@onebrain-ai/cli 3.0.0 → 3.1.0

package/README.md

@@ -53,6 +53,16 @@ The shim still runs but exits with `command not found` (127) until the binary is
 
 This is the first v3 release on npm. v2.x was the TypeScript/Bun implementation and is now deprecated — use this v3 package going forward. See the [v3.0.0 CHANGELOG](https://github.com/onebrain-ai/onebrain-cli/blob/main/CHANGELOG.md) for the full migration story.
 
+## Releasing
+
+Source for this package lives at `npm-wrapper/` in the [`onebrain-ai/onebrain-cli`](https://github.com/onebrain-ai/onebrain-cli) repository. Publishes happen automatically from the `npm-publish` job in `.github/workflows/release.yml` whenever a stable `vMAJOR.MINOR.PATCH` tag is pushed:
+
+1. The job uses npm Trusted Publishers (OIDC `id-token: write`) — there is no long-lived `NPM_TOKEN` secret to rotate.
+2. `npm version "$VERSION" --no-git-tag-version --allow-same-version` rewrites `package.json` to match the git tag, so the wrapper version always equals the binary release version.
+3. `npm publish --access public --provenance` ships the package with a Sigstore attestation linking it to the exact workflow run and commit.
+
+Tags containing `-` (e.g. `v3.0.1-rc.1`) are treated as prereleases and skip the npm publish step. Do not publish this package manually from a local clone — the trusted-publisher policy only honors publishes that originate from this workflow.
+
 ## License
 
 [AGPL-3.0-only](LICENSE) — matches the upstream CLI binary. If you make a modified version available to users over a network (AGPL §13 — SaaS, internal APIs, any networked interaction), you must release your modifications under the same license. For commercial licensing inquiries, contact [hello@onebrain.run](mailto:hello@onebrain.run).

package/bin/onebrain.js

@@ -20,7 +20,7 @@ const binaryPath = path.join(__dirname, binaryName);
 
 if (!fs.existsSync(binaryPath)) {
   console.error(`[@onebrain-ai/cli] Binary not found at ${binaryPath}`);
-  console.error('Re-run `npm install -g @onebrain-ai/cli` to download it,');
+  console.error('Re-run `npm install` (or `npm install -g @onebrain-ai/cli`) to download it,');
   console.error('or visit https://github.com/onebrain-ai/onebrain-cli/releases/latest');
   process.exit(127);
 }
@@ -30,4 +30,11 @@ if (child.error) {
   console.error('[@onebrain-ai/cli] Failed to exec:', child.error.message);
   process.exit(1);
 }
+// Signal-terminated child: re-raise on this process so the parent shell sees
+// the canonical `128 + signum` exit (Ctrl-C → SIGINT → 130, SIGTERM → 143).
+// Without this, CI tooling can't distinguish a user interrupt from a real
+// error — both would collapse to exit 1.
+if (child.signal) {
+  process.kill(process.pid, child.signal);
+}
 process.exit(child.status ?? 1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onebrain-ai/cli",
-  "version": "3.0.0",
+  "version": "3.1.0",
   "description": "Local-first Rust CLI for OneBrain — personal AI OS for Obsidian. Downloads the matching platform binary from GitHub Releases on install.",
   "keywords": [
     "onebrain",
@@ -35,7 +35,7 @@
     "postinstall": "node postinstall.js"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=20"
   },
   "os": [
     "darwin",

package/postinstall.js

@@ -2,21 +2,32 @@
 /**
  * @onebrain-ai/cli postinstall — downloads the matching platform binary
  * from the OneBrain CLI GitHub Release tagged v${pkg.version}, extracts it
- * to ./bin/, and chmods the result.
+ * to ./bin/, verifies SHA256, smoke-runs the binary, and chmods the result.
  *
  * No npm-side caching of binaries — every install pulls fresh from GitHub
  * (matches the rustup / esbuild / swc pattern). For a faster install path,
  * see the optionalDependencies-per-platform layout we may switch to in
  * v3.0.x.
  *
- * Bypass: set ONEBRAIN_CLI_SKIP_POSTINSTALL=1 to skip the download (useful
- * for CI environments that supply their own binary).
+ * Knobs:
+ *   ONEBRAIN_CLI_SKIP_POSTINSTALL=1  — skip the download entirely (for CI
+ *                                       environments that supply their own
+ *                                       binary).
+ *   ONEBRAIN_CLI_LIBC=glibc|musl     — override Linux libc auto-detection.
+ *   ONEBRAIN_CLI_ARM=v6|v7           — override 32-bit ARM version detect.
+ *   ONEBRAIN_CLI_DEBUG=1             — verbose logging (cleanup, libc probe).
+ *
+ * Telemetry: every fetch sends `User-Agent: onebrain-cli-postinstall/$VERSION`
+ * to GitHub. This is the only telemetry the postinstall emits; opt out by
+ * either setting ONEBRAIN_CLI_SKIP_POSTINSTALL=1 or downloading the binary
+ * manually from the GitHub Release.
  */
 'use strict';
 
 const fs = require('node:fs');
 const path = require('node:path');
 const https = require('node:https');
+const crypto = require('node:crypto');
 const { execFileSync } = require('node:child_process');
 
 if (process.env.ONEBRAIN_CLI_SKIP_POSTINSTALL) {
@@ -26,7 +37,11 @@ if (process.env.ONEBRAIN_CLI_SKIP_POSTINSTALL) {
 
 const pkg = require('./package.json');
 const VERSION = pkg.version;
+const DEBUG = !!process.env.ONEBRAIN_CLI_DEBUG;
 
+// The fixed-target host map — Linux + arm32 + musl rows live in resolveTriple
+// because they need runtime detection. This table is the "no detection needed"
+// fast path.
 const TRIPLE_MAP = {
   'darwin-arm64': 'aarch64-apple-darwin',
   'darwin-x64':   'x86_64-apple-darwin',
@@ -36,15 +51,7 @@ const TRIPLE_MAP = {
   'win32-x64':    'x86_64-pc-windows-msvc',
 };
 
-const key = `${process.platform}-${process.arch}`;
-const triple = TRIPLE_MAP[key];
-if (!triple) {
-  console.error(`[@onebrain-ai/cli] Unsupported platform: ${key}`);
-  console.error('Supported: ' + Object.keys(TRIPLE_MAP).join(', '));
-  console.error('Manual download: https://github.com/onebrain-ai/onebrain-cli/releases/latest');
-  process.exit(1);
-}
-
+const triple = resolveTriple();
 const isWin = process.platform === 'win32';
 const archiveExt = isWin ? 'zip' : 'tar.gz';
 const archiveName = `onebrain-${triple}.${archiveExt}`;
@@ -58,17 +65,36 @@ const archivePath = path.join(root, archiveName);
 console.log(`[@onebrain-ai/cli] Downloading v${VERSION} for ${triple} ...`);
 console.log(`  ${url}`);
 
-downloadFile(url, archivePath).then(() => {
-  console.log('[@onebrain-ai/cli] Extracting ...');
-  // `tar` ships on macOS, Linux, and Windows 10+ (bsdtar). Spawn it via
-  // execFileSync — argv form so the path is never shell-interpolated.
-  if (isWin) {
-    // Windows zip — bsdtar auto-detects format.
-    execFileSync('tar', ['-xf', archivePath, '-C', binDir], { stdio: 'inherit' });
-  } else {
-    execFileSync('tar', ['-xzf', archivePath, '-C', binDir], { stdio: 'inherit' });
+downloadFile(url, archivePath).then(async () => {
+  try {
+    // Supply-chain integrity: verify the downloaded archive against the
+    // `.sha256` published alongside it in the same GitHub Release. The
+    // release workflow generates both files in the same job, so a mismatch
+    // indicates either archive corruption or tampering between GitHub's
+    // S3 CDN and this host. This closes the gap between the OIDC-attested
+    // wrapper publish and the binary the postinstall actually executes.
+    console.log('[@onebrain-ai/cli] Verifying SHA256 ...');
+    const sha256Body = await downloadText(`${url}.sha256`);
+    const expectedHash = sha256Body.trim().split(/\s+/)[0].toLowerCase();
+    const actualHash = crypto.createHash('sha256')
+      .update(fs.readFileSync(archivePath))
+      .digest('hex');
+    if (!expectedHash || expectedHash !== actualHash) {
+      throw new Error(`SHA256 mismatch — expected ${expectedHash || '<empty>'}, got ${actualHash}. Archive may be corrupt or tampered.`);
+    }
+
+    console.log('[@onebrain-ai/cli] Extracting ...');
+    extractArchive(archivePath, binDir);
+  } finally {
+    // Always remove the archive — failed verification or extraction
+    // shouldn't leave half-staged files lingering in node_modules/.
+    if (fs.existsSync(archivePath)) {
+      try { fs.unlinkSync(archivePath); }
+      catch (err) {
+        if (DEBUG) console.warn(`[@onebrain-ai/cli] archive cleanup failed: ${err.message}`);
+      }
+    }
   }
-  fs.unlinkSync(archivePath);
 
   const binaryName = isWin ? 'onebrain.exe' : 'onebrain';
   const binaryPath = path.join(binDir, binaryName);
@@ -79,24 +105,219 @@ downloadFile(url, archivePath).then(() => {
   if (!isWin) {
     fs.chmodSync(binaryPath, 0o755);
   }
-  console.log(`[@onebrain-ai/cli] Installed onebrain v${VERSION} → ${binaryPath}`);
+
+  // Smoke-run the binary so a wrong-libc / wrong-arch download fails at
+  // install time with an actionable error instead of segfaulting at first
+  // user invocation. ~30-80 ms cost, catches every silent install bug from
+  // the detector layer above.
+  try {
+    const out = execFileSync(binaryPath, ['--version'], {
+      stdio: ['ignore', 'pipe', 'pipe'],
+      timeout: 10_000,
+    }).toString().trim();
+    console.log(`[@onebrain-ai/cli] Installed ${out} → ${binaryPath}`);
+  } catch (err) {
+    console.error(`[@onebrain-ai/cli] Binary installed but failed to run: ${err.message}`);
+    console.error('This usually means the wrong libc/arch variant was selected for your host.');
+    console.error('Override with one of:');
+    if (process.platform === 'linux' && process.arch === 'arm') {
+      console.error('  ONEBRAIN_CLI_ARM=v6 npm install @onebrain-ai/cli   # for older ARM (Pi 1 / Pi Zero)');
+      console.error('  ONEBRAIN_CLI_ARM=v7 npm install @onebrain-ai/cli   # for 32-bit Pi 2/3/4');
+    } else if (process.platform === 'linux') {
+      console.error('  ONEBRAIN_CLI_LIBC=musl npm install @onebrain-ai/cli');
+      console.error('  ONEBRAIN_CLI_LIBC=glibc npm install @onebrain-ai/cli');
+    }
+    console.error('Set ONEBRAIN_CLI_DEBUG=1 to see which detector path fired.');
+    process.exit(1);
+  }
 }).catch((err) => {
   console.error('[@onebrain-ai/cli] Install failed:', err.message);
+  console.error('Possible causes: package.json version mismatches a published release, release was yanked,');
+  console.error('CDN propagation lag, or this platform variant is not yet built.');
   console.error('Manual download: https://github.com/onebrain-ai/onebrain-cli/releases/latest');
   process.exit(1);
 });
 
-function downloadFile(url, dest, redirects = 5) {
+// resolveTriple picks the Rust target triple for the current host. On Linux
+// the choice between glibc/musl and ARMv6/ARMv7 is dynamic — Alpine and
+// other musl-based distros need the musl-linked binary or they'll fail at
+// runtime when the dynamic loader can't resolve glibc symbols. Raspberry Pi
+// devices span ARMv6 (Pi 1, Pi Zero) through ARMv8 (Pi 5) and the wrong
+// binary segfaults with an illegal-instruction trap.
+function resolveTriple() {
+  if (process.platform === 'linux') {
+    if (process.arch === 'arm') {
+      return resolveArmTriple();
+    }
+    const libc = resolveLinuxLibc();
+    if (libc === 'musl') {
+      if (process.arch === 'x64') return 'x86_64-unknown-linux-musl';
+      console.error(`[@onebrain-ai/cli] Unsupported platform: linux-${process.arch}-musl`);
+      console.error('Only x86_64 musl is published. Build from source or use a glibc-based distro:');
+      console.error('  https://github.com/onebrain-ai/onebrain-cli');
+      process.exit(1);
+    }
+  }
+
+  const key = `${process.platform}-${process.arch}`;
+  const triple = TRIPLE_MAP[key];
+  if (!triple) {
+    console.error(`[@onebrain-ai/cli] Unsupported platform: ${key}`);
+    console.error('Supported: ' + Object.keys(TRIPLE_MAP).join(', '));
+    console.error('Manual download: https://github.com/onebrain-ai/onebrain-cli/releases/latest');
+    process.exit(1);
+  }
+  return triple;
+}
+
+// resolveLinuxLibc returns 'musl' or 'glibc'. Override via ONEBRAIN_CLI_LIBC.
+// Detection layers (positive-verification — never silently fall through):
+//   1. Env override — always wins.
+//   2. /etc/alpine-release — definitive Alpine signal.
+//   3. process.report.header.glibcVersionRuntime — empty string on musl,
+//      a version like "2.39" on glibc (stable in Node 14+).
+// On a fully unknown Node build (process.report missing, no /etc/alpine-release)
+// we WARN and default to 'glibc' — the user can override via env if the guess
+// is wrong instead of the postinstall installing the wrong binary silently.
+function resolveLinuxLibc() {
+  const override = process.env.ONEBRAIN_CLI_LIBC;
+  if (override === 'musl' || override === 'glibc') {
+    if (DEBUG) console.log(`[@onebrain-ai/cli] libc override: ${override}`);
+    return override;
+  }
+
+  try {
+    if (fs.existsSync('/etc/alpine-release')) return 'musl';
+  } catch (err) {
+    if (DEBUG) console.warn(`[@onebrain-ai/cli] libc probe (alpine-release): ${err.message}`);
+  }
+
+  try {
+    if (typeof process.report?.getReport === 'function') {
+      const header = process.report.getReport()?.header;
+      if (header && typeof header.glibcVersionRuntime === 'string') {
+        return header.glibcVersionRuntime === '' ? 'musl' : 'glibc';
+      }
+      // Report exists but the field shape is unfamiliar — likely a future
+      // Node version restructured it. Don't guess; warn and let the smoke
+      // test catch a wrong choice.
+      console.warn('[@onebrain-ai/cli] libc detector: process.report shape unrecognised, defaulting to glibc.');
+      console.warn('  Override with ONEBRAIN_CLI_LIBC=musl if this is an Alpine/musl host.');
+      return 'glibc';
+    }
+  } catch (err) {
+    if (DEBUG) console.warn(`[@onebrain-ai/cli] libc probe (process.report): ${err.message}`);
+  }
+
+  console.warn('[@onebrain-ai/cli] libc detector: no probe succeeded, defaulting to glibc.');
+  console.warn('  Override with ONEBRAIN_CLI_LIBC=musl if this is an Alpine/musl host.');
+  return 'glibc';
+}
+
+// resolveArmTriple picks between armv6 (Pi 1, Pi Zero) and armv7
+// (Pi 2/3/4 in 32-bit OS, Pi Zero 2 W in 32-bit OS) for Linux 32-bit ARM.
+// Override via ONEBRAIN_CLI_ARM=v6 or v7.
+//
+// Conservative default = ARMv6 because an ARMv6 binary runs on ARMv7 hosts
+// but an ARMv7 binary crashes with SIGILL on ARMv6 hosts. We sacrifice some
+// performance on Pi 4 32-bit for correctness on Pi Zero.
+function resolveArmTriple() {
+  const override = process.env.ONEBRAIN_CLI_ARM;
+  if (override === 'v7') return 'armv7-unknown-linux-gnueabihf';
+  if (override === 'v6') return 'arm-unknown-linux-gnueabihf';
+
+  // process.config.variables.arm_version is set at Node build time:
+  // '6' on Node's armv6l build, '7' on armv7l, missing on builds without
+  // ARM-specific flags.
+  const armVersion = process.config?.variables?.arm_version;
+  if (armVersion === '7') return 'armv7-unknown-linux-gnueabihf';
+  if (armVersion === '6') return 'arm-unknown-linux-gnueabihf';
+
+  // Fall back to /proc/cpuinfo. CHECK ORDER MATTERS: the kernel reports
+  // `CPU architecture: 7` even on Pi 1 / Pi Zero (ARM1176 cores) because the
+  // chip supports VMSAv7 (virtual memory arch) despite the instruction-set
+  // being ARMv6. So the `CPU architecture` line cannot be trusted on its own.
+  // The `model name` line ("ARMv6-compatible processor" on Pi Zero) is the
+  // reliable signal, and we check it FIRST.
+  try {
+    const cpuinfo = fs.readFileSync('/proc/cpuinfo', 'utf8');
+    if (/ARMv6|ARM1176|ARM11\b/i.test(cpuinfo)) {
+      return 'arm-unknown-linux-gnueabihf';
+    }
+    if (/ARMv7|Cortex-A[789]|Cortex-A1[5-7]/i.test(cpuinfo) || /CPU architecture:\s*7/m.test(cpuinfo)) {
+      return 'armv7-unknown-linux-gnueabihf';
+    }
+  } catch (err) {
+    if (DEBUG) console.warn(`[@onebrain-ai/cli] arm probe (cpuinfo): ${err.message}`);
+  }
+
+  console.warn('[@onebrain-ai/cli] ARM version detection inconclusive — defaulting to ARMv6 (compatible everywhere, slower on Pi 4).');
+  console.warn('  Override with ONEBRAIN_CLI_ARM=v7 to force the ARMv7 binary.');
+  return 'arm-unknown-linux-gnueabihf';
+}
+
+// extractArchive unpacks .tar.gz on Unix and .zip on Windows. The Windows
+// path tries bsdtar first (ships on Windows 10 1803+) and falls back to
+// PowerShell Expand-Archive for older hosts. PowerShell paths use
+// -LiteralPath to avoid wildcard expansion on '[' or ']' and are escaped
+// for single-quote literals — '' is PowerShell's only single-quote escape
+// inside a '...'-string, so `escapePsSingleQuoted` closes off injection.
+function extractArchive(archive, destDir) {
+  if (!isWin) {
+    execFileSync('tar', ['-xzf', archive, '-C', destDir], { stdio: 'inherit' });
+    return;
+  }
+
+  try {
+    execFileSync('tar', ['-xf', archive, '-C', destDir], { stdio: 'inherit' });
+  } catch (err) {
+    // ANY tar failure on Windows falls back to PowerShell — the archive
+    // already passed SHA256, so a tar error means either tar.exe is missing
+    // (pre-1803 Windows 10, ENOENT) or PATH points at GNU tar from MSYS2 /
+    // Git-for-Windows / Cygwin (which doesn't grok .zip and exits non-zero).
+    // Expand-Archive ships with PowerShell 5.1 on every Windows 10+ host.
+    const reason = err.code || err.message;
+    console.log(`[@onebrain-ai/cli] tar failed (${reason}), falling back to PowerShell Expand-Archive ...`);
+    const escapedArchive = escapePsSingleQuoted(archive);
+    const escapedDest = escapePsSingleQuoted(destDir);
+    const command = `$ErrorActionPreference='Stop'; Expand-Archive -LiteralPath '${escapedArchive}' -DestinationPath '${escapedDest}' -Force`;
+    execFileSync(
+      'powershell.exe',
+      ['-NoProfile', '-NonInteractive', '-Command', command],
+      { stdio: 'inherit' }
+    );
+  }
+}
+
+function escapePsSingleQuoted(s) {
+  return s.replace(/'/g, "''");
+}
+
+// downloadFile streams a binary to disk. Follows GitHub's redirect chain
+// (S3 CDN) and retries on 404 with exponential backoff — after `npm publish`
+// the wrapper can be live before the release CDN has fanned out, so a fresh
+// `npm install` can race the binary. Three retries at 2s/4s/8s = 14s total
+// covers the worst observed lag. The same 404 also fires for permanent
+// failures (wrong version, yanked release, missing platform variant) — the
+// final reject path elaborates on the possible causes.
+function downloadFile(url, dest, redirects = 5, retries = 3, backoffMs = 2000) {
   return new Promise((resolve, reject) => {
     https.get(url, { headers: { 'User-Agent': `onebrain-cli-postinstall/${VERSION}` } }, (res) => {
-      // GitHub Release downloads always redirect to S3 — follow.
       if ([301, 302, 303, 307, 308].includes(res.statusCode)) {
         if (redirects <= 0) {
           reject(new Error('Too many redirects'));
           return;
         }
         res.resume();
-        downloadFile(res.headers.location, dest, redirects - 1).then(resolve, reject);
+        downloadFile(res.headers.location, dest, redirects - 1, retries, backoffMs).then(resolve, reject);
+        return;
+      }
+      if (res.statusCode === 404 && retries > 0) {
+        res.resume();
+        console.log(`[@onebrain-ai/cli]   binary not yet on CDN, retrying in ${backoffMs}ms ...`);
+        setTimeout(() => {
+          downloadFile(url, dest, redirects, retries - 1, backoffMs * 2).then(resolve, reject);
+        }, backoffMs);
         return;
       }
       if (res.statusCode !== 200) {
@@ -110,3 +331,42 @@ function downloadFile(url, dest, redirects = 5) {
     }).on('error', reject);
   });
 }
+
+// downloadText follows the same redirect + retry chain as downloadFile but
+// buffers the body into a UTF-8 string. Used for small metadata files
+// (currently the `.sha256` checksum next to each release archive). Don't
+// use it for binaries — the body lives in memory for the duration of the
+// request. Inherits the same 404 retry policy since the .sha256 is
+// published in the same Release as the archive and CDN-lags together.
+function downloadText(url, redirects = 5, retries = 3, backoffMs = 2000) {
+  return new Promise((resolve, reject) => {
+    https.get(url, { headers: { 'User-Agent': `onebrain-cli-postinstall/${VERSION}` } }, (res) => {
+      if ([301, 302, 303, 307, 308].includes(res.statusCode)) {
+        if (redirects <= 0) {
+          reject(new Error('Too many redirects'));
+          return;
+        }
+        res.resume();
+        downloadText(res.headers.location, redirects - 1, retries, backoffMs).then(resolve, reject);
+        return;
+      }
+      if (res.statusCode === 404 && retries > 0) {
+        res.resume();
+        console.log(`[@onebrain-ai/cli]   sha256 not yet on CDN, retrying in ${backoffMs}ms ...`);
+        setTimeout(() => {
+          downloadText(url, redirects, retries - 1, backoffMs * 2).then(resolve, reject);
+        }, backoffMs);
+        return;
+      }
+      if (res.statusCode !== 200) {
+        reject(new Error(`HTTP ${res.statusCode} fetching ${url}`));
+        return;
+      }
+      let body = '';
+      res.setEncoding('utf8');
+      res.on('data', (chunk) => { body += chunk; });
+      res.on('end', () => resolve(body));
+      res.on('error', reject);
+    }).on('error', reject);
+  });
+}