@jonaskahn/relo 0.1.0-beta.17.d00e9a2a → 0.1.0-beta.20.d7e7f1ef

package/README.md

@@ -1,97 +1,59 @@
 <div align="center">
-<img src="assets/logo.png" alt="Relo" width="96">
+<img src="https://raw.githubusercontent.com/jonaskahn/relo/main/assets/logo.svg" alt="Relo" width="96">
 
 <h2>Relo</h2>
 
 <code>▚▚▚▚▚▚▚ Light • Fast • Reliable ▚▚▚▚▚▚▚</code>
 
-</div>
-
-> One local proxy that lets Codex, Claude Code, Cursor and Grok, etc. Talk to any model, any provider with no config changes.
-
-## Installation
-
-```console
-$ npm install -g @jonaskahn/relo
-$ relo daemon start
-```
-
-## What you get
-
-This package installs the `relo` binary and puts a `relo` command on your
-PATH. It is the daemon with its tray icon, downloaded from the GitHub release
-and verified against the release checksums.
-
-`relo` runs headless where there is no desktop session — a container or a
-server — and shows its tray icon where there is one. The installers
-(`Relo-Setup-*.exe` on Windows, the `Relo-Setup-*.deb` / `Relo-Setup-*.rpm`
-packages on Linux, and `Relo.app` on macOS) install the same binary.
-
-Every install provides the `relo` command, so they are never installed
-together: if another relo is already on your PATH, this install refuses and
-tells you where it found it. Removing that install first lets this package
-take over.
-
-Supported hosts: macOS, Linux, and Windows on both Intel and Apple Silicon (or
-their ARM equivalents). State lives in `$RELO_HOME`, `~/.relo` by default, so
-an npm install and a `.deb` install share the same configuration.
+<a href="https://www.npmjs.com/package/@jonaskahn/relo"><img src="https://img.shields.io/npm/v/@jonaskahn/relo?label=npm%40latest" alt="npm latest"></a>
+<a href="https://www.npmjs.com/package/@jonaskahn/relo?activeTab=versions"><img src="https://img.shields.io/npm/v/@jonaskahn/relo/beta" alt="npm beta"></a>
 
-## Updates
+<p><i>Let your harness agents talk to any model, any provider with no config changes.</i></p>
 
-The postinstall stops a running relo before replacing the binary: it asks the
-old build to drain, ends the processes of this home that still hold a
-configured port, and checks the ports are free before it writes the new one. A
-port another program holds fails the install rather than killing that program:
-
-```
-relo: install failed -- something else is listening on port 10101
-```
+</div>
 
-Free the port, or point `$RELO_HOME/config.toml` at another one, and install
-again. The data is never touched by an update.
+---
 
-## Uninstalling
+## Install
 
 ```console
-$ npm uninstall -g @jonaskahn/relo
+$ npm i -g @jonaskahn/relo        # latest stable (Node 22+)
+$ npm i -g @jonaskahn/relo@beta   # fresh from main
 ```
 
-This keeps your data in `$RELO_HOME`: the preuninstall script stops the daemon,
-frees its ports, and turns off start-at-login. To remove the data as well, use
-the daemon itself, which also removes the program:
+Installs the `relo` binary, verified against the release checksums. State
+lives in `~/.relo` (`$RELO_HOME`), shared with every other installer. Never
+installed twice: if another Relo is on your PATH, this one refuses and tells
+you where it found it.
+
+## Start
 
 ```console
-$ relo uninstall --wipe
+$ relo daemon start                 # console at http://127.0.0.1:10101
 ```
 
-Without a flag, `relo uninstall` asks whether the data goes.
+One port serves everything: the console, the management API, and the data
+plane (`/inference` speaks OpenAI, `/inference-claude` speaks Anthropic).
 
-## Install options
+## Update
 
-The installer downloads the daemon binary from a GitHub release: the latest
-one by default, or the tag `--relo-version` names when the installer is run
-by hand:
+The installer stops the running daemon, swaps the binary, and checks the port
+is free. Your data is never touched. If another program holds the port, the
+install fails instead of killing it:
 
-```console
-$ node "$(npm root -g)/relo/lib/install.mjs" --relo-version 0.2.0
+```
+relo: install failed -- something else is listening on port 10101
 ```
 
-## Troubleshooting
-
-An install that printed a platform or checksum error left nothing behind, so
-fix the cause and run the installer again:
+## Uninstall
 
 ```console
-$ node "$(npm root -g)/relo/lib/install.mjs"
+$ npm uninstall -g @jonaskahn/relo   # keeps your data
+$ relo uninstall --wipe               # removes data too
 ```
 
-Downloads are verified against `checksums.txt` from the release. A mismatch
-fails the install rather than writing an executable.
-
 ## Links
 
-- [Source](https://github.com/jonaskahn/relo)
-- [Releases](https://github.com/jonaskahn/relo/releases)
-- [Documentation](https://github.com/jonaskahn/relo#readme)
+[Source](https://github.com/jonaskahn/relo) · [Releases](https://github.com/jonaskahn/relo/releases) · [Docs](https://github.com/jonaskahn/relo#readme)
 
 AGPL-3.0-only

package/lib/archive.mjs

@@ -0,0 +1,72 @@
+// Reads the daemon binary out of a release tarball. Prereleases publish one
+// versioned archive per platform instead of the raw binary the stable
+// releases carry, so the installer falls back to this when the manifest
+// lists no raw binary.
+//
+// Pure node:zlib plus a minimal tar walk, no dependency and no system tar,
+// so the postinstall behaves the same on every host the package supports.
+import { gunzipSync } from 'node:zlib';
+
+function text(bytes) {
+	return Buffer.from(bytes).toString('utf8').replace(/\0.*$/s, '').trim();
+}
+
+function entryName(header) {
+	const name = text(header.subarray(0, 100));
+	const prefix = text(header.subarray(345, 500));
+	const joined = prefix ? `${prefix}/${name}` : name;
+	return joined.replace(/^\.\//, '');
+}
+
+function entrySize(header) {
+	const size = Number.parseInt(text(header.subarray(124, 136)), 8);
+	if (!Number.isSafeInteger(size) || size < 0) {
+		throw new Error('relo: the release archive has a corrupt entry size');
+	}
+	return size;
+}
+
+function safeName(name) {
+	if (!name || name.startsWith('/') || name.startsWith('\\')) return false;
+	return !name.split(/[\\/]/).includes('..');
+}
+
+// extractBinary returns the bytes of the single archive member whose file
+// name is in names. Pax headers and directories are skipped; anything else
+// that is not that one regular file fails the install instead of writing a
+// wrong executable into the package.
+export function extractBinary(tarball, { names }) {
+	let tar;
+	try {
+		tar = gunzipSync(tarball);
+	} catch {
+		throw new Error('relo: the release archive is not valid gzip');
+	}
+	const found = [];
+	let offset = 0;
+	while (offset + 512 <= tar.length) {
+		const header = tar.subarray(offset, offset + 512);
+		if (header.every((byte) => byte === 0)) break;
+		const name = entryName(header);
+		const size = entrySize(header);
+		const end = offset + 512 + size;
+		if (end > tar.length) {
+			throw new Error(`relo: the release archive truncates ${name || 'an entry'}`);
+		}
+		const type = String.fromCharCode(header[156]);
+		if ((type === '0' || type === '\0') && names.includes(name.split('/').pop())) {
+			if (!safeName(name)) {
+				throw new Error(`relo: the release archive hides an unsafe path (${name})`);
+			}
+			found.push(Buffer.from(tar.subarray(offset + 512, end)));
+		}
+		offset += 512 + Math.ceil(size / 512) * 512;
+	}
+	if (found.length === 0) {
+		throw new Error(`relo: the release archive holds no ${names.join(' or ')}`);
+	}
+	if (found.length > 1) {
+		throw new Error('relo: the release archive holds more than one binary');
+	}
+	return found[0];
+}

package/lib/daemon.mjs

@@ -16,19 +16,18 @@ export function reloHome(env = process.env) {
 	return env.RELO_HOME?.trim() || join(homedir(), '.relo');
 }
 
-const DEFAULTS = { port: 10101, openai: 10201, anthropic: 10202, gemini: 10203 };
+const DEFAULTS = { port: 10101 };
 
-// servicePorts lists the ports a home opens: the management port plus one per
-// client protocol. A protocol whose port is 0 is not opened.
+// servicePorts lists the port a home opens: the single listener's port. A
+// zero port asks for an ephemeral one, which no scan can name.
 export function servicePorts(configText = '') {
-	const found = {};
+	let found;
 	for (const line of configText.split('\n')) {
-		const match = line.match(/^\s*(port|openai|anthropic|gemini)\s*=\s*(\d+)/);
-		if (match) found[match[1]] ??= Number(match[2]);
+		const match = line.match(/^\s*port\s*=\s*(\d+)/);
+		if (match) found ??= Number(match[1]);
 	}
-	return ['port', 'openai', 'anthropic', 'gemini']
-		.map((key) => found[key] ?? DEFAULTS[key])
-		.filter((port) => port !== 0);
+	const port = found ?? DEFAULTS.port;
+	return port === 0 ? [] : [port];
 }
 
 // runtimePid reads the pid a daemon published, or null when no usable file

package/lib/install.mjs

@@ -22,7 +22,8 @@ import { askStart, quiesce, reloHome } from './daemon.mjs';
 import { findConflictingRelo } from './conflict.mjs';
 import { fetchBytes } from './download.mjs';
 import { target } from './platform.mjs';
-import { assets, checksumsUrl, prereleaseTag, tagFromArgs, url } from './release.mjs';
+import { assets, checksumsUrl, prereleaseTag, selectBundle, tagFromArgs, url } from './release.mjs';
+import { extractBinary } from './archive.mjs';
 
 const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 const binaryDir = resolve(packageRoot, 'bin');
@@ -42,10 +43,16 @@ async function fromRelease(tag) {
 	const { version } = assets(tag);
 
 	// One manifest lists every asset in the release, so a single fetch
-	// verifies the binary before anything executable is written.
-	const manifest = await fetchBytes(checksumsUrl(tag), 'checksums.txt');
-	const body = await fetchBytes(url(asset.name, tag), asset.name);
-	expect(parse(manifest), asset.name, body);
+	// verifies the binary before anything executable is written. A release
+	// carrying the raw binary uses it; one carrying only the versioned
+	// tarballs falls back to this host's archive, and the binary inside is
+	// what the launcher beside it already expects.
+	const manifest = parse(await fetchBytes(checksumsUrl(tag), 'checksums.txt'));
+	const pick = selectBundle(manifest, asset);
+	const downloaded = await fetchBytes(url(pick.name, tag), pick.name);
+	expect(manifest, pick.name, downloaded);
+	const inner = asset.os === 'windows' ? 'relo.exe' : 'relo';
+	const body = pick.kind === 'raw' ? downloaded : extractBinary(downloaded, { names: [inner] });
 	const destination = resolve(binaryDir, asset.name);
 	// Quiesced first: on windows the rename below fails over a running exe, and
 	// the new daemon cannot bind a port the old one still serves.

package/lib/release.mjs

@@ -53,3 +53,30 @@ export function checksumsUrl(tag = null) {
 export function url(name, tag = null) {
 	return `${assets(tag).base}/${name}`;
 }
+
+// selectBundle names the asset one host downloads from a release manifest:
+// the raw binary when the release carries it, else this host's versioned
+// tarball. It throws naming both when neither is listed, so a failed
+// install says what is missing instead of what a 404 means.
+export function selectBundle(entries, { os, arch, name }) {
+	if (entries.has(name)) return { kind: 'raw', name };
+	const bundle = tarballFor(entries, { os, arch });
+	if (bundle) return { kind: 'tarball', name: bundle };
+	throw new Error(
+		`no ${name} or versioned tarball in the release. ` +
+			'No release may be published yet; rerun the installer with --relo-version <tag> for a published tag, or without it for the latest release.'
+	);
+}
+
+// tarballFor finds the versioned archive a release publishes for one host
+// inside its own checksums manifest. Releases ship one tarball per
+// platform, and the version is read out of the manifest entry itself, so
+// this resolves both a pinned tag and the unpinned latest release without
+// a second fetch.
+export function tarballFor(entries, { os, arch }) {
+	const match = [...entries.keys()].find((name) => {
+		const parts = new RegExp(`^relo-(.+)-${os}-${arch}\\.tar\\.gz$`).exec(name);
+		return parts && version(parts[1]);
+	});
+	return match ?? null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@jonaskahn/relo",
-	"version": "0.1.0-beta.17.d00e9a2a",
+	"version": "0.1.0-beta.20.d7e7f1ef",
 	"description": "One local proxy that lets Codex, Claude Code, Cursor and Grok, etc. Talk to any model, any provider with no config changes",
 	"license": "AGPL-3.0-only",
 	"type": "module",
@@ -40,6 +40,7 @@
 	},
 	"files": [
 		"bin/relo.mjs",
+		"lib/archive.mjs",
 		"lib/checksums.mjs",
 		"lib/conflict.mjs",
 		"lib/daemon.mjs",