@kroszborg/sugi 0.3.1 → 0.3.2

package/README.md

@@ -7,7 +7,7 @@
 ## Install
 
 ```sh
-npm install -g sugi
+npm install -g @kroszborg/sugi
 ```
 
 Or via Homebrew:

package/bin.js

@@ -10,7 +10,7 @@ const binPath = path.join(__dirname, 'bin', binName);
 
 if (!fs.existsSync(binPath)) {
   console.error('sugi: binary not found at ' + binPath);
-  console.error('Try reinstalling: npm install -g sugi');
+  console.error('Try reinstalling: npm install -g @kroszborg/sugi');
   process.exit(1);
 }
 

package/install.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // npm binary wrapper for sugi
 // Downloads the correct pre-built binary from GitHub Releases on postinstall.
-// Falls back to `go build` if no release exists yet (local / dev install).
+// Falls back to `go install` if no release binary exists yet.
 
 'use strict';
 
@@ -9,7 +9,7 @@ const https = require('https');
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
-const { execSync, spawnSync } = require('child_process');
+const { spawnSync } = require('child_process');
 
 const VERSION = require('./package.json').version;
 const REPO = 'Kroszborg/sugi';
@@ -35,72 +35,100 @@ function platformInfo() {
   return { osName, cpu, ext, binName };
 }
 
+// Download url to dest, following up to 10 redirects.
+// Only opens the WriteStream once we have a confirmed 200 response.
 function downloadFile(url, dest) {
   return new Promise((resolve, reject) => {
-    const file = fs.createWriteStream(dest);
+    let redirects = 0;
+
     const get = (u) => {
+      if (redirects > 10) return reject(new Error('Too many redirects'));
       https.get(u, { headers: { 'User-Agent': 'sugi-npm-installer' } }, (res) => {
-        if (res.statusCode === 301 || res.statusCode === 302) {
-          file.close();
-          const newFile = fs.createWriteStream(dest);
+        if (res.statusCode === 301 || res.statusCode === 302 ||
+            res.statusCode === 307 || res.statusCode === 308) {
+          redirects++;
+          res.resume(); // drain so socket can be reused
           return get(res.headers.location);
         }
         if (res.statusCode !== 200) {
-          file.close();
-          return reject(new Error(`HTTP ${res.statusCode} for ${u}`));
+          res.resume();
+          return reject(new Error(`HTTP ${res.statusCode} downloading ${u}`));
         }
+        // Only create the file once we have a real 200 response
+        const file = fs.createWriteStream(dest);
         res.pipe(file);
-        file.on('finish', () => { file.close(); resolve(); });
-      }).on('error', (e) => { file.close(); reject(e); });
+        file.on('finish', () => file.close(resolve));
+        file.on('error', (e) => { fs.unlink(dest, () => {}); reject(e); });
+        res.on('error', (e) => { file.close(); fs.unlink(dest, () => {}); reject(e); });
+      }).on('error', reject);
     };
+
     get(url);
   });
 }
 
 function tryGoBuild() {
-  // Check if go is available
   const goCheck = spawnSync('go', ['version'], { stdio: 'pipe' });
-  if (goCheck.status !== 0) {
-    return false;
-  }
+  if (goCheck.status !== 0) return false;
 
   if (!fs.existsSync(BIN_DIR)) fs.mkdirSync(BIN_DIR, { recursive: true });
 
   const binName = process.platform === 'win32' ? 'sugi.exe' : 'sugi';
   const binDest = path.join(BIN_DIR, binName);
 
-  // If we're inside an npm-installed package, try go install as a fallback
-  console.log('sugi: building from source via `go install`…');
+  console.log('sugi: building from source via `go install`...');
+  // Embed the version string via ldflags so `sugi version` shows the right value
+  const ldflags = `-X main.version=${VERSION}`;
   const result = spawnSync(
     'go',
-    ['install', `github.com/${REPO}/cmd/sugi@latest`],
+    ['install', `-ldflags=${ldflags}`, `github.com/${REPO}/cmd/sugi@latest`],
     { stdio: 'inherit', env: process.env }
   );
 
-  if (result.status === 0) {
-    // Find the installed binary in GOPATH/bin or GOBIN
-    const goEnv = spawnSync('go', ['env', 'GOBIN', 'GOPATH'], { stdio: 'pipe' });
-    if (goEnv.status === 0) {
-      const [gobin, gopath] = goEnv.stdout.toString().trim().split('\n');
-      const candidates = [
-        gobin && path.join(gobin.trim(), binName),
-        gopath && path.join(gopath.trim(), 'bin', binName),
-      ].filter(Boolean);
-
-      for (const src of candidates) {
-        if (fs.existsSync(src)) {
-          fs.copyFileSync(src, binDest);
-          fs.chmodSync(binDest, 0o755);
-          console.log(`sugi: installed to ${binDest}`);
-          return true;
-        }
-      }
+  if (result.status !== 0) return false;
+
+  // Locate the installed binary in GOBIN or GOPATH/bin
+  const goEnv = spawnSync('go', ['env', 'GOBIN', 'GOPATH'], { stdio: 'pipe' });
+  if (goEnv.status !== 0) return false;
+
+  const [gobin, gopath] = goEnv.stdout.toString().trim().split('\n');
+  const candidates = [
+    gobin && path.join(gobin.trim(), binName),
+    gopath && path.join(gopath.trim(), 'bin', binName),
+  ].filter(Boolean);
+
+  for (const src of candidates) {
+    if (fs.existsSync(src)) {
+      fs.copyFileSync(src, binDest);
+      fs.chmodSync(binDest, 0o755);
+      console.log(`sugi: installed to ${binDest}`);
+      return true;
     }
   }
 
   return false;
 }
 
+function extractArchive(archivePath, ext, binName) {
+  if (!fs.existsSync(BIN_DIR)) fs.mkdirSync(BIN_DIR, { recursive: true });
+
+  if (ext === '.tar.gz') {
+    // Use array args to avoid shell injection
+    const result = spawnSync('tar', ['-xzf', archivePath, '-C', BIN_DIR, binName], { stdio: 'inherit' });
+    if (result.status !== 0) throw new Error('tar extraction failed');
+  } else {
+    // Windows: use PowerShell Expand-Archive
+    const ps = `Expand-Archive -Path '${archivePath}' -DestinationPath '${BIN_DIR}' -Force`;
+    const result = spawnSync('powershell', ['-NoProfile', '-Command', ps], { stdio: 'inherit' });
+    if (result.status !== 0) throw new Error('Expand-Archive failed');
+  }
+
+  const binDest = path.join(BIN_DIR, binName);
+  if (!fs.existsSync(binDest)) throw new Error(`Binary not found after extraction: ${binDest}`);
+  fs.chmodSync(binDest, 0o755);
+  return binDest;
+}
+
 async function main() {
   const { osName, cpu, ext, binName } = platformInfo();
 
@@ -109,45 +137,34 @@ async function main() {
   const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'sugi-'));
   const archivePath = path.join(tmpDir, assetName);
 
-  console.log(`sugi: downloading ${assetName}…`);
+  console.log(`sugi: downloading ${assetName}...`);
 
   let downloadOk = false;
   try {
     await downloadFile(url, archivePath);
     downloadOk = true;
   } catch (e) {
-    console.error(`sugi: download failed — ${e.message}`);
+    console.error(`sugi: download failed - ${e.message}`);
   }
 
   if (!downloadOk) {
-    console.log(`sugi: falling back to go install…`);
+    console.log('sugi: falling back to go install...');
     const ok = tryGoBuild();
+    fs.rmSync(tmpDir, { recursive: true, force: true });
     if (!ok) {
-      console.error(`sugi: install failed. Install manually:`);
+      console.error('sugi: install failed. Install manually:');
       console.error(`  go install github.com/${REPO}/cmd/sugi@latest`);
       console.error(`  or download from: https://github.com/${REPO}/releases`);
       process.exit(1);
     }
-    fs.rmSync(tmpDir, { recursive: true, force: true });
     return;
   }
 
-  if (!fs.existsSync(BIN_DIR)) fs.mkdirSync(BIN_DIR, { recursive: true });
-  const binDest = path.join(BIN_DIR, binName);
-
   try {
-    if (ext === '.tar.gz') {
-      execSync(`tar -xzf "${archivePath}" -C "${BIN_DIR}" sugi`, { stdio: 'inherit' });
-    } else {
-      execSync(
-        `powershell -Command "Expand-Archive -Path '${archivePath}' -DestinationPath '${BIN_DIR}' -Force"`,
-        { stdio: 'inherit' }
-      );
-    }
-    fs.chmodSync(binDest, 0o755);
+    const binDest = extractArchive(archivePath, ext, binName);
     console.log(`sugi: installed to ${binDest}`);
   } catch (e) {
-    console.error(`sugi: extraction failed — ${e.message}`);
+    console.error(`sugi: extraction failed - ${e.message}`);
     process.exit(1);
   } finally {
     fs.rmSync(tmpDir, { recursive: true, force: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kroszborg/sugi",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Terminal UI git client — PRs, AI commits, interactive rebase, bisect, worktrees",
   "keywords": [
     "git",