@probelabs/probe 0.6.0-rc146 → 0.6.0-rc148

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@probelabs/probe",
-  "version": "0.6.0-rc146",
+  "version": "0.6.0-rc148",
   "description": "Node.js wrapper for the probe code search tool",
   "main": "src/index.js",
   "module": "src/index.js",
@@ -21,10 +21,6 @@
       "import": "./src/agent/simpleTelemetry.js",
       "require": "./cjs/agent/simpleTelemetry.cjs"
     },
-    "./telemetry/full": {
-      "import": "./src/agent/telemetry.js",
-      "require": "./cjs/agent/telemetry.cjs"
-    },
     "./agent/mcp": {
       "import": "./src/agent/mcp/index.js"
     }
@@ -41,6 +37,8 @@
     "bin/probe-binary",
     "bin/probe.exe",
     "bin/.gitkeep",
+    "bin/binaries/*.tar.gz",
+    "bin/binaries/*.zip",
     "scripts/postinstall.js",
     "build/**/*",
     "MERMAID_SUPPORT_SUMMARY.md",
@@ -77,13 +75,6 @@
     "@ai-sdk/google": "^2.0.14",
     "@ai-sdk/openai": "^2.0.10",
     "@modelcontextprotocol/sdk": "^1.0.0",
-    "@opentelemetry/api": "^1.9.0",
-    "@opentelemetry/core": "^1.30.1",
-    "@opentelemetry/exporter-trace-otlp-http": "^0.203.0",
-    "@opentelemetry/resources": "^2.0.1",
-    "@opentelemetry/sdk-node": "^0.203.0",
-    "@opentelemetry/sdk-trace-base": "^1.30.0",
-    "@opentelemetry/semantic-conventions": "^1.36.0",
     "@probelabs/maid": "^0.0.16",
     "ai": "^5.0.0",
     "axios": "^1.8.3",
@@ -92,6 +83,7 @@
     "glob": "^10.3.10",
     "gpt-tokenizer": "^3.0.1",
     "tar": "^6.2.0",
+    "adm-zip": "^0.5.16",
     "zod": "^3.24.2"
   },
   "devDependencies": {

package/scripts/postinstall.js

@@ -10,11 +10,12 @@
 import fs from 'fs-extra';
 import path from 'path';
 import { fileURLToPath } from 'url';
-import { exec } from 'child_process';
+import { execFile } from 'child_process';
 import { promisify } from 'util';
+import { extractBundledBinary } from '../src/extractor.js';
 import { downloadProbeBinary } from '../src/downloader.js';
 
-const execAsync = promisify(exec);
+const execFileAsync = promisify(execFile);
 
 // Get the directory of the current module
 const __filename = fileURLToPath(import.meta.url);
@@ -98,48 +99,73 @@ You can download the binary from: https://github.com/probelabs/probe/releases
 			console.log('Created .gitignore file in bin directory');
 		}
 
-		// Download the probe binary
-		if (process.env.DEBUG === '1' || process.env.VERBOSE === '1') {
-			console.log('Downloading probe binary...');
-		}
-		try {
-			// Try to get the package version
-			let packageVersion = '0.0.0';
-			const possiblePaths = [
-				path.resolve(__dirname, '..', 'package.json'),      // When installed from npm: scripts/../package.json
-				path.resolve(__dirname, '..', '..', 'package.json') // In development: scripts/../../package.json
-			];
-
-			for (const packageJsonPath of possiblePaths) {
-				try {
-					if (fs.existsSync(packageJsonPath)) {
+		// Get the package version first
+		let packageVersion = '0.0.0';
+		const possiblePaths = [
+			path.resolve(__dirname, '..', 'package.json'),      // When installed from npm: scripts/../package.json
+			path.resolve(__dirname, '..', '..', 'package.json') // In development: scripts/../../package.json
+		];
+
+		for (const packageJsonPath of possiblePaths) {
+			try {
+				if (fs.existsSync(packageJsonPath)) {
+					if (process.env.DEBUG === '1' || process.env.VERBOSE === '1') {
+						console.log(`Found package.json at: ${packageJsonPath}`);
+					}
+					const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
+					if (packageJson.version) {
+						packageVersion = packageJson.version;
 						if (process.env.DEBUG === '1' || process.env.VERBOSE === '1') {
-							console.log(`Found package.json at: ${packageJsonPath}`);
-						}
-						const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
-						if (packageJson.version) {
-							packageVersion = packageJson.version;
-							if (process.env.DEBUG === '1' || process.env.VERBOSE === '1') {
-								console.log(`Using version from package.json: ${packageVersion}`);
-							}
-							break;
+							console.log(`Using version from package.json: ${packageVersion}`);
 						}
+						break;
 					}
-				} catch (err) {
-					console.error(`Error reading package.json at ${packageJsonPath}:`, err);
 				}
+			} catch (err) {
+				console.error(`Error reading package.json at ${packageJsonPath}:`, err);
 			}
+		}
 
-			// Download the binary (it will be placed at the correct location automatically)
-			const binaryPath = await downloadProbeBinary(packageVersion);
+		// Try to extract bundled binary first
+		let binaryPath;
+		try {
+			if (process.env.DEBUG === '1' || process.env.VERBOSE === '1') {
+				console.log('Extracting bundled probe binary...');
+			}
+			binaryPath = await extractBundledBinary(packageVersion);
+			if (process.env.DEBUG === '1' || process.env.VERBOSE === '1') {
+				console.log(`Successfully extracted bundled binary to: ${binaryPath}`);
+			}
+		} catch (extractError) {
+			// If bundled binary extraction fails, fall back to downloading
 			if (process.env.DEBUG === '1' || process.env.VERBOSE === '1') {
-				console.log(`Successfully downloaded probe binary to: ${binaryPath}`);
+				console.log(`Bundled binary extraction failed: ${extractError.message}`);
+				console.log('Falling back to downloading binary from GitHub...');
+			} else {
+				console.log('Bundled binary not found, downloading from GitHub...');
 			}
 
-			// Get the path to the target binary (preserve the Node.js wrapper script)
-			// (variables already declared at the beginning of main function)
+			try {
+				binaryPath = await downloadProbeBinary(packageVersion);
+				if (process.env.DEBUG === '1' || process.env.VERBOSE === '1') {
+					console.log(`Successfully downloaded probe binary to: ${binaryPath}`);
+				}
+			} catch (downloadError) {
+				throw new Error(
+					`Failed to install probe binary.\n` +
+					`Bundled extraction error: ${extractError.message}\n` +
+					`Download error: ${downloadError.message}\n` +
+					`\n` +
+					`Please check:\n` +
+					`1. Your platform is supported\n` +
+					`2. You have internet connectivity\n` +
+					`3. GitHub releases are accessible`
+				);
+			}
+		}
 
-			// Copy the downloaded binary to the correct location
+		// Copy the extracted/downloaded binary to the correct location if needed
+		// (targetBinaryName and targetBinaryPath already declared at the beginning of main function)
 			if (binaryPath !== targetBinaryPath) {
 				if (process.env.DEBUG === '1' || process.env.VERBOSE === '1') {
 					console.log(`Copying binary to ${targetBinaryPath} from ${binaryPath}`);
@@ -151,7 +177,18 @@ You can download the binary from: https://github.com/probelabs/probe/releases
 			// On macOS, try to remove quarantine attributes that might prevent execution
 			if (process.platform === 'darwin') {
 				try {
-					await execAsync(`xattr -d com.apple.quarantine "${targetBinaryPath}" 2>/dev/null || true`);
+					// Security: Use execFile with array args instead of exec to prevent command injection
+					// Validate that the path is within the bin directory
+					const normalizedPath = path.normalize(targetBinaryPath);
+					const normalizedBinDir = path.normalize(binDir);
+					if (!normalizedPath.startsWith(normalizedBinDir)) {
+						throw new Error('Invalid binary path - outside of bin directory');
+					}
+
+					await execFileAsync('xattr', ['-d', 'com.apple.quarantine', normalizedPath]).catch(() => {
+						// Ignore errors - xattr may not exist or file may not have quarantine attribute
+					});
+
 					if (process.env.DEBUG === '1' || process.env.VERBOSE === '1') {
 						console.log('Removed quarantine attributes from binary');
 					}
@@ -163,18 +200,9 @@ You can download the binary from: https://github.com/probelabs/probe/releases
 				}
 			}
 
-			if (process.env.DEBUG === '1' || process.env.VERBOSE === '1') {
-				console.log('\nProbe binary was successfully downloaded and installed during installation.');
-				console.log('You can now use the probe command directly from the command line.');
-			}
-		} catch (error) {
-			console.error('Error downloading probe binary:', error);
-			console.error('\nNote: The probe binary will need to be downloaded when you first use the package.');
-			console.error('If you encounter any issues, you can manually place the binary in the bin directory.');
-			console.error('You can download it from: https://github.com/probelabs/probe/releases');
-
-			// Don't fail the installation, just warn the user
-			return;
+		if (process.env.DEBUG === '1' || process.env.VERBOSE === '1') {
+			console.log('\nProbe binary was successfully installed.');
+			console.log('You can now use the probe command directly from the command line.');
 		}
 	} catch (error) {
 		console.error(`Error in postinstall script: ${error.message}`);

package/src/extractor.js

@@ -0,0 +1,271 @@
+/**
+ * Binary extractor for bundled probe binaries
+ * @module extractor
+ */
+
+import fs from 'fs-extra';
+import path from 'path';
+import tar from 'tar';
+import AdmZip from 'adm-zip';
+import os from 'os';
+import { fileURLToPath } from 'url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+const BINARY_NAME = "probe";
+
+/**
+ * Detects the current OS and architecture
+ * @returns {Object} Object containing OS and architecture information
+ */
+function detectPlatform() {
+	const osType = os.platform();
+	const archType = os.arch();
+
+	let platform;
+	let extension;
+
+	// Map to the same format used in release artifacts
+	if (osType === 'linux') {
+		if (archType === 'x64') {
+			platform = 'x86_64-unknown-linux-gnu';
+			extension = 'tar.gz';
+		} else if (archType === 'arm64') {
+			platform = 'aarch64-unknown-linux-gnu';
+			extension = 'tar.gz';
+		} else {
+			throw new Error(`Unsupported Linux architecture: ${archType}`);
+		}
+	} else if (osType === 'darwin') {
+		if (archType === 'x64') {
+			platform = 'x86_64-apple-darwin';
+			extension = 'tar.gz';
+		} else if (archType === 'arm64') {
+			platform = 'aarch64-apple-darwin';
+			extension = 'tar.gz';
+		} else {
+			throw new Error(`Unsupported macOS architecture: ${archType}`);
+		}
+	} else if (osType === 'win32') {
+		if (archType === 'x64') {
+			platform = 'x86_64-pc-windows-msvc';
+			extension = 'zip';
+		} else {
+			throw new Error(`Unsupported Windows architecture: ${archType}`);
+		}
+	} else {
+		throw new Error(`Unsupported operating system: ${osType}`);
+	}
+
+	if (process.env.DEBUG === '1' || process.env.VERBOSE === '1') {
+		console.log(`Detected platform: ${platform}`);
+	}
+
+	return { platform, extension, osType, archType };
+}
+
+/**
+ * Validates that a path is within a base directory (prevents path traversal)
+ * @param {string} filePath - Path to validate
+ * @param {string} baseDir - Base directory that filePath must be within
+ * @returns {boolean} True if path is safe
+ */
+function isPathSafe(filePath, baseDir) {
+	const normalizedBase = path.normalize(baseDir);
+	const normalizedPath = path.normalize(filePath);
+	const relativePath = path.relative(normalizedBase, normalizedPath);
+
+	// Path is safe if it doesn't start with '..' and isn't absolute
+	return !relativePath.startsWith('..') && !path.isAbsolute(relativePath);
+}
+
+/**
+ * Extracts a tar.gz archive using the tar library
+ * @param {string} archivePath - Path to the .tar.gz file
+ * @param {string} extractDir - Directory to extract to
+ */
+async function extractTarGz(archivePath, extractDir) {
+	await tar.extract({
+		file: archivePath,
+		cwd: extractDir,
+		// Security: Prevent path traversal attacks
+		onentry: (entry) => {
+			const fullPath = path.join(extractDir, entry.path);
+			if (!isPathSafe(fullPath, extractDir)) {
+				throw new Error(`Path traversal attempt detected: ${entry.path}`);
+			}
+		}
+	});
+}
+
+/**
+ * Extracts a zip archive using adm-zip library
+ * @param {string} archivePath - Path to the .zip file
+ * @param {string} extractDir - Directory to extract to
+ */
+async function extractZip(archivePath, extractDir) {
+	const zip = new AdmZip(archivePath);
+	const zipEntries = zip.getEntries();
+
+	// Extract each entry with path validation
+	for (const entry of zipEntries) {
+		const outputPath = path.join(extractDir, entry.entryName);
+
+		// Security: Validate path to prevent traversal attacks
+		if (!isPathSafe(outputPath, extractDir)) {
+			throw new Error(`Path traversal attempt detected: ${entry.entryName}`);
+		}
+
+		if (entry.isDirectory) {
+			await fs.ensureDir(outputPath);
+		} else {
+			await fs.ensureDir(path.dirname(outputPath));
+			await fs.writeFile(outputPath, entry.getData());
+		}
+	}
+}
+
+/**
+ * Finds the binary file in the extracted directory
+ * @param {string} dir - Directory to search
+ * @param {string} baseDir - Base directory for path validation
+ * @param {string} binaryName - Name of binary to find
+ * @param {boolean} isWindows - Whether running on Windows
+ * @returns {Promise<string|null>} Path to binary or null
+ */
+async function findBinary(dir, baseDir, binaryName, isWindows) {
+	const entries = await fs.readdir(dir, { withFileTypes: true });
+
+	for (const entry of entries) {
+		const fullPath = path.join(dir, entry.name);
+
+		// Security: Validate path to prevent traversal
+		if (!isPathSafe(fullPath, baseDir)) {
+			if (process.env.DEBUG === '1' || process.env.VERBOSE === '1') {
+				console.log(`Skipping unsafe path: ${fullPath}`);
+			}
+			continue;
+		}
+
+		if (entry.isDirectory()) {
+			const result = await findBinary(fullPath, baseDir, binaryName, isWindows);
+			if (result) return result;
+		} else if (entry.isFile()) {
+			// Check if this is the binary we're looking for
+			if (entry.name === binaryName ||
+				entry.name === BINARY_NAME ||
+				(isWindows && entry.name.endsWith('.exe'))) {
+				return fullPath;
+			}
+		}
+	}
+
+	return null;
+}
+
+/**
+ * Extracts the bundled binary for the current platform
+ * @param {string} version - Version string (used for archive naming)
+ * @returns {Promise<string>} Path to the extracted binary
+ */
+export async function extractBundledBinary(version) {
+	const { platform, extension, osType } = detectPlatform();
+
+	// Construct the archive filename
+	const archiveName = `probe-v${version}-${platform}.${extension}`;
+
+	// Path to the bundled archive
+	const binariesDir = path.resolve(__dirname, '..', 'bin', 'binaries');
+	const archivePath = path.join(binariesDir, archiveName);
+
+	if (process.env.DEBUG === '1' || process.env.VERBOSE === '1') {
+		console.log(`Looking for bundled binary at: ${archivePath}`);
+	}
+
+	// Check if the archive exists
+	if (!(await fs.pathExists(archivePath))) {
+		throw new Error(
+			`Bundled binary not found for platform ${platform}.\n` +
+			`Expected archive: ${archiveName}\n` +
+			`Searched in: ${binariesDir}\n` +
+			`\n` +
+			`Supported platforms:\n` +
+			`  - x86_64-unknown-linux-gnu (Linux x64)\n` +
+			`  - aarch64-unknown-linux-gnu (Linux ARM64)\n` +
+			`  - x86_64-apple-darwin (macOS Intel)\n` +
+			`  - aarch64-apple-darwin (macOS Apple Silicon)\n` +
+			`  - x86_64-pc-windows-msvc (Windows x64)\n` +
+			`\n` +
+			`Your platform: ${platform}`
+		);
+	}
+
+	// Determine output binary name and path
+	const binDir = path.resolve(__dirname, '..', 'bin');
+	const isWindows = osType === 'win32';
+	const binaryName = isWindows ? `${BINARY_NAME}.exe` : `${BINARY_NAME}-binary`;
+	const binaryPath = path.join(binDir, binaryName);
+
+	if (process.env.DEBUG === '1' || process.env.VERBOSE === '1') {
+		console.log(`Extracting ${archiveName} to ${binDir}...`);
+	}
+
+	// Create a temporary extraction directory
+	const extractDir = path.join(binDir, 'temp_extract');
+	await fs.ensureDir(extractDir);
+
+	try {
+		// Extract based on file type using proper libraries (no shell commands!)
+		if (extension === 'tar.gz') {
+			await extractTarGz(archivePath, extractDir);
+		} else if (extension === 'zip') {
+			await extractZip(archivePath, extractDir);
+		}
+
+		// Find the binary in the extracted files
+		if (process.env.DEBUG === '1' || process.env.VERBOSE === '1') {
+			console.log(`Searching for binary in extracted files...`);
+		}
+
+		const binaryFilePath = await findBinary(extractDir, extractDir, binaryName, isWindows);
+
+		if (!binaryFilePath) {
+			const allFiles = await fs.readdir(extractDir, { recursive: true });
+			throw new Error(
+				`Binary not found in the archive.\n` +
+				`Expected binary name: ${binaryName}\n` +
+				`Files in archive: ${allFiles.join(', ')}`
+			);
+		}
+
+		// Copy the binary to the final location
+		if (process.env.DEBUG === '1' || process.env.VERBOSE === '1') {
+			console.log(`Found binary at ${binaryFilePath}`);
+			console.log(`Installing to ${binaryPath}`);
+		}
+
+		await fs.copyFile(binaryFilePath, binaryPath);
+
+		// Make the binary executable on Unix-like systems
+		if (!isWindows) {
+			await fs.chmod(binaryPath, 0o755);
+		}
+
+		// Clean up the temporary extraction directory
+		await fs.remove(extractDir);
+
+		if (process.env.DEBUG === '1' || process.env.VERBOSE === '1') {
+			console.log(`Binary successfully extracted to ${binaryPath}`);
+		}
+
+		return binaryPath;
+	} catch (error) {
+		// Clean up on error
+		try {
+			await fs.remove(extractDir);
+		} catch {}
+
+		throw new Error(`Failed to extract bundled binary: ${error.message}`);
+	}
+}

package/src/index.js

@@ -39,8 +39,6 @@ import { searchTool, queryTool, extractTool, delegateTool } from './tools/vercel
 import { bashTool } from './tools/bash.js';
 import { ProbeAgent } from './agent/ProbeAgent.js';
 import { SimpleTelemetry, SimpleAppTracer, initializeSimpleTelemetryFromOptions } from './agent/simpleTelemetry.js';
-import { TelemetryConfig, initializeTelemetryFromOptions } from './agent/telemetry.js';
-import { AppTracer } from './agent/appTracer.js';
 import { listFilesToolInstance, searchFilesToolInstance } from './agent/probeTool.js';
 import { StorageAdapter, InMemoryStorageAdapter } from './agent/storage/index.js';
 import { HookManager, HOOK_TYPES } from './agent/hooks/index.js';
@@ -64,14 +62,10 @@ export {
 	// Export hooks
 	HookManager,
 	HOOK_TYPES,
-	// Export simple telemetry classes (no OpenTelemetry dependencies)
+	// Export simple telemetry classes (lightweight, no heavy dependencies)
 	SimpleTelemetry,
 	SimpleAppTracer,
 	initializeSimpleTelemetryFromOptions,
-	// Export full OpenTelemetry telemetry classes
-	TelemetryConfig,
-	AppTracer,
-	initializeTelemetryFromOptions,
 	// Export tool generators directly
 	searchTool,
 	queryTool,