@qualflare/cli 0.1.10 → 0.1.12-rc.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/LICENSE +178 -0
  2. package/README.md +97 -0
  3. package/bin/qf +120 -0
  4. package/package.json +18 -17
  5. package/bin/qf.js +0 -18
  6. package/install.js +0 -124
package/LICENSE ADDED
@@ -0,0 +1,178 @@
1
+ Apache License
2
+ Version 2.0, January 2004
3
+ http://www.apache.org/licenses/
4
+
5
+ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
6
+
7
+ 1. Definitions.
8
+
9
+ "License" shall mean the terms and conditions for use, reproduction,
10
+ and distribution as defined by Sections 1 through 9 of this document.
11
+
12
+ "Licensor" shall mean the copyright owner or entity authorized by
13
+ the copyright owner that is granting the License.
14
+
15
+ "Legal Entity" shall mean the union of the acting entity and all
16
+ other entities that control, are controlled by, or are under common
17
+ control with that entity. For the purposes of this definition,
18
+ "control" means (i) the power, direct or indirect, to cause the
19
+ direction or management of such entity, whether by contract or
20
+ otherwise, or (ii) ownership of fifty percent (50%) or more of the
21
+ outstanding shares, or (iii) beneficial ownership of such entity.
22
+
23
+ "You" (or "Your") shall mean an individual or Legal Entity
24
+ exercising permissions granted by this License.
25
+
26
+ "Source" form shall mean the preferred form for making modifications,
27
+ including but not limited to software source code, documentation
28
+ source, and configuration files.
29
+
30
+ "Object" form shall mean any form resulting from mechanical
31
+ transformation or translation of a Source form, including but
32
+ not limited to compiled object code, generated documentation,
33
+ and conversions to other media types.
34
+
35
+ "Work" shall mean the work of authorship made available under
36
+ the License, as indicated by a copyright notice that is included in
37
+ or attached to the work (an example is provided in the Appendix below).
38
+
39
+ "Derivative Works" shall mean any work, whether in Source or Object
40
+ form, that is based on (or derived from) the Work and for which the
41
+ editorial revisions, annotations, elaborations, or other modifications
42
+ represent, as a whole, an original work of authorship. For the purposes
43
+ of this License, Derivative Works shall not include works that remain
44
+ separable from, or merely link (or bind by name) to the interfaces of,
45
+ the Work and Derivative Works thereof.
46
+
47
+ "Contribution" shall mean, as submitted to the Licensor for inclusion
48
+ in the Work by the copyright owner or by an individual or Legal Entity
49
+ authorized to submit on behalf of the copyright owner. For the purposes
50
+ of this definition, "contribution" means any original work of authorship,
51
+ including any modifications or additions to an existing work, submitted
52
+ intentionally to the Licensor for inclusion in the Work.
53
+
54
+ "Contributor" shall mean Licensor and any Legal Entity on behalf of
55
+ whom a Contribution has been received by the Licensor and included
56
+ within the Work.
57
+
58
+ 2. Grant of Copyright License. Subject to the terms and conditions of
59
+ this License, each Contributor hereby grants to You a perpetual,
60
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
61
+ copyright license to reproduce, prepare Derivative Works of,
62
+ publicly display, publicly perform, sublicense, and distribute the
63
+ Work and such Derivative Works in Source or Object form.
64
+
65
+ 3. Grant of Patent License. Subject to the terms and conditions of
66
+ this License, each Contributor hereby grants to You a perpetual,
67
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
68
+ (except as stated in this section) patent license to make, have made,
69
+ use, offer to sell, sell, import, and otherwise transfer the Work,
70
+ where such license applies only to those patent claims licensable
71
+ by such Contributor that are necessarily infringed by their
72
+ Contribution(s) alone or by the combination of their Contributions
73
+ with the Work to which such Contributions were submitted. If You
74
+ institute patent litigation against any entity (including a
75
+ cross-claim or counterclaim in a lawsuit) alleging that the Work
76
+ or a Contribution incorporated within the Work constitutes direct
77
+ or contributory patent infringement, then any patent licenses
78
+ granted to You under this License for that Work shall terminate
79
+ as of the date such litigation is filed.
80
+
81
+ 4. Redistribution. You may reproduce and distribute copies of the
82
+ Work or Derivative Works thereof in any medium, with or without
83
+ modifications, and in Source or Object form, provided that You
84
+ meet the following conditions:
85
+
86
+ (a) You must give any other recipients of the Work or Derivative
87
+ Works a copy of this License; and
88
+
89
+ (b) You must cause any modified files to carry prominent notices
90
+ stating that You changed the files; and
91
+
92
+ (c) You must retain, in the Source form of any Derivative Works
93
+ that You distribute, all copyright, patent, trademark, and
94
+ attribution notices from the Source form of the Work,
95
+ excluding those notices that do not pertain to any part of
96
+ the Derivative Works; and
97
+
98
+ (d) If the Work includes a "NOTICE" text file as part of its
99
+ distribution, You must include a readable copy of the
100
+ attribution notices contained within such NOTICE file, in
101
+ at least one of the following places: within a NOTICE text
102
+ file distributed as part of the Derivative Works; within
103
+ the Source form or documentation, if provided along with the
104
+ Derivative Works; or, within a display generated by the
105
+ Derivative Works, if and wherever such third-party notices
106
+ normally appear. The contents of the NOTICE file are for
107
+ informational purposes only and do not modify the License.
108
+ You may add Your own attribution notices within Derivative
109
+ Works that You distribute, alongside or as an addendum to
110
+ the NOTICE text from the Work, provided that such additional
111
+ attribution notices cannot be construed as modifying the License.
112
+
113
+ You may add Your own license statement for Your modifications and
114
+ may provide additional grant of rights to use, copy, modify, merge,
115
+ publish, distribute, sublicense, and/or sell copies of the
116
+ Work, and to permit persons to whom the Work is furnished to do so.
117
+
118
+ 5. Submission of Contributions. Unless You explicitly state otherwise,
119
+ any Contribution intentionally submitted for inclusion in the Work
120
+ by You to the Licensor shall be under the terms and conditions of
121
+ this License, without any additional terms or conditions.
122
+ Notwithstanding the above, nothing herein shall supersede or modify
123
+ the terms of any separate license agreement you may have executed
124
+ with Licensor regarding such Contributions.
125
+
126
+ 6. Trademarks. This License does not grant permission to use the trade
127
+ names, trademarks, service marks, or product names of the Licensor,
128
+ except as required for reasonable and customary use in describing the
129
+ origin of the Work and reproducing the content of the NOTICE file.
130
+
131
+ 7. Disclaimer of Warranty. Unless required by applicable law or
132
+ agreed to in writing, Licensor provides the Work (and each
133
+ Contributor provides its Contributions) on an "AS IS" BASIS,
134
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
135
+ implied, including, without limitation, any warranties or conditions
136
+ of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
137
+ PARTICULAR PURPOSE. You are solely responsible for determining the
138
+ appropriateness of using or reproducing the Work and assume any
139
+ risks associated with Your exercise of permissions under this License.
140
+
141
+ 8. Limitation of Liability. In no event and under no legal theory,
142
+ whether in tort (including negligence), contract, or otherwise,
143
+ unless required by applicable law (such as deliberate and grossly
144
+ negligent acts) or agreed to in writing, shall any Contributor be
145
+ liable to You for damages, including any direct, indirect, special,
146
+ incidental, or exemplary damages of any character arising as a
147
+ result of this License or out of the use or inability to use the
148
+ Work (including but not limited to damages for loss of goodwill,
149
+ work stoppage, computer failure or malfunction, or all other
150
+ commercial damages or losses), even if such Contributor has been
151
+ advised of the possibility of such damages.
152
+
153
+ 9. Accepting Warranty or Additional Liability. While redistributing
154
+ the Work or Derivative Works thereof, You may choose to offer,
155
+ and charge a fee for, acceptance of support, warranty, indemnity,
156
+ or other liability obligations and/or rights consistent with this
157
+ License. However, in accepting such obligations, You may offer such
158
+ conditions only on Your own behalf and on Your sole responsibility,
159
+ not on behalf of any other Contributor, and only if You agree to
160
+ indemnify, defend, and hold each Contributor harmless for any
161
+ liability incurred by, or claims asserted against, such Contributor
162
+ by reason of your accepting any such warranty or additional liability.
163
+
164
+ END OF TERMS AND CONDITIONS
165
+
166
+ Copyright 2026 Qualflare OÜ
167
+
168
+ Licensed under the Apache License, Version 2.0 (the "License");
169
+ you may not use this file except in compliance with the License.
170
+ You may obtain a copy of the License at
171
+
172
+ http://www.apache.org/licenses/LICENSE-2.0
173
+
174
+ Unless required by applicable law or agreed to in writing, software
175
+ distributed under the License is distributed on an "AS IS" BASIS,
176
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
177
+ See the License for the specific language governing permissions and
178
+ limitations under the License.
package/README.md ADDED
@@ -0,0 +1,97 @@
1
+ # @qualflare/cli
2
+
3
+ npm distribution of the **Qualflare CLI** (`qf`) — upload test results to [Qualflare](https://qualflare.com) from any CI pipeline or local machine. Supports 23 testing frameworks with automatic format detection.
4
+
5
+ ## Install
6
+
7
+ ```bash
8
+ npm install -g @qualflare/cli
9
+ qf version
10
+ ```
11
+
12
+ Requires Node ≥ 16.
13
+
14
+ ### No install scripts
15
+
16
+ This package runs **no `postinstall` and no install script of any kind**, and has no runtime dependencies.
17
+
18
+ The platform-native `qf` binary ships as a normal npm package — `@qualflare/cli-darwin-arm64`, `@qualflare/cli-linux-x64`, and so on — listed in `optionalDependencies`. Your package manager reads each one's `os`/`cpu` fields and downloads only the one matching your machine. `bin/qf` is a small launcher that resolves that package and executes the binary.
19
+
20
+ This means:
21
+
22
+ - Nothing is downloaded or executed while installing.
23
+ - The binary is covered by the `integrity` hash in your lockfile, verified by your package manager on every install.
24
+ - `npm install --ignore-scripts` works with no special handling.
25
+ - A private registry mirror proxies the binary like any other tarball.
26
+
27
+ Prebuilt binaries are provided for:
28
+
29
+ | OS | Architectures | Package |
30
+ |----|---------------|---------|
31
+ | macOS | arm64, x64 | `@qualflare/cli-darwin-{arm64,x64}` |
32
+ | Linux | arm64, x64 | `@qualflare/cli-linux-{arm64,x64}` |
33
+ | Windows | arm64, x64 | `@qualflare/cli-win32-{arm64,x64}` |
34
+
35
+ ## Quick start
36
+
37
+ ```bash
38
+ # Save your project API token (Project → Settings → Access Tokens in the dashboard)
39
+ qf login myapp qf_your_token_here
40
+
41
+ # Upload a report — the framework is auto-detected from the file
42
+ qf myapp collect path/to/results.xml
43
+ ```
44
+
45
+ ## In CI
46
+
47
+ ```bash
48
+ qf login ci "$QF_TOKEN" --force
49
+ qf ci collect test-results/*.xml
50
+ ```
51
+
52
+ Set `QF_TOKEN` from a secret, plus `QF_BRANCH` / `QF_COMMIT` for git context (auto-detected from common CI variables when unset).
53
+
54
+ Because there is no install script, nothing in CI needs to reach GitHub Releases at install time — your registry is the only host involved.
55
+
56
+ ## Restricted networks and air-gapped installs
57
+
58
+ The binary is an ordinary npm tarball, so a registry mirror (Verdaccio, Artifactory, Nexus, …) covers it with no extra configuration — point npm at your mirror and both `@qualflare/cli` and the platform package come from it.
59
+
60
+ If you already have a `qf` binary and want to use it directly:
61
+
62
+ ```bash
63
+ QF_BINARY=/opt/qualflare/qf qf version
64
+ ```
65
+
66
+ `QF_BINARY` takes an absolute path to a `qf` executable and bypasses package resolution entirely.
67
+
68
+ > **Migrating from ≤ 0.1.11.** `QUALFLARE_CLI_SKIP_INSTALL` and `QUALFLARE_CLI_BASE_URL` no longer exist and are safe to delete. There is no download to skip, and mirroring is handled by your npm registry rather than a separate base URL. Use `QF_BINARY` if you were pointing at a self-hosted binary.
69
+
70
+ ## Troubleshooting
71
+
72
+ **`The package "@qualflare/cli-<os>-<arch>" could not be found`**
73
+
74
+ Three usual causes:
75
+
76
+ 1. **Installed with `--omit=optional` or `--no-optional`.** Drop the flag — the platform binary *is* an optional dependency.
77
+ 2. **A stale lockfile.** npm has a long-standing bug where platform-specific optional dependencies are dropped from `package-lock.json` ([npm/cli#4828](https://github.com/npm/cli/issues/4828)). Fix:
78
+ ```bash
79
+ rm -rf node_modules package-lock.json && npm install
80
+ ```
81
+ 3. **`node_modules` built on another platform** — a Docker bind-mount, a WSL/Windows shared directory, or Rosetta. Reinstall on the machine that will run it. The launcher detects this case and says so.
82
+
83
+ **Unsupported platform**
84
+
85
+ Binaries cover macOS, Linux, and Windows on arm64 and x64. Elsewhere, build from source or use another channel below.
86
+
87
+ ## Other install methods
88
+
89
+ Homebrew, Docker (GHCR + Docker Hub), and direct binary downloads are documented in the [main README](https://github.com/Qualflare/qualflare-cli#installation). Those channels ship a `checksums.txt` and a keyless [cosign](https://github.com/sigstore/cosign) signature over it, plus a CycloneDX SBOM per archive.
90
+
91
+ ## Links
92
+
93
+ - **Documentation:** https://docs.qualflare.com
94
+ - **Source & issues:** https://github.com/Qualflare/qualflare-cli
95
+ - **Releases / changelog:** https://github.com/Qualflare/qualflare-cli/releases
96
+
97
+ Licensed under the [Apache License 2.0](https://github.com/Qualflare/qualflare-cli/blob/main/LICENSE).
package/bin/qf ADDED
@@ -0,0 +1,120 @@
1
+ #!/usr/bin/env node
2
+ 'use strict';
3
+
4
+ // Thin launcher: resolve the platform-native `qf` binary out of the matching
5
+ // @qualflare/cli-<os>-<arch> optional dependency and exec it, forwarding args, stdio,
6
+ // and the exit code.
7
+ //
8
+ // There is deliberately no install script here. The binary arrives as an ordinary npm
9
+ // tarball that the resolver picks via the platform package's `os`/`cpu` fields, so
10
+ // nothing is downloaded or executed at install time.
11
+
12
+ const { spawnSync } = require('node:child_process');
13
+
14
+ const PLATFORMS = {
15
+ darwin: {
16
+ arm64: '@qualflare/cli-darwin-arm64/bin/qf',
17
+ x64: '@qualflare/cli-darwin-x64/bin/qf',
18
+ },
19
+ linux: {
20
+ arm64: '@qualflare/cli-linux-arm64/bin/qf',
21
+ x64: '@qualflare/cli-linux-x64/bin/qf',
22
+ },
23
+ win32: {
24
+ arm64: '@qualflare/cli-win32-arm64/bin/qf.exe',
25
+ x64: '@qualflare/cli-win32-x64/bin/qf.exe',
26
+ },
27
+ };
28
+
29
+ const RELEASES = 'https://github.com/Qualflare/qualflare-cli/releases';
30
+
31
+ function fail(lines) {
32
+ for (const line of lines) console.error(line);
33
+ process.exit(1);
34
+ }
35
+
36
+ // npm skips a failed optional dependency without reporting an error, so "the package
37
+ // isn't there" has several very different causes. Tell them apart — a bare
38
+ // MODULE_NOT_FOUND sends people down the wrong path.
39
+ function diagnose(subpath) {
40
+ const wanted = subpath.split('/').slice(0, 2).join('/'); // @qualflare/cli-<os>-<arch>
41
+
42
+ // Did a *different* platform's package get installed? That means these node_modules
43
+ // were populated on another machine (Docker bind-mount, WSL share, Rosetta).
44
+ //
45
+ // Probe with require.resolve rather than reading the scope directory: the layout on
46
+ // disk differs between npm, pnpm, Yarn PnP, and global installs, but resolution works
47
+ // the same way in all of them.
48
+ const siblings = [];
49
+ for (const byArch of Object.values(PLATFORMS)) {
50
+ for (const other of Object.values(byArch)) {
51
+ const name = other.split('/').slice(0, 2).join('/');
52
+ if (name === wanted) continue;
53
+ try {
54
+ require.resolve(`${name}/package.json`);
55
+ siblings.push(name);
56
+ } catch {
57
+ // not installed — expected for every platform but the host's
58
+ }
59
+ }
60
+ }
61
+
62
+ if (siblings.length > 0) {
63
+ fail([
64
+ `[qualflare] "${wanted}" is missing, but ${siblings
65
+ .map((s) => `"${s}"`)
66
+ .join(', ')} is installed.`,
67
+ '',
68
+ "This node_modules was installed for a different platform than the one you're",
69
+ `running on (${process.platform}/${process.arch}) — commonly a Docker bind-mount,`,
70
+ 'a WSL/Windows shared directory, or Rosetta.',
71
+ '',
72
+ 'Reinstall on this machine:',
73
+ ' rm -rf node_modules package-lock.json && npm install',
74
+ ]);
75
+ }
76
+
77
+ fail([
78
+ `[qualflare] The package "${wanted}" could not be found, and is needed by @qualflare/cli.`,
79
+ '',
80
+ 'If you installed with --omit=optional (or --no-optional), drop that flag —',
81
+ '@qualflare/cli uses optionalDependencies to install the right binary for your platform.',
82
+ '',
83
+ 'Otherwise this is likely the known npm lockfile bug with platform-specific optional',
84
+ 'dependencies (https://github.com/npm/cli/issues/4828). Reinstall from scratch:',
85
+ ' rm -rf node_modules package-lock.json && npm install',
86
+ '',
87
+ 'You can also point at a binary yourself with QF_BINARY=/path/to/qf, or install from',
88
+ RELEASES,
89
+ ]);
90
+ }
91
+
92
+ const subpath = PLATFORMS[process.platform]?.[process.arch];
93
+ if (!process.env.QF_BINARY && !subpath) {
94
+ fail([
95
+ `[qualflare] Unsupported platform: ${process.platform}/${process.arch}.`,
96
+ '',
97
+ 'Prebuilt binaries are available for macOS, Linux, and Windows on arm64 and x64.',
98
+ `Install another way — Homebrew, Docker, or a direct download: ${RELEASES}`,
99
+ ]);
100
+ }
101
+
102
+ let bin = process.env.QF_BINARY;
103
+ if (!bin) {
104
+ try {
105
+ bin = require.resolve(subpath);
106
+ } catch {
107
+ diagnose(subpath);
108
+ }
109
+ }
110
+
111
+ const res = spawnSync(bin, process.argv.slice(2), { shell: false, stdio: 'inherit' });
112
+
113
+ if (res.error) {
114
+ fail([
115
+ `[qualflare] could not run qf: ${res.error.message}`,
116
+ '[qualflare] try reinstalling: npm install -g @qualflare/cli',
117
+ ]);
118
+ }
119
+ // A signal-terminated child reports status === null; surface that as a failure.
120
+ process.exit(res.status === null ? 1 : res.status);
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "@qualflare/cli",
3
- "version": "0.1.10",
4
- "description": "Qualflare CLI (qf) — upload test results to Qualflare from any CI or local machine. Installs the platform-native binary from the matching GitHub release.",
3
+ "version": "0.1.12-rc.1",
4
+ "description": "Qualflare CLI (qf) — upload test results to Qualflare from any CI or local machine. Ships the platform-native binary as an optional dependency; no install scripts.",
5
5
  "keywords": [
6
6
  "qualflare",
7
7
  "test",
@@ -24,25 +24,26 @@
24
24
  "license": "Apache-2.0",
25
25
  "author": "Qualflare",
26
26
  "bin": {
27
- "qf": "bin/qf.js"
27
+ "qf": "bin/qf"
28
28
  },
29
29
  "files": [
30
- "bin/qf.js",
31
- "install.js"
30
+ "bin/qf",
31
+ "README.md",
32
+ "LICENSE"
32
33
  ],
33
- "scripts": {
34
- "postinstall": "node install.js"
35
- },
36
34
  "engines": {
37
35
  "node": ">=16"
38
36
  },
39
- "os": [
40
- "darwin",
41
- "linux",
42
- "win32"
43
- ],
44
- "cpu": [
45
- "x64",
46
- "arm64"
47
- ]
37
+ "publishConfig": {
38
+ "access": "public",
39
+ "provenance": true
40
+ },
41
+ "optionalDependencies": {
42
+ "@qualflare/cli-darwin-arm64": "0.1.12-rc.1",
43
+ "@qualflare/cli-darwin-x64": "0.1.12-rc.1",
44
+ "@qualflare/cli-linux-arm64": "0.1.12-rc.1",
45
+ "@qualflare/cli-linux-x64": "0.1.12-rc.1",
46
+ "@qualflare/cli-win32-arm64": "0.1.12-rc.1",
47
+ "@qualflare/cli-win32-x64": "0.1.12-rc.1"
48
+ }
48
49
  }
package/bin/qf.js DELETED
@@ -1,18 +0,0 @@
1
- #!/usr/bin/env node
2
- 'use strict';
3
-
4
- // Thin launcher: exec the platform-native `qf` binary that install.js placed next to
5
- // this file, forwarding args, stdio, and the exit code.
6
-
7
- const path = require('node:path');
8
- const { spawnSync } = require('node:child_process');
9
-
10
- const bin = path.join(__dirname, process.platform === 'win32' ? 'qf.exe' : 'qf');
11
- const res = spawnSync(bin, process.argv.slice(2), { stdio: 'inherit' });
12
-
13
- if (res.error) {
14
- console.error(`[qualflare] could not run qf: ${res.error.message}`);
15
- console.error('[qualflare] try reinstalling: npm install -g @qualflare/cli');
16
- process.exit(1);
17
- }
18
- process.exit(res.status === null ? 1 : res.status);
package/install.js DELETED
@@ -1,124 +0,0 @@
1
- #!/usr/bin/env node
2
- 'use strict';
3
-
4
- // Postinstall: download the platform-native `qf` binary from the matching GitHub
5
- // release, verify its sha256 against the release checksums.txt, and extract it into
6
- // ./bin. Dependency-free (uses Node core + the system `tar`).
7
-
8
- const fs = require('node:fs');
9
- const path = require('node:path');
10
- const os = require('node:os');
11
- const https = require('node:https');
12
- const crypto = require('node:crypto');
13
- const { spawnSync } = require('node:child_process');
14
-
15
- const REPO = 'Qualflare/qualflare-cli';
16
- const pkg = require('./package.json');
17
- const version = pkg.version;
18
-
19
- if (process.env.QUALFLARE_CLI_SKIP_INSTALL === '1') {
20
- console.log('[qualflare] QUALFLARE_CLI_SKIP_INSTALL=1 — skipping binary download.');
21
- process.exit(0);
22
- }
23
-
24
- const PLATFORMS = { darwin: 'darwin', linux: 'linux', win32: 'windows' };
25
- const ARCHES = { x64: 'amd64', arm64: 'arm64' };
26
- const goOS = PLATFORMS[process.platform];
27
- const goArch = ARCHES[process.arch];
28
- if (!goOS || !goArch) {
29
- console.error(
30
- `[qualflare] Unsupported platform: ${process.platform}/${process.arch}. ` +
31
- `Install manually from https://github.com/${REPO}/releases`,
32
- );
33
- process.exit(1);
34
- }
35
-
36
- const isWin = goOS === 'windows';
37
- const ext = isWin ? 'zip' : 'tar.gz';
38
- const binName = isWin ? 'qf.exe' : 'qf';
39
- // Must match the goreleaser archives name_template: qf_<Version>_<Os>_<Arch>.
40
- const archive = `qf_${version}_${goOS}_${goArch}.${ext}`;
41
- const base =
42
- process.env.QUALFLARE_CLI_BASE_URL ||
43
- `https://github.com/${REPO}/releases/download/v${version}`;
44
-
45
- const binDir = path.join(__dirname, 'bin');
46
- const binPath = path.join(binDir, binName);
47
-
48
- // Idempotent — a re-run (or a repaired install) shouldn't re-download.
49
- if (fs.existsSync(binPath)) process.exit(0);
50
- fs.mkdirSync(binDir, { recursive: true });
51
-
52
- // Resolve `tar` to a fixed absolute path rather than searching $PATH (a writable
53
- // $PATH entry could shadow the real binary). bsdtar (macOS, Windows 10+) reads both
54
- // tar.gz and zip; GNU tar (Linux) reads tar.gz — so one `tar -xf` covers every OS.
55
- function resolveTar() {
56
- const candidates = isWin
57
- ? ['C:\\Windows\\System32\\tar.exe']
58
- : ['/usr/bin/tar', '/bin/tar'];
59
- const found = candidates.find((p) => fs.existsSync(p));
60
- if (!found) throw new Error(`no usable tar found (looked in: ${candidates.join(', ')})`);
61
- return found;
62
- }
63
-
64
- function get(url) {
65
- return new Promise((resolve, reject) => {
66
- https
67
- .get(url, { headers: { 'User-Agent': '@qualflare/cli' } }, (res) => {
68
- // Follow the release-asset redirect to the CDN.
69
- if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
70
- res.resume();
71
- resolve(get(res.headers.location));
72
- return;
73
- }
74
- if (res.statusCode !== 200) {
75
- res.resume();
76
- reject(new Error(`GET ${url} -> HTTP ${res.statusCode}`));
77
- return;
78
- }
79
- const chunks = [];
80
- res.on('data', (c) => chunks.push(c));
81
- res.on('end', () => resolve(Buffer.concat(chunks)));
82
- res.on('error', reject);
83
- })
84
- .on('error', reject);
85
- });
86
- }
87
-
88
- (async () => {
89
- try {
90
- const [data, sumsBuf] = await Promise.all([
91
- get(`${base}/${archive}`),
92
- get(`${base}/checksums.txt`),
93
- ]);
94
-
95
- // checksums.txt lines look like: "<sha256> qf_<v>_<os>_<arch>.<ext>"
96
- const line = sumsBuf
97
- .toString('utf8')
98
- .split('\n')
99
- .find((l) => l.trim().endsWith(archive));
100
- const expected = line?.trim().split(/\s+/)[0];
101
- if (!expected) throw new Error(`no checksum entry for ${archive}`);
102
- const actual = crypto.createHash('sha256').update(data).digest('hex');
103
- if (expected !== actual) {
104
- throw new Error(`checksum mismatch for ${archive} (expected ${expected}, got ${actual})`);
105
- }
106
-
107
- // Extract just the binary into ./bin. `tar` preserves the archived mode (0755),
108
- // so the extracted qf is already executable — no chmod needed.
109
- const workDir = fs.mkdtempSync(path.join(os.tmpdir(), 'qualflare-cli-'));
110
- const tmp = path.join(workDir, archive);
111
- fs.writeFileSync(tmp, data);
112
- const r = spawnSync(resolveTar(), ['-xf', tmp, '-C', binDir, binName], { stdio: 'inherit' });
113
- fs.rmSync(workDir, { recursive: true, force: true });
114
- if (r.status !== 0) throw new Error(`extract failed (tar exit ${r.status})`);
115
-
116
- console.log(`[qualflare] installed qf v${version} (${goOS}/${goArch}).`);
117
- } catch (err) {
118
- console.error(`[qualflare] failed to install the qf binary: ${err.message}`);
119
- console.error(
120
- `[qualflare] install manually from https://github.com/${REPO}/releases/tag/v${version}`,
121
- );
122
- process.exit(1);
123
- }
124
- })();