@symbiosis-lab/moss 0.12.1 → 0.15.9

package/README.md

@@ -1,12 +1,6 @@
 # @symbiosis-lab/moss
 
-moss on your PATH. This package downloads the official [moss](https://@symbiosis-lab/moss.com)
-CLI binary from [moss-releases](https://github.com/Symbiosis-Lab/moss-releases)
-and exposes it as the `moss` command.
-
-> **Publishing note:** the package is currently marked `"private": true` in
-> `package.json` so it cannot ship by accident. Flip that (remove the field)
-> at publish time — `publishConfig` is already set up.
+moss on your PATH. This package downloads the open [moss-cli](https://github.com/Symbiosis-Lab/moss/tree/develop/crates/moss-cli) binary and exposes it as the `moss` command.
 
 ## Install
 
@@ -15,12 +9,9 @@ npm install -g @symbiosis-lab/moss
 moss --version
 ```
 
-The binary is fetched at install time (postinstall). With `--ignore-scripts`,
-or if the download failed (e.g. offline), the first `moss` invocation fetches
-it lazily instead.
+The binary is fetched at install time (postinstall). With `--ignore-scripts`, or if the download failed (e.g. offline), the first `moss` invocation fetches it lazily instead.
 
-Supported platforms: macOS (Intel and Apple Silicon, one universal binary)
-and Linux x86_64.
+Supported platforms: macOS (Intel and Apple Silicon, one universal binary) and Linux x86_64. The binary has no window system in its dependency graph, so it starts on a headless Linux server or inside a container with no desktop libraries to install first.
 
 ## Use
 
@@ -30,29 +21,15 @@ moss build ~/Sites/my-site
 
 All arguments pass straight through to the moss binary; see `moss --help`.
 
-## Linux runtime dependency (temporary)
-
-The current Linux binary links against WebKitGTK even for headless CLI verbs.
-If `moss` fails with `error while loading shared libraries`, install:
-
-```sh
-sudo apt install libwebkit2gtk-4.1-0
-```
-
-This requirement is temporary — a moss CLI build without the WebKitGTK
-linkage is planned.
+`moss preview` and `moss edit` need a window, which this binary doesn't have: they hand off to [moss desktop](https://mosspub.com) if it's installed, or print a one-line hint if it isn't. On macOS, `moss desktop install` fetches and installs it for you (see `moss desktop install --help`); it always asks before downloading and never runs unattended (no terminal attached, as in CI, is treated as declining). moss desktop isn't packaged for Linux or Windows yet, so `moss desktop install` there just prints where to get it.
 
 ## Checksums
 
-Downloads are verified against the `SHA256SUMS` file published with each
-release. Releases that predate checksum publishing install with a warning
-instead of verification.
+Downloads are verified against the `SHA256SUMS` file published with each release. Releases that predate checksum publishing install with a warning instead of verification.
 
 ## Versioning and overrides
 
-The wrapper downloads the moss version matching its own package version;
-they are released in lockstep. `MOSS_VERSION_OVERRIDE=v0.11.1` forces a
-specific release (ops/testing escape hatch).
+The wrapper downloads the moss version matching its own package version; they are released in lockstep. `MOSS_VERSION_OVERRIDE=v0.11.1` forces a specific release (ops/testing escape hatch).
 
 ## Controlling the download
 
@@ -62,18 +39,10 @@ specific release (ops/testing escape hatch).
 | `MOSS_BINARY_PATH=/path/to/moss` | Run that binary instead of the vendored one, and skip the download entirely. |
 | `MOSS_FORCE_BINARY_DOWNLOAD=1` | Download even where the wrapper would otherwise skip. |
 
-Each also reads from `.npmrc` under its lowercased name (`moss_skip_binary_download=true`),
-because npm passes config keys to lifecycle scripts as `npm_config_*`.
+Each also reads from `.npmrc` under its lowercased name (`moss_skip_binary_download=true`), because npm passes config keys to lifecycle scripts as `npm_config_*`.
 
-**Inside the moss repo the download is skipped automatically.** A checkout is
-not an install: `packages/moss` sits in the workspace rather than under
-`node_modules`, so `pnpm install` at the repo root would otherwise pull a
-release binary that no moss developer wants — they build from source. Point
-`MOSS_BINARY_PATH` at `src-tauri/target/release/moss` to exercise the wrapper
-against your own build.
+**Inside the moss repo the download is skipped automatically.** A checkout is not an install: `packages/moss` sits in the workspace rather than under `node_modules`, so `pnpm install` at the repo root would otherwise pull a release binary that no moss developer wants — they build from source. Point `MOSS_BINARY_PATH` at `target/release/moss-cli` (`cargo build --release -p moss-cli`) to exercise the wrapper against your own build.
 
 ## License
 
-The wrapper code in this package is MIT (see LICENSE). The moss binary it
-downloads is a separate work, distributed under its own terms via
-[moss-releases](https://github.com/Symbiosis-Lab/moss-releases).
+The wrapper code in this package is MIT (see LICENSE). The moss binary it downloads is a separate work, distributed under its own terms via [moss](https://github.com/Symbiosis-Lab/moss).

package/bin/moss.js

@@ -24,25 +24,10 @@ async function main() {
     await fetchBinary();
   }
 
-  // stderr is piped so a loader failure can be recognized, then replayed
-  // verbatim. stdin/stdout stay inherited for interactive use.
-  const result = spawnSync(binary, process.argv.slice(2), {
-    stdio: ['inherit', 'inherit', 'pipe'],
-  });
-
-  const stderr = result.stderr ? result.stderr.toString() : '';
-  if (stderr) process.stderr.write(stderr);
+  const result = spawnSync(binary, process.argv.slice(2), { stdio: 'inherit' });
 
   if (result.error) throw result.error;
 
-  if (stderr.includes('error while loading shared libraries')) {
-    console.error(
-      '\nmoss-npm: the moss binary currently needs the WebKitGTK runtime libraries:\n' +
-        '  sudo apt install libwebkit2gtk-4.1-0\n' +
-        'This is temporary — a moss CLI build without that linkage is planned.'
-    );
-  }
-
   process.exit(result.status === null ? 1 : result.status);
 }
 

package/lib/fetch.js

@@ -1,4 +1,4 @@
-// Downloads the moss CLI binary for this platform from moss-releases.
+// Downloads the moss CLI binary for this platform from moss.
 //
 // No dependencies: uses the global fetch that ships with Node >= 18.
 // The version defaults to this package's own version (the wrapper is
@@ -11,10 +11,15 @@ const crypto = require('node:crypto');
 const fs = require('node:fs');
 const path = require('node:path');
 
-const RELEASES = 'https://github.com/Symbiosis-Lab/moss-releases/releases/download';
+const RELEASES = 'https://github.com/Symbiosis-Lab/moss/releases/download';
 
 const packageRoot = path.join(__dirname, '..');
-const vendorBinary = path.join(packageRoot, 'vendor', 'moss');
+
+// Compute the vendored binary path at use time, appending .exe on win32.
+function vendorBinary() {
+  const name = process.platform === 'win32' ? 'moss.exe' : 'moss';
+  return path.join(packageRoot, 'vendor', name);
+}
 
 // npm and pnpm expose every `.npmrc` key to lifecycle scripts as `npm_config_<key>`,
 // so one lookup covers both the environment variable and the config file. This is
@@ -58,7 +63,7 @@ function skipDownloadReason() {
 // Which binary `moss` should execute. `MOSS_BINARY_PATH` wins so a developer can
 // point the wrapper at a locally built moss (esbuild's `ESBUILD_BINARY_PATH`).
 function resolveBinary() {
-  return process.env.MOSS_BINARY_PATH || vendorBinary;
+  return process.env.MOSS_BINARY_PATH || vendorBinary();
 }
 
 function resolveVersion() {
@@ -77,10 +82,13 @@ function resolveAsset() {
   if (platform === 'linux' && arch === 'x64') {
     return 'moss-linux-x86_64';
   }
+  if (platform === 'win32' && arch === 'x64') {
+    return 'moss-windows-x86_64.exe';
+  }
   throw new Error(
     `moss-npm: no moss binary is published for ${platform}-${arch}.\n` +
-      'Supported: macOS (x64/arm64) and Linux (x64). ' +
-      'See https://github.com/Symbiosis-Lab/moss-releases for available builds.'
+      'Supported: macOS (x64/arm64), Linux (x64), and Windows (x64). ' +
+      'See https://github.com/Symbiosis-Lab/moss for available builds.'
   );
 }
 
@@ -92,26 +100,57 @@ async function download(url) {
   return Buffer.from(await res.arrayBuffer());
 }
 
-// Verifies bytes against the release's SHA256SUMS. Releases before v0.11.2
-// published no checksums; a missing SHA256SUMS is a warning, not a failure.
+// The first release that published a SHA256SUMS file. Before it there is
+// nothing to verify against; from it on, every release has one.
+const CHECKSUMS_SINCE = [0, 11, 2];
+
+// Must a missing checksum be fatal for this version? Anything unparseable
+// answers yes: an unrecognised version string is not a licence to skip the
+// only check on bytes we are about to mark executable.
+function checksumsRequired(version) {
+  const parts = String(version).split('-')[0].split('.').map(Number);
+  if (parts.length !== 3 || parts.some((n) => !Number.isInteger(n))) return true;
+  for (let i = 0; i < 3; i += 1) {
+    if (parts[i] !== CHECKSUMS_SINCE[i]) return parts[i] > CHECKSUMS_SINCE[i];
+  }
+  return true;
+}
+
+// Verifies bytes against the release's SHA256SUMS.
+//
+// Every reason we might not reach a checksum — a non-200, a network error, a
+// SHA256SUMS with no line for this asset — is reached over the same connection
+// that just served the binary. So on a version that publishes checksums, taking
+// any of them as permission to skip verification hands the skip to whoever
+// controls that connection: suppress one small request and the binary installs
+// unverified. Fail closed there, and keep the warning only for the pre-v0.11.2
+// releases where the file genuinely does not exist.
 async function verifyChecksum(bytes, asset, version) {
+  const unverified = (reason) => {
+    if (checksumsRequired(version)) {
+      throw new Error(
+        `moss-npm: cannot verify moss v${version} (${asset}): ${reason}.\n` +
+          '  Every release from v0.11.2 on publishes SHA256SUMS, so this is either a\n' +
+          '  transient network fault or a tampered download. Not installing.'
+      );
+    }
+    console.warn(`moss-npm: ${reason}; skipping checksum verification (v${version} predates SHA256SUMS)`);
+  };
+
   let sums;
   try {
     const res = await fetch(`${RELEASES}/v${version}/SHA256SUMS`, { redirect: 'follow' });
     if (!res.ok) {
-      console.warn(`moss-npm: no SHA256SUMS published for v${version}; skipping checksum verification`);
-      return;
+      return unverified(`no SHA256SUMS published for v${version} (${res.status})`);
     }
     sums = await res.text();
   } catch (err) {
-    console.warn(`moss-npm: could not fetch SHA256SUMS (${err.message}); skipping checksum verification`);
-    return;
+    return unverified(`could not fetch SHA256SUMS (${err.message})`);
   }
 
   const line = sums.split('\n').find((l) => l.trim().endsWith(asset));
   if (!line) {
-    console.warn(`moss-npm: SHA256SUMS has no entry for ${asset}; skipping checksum verification`);
-    return;
+    return unverified(`SHA256SUMS has no entry for ${asset}`);
   }
 
   const expected = line.trim().split(/\s+/)[0];
@@ -134,17 +173,20 @@ async function fetchBinary() {
   const bytes = await download(url);
   await verifyChecksum(bytes, asset, version);
 
-  fs.mkdirSync(path.dirname(vendorBinary), { recursive: true });
-  fs.writeFileSync(vendorBinary, bytes, { mode: 0o755 });
-  console.log(`moss-npm: installed ${vendorBinary}`);
-  return vendorBinary;
+  const binaryPath = vendorBinary();
+  fs.mkdirSync(path.dirname(binaryPath), { recursive: true });
+  fs.writeFileSync(binaryPath, bytes, { mode: 0o755 });
+  console.log(`moss-npm: installed ${binaryPath}`);
+  return binaryPath;
 }
 
 module.exports = {
+  checksumsRequired,
   fetchBinary,
   vendorBinary,
   resolveAsset,
   resolveBinary,
   resolveVersion,
   skipDownloadReason,
+  verifyChecksum,
 };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@symbiosis-lab/moss",
-  "version": "0.12.1",
-  "description": "moss on your PATH — npm wrapper that installs the moss CLI binary from moss-releases",
+  "version": "0.15.9",
+  "description": "moss on your PATH — npm wrapper that installs the moss CLI binary from moss",
   "bin": {
     "moss": "bin/moss.js"
   },
@@ -22,7 +22,8 @@
   },
   "os": [
     "darwin",
-    "linux"
+    "linux",
+    "win32"
   ],
   "cpu": [
     "x64",
@@ -38,10 +39,10 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/Symbiosis-Lab/moss-releases.git"
+    "url": "git+https://github.com/Symbiosis-Lab/moss.git"
   },
   "bugs": {
-    "url": "https://github.com/Symbiosis-Lab/moss-releases/issues"
+    "url": "https://github.com/Symbiosis-Lab/moss/issues"
   },
   "homepage": "https://mosspub.com",
   "publishConfig": {