@dreamdata_io/verify-tracking 0.1.0

package/scripts/install.sh

@@ -0,0 +1,314 @@
+#!/bin/sh
+#
+# One-command install for verify-tracking, for a machine with nothing on it.
+#
+#   curl -fsSL https://unpkg.com/@dreamdata_io/verify-tracking/scripts/install.sh | sh
+#
+# The npm package is the same artifact either way; this script exists because
+# the people who need the tool most — CS, not engineers — have no Node, no npm,
+# no Chromium and no Claude Code CLI, and "install Node first" is where a
+# handover stops. So everything the run needs is fetched here, into one
+# directory that `rm -rf` undoes, without sudo and without touching a
+# system-wide npm prefix.
+#
+# The one step that cannot be automated is the Claude sign-in: it is an OAuth
+# flow through a browser, and no script can hold someone's credentials for
+# them. It is *driven* from here instead — the installer checks the auth state
+# and hands over to `claude auth login` on the terminal, so the operator
+# finishes in the same sitting rather than discovering the requirement on a
+# failed first run.
+set -eu
+
+PKG="@dreamdata_io/verify-tracking"
+PKG_VERSION="${VERIFY_TRACKING_VERSION:-latest}"
+# Whatever npm should install to get the package. Overridable so a release
+# candidate can be installed from a local tarball — the one-liner itself can
+# only ever test what is already on the registry, which is the previous
+# release.
+PKG_SPEC="${VERIFY_TRACKING_PKG_SPEC:-$PKG@$PKG_VERSION}"
+CLAUDE_PKG="@anthropic-ai/claude-code"
+
+# Pinned rather than "latest LTS": an installer that silently changes runtime
+# between two colleagues' machines makes a bug report unreproducible.
+NODE_VERSION="${VERIFY_TRACKING_NODE_VERSION:-v24.21.0}"
+NODE_DIST="${VERIFY_TRACKING_NODE_DIST:-https://nodejs.org/dist}"
+
+# Everything this installer writes lives under these two paths, and nothing
+# else does. PREFIX holds the runtime, the packages and the browser; BIN_DIR
+# gets the two shims that are the whole user-facing surface.
+PREFIX="${VERIFY_TRACKING_PREFIX:-$HOME/.local/share/verify-tracking}"
+BIN_DIR="${VERIFY_TRACKING_BIN_DIR:-$HOME/.local/bin}"
+
+# Kept out of the shared ~/.cache/ms-playwright on purpose: the browser this
+# installer downloaded is then provably the browser the run launches, and an
+# uninstall takes its 150MB with it instead of orphaning them.
+BROWSERS_DIR="$PREFIX/browsers"
+
+say()  { printf '  %s\n' "$1"; }
+step() { printf '\n==> %s\n' "$1"; }
+die()  { printf '\nverify-tracking install failed: %s\n\n' "$1" >&2; exit 1; }
+
+# ---------------------------------------------------------------------------
+# Platform
+# ---------------------------------------------------------------------------
+
+os="$(uname -s)"
+arch="$(uname -m)"
+case "$os" in
+  Darwin) node_os="darwin" ;;
+  Linux)  node_os="linux" ;;
+  *) die "unsupported OS: $os. macOS and Linux only — on Windows, install Node 20+ and run: npx -y $PKG@latest" ;;
+esac
+case "$arch" in
+  arm64|aarch64) node_arch="arm64" ;;
+  x86_64|amd64)  node_arch="x64" ;;
+  *) die "unsupported CPU: $arch." ;;
+esac
+
+command -v curl >/dev/null 2>&1 || die "curl is required."
+command -v tar  >/dev/null 2>&1 || die "tar is required."
+
+printf 'Installing verify-tracking (%s/%s)\n' "$node_os" "$node_arch"
+say "runtime, packages and browser -> $PREFIX"
+say "commands                      -> $BIN_DIR"
+
+# ---------------------------------------------------------------------------
+# 1. A Node the tool can run on
+# ---------------------------------------------------------------------------
+
+# Reused rather than replaced when the host already has a new enough one: a
+# second Node in someone's home directory is 60MB and a support question, and
+# the package is plain compiled JS that does not care whose Node runs it.
+host_node_is_usable() {
+  command -v node >/dev/null 2>&1 || return 1
+  command -v npm  >/dev/null 2>&1 || return 1
+  major="$(node -p 'process.versions.node.split(".")[0]' 2>/dev/null || echo 0)"
+  [ "$major" -ge 20 ] 2>/dev/null
+}
+
+sha256_of() {
+  if command -v shasum >/dev/null 2>&1; then shasum -a 256 "$1" | awk '{print $1}'
+  elif command -v sha256sum >/dev/null 2>&1; then sha256sum "$1" | awk '{print $1}'
+  else die "need shasum or sha256sum to verify the Node download."
+  fi
+}
+
+install_node() {
+  name="node-$NODE_VERSION-$node_os-$node_arch"
+  url="$NODE_DIST/$NODE_VERSION/$name.tar.gz"
+  tmp="$(mktemp -d)"
+  # A failed or interrupted download never leaves a half-unpacked runtime
+  # where a working one is expected.
+  trap 'rm -rf "$tmp"' EXIT
+
+  say "downloading $NODE_VERSION (~60MB)"
+  curl -fsSL --retry 3 -o "$tmp/$name.tar.gz" "$url" || die "could not download $url"
+
+  # nodejs.org publishes checksums for exactly this reason; bytes that arrive
+  # over a hijacked or truncated transfer are not unpacked and executed.
+  say "verifying checksum"
+  curl -fsSL --retry 3 -o "$tmp/SHASUMS256.txt" "$NODE_DIST/$NODE_VERSION/SHASUMS256.txt" \
+    || die "could not download the Node checksums. Refusing to install unverified bytes."
+  expected="$(awk -v f="$name.tar.gz" '$2 == f || $2 == "./"f {print $1}' "$tmp/SHASUMS256.txt")"
+  [ -n "$expected" ] || die "no published checksum for $name.tar.gz."
+  actual="$(sha256_of "$tmp/$name.tar.gz")"
+  [ "$expected" = "$actual" ] || die "checksum mismatch for $name.tar.gz. Not installing."
+
+  say "unpacking"
+  rm -rf "$PREFIX/node"
+  mkdir -p "$PREFIX/node"
+  tar -xzf "$tmp/$name.tar.gz" -C "$PREFIX/node" --strip-components=1 \
+    || die "could not unpack $name.tar.gz"
+
+  rm -rf "$tmp"
+  trap - EXIT
+}
+
+step "Node runtime"
+if host_node_is_usable; then
+  say "using the Node already installed ($(node -v))"
+  NODE="$(command -v node)"
+  NPM="$(command -v npm)"
+elif [ -x "$PREFIX/node/bin/node" ]; then
+  say "using the Node this installer downloaded earlier ($("$PREFIX/node/bin/node" -v))"
+  NODE="$PREFIX/node/bin/node"
+  NPM="$PREFIX/node/bin/npm"
+else
+  say "no Node 20+ on this machine — fetching a private one"
+  install_node
+  NODE="$PREFIX/node/bin/node"
+  NPM="$PREFIX/node/bin/npm"
+fi
+
+# npm from an unpacked tarball is a script that wants `node` on the PATH, and
+# on a machine with no system Node there is none. Every npm call below runs
+# through this.
+run_npm() {
+  PATH="$PREFIX/node/bin:$PATH" "$NPM" "$@"
+}
+
+# ---------------------------------------------------------------------------
+# 2. The tool, and the Claude Code CLI it asks for its answers
+# ---------------------------------------------------------------------------
+
+# --prefix keeps both out of any global npm root: no sudo, no fighting a
+# system-managed node_modules, and an uninstall that is one rm -rf.
+step "verify-tracking $PKG_VERSION"
+mkdir -p "$PREFIX/lib"
+run_npm install --prefix "$PREFIX/lib" --no-audit --no-fund --loglevel=error "$PKG_SPEC" \
+  || die "npm could not install $PKG_SPEC"
+
+PKG_ROOT="$PREFIX/lib/node_modules/$PKG"
+[ -f "$PKG_ROOT/dist/cli.js" ] || die "the installed package has no dist/cli.js — expected at $PKG_ROOT"
+
+step "Claude Code CLI"
+if command -v claude >/dev/null 2>&1; then
+  say "using the claude already on your PATH"
+  CLAUDE="$(command -v claude)"
+else
+  say "installing $CLAUDE_PKG"
+  run_npm install --prefix "$PREFIX/lib" --no-audit --no-fund --loglevel=error "$CLAUDE_PKG" \
+    || die "npm could not install $CLAUDE_PKG"
+  CLAUDE="$PREFIX/lib/node_modules/.bin/claude"
+  [ -x "$CLAUDE" ] || die "expected a claude executable at $CLAUDE"
+fi
+
+# ---------------------------------------------------------------------------
+# 3. A browser to drive
+# ---------------------------------------------------------------------------
+
+# The collector launches an installed Google Chrome first and only falls back
+# to Playwright's own Chromium, so a machine with Chrome needs none of this.
+# Mirrors src/config/preflight.ts — if that list grows, this one should too.
+has_chrome() {
+  for p in \
+    "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" \
+    "/opt/google/chrome/chrome" \
+    "/usr/bin/google-chrome" \
+    "/usr/bin/google-chrome-stable"
+  do
+    if [ -x "$p" ]; then return 0; fi
+  done
+  return 1
+}
+
+step "Browser"
+if has_chrome && [ "${VERIFY_TRACKING_FORCE_CHROMIUM:-0}" != "1" ]; then
+  say "Google Chrome is installed — nothing to download"
+  say "(set VERIFY_TRACKING_FORCE_CHROMIUM=1 to fetch Playwright's Chromium anyway)"
+else
+  say "downloading Chromium (~150MB, once)"
+  # The package's own Playwright, so the browser revision matches the client
+  # that will drive it. A mismatched pair fails at launch, not at install.
+  PLAYWRIGHT_BROWSERS_PATH="$BROWSERS_DIR" PATH="$PREFIX/node/bin:$PATH" \
+    "$NODE" "$PREFIX/lib/node_modules/playwright/cli.js" install chromium \
+    || die "could not download Chromium. Install Google Chrome instead (https://www.google.com/chrome/) and re-run this installer."
+fi
+
+# ---------------------------------------------------------------------------
+# 4. Shims
+# ---------------------------------------------------------------------------
+
+# A shim rather than a symlink, because the run needs an environment: its own
+# Node, `claude` findable on the PATH (local-cli.ts spawns it by name), and the
+# browser directory this installer actually filled.
+write_shim() {
+  shim="$BIN_DIR/$1"
+  entry="$2"
+  cat > "$shim" <<SHIM
+#!/bin/sh
+# Generated by the verify-tracking installer. Re-run the installer to update;
+# edits here are overwritten.
+PREFIX="$PREFIX"
+export PATH="\$PREFIX/node/bin:\$PREFIX/lib/node_modules/.bin:\$PATH"
+export PLAYWRIGHT_BROWSERS_PATH="\${PLAYWRIGHT_BROWSERS_PATH:-$BROWSERS_DIR}"
+
+# The Node this was installed against, with a fallback: a version manager can
+# retire the exact path under us, and any Node 20+ runs this package fine.
+NODE="$NODE"
+if [ ! -x "\$NODE" ]; then
+  NODE="\$(command -v node 2>/dev/null || true)"
+fi
+if [ ! -x "\$NODE" ]; then
+  printf 'verify-tracking: no Node runtime found. Re-run the installer:\\n' >&2
+  printf '  curl -fsSL https://unpkg.com/%s/scripts/install.sh | sh\\n' "$PKG" >&2
+  exit 1
+fi
+
+exec "\$NODE" "\$PREFIX/lib/node_modules/$PKG/$entry" "\$@"
+SHIM
+  chmod +x "$shim"
+  say "$shim"
+}
+
+step "Commands"
+mkdir -p "$BIN_DIR"
+write_shim "verify-tracking" "dist/cli.js"
+write_shim "verify-tracking-mcp" "dist/mcp/server.js"
+
+# ---------------------------------------------------------------------------
+# 5. Sign in to Claude — the one step a human has to finish
+# ---------------------------------------------------------------------------
+
+# `curl … | sh` leaves this script's own text on stdin, so a child that prompts
+# would read the rest of the installer as if it were typed. /dev/tty is the
+# operator's actual terminal, and reading from it is what makes an interactive
+# login possible from inside a piped installer.
+claude_is_logged_in() {
+  PATH="$PREFIX/node/bin:$PATH" "$CLAUDE" auth status --json 2>/dev/null \
+    | grep -q '"loggedIn"[[:space:]]*:[[:space:]]*true'
+}
+
+login_instructions() {
+  printf '\n'
+  say "Finish by signing in to Claude, then you are done:"
+  printf '\n'
+  printf '    %s auth login\n' "$CLAUDE"
+  printf '\n'
+}
+
+step "Claude sign-in"
+if claude_is_logged_in; then
+  say "already signed in"
+elif [ ! -r /dev/tty ]; then
+  # Non-interactive: CI, a provisioning script, a shell with no terminal. The
+  # tool is fully installed and one command short of working, so that command
+  # is printed rather than a login attempted against nothing.
+  say "no terminal available, so the sign-in cannot run here."
+  login_instructions
+else
+  say "opening the Claude sign-in — a browser window will ask you to log in."
+  say "This happens once on this machine."
+  printf '\n'
+  # `|| true` so a cancelled or failed login leaves a fully installed tool and
+  # a printed next step, not a failed install someone has to start over.
+  if PATH="$PREFIX/node/bin:$PATH" "$CLAUDE" auth login < /dev/tty > /dev/tty 2>&1; then
+    if claude_is_logged_in; then
+      say "signed in."
+    else
+      say "the sign-in did not complete."
+      login_instructions
+    fi
+  else
+    say "the sign-in was cancelled or failed."
+    login_instructions
+  fi
+fi
+
+# ---------------------------------------------------------------------------
+# Done
+# ---------------------------------------------------------------------------
+
+printf '\n==> Installed\n'
+"$BIN_DIR/verify-tracking" --version 2>/dev/null | sed 's/^/  /' || true
+
+case ":${PATH}:" in
+  *":$BIN_DIR:"*) ;;
+  *)
+    printf '\n  %s is not on your PATH. Add it, then reopen your terminal:\n\n' "$BIN_DIR"
+    printf "    echo 'export PATH=\"%s:\$PATH\"' >> ~/.zshrc\n" "$BIN_DIR"
+    ;;
+esac
+
+printf '\n  Try it:\n\n    verify-tracking --url https://example.com --quick --no-save-report\n'
+printf '\n  Uninstall:\n\n    rm -rf %s %s/verify-tracking %s/verify-tracking-mcp\n\n' "$PREFIX" "$BIN_DIR" "$BIN_DIR"