"
-  cp "$vdir/$bin" "$here/bin/$bin" || refuse "cannot link or copy the engine into $here/bin"
+# shellcheck disable=SC3013 # -ef is in every sh the launcher runs under (dash, bash, busybox, zsh)
+if [ ! "$here/bin/$bin" -ef "$vdir/$bin" ]; then
+  mkdir -p "$here/bin" || refuse "cannot create $here/bin"
+  if ! ln -sfn "$vdir/$bin" "$here/bin/$bin" 2>/dev/null; then
+    rm -f "$here/bin/$bin"
+    cp "$vdir/$bin" "$here/bin/$bin" || refuse "cannot link or copy the engine into $here/bin"
+  fi
 fi
 # Unpacking the embedded runner script and SDK beside the binary is a no-op
 # until the engine embeds them (no pack JavaScript runs yet).

package/manifest.json

@@ -1,13 +1,13 @@
 {
   "v": 1,
-  "version": "1.61009.3",
-  "builtAt": "2026-10-09T17:12:30Z",
-  "commit": "d8c6f57",
+  "version": "1.61011.1",
+  "builtAt": "2026-10-11T14:21:06Z",
+  "commit": "be76a87",
   "goVersion": "go1.24.13",
-  "updaterDigest": "17d1c0633fb74986490cd291b8e55248a9c8cbf9b76f039252f744c3e76ecc74",
+  "updaterDigest": "ad53cefad388e31a7059dfbe5afc71479991a7aaa182d36cb9accde4f06a512b",
   "binaries": {
-    "linux-x64": {"file": "cn", "sha256": "faa12311d2006f7c1a959de09a4484894d915068e0ba16e5be86d7f5df6a1da6", "size": 12746936}
+    "linux-x64": {"file": "cn", "sha256": "bb852b2a1789e0b1842572374668569dfb9e339f541d9e156fb9786b45230b14", "size": 12845240}
   },
-  "launcher": "82defc0fd3c22332d24bbc9ba207723bf6c88962bb5213afc79660fefa09c9bb",
+  "launcher": "314f37fe7a4a1d2fdc59de14d5e8903959d9bd1bc03971e36d6340ed805129cd",
   "testedPacks": {}
 }

package/manifest.sig.json

@@ -3,5 +3,5 @@
     "payload": "eyJ2IjoxLCJrZXlJZCI6ImM3NzQwNWM2ZDA4NzExODYiLCJwdWJsaWNLZXkiOiI0UHlTQzRTbG5MakJ1cVY2Qll4eU9XWUtLOWkzV295NkZCQ1ZNckF6clRzIiwidXNlIjoibWFuaWZlc3QiLCJpc3N1ZXIiOiJlYTg1ZjM1NDIxZjM3NWZjIiwibm90QmVmb3JlIjoiMjAyNi0xMC0wM1QxNjozNjozN1oiLCJub3RBZnRlciI6IjIwMjctMTAtMDNUMTY6MzY6MzdaIn0",
     "signature": "ex4GNEE3PIUj3Ue6X2TZnbB5E6G-DVrGNaYdvI13NuOauoJYilB_54TyAH490IS9-IZiu3BKVYpigm3uDTXSBw"
   },
-  "signature": "Sek2B4pBVaq1XH-pbXcaegAjV1qvdf3BCf9QS9kDU5_5TbJmz224xHm53wqYRt-gaPUjYraY5IWDV08ELbzCCQ"
+  "signature": "hxOZ4q1fimMsTdk8VfxiYYXTNT64QJ2Bawx-__Moy2zpwUncpmEzEvbyctpQfkSTygcLcPaqInd2LEyHb6E6Dg"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claudinite/cli",
-  "version": "1.61009.3",
+  "version": "1.61011.1",
   "description": "Claudinite engine release manifest and launcher",
   "license": "UNLICENSED",
   "repository": {"type": "git", "url": "git+https://github.com/missingbulb/ClaudiniteEngine.git"},