@pinchpass/cli 1.2.0 → 1.2.1

package/README.md

@@ -11,18 +11,24 @@ in the URL fragment.
 ## Install
 
 ```sh
-npm i -g @pinchpass/cli
+npm i -g @pinchpass/cli     # provides the `pinchpass` command
+```
+
+```sh
+npx @pinchpass/cli request API_KEY   # no install; fetches the binary on first run
 ```
 
 ```sh
 brew install --cask rubybear-lgtm/tap/pinchpass
 ```
 
-The npm postinstall downloads the prebuilt `pinchpass` binary to `~/.local/bin`.
-It is version-aware: when the binary it finds (on `PATH`, or in `~/.local/bin`,
+The npm package installs this package's `bin/pinchpass.js`, which resolves the
+platform binary and hands off to it. The postinstall downloads that binary to
+`~/.local/bin`, verifying it against the release's `checksums.txt`, and is
+version-aware: when the binary it finds (on `PATH`, or in `~/.local/bin`,
 `~/.openclaw/bin`, `~/.pi/bin`) does not report the package's version, it
-downloads the matching release asset and replaces it. Downloads are verified
-against the release's `checksums.txt`. Set `PINCHPASS_SKIP_DOWNLOAD=1` to skip.
+downloads the matching release asset and replaces it. Set
+`PINCHPASS_SKIP_DOWNLOAD=1` to skip the download.
 
 ## Updating
 

package/bin/pinchpass.js

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+/**
+ * `pinchpass` CLI entry point.
+ *
+ * npm installs this file as the package's `bin`, so `npx @pinchpass/cli` and a
+ * global install behave like a normal npm CLI. It resolves the platform binary
+ * (downloading it on first use) and hands off to it, forwarding stdio, signals,
+ * and the exit code.
+ *
+ * It deliberately does not re-check the binary version on every run: keeping
+ * updates in `npm update -g` / `brew upgrade` keeps `pinchpass request` fast
+ * and predictable.
+ */
+import { spawn } from "node:child_process";
+
+let findBinary;
+let install;
+try {
+  const [binaryMod, installerMod] = await Promise.all([
+    import("../dist/binary.js"),
+    import("../scripts/install-binary.js"),
+  ]);
+  findBinary = binaryMod.findBinary;
+  install = installerMod.install;
+} catch (err) {
+  const message = err instanceof Error ? err.message : String(err);
+  process.stderr.write(`pinchpass: package is not built (${message})\n`);
+  process.stderr.write("pinchpass: run `npm run build` in the package directory.\n");
+  process.exit(1);
+}
+
+async function resolveBinary() {
+  const existing = findBinary();
+  if (existing) return existing;
+
+  process.stderr.write("pinchpass: downloading the platform binary...\n");
+  await install({ log: (line) => process.stderr.write(`${line}\n`) });
+  return findBinary();
+}
+
+const binary = await resolveBinary();
+if (!binary) {
+  process.stderr.write(
+    "pinchpass: could not find or install the binary.\n" +
+      "pinchpass: install it with `npm i -g @pinchpass/cli` or " +
+      "`go install github.com/rubybear-lgtm/pinchpass@latest`.\n",
+  );
+  process.exit(1);
+}
+
+const child = spawn(binary, process.argv.slice(2), { stdio: "inherit" });
+
+for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) {
+  process.on(signal, () => {
+    try {
+      child.kill(signal);
+    } catch {
+      // already gone
+    }
+  });
+}
+
+child.on("error", (err) => {
+  process.stderr.write(`pinchpass: failed to run ${binary}: ${err.message}\n`);
+  process.exit(1);
+});
+
+child.on("exit", (code, signal) => {
+  if (signal) process.kill(process.pid, signal);
+  else process.exit(code ?? 1);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pinchpass/cli",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "One-time E2E-encrypted secret request links — native for Pi and OpenClaw agents",
   "repository": {
     "type": "git",
@@ -16,8 +16,12 @@
   ],
   "type": "module",
   "main": "./dist/index.js",
+  "bin": {
+    "pinchpass": "./bin/pinchpass.js"
+  },
   "files": [
     "dist",
+    "bin",
     "skills",
     "openclaw.plugin.json",
     "scripts",

package/skills/pinchpass/SKILL.md

@@ -37,10 +37,15 @@ pi install npm:@pinchpass/cli
 ```
 
 ```bash
-# Any agent (npm — downloads the prebuilt binary)
+# Any agent (npm — provides the `pinchpass` command)
 npm i -g @pinchpass/cli
 ```
 
+```bash
+# No install needed (npx fetches package and binary on first use)
+npx @pinchpass/cli request API_KEY
+```
+
 ```bash
 # From source (requires Go 1.26+)
 go install github.com/rubybear-lgtm/pinchpass@latest