@mutagent/cli 0.1.197 → 0.1.198

package/dist/bin/cli.js

@@ -728,8 +728,8 @@ var init_sdk_client = __esm(() => {
 // src/bin/cli.ts
 import { Command as Command12 } from "commander";
 import chalk18 from "chalk";
-import { readFileSync as readFileSync8, existsSync as existsSync9 } from "fs";
-import { join as join11, dirname as dirname3 } from "path";
+import { readFileSync as readFileSync9, existsSync as existsSync10 } from "fs";
+import { join as join12, dirname as dirname3 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/commands/auth.ts
@@ -3099,7 +3099,8 @@ name: mutagent-cli-workflows-install
 description: |
   Meta-installer workflow. Installs a MutagenT package (helix, diagnostics, or
   evaluator) into the user's environment via \`mutagent install <package>\`.
-  Login-gated. diagnostics/evaluator come from public npm; helix self-hosts.
+  Login-gated. diagnostics/evaluator come from public npm; helix is fetched
+  from a private registry via a login-brokered signed URL (no static secret).
 triggers:
   - "install diagnostics"
   - "install evaluator"
@@ -3138,7 +3139,7 @@ Where \`<package>\` is one of:
 |---|---|---|
 | \`diagnostics\` | public npm \`@mutagent/diagnostics\` | Ready to install |
 | \`evaluator\` | public npm \`@mutagent/evaluator\` | Ready to install |
-| \`helix\` | self-hosted install | Pending — may return \`NOT_IMPLEMENTED\` for now |
+| \`helix\` | private registry via login-brokered signed URL | Ready to install — login-gated download, sha256-verified, then initialized into your project |
 
 **Flags** (verify against \`--help\`):
 - \`--harness <claude-code|codex|omp>\` -- target coding-agent harness (default \`claude-code\`).
@@ -3171,6 +3172,8 @@ Where \`<package>\` is one of:
 ## Examples
 
 \`\`\`bash
+mutagent install helix --json
+mutagent install helix --harness codex --json
 mutagent install diagnostics --json
 mutagent install evaluator --version 1.2.3 --json
 mutagent install diagnostics --harness codex --json
@@ -3181,15 +3184,15 @@ mutagent install diagnostics --harness codex --json
 ## Output handling
 
 - On success (\`{ success: true, package, version, harness, global }\`): tell the user what was installed and the resolved version. Surface \`_links.install\` / \`_links.login\`.
-- If \`helix\` returns \`NOT_IMPLEMENTED\`: explain that self-hosted helix install is still pending (tracked upstream) and suggest \`diagnostics\` / \`evaluator\`, which install from public npm today.
-- On an auth error: route to the login workflow, then retry.
+- For \`helix\`: the CLI resolves a signed download URL from the login broker, downloads + sha256-verifies the plugin, then runs its init into the project. An \`INTEGRITY_ERROR\` means the download failed checksum verification — retry.
+- On an auth error (including a broker \`AUTH_REQUIRED\`): route to the login workflow, then retry.
 
 ---
 
 ## Common pitfalls
 
 - Running before login → auth error (install is login-gated).
-- Assuming \`helix\` installs like the npm packages — it self-hosts and may not be wired yet.
+- Assuming \`helix\` installs from public npm — it is fetched from a private registry via a login-brokered signed URL (the CLI holds no static secret).
 - Installing without confirming with the user first (Core Rule 5).
 
 ---
@@ -4723,7 +4726,229 @@ init_errors();
 // src/lib/installer.ts
 init_errors();
 init_config();
+import { spawn as spawn2 } from "child_process";
+
+// src/lib/installer-helix.ts
+init_errors();
+init_config();
 import { spawn } from "child_process";
+import { createHash } from "crypto";
+import { homedir as homedir2 } from "os";
+import { join as join11 } from "path";
+import {
+  existsSync as existsSync9,
+  mkdirSync as mkdirSync5,
+  readFileSync as readFileSync8,
+  renameSync as renameSync2,
+  rmSync,
+  writeFileSync as writeFileSync6
+} from "fs";
+async function installHelix(opts, deps = {}) {
+  const auth = (deps.resolveAuth ?? defaultResolveAuth)();
+  const fetchImpl = deps.fetchImpl ?? globalThis.fetch;
+  const descriptor = await fetchDescriptor(fetchImpl, auth, opts.version);
+  const baseDir = deps.homeDir ?? join11(homedir2(), ".mutagent", "helix");
+  const versionDir = join11(baseDir, descriptor.version);
+  mkdirSync5(versionDir, { recursive: true });
+  const tgzPath = join11(versionDir, `helix-plugin-${descriptor.version}.tgz`);
+  const tmpPath = `${tgzPath}.${String(process.pid)}.${String(Date.now())}.part`;
+  const download = deps.download ?? defaultDownload;
+  await download(descriptor.url, tmpPath);
+  const sha256 = deps.sha256 ?? defaultSha256;
+  const actual = (await sha256(tmpPath)).toLowerCase();
+  const expected = descriptor.sha256.toLowerCase();
+  if (actual !== expected) {
+    safeRm(tmpPath);
+    throw new MutagentError("INTEGRITY_ERROR", `Downloaded helix plugin failed sha256 verification (expected ${expected.slice(0, 12)}…, got ${actual.slice(0, 12)}…).`, "The download may be corrupt or tampered with. Retry: mutagent install helix");
+  }
+  renameSync2(tmpPath, tgzPath);
+  const extract = deps.extract ?? defaultExtract;
+  await extract(tgzPath, versionDir);
+  const locateInitBin = deps.locateInitBin ?? defaultLocateInitBin;
+  const binPath = await locateInitBin(versionDir);
+  const initArgs = ["init", "--harness", opts.harness];
+  if (opts.global)
+    initArgs.push("--global");
+  const runInit = deps.runInit ?? defaultRunInit;
+  const code = await runInit(binPath, initArgs, process.cwd());
+  if (code !== 0) {
+    throw new MutagentError("INSTALL_FAILED", `helix plugin init exited with code ${String(code)}.`, "Re-run: mutagent install helix — or run the plugin init manually and report the error.");
+  }
+  await postTelemetry(fetchImpl, auth, {
+    pkg: "helix",
+    version: descriptor.version,
+    harness: opts.harness,
+    cliVersion: deps.cliVersion ?? readCliVersion()
+  });
+  return { version: descriptor.version };
+}
+async function fetchDescriptor(fetchImpl, auth, version) {
+  if (!auth.apiKey) {
+    throw new MutagentError("AUTH_REQUIRED", "Authentication required to install helix.", "Run: mutagent login");
+  }
+  const url = `${auth.apiBase}/api/helix/plugin/download?version=${encodeURIComponent(version)}`;
+  let res;
+  try {
+    res = await fetchImpl(url, {
+      method: "GET",
+      headers: { "x-api-key": auth.apiKey, ...auth.headers }
+    });
+  } catch {
+    throw new MutagentError("SERVER_UNAVAILABLE", "Could not reach the MutagenT plugin broker.", "Check your network connection or verify the endpoint with: mutagent config show");
+  }
+  if (res.status === 401) {
+    throw new MutagentError("AUTH_REQUIRED", "The plugin broker rejected your credentials.", "Re-authenticate: mutagent login");
+  }
+  if (!res.ok) {
+    const detail = await readErrorMessage(res);
+    throw new MutagentError("INSTALL_FAILED", `Plugin broker returned ${String(res.status)}.${detail ? ` ${detail}` : ""}`, "Verify the requested version exists, then retry: mutagent install helix");
+  }
+  const raw = await res.json();
+  if (!isBrokerResponse(raw)) {
+    throw new MutagentError("INSTALL_FAILED", "Plugin broker returned a malformed response (missing version/sha256/url).", "Retry: mutagent install helix — if it persists, report it.");
+  }
+  return raw;
+}
+async function postTelemetry(fetchImpl, auth, event) {
+  if (!auth.apiKey)
+    return;
+  try {
+    await fetchImpl(`${auth.apiBase}/api/helix/installs`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "x-api-key": auth.apiKey,
+        ...auth.headers
+      },
+      body: JSON.stringify(event)
+    });
+  } catch {}
+}
+function defaultResolveAuth() {
+  const apiKey = getApiKey();
+  const config = loadConfig();
+  const apiBase = config.endpoint ?? "https://api.mutagent.io";
+  const headers = {};
+  if (config.defaultWorkspace)
+    headers["x-workspace-id"] = config.defaultWorkspace;
+  if (config.defaultOrganization)
+    headers["x-organization-id"] = config.defaultOrganization;
+  return { apiBase, apiKey, headers };
+}
+async function defaultDownload(url, destPath) {
+  let res;
+  try {
+    res = await globalThis.fetch(url);
+  } catch {
+    throw new MutagentError("SERVER_UNAVAILABLE", "Failed to download the helix plugin from storage.", "Check your network connection and retry: mutagent install helix");
+  }
+  if (!res.ok) {
+    throw new MutagentError("INSTALL_FAILED", `Plugin download failed with status ${String(res.status)}.`, "The signed URL may have expired — retry: mutagent install helix");
+  }
+  const bytes = Buffer.from(await res.arrayBuffer());
+  writeFileSync6(destPath, bytes);
+}
+async function defaultSha256(filePath) {
+  return Promise.resolve(createHash("sha256").update(readFileSync8(filePath)).digest("hex"));
+}
+function defaultExtract(tgzPath, destDir) {
+  return new Promise((resolve, reject) => {
+    const child = spawn("tar", ["-xzf", tgzPath, "-C", destDir], {
+      stdio: ["ignore", "ignore", "pipe"]
+    });
+    let stderr = "";
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString("utf-8");
+    });
+    child.on("error", (err) => {
+      reject(new MutagentError("INSTALL_FAILED", `Failed to extract the helix plugin: ${err.message}`, 'Ensure "tar" is installed and available on your PATH.'));
+    });
+    child.on("close", (code) => {
+      if (code === 0) {
+        resolve();
+      } else {
+        reject(new MutagentError("INSTALL_FAILED", `Extracting the helix plugin failed (tar exit ${String(code ?? 1)}).${stderr ? ` ${stderr.trim().slice(0, 200)}` : ""}`, "The downloaded archive may be corrupt — retry: mutagent install helix"));
+      }
+    });
+  });
+}
+function defaultLocateInitBin(extractedDir) {
+  const pkgDir = existsSync9(join11(extractedDir, "package", "package.json")) ? join11(extractedDir, "package") : extractedDir;
+  const pkgJsonPath = join11(pkgDir, "package.json");
+  if (!existsSync9(pkgJsonPath)) {
+    return Promise.reject(new MutagentError("INSTALL_FAILED", "Could not find package.json in the extracted helix plugin.", "The archive layout is unexpected — retry or report: mutagent install helix"));
+  }
+  const raw = JSON.parse(readFileSync8(pkgJsonPath, "utf-8"));
+  const binRel = resolveBinField(raw);
+  if (!binRel) {
+    return Promise.reject(new MutagentError("INSTALL_FAILED", "The helix plugin package.json declares no runnable bin.", "The plugin package is malformed — report: mutagent install helix"));
+  }
+  const binPath = join11(pkgDir, binRel);
+  if (!existsSync9(binPath)) {
+    return Promise.reject(new MutagentError("INSTALL_FAILED", `The helix plugin bin was not found at ${binRel}.`, "The plugin package is incomplete — report: mutagent install helix"));
+  }
+  return Promise.resolve(binPath);
+}
+function defaultRunInit(binPath, args, cwd) {
+  return new Promise((resolve, reject) => {
+    const child = spawn("node", [binPath, ...args], { cwd, stdio: "inherit" });
+    child.on("error", (err) => {
+      reject(new MutagentError("INSTALL_FAILED", `Failed to run the helix plugin init: ${err.message}`, 'Ensure "node" is installed and available on your PATH.'));
+    });
+    child.on("close", (code) => {
+      resolve(code ?? 1);
+    });
+  });
+}
+function resolveBinField(pkg) {
+  if (!pkg || typeof pkg !== "object")
+    return;
+  const bin = pkg.bin;
+  if (typeof bin === "string")
+    return bin;
+  if (bin && typeof bin === "object") {
+    const entries = bin;
+    const preferred = entries["mutagent-helix"];
+    if (typeof preferred === "string")
+      return preferred;
+    for (const value of Object.values(entries)) {
+      if (typeof value === "string")
+        return value;
+    }
+  }
+  return;
+}
+function isBrokerResponse(value) {
+  if (!value || typeof value !== "object")
+    return false;
+  const v = value;
+  return typeof v.version === "string" && typeof v.sha256 === "string" && typeof v.url === "string";
+}
+async function readErrorMessage(res) {
+  try {
+    const body = await res.json();
+    if (body && typeof body === "object") {
+      const b = body;
+      if (typeof b.message === "string")
+        return b.message;
+      if (typeof b.error === "string")
+        return b.error;
+    }
+  } catch {}
+  return;
+}
+function readCliVersion() {
+  if (process.env.CLI_VERSION)
+    return process.env.CLI_VERSION;
+  return "unknown";
+}
+function safeRm(path) {
+  try {
+    rmSync(path, { force: true });
+  } catch {}
+}
+
+// src/lib/installer.ts
 var VALID_PACKAGES = ["helix", "diagnostics", "evaluator"];
 var VALID_HARNESSES = ["claude-code", "codex", "omp"];
 var VERSION_MATRIX = {
@@ -4736,7 +4961,7 @@ var NPM_PACKAGES = {
   evaluator: "@mutagent/evaluator"
 };
 var defaultRunner = (cmd, args) => new Promise((resolve, reject) => {
-  const child = spawn(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
+  const child = spawn2(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
   let stdout = "";
   let stderr = "";
   child.stdout.on("data", (chunk) => {
@@ -4771,7 +4996,13 @@ async function installPackage(pkg, opts, deps = {}) {
   }
   const version = opts.version ?? VERSION_MATRIX[pkg];
   if (pkg === "helix") {
-    throw new MutagentError("NOT_IMPLEMENTED", "helix self-host install is not available yet — hosting on install.mutagent.io is pending (see issue #1191, task CI1).", "Track: gh issue view 1191. For now install diagnostics/evaluator via npm.");
+    const { version: resolved } = await installHelix({ harness: opts.harness, global: opts.global, version }, deps.helix ?? {});
+    return {
+      package: pkg,
+      version: resolved,
+      harness: opts.harness,
+      global: opts.global
+    };
   }
   const npmPackage = NPM_PACKAGES[pkg];
   const args = ["install", "-g", `${npmPackage}@${version}`];
@@ -4801,15 +5032,18 @@ ${chalk17.bold("Arguments & flags:")}
   ${chalk17.bold("--json")}               Structured output
 
 ${chalk17.bold("Examples:")}
+  ${chalk17.dim("$")} mutagent install helix
+  ${chalk17.dim("$")} mutagent install helix --harness codex
   ${chalk17.dim("$")} mutagent install diagnostics
   ${chalk17.dim("$")} mutagent install evaluator --version 1.2.3
   ${chalk17.dim("$")} mutagent install diagnostics --harness codex --json
 
 ${chalk17.bold("Packages:")}
+  ${chalk17.bold("helix")}        ${chalk17.green("(available)")} — the ADL conductor. Downloaded from a private
+                 registry via a login-brokered signed URL, sha256-verified, then
+                 initialized into your project. No static secret ships in the CLI.
   ${chalk17.bold("diagnostics")}  Public npm package @mutagent/diagnostics ${chalk17.green("(available)")}
   ${chalk17.bold("evaluator")}    Public npm package @mutagent/evaluator ${chalk17.green("(available)")}
-  ${chalk17.bold("helix")}        ${chalk17.yellow("NOT yet available")} — self-host on install.mutagent.io is pending (#1191).
-                 Running it today errors with ${chalk17.bold("NOT_IMPLEMENTED")} by design (no fake install).
 
 ${chalk17.yellow("Note:")} install is login-gated. Run ${chalk17.cyan("mutagent login")} first (else exits with a login directive).
     `).action(async (pkg, options) => {
@@ -4847,8 +5081,8 @@ if (process.env.CLI_VERSION) {
 } else {
   try {
     const __dirname2 = dirname3(fileURLToPath2(import.meta.url));
-    const pkgPath = join11(__dirname2, "..", "..", "package.json");
-    const pkg = JSON.parse(readFileSync8(pkgPath, "utf-8"));
+    const pkgPath = join12(__dirname2, "..", "..", "package.json");
+    const pkg = JSON.parse(readFileSync9(pkgPath, "utf-8"));
     cliVersion = pkg.version ?? cliVersion;
   } catch {}
 }
@@ -4965,12 +5199,12 @@ program.addCommand(createFeedbackCommand());
 var isInteractive = process.stdin.isTTY && !rawArgs.includes("--json") && process.env.CI !== "true";
 var isSkillCommand = rawArgs[0] === "skills" || rawArgs[0] === "hooks";
 if (isInteractive && !isSkillCommand) {
-  const skillPath = join11(process.cwd(), ".claude/skills/mutagent-cli/SKILL.md");
-  if (!existsSync9(skillPath)) {
+  const skillPath = join12(process.cwd(), ".claude/skills/mutagent-cli/SKILL.md");
+  if (!existsSync10(skillPath)) {
     console.log(chalk18.dim("MutagenT SKILL not installed. Install it for AI agent support? Run:"), chalk18.cyan("mutagent skills install"));
   }
 }
 program.parse();
 
-//# debugId=9788EBFA942A533664756E2164756E21
+//# debugId=9CA84168C389E42C64756E2164756E21
 //# sourceMappingURL=cli.js.map