@inflexa-ai/inflexa 0.1.0

package/README.md

@@ -0,0 +1,13 @@
+# Inflexa
+
+Local-first AI agent for reproducible biological data analysis.
+
+```bash
+npm install -g @inflexa-ai/inflexa
+inflexa
+```
+
+This package delivers a self-contained native binary through a
+platform-specific optional dependency; Node.js only hosts the thin
+launcher. Docs, source, and other install channels (Homebrew, install
+scripts): https://github.com/inflexa-ai/inflexa

package/bin/inflexa.js

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+"use strict";
+// The @inflexa-ai/inflexa `bin`: resolves and executes the platform-native
+// binary delivered by one of the @inflexa-ai/inflexa-<platform>-<arch>
+// optionalDependencies, falling back to the copy postinstall.js downloaded
+// when optional dependencies were skipped. The `bin` stays a Node script —
+// pointing it at the raw executable breaks the shims npm/pnpm/bun generate
+// on Windows.
+const { spawnSync } = require("node:child_process");
+const fs = require("node:fs");
+const path = require("node:path");
+
+function resolveBinary() {
+  if (process.env.INFLEXA_BIN_PATH) return process.env.INFLEXA_BIN_PATH;
+  const binName = process.platform === "win32" ? "inflexa.exe" : "inflexa";
+  // TODO(extend): pick a -musl platform package on musl libc once those
+  // binaries ship (inflexa-ai/inflexa#107).
+  const pkg = `@inflexa-ai/inflexa-${process.platform}-${process.arch}`;
+  try {
+    const pkgJson = require.resolve(`${pkg}/package.json`);
+    return path.join(path.dirname(pkgJson), "bin", binName);
+  } catch {
+    const fallback = path.join(__dirname, "..", "bin-fallback", binName);
+    if (fs.existsSync(fallback)) return fallback;
+    return null;
+  }
+}
+
+const bin = resolveBinary();
+if (!bin) {
+  console.error(
+    [
+      `inflexa: no binary available for ${process.platform}-${process.arch}.`,
+      "The platform package (an optionalDependency) was not installed, and the",
+      "postinstall fallback did not deliver a binary either. Reinstall without",
+      "--no-optional/--omit=optional/--ignore-scripts, or install the platform",
+      `package directly: npm install @inflexa-ai/inflexa-${process.platform}-${process.arch}`,
+    ].join("\n"),
+  );
+  process.exit(1);
+}
+
+const result = spawnSync(bin, process.argv.slice(2), { stdio: "inherit" });
+if (result.error) {
+  console.error(`inflexa: failed to start ${bin}: ${result.error.message}`);
+  process.exit(1);
+}
+process.exit(typeof result.status === "number" ? result.status : 0);

package/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "@inflexa-ai/inflexa",
+  "version": "0.1.0",
+  "description": "Local-first AI agent for reproducible biological data analysis",
+  "license": "Apache-2.0",
+  "homepage": "https://github.com/inflexa-ai/inflexa",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/inflexa-ai/inflexa.git"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  },
+  "bin": {
+    "inflexa": "bin/inflexa.js"
+  },
+  "files": [
+    "bin",
+    "postinstall.js"
+  ],
+  "scripts": {
+    "postinstall": "node postinstall.js"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "optionalDependencies": {
+    "@inflexa-ai/inflexa-darwin-arm64": "0.1.0",
+    "@inflexa-ai/inflexa-darwin-x64": "0.1.0",
+    "@inflexa-ai/inflexa-linux-x64": "0.1.0",
+    "@inflexa-ai/inflexa-win32-x64": "0.1.0"
+  }
+}

package/postinstall.js

@@ -0,0 +1,82 @@
+"use strict";
+// Fallback binary delivery for installs that skipped optionalDependencies
+// (--no-optional/--omit=optional, or a node_modules/lockfile carried across
+// operating systems): downloads this exact version's binary from the GitHub
+// release and verifies it against the release's SHA256SUMS — the file the
+// release workflow generated and attested — before placing it in
+// bin-fallback/ for the launcher.
+//
+// Failures warn and exit 0 instead of failing the whole `npm install`: a
+// missing binary is only fatal when inflexa is actually invoked (the
+// launcher prints recovery steps), while a hard postinstall failure would
+// block installing any dependency tree that merely includes inflexa —
+// e.g. on a platform we don't build for at all.
+const { createHash } = require("node:crypto");
+const fs = require("node:fs");
+const path = require("node:path");
+
+const REPO = "inflexa-ai/inflexa";
+
+// npm platform key -> release asset name (npm says win32 where the release
+// assets say windows).
+const ASSETS = {
+  "darwin-arm64": "inflexa-darwin-arm64",
+  "darwin-x64": "inflexa-darwin-x64",
+  "linux-x64": "inflexa-linux-x64",
+  "win32-x64": "inflexa-windows-x64.exe",
+};
+
+async function main() {
+  const key = `${process.platform}-${process.arch}`;
+  const binName = process.platform === "win32" ? "inflexa.exe" : "inflexa";
+
+  // Fast path: the platform optionalDependency delivered the binary, nothing
+  // to download.
+  try {
+    require.resolve(`@inflexa-ai/inflexa-${key}/package.json`);
+    return;
+  } catch {
+    // fall through to the download
+  }
+
+  const asset = ASSETS[key];
+  if (!asset) {
+    console.warn(`inflexa: no prebuilt binary exists for ${key}; the inflexa command will not run on this platform.`);
+    return;
+  }
+
+  const version = require(path.join(__dirname, "package.json")).version;
+  const base = `https://github.com/${REPO}/releases/download/v${version}`;
+
+  const binRes = await fetch(`${base}/${asset}`);
+  if (!binRes.ok) throw new Error(`download failed (HTTP ${binRes.status}): ${base}/${asset}`);
+  const bin = Buffer.from(await binRes.arrayBuffer());
+
+  const sumsRes = await fetch(`${base}/SHA256SUMS`);
+  if (!sumsRes.ok) throw new Error(`download failed (HTTP ${sumsRes.status}): ${base}/SHA256SUMS`);
+  const sums = await sumsRes.text();
+  let expected = null;
+  for (const line of sums.split("\n")) {
+    const [hash, name] = line.trim().split(/\s+/);
+    if (name === asset) {
+      expected = hash;
+      break;
+    }
+  }
+  if (!expected) throw new Error(`${asset} is not listed in the release's SHA256SUMS`);
+  const actual = createHash("sha256").update(bin).digest("hex");
+  if (actual !== expected) throw new Error(`checksum mismatch for ${asset} — expected ${expected}, got ${actual}`);
+
+  // Stage-then-rename so the launcher never sees a half-written binary.
+  const dir = path.join(__dirname, "bin-fallback");
+  fs.mkdirSync(dir, { recursive: true });
+  const staged = path.join(dir, `.${binName}.tmp`);
+  fs.writeFileSync(staged, bin, { mode: 0o755 });
+  fs.renameSync(staged, path.join(dir, binName));
+  console.log(`inflexa: optionalDependencies were skipped — downloaded and verified ${asset} instead`);
+}
+
+main().catch(function (err) {
+  console.warn(`inflexa: postinstall fallback failed: ${err.message}`);
+  console.warn("inflexa: the inflexa command will not run until its binary is available — reinstall without --no-optional, or see https://github.com/inflexa-ai/inflexa");
+});