@pinchpass/cli 1.1.0 → 1.2.0

package/README.md

@@ -14,8 +14,26 @@ in the URL fragment.
 npm i -g @pinchpass/cli
 ```
 
-The install downloads the prebuilt `pinchpass` binary for your platform to
-`~/.local/bin` (or finds an existing install).
+```sh
+brew install --cask rubybear-lgtm/tap/pinchpass
+```
+
+The npm postinstall downloads the prebuilt `pinchpass` binary to `~/.local/bin`.
+It is version-aware: when the binary it finds (on `PATH`, or in `~/.local/bin`,
+`~/.openclaw/bin`, `~/.pi/bin`) does not report the package's version, it
+downloads the matching release asset and replaces it. Downloads are verified
+against the release's `checksums.txt`. Set `PINCHPASS_SKIP_DOWNLOAD=1` to skip.
+
+## Updating
+
+```sh
+pinchpass --version                           # pinchpass v1.2.0 (abc1234)
+npm update -g @pinchpass/cli                  # re-runs the postinstall
+brew upgrade --cask pinchpass
+go install github.com/rubybear-lgtm/pinchpass@latest
+```
+
+The extension warns when the binary it resolves is older than the package.
 
 ## Pi (pi.dev)
 
@@ -30,10 +48,15 @@ That registers:
 - **`request_secret` tool** — two collection modes:
   - `via: "modal"` (default in the TUI): a Pi dialog collects each secret
     directly into `.env` — the value never reaches the LLM, never enters the
-    transcript, and no server is started. Cancelable with `Esc`.
+    transcript, and no server is started. Cancelable with `Esc`. `ttl` does not
+    apply here and is ignored.
   - `via: "link"`: spawns the CLI, streams the one-time E2E-encrypted link to
-    the user immediately, blocks until they submit or the TTL expires.
+    the user immediately, blocks until they submit or the TTL expires. The URL
+    (including its `#k=` decryption-key fragment) is shown to the model and
+    stays in the transcript, so prefer the modal when the secret is sensitive.
   - `via` defaults to `"auto"`: modal in the TUI, link everywhere else.
+  - `tunnel: true` always uses the link, even in the TUI — the modal cannot
+    serve a remote user.
 - **`pinchpass` skill** — full usage guidance for the model.
 
 The binary is resolved from `PATH`, `~/.local/bin`, `~/.openclaw/bin`, and
@@ -58,6 +81,7 @@ pinchpass request <secret-name>... [flags]
 | `-out`     | `.env`    | Output .env file path                   |
 | `-ttl`     | 30        | Minutes until the link expires          |
 | `-port`    | random    | Local port to bind                      |
+| `-listen-addr` | `127.0.0.1` | Address to listen on               |
 | `-json`    | false     | Machine-readable JSON output            |
 
 ## License

package/dist/args.js

@@ -0,0 +1,30 @@
+/** Tool/CLI argument types and translation to pinchpass CLI flags. */
+/**
+ * Decide how to collect a secret.
+ *
+ * A tunnel or an explicit `link` request always uses the browser link, since
+ * the modal cannot leave the local machine. The modal is only reachable from
+ * the interactive TUI; everywhere else (and for `via: "auto"`) the link wins.
+ */
+export function chooseVia(via, tunnel, mode) {
+    const requested = via ?? "auto";
+    const forceLink = requested === "link" || tunnel === true;
+    const modal = !forceLink && mode === "tui";
+    return {
+        via: modal ? "modal" : "link",
+        downgraded: requested === "modal" && !modal,
+    };
+}
+/** Build the `pinchpass request ...` argv for the given tool arguments. */
+export function buildArgs(params) {
+    const args = ["request", ...params.names, "-json"];
+    if (params.tunnel)
+        args.push("-tunnel");
+    if (params.note)
+        args.push("-note", params.note);
+    if (typeof params.ttl === "number")
+        args.push("-ttl", String(params.ttl));
+    if (params.out)
+        args.push("-out", params.out);
+    return args;
+}

package/dist/binary.js

@@ -0,0 +1,124 @@
+/** Locate the pinchpass binary without requiring PATH configuration. */
+import { accessSync, constants, readFileSync, statSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { homedir } from "node:os";
+import { join } from "node:path";
+/** Real binaries are multi-MB; a failed download can leave a tiny stub behind. */
+export const MIN_VALID_BYTES = 100 * 1024;
+/** Extra directories where the postinstall script may have placed the binary. */
+export const FALLBACK_DIRS = [
+    join(homedir(), ".local", "bin"),
+    join(homedir(), ".openclaw", "bin"),
+    join(homedir(), ".pi", "bin"),
+];
+export const BINARY_MISSING = `The pinchpass binary is not installed. Install it with one of:
+
+  npm i -g @pinchpass/cli      # downloads the prebuilt binary for your platform
+  go install github.com/rubybear-lgtm/pinchpass@latest
+
+Then try request_secret again.`;
+export function binaryName(platform = process.platform) {
+    return platform === "win32" ? "pinchpass.exe" : "pinchpass";
+}
+/**
+ * Search explicit directories for an executable `pinchpass`.
+ *
+ * A candidate that looks like a real binary (>= MIN_VALID_BYTES) wins over one
+ * that does not, so a stale stub earlier in PATH cannot shadow a good install.
+ */
+export function findBinaryIn(dirs, platform = process.platform) {
+    const name = binaryName(platform);
+    const seen = new Set();
+    const executable = [];
+    for (const dir of dirs) {
+        if (!dir || seen.has(dir))
+            continue;
+        seen.add(dir);
+        const candidate = join(dir, name);
+        try {
+            accessSync(candidate, constants.X_OK);
+        }
+        catch {
+            continue;
+        }
+        executable.push(candidate);
+    }
+    for (const candidate of executable) {
+        try {
+            if (statSync(candidate).size >= MIN_VALID_BYTES)
+                return candidate;
+        }
+        catch {
+            // keep looking
+        }
+    }
+    return executable[0] ?? null;
+}
+/** Find pinchpass on PATH, then in the known install directories. */
+export function findBinary() {
+    const sep = process.platform === "win32" ? ";" : ":";
+    const pathDirs = (process.env.PATH ?? "").split(sep).filter(Boolean);
+    return findBinaryIn([...pathDirs, ...FALLBACK_DIRS]);
+}
+const PACKAGE_NAME = "@pinchpass/cli";
+const UPDATE_HINT = `npm i -g ${PACKAGE_NAME} (or go install github.com/rubybear-lgtm/pinchpass@latest)`;
+/** The version of this npm package, read from its own package.json. */
+export function packageVersion() {
+    try {
+        const raw = readFileSync(new URL("../package.json", import.meta.url), "utf8");
+        return JSON.parse(raw).version ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Extract x.y.z from `pinchpass --version` output (null for older builds). */
+export function parseVersion(text) {
+    const match = /(?:^|\s)v?(\d+\.\d+\.\d+)(?=\s|$)/.exec(text ?? "");
+    return match ? match[1] : null;
+}
+/** Numeric x.y.z comparison. Returns -1, 0, or 1. */
+export function compareVersions(a, b) {
+    const pa = a.split(".").map(Number);
+    const pb = b.split(".").map(Number);
+    for (let i = 0; i < 3; i++) {
+        const diff = (pa[i] || 0) - (pb[i] || 0);
+        if (diff !== 0)
+            return diff < 0 ? -1 : 1;
+    }
+    return 0;
+}
+const versionCache = new Map();
+/** The version a binary reports, or null when it predates --version. */
+export function binaryVersion(bin) {
+    if (versionCache.has(bin))
+        return versionCache.get(bin) ?? null;
+    let result = null;
+    try {
+        const out = execFileSync(bin, ["--version"], {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+            timeout: 5000,
+        });
+        result = parseVersion(out);
+    }
+    catch {
+        result = null;
+    }
+    versionCache.set(bin, result);
+    return result;
+}
+/** A one-line update hint when the resolved binary is older than the package. */
+export function updateNotice(bin) {
+    const pkg = packageVersion();
+    if (!pkg)
+        return null;
+    const installed = binaryVersion(bin);
+    if (!installed) {
+        return `this pinchpass binary predates version reporting — update it: ${UPDATE_HINT}`;
+    }
+    if (compareVersions(installed, pkg) < 0) {
+        return `pinchpass v${installed} is older than this package (v${pkg}) — update it: ${UPDATE_HINT}`;
+    }
+    return null;
+}

package/dist/env.js

@@ -0,0 +1,62 @@
+/**
+ * `.env` writing helpers for the modal collection path.
+ *
+ * Mirrors `store.EnvStore.Save` in the Go CLI: values are written as
+ * `KEY="value"` with shell-safe escaping, and an existing key is replaced in
+ * place. Writes go through a temp file + rename so a crash or a concurrent
+ * reader never observes a half-written file.
+ */
+import { mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { randomBytes } from "node:crypto";
+import { dirname, join } from "node:path";
+/** Shell-escape a value for a double-quoted .env line (mirrors store.go). */
+export function escapeEnvValue(s) {
+    return s.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\$/g, "\\$").replace(/`/g, "\\`");
+}
+/** Render the file contents with `key` set to `value`, replacing any existing line. */
+export function renderEnv(existing, key, value) {
+    const line = `${key}="${escapeEnvValue(value)}"`;
+    const out = [];
+    let replaced = false;
+    for (const l of existing.split("\n")) {
+        const t = l.trim();
+        if (t === "")
+            continue;
+        if (t.startsWith(key + "=")) {
+            out.push(line);
+            replaced = true;
+        }
+        else {
+            out.push(l);
+        }
+    }
+    if (!replaced)
+        out.push(line);
+    return out.join("\n") + "\n";
+}
+/** Write/update a single KEY="value" line in a .env file. */
+export function writeEnvKey(path, key, value) {
+    const dir = dirname(path);
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    let existing = "";
+    try {
+        existing = readFileSync(path, "utf8");
+    }
+    catch {
+        // new file
+    }
+    const tmp = join(dir, `.pinchpass-${randomBytes(6).toString("hex")}.tmp`);
+    try {
+        writeFileSync(tmp, renderEnv(existing, key, value), { mode: 0o600 });
+        renameSync(tmp, path);
+    }
+    catch (err) {
+        try {
+            unlinkSync(tmp);
+        }
+        catch {
+            // nothing to clean up
+        }
+        throw err;
+    }
+}