@coworker-jp/aidr 0.1.323 → 0.1.326

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coworker-jp/aidr",
-  "version": "0.1.323",
+  "version": "0.1.326",
   "description": "AIDR setup CLI - installs ai-scanner hooks for 19+ AI coding agents",
   "type": "module",
   "bin": {

package/src/binary-fetcher.mjs

@@ -37,6 +37,14 @@ export function detectOpengrepPlatform() {
   if (os === "darwin" && arch === "x64") return "osx_x86";
   if (os === "linux" && arch === "x64") return "manylinux_x86";
   if (os === "linux" && arch === "arm64") return "manylinux_aarch64";
+  // Windows x64 (issue #2426). The upstream single-file CLI for Windows has
+  // existed since v1.16.0 as `opengrep_windows_x86.exe` — it is the ONLY asset
+  // whose name carries an extension, which is why counting only the
+  // suffixless `opengrep_*` assets misses it. Verified on the Windows testbed:
+  // the real binary answers the exact argv ai-scanner passes and returns a
+  // genuine finding. (`opengrep-core_windows_x86.zip` is a different thing —
+  // the OCaml core, not the CLI — and is NOT what we fetch.)
+  if (os === "win32" && arch === "x64") return "windows_x86";
   throw new Error(`Unsupported platform for Opengrep: ${os}/${arch}`);
 }
 
@@ -369,8 +377,28 @@ const OPENGREP_SHA256 = {
   manylinux_aarch64: "7141748e929292e2b672f12515035a01643705010f28970c66ae43612162213e",
   musllinux_x86: "02cf0b1be28d4bafd21fc836d59f4bdccf3ff0635dc3ec3c1a33560ab76a65e5",
   musllinux_aarch64: "cbe97968569491bbaea33cf88384177cf602319550d10da066297c2421c24466",
+  windows_x86: "f559795b0a8e66452e7f370d52b86398c09d99a50202ec4483fe2fa89a86d1c7",
 };
 
+/**
+ * Upstream RELEASE ASSET name for a platform.
+ *
+ * Windows is the only platform whose asset carries an extension
+ * (`opengrep_windows_x86.exe`); every other platform ships a suffixless file.
+ * Kept as one function so the rule lives in a single place — the URL builder
+ * and the SHA-mismatch message both read it.
+ *
+ * NOTE this is deliberately NOT the on-disk filename. We install every platform
+ * as plain `opengrep` (no `.exe`): an extensionless PE launches fine through a
+ * full path, and keeping one name means the seven per-agent `BIN_FILES`
+ * uninstall tables, the sibling lookup in ai-scanner, and `SYSTEM_OPENGREP` do
+ * not each need a platform-conditional branch (a missed one would silently
+ * leave the engine behind on uninstall).
+ */
+export function opengrepAssetName(platform) {
+  return platform === "windows_x86" ? `opengrep_${platform}.exe` : `opengrep_${platform}`;
+}
+
 /**
  * Download the bundled Opengrep binary (LGPL-2.1) for the current platform
  * into `destPath`. Opengrep is invoked by ai-scanner as a separate process;
@@ -385,13 +413,14 @@ export async function fetchOpengrep(destPath) {
   const expectedSha = OPENGREP_SHA256[platform];
   if (!expectedSha) throw new Error(`no pinned SHA256 for Opengrep platform ${platform}`);
 
-  const binUrl = `https://github.com/opengrep/opengrep/releases/download/${OPENGREP_VERSION}/opengrep_${platform}`;
+  const asset = opengrepAssetName(platform);
+  const binUrl = `https://github.com/opengrep/opengrep/releases/download/${OPENGREP_VERSION}/${asset}`;
 
   await fsp.mkdir(path.dirname(destPath), { recursive: true });
   const buf = await fetchBuffer(binUrl);
   const sha256 = crypto.createHash("sha256").update(buf).digest("hex");
   if (sha256 !== expectedSha) {
-    throw new Error(`SHA256 mismatch for opengrep_${platform}: got ${sha256}, expected ${expectedSha}`);
+    throw new Error(`SHA256 mismatch for ${asset}: got ${sha256}, expected ${expectedSha}`);
   }
 
   const tmp = `${destPath}.tmp-${process.pid}`;

package/src/templates.mjs

@@ -368,16 +368,18 @@ if should_check_update; then
     if [ -n "$have_host" ] && [ -n "$want_host" ] && [ "$have_host" != "$want_host" ]; then
         echo "ai-scanner: 導入済みのバイナリは $have_host を見ていますが、この導入は $want_host から配信しています。アクセスキーは決して受け付けられず、検知ログは拒否されて捨てられます。一致するバイナリを取り直しています。" >&2
         echo "ai-scanner: the installed binary talks to $have_host, but this installation provisions from $want_host, so its access key can never be accepted (detection logs are refused and discarded). Re-downloading the matching binary." >&2
-        download_binary "\${DOWNLOAD_BASE}/\${PLATFORM_SLUG}" "$BIN" || \\
+        download_binary "\${DOWNLOAD_BASE}/\${PLATFORM_SLUG}" "$BIN" || {
             echo "ai-scanner: 食い違ったバイナリを置き換えられませんでした: \${UNVERIFIED_REASON:-ダウンロードに失敗しました}。手元の検査は続きますが、検知ログは拒否され続けます。導入コマンドをもう一度実行してください。それでも直らなければ、このメッセージを添えて社内の IT 管理者にご連絡ください。" >&2
             echo "ai-scanner: could not replace the mismatched binary: \${UNVERIFIED_REASON:-the download failed}. Scanning continues locally, but detection logs will keep being refused. Re-run the installer, or contact your IT administrator with this message." >&2
+        }
     elif [ -z "$have_host" ]; then
         echo "ai-scanner: 導入済みのバイナリがどのライセンスサーバーを見ているか読めなかったので、環境が一致するかは確認していません。検知ログが拒否されているようなら、導入コマンドをもう一度実行してください。" >&2
         echo "ai-scanner: could not read which license server the installed binary uses, so the environment match was NOT checked. If detection logs are being refused, re-run the installer." >&2
     fi
-    timeout "$UPDATE_TIMEOUT" "$BIN" update 2>/dev/null || \\
+    timeout "$UPDATE_TIMEOUT" "$BIN" update 2>/dev/null || {
         echo "ai-scanner: スキャナーは今回、自分を更新できませんでした。すでに持っているルールで検査は続きます。これが繰り返されるなら、導入コマンドをもう一度実行してください。それでも直らなければ社内の IT 管理者にご連絡ください。" >&2
         echo "ai-scanner: the scanner could not update itself just now. It keeps scanning with the rules it already has; if this repeats, re-run the installer or contact your IT administrator." >&2
+    }
 
     # Keep the hook binary on the SAME build as the periodic one (issue #2366).
     # They come from one crate and share one version, so a skew means an update
@@ -400,9 +402,10 @@ if should_check_update; then
         if [ -n "$scanner_ver" ] && [ -n "$harness_ver" ] && [ "$scanner_ver" != "$harness_ver" ]; then
             echo "ai-scanner: ツールコール検査機は $harness_ver、この端末は $scanner_ver です。同じビルドで揃うよう、いま取り直しています。" >&2
             echo "ai-scanner: the tool-call scanner is on $harness_ver while this endpoint is on $scanner_ver. Refreshing it so both run one build." >&2
-            download_binary "\${DOWNLOAD_BASE}/ai-harness/\${PLATFORM_SLUG}" "$HARNESS" || \\
+            download_binary "\${DOWNLOAD_BASE}/ai-harness/\${PLATFORM_SLUG}" "$HARNESS" || {
                 echo "ai-scanner: ツールコール検査機を取り直せませんでした: \${UNVERIFIED_REASON:-ダウンロードに失敗しました}。検査は $harness_ver のまま続きます。これが繰り返されるなら、導入コマンド (${installCommand}) をもう一度実行してください。" >&2
                 echo "ai-scanner: could not refresh the tool-call scanner: \${UNVERIFIED_REASON:-the download failed}. Scanning continues on $harness_ver; re-run the installer (${installCommand}) if this repeats." >&2
+            }
         fi
     fi
     date +%s > "$PULL_STAMP"
@@ -484,9 +487,10 @@ if [ -x "$HARNESS" ] && [ -n "$CONFIG_ROOT" ] && [ -n "\${AI_SCANNER_ACCESS_KEY:
         timeout "$UPDATE_TIMEOUT" "$HARNESS" setup \\
             --agent ${setupAgentName} --scope "$repair_scope" \\
             --access-key "$AI_SCANNER_ACCESS_KEY" \\
-            --download-base "$DOWNLOAD_BASE" --home "$CONFIG_ROOT" >/dev/null 2>&1 || \\
+            --download-base "$DOWNLOAD_BASE" --home "$CONFIG_ROOT" >/dev/null 2>&1 || {
             echo "ai-scanner: この端末のフックアダプタは分割前の形のままで、今回は更新できませんでした。ツールコールは、すでに導入済みのバイナリが検査し続けます。このメッセージが繰り返されるなら、導入コマンド (${installCommand}) をもう一度実行してください。それでも直らなければ、このメッセージを添えて社内の IT 管理者にご連絡ください。" >&2
             echo "ai-scanner: the hook adapters on this endpoint are still the pre-split shape and could not be updated just now. Tool calls keep being scanned by the binary already installed; if this message repeats, re-run the installer (${installCommand}) or contact your IT administrator with this message." >&2
+            }
     fi
 fi