@delta-infra/cli 1.0.26 → 1.0.28

package/README.md

@@ -4,7 +4,31 @@ Delta Infra 的命令行工具。
 
 ## 安装
 
-### 方式一：直接下载 Binary（推荐）
+### 方式一：npx 一键安装（推荐）
+
+```bash
+npx @delta-infra/cli@latest install
+```
+
+该命令会依次完成：
+1. **全局安装** `@delta-infra/cli`（含 Go 二进制）
+2. **安装 AI Skills** 到 `~/.agents/skills/`，自动适配 Claude Code、Codex、OpenCode、Cursor 等 AI 工具
+3. **初始化配置** `delta-cli config init`（交互式，非 TTY 跳过）
+4. **身份认证** `delta-cli auth login`（交互式，非 TTY 跳过）
+
+AI Agent 也可以直接使用以下指令完成安装：
+
+> 帮我安装 delta-cli：https://github.com/yzailab/delta-infra-cli
+
+### 卸载
+
+```bash
+npx @delta-infra/cli@latest uninstall
+```
+
+清理全局包、AI Skills 和配置文件。
+
+### 方式二：直接下载 Binary
 
 从 [GitHub Releases](https://github.com/yzailab/delta-infra-cli/releases) 下载对应平台的压缩包（以下使用 `latest` 指向最新版）：
 
@@ -30,7 +54,7 @@ Remove-Item -Path delta-cli.zip
 # 将 delta-cli.exe 放到 PATH 中的目录
 ```
 
-### 方式二：一键安装脚本（国内用户推荐）
+### 方式三：一键安装脚本（国内用户推荐）
 
 安装脚本会自动尝试国内 npm 镜像（npmmirror），失败后再回退到 npm 官方源：
 
@@ -42,7 +66,7 @@ curl -L https://raw.githubusercontent.com/yzailab/delta-infra-cli/main/install.s
 Invoke-RestMethod -Uri https://raw.githubusercontent.com/yzailab/delta-infra-cli/main/install.ps1 | Invoke-Expression
 ```
 
-### 方式三：npm
+### 方式四：npm
 
 ```bash
 npm install -g @delta-infra/cli
@@ -74,7 +98,7 @@ DELTA_CLI_ARCHIVE=/path/to/delta-cli-linux-amd64.tar.gz npm install -g @delta-in
 | `DELTA_CLI_FATAL_ON_ERROR` | 安装失败时退出码非 0（默认警告，用于调试）。 |
 | `DELTA_CLI_DOWNLOAD_TIMEOUT` | 单个下载源最大等待时间（毫秒，默认 120000）。 |
 
-### 方式四：Go Install
+### 方式五：Go Install
 
 ```bash
 go install github.com/delta-infra/delta-infra-cli/cmd/delta-cli@latest

package/checksums.txt

@@ -1,5 +1,5 @@
-110cb296b55737119c1a0338af0c659e7c4707fe5de634697fa7ef0bcf098a25  delta-cli-darwin-amd64.tar.gz
-50ed88ad864a6c1e6775c79d08977c8682e122f109e5aed3fe6abfa0452a0c26  delta-cli-darwin-arm64.tar.gz
-11a43205c93dfa12e57543171c810dac20f08bdb4bf91a38c510a8989f65f806  delta-cli-linux-amd64.tar.gz
-90e8f18aec87969d1b9a48ff4e74ea2eef25ef0681ee7fbb50f085a4fd2d92e1  delta-cli-linux-arm64.tar.gz
-b2a18ddff838feea1c3325a8c287c5e0c209f221085883c12b0f0ede75276e70  delta-cli-windows-amd64.zip
+79b5433250ec9697d0a7c360eb4b35c9f27e62152de32fad89a905e374bd29e0  delta-cli-darwin-amd64.tar.gz
+0602d8f72b91de73270ec0f385202f543649375e948719641179a78d1f37fdcf  delta-cli-darwin-arm64.tar.gz
+6db533d7826c62dc411c71c0a455cf37c5d580528b8fc5bc0e17904d9f00ffc2  delta-cli-linux-amd64.tar.gz
+0ddb97549520f524079885aab54e2058aad97fdbc9014a123d17fa91319f8280  delta-cli-linux-arm64.tar.gz
+7eab714f28f6ef0a1e713a7f98d2203975c5249061bbb37a60ee387398369451  delta-cli-windows-amd64.zip

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@delta-infra/cli",
-  "version": "1.0.26",
+  "version": "1.0.28",
   "description": "Delta Sandbox CLI",
   "bin": {
     "delta-cli": "scripts/run.js"
@@ -11,6 +11,7 @@
   "files": [
     "checksums.txt",
     "scripts/install.js",
+    "scripts/install-wizard.js",
     "scripts/run.js",
     "skills/delta-sandbox/SKILL.md",
     "skills/delta-sandbox/references/",
@@ -40,5 +41,8 @@
   "repository": {
     "type": "git",
     "url": "git+https://github.com/yzailab/delta-infra-cli.git"
+  },
+  "dependencies": {
+    "@clack/prompts": "^1.2.0"
   }
 }

package/scripts/install-wizard.js

@@ -0,0 +1,403 @@
+#!/usr/bin/env node
+// Copyright (c) 2026 Delta Infra Authors
+// SPDX-License-Identifier: MIT
+
+const fs = require("fs");
+const path = require("path");
+const { execFileSync, execFile } = require("child_process");
+const p = require("@clack/prompts");
+
+const PKG = "@delta-infra/cli";
+const SKILLS_REPO = "yzailab/delta-infra-cli";
+const CONFIG_DIR = path.join(osHomedir(), ".delta-infra");
+const isWindows = process.platform === "win32";
+
+// ── i18n ────────────────────────────────────────────────────────────────────
+
+const messages = {
+  zh: {
+    setup:          "正在设置 Delta Sandbox CLI...",
+    upgrade:        "正在升级 %s (v%s → v%s)...",
+    step1:          "正在安装 %s...",
+    step1Skip:      "已安装 (v%s)，跳过",
+    step1Done:      "已全局安装",
+    step1Upgraded:  "已升级到 v%s",
+    step1Fail:      "全局安装失败。运行以下命令重试: npm install -g %s",
+    step2:          "安装 AI Skills",
+    step2Spinner:   "正在安装 Skills...",
+    step2Done:      "Skills 已安装",
+    step2Skip:      "已安装，跳过",
+    step2Fail:      "Skills 安装失败。运行以下命令重试: npx skills add %s -y -g",
+    step3:          "正在初始化配置...",
+    step3Skip:      "跳过配置初始化",
+    step3Done:      "配置已初始化",
+    step3Fail:      "配置初始化失败。运行以下命令重试: delta-cli config init",
+    step4:          "身份认证",
+    step4Confirm:   "是否进行身份认证？",
+    step4Skip:      "跳过身份认证。后续运行 delta-cli auth login 完成",
+    step4Done:      "认证完成",
+    step4Fail:      "认证失败。运行以下命令重试: delta-cli auth login",
+    done:           "安装完成！\n现在可以和你的 AI 工具说：\"帮我使用 delta sandbox 运行一个 GPU 任务\"",
+    cancelled:      "安装已取消",
+    nonTtyHint:     "要完成配置，请在终端中运行：\n  delta-cli config init\n  delta-cli auth login",
+  },
+  en: {
+    setup:          "Setting up Delta Sandbox CLI...",
+    upgrade:        "Upgrading %s (v%s → v%s)...",
+    step1:          "Installing %s globally...",
+    step1Skip:      "Already installed (v%s). Skipped",
+    step1Done:      "Installed globally",
+    step1Upgraded:  "Upgraded to v%s",
+    step1Fail:      "Failed to install globally. Run manually: npm install -g %s",
+    step2:          "Install AI skills",
+    step2Spinner:   "Installing skills...",
+    step2Done:      "Skills installed",
+    step2Skip:      "Already installed. Skipped",
+    step2Fail:      "Failed to install skills. Run manually: npx skills add %s -y -g",
+    step3:          "Initializing config...",
+    step3Skip:      "Skipped config initialization",
+    step3Done:      "Config initialized",
+    step3Fail:      "Failed to init config. Run manually: delta-cli config init",
+    step4:          "Authorization",
+    step4Confirm:   "Would you like to authenticate now?",
+    step4Skip:      "Skipped. Run delta-cli auth login to authorize later",
+    step4Done:      "Authorization complete",
+    step4Fail:      "Failed to authorize. Run delta-cli auth login to retry",
+    done:           "You are all set!\nNow try asking your AI tool: \"Help me run a GPU task with delta sandbox\"",
+    cancelled:      "Installation cancelled",
+    nonTtyHint:     "To complete setup, run interactively:\n  delta-cli config init\n  delta-cli auth login",
+  },
+};
+
+// ── Helpers ─────────────────────────────────────────────────────────────────
+
+function handleCancel(value, msg) {
+  if (p.isCancel(value)) {
+    p.cancel(msg.cancelled);
+    process.exit(0);
+  }
+  return value;
+}
+
+function execCmd(cmd, args, opts) {
+  if (isWindows) {
+    return execFileSync("cmd.exe", ["/c", cmd, ...args], opts);
+  }
+  return execFileSync(cmd, args, opts);
+}
+
+function run(cmd, args, opts = {}) {
+  execCmd(cmd, args, { stdio: "inherit", ...opts });
+}
+
+function runSilent(cmd, args, opts = {}) {
+  return execCmd(cmd, args, {
+    stdio: ["ignore", "pipe", "pipe"],
+    ...opts,
+  });
+}
+
+function runSilentAsync(cmd, args, opts = {}) {
+  const actualCmd = isWindows ? "cmd.exe" : cmd;
+  const actualArgs = isWindows ? ["/c", cmd, ...args] : args;
+  return new Promise((resolve, reject) => {
+    execFile(actualCmd, actualArgs, {
+      stdio: ["ignore", "pipe", "pipe"],
+      ...opts,
+    }, (err, stdout) => {
+      if (err) reject(err);
+      else resolve(stdout);
+    });
+  });
+}
+
+function fmt(template, ...values) {
+  let i = 0;
+  return template.replace(/%s/g, () => values[i++] ?? "");
+}
+
+function osHomedir() {
+  return process.env.HOME ||
+    process.env.USERPROFILE ||
+    (process.env.HOMEDRIVE && process.env.HOMEPATH && process.env.HOMEDRIVE + process.env.HOMEPATH) ||
+    "/root";
+}
+
+function whichDeltaCli() {
+  try {
+    const prefix = execFileSync("npm", ["prefix", "-g"], {
+      stdio: ["ignore", "pipe", "pipe"],
+    }).toString().trim();
+    const bin = isWindows
+      ? path.join(prefix, "delta-cli.cmd")
+      : path.join(prefix, "bin", "delta-cli");
+    if (fs.existsSync(bin)) return bin;
+  } catch {}
+  try {
+    const cmd = isWindows ? "where" : "which";
+    return execFileSync(cmd, ["delta-cli"], { stdio: ["ignore", "pipe", "pipe"] })
+      .toString().split("\n")[0].trim();
+  } catch {
+    return null;
+  }
+}
+
+function getLatestVersion() {
+  try {
+    const out = runSilent("npm", ["view", PKG, "version"], { timeout: 15000 });
+    const ver = out.toString().trim();
+    return /^\d+\.\d+\.\d+/.test(ver) ? ver : null;
+  } catch { return null; }
+}
+
+function semverLessThan(a, b) {
+  const pa = a.replace(/-.*$/, "").split(".").map(Number);
+  const pb = b.replace(/-.*$/, "").split(".").map(Number);
+  for (let i = 0; i < 3; i++) {
+    if ((pa[i] || 0) < (pb[i] || 0)) return true;
+    if ((pa[i] || 0) > (pb[i] || 0)) return false;
+  }
+  return false;
+}
+
+function getGloballyInstalledVersion() {
+  try {
+    const out = runSilent("npm", ["list", "-g", PKG], { timeout: 15000 });
+    const match = out.toString().match(/@(\d+\.\d+\.\d+[^\s]*)/);
+    return match ? match[1] : "unknown";
+  } catch { return null; }
+}
+
+function getExistingConfig() {
+  try {
+    const configPath = path.join(CONFIG_DIR, "config.json");
+    if (!fs.existsSync(configPath)) return null;
+    return JSON.parse(fs.readFileSync(configPath, "utf8"));
+  } catch { return null; }
+}
+
+// ── Steps ───────────────────────────────────────────────────────────────────
+
+async function stepInstallGlobally(msg) {
+  const installedVer = getGloballyInstalledVersion();
+  const latestVer = getLatestVersion();
+  const needsUpgrade = installedVer && latestVer && semverLessThan(installedVer, latestVer);
+
+  if (installedVer && !needsUpgrade) {
+    p.log.info(fmt(msg.step1Skip, installedVer));
+    return false;
+  }
+
+  const s = p.spinner();
+  if (needsUpgrade) {
+    s.start(fmt(msg.upgrade, PKG, installedVer, latestVer));
+  } else {
+    s.start(fmt(msg.step1, PKG));
+  }
+  try {
+    await runSilentAsync("npm", ["install", "-g", PKG], { timeout: 120000 });
+    s.stop(needsUpgrade ? fmt(msg.step1Upgraded, latestVer) : msg.step1Done);
+    return needsUpgrade;
+  } catch {
+    s.stop(fmt(msg.step1Fail, PKG));
+    process.exit(1);
+  }
+}
+
+async function skillsAlreadyInstalled() {
+  try {
+    const out = await runSilentAsync("npx", ["-y", "skills", "ls", "-g"], {
+      timeout: 120000,
+    });
+    return /^delta-/m.test(out.toString());
+  } catch { return false; }
+}
+
+async function stepInstallSkills(msg) {
+  const s = p.spinner();
+  s.start(msg.step2Spinner);
+  try {
+    if (await skillsAlreadyInstalled()) {
+      s.stop(msg.step2Skip);
+      return;
+    }
+    try {
+      await runSilentAsync("npx", ["-y", "skills", "add", SKILLS_REPO, "-y", "-g"], {
+        timeout: 120000,
+      });
+    } catch {
+      // Retry with GitHub URL directly
+      await runSilentAsync("npx", [
+        "-y", "skills", "add",
+        `https://github.com/${SKILLS_REPO}`, "-y", "-g",
+      ], { timeout: 120000 });
+    }
+    s.stop(msg.step2Done);
+  } catch {
+    s.stop(fmt(msg.step2Fail, SKILLS_REPO));
+    process.exit(1);
+  }
+}
+
+async function stepConfigInit(msg) {
+  const s = p.spinner();
+  s.start(msg.step3);
+
+  const deltaCli = whichDeltaCli();
+  if (!deltaCli) {
+    s.stop(msg.step3);
+    p.log.warn("delta-cli not found on PATH after global install.");
+    p.log.info(msg.step3Fail);
+    return;
+  }
+
+  // Check if config already exists with valid data
+  const existingConfig = getExistingConfig();
+  s.stop(msg.step3);
+
+  if (existingConfig && existingConfig.base_url) {
+    const reuse = await p.confirm({
+      message: `发现已有配置 (Server: ${existingConfig.base_url})，继续使用？`,
+    });
+    if (handleCancel(reuse, msg) && reuse) {
+      p.log.info(msg.step3Skip);
+      return;
+    }
+  }
+
+  try {
+    run(deltaCli, ["config", "init"]);
+    p.log.success(msg.step3Done);
+  } catch {
+    p.log.error(msg.step3Fail);
+    process.exit(1);
+  }
+}
+
+async function stepAuthLogin(msg) {
+  const deltaCli = whichDeltaCli();
+  if (!deltaCli) {
+    p.log.warn("delta-cli not found, skipping authorization");
+    return;
+  }
+
+  const yes = await p.confirm({
+    message: msg.step4Confirm,
+  });
+  if (p.isCancel(yes)) {
+    p.cancel(msg.cancelled);
+    process.exit(0);
+  }
+  if (!yes) {
+    p.log.info(msg.step4Skip);
+    return;
+  }
+
+  p.log.step(msg.step4);
+  try {
+    run(deltaCli, ["auth", "login"]);
+    p.log.success(msg.step4Done);
+  } catch {
+    p.log.warn(msg.step4Fail);
+  }
+}
+
+// ── Uninstall steps ─────────────────────────────────────────────────────────
+
+async function stepUninstallSkills(msg) {
+  const s = p.spinner();
+  s.start("Removing AI skills...");
+  try {
+    await runSilentAsync("npx", ["-y", "skills", "remove", "delta-sandbox", "delta-shared", "-g"], {
+      timeout: 120000,
+    });
+    s.stop("AI skills removed");
+  } catch {
+    s.stop("Warning: skill removal failed. You can retry:");
+    p.log.info("  npx skills remove delta-sandbox delta-shared -g");
+  }
+}
+
+function stepRemoveConfig() {
+  if (!fs.existsSync(CONFIG_DIR)) {
+    return;
+  }
+  fs.rmSync(CONFIG_DIR, { recursive: true, force: true });
+}
+
+async function stepUninstallPackage(msg) {
+  const installedVer = getGloballyInstalledVersion();
+  if (!installedVer) {
+    return;
+  }
+  const s = p.spinner();
+  s.start("Removing global package...");
+  try {
+    await runSilentAsync("npm", ["uninstall", "-g", PKG], { timeout: 60000 });
+    s.stop("Package removed");
+  } catch {
+    s.stop("Failed to remove global package");
+    p.log.info(`  npm uninstall -g ${PKG}`);
+  }
+}
+
+// ── Main ────────────────────────────────────────────────────────────────────
+
+async function doInstall() {
+  const isInteractive = !!process.stdin.isTTY;
+
+  if (isInteractive) {
+    p.intro(messages.zh.setup);
+    await stepInstallGlobally(messages.zh);
+    await stepInstallSkills(messages.zh);
+    await stepConfigInit(messages.zh);
+    await stepAuthLogin(messages.zh);
+    p.outro(messages.zh.done);
+  } else {
+    console.log(messages.zh.setup);
+    await stepInstallGlobally(messages.zh);
+    await stepInstallSkills(messages.zh);
+    console.log(messages.zh.nonTtyHint);
+  }
+}
+
+async function doUninstall() {
+  const isInteractive = !!process.stdin.isTTY;
+
+  if (isInteractive) {
+    const ok = await p.confirm({
+      message: "将移除全局包、AI Skills 和配置文件。是否继续？",
+    });
+    if (p.isCancel(ok) || !ok) {
+      p.cancel("卸载已取消");
+      process.exit(0);
+    }
+  }
+
+  await stepRemoveConfig();
+  await stepUninstallSkills();
+  await stepUninstallPackage();
+
+  if (isInteractive) {
+    p.outro("卸载完成");
+  } else {
+    console.log("\nUninstall complete.");
+  }
+}
+
+function main() {
+  const subcommand = process.argv[2];
+  if (subcommand === "uninstall") {
+    doUninstall().catch((e) => {
+      console.error("[delta-cli] Uninstall failed:", e.message);
+      process.exit(1);
+    });
+  } else {
+    doInstall().catch((e) => {
+      console.error("[delta-cli] Install failed:", e.message);
+      process.exit(1);
+    });
+  }
+}
+
+main();

package/scripts/install.js

@@ -1,368 +1,299 @@
-#!/usr/bin/env node
-const fs = require('fs');
-const path = require('path');
-const https = require('https');
-const crypto = require('crypto');
-const { execSync, spawn } = require('child_process');
-
-const BINARY_NAME = 'delta-cli';
-const VERSION = require('../package.json').version;
-
-const DEFAULT_ALLOWED_HOSTS = [
-  'github.com',
-  'gh-proxy.com',
-  'objects.githubusercontent.com',
-  'release-assets.githubusercontent.com',
-  'github-releases.githubusercontent.com',
-  'raw.githubusercontent.com',
-];
+// Copyright (c) 2026 Delta Infra Authors
+// SPDX-License-Identifier: MIT
+
+const fs = require("fs");
+const path = require("path");
+const { execFileSync } = require("child_process");
+const os = require("os");
+const crypto = require("crypto");
+
+const VERSION = require("../package.json").version.replace(/-.*$/, "");
+const NAME = "delta-cli";
+const REPO = "yzailab/delta-infra-cli";
+const DEFAULT_ALLOWED_HOSTS = new Set([
+  "github.com",
+  "gh-proxy.com",
+  "objects.githubusercontent.com",
+  "release-assets.githubusercontent.com",
+  "github-releases.githubusercontent.com",
+  "raw.githubusercontent.com",
+  "registry.npmmirror.com",
+]);
 const DEFAULT_ALLOWED_HOST_PREFIXES = [
-  'github-production-release-asset-',
+  "github-production-release-asset-",
 ];
-const MAX_REDIRECTS = 5;
 
-const platformMap = {
-  darwin: 'darwin',
-  linux: 'linux',
-  win32: 'windows',
+const PLATFORM_MAP = {
+  darwin: "darwin",
+  linux: "linux",
+  win32: "windows",
 };
 
-const archMap = {
-  x64: 'amd64',
-  arm64: 'arm64',
+const ARCH_MAP = {
+  x64: "amd64",
+  arm64: "arm64",
 };
 
-const RELEASE_SOURCE_BASE = 'https://github.com/yzailab/delta-infra-cli/releases/download';
-const RELEASE_DOMESTIC_BASE = 'https://gh-proxy.com/https://github.com/yzailab/delta-infra-cli/releases/download';
+const platform = PLATFORM_MAP[process.platform];
+const arch = ARCH_MAP[process.arch];
+
+const isWindows = process.platform === "win32";
+const ext = isWindows ? ".zip" : ".tar.gz";
+const archiveName = `${NAME}-${platform}-${arch}${ext}`;
+const GITHUB_URL = `https://github.com/${REPO}/releases/download/v${VERSION}/${archiveName}`;
+
+const binDir = path.join(__dirname, "..", "bin");
+const dest = path.join(binDir, NAME + (isWindows ? ".exe" : ""));
+
+// ── Mirror URL resolution ──────────────────────────────────────────────────
 
 function releaseAssetUrls(version, assetName) {
   const urls = [];
-  const mirror = process.env.DELTA_CLI_MIRROR || '';
+  const mirror = process.env.DELTA_CLI_MIRROR || "";
   if (mirror) {
-    urls.push(`${mirror.replace(/\/$/, '')}/yzailab/delta-infra-cli/releases/download/v${version}/${assetName}`);
+    urls.push(`${mirror.replace(/\/$/, "")}/yzailab/delta-infra-cli/releases/download/v${version}/${assetName}`);
   }
-  urls.push(`${RELEASE_DOMESTIC_BASE}/v${version}/${assetName}`);
-  urls.push(`${RELEASE_SOURCE_BASE}/v${version}/${assetName}`);
+  // China acceleration mirror (gh-proxy.com)
+  urls.push(`https://gh-proxy.com/https://github.com/yzailab/delta-infra-cli/releases/download/v${version}/${assetName}`);
+  // GitHub source
+  urls.push(GITHUB_URL);
   return urls;
 }
 
-function resolveUrl(base, location) {
-  if (!location) return base;
-  if (location.startsWith('http://') || location.startsWith('https://')) {
-    return location;
-  }
-  const baseUrl = new URL(base);
-  return new URL(location, baseUrl).href;
-}
-
-function loadChecksums() {
-  const checksumPath = path.join(__dirname, '..', 'checksums.txt');
-  if (!fs.existsSync(checksumPath)) {
-    return null;
-  }
-  const content = fs.readFileSync(checksumPath, 'utf8');
-  const map = new Map();
-  for (const line of content.split(/\r?\n/)) {
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith('#')) continue;
-    const idx = trimmed.indexOf('  ');
-    let hash, filename;
-    if (idx === -1) {
-      const parts = trimmed.split(/\s+/);
-      if (parts.length < 2) continue;
-      hash = parts[0];
-      filename = parts[1];
-    } else {
-      hash = trimmed.slice(0, idx);
-      filename = trimmed.slice(idx + 2);
-    }
-    map.set(filename, hash.toLowerCase());
-  }
-  return map;
-}
-
-function fileSha256(filePath) {
-  return new Promise((resolve, reject) => {
-    const hash = crypto.createHash('sha256');
-    const stream = fs.createReadStream(filePath);
-    stream.on('data', (chunk) => hash.update(chunk));
-    stream.on('end', () => resolve(hash.digest('hex')));
-    stream.on('error', reject);
-  });
-}
-
-function isAllowListedUrl(urlStr) {
-  let url;
-  try {
-    url = new URL(urlStr);
-  } catch {
-    return false;
-  }
-  if (url.protocol !== 'https:') {
-    return false;
-  }
-  const host = url.hostname.toLowerCase();
+function assertAllowedHost(url) {
+  const { hostname } = new URL(url);
   const allowlist = new Set(DEFAULT_ALLOWED_HOSTS);
-  (process.env.DELTA_CLI_MIRROR_ALLOWLIST || '')
-    .split(',')
+  (process.env.DELTA_CLI_MIRROR_ALLOWLIST || "")
+    .split(",")
     .map((h) => h.trim().toLowerCase())
     .filter(Boolean)
     .forEach((h) => allowlist.add(h));
   for (const allowed of allowlist) {
-    if (host === allowed || host.endsWith('.' + allowed)) {
-      return true;
-    }
+    if (hostname === allowed || hostname.endsWith("." + allowed)) return;
   }
   for (const prefix of DEFAULT_ALLOWED_HOST_PREFIXES) {
-    if (host.startsWith(prefix)) {
-      return true;
-    }
+    if (hostname.startsWith(prefix)) return;
   }
-  return false;
+  throw new Error(`Download host not allowed: ${hostname}`);
 }
 
-function getHttpProxy() {
-  return (
-    process.env.HTTPS_PROXY ||
-    process.env.https_proxy ||
-    process.env.HTTP_PROXY ||
-    process.env.http_proxy ||
-    ''
-  );
-}
+// ── curl version detection (for --ssl-revoke-best-effort) ──────────────────
 
-const DOWNLOAD_TIMEOUT_MS = parseInt(process.env.DELTA_CLI_DOWNLOAD_TIMEOUT, 10) || 120000;
+function isCurlVersionSupported(versionOutput) {
+  const match = String(versionOutput).match(/^\s*curl\s+(\d+)\.(\d+)\.(\d+)/i);
+  if (!match) return false;
+  const major = parseInt(match[1], 10);
+  const minor = parseInt(match[2], 10);
+  return major > 7 || (major === 7 && minor >= 70);
+}
 
-function nodeDownload(url, dest, redirectCount = 0) {
-  return new Promise((resolve, reject) => {
-    if (!isAllowListedUrl(url)) {
-      reject(new Error(`Download URL is not allow-listed: ${url}`));
-      return;
-    }
-    if (redirectCount > MAX_REDIRECTS) {
-      reject(new Error('Too many redirects while downloading'));
-      return;
-    }
+let _curlSupportsSslRevokeBestEffort;
 
-    const file = fs.createWriteStream(dest);
-    const hash = crypto.createHash('sha256');
-    let finished = false;
-    const maxTimer = setTimeout(() => {
-      cleanup(new Error(`Download did not complete within ${DOWNLOAD_TIMEOUT_MS}ms`));
-    }, DOWNLOAD_TIMEOUT_MS);
-
-    const cleanup = (err) => {
-      if (finished) return;
-      finished = true;
-      clearTimeout(maxTimer);
-      try {
-        file.destroy();
-        fs.unlinkSync(dest);
-      } catch {}
-      reject(err);
-    };
-
-    https
-      .get(url, { timeout: 60000 }, (response) => {
-        if (response.statusCode >= 301 && response.statusCode <= 308 && response.headers.location) {
-          const nextUrl = resolveUrl(url, response.headers.location);
-          if (!isAllowListedUrl(nextUrl)) {
-            cleanup(new Error(`Redirect URL is not allow-listed: ${nextUrl}`));
-            return;
-          }
-          file.destroy();
-          try {
-            fs.unlinkSync(dest);
-          } catch {}
-          nodeDownload(nextUrl, dest, redirectCount + 1).then(resolve).catch(reject);
-          return;
-        }
-        if (response.statusCode !== 200) {
-          cleanup(new Error(`Download failed: HTTP ${response.statusCode}`));
-          return;
-        }
-        response.pipe(file);
-        response.on('data', (chunk) => hash.update(chunk));
-        file.on('finish', () => {
-          file.close((err) => {
-            if (finished) return;
-            if (err) {
-              cleanup(err);
-              return;
-            }
-            finished = true;
-            clearTimeout(maxTimer);
-            resolve(hash.digest('hex'));
-          });
-        });
-        file.on('error', cleanup);
-      })
-      .on('error', cleanup)
-      .on('timeout', () => {
-        cleanup(new Error('Download timed out'));
-      });
-  });
+function curlSupportsSslRevokeBestEffort() {
+  if (_curlSupportsSslRevokeBestEffort !== undefined) {
+    return _curlSupportsSslRevokeBestEffort;
+  }
+  try {
+    const output = execFileSync("curl", ["--version"], {
+      stdio: ["ignore", "pipe", "ignore"],
+      encoding: "utf8",
+      timeout: 5000,
+    });
+    _curlSupportsSslRevokeBestEffort = isCurlVersionSupported(output);
+  } catch {
+    _curlSupportsSslRevokeBestEffort = false;
+  }
+  return _curlSupportsSslRevokeBestEffort;
 }
 
-function curlDownload(url, dest, proxy) {
-  return new Promise((resolve, reject) => {
-    const maxSeconds = Math.ceil(DOWNLOAD_TIMEOUT_MS / 1000);
-    const args = ['-L', '--fail', '--show-error', '--silent', '--max-time', String(maxSeconds), '-o', dest];
-    if (proxy) {
-      args.push('--proxy', proxy);
-    }
-    args.push(url);
-    const child = spawn('curl', args, { stdio: ['ignore', 'inherit', 'inherit'] });
-    child.on('error', (err) => {
-      reject(new Error(`curl not available or failed to start: ${err.message}`));
-    });
-    child.on('close', (code) => {
-      if (code !== 0) {
-        reject(new Error(`curl download failed (exit ${code})`));
-        return;
-      }
-      fileSha256(dest).then(resolve).catch(reject);
-    });
-  });
+// ── Download ───────────────────────────────────────────────────────────────
+
+function download(url, destPath) {
+  assertAllowedHost(url);
+  const args = [
+    "--fail", "--location", "--silent", "--show-error",
+    "--connect-timeout", "10", "--max-time", "120",
+    "--max-redirs", "3",
+    "--output", destPath,
+  ];
+  if (isWindows && curlSupportsSslRevokeBestEffort()) {
+    args.unshift("--ssl-revoke-best-effort");
+  }
+  args.push(url);
+  execFileSync("curl", args, { stdio: ["ignore", "ignore", "pipe"] });
 }
 
-async function download(url, dest) {
-  const proxy = getHttpProxy();
-  const preferCurl =
-    process.env.DELTA_CLI_USE_CURL === '1' || (!!proxy && process.env.DELTA_CLI_USE_CURL !== '0');
+// ── Extraction ─────────────────────────────────────────────────────────────
 
-  if (preferCurl) {
+function extractZipWindows(archivePath, destDir) {
+  const psOpts = ["-NoProfile", "-ExecutionPolicy", "Bypass", "-Command"];
+  const psEnv = {
+    DELTA_CLI_ARCHIVE: archivePath,
+    DELTA_CLI_DEST: destDir,
+  };
+  try {
+    const dotnet =
+      "$ErrorActionPreference='Stop';" +
+      "Add-Type -AssemblyName System.IO.Compression.FileSystem;" +
+      "[System.IO.Compression.ZipFile]::ExtractToDirectory($env:DELTA_CLI_ARCHIVE,$env:DELTA_CLI_DEST)";
+    execFileSync("powershell.exe", [...psOpts, dotnet], { stdio: ["ignore", "inherit", "inherit"], env: psEnv });
+  } catch (primaryErr) {
     try {
-      return await curlDownload(url, dest, proxy);
-    } catch (err) {
-      if (process.env.DELTA_CLI_USE_CURL === '1') {
-        throw err;
+      const cmdlet =
+        "$ErrorActionPreference='Stop';" +
+        "Expand-Archive -LiteralPath $env:DELTA_CLI_ARCHIVE -DestinationPath $env:DELTA_CLI_DEST -Force";
+      execFileSync("powershell.exe", [...psOpts, cmdlet], { stdio: ["ignore", "inherit", "inherit"], env: psEnv });
+    } catch (secondErr) {
+      try {
+        execFileSync("tar", ["-xf", archivePath, "-C", destDir], { stdio: "ignore" });
+      } catch (fallbackErr) {
+        throw new Error(
+          `Failed to extract ${archivePath}. ` +
+          `.NET ZipFile: ${primaryErr.message}. ` +
+          `Expand-Archive: ${secondErr.message}. ` +
+          `tar: ${fallbackErr.message}`
+        );
       }
-      console.warn(`[delta-cli] curl download failed (${err.message}), falling back to Node https.`);
     }
   }
-
-  return nodeDownload(url, dest);
 }
 
-function verifyAsset(assetName, filePath, checksums) {
-  if (!checksums) {
-    console.warn('[delta-cli] checksums.txt not found; skipping checksum verification.');
-    return;
-  }
-  const expected = checksums.get(assetName);
-  if (!expected) {
-    throw new Error(`No checksum found for ${assetName} in checksums.txt`);
+// ── Checksum ───────────────────────────────────────────────────────────────
+
+function getExpectedChecksum(archiveName, checksumsDir) {
+  const dir = checksumsDir || path.join(__dirname, "..");
+  const checksumsPath = path.join(dir, "checksums.txt");
+  if (!fs.existsSync(checksumsPath)) {
+    console.error("[WARN] checksums.txt not found, skipping checksum verification");
+    return null;
   }
-  const actual = crypto.createHash('sha256').update(fs.readFileSync(filePath)).digest('hex');
-  if (actual !== expected) {
-    throw new Error(`Checksum mismatch for ${assetName}: expected ${expected}, got ${actual}`);
+  const content = fs.readFileSync(checksumsPath, "utf8");
+  for (const line of content.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    const idx = trimmed.indexOf("  ");
+    if (idx === -1) continue;
+    const hash = trimmed.slice(0, idx);
+    const name = trimmed.slice(idx + 2);
+    if (name === archiveName) return hash;
   }
-  console.log(`[delta-cli] Checksum OK for ${assetName}.`);
+  throw new Error(`Checksum entry not found for ${archiveName}`);
 }
 
-function extract(archivePath, destDir, platform) {
-  fs.mkdirSync(destDir, { recursive: true });
-  if (platform === 'windows') {
-    const escapedArchive = archivePath.replace(/'/g, "''");
-    const escapedDest = destDir.replace(/'/g, "''");
-    execSync(
-      `powershell.exe -NoProfile -Command "Expand-Archive -Path '${escapedArchive}' -DestinationPath '${escapedDest}' -Force"`,
-      { stdio: 'inherit' }
+function verifyChecksum(archivePath, expectedHash) {
+  if (expectedHash === null) return;
+  const hash = crypto.createHash("sha256");
+  const fd = fs.openSync(archivePath, "r");
+  try {
+    const buf = Buffer.alloc(64 * 1024);
+    let bytesRead;
+    while ((bytesRead = fs.readSync(fd, buf, 0, buf.length, null)) > 0) {
+      hash.update(buf.subarray(0, bytesRead));
+    }
+  } finally {
+    fs.closeSync(fd);
+  }
+  const actual = hash.digest("hex");
+  if (actual.toLowerCase() !== expectedHash.toLowerCase()) {
+    throw new Error(
+      `[SECURITY] Checksum mismatch for ${path.basename(archivePath)}: expected ${expectedHash} but got ${actual}`
     );
-  } else {
-    execSync(`tar -xzf "${archivePath}" -C "${destDir}"`, { stdio: 'inherit' });
   }
 }
 
-async function install(options = {}) {
-  const fatal = options.fatal === true;
-  const allowSkip = options.allowSkip !== false;
+// ── Main install ───────────────────────────────────────────────────────────
 
-  if (allowSkip && (process.env.CI === 'true' || process.env.CI === '1' || process.env.DELTA_CLI_SKIP_POSTINSTALL)) {
-    console.log('[delta-cli] postinstall skipped (CI or DELTA_CLI_SKIP_POSTINSTALL).');
-    return;
-  }
-
-  const platform = platformMap[process.platform];
-  const arch = archMap[process.arch];
-  if (!platform || !arch) {
-    throw new Error(`Unsupported platform: ${process.platform} ${process.arch}`);
-  }
-
-  const isWin = platform === 'windows';
-  const archiveExt = isWin ? '.zip' : '.tar.gz';
-  const binaryExt = isWin ? '.exe' : '';
-  const assetName = `${BINARY_NAME}-${platform}-${arch}${archiveExt}`;
-  const binDir = path.join(__dirname, '..', 'bin');
-  const archivePath = path.join(binDir, assetName);
-  const binaryPath = path.join(binDir, `${BINARY_NAME}${binaryExt}`);
+function install() {
+  const downloadUrls = releaseAssetUrls(VERSION, archiveName);
 
   fs.mkdirSync(binDir, { recursive: true });
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "delta-cli-"));
+  const archivePath = path.join(tmpDir, archiveName);
 
-  const localArchive = process.env.DELTA_CLI_ARCHIVE;
-  if (localArchive) {
-    if (!fs.existsSync(localArchive)) {
-      throw new Error(`DELTA_CLI_ARCHIVE file not found: ${localArchive}`);
-    }
-    fs.copyFileSync(localArchive, archivePath);
-  } else {
-    const urls = releaseAssetUrls(VERSION, assetName);
+  try {
     let lastErr;
-    let checksum;
-    for (const url of urls) {
-      console.log(`[delta-cli] Downloading ${assetName} from ${new URL(url).hostname}...`);
+    let downloaded = false;
+    for (const url of downloadUrls) {
       try {
-        checksum = await download(url, archivePath);
+        download(url, archivePath);
+        downloaded = true;
         break;
-      } catch (err) {
-        console.warn(`[delta-cli] Download failed from ${url}: ${err.message}`);
-        lastErr = err;
+      } catch (e) {
+        lastErr = e;
       }
     }
-    if (checksum === undefined) {
-      throw lastErr || new Error('All download sources failed');
-    }
-  }
+    if (!downloaded) throw lastErr;
 
-  const checksums = loadChecksums();
-  verifyAsset(assetName, archivePath, checksums);
+    const expectedHash = getExpectedChecksum(archiveName);
+    verifyChecksum(archivePath, expectedHash);
 
-  console.log(`[delta-cli] Extracting to ${binDir}...`);
-  extract(archivePath, binDir, platform);
-  fs.unlinkSync(archivePath);
+    if (isWindows) {
+      extractZipWindows(archivePath, tmpDir);
+    } else {
+      execFileSync("tar", ["-xzf", archivePath, "-C", tmpDir], { stdio: "ignore" });
+    }
 
-  const extractedBinary = path.join(binDir, `${BINARY_NAME}-${platform}-${arch}${binaryExt}`);
-  if (fs.existsSync(extractedBinary) && extractedBinary !== binaryPath) {
-    fs.renameSync(extractedBinary, binaryPath);
+    const binaryName = NAME + (isWindows ? ".exe" : "");
+    const extractedBinary = path.join(tmpDir, `${NAME}-${platform}-${arch}`);
+    if (fs.existsSync(extractedBinary)) {
+      fs.copyFileSync(extractedBinary, dest);
+    } else {
+      // Fallback: try the plain name (older release format)
+      const plainBinary = path.join(tmpDir, binaryName);
+      if (fs.existsSync(plainBinary)) {
+        fs.copyFileSync(plainBinary, dest);
+      } else {
+        // Search in tmpDir
+        const files = fs.readdirSync(tmpDir).filter(f => f.includes(NAME) || f.includes(binaryName));
+        if (files.length > 0) {
+          fs.copyFileSync(path.join(tmpDir, files[0]), dest);
+        } else {
+          throw new Error(`Binary not found in extracted archive. Files: ${fs.readdirSync(tmpDir).join(", ")}`);
+        }
+      }
+    }
+    fs.chmodSync(dest, 0o755);
+  } finally {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
   }
+}
 
-  if (!fs.existsSync(binaryPath)) {
-    throw new Error(`Binary not found after extraction: ${binaryPath}`);
-  }
+// ── Entry ──────────────────────────────────────────────────────────────────
 
-  if (platform !== 'windows') {
-    fs.chmodSync(binaryPath, 0o755);
+if (require.main === module) {
+  if (!platform || !arch) {
+    console.error(`Unsupported platform: ${process.platform}-${process.arch}`);
+    process.exit(1);
   }
 
-  console.log(`[delta-cli] Installed at ${binaryPath}.`);
-}
+  // npx postinstall guard: skip binary download in ephemeral npx context
+  const isNpxPostinstall =
+    process.env.npm_command === "exec" && !process.env.DELTA_CLI_RUN;
 
-function handleError(err) {
-  const fatal = process.env.DELTA_CLI_FATAL_ON_ERROR === '1';
-  const message = err && err.message ? err.message : String(err);
-  if (fatal) {
-    console.error('[delta-cli] install failed:', message);
-    process.exit(1);
+  if (isNpxPostinstall) {
+    process.exit(0);
   }
-  console.error('[delta-cli] postinstall warning:', message);
-  console.error('The wrapper is installed, but the native binary may be missing.');
-  console.error('Run "delta-cli" once to retry, or set DELTA_CLI_ARCHIVE to a local archive path.');
-  process.exit(0);
-}
 
-if (require.main === module) {
-  install({ allowSkip: true }).catch(handleError);
+  try {
+    install();
+    console.log(`${NAME} v${VERSION} installed successfully`);
+  } catch (err) {
+    console.error(`Failed to install ${NAME}:`, err.message);
+    console.error(
+      `\nIf you are behind a firewall or in a restricted network, try one of:\n` +
+      `  # 1. Use a proxy:\n` +
+      `  export https_proxy=http://your-proxy:port\n` +
+      `  npm install -g @delta-infra/cli\n\n` +
+      `  # 2. Point to a corporate npm mirror:\n` +
+      `  npm install -g @delta-infra/cli --registry=https://your-corp-mirror/\n` +
+      `\nOr manually download from:\n` +
+      `  https://github.com/${REPO}/releases/tag/v${VERSION}`
+    );
+    process.exit(1);
+  }
 }
 
-module.exports = { install };
+module.exports = {
+  getExpectedChecksum, verifyChecksum, assertAllowedHost,
+  isCurlVersionSupported, curlSupportsSslRevokeBestEffort,
+};

package/scripts/run.js

@@ -1,60 +1,65 @@
 #!/usr/bin/env node
-const fs = require('fs');
-const path = require('path');
-const { spawn } = require('child_process');
-const { install } = require('./install');
+// Copyright (c) 2026 Delta Infra Authors
+// SPDX-License-Identifier: MIT
 
-const binary = path.join(
-  __dirname,
-  '..',
-  'bin',
-  process.platform === 'win32' ? 'delta-cli.exe' : 'delta-cli'
-);
+const { execFileSync } = require("child_process");
+const fs = require("fs");
+const path = require("path");
 
-async function ensureBinary() {
-  if (fs.existsSync(binary)) {
-    return;
-  }
-  console.error('[delta-cli] Binary not found, attempting to install...');
-  await install({ allowSkip: false, fatal: true });
-  if (!fs.existsSync(binary)) {
-    throw new Error('Binary is still missing after install attempt.');
-  }
-}
+const ext = process.platform === "win32" ? ".exe" : "";
+const bin = path.join(__dirname, "..", "bin", "delta-cli" + ext);
 
-async function main() {
+// On Windows, a crashed self-update may have left the binary renamed to .old.
+const oldBin = bin + ".old";
+function restoreOldBinary() {
   try {
-    await ensureBinary();
-  } catch (err) {
-    console.error('[delta-cli] Could not install binary:', err.message);
-    console.error('Set DELTA_CLI_ARCHIVE to a local archive path, or reinstall the package.');
-    process.exit(1);
-  }
+    if (fs.existsSync(bin)) {
+      fs.rmSync(bin, { force: true });
+    }
+    fs.renameSync(oldBin, bin);
+    return true;
+  } catch { return false; }
+}
 
-  const child = spawn(binary, process.argv.slice(2), {
-    stdio: 'inherit',
-    windowsHide: true,
-  });
+if (process.platform === "win32" && fs.existsSync(oldBin)) {
+  if (!fs.existsSync(bin)) {
+    restoreOldBinary();
+  } else {
+    try {
+      execFileSync(bin, ["--version"], { stdio: "ignore", timeout: 10000 });
+      try { fs.rmSync(oldBin, { force: true }); } catch {}
+    } catch {
+      restoreOldBinary();
+    }
+  }
+}
 
-  child.on('error', (err) => {
-    console.error('[delta-cli] Failed to start:', err.message);
-    process.exit(1);
-  });
+const args = process.argv.slice(2);
 
-  child.on('close', (code, signal) => {
-    if (code !== null && code !== undefined) {
-      process.exit(code);
-    }
-    if (signal) {
-      try {
-        process.kill(process.pid, signal);
-      } catch {
-        process.exit(1);
-      }
-    } else {
+// Intercept install/uninstall — run wizard, bypass native binary
+if (args[0] === "install" || args[0] === "uninstall") {
+  require("./install-wizard.js");
+} else {
+  // Auto-download binary if missing (e.g. npx skipped postinstall)
+  if (!fs.existsSync(bin)) {
+    try {
+      execFileSync(process.execPath, [path.join(__dirname, "install.js")], {
+        stdio: "inherit",
+        env: { ...process.env, DELTA_CLI_RUN: "true" },
+      });
+    } catch {
+      console.error(
+        `\nFailed to auto-install delta-cli binary.\n` +
+        `To fix, run the install script manually:\n` +
+        `  node "${path.join(__dirname, "install.js")}"\n`
+      );
       process.exit(1);
     }
-  });
-}
+  }
 
-main();
+  try {
+    execFileSync(bin, args, { stdio: "inherit" });
+  } catch (e) {
+    process.exit(e.status || 1);
+  }
+}