@runinfra/cli 0.1.0 → 0.2.0

package/README.md

@@ -3,9 +3,6 @@
 Sign in from your terminal and pull the optimized model packages your workspace
 owns.
 
-Node 20 or newer. **Zero runtime dependencies** by design, so it installs
-quickly and runs cleanly inside a slim container or a locked-down host.
-
 ```console
 $ npm install -g @runinfra/cli
 $ runinfra login
@@ -16,6 +13,53 @@ Replace `<slug>` with the slug shown on your package's page under
 **Optimized models** on runinfra.ai, for example
 `qwen3-6-27b-fp8cd-v3-mlponly-h100-vllm`.
 
+---
+
+## Install
+
+<!-- Release note for the next editor: when the installer and the wheel are
+     actually published, the standalone line becomes the lead command in the
+     block above and its Status cell becomes "Live". Do not promote a row
+     before fetching its artifact and installing from it: the Status column
+     is the only thing standing between a reader and a command that 404s. -->
+
+Run the npm line above if the machine already has Node 20 or newer. It is the
+only channel published today.
+
+Two more channels are on the way, because these kits get pulled onto GPU hosts
+and a GPU host often has Python but no Node:
+
+| Channel | Command | Reach for it when | Status |
+| --- | --- | --- | --- |
+| Standalone | `curl -fsSL https://raw.githubusercontent.com/RightNow-AI/runinfra-cli/main/install.sh \| sh` | The box is bare. No Node, no Python, the download brings its own runtime. | Not published yet |
+| Python | `pip install runinfra-cli` | The machine already lives in Python. | Not published yet |
+| Node | `npm install -g @runinfra/cli` | The machine already lives in Node 20 or newer. | **Live, 0.1.1** |
+
+Only the npm row works right now. Checked on 2026-07-27:
+`pip index versions runinfra-cli` answers "No matching distribution found",
+and the installer URL returns 404 because the script is not on the release
+repository's main branch yet. Both are written down with their real commands
+rather than left out, so the release that publishes them only has to flip a
+Status cell, and so a reader can tell today what works from what does not.
+
+All three publish at the same version, **0.1.1**, and put the same `runinfra`
+command on PATH: the two new channels repackage the client that is already on
+npm rather than changing it. So `runinfra --version` reads the same however it
+arrived, and every command in this document behaves identically. What differs
+is only what has to be on the machine first:
+
+- **Standalone and Python** install one compiled executable with the runtime
+  inside it. Nothing else is required, which is the whole point on a host you
+  did not build. Note the distribution name: `pip install runinfra-cli` is
+  this tool, `pip install runinfra` is the inference SDK, a different product
+  for calling an endpoint from your code.
+- **npm** installs the same program as JavaScript and runs it on the Node you
+  already have. It has **zero runtime dependencies** by design, so it installs
+  quickly and runs cleanly inside a slim container or a locked-down host.
+
+Rather not install anything globally? The npm channel also runs through npx,
+for example `npx @runinfra/cli pull <slug>`.
+
 If your registry cannot find `@runinfra/cli`, the release has not reached it
 yet. Run the CLI from a checkout instead, see [Development](#development).
 

package/dist/endpoints.js

@@ -29,7 +29,7 @@ export function resolveApiBase(env) {
     const base = `${url.origin}${url.pathname}`.replace(/\/+$/u, "");
     return { ok: true, base };
 }
-function isLoopbackHostname(hostname) {
+export function isLoopbackHostname(hostname) {
     return (hostname === "localhost" ||
         hostname === "127.0.0.1" ||
         hostname === "[::1]" ||

package/dist/http.js

@@ -1,6 +1,8 @@
 import { request as httpRequest } from "node:http";
 import { request as httpsRequest } from "node:https";
+import { isLoopbackHostname } from "./endpoints.js";
 import { CliError } from "./errors.js";
+import { CLI_LATEST_VERSION_HEADER, recordLatest } from "./update-notice.js";
 import { userAgent } from "./version.js";
 export const DEFAULT_IDLE_TIMEOUT_MS = 30_000;
 export const DEFAULT_MAX_BODY_BYTES = 2 * 1024 * 1024;
@@ -12,6 +14,7 @@ function normalizeHeaders(message) {
             continue;
         out[name.toLowerCase()] = Array.isArray(value) ? value.join(", ") : value;
     }
+    recordLatest(out[CLI_LATEST_VERSION_HEADER]);
     return out;
 }
 function networkError(url, cause) {
@@ -24,11 +27,30 @@ function networkError(url, cause) {
     }
     return new CliError("network", `Could not reach ${host}: ${detail}`, "Check your connection or proxy settings, then run the command again.");
 }
+const CREDENTIAL_HEADERS = new Set([
+    "authorization",
+    "cookie",
+    "proxy-authorization",
+]);
+function headersForHop(requested, origin, originalOrigin) {
+    if (!requested || origin === originalOrigin)
+        return { ...(requested ?? {}) };
+    const carried = {};
+    for (const [name, value] of Object.entries(requested)) {
+        if (CREDENTIAL_HEADERS.has(name.toLowerCase()))
+            continue;
+        carried[name] = value;
+    }
+    return carried;
+}
 async function dispatch(options) {
     const maxRedirects = options.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
     let currentUrl = options.url;
     let method = options.method;
-    let body = options.json === undefined ? null : Buffer.from(JSON.stringify(options.json), "utf8");
+    let body = options.json === undefined
+        ? null
+        : Buffer.from(JSON.stringify(options.json), "utf8");
+    const originalOrigin = new URL(options.url).origin;
     for (let hop = 0; hop <= maxRedirects; hop += 1) {
         const parsed = new URL(currentUrl);
         const secure = parsed.protocol === "https:";
@@ -36,7 +58,7 @@ async function dispatch(options) {
         const headers = {
             accept: "application/json",
             "user-agent": userAgent(),
-            ...(options.headers ?? {}),
+            ...headersForHop(options.headers, parsed.origin, originalOrigin),
         };
         if (body) {
             headers["content-type"] = "application/json";
@@ -64,7 +86,11 @@ async function dispatch(options) {
         });
         const status = message.statusCode ?? 0;
         const location = message.headers.location;
-        const isRedirect = (status === 301 || status === 302 || status === 303 || status === 307 || status === 308) &&
+        const isRedirect = (status === 301 ||
+            status === 302 ||
+            status === 303 ||
+            status === 307 ||
+            status === 308) &&
             typeof location === "string";
         if (!isRedirect) {
             return { message, finalUrl: currentUrl };
@@ -74,7 +100,11 @@ async function dispatch(options) {
         if (parsed.protocol === "https:" && next.protocol !== "https:") {
             throw new CliError("network", `${parsed.host} redirected to an insecure URL (${next.protocol}//${next.host}).`, "This is not something the CLI can safely follow. Report it to support.");
         }
-        if (status === 303 || ((status === 301 || status === 302) && method !== "HEAD")) {
+        if (next.protocol === "http:" && !isLoopbackHostname(next.hostname)) {
+            throw new CliError("network", `${parsed.host} redirected to a plaintext URL off this machine (${next.protocol}//${next.host}).`, "This is not something the CLI can safely follow. Report it to support.");
+        }
+        if (status === 303 ||
+            ((status === 301 || status === 302) && method !== "HEAD")) {
             method = "GET";
             body = null;
         }
@@ -101,8 +131,13 @@ async function bufferBody(message, url, maxBytes) {
 }
 export async function requestRaw(options) {
     const { message, finalUrl } = await dispatch(options);
+    const headers = normalizeHeaders(message);
     const body = await bufferBody(message, finalUrl, options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES);
-    return { status: message.statusCode ?? 0, headers: normalizeHeaders(message), body };
+    return {
+        status: message.statusCode ?? 0,
+        headers,
+        body,
+    };
 }
 export async function requestJson(options) {
     const raw = await requestRaw(options);
@@ -124,18 +159,25 @@ export async function headResource(url, options = {}) {
     const { message } = await dispatch({
         method: "HEAD",
         url,
-        ...(options.idleTimeoutMs === undefined ? {} : { idleTimeoutMs: options.idleTimeoutMs }),
+        ...(options.idleTimeoutMs === undefined
+            ? {}
+            : { idleTimeoutMs: options.idleTimeoutMs }),
         ...(options.signal ? { signal: options.signal } : {}),
     });
     message.resume();
-    return { status: message.statusCode ?? 0, headers: normalizeHeaders(message) };
+    return {
+        status: message.statusCode ?? 0,
+        headers: normalizeHeaders(message),
+    };
 }
 export async function streamRange(request) {
     const { message, finalUrl } = await dispatch({
         method: "GET",
         url: request.url,
         headers: { range: `bytes=${request.start}-${request.endInclusive}` },
-        ...(request.idleTimeoutMs === undefined ? {} : { idleTimeoutMs: request.idleTimeoutMs }),
+        ...(request.idleTimeoutMs === undefined
+            ? {}
+            : { idleTimeoutMs: request.idleTimeoutMs }),
         ...(request.signal ? { signal: request.signal } : {}),
     });
     const status = message.statusCode ?? 0;
@@ -151,7 +193,9 @@ export async function streamWhole(request) {
     const { message, finalUrl } = await dispatch({
         method: "GET",
         url: request.url,
-        ...(request.idleTimeoutMs === undefined ? {} : { idleTimeoutMs: request.idleTimeoutMs }),
+        ...(request.idleTimeoutMs === undefined
+            ? {}
+            : { idleTimeoutMs: request.idleTimeoutMs }),
         ...(request.signal ? { signal: request.signal } : {}),
     });
     const status = message.statusCode ?? 0;

package/dist/main.js

@@ -6,7 +6,8 @@ import { login } from "./login.js";
 import { logout } from "./logout.js";
 import { createOutput } from "./output.js";
 import { pull } from "./pull.js";
-import { CLI_NAME, CLI_VERSION, isSupportedNodeVersion, MINIMUM_NODE_MAJOR } from "./version.js";
+import { maybePrintUpdateNotice } from "./update-notice.js";
+import { CLI_NAME, CLI_VERSION, isSupportedNodeVersion, MINIMUM_NODE_MAJOR, } from "./version.js";
 import { whoami } from "./whoami.js";
 export async function run(argv, options = {}) {
     const output = options.output ?? createOutput();
@@ -35,22 +36,32 @@ export async function run(argv, options = {}) {
             ...(options.env ? { env: options.env } : {}),
             ...(options.platform ? { platform: options.platform } : {}),
         });
+        let exitCode;
         switch (parsed.args.command) {
             case "login":
-                return await login(context, { device: parsed.args.device });
+                exitCode = await login(context, { device: parsed.args.device });
+                break;
             case "logout":
-                return await logout(context);
+                exitCode = await logout(context);
+                break;
             case "whoami":
-                return await whoami(context);
+                exitCode = await whoami(context);
+                break;
             case "pull": {
                 const slug = parsed.args.slug;
                 if (slug === null) {
                     output.error("runinfra pull needs a package slug.");
                     return 2;
                 }
-                return await pull(context, { slug, out: parsed.args.out, concurrency: parsed.args.concurrency }, signal);
+                exitCode = await pull(context, { slug, out: parsed.args.out, concurrency: parsed.args.concurrency }, signal);
+                break;
             }
         }
+        await maybePrintUpdateNotice(output, {
+            env: options.env ?? process.env,
+            platform: options.platform ?? process.platform,
+        });
+        return exitCode;
     }
     catch (error) {
         output.endStatus();
@@ -61,7 +72,12 @@ export async function run(argv, options = {}) {
         if (described.code === "unexpected") {
             output.detail("This is a bug in the CLI. Report it with the command you ran and this message.");
         }
-        return exitCodeFor(error);
+        const exitCode = exitCodeFor(error);
+        await maybePrintUpdateNotice(output, {
+            env: options.env ?? process.env,
+            platform: options.platform ?? process.platform,
+        });
+        return exitCode;
     }
 }
 function neverAborted() {

package/dist/pull.js

@@ -37,7 +37,25 @@ export async function pull(context, options, signal) {
     const existing = await statOrNull(finalPath);
     if (existing !== null) {
         if (existing.size === artifact.sizeBytes) {
-            output.info(`${fileName} is already downloaded.`);
+            if (lease.checksumSha256) {
+                let lastTickMs = 0;
+                const actual = await sha256File(finalPath, (hashed) => {
+                    const nowMs = Date.now();
+                    if (nowMs - lastTickMs < 500)
+                        return;
+                    lastTickMs = nowMs;
+                    const percent = artifact.sizeBytes > 0 ? (hashed / artifact.sizeBytes) * 100 : 0;
+                    output.status(`  Checking the file already here  ${percent.toFixed(1)}%`);
+                }, signal);
+                output.endStatus();
+                if (judgeChecksum(lease.checksumSha256, actual) === "mismatch") {
+                    throw new CliError("checksum_mismatch", `${finalPath} is the published size but does not match the published checksum.`, "Move or delete that file, then run the same command again to download it fresh.");
+                }
+                output.info(`${fileName} is already downloaded, and its checksum matches.`);
+            }
+            else {
+                output.info(`${fileName} is already downloaded. UNVERIFIED: this package publishes no checksum.`);
+            }
             output.result(finalPath);
             return 0;
         }

package/dist/update-notice.js

@@ -0,0 +1,216 @@
+import { chmod, mkdir, open, readFile, rename, rm, writeFile, } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { credentialLocation } from "./paths.js";
+import { CLI_VERSION } from "./version.js";
+export const CLI_LATEST_VERSION_HEADER = "x-runinfra-cli-latest";
+export const UPDATE_CHECK_FILE_NAME = "update-check.json";
+const NOTICE_INTERVAL_MS = 24 * 60 * 60 * 1_000;
+const PYPI_CHANNEL = "pypi";
+const POSIX_INSTALLER = "curl -fsSL https://raw.githubusercontent.com/RightNow-AI/runinfra-cli/main/install.sh | sh";
+const WINDOWS_INSTALLER = "irm https://raw.githubusercontent.com/RightNow-AI/runinfra-cli/main/install.ps1 | iex";
+let latestSeen = null;
+function parseVersion(version) {
+    const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/u.exec(version);
+    if (!match)
+        return null;
+    const core = [match[1], match[2], match[3]].map((part) => Number.parseInt(part ?? "", 10));
+    if (core.some((part) => !Number.isSafeInteger(part) || part < 0))
+        return null;
+    const rawPrerelease = match[4];
+    const prerelease = rawPrerelease?.split(".") ?? null;
+    if (prerelease?.some((part) => part.length === 0 ||
+        !/^[0-9A-Za-z-]+$/u.test(part) ||
+        (/^\d+$/u.test(part) && part.length > 1 && part.startsWith("0")))) {
+        return null;
+    }
+    return {
+        core: [core[0] ?? 0, core[1] ?? 0, core[2] ?? 0],
+        prerelease,
+    };
+}
+function comparePrerelease(a, b) {
+    if (a === null && b === null)
+        return 0;
+    if (a === null)
+        return 1;
+    if (b === null)
+        return -1;
+    const length = Math.max(a.length, b.length);
+    for (let index = 0; index < length; index += 1) {
+        const aPart = a[index];
+        const bPart = b[index];
+        if (aPart === undefined)
+            return -1;
+        if (bPart === undefined)
+            return 1;
+        if (aPart === bPart)
+            continue;
+        const aNumeric = /^\d+$/u.test(aPart);
+        const bNumeric = /^\d+$/u.test(bPart);
+        if (aNumeric && bNumeric) {
+            if (aPart.length !== bPart.length) {
+                return aPart.length < bPart.length ? -1 : 1;
+            }
+            return aPart < bPart ? -1 : 1;
+        }
+        if (aNumeric !== bNumeric)
+            return aNumeric ? -1 : 1;
+        return aPart < bPart ? -1 : 1;
+    }
+    return 0;
+}
+export function compareVersions(a, b) {
+    const parsedA = parseVersion(a);
+    const parsedB = parseVersion(b);
+    if (!parsedA || !parsedB)
+        return 0;
+    for (let index = 0; index < parsedA.core.length; index += 1) {
+        const aPart = parsedA.core[index] ?? 0;
+        const bPart = parsedB.core[index] ?? 0;
+        if (aPart === bPart)
+            continue;
+        return aPart < bPart ? -1 : 1;
+    }
+    return comparePrerelease(parsedA.prerelease, parsedB.prerelease);
+}
+export function recordLatest(version) {
+    if (version === undefined || parseVersion(version) === null)
+        return;
+    if (latestSeen === null || compareVersions(version, latestSeen) === 1) {
+        latestSeen = version;
+    }
+}
+export function __resetLatestForTest() {
+    latestSeen = null;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseState(raw) {
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (!isRecord(value))
+        return null;
+    if (typeof value.version !== "string" ||
+        parseVersion(value.version) === null) {
+        return null;
+    }
+    if (typeof value.lastNotifiedAt !== "number" ||
+        !Number.isSafeInteger(value.lastNotifiedAt) ||
+        value.lastNotifiedAt < 0) {
+        return null;
+    }
+    return { version: value.version, lastNotifiedAt: value.lastNotifiedAt };
+}
+async function readState(file) {
+    let raw;
+    try {
+        raw = await readFile(file, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            return { kind: "missing" };
+        }
+        throw error;
+    }
+    const state = parseState(raw);
+    return state ? { kind: "valid", state } : { kind: "invalid" };
+}
+function shouldNotify(latest, state, nowMs) {
+    if (compareVersions(latest, CLI_VERSION) !== 1)
+        return false;
+    if (state.kind === "invalid")
+        return false;
+    if (state.kind === "missing")
+        return true;
+    const alreadyNotified = compareVersions(state.state.version, latest);
+    if (alreadyNotified === 1)
+        return false;
+    if (alreadyNotified === -1)
+        return true;
+    return nowMs - state.state.lastNotifiedAt >= NOTICE_INTERVAL_MS;
+}
+function updateMessage(latest, env, platform, versions) {
+    if (env.RUNINFRA_DIST_CHANNEL === PYPI_CHANNEL) {
+        return `RunInfra CLI ${latest} is available. Upgrade: pip install --upgrade runinfra-cli`;
+    }
+    if (versions.bun !== undefined) {
+        const installer = platform === "win32" ? WINDOWS_INSTALLER : POSIX_INSTALLER;
+        return `RunInfra CLI ${latest} is available. Re-run the RunInfra standalone installer: ${installer}`;
+    }
+    return `RunInfra CLI ${latest} is available. Upgrade: npm install -g @runinfra/cli@latest`;
+}
+async function persistState(file, temp, state, platform) {
+    try {
+        await writeFile(temp, `${JSON.stringify(state, null, 2)}\n`, {
+            encoding: "utf8",
+            mode: 0o600,
+        });
+        if (platform !== "win32")
+            await chmod(temp, 0o600);
+        await rename(temp, file);
+        if (platform !== "win32")
+            await chmod(file, 0o600);
+    }
+    catch (error) {
+        await rm(temp, { force: true }).catch(() => undefined);
+        throw error;
+    }
+}
+async function releaseLock(lock, lockFile) {
+    if (lock === null)
+        return;
+    await lock.close().catch(() => undefined);
+    await rm(lockFile, { force: true }).catch(() => undefined);
+}
+async function printUpdateNotice(output, deps) {
+    const latest = latestSeen;
+    if (latest === null || compareVersions(latest, CLI_VERSION) !== 1)
+        return;
+    const env = deps.env ?? process.env;
+    const platform = deps.platform ?? process.platform;
+    const location = credentialLocation({
+        platform,
+        env,
+        homeDir: deps.homeDir ?? homedir(),
+    });
+    const file = join(location.dir, UPDATE_CHECK_FILE_NAME);
+    const temp = `${file}.${process.pid}.tmp`;
+    const lockFile = `${file}.lock`;
+    const nowMs = (deps.now ?? Date.now)();
+    if (!Number.isSafeInteger(nowMs) || nowMs < 0)
+        return;
+    await mkdir(location.dir, {
+        recursive: true,
+        ...(platform === "win32" ? {} : { mode: 0o700 }),
+    });
+    if (platform !== "win32")
+        await chmod(location.dir, 0o700);
+    let lock = null;
+    try {
+        lock = await open(lockFile, "wx", 0o600);
+        if (platform !== "win32")
+            await chmod(lockFile, 0o600);
+        const state = await readState(file);
+        if (!shouldNotify(latest, state, nowMs))
+            return;
+        await persistState(file, temp, { version: latest, lastNotifiedAt: nowMs }, platform);
+        output.info(updateMessage(latest, env, platform, deps.versions ?? process.versions));
+    }
+    finally {
+        await releaseLock(lock, lockFile);
+    }
+}
+export async function maybePrintUpdateNotice(output, deps = {}) {
+    try {
+        await printUpdateNotice(output, deps);
+    }
+    catch {
+    }
+}

package/dist/version.js

@@ -1,6 +1,6 @@
 export const CLI_NAME = "runinfra";
 export const CLI_PACKAGE = "@runinfra/cli";
-export const CLI_VERSION = "0.1.0";
+export const CLI_VERSION = "0.2.0";
 export const CLI_CLIENT_ID = "runinfra-cli";
 export const MINIMUM_NODE_MAJOR = 20;
 export function isSupportedNodeVersion(version) {

package/package.json

@@ -1,9 +1,13 @@
 {
   "name": "@runinfra/cli",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "RunInfra CLI: browser-approved sign-in and resumable downloads for optimized model packages",
   "license": "SEE LICENSE IN LICENSE",
-  "homepage": "https://runinfra.ai/optimized-models",
+  "homepage": "https://runinfra.ai/catalog",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/RightNow-AI/runinfra-cli.git"
+  },
   "bugs": {
     "url": "https://runinfra.ai/contact"
   },