@mcptask/cli 0.2.3

package/README.md

@@ -0,0 +1,69 @@
+# @mcptask/cli
+
+The [mcptask](https://mcptask.online) runner — drives Claude Code through the
+tasks on mcptask.online.
+
+```bash
+npx @mcptask/cli init
+```
+
+Run that in the project you want the runner to work on. It installs the skills,
+helper scripts and configuration the runner needs, and prints how to switch on a
+scheduled job — it does not switch one on for you.
+
+```bash
+npx @mcptask/cli run today      # work today's tasks
+npx @mcptask/cli version        # version and resolved configuration
+```
+
+## What this package is
+
+A thin wrapper around a single static binary. It carries no binary of its own:
+publishing six of them in one tarball would make every project download five it
+cannot run, so the postinstall downloads the one archive this platform needs and
+verifies it against the release's published `checksums.txt` before unpacking it.
+
+macOS, Linux and Windows, on amd64 and arm64. The binary needs no Go and no Ruby.
+
+The wrapper forwards arguments and exit codes untouched — the runner's exit codes
+are a contract that scheduled jobs read, and a wrapper that flattened them to 0/1
+would break every one of them.
+
+## Not a JS project?
+
+The same binary installs without npm:
+
+```bash
+curl -fsSL https://github.com/jchsoft/mcptask-releases/releases/latest/download/install.sh | sh
+```
+
+Or `brew install jchsoft/tap/mcptask_runner` on macOS, and on Windows:
+
+```powershell
+scoop bucket add jchsoft https://github.com/jchsoft/scoop-bucket
+scoop install mcptask_runner
+```
+
+Once installed any way, it updates itself:
+
+```bash
+mcptask_runner update --self
+```
+
+## Environment
+
+| Variable | Effect |
+| --- | --- |
+| `MCPTASK_VERSION` | install a specific release instead of the one matching this package |
+| `MCPTASK_NO_UPDATE_CHECK` | set to `1` to stop the runner mentioning newer releases |
+
+The package version is the release it installs, so `@mcptask/cli@0.2.3` gives you
+`mcptask_runner` 0.2.3.
+
+## Where things live
+
+Binaries and checksums: [jchsoft/mcptask-releases](https://github.com/jchsoft/mcptask-releases).
+
+---
+
+Proprietary — © JCHSoft. All rights reserved.

package/bin/mcptask_runner.js

@@ -0,0 +1,37 @@
+#!/usr/bin/env node
+// Thin wrapper: run the binary the postinstall script downloaded (#11273).
+//
+// It exists so `npx @mcptask/cli init` works, and it deliberately does nothing
+// beyond handing over — arguments through untouched, stdio inherited so the
+// runner's own progress output and prompts behave as if it had been invoked
+// directly, and its exit code passed back. The runner's exit codes are a
+// documented contract, and a wrapper that collapsed them to 0/1 would break
+// every scheduled job that reads them.
+'use strict'
+
+const path = require('node:path')
+const fs = require('node:fs')
+const { spawnSync } = require('node:child_process')
+
+const binary = process.platform === 'win32' ? 'mcptask_runner.exe' : 'mcptask_runner'
+const executable = path.join(__dirname, '..', 'vendor', binary)
+
+if (!fs.existsSync(executable)) {
+  console.error(
+    '@mcptask/cli: the runner binary is missing — the postinstall download did ' +
+    'not complete.\nReinstall with `npm install @mcptask/cli`, or run ' +
+    '`node install.js` inside the package.'
+  )
+  process.exit(1)
+}
+
+const result = spawnSync(executable, process.argv.slice(2), { stdio: 'inherit' })
+
+if (result.error) {
+  console.error(`@mcptask/cli: could not start the runner — ${result.error.message}`)
+  process.exit(1)
+}
+
+// A process killed by a signal has a null status; report it the way a shell
+// does rather than as a success.
+process.exit(result.status === null ? 1 : result.status)

package/install.js

@@ -0,0 +1,143 @@
+// postinstall: fetch the mcptask_runner binary for this platform (#11273).
+//
+// The npm package carries no binary of its own — publishing six of them in one
+// tarball would make every JS project download five it cannot run. Instead the
+// package version tracks the release tag, and this script downloads the one
+// archive this platform needs and verifies it against the release's checksums.
+//
+// Node's standard library only, on purpose: a postinstall script with
+// dependencies has to be installed before it can install, and every dependency
+// here would run in the same privileged position on every host.
+'use strict'
+
+const crypto = require('node:crypto')
+const fs = require('node:fs')
+const https = require('node:https')
+const os = require('node:os')
+const path = require('node:path')
+const { execFileSync } = require('node:child_process')
+
+const REPO = process.env.MCPTASK_RELEASE_REPO || 'jchsoft/mcptask-releases'
+const BINARY = process.platform === 'win32' ? 'mcptask_runner.exe' : 'mcptask_runner'
+const VENDOR = path.join(__dirname, 'vendor')
+
+// npm normalises the package version; the release tag it came from is that
+// version with a leading v. MCPTASK_VERSION overrides both, which is what makes
+// a pre-release installable without republishing the package.
+const version = process.env.MCPTASK_VERSION || `v${require('./package.json').version}`
+
+function platformSlug () {
+  const goos = { darwin: 'darwin', linux: 'linux', win32: 'windows' }[process.platform]
+  const goarch = { x64: 'amd64', arm64: 'arm64' }[process.arch]
+  if (!goos || !goarch) {
+    throw new Error(
+      `unsupported platform ${process.platform}/${process.arch} — ` +
+      'the release builds darwin, linux and windows on amd64 and arm64'
+    )
+  }
+  return { goos, goarch }
+}
+
+// GitHub redirects release downloads to a storage host, so redirects have to be
+// followed by hand: https.get does not do it.
+function get (url, redirectsLeft = 5) {
+  return new Promise((resolve, reject) => {
+    const headers = { 'user-agent': '@mcptask/cli' }
+    // Only needed while the release repository is private.
+    const token = process.env.MCPTASK_GITHUB_TOKEN || process.env.GITHUB_TOKEN
+    if (token) headers.authorization = `Bearer ${token}`
+
+    https.get(url, { headers }, (res) => {
+      if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+        res.resume()
+        if (redirectsLeft === 0) return reject(new Error(`too many redirects for ${url}`))
+        return resolve(get(res.headers.location, redirectsLeft - 1))
+      }
+      if (res.statusCode !== 200) {
+        res.resume()
+        return reject(new Error(`GET ${url} failed with HTTP ${res.statusCode}`))
+      }
+      const chunks = []
+      res.on('data', (c) => chunks.push(c))
+      res.on('end', () => resolve(Buffer.concat(chunks)))
+      res.on('error', reject)
+    }).on('error', reject)
+  })
+}
+
+// The archive is only unpacked once its hash matches what the release published.
+// This runs as a postinstall script, so the binary it produces will be executed
+// by the developer without further inspection — an unverified download here is
+// an unverified download straight onto PATH.
+function verify (archiveName, archive, checksums) {
+  const digest = crypto.createHash('sha256').update(archive).digest('hex')
+  const line = checksums
+    .toString('utf8')
+    .split('\n')
+    .find((l) => l.trim().endsWith(archiveName))
+  if (!line) throw new Error(`checksums.txt does not list ${archiveName}`)
+
+  const expected = line.trim().split(/\s+/)[0]
+  if (expected !== digest) {
+    throw new Error(
+      `checksum mismatch for ${archiveName}\n  expected ${expected}\n  got      ${digest}`
+    )
+  }
+}
+
+function extract (archivePath, destination) {
+  if (archivePath.endsWith('.zip')) {
+    // Windows: PowerShell rather than a zip dependency.
+    execFileSync('powershell', [
+      '-NoProfile', '-NonInteractive', '-Command',
+      `Expand-Archive -Path "${archivePath}" -DestinationPath "${destination}" -Force`
+    ], { stdio: 'inherit' })
+  } else {
+    // bsdtar/GNU tar, present on every macOS and Linux host.
+    execFileSync('tar', ['-xzf', archivePath, '-C', destination], { stdio: 'inherit' })
+  }
+}
+
+async function main () {
+  const { goos, goarch } = platformSlug()
+  const bare = version.replace(/^v/, '')
+  const ext = goos === 'windows' ? 'zip' : 'tar.gz'
+  const archiveName = `mcptask_runner_${bare}_${goos}_${goarch}.${ext}`
+  const base = `https://github.com/${REPO}/releases/download/${version}`
+
+  console.log(`@mcptask/cli: downloading ${archiveName}`)
+  const [archive, checksums] = await Promise.all([
+    get(`${base}/${archiveName}`),
+    get(`${base}/checksums.txt`)
+  ])
+
+  verify(archiveName, archive, checksums)
+
+  fs.rmSync(VENDOR, { recursive: true, force: true })
+  fs.mkdirSync(VENDOR, { recursive: true })
+
+  const staging = fs.mkdtempSync(path.join(os.tmpdir(), 'mcptask-'))
+  try {
+    const archivePath = path.join(staging, archiveName)
+    fs.writeFileSync(archivePath, archive)
+    extract(archivePath, staging)
+
+    const from = path.join(staging, BINARY)
+    if (!fs.existsSync(from)) throw new Error(`the archive did not contain ${BINARY}`)
+    fs.copyFileSync(from, path.join(VENDOR, BINARY))
+    // npm does not preserve the executable bit through this path, and the
+    // wrapper execs the file directly rather than through a shell.
+    fs.chmodSync(path.join(VENDOR, BINARY), 0o755)
+  } finally {
+    fs.rmSync(staging, { recursive: true, force: true })
+  }
+
+  console.log(`@mcptask/cli: installed mcptask_runner ${version}`)
+}
+
+main().catch((err) => {
+  console.error(`@mcptask/cli: ${err.message}`)
+  // Fail the install rather than leaving a package whose only command is
+  // missing; `npx @mcptask/cli` would otherwise fail later and less clearly.
+  process.exit(1)
+})

package/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "@mcptask/cli",
+  "version": "0.2.3",
+  "description": "mcptask runner — drives Claude Code through the tasks on mcptask.online",
+  "homepage": "https://mcptask.online",
+  "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jchsoft/mcptask-releases.git"
+  },
+  "bin": {
+    "mcptask_runner": "bin/mcptask_runner.js"
+  },
+  "scripts": {
+    "postinstall": "node install.js"
+  },
+  "files": [
+    "bin/mcptask_runner.js",
+    "install.js",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "os": [
+    "darwin",
+    "linux",
+    "win32"
+  ],
+  "cpu": [
+    "x64",
+    "arm64"
+  ]
+}