@promptster/teams-cli 0.6.1 → 0.8.0

package/bin/promptster-teams.js

@@ -1,31 +1,66 @@
 #!/usr/bin/env node
 "use strict";
 
-// Platform shim: selects and execs the right prebuilt Go binary for this OS/arch.
+// Launcher: execs the MANAGED binary (~/.promptster-teams/bin), falling back to
+// the copy bundled in node_modules. See lib/resolve.js for why the binary that
+// runs must not be the one npm is tracking.
+//
+// Preferring `managed` is what keeps npm honest: self-update rewrites the
+// managed file, node_modules is never touched, so `npm ls` keeps telling the
+// truth about what npm installed.
+
 const { spawnSync } = require("child_process");
-const path = require("path");
 const fs = require("fs");
 
-const MAP = {
-  "darwin-x64": "promptster-teams-darwin-x64",
-  "darwin-arm64": "promptster-teams-darwin-arm64",
-  "linux-x64": "promptster-teams-linux-x64",
-  "linux-arm64": "promptster-teams-linux-arm64",
-  "win32-x64": "promptster-teams-win32-x64.exe",
-  "win32-arm64": "promptster-teams-win32-arm64.exe",
-};
-
-const key = `${process.platform}-${process.arch}`;
-const binName = MAP[key];
-if (!binName) {
-  console.error(`promptster-teams: unsupported platform ${key}`);
-  process.exit(1);
+const {
+  PLATFORMS,
+  bundledBinPath,
+  managedBinPath,
+  isGlobalInstall,
+  platformKey,
+  platformPackage,
+} = require("../lib/resolve");
+
+function usable(p) {
+  if (!p) return false;
+  try {
+    fs.accessSync(p, fs.constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
 }
 
-const binPath = path.join(__dirname, "..", "binaries", binName);
-if (!fs.existsSync(binPath)) {
-  console.error(`promptster-teams: binary not found at ${binPath}`);
-  console.error("The package may have installed incorrectly; try reinstalling.");
+const bundled = bundledBinPath();
+
+// A project-local install runs ITS OWN binary, never the shared managed one.
+// The managed binary is per-user; a lockfile is a per-project pin. Pointing a
+// local install at the shared file would mean a repo pinning 0.5.0 executes
+// whatever another repo last installed — the lockfile would select nothing.
+//
+// Otherwise: managed first. If postinstall could not write it (--ignore-scripts,
+// read-only home, unresolvable HOME), fall back to bundled so the CLI still runs
+// — it just self-updates inside node_modules the way it used to, and npm ls goes
+// back to drifting. Working-but-drifting beats not working.
+const managed = isGlobalInstall() ? managedBinPath() : null;
+const binPath = usable(managed) ? managed : bundled;
+
+if (!usable(binPath)) {
+  // The binary now arrives as a per-platform optionalDependency, and npm treats
+  // a missing optional dep as a SUCCESSFUL install — no error, no warning. So
+  // this is the first and only place an engineer learns anything is wrong, and
+  // a bare "binary not found" would send them hunting the wrong thing. Name the
+  // package that is actually missing and the most likely cause.
+  if (!PLATFORMS.includes(platformKey())) {
+    console.error(`promptster-teams: unsupported platform ${platformKey()}`);
+    console.error(`Supported: ${PLATFORMS.join(", ")}`);
+    process.exit(1);
+  }
+  console.error(
+    `promptster-teams: no binary found — ${platformPackage()} is not installed.`
+  );
+  console.error("This usually means the install used --omit=optional/--no-optional.");
+  console.error("Fix: npm i -g @promptster/teams-cli   (without omitting optional deps)");
   process.exit(1);
 }
 

package/lib/resolve.js

@@ -0,0 +1,166 @@
+"use strict";
+
+// Shared path/platform resolution for the npm package.
+//
+// WHY THIS PACKAGE IS A LAUNCHER, NOT THE INSTALL
+// ------------------------------------------------
+// The Go binary self-updates by renaming a verified new build over its own
+// executable. When the executable it swaps lives inside node_modules, npm's
+// metadata immediately starts lying: `npm ls` / `npm outdated` keep reporting
+// the version npm installed while the binary underneath has moved on, and a
+// reinstall silently writes the older binary back.
+//
+// You cannot fix that by rewriting package.json behind npm's back — that is a
+// hack no mature CLI does, and it does not even work for project-local installs
+// (npm ls reads the lockfile, not the installed package.json — verified).
+//
+// So the binary does not live in node_modules. postinstall.js copies it to the
+// MANAGED path (~/.promptster-teams/bin — the same place install.sh writes),
+// and bin/promptster-teams.js execs that. node_modules keeps a pristine copy
+// that nothing ever mutates, so npm's metadata stays true by construction, and
+// self-update stays fully automatic — which matters because this is a daemon:
+// unlike claude/codex, there is no human reading a "please upgrade" nudge.
+//
+// That pristine copy arrives via a per-platform optionalDependency gated on
+// npm's os/cpu fields, so an install downloads ONE binary (~18MB) instead of the
+// six (~74.5MB) that used to ship in a single tarball. The tradeoff: optional
+// deps fail SILENTLY, so every consumer of bundledBinPath() must handle null.
+//
+// Keep this file dependency-free: postinstall must run before anything is
+// installed, and the launcher is on the hot path of every invocation.
+
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+// The platform-arch keys we publish a binary package for. The package name is
+// always `<wrapper>-<key>` and the binary inside is always named canonically,
+// so the key is the only thing that varies.
+const PLATFORMS = [
+  "darwin-x64",
+  "darwin-arm64",
+  "linux-x64",
+  "linux-arm64",
+  "win32-x64",
+  "win32-arm64",
+];
+
+const PKG_PREFIX = "@promptster/teams-cli";
+
+function platformKey() {
+  return `${process.platform}-${process.arch}`;
+}
+
+function platformPackage(key) {
+  return `${PKG_PREFIX}-${key || platformKey()}`;
+}
+
+// bundledBinPath is the pristine copy npm installed — now inside the per-platform
+// optionalDependency (@promptster/teams-cli-darwin-arm64, …) rather than a
+// binaries/ directory carrying all six. npm skips the packages whose os/cpu do
+// not match the host, so exactly one is ever present.
+//
+// Returns null when the platform package is absent. That is a REAL state, not a
+// theoretical one: optional dependencies fail SILENTLY by design, so
+// --omit=optional, a partial registry publish, or an unsupported platform all
+// land here with npm reporting success. Callers must degrade, never assume.
+//
+// Resolved via require.resolve rather than a hardcoded ../../ path so it works
+// wherever the package manager actually put it — hoisted to a root
+// node_modules, nested, or in a pnpm store.
+function bundledBinPath() {
+  const key = platformKey();
+  if (!PLATFORMS.includes(key)) return null;
+  const binName = key.startsWith("win32-")
+    ? "promptster-teams.exe"
+    : "promptster-teams";
+  try {
+    const pkgJson = require.resolve(`${platformPackage(key)}/package.json`);
+    const p = path.join(path.dirname(pkgJson), binName);
+    return fs.existsSync(p) ? p : null;
+  } catch {
+    return null;
+  }
+}
+
+// managedBinPath MUST stay in lockstep with Go's state.CanonicalInstallBin and
+// install.sh's INSTALL_DIR. All three name the same file; if they diverge, an
+// npm install and a curl install manage two different binaries on one box and
+// PATH decides which one the engineer actually runs.
+function managedBinPath() {
+  const home = os.homedir();
+  if (!home) return null;
+  const name =
+    process.platform === "win32" ? "promptster-teams.exe" : "promptster-teams";
+  return path.join(home, ".promptster-teams", "bin", name);
+}
+
+// isGlobalInstall reports whether this package was installed into a GLOBAL
+// prefix rather than a project's node_modules.
+//
+// This gate is why a project-local install does not touch the managed binary at
+// all. The managed binary is per-USER and shared; a project's lockfile is a
+// deliberate per-PROJECT pin. If a local install pointed at the shared binary,
+// a repo pinning 0.5.0 and one pinning 0.6.1 would both execute whichever
+// version happens to be in ~/.promptster-teams/bin — the lockfile would select
+// nothing at all. That is strictly worse than the npm-ls drift this design
+// removes, so local installs stay entirely inside their own node_modules.
+//
+// Mirrors nudgeFor's layout rules in internal/selfupdate/selfupdate.go: match
+// path SEGMENTS (never substrings — a directory called my-node_modules-backup
+// is not npm), and split on both separators so the check is host-independent.
+function pathSegments(p) {
+  return String(p || "").split(/[/\\]/).filter(Boolean);
+}
+
+function isGlobalInstall(selfDir) {
+  const segs = pathSegments(selfDir === undefined ? __dirname : selfDir);
+  if (!segs.includes("node_modules")) {
+    // Not under node_modules at all (e.g. `npm link`, a checkout). Not a
+    // project-local install, so it may manage the shared binary.
+    return true;
+  }
+  const pnpm = segs.includes(".pnpm") || segs.includes("pnpm");
+  const adjacent = (a, b) =>
+    segs.some((s, i) => s === a && segs[i + 1] === b);
+
+  // pnpm's global prefix, e.g. ~/Library/pnpm/global/5/node_modules/...
+  if (pnpm && segs.includes("global")) return true;
+  // npm's global prefix: <prefix>/lib/node_modules (unix) or
+  // <AppData>\npm\node_modules (windows).
+  if (!pnpm && (adjacent("lib", "node_modules") || adjacent("npm", "node_modules"))) {
+    return true;
+  }
+  return false;
+}
+
+// parseVersion turns "1.2.3" into [1,2,3]; returns null for anything that is
+// not a plain 3-part numeric version. Deliberately strict rather than a semver
+// dependency: the release pipeline only ever produces x.y.z, and an unparseable
+// version must fall through to "unknown", never to a wrong comparison.
+function parseVersion(s) {
+  const m = /^v?(\d+)\.(\d+)\.(\d+)/.exec(String(s || "").trim());
+  return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : null;
+}
+
+// isNewer mirrors the Go updater's strictly-newer gate: a is newer than b.
+function isNewer(a, b) {
+  const x = parseVersion(a);
+  const y = parseVersion(b);
+  if (!x || !y) return false;
+  for (let i = 0; i < 3; i++) {
+    if (x[i] !== y[i]) return x[i] > y[i];
+  }
+  return false;
+}
+
+module.exports = {
+  PLATFORMS,
+  platformKey,
+  platformPackage,
+  bundledBinPath,
+  managedBinPath,
+  isGlobalInstall,
+  parseVersion,
+  isNewer,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@promptster/teams-cli",
-  "version": "0.6.1",
+  "version": "0.8.0",
   "description": "On-device, auditable AI-coding capture for internal engineering teams",
   "keywords": [
     "promptster",
@@ -21,11 +21,13 @@
   },
   "scripts": {
     "build": "node scripts/build.js",
+    "postinstall": "node scripts/postinstall.js",
     "prepublishOnly": "node scripts/build.js && node scripts/check-binaries.js"
   },
   "files": [
     "bin/",
-    "binaries/",
+    "lib/",
+    "scripts/postinstall.js",
     "README.md"
   ],
   "engines": {
@@ -33,5 +35,13 @@
   },
   "publishConfig": {
     "access": "public"
+  },
+  "optionalDependencies": {
+    "@promptster/teams-cli-linux-x64": "0.8.0",
+    "@promptster/teams-cli-linux-arm64": "0.8.0",
+    "@promptster/teams-cli-darwin-x64": "0.8.0",
+    "@promptster/teams-cli-darwin-arm64": "0.8.0",
+    "@promptster/teams-cli-win32-x64": "0.8.0",
+    "@promptster/teams-cli-win32-arm64": "0.8.0"
   }
 }

package/scripts/postinstall.js

@@ -0,0 +1,202 @@
+#!/usr/bin/env node
+"use strict";
+
+// Installs the platform binary from node_modules to the MANAGED path
+// (~/.promptster-teams/bin/promptster-teams), which is what actually runs and
+// what self-update owns. See lib/resolve.js for why the binary must not run
+// from inside node_modules.
+//
+// Contract: this script must NEVER fail an npm install. A postinstall that
+// exits non-zero aborts `npm i -g` and leaves the engineer with no CLI at all —
+// far worse than the drift it exists to fix. Every failure path warns and exits
+// 0; bin/promptster-teams.js then falls back to the bundled binary, which works
+// exactly as it did before this file existed.
+
+const { spawnSync } = require("child_process");
+const fs = require("fs");
+const path = require("path");
+
+const {
+  PLATFORMS,
+  bundledBinPath,
+  managedBinPath,
+  isGlobalInstall,
+  isNewer,
+  platformKey,
+  platformPackage,
+} = require("../lib/resolve");
+
+function warn(msg) {
+  console.warn(`promptster-teams: ${msg}`);
+}
+
+// binVersion asks a binary what it is. One that cannot answer (missing,
+// corrupt, wrong arch, not executable) reports null.
+//
+// Both sides of the downgrade guard go through this deliberately. The obvious
+// shortcut is to compare package.json's version against the managed binary —
+// but that trusts package.json to describe the bytes sitting in binaries/, and
+// when those two disagree the guard makes its decision on a fiction (and the
+// success log prints a version that was never installed). The pipeline does gate
+// package.json against the tag, so they agree today; comparing the actual binary
+// to the actual binary means the guard cannot be wrong even if that gate is ever
+// lost. It costs one ~10ms spawn on install.
+function binVersion(bin) {
+  if (!bin || !fs.existsSync(bin)) return null;
+  try {
+    const r = spawnSync(bin, ["--version"], {
+      encoding: "utf8",
+      timeout: 10_000,
+    });
+    if (r.status !== 0 || !r.stdout) return null;
+    return r.stdout.trim().split("\n")[0].trim() || null;
+  } catch {
+    return null;
+  }
+}
+
+// repairAutostart re-points an existing launchd/systemd/schtasks unit at the
+// managed binary.
+//
+// THIS IS A MIGRATION, and without it this package is a silent regression for
+// every engineer who has run `autostart enable`. The unit bakes an ABSOLUTE
+// path at enable time. Installs predating the managed-binary layout baked
+// <pkg>/binaries/promptster-teams-<platform> — a path that no longer exists in
+// the package, because the binary moved to a per-platform dependency and the
+// wrapper stopped shipping binaries/ entirely. So `npm i -g` deletes the exact
+// file the supervisor is pointed at.
+//
+// Nothing about that fails loudly. The running daemon holds its inode and keeps
+// capturing, so the upgrade looks clean; the unit only breaks at the NEXT LOGIN,
+// when launchd runs a path that is gone. Capture never comes back — the precise
+// failure autostart exists to prevent.
+//
+// Delegated to the Go binary (`autostart repair`) rather than reimplemented
+// here: this must not grow a plist writer, a systemd unit writer and a schtasks
+// caller in Node, three platforms out of sync with the Go ones. `repair` is a
+// no-op when autostart was never enabled and never exits non-zero.
+function repairAutostart(managed) {
+  try {
+    const r = spawnSync(managed, ["autostart", "repair"], {
+      encoding: "utf8",
+      timeout: 30_000,
+    });
+    const out = `${r.stdout || ""}${r.stderr || ""}`.trim();
+    if (out) console.log(out);
+  } catch {
+    // Best-effort: a failed repair leaves autostart pointing at the old path,
+    // which the engineer can fix with `promptster-teams autostart enable`.
+    // Aborting the install over it would be strictly worse.
+  }
+}
+
+function main() {
+  // A project-local install must not touch the shared managed binary. The
+  // lockfile is a per-PROJECT pin; the managed binary is per-USER. Letting a
+  // local install write it means two repos pinning different versions fight
+  // over one file and neither gets what its lockfile selected — a worse bug
+  // than the npm-ls drift this whole design removes. Local installs keep
+  // running out of their own node_modules, exactly as before.
+  if (!isGlobalInstall()) {
+    console.log(
+      "promptster-teams: project-local install — leaving ~/.promptster-teams/bin alone " +
+        "and running the version your lockfile pins"
+    );
+    return;
+  }
+
+  const bundled = bundledBinPath();
+  if (!bundled) {
+    // Either an unsupported platform, or the optionalDependency carrying the
+    // binary is absent. npm treats a missing optional dep as SUCCESS and says
+    // nothing, so this warning is the only signal the engineer will ever get
+    // that they have a CLI with no binary behind it. Say which package.
+    if (!PLATFORMS.includes(platformKey())) {
+      warn(`unsupported platform ${platformKey()} — no binary to install`);
+      return;
+    }
+    warn(`${platformPackage()} is not installed, so there is no binary to install.`);
+    warn("If you used --omit=optional or --no-optional, reinstall without it.");
+    return;
+  }
+  const managed = managedBinPath();
+  if (!managed) {
+    warn("could not resolve home directory — skipping binary install");
+    return;
+  }
+
+  const incoming = binVersion(bundled);
+  const current = binVersion(managed);
+
+  if (!incoming) {
+    warn(`bundled binary at ${bundled} did not report a version — skipping`);
+    return;
+  }
+
+  // Never downgrade. The managed binary self-updates forward on its own, so it
+  // is routinely NEWER than whatever version npm is installing (that is the
+  // normal steady state, not an error). Clobbering it would hand the daemon an
+  // older build that immediately re-updates — churn, plus a window on a version
+  // the engineer already moved past. Mirrors the Go updater's isNewer gate.
+  //
+  // A managed binary that cannot report a version (current === null) is treated
+  // as absent and overwritten: a corrupt or half-written file should be
+  // replaced, not preserved by a guard meant to protect a GOOD newer build.
+  if (current && !isNewer(incoming, current)) {
+    console.log(
+      `promptster-teams: ${managed} is ${current}; not replacing it with ${incoming}`
+    );
+    return;
+  }
+
+  try {
+    fs.mkdirSync(path.dirname(managed), { recursive: true });
+    // Write to a temp file in the SAME directory, then rename: rename is atomic
+    // on POSIX, so a concurrent `promptster-teams` exec sees either the whole
+    // old binary or the whole new one, never a half-written file. Copying
+    // straight onto `managed` would also fail with ETXTBSY on Linux if the
+    // daemon is running.
+    const tmp = `${managed}.tmp-${process.pid}`;
+    fs.copyFileSync(bundled, tmp);
+    fs.chmodSync(tmp, 0o755);
+
+    // Re-check immediately before the swap. The guard above and this rename are
+    // not atomic with respect to the Go self-updater, which renames onto this
+    // same path from a live daemon: read 1.0.0 -> daemon installs 1.2.0 ->
+    // rename 1.1.0 over it, and the guard has been defeated.
+    //
+    // This narrows the window from "the whole copy" to the microseconds around
+    // the rename rather than closing it. Closing it needs a lock protocol shared
+    // by a Node script and a Go daemon, which is a lot of machinery for this
+    // failure: rename is atomic so the file is always ONE whole valid binary
+    // (never corrupt), the only cost is running an older version, and the daemon
+    // re-updates forward within one check interval (<=30m). Deliberate tradeoff,
+    // not an oversight — see CLAUDE.md.
+    const stillCurrent = binVersion(managed);
+    if (stillCurrent && !isNewer(incoming, stillCurrent)) {
+      fs.unlinkSync(tmp);
+      console.log(
+        `promptster-teams: ${managed} changed to ${stillCurrent} mid-install; leaving it`
+      );
+      return;
+    }
+    fs.renameSync(tmp, managed);
+    console.log(
+      `promptster-teams: installed ${incoming} to ${managed}${
+        current ? ` (was ${current})` : ""
+      }`
+    );
+    repairAutostart(managed);
+  } catch (err) {
+    // Falls back to the bundled binary via bin/promptster-teams.js.
+    warn(`could not install to ${managed}: ${err.message}`);
+    warn("falling back to the bundled binary (npm ls may report a stale version)");
+  }
+}
+
+try {
+  main();
+} catch (err) {
+  // Belt and braces: nothing here may abort an npm install.
+  warn(`postinstall skipped: ${err && err.message}`);
+}

package/binaries/SHA256SUMS

@@ -1,6 +0,0 @@
-2c8a4c5553788f5b6b781dcec1ab33fae2a0bff8f094370d9b0b143e975442d5  promptster-teams-linux-x64
-1b2cfba34071904e43e42ee6b87ea4c442f7bc50e62ffe51c58623cbee1f9de5  promptster-teams-linux-arm64
-e15413b163e1b5fac9254342881b2f6ae790dcfa433018cd4210750dc0df0133  promptster-teams-darwin-x64
-1ced87baf08d4af80e0515b4206ccd6d110ffe311390ed69868b2451e8e8d4cf  promptster-teams-darwin-arm64
-86cd9607458ffb76de60d06919bde579f5d89f1dc625903645909c5a2373c7f1  promptster-teams-win32-x64.exe
-40f6278f6ec4216b896081820fe2178f0ad96bc9f49cedb6ca8843f4c8d40f0f  promptster-teams-win32-arm64.exe

package/binaries/SHA256SUMS.minisig

@@ -1,4 +0,0 @@
-untrusted comment: signature from minisign secret key
-RUSPnqFjEKp3+S04GPMUnLjuEyer/6aoLJjkuc9K2bVb0eC+0S0muKBqw8x6NQnIfyI562lAQQNWkTxhv75vIzcQuvqCyPeDjQ8=
-trusted comment: timestamp:1784117828	file:SHA256SUMS	hashed
-ym2SDj/OeLtNJIB3eyPWAF2PAWeNS8ckXRaNO0+Euxychcqs7+mpmJH4HwrRvhlO4MhE5m8dXyj0zWAJjC46Bg==