@kosli/cli 2.13.1-SNAPSHOT-b45c7e65 → 2.13.1-SNAPSHOT-b45c7e67

package/bin/kosli

@@ -3,6 +3,10 @@
 
 const { spawnSync } = require("child_process");
 const path = require("path");
+const https = require("https");
+const http = require("http");
+const fs = require("fs");
+const os = require("os");
 
 const platform = process.platform;
 const arch = process.arch;
@@ -23,24 +27,118 @@ if (!SUPPORTED[platform] || !SUPPORTED[platform][arch]) {
 
 const packageName = `@kosli/cli-${platform}-${arch}`;
 
-let binaryPath;
+// Try the optional platform package first (installed via npm install / npm install -g)
+let resolvedBinaryPath = null;
 try {
   const packageDir = path.dirname(
     require.resolve(`${packageName}/package.json`)
   );
   const binaryName = platform === "win32" ? "kosli.exe" : "kosli";
-  binaryPath = path.join(packageDir, "bin", binaryName);
-} catch (e) {
-  process.stderr.write(
-    `[kosli] Error: platform package ${packageName} is not installed.\n` +
-    `[kosli] Try reinstalling: npm install -g @kosli/cli\n`
-  );
-  process.exit(1);
+  resolvedBinaryPath = path.join(packageDir, "bin", binaryName);
+} catch (_) {
+  // Optional dep not present — will fall back to on-demand download below (npx case)
 }
 
-const result = spawnSync(binaryPath, process.argv.slice(2), { stdio: "inherit" });
-if (result.error) {
-  process.stderr.write(`[kosli] Error: failed to run binary: ${result.error.message}\n`);
-  process.exit(1);
+async function run() {
+  const binaryPath = resolvedBinaryPath ?? await getOrDownloadBinary();
+
+  const result = spawnSync(binaryPath, process.argv.slice(2), { stdio: "inherit" });
+  if (result.error) {
+    process.stderr.write(`[kosli] Error: failed to run binary: ${result.error.message}\n`);
+    process.exit(1);
+  }
+  process.exit(result.status ?? 1);
 }
-process.exit(result.status ?? 1);
+
+async function getOrDownloadBinary() {
+  const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, "..", "package.json"), "utf8"));
+  const version = pkg.version;
+
+  if (!version || version === "0.0.0") {
+    process.stderr.write(
+      `[kosli] Error: package version is "${version}" — cannot determine which binary to download.\n` +
+      `[kosli] Try: npm install -g @kosli/cli\n`
+    );
+    process.exit(1);
+  }
+
+  const binaryName = platform === "win32" ? "kosli.exe" : "kosli";
+
+  // Cache under ~/.cache/kosli/<version>/<platform>-<arch>/kosli[.exe]
+  const cacheDir = path.join(os.homedir(), ".cache", "kosli", version, `${platform}-${arch}`);
+  const cachedBinary = path.join(cacheDir, binaryName);
+
+  if (fs.existsSync(cachedBinary)) {
+    return cachedBinary;
+  }
+
+  // Build GitHub release download URL
+  // npm platform → goreleaser OS/arch naming
+  const goOs = { darwin: "darwin", linux: "linux", win32: "windows" }[platform];
+  const goArch = { x64: "amd64", arm64: "arm64", arm: "armv6" }[arch];
+  const ext = platform === "win32" ? "zip" : "tar.gz";
+  const versionNoV = version.replace(/^v/, "");
+  const archiveName = `kosli_${versionNoV}_${goOs}_${goArch}.${ext}`;
+  const downloadUrl = `https://github.com/kosli-dev/cli/releases/download/v${versionNoV}/${archiveName}`;
+
+  process.stderr.write(`[kosli] Downloading ${archiveName}...\n`);
+
+  const tmpFile = path.join(os.tmpdir(), `kosli-download-${process.pid}.${ext}`);
+  try {
+    await downloadToFile(downloadUrl, tmpFile);
+
+    fs.mkdirSync(cacheDir, { recursive: true });
+
+    // Extract just the binary from the archive.
+    // The binary sits at the archive root (no wrapping directory).
+    // `tar` on Linux/macOS handles tar.gz; bsdtar (Windows 10+) handles both tar.gz and zip.
+    const tarFlags = ext === "tar.gz" ? ["-xzf"] : ["-xf"];
+    const tarResult = spawnSync(
+      "tar",
+      [...tarFlags, tmpFile, binaryName, "-C", cacheDir],
+      { stdio: ["ignore", "ignore", "pipe"] }
+    );
+    if (tarResult.status !== 0 || !fs.existsSync(cachedBinary)) {
+      const detail = tarResult.stderr ? tarResult.stderr.toString().trim() : "unknown error";
+      throw new Error(`Extraction failed: ${detail}`);
+    }
+
+    if (platform !== "win32") {
+      fs.chmodSync(cachedBinary, 0o755);
+    }
+
+    return cachedBinary;
+  } finally {
+    try { fs.unlinkSync(tmpFile); } catch (_) {}
+  }
+}
+
+function downloadToFile(url, dest) {
+  return new Promise((resolve, reject) => {
+    function get(url) {
+      const mod = url.startsWith("https://") ? https : http;
+      mod.get(url, (res) => {
+        if ([301, 302, 307, 308].includes(res.statusCode)) {
+          res.resume();
+          return get(res.headers.location);
+        }
+        if (res.statusCode !== 200) {
+          res.resume();
+          return reject(new Error(`HTTP ${res.statusCode} from ${url}`));
+        }
+        const file = fs.createWriteStream(dest);
+        res.pipe(file);
+        file.on("finish", () => file.close(resolve));
+        file.on("error", (err) => { fs.unlink(dest, () => {}); reject(err); });
+        res.on("error", reject);
+      }).on("error", reject);
+    }
+    get(url);
+  });
+}
+
+run().catch((err) => {
+  process.stderr.write(`[kosli] Error: ${err.message}\n`);
+  process.stderr.write(`[kosli] Try: npm install -g @kosli/cli\n`);
+  process.exit(1);
+});

package/package.json

@@ -1,13 +1,14 @@
 {
   "name": "@kosli/cli",
-  "version": "2.13.1-SNAPSHOT-b45c7e65",
+  "version": "2.13.1-SNAPSHOT-b45c7e67",
   "description": "CLI client for reporting compliance events to https://kosli.com",
   "license": "MIT",
   "author": "Kosli Inc. <hello@kosli.com>",
   "homepage": "https://kosli.com",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/kosli-dev/cli.git"
+    "url": "git+https://github.com/kosli-dev/cli.git",
+    "directory": "npm/wrapper"
   },
   "bugs": {
     "url": "https://github.com/kosli-dev/cli/issues"
@@ -19,6 +20,9 @@
     "supply-chain",
     "devops"
   ],
+  "engines": {
+    "node": ">=18"
+  },
   "bin": {
     "kosli": "bin/kosli"
   },
@@ -30,13 +34,13 @@
     "postinstall": "node install.js"
   },
   "optionalDependencies": {
-    "@kosli/cli-darwin-arm64": "2.13.1-SNAPSHOT-b45c7e65",
-    "@kosli/cli-darwin-x64": "2.13.1-SNAPSHOT-b45c7e65",
-    "@kosli/cli-linux-arm": "2.13.1-SNAPSHOT-b45c7e65",
-    "@kosli/cli-linux-arm64": "2.13.1-SNAPSHOT-b45c7e65",
-    "@kosli/cli-linux-x64": "2.13.1-SNAPSHOT-b45c7e65",
-    "@kosli/cli-win32-arm64": "2.13.1-SNAPSHOT-b45c7e65",
-    "@kosli/cli-win32-x64": "2.13.1-SNAPSHOT-b45c7e65"
+    "@kosli/cli-darwin-arm64": "2.13.1-SNAPSHOT-b45c7e67",
+    "@kosli/cli-darwin-x64": "2.13.1-SNAPSHOT-b45c7e67",
+    "@kosli/cli-linux-arm": "2.13.1-SNAPSHOT-b45c7e67",
+    "@kosli/cli-linux-arm64": "2.13.1-SNAPSHOT-b45c7e67",
+    "@kosli/cli-linux-x64": "2.13.1-SNAPSHOT-b45c7e67",
+    "@kosli/cli-win32-arm64": "2.13.1-SNAPSHOT-b45c7e67",
+    "@kosli/cli-win32-x64": "2.13.1-SNAPSHOT-b45c7e67"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",