@codevector/cli 0.3.4 → 0.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codevector/cli",
-  "version": "0.3.4",
+  "version": "0.5.0",
   "description": "CodeVector CLI — installs and configures first-party coding-tool integrations.",
   "license": "UNLICENSED",
   "bin": {
@@ -9,6 +9,7 @@
   "files": [
     "bin",
     "dist",
+    "scripts",
     "src/hooks"
   ],
   "type": "module",
@@ -16,7 +17,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@clack/prompts": "1.3.0",
+    "@clack/prompts": "1.4.0",
     "citty": "^0.2.2",
     "hono": "4.12.16",
     "smol-toml": "^1.6.1"
@@ -28,8 +29,8 @@
     "typescript": "6.0.3",
     "vitest": "4.1.5",
     "zod": "4.4.2",
-    "@codevector/api": "1.7.3",
-    "@codevector/common": "1.7.3"
+    "@codevector/api": "1.13.0",
+    "@codevector/common": "1.13.0"
   },
   "engines": {
     "node": ">=20"
@@ -39,6 +40,7 @@
     "build": "tsup",
     "type-check": "tsc --noEmit",
     "test": "vitest run",
-    "test:watch": "vitest"
+    "test:watch": "vitest",
+    "postinstall": "node scripts/postinstall.mjs"
   }
 }

package/scripts/postinstall.mjs

@@ -0,0 +1,140 @@
+#!/usr/bin/env node
+/**
+ * Post-install tasks. Two independent things, each wrapped so neither can
+ * fail the install:
+ *
+ *   1. Migrate legacy single-profile credentials.json to the multi-profile
+ *      format introduced in v0.4.0.
+ *   2. Detect which package manager invoked the install (npm / pnpm / yarn),
+ *      parsed out of `process.env.npm_config_user_agent`, and persist it to
+ *      `~/.config/codevector/install.json` so `codevector update` can use
+ *      the same manager without prompting.
+ *
+ * Runs automatically after `npm install` / `pnpm install` / `yarn add`.
+ * Zero external dependencies — only Node built-ins. Any error is silently
+ * ignored so the install never fails.
+ */
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { homedir } from "node:os";
+
+const CONFIG_DIR = process.env.CODEVECTOR_CONFIG_DIR ?? join(homedir(), ".config", "codevector");
+const CREDENTIALS_FILE = join(CONFIG_DIR, "credentials.json");
+const INSTALL_FILE = join(CONFIG_DIR, "install.json");
+
+try {
+  migrateCredentialsIfNeeded();
+} catch {
+  // Never fail the install.
+}
+
+try {
+  capturePackageManagerIfPossible();
+} catch {
+  // Never fail the install.
+}
+
+function migrateCredentialsIfNeeded() {
+  let raw;
+  try {
+    raw = readFileSync(CREDENTIALS_FILE, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return; // Nothing to migrate.
+    throw err;
+  }
+
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return; // Corrupted file — leave it for the CLI to surface.
+  }
+
+  // Already migrated (or created by a newer CLI).
+  if (parsed && typeof parsed === "object" && "profiles" in parsed) return;
+
+  // Legacy format guard.
+  if (
+    !parsed ||
+    typeof parsed !== "object" ||
+    typeof parsed.apiKey !== "string" ||
+    typeof parsed.gatewayUrl !== "string"
+  ) {
+    return;
+  }
+
+  const migrated = {
+    activeProfile: "default",
+    profiles: { default: parsed },
+  };
+
+  mkdirSync(dirname(CREDENTIALS_FILE), { recursive: true, mode: 0o700 });
+
+  // Always enforce 0600 — secrets file.
+  const mode = 0o600;
+  const tmp = `${CREDENTIALS_FILE}.${process.pid}.tmp`;
+  writeFileSync(tmp, JSON.stringify(migrated, null, 2), { mode });
+  try {
+    chmodSync(tmp, mode);
+  } catch {
+    // Windows or unsupported FS.
+  }
+  renameSync(tmp, CREDENTIALS_FILE);
+}
+
+function capturePackageManagerIfPossible() {
+  const pm = detectPackageManager();
+  if (!pm) return;
+
+  // Preserve an existing user-pinned choice — only auto-detection writes
+  // are overwritten by later installs.
+  if (existsSync(INSTALL_FILE)) {
+    try {
+      const existing = JSON.parse(readFileSync(INSTALL_FILE, "utf8"));
+      if (existing && existing.source === "user") return;
+      // If the user is reinstalling with the same PM, no-op so we don't
+      // churn mtimes on every `npm i -g` rerun.
+      if (existing && existing.packageManager === pm && existing.source === "auto") return;
+    } catch {
+      // Fall through and overwrite a corrupt install.json.
+    }
+  }
+
+  mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+  const payload = {
+    packageManager: pm,
+    source: "auto",
+    detectedAt: new Date().toISOString(),
+  };
+  const tmp = `${INSTALL_FILE}.${process.pid}.tmp`;
+  writeFileSync(tmp, JSON.stringify(payload, null, 2));
+  renameSync(tmp, INSTALL_FILE);
+}
+
+/**
+ * Parse npm_config_user_agent. All three managers set it during script
+ * execution. Example values:
+ *
+ *   npm/10.2.4 node/v20.11.0 darwin arm64 workspaces/false
+ *   pnpm/8.15.0 npm/? node/v20.11.0 darwin arm64
+ *   yarn/1.22.19 npm/? node/v20.11.0 darwin arm64
+ *
+ * We look at the LEADING token: that's the manager actually running this
+ * script. pnpm/yarn both append a ghost "npm/?" segment, which is why we
+ * never use a contains-check.
+ */
+function detectPackageManager() {
+  const ua = process.env.npm_config_user_agent;
+  if (typeof ua !== "string" || ua.length === 0) return null;
+  const head = ua.split(" ")[0] ?? "";
+  const slash = head.indexOf("/");
+  const name = slash > 0 ? head.slice(0, slash) : head;
+  switch (name) {
+    case "npm":
+    case "pnpm":
+    case "yarn":
+      return name;
+    default:
+      return null;
+  }
+}