@mobb.ai/cli 0.0.1 → 1.4.49

package/README.md

@@ -0,0 +1,84 @@
+# @mobb.ai/cli
+
+Binary distribution of the Bugsy CLI, delivered entirely through the `@mobb.ai`
+npm org. The package itself is a ~30-line launcher that runs on **any Node.js
+>= 14**; the real CLI is a standalone executable (own Node runtime embedded)
+that npm installs as a platform-specific optional dependency. No downloads
+outside npm, no GitHub access, no checksum plumbing — registry + lockfile
+integrity cover supply-chain verification.
+
+Scoped under `@mobb.ai` so only the org can publish the launcher and platform
+binaries (typosquat / fake-package resistance).
+
+## Usage (customers)
+
+```bash
+npm install @mobb.ai/cli     # ~40 MB download, exactly one platform package
+mobbdev scan -r https://github.com/WebGoat/WebGoat
+```
+
+Published platforms: `linux-x64`, `linux-arm64`, `win-x64` (glibc — musl/Alpine
+is not supported, the binary needs the glibc loader). The `macos-*` names are
+reserved in the org but not built yet: postject invalidates the Mach-O
+signature and macOS then refuses to exec the binary, so those targets need a
+macOS build job. macOS and Alpine users install the `mobbdev` npm package.
+
+Same CLI, commands, config, and login as the `mobbdev` package. Customers
+choose:
+
+| | `mobbdev` | `@mobb.ai/cli` |
+| --- | --- | --- |
+| What runs | JS on the customer's Node | standalone binary (Node 22 inside) |
+| Node requirement | engines range of `mobbdev` | any Node >= 14 |
+| Install size | ~380 MB (467 packages) | ~40 MB compressed / ~120 MB on disk (2 packages) |
+
+## How it works
+
+- `@mobb.ai/cli-<os>-<cpu>` packages each contain one compiled binary and
+  declare `os`/`cpu` (Node `process.platform` / `process.arch` values), so npm
+  installs only the matching one. Package *names* use `macos` / `win` slugs
+  (`@mobb.ai/cli-macos-arm64`, `@mobb.ai/cli-win-x64`, …).
+- `@mobb.ai/cli` lists them as exact-version `optionalDependencies` and its
+  `mobbdev` bin resolves + spawns the installed binary, forwarding args and
+  exit code.
+
+## Release flow
+
+**Shared version:** `clients/cli_wrapper/package.json` must always equal
+`clients/cli/package.json`. Platform packages and `@mobb.ai/cli` publish under
+that version. `clients/cli/scripts/increment-version.sh` bumps both when either
+tree changes; `scripts/check_cli_version.sh` (CI), the version step in
+`.github/workflows/cli-binary-tests.yml` and `sharedVersion()` in
+`clients/scripts/targets.mjs` (used by the packaging step) all fail on mismatch.
+
+The JS npm package `mobbdev` (from `clients/cli`) is published separately;
+binary packages are generated by `scripts/prepare_publish.mjs` (one package per
+binary in `binaries/`, optionalDeps stamped into `publish/`).
+
+`scripts/publish_cli_binaries.sh` (Production deploy, after `publish_cli.sh`):
+1. Skips if `@mobb.ai/cli@<version>` is already on npm.
+2. `pnpm run build:binary:all` in `clients/cli` (Node SEA + postject).
+3. **Gate:** `pnpm run test:binary` in `clients/cli` — binary smoke tests +
+   Verdaccio publish → install (platform packages first, then `@mobb.ai/cli`
+   with optionalDependency resolution) and exit-code passthrough. No publish
+   if it fails.
+4. `scripts/prepare_publish.mjs` stages the artifacts, then publishes the
+   platform packages and `@mobb.ai/cli` last, so a published launcher can
+   always resolve its binaries.
+
+Run the tests locally: `pnpm run build:binary` in `clients/cli` (the host
+binary the e2e executes), then `pnpm run test:binary` there. On macOS use
+`build:binary`, not `build:binary:all` — the release matrix has no mac target,
+so `:all` leaves no host binary for the e2e to run.
+
+The build/packaging logic is JS: `clients/scripts/targets.mjs` (target matrix,
+platform↔slug mapping, shared version), `clients/cli/scripts/build_binary.mjs`
+(SEA build), `scripts/prepare_publish.mjs` (npm artifacts),
+`clients/cli/__e2e__/binary.mjs` (`node --test` e2e).
+
+## Environment variables
+
+| Variable | Set by | Purpose |
+| --- | --- | --- |
+| `MOBBDEV_MODULE_ROOT` | the binary itself (`src/sea_assets.ts`) | Where SEA-embedded assets (`package.json`, `.env`, protos) were materialized; `getModuleRootDir()` reads it. Not meant to be set by hand. |
+| `MOBB_SNYK_DOWNLOAD_BASE` | user | Mirror for Snyk's standalone CLI, default `https://downloads.snyk.io/cli`. Set it when that host is blocked — the binary has no bundled `snyk`, so `mobbdev scan --scanner snyk` downloads it (pinned version, checksum-verified, cached in `~/.mobb/tools/snyk/`). |

package/bin/mobbdev.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+'use strict'
+const binary = require('../lib/binary')
+
+try {
+  binary.run(process.argv.slice(2))
+} catch (err) {
+  console.error(String((err && err.message) || err))
+  process.exit(1)
+}

package/lib/binary.js

@@ -0,0 +1,52 @@
+'use strict'
+// @mobb.ai/cli launcher: resolves the platform binary installed by npm via
+// optionalDependencies (@mobb.ai/cli-<os>-<cpu>, gated by os/cpu fields so
+// npm installs exactly one) and forwards all arguments to it.
+//
+// No downloads, no checksums: the binary arrives through npm like any other
+// dependency, so registry mirrors / lockfile integrity already cover it.
+//
+// Zero runtime dependencies. Must stay runnable on Node >= 14: no ESM,
+// no syntax newer than what Node 14 parses.
+
+const { spawnSync } = require('child_process')
+
+// npm package slug uses macos/win (org convention); process.platform is
+// darwin/win32. Keep in sync with scripts/gen_platform_pkg.js.
+function npmOs() {
+  if (process.platform === 'darwin') return 'macos'
+  if (process.platform === 'win32') return 'win'
+  return process.platform
+}
+
+function getPlatformPackage() {
+  return '@mobb.ai/cli-' + npmOs() + '-' + process.arch
+}
+
+function getBinaryPath() {
+  const pkgName = getPlatformPackage()
+  const binName = process.platform === 'win32' ? 'mobbdev.exe' : 'mobbdev'
+  try {
+    return require.resolve(pkgName + '/' + binName)
+  } catch (e) {
+    throw new Error(
+      'Could not find the mobbdev binary package "' +
+        pkgName +
+        '".\n' +
+        'Either this platform is not supported by the binary distribution,\n' +
+        'or optional dependencies were skipped (npm install --no-optional).\n' +
+        'Reinstall with optional dependencies enabled, or use the regular\n' +
+        'npm package instead: npm install mobbdev (requires a supported Node.js).'
+    )
+  }
+}
+
+function run(args) {
+  const result = spawnSync(getBinaryPath(), args, { stdio: 'inherit' })
+  if (result.error) {
+    throw result.error
+  }
+  process.exit(result.status === null ? 1 : result.status)
+}
+
+module.exports = { run }

package/package.json

@@ -1,11 +1,29 @@
 {
   "name": "@mobb.ai/cli",
-  "version": "0.0.1",
-  "description": "",
-  "main": "index.js",
-  "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1"
+  "version": "1.4.49",
+  "description": "Binary distribution of mobbdev (Bugsy CLI). Installs a standalone, self-contained executable via npm — no Node.js version requirement, the binary embeds its own runtime. Same CLI, same commands as the mobbdev package.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/mobb-dev/bugsy.git"
+  },
+  "bin": {
+    "mobbdev": "bin/mobbdev.js"
+  },
+  "files": [
+    "bin",
+    "lib"
+  ],
+  "optionalDependencies": {
+    "@mobb.ai/cli-linux-arm64": "1.4.49",
+    "@mobb.ai/cli-linux-x64": "1.4.49",
+    "@mobb.ai/cli-win-x64": "1.4.49"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=14"
   },
   "author": "",
-  "license": "ISC"
+  "license": "MIT"
 }