@usearete/a4 0.12.0 → 0.14.0

package/README.md

@@ -1,46 +1,81 @@
-# Arete CLI
+# @usearete/a4
 
-Programmable data feeds for Solana. Arete CLI lets you deploy feeds for any Solana data to our cloud.
+The Arete CLI (`a4`) as an npm package. Programmable, real-time Solana data
+feeds: deploy stacks, explore live data, wire up your agent.
 
-## Quick Start
+## Install
 
 ```bash
-npx @usearete/a4 create my-app
-cd my-app
-npm run dev
+npx @usearete/a4 install
 ```
 
-## Installation
+This downloads the `a4` release binary for your platform (the version is
+locked to the package version), verifies its SHA-256 and minisign signature,
+copies it to `~/.local/bin/a4` (`%USERPROFILE%\.local\bin\a4.exe` on
+Windows), adds that directory to your shell PATH and writes
+`~/.arete/receipt.json`. The last two stdout lines are always:
 
-### npm (recommended for JS/TS developers)
+```text
+A4_BIN=/home/you/.local/bin/a4
+export PATH="$HOME/.local/bin:$PATH"
+```
+
+Agents: your shell snapshotted PATH when the session started, so either
+`eval` the `export` line or call the `A4_BIN` path directly.
+
+Equivalent:
 
 ```bash
-npm install -g @usearete/a4
+npm install -g @usearete/a4 && a4 install   # global shim, same download path
+pnpm dlx @usearete/a4 install
+bunx @usearete/a4 install
 ```
 
-### Cargo (for Rust developers)
+Or without Node at all:
 
 ```bash
-cargo install a4-cli
+curl -fsSL https://arete.run/install.sh | sh          # macOS, Linux
+irm https://arete.run/install.ps1 | iex                # Windows PowerShell
 ```
 
-## Commands
+Flags and environment:
+
+| Flag / env | Effect |
+|---|---|
+| `--install-dir DIR` / `A4_INSTALL_DIR` | Install somewhere other than `~/.local/bin` |
+| `--no-modify-path` / `A4_NO_MODIFY_PATH=1` | Do not edit shell rc files / the Windows user PATH |
+| `--json` | Print the install receipt as JSON (the `A4_BIN=` line still follows) |
+| `A4_MANIFEST_BASE_URL`, `A4_LATEST_URL` | Test overrides for the release download base and latest pointer |
+
+The package has no `postinstall` script and no dependencies; nothing touches
+the network at `npm install` time.
+
+## Run
 
-| Command | Description |
-|---------|-------------|
-| `a4 create [name]` | Scaffold a new app from a template |
-| `a4 init` | Initialize a stack project |
-| `a4 up <path.stack-manifest.json>` | Deploy one exact StackManifest |
-| `a4 status` | Show project overview |
-| `a4 auth login` | Authenticate with Arete |
+Once installed, `a4` is on PATH in new shells. `npx @usearete/a4 <args>` also
+works in the same session: it runs the binary recorded in
+`~/.arete/receipt.json`, installing it silently first if needed, so
+`npx @usearete/a4 explore --json` prints only the command's JSON.
 
-The npm package `@usearete/a4` and the Cargo crate `a4-cli` both install the same `a4` command.
+```bash
+a4 init -y          # arete.toml, AGENTS.md, CLAUDE.md, MCP config, skills
+a4 doctor --json    # check the setup
+a4 explore --json   # what live data is available
+a4 self update      # upgrade in place (alias: a4 upgrade)
+```
+
+Full reference: <https://docs.arete.run/cli/commands/>. Agent setup guide:
+<https://docs.arete.run/agent.md>.
+
+## Building from source
 
-## Documentation
+Only needed for unsupported platforms (anything other than
+darwin-arm64/x64, linux-x64/arm64, win32-x64):
 
-- [Getting Started](https://docs.arete.run)
-- [CLI Reference](https://docs.arete.run/cli/commands/)
-- [Stack Development](https://docs.arete.run/building-stacks/workflow/)
+```bash
+cargo install a4-cli
+a4 self install --source manual
+```
 
 ## License
 

package/bin/a4.js

@@ -1,106 +1,360 @@
 #!/usr/bin/env node
+"use strict";
 
-const { spawnSync } = require("child_process");
-const path = require("path");
-const fs = require("fs");
+// @usearete/a4 launcher. Scriptless bootstrapper for the Arete CLI (`a4`):
+//
+//   npx @usearete/a4 install [--install-dir DIR] [--no-modify-path] [--json]
+//     Download the release asset for this package's version, verify sha256 +
+//     minisign signature, then run `<tmp>/a4 self install --source npm ...`.
+//   npx @usearete/a4 <anything else>
+//     Run the binary recorded in ~/.arete/receipt.json (installing silently
+//     first when there is no receipt) with the given argv.
+//
+// No lifecycle scripts, no dependencies, no network access at `npm install`.
+// Design: docs/internal/agent-first-onboarding.md (WP3).
 
-const binName = process.platform === "win32" ? "a4.exe" : "a4";
-const localBinPath = path.join(__dirname, binName);
+const crypto = require("node:crypto");
+const fs = require("node:fs");
+const http = require("node:http");
+const https = require("node:https");
+const os = require("node:os");
+const path = require("node:path");
+const { spawnSync } = require("node:child_process");
+
+const pkg = require("../package.json");
 
 const RECURSION_SENTINEL = "ARETE_A4_LAUNCHER_ACTIVE";
+const MINISIGN_PUBLIC_KEY = "RWRsiwmDW0371BZbcE1IWD6Y8/KIoAArUAp7mpyG6VweJ5rE3Lf3g5qA";
+const RELEASE_BASE = "https://github.com/AreteA4/arete/releases/download";
+const MAX_REDIRECTS = 5;
+const ASSETS = {
+  "darwin-arm64": "a4-darwin-arm64",
+  "darwin-x64": "a4-darwin-x64",
+  "linux-x64": "a4-linux-x64",
+  "linux-arm64": "a4-linux-arm64",
+  "win32-x64": "a4-win32-x64.exe",
+};
+const ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
 
-function canonicalPath(candidate) {
-  try {
-    return fs.realpathSync(candidate);
-  } catch {
-    return path.resolve(candidate);
+class InstallError extends Error {}
+
+// ---------------------------------------------------------------------------
+// Platform, URLs, receipt
+
+function pickAsset(platform = process.platform, arch = process.arch) {
+  return ASSETS[`${platform}-${arch}`] || null;
+}
+
+// Same semantics as cli/src/selfhost/platform.rs::release_base_url.
+function releaseBaseUrl(version, env = process.env) {
+  const override = (env.A4_MANIFEST_BASE_URL || "").trim();
+  if (override) {
+    const base = override.replace(/\/+$/, "");
+    return base.includes("{version}")
+      ? base.split("{version}").join(version)
+      : `${base}/a4-cli-v${version}`;
   }
+  return `${RELEASE_BASE}/a4-cli-v${version}`;
 }
 
-function pathCandidates(env = process.env, platform = process.platform) {
-  const names = platform === "win32" ? ["a4.exe"] : ["a4"];
-  return (env.PATH || "")
-    .split(path.delimiter)
-    .filter(Boolean)
-    .flatMap((directory) => names.map((name) => path.join(directory, name)));
+function areteHome(env = process.env, homedir = os.homedir()) {
+  return env.ARETE_HOME ? env.ARETE_HOME : path.join(homedir, ".arete");
 }
 
-function isExecutableFile(candidate, platform = process.platform) {
+function receiptPath(env = process.env, homedir = os.homedir()) {
+  return path.join(areteHome(env, homedir), "receipt.json");
+}
+
+// Parsed receipt when it exists, is well-formed and its binary is present; else null.
+function readReceipt(env = process.env, homedir = os.homedir()) {
+  let receipt;
   try {
-    if (!fs.statSync(candidate).isFile()) return false;
-    if (platform !== "win32") {
-      fs.accessSync(candidate, fs.constants.X_OK);
-    }
-    return true;
+    receipt = JSON.parse(fs.readFileSync(receiptPath(env, homedir), "utf8"));
   } catch {
-    return false;
+    return null;
   }
+  if (!receipt || typeof receipt !== "object" || typeof receipt.binary !== "string") return null;
+  try {
+    if (!fs.statSync(receipt.binary).isFile()) return null;
+  } catch {
+    return null;
+  }
+  return receipt;
 }
 
-// Try the concrete postinstall destination first, then every PATH candidate
-// except this JavaScript launcher (including symlinks in node_modules/.bin).
-function getBinaryPath(env = process.env, platform = process.platform) {
-  const launcherPaths = new Set(
-    [__filename, process.argv[1]].filter(Boolean).map(canonicalPath)
-  );
+// ---------------------------------------------------------------------------
+// Checksums
 
-  // 1. Check for bundled binary (npm postinstall)
-  if (
-    isExecutableFile(localBinPath, platform)
-    && !launcherPaths.has(canonicalPath(localBinPath))
-  ) {
-    return localBinPath;
+// `<sha256>  <asset>` per line (optional `*` binary marker) -> Map(asset -> sha256 lowercase).
+function parseChecksums(text) {
+  const map = new Map();
+  for (const line of String(text).split(/\r?\n/)) {
+    const match = line.match(/^([a-fA-F0-9]{64})\s+\*?(\S.*?)\s*$/);
+    if (match) map.set(match[2], match[1].toLowerCase());
   }
+  return map;
+}
 
-  // 2. Check system PATH (cargo install, manual install)
-  for (const candidate of pathCandidates(env, platform)) {
-    if (!isExecutableFile(candidate, platform)) continue;
-    if (launcherPaths.has(canonicalPath(candidate))) continue;
-    return candidate;
-  }
+function sha256File(filePath) {
+  return new Promise((resolve, reject) => {
+    const hash = crypto.createHash("sha256");
+    fs.createReadStream(filePath)
+      .on("error", reject)
+      .on("data", (chunk) => hash.update(chunk))
+      .on("end", () => resolve(hash.digest("hex")));
+  });
+}
 
-  return null;
+// ---------------------------------------------------------------------------
+// minisign (https://jedisct1.github.io/minisign/) verification in pure Node.
+//
+// Public key: base64 of  alg("Ed") || key_id(8) || ed25519_pk(32)
+// Signature file:
+//   untrusted comment: ...
+//   base64( alg("ED") || key_id(8) || signature(64) )
+//   trusted comment: <text>
+//   base64( global_signature(64) )      over signature || trusted comment
+// alg "ED" signs blake2b-512(message); legacy "Ed" (signs raw message) is rejected.
+
+function parseMinisignPublicKey(text) {
+  const line = String(text)
+    .split(/\r?\n/)
+    .map((l) => l.trim())
+    .find((l) => l && !l.startsWith("untrusted comment:"));
+  const raw = line ? Buffer.from(line, "base64") : Buffer.alloc(0);
+  if (raw.length !== 42) throw new InstallError("minisign public key: expected 42 bytes");
+  const algorithm = raw.subarray(0, 2).toString("latin1");
+  if (algorithm !== "Ed") throw new InstallError(`minisign public key: unsupported algorithm ${JSON.stringify(algorithm)}`);
+  return { algorithm, keyId: raw.subarray(2, 10), key: raw.subarray(10, 42) };
 }
 
-function main() {
-  if (process.env[RECURSION_SENTINEL] === "1") {
-    console.error("Refusing to recursively launch the Arete CLI shim.");
-    process.exit(1);
+function parseMinisignSignature(text) {
+  const lines = String(text).split(/\r?\n/).map((l) => l.trim());
+  const [untrusted, sigLine, trustedLine, globalLine] = lines;
+  if (!untrusted || !untrusted.startsWith("untrusted comment:") || !sigLine || !trustedLine || !globalLine) {
+    throw new InstallError("minisign signature: malformed file (expected 4 lines)");
+  }
+  if (!trustedLine.startsWith("trusted comment:")) {
+    throw new InstallError("minisign signature: missing trusted comment line");
   }
+  const raw = Buffer.from(sigLine, "base64");
+  if (raw.length !== 74) throw new InstallError("minisign signature: expected 74 bytes");
+  const algorithm = raw.subarray(0, 2).toString("latin1");
+  if (algorithm === "Ed") throw new InstallError("minisign signature: legacy (non-prehashed) signature rejected");
+  if (algorithm !== "ED") throw new InstallError(`minisign signature: unsupported algorithm ${JSON.stringify(algorithm)}`);
+  const globalSignature = Buffer.from(globalLine, "base64");
+  if (globalSignature.length !== 64) throw new InstallError("minisign signature: global signature must be 64 bytes");
+  return {
+    algorithm,
+    keyId: raw.subarray(2, 10),
+    signature: raw.subarray(10, 74),
+    trustedComment: trustedLine.slice("trusted comment:".length).replace(/^ /, ""),
+    globalSignature,
+  };
+}
 
-  const binPath = getBinaryPath();
+function ed25519KeyObject(rawKey) {
+  return crypto.createPublicKey({
+    key: Buffer.concat([ED25519_SPKI_PREFIX, rawKey]),
+    format: "der",
+    type: "spki",
+  });
+}
 
-  if (!binPath) {
-    console.error(
-      "Arete CLI binary not found. This usually means the postinstall script failed.\n" +
-      "Try reinstalling: npm install @usearete/a4\n" +
-      "\n" +
-      "If the problem persists, you can install the CLI via Cargo:\n" +
-      "  cargo install a4-cli"
+// Throws InstallError on any failure; returns { trustedComment } on success.
+function verifyMinisign({ publicKey, signature, message }) {
+  const pk = typeof publicKey === "string" ? parseMinisignPublicKey(publicKey) : publicKey;
+  const sig = typeof signature === "string" ? parseMinisignSignature(signature) : signature;
+  if (!pk.keyId.equals(sig.keyId)) {
+    throw new InstallError(
+      `minisign signature: key id ${sig.keyId.toString("hex")} does not match the embedded key ${pk.keyId.toString("hex")}`
     );
-    process.exit(1);
   }
+  const key = ed25519KeyObject(pk.key);
+  const prehash = crypto.createHash("blake2b512").update(message).digest();
+  if (!crypto.verify(null, prehash, key, sig.signature)) {
+    throw new InstallError("minisign signature: signature does not match checksums.txt");
+  }
+  const globalMessage = Buffer.concat([sig.signature, Buffer.from(sig.trustedComment, "utf8")]);
+  if (!crypto.verify(null, globalMessage, key, sig.globalSignature)) {
+    throw new InstallError("minisign signature: global signature (trusted comment) invalid");
+  }
+  return { trustedComment: sig.trustedComment };
+}
 
-  const result = spawnSync(binPath, process.argv.slice(2), {
-    stdio: "inherit",
-    env: { ...process.env, [RECURSION_SENTINEL]: "1" },
+// ---------------------------------------------------------------------------
+// HTTP (follows up to MAX_REDIRECTS redirects; http: allowed for test servers)
+
+function getResponse(url, depth = 0) {
+  if (depth > MAX_REDIRECTS) return Promise.reject(new InstallError(`too many redirects fetching ${url}`));
+  return new Promise((resolve, reject) => {
+    const client = url.startsWith("http:") ? http : https;
+    client
+      .get(url, { headers: { "user-agent": `@usearete/a4 ${pkg.version}` } }, (response) => {
+        const { statusCode, headers } = response;
+        if ([301, 302, 303, 307, 308].includes(statusCode)) {
+          response.resume();
+          if (!headers.location) return reject(new InstallError(`redirect from ${url} has no location header`));
+          return resolve(getResponse(new URL(headers.location, url).toString(), depth + 1));
+        }
+        resolve(response);
+      })
+      .on("error", reject);
   });
+}
 
+async function fetchToFile(url, dest, mode) {
+  const response = await getResponse(url);
+  if (response.statusCode !== 200) {
+    response.resume();
+    return response.statusCode;
+  }
+  await new Promise((resolve, reject) => {
+    const file = fs.createWriteStream(dest, { mode });
+    response.on("error", (err) => { file.destroy(); reject(err); });
+    file.on("error", reject);
+    file.on("finish", () => file.close(resolve));
+    response.pipe(file);
+  });
+  return 200;
+}
+
+// ---------------------------------------------------------------------------
+// Install
+
+function stillPublishing(version, url) {
+  return new InstallError(`Release ${version} is still publishing; retry in a few minutes (missing ${url})`);
+}
+
+// Download + verify into a fresh temp dir. Returns { dir, binary, checksums, signature }.
+async function downloadRelease({ version = pkg.version, env = process.env, platform = process.platform, arch = process.arch, publicKey = MINISIGN_PUBLIC_KEY, log = () => {} } = {}) {
+  const asset = pickAsset(platform, arch);
+  if (!asset) {
+    throw new InstallError(
+      `no prebuilt a4 binary for ${platform}-${arch}. Build from source: https://github.com/AreteA4/arete#building-from-source`
+    );
+  }
+  const base = releaseBaseUrl(version, env);
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "a4-install-"));
+  const binary = path.join(dir, platform === "win32" ? "a4.exe" : "a4");
+  const checksums = path.join(dir, "checksums.txt");
+  const signature = path.join(dir, "checksums.txt.minisig");
+  log(`Installing a4 ${version} (${platform}-${arch}) from ${base}`);
+
+  for (const [name, dest, mode] of [[asset, binary, 0o755], ["checksums.txt", checksums, 0o644], ["checksums.txt.minisig", signature, 0o644]]) {
+    const url = `${base}/${name}`;
+    let status;
+    try {
+      status = await fetchToFile(url, dest, mode);
+    } catch (err) {
+      throw new InstallError(`download of ${url} failed: ${err.message}. Check network/proxy settings and retry`);
+    }
+    if (status === 404) throw stillPublishing(version, url);
+    if (status !== 200) throw new InstallError(`download of ${url} failed (HTTP ${status}). Retry in a few minutes`);
+  }
+
+  const checksumText = fs.readFileSync(checksums, "utf8");
+  verifyMinisign({ publicKey, signature: fs.readFileSync(signature, "utf8"), message: Buffer.from(checksumText, "utf8") });
+  const expected = parseChecksums(checksumText).get(asset);
+  if (!expected) throw new InstallError(`checksums.txt has no entry for ${asset}; the release may be incomplete, retry in a few minutes`);
+  const actual = await sha256File(binary);
+  if (actual !== expected) {
+    throw new InstallError(
+      `sha256 mismatch for ${asset} (expected ${expected}, got ${actual}). Retry; if it persists, report at https://github.com/AreteA4/arete/issues`
+    );
+  }
+  if (platform !== "win32") fs.chmodSync(binary, 0o755);
+  return { dir, binary, checksums, signature };
+}
+
+// Run the full install path. `quiet` captures stdout and returns the A4_BIN path.
+// Returns { status, a4Bin }.
+async function runInstall(passthrough = [], options = {}) {
+  const { quiet = false, env = process.env, stdio = "inherit", log = (m) => process.stderr.write(`${m}\n`) } = options;
+  const release = await downloadRelease({ ...options, log });
+  try {
+    const args = ["self", "install", "--source", "npm", "--checksums", release.checksums, "--signature", release.signature, ...passthrough];
+    const result = spawnSync(release.binary, args, {
+      stdio: quiet ? ["ignore", "pipe", "inherit"] : stdio,
+      encoding: "utf8",
+      env: { ...env, [RECURSION_SENTINEL]: "1" },
+    });
+    if (result.error) throw new InstallError(`failed to run ${release.binary}: ${result.error.message}`);
+    let a4Bin = null;
+    if (quiet && result.stdout) {
+      const line = result.stdout.split(/\r?\n/).reverse().find((l) => l.startsWith("A4_BIN="));
+      if (line) a4Bin = line.slice("A4_BIN=".length).trim();
+    }
+    return { status: result.status ?? 1, a4Bin };
+  } finally {
+    fs.rmSync(release.dir, { recursive: true, force: true });
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Launcher
+
+function runBinary(binary, argv, { env = process.env, stdio = "inherit" } = {}) {
+  const result = spawnSync(binary, argv, { stdio, env: { ...env, [RECURSION_SENTINEL]: "1" }, encoding: "utf8" });
   if (result.error) {
-    if (result.error.code === "EACCES") {
-      console.error(
-        "Permission denied. Try running:\n" +
-        `  chmod +x "${binPath}"`
-      );
-    } else {
-      console.error("Failed to run Arete CLI:", result.error.message);
+    const hint = result.error.code === "EACCES" ? ` Try: chmod +x "${binary}"` : "";
+    throw new InstallError(`failed to run ${binary}: ${result.error.message}.${hint} Reinstall with: npx @usearete/a4 install`);
+  }
+  return result;
+}
+
+// Returns the process exit code. Options are for tests (env, homedir, publicKey, stdio).
+async function launch(argv, options = {}) {
+  const { env = process.env, homedir = os.homedir(), stdio = "inherit", log = (m) => process.stderr.write(`${m}\n`) } = options;
+  if (env[RECURSION_SENTINEL] === "1") {
+    log("Refusing to recursively launch the Arete CLI shim.");
+    return 1;
+  }
+  if (argv[0] === "install") {
+    return (await runInstall(argv.slice(1), { ...options, env, log })).status;
+  }
+
+  let receipt = readReceipt(env, homedir);
+  if (!receipt) {
+    log(`a4 is not installed yet (no ${receiptPath(env, homedir)}); installing a4 ${pkg.version} first`);
+    const { status, a4Bin } = await runInstall([], { ...options, env, log, quiet: true });
+    if (status !== 0 || !a4Bin) {
+      throw new InstallError(`a4 self install failed (exit ${status}). Run: npx @usearete/a4 install`);
     }
-    process.exit(1);
+    receipt = { binary: a4Bin };
   }
+  const result = runBinary(receipt.binary, argv, { env, stdio });
+  if (options.onResult) options.onResult(result);
+  return result.status ?? 1;
+}
 
-  process.exit(result.status ?? 1);
+async function main() {
+  try {
+    process.exitCode = await launch(process.argv.slice(2));
+  } catch (err) {
+    process.stderr.write(`error: ${err instanceof InstallError ? err.message : err.stack || err}\n`);
+    process.exitCode = 1;
+  }
 }
 
 if (require.main === module) main();
 
-module.exports = { canonicalPath, getBinaryPath, pathCandidates };
+module.exports = {
+  ASSETS,
+  InstallError,
+  MINISIGN_PUBLIC_KEY,
+  RECURSION_SENTINEL,
+  areteHome,
+  downloadRelease,
+  launch,
+  parseChecksums,
+  parseMinisignPublicKey,
+  parseMinisignSignature,
+  pickAsset,
+  readReceipt,
+  receiptPath,
+  releaseBaseUrl,
+  runInstall,
+  sha256File,
+  verifyMinisign,
+};

package/package.json

@@ -1,13 +1,12 @@
 {
   "name": "@usearete/a4",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "description": "Arete CLI (a4) - Real-time Solana streaming pipelines",
   "bin": {
     "a4": "bin/a4.js"
   },
   "scripts": {
-    "postinstall": "node scripts/postinstall.js",
-    "test": "node --test bin/*.test.js"
+    "test": "node --test test/a4.test.js"
   },
   "repository": {
     "type": "git",
@@ -33,11 +32,10 @@
     "access": "public"
   },
   "engines": {
-    "node": ">=16.0.0"
+    "node": ">=18"
   },
   "files": [
     "bin",
-    "scripts",
     "README.md"
   ]
 }

package/bin/a4.test.js

@@ -1,86 +0,0 @@
-const assert = require("node:assert/strict");
-const { spawnSync } = require("node:child_process");
-const fs = require("node:fs");
-const os = require("node:os");
-const path = require("node:path");
-const test = require("node:test");
-
-const { canonicalPath, getBinaryPath } = require("./a4.js");
-
-test("skips a symlink to the launcher and selects the next native binary", (t) => {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), "arete-a4-launcher-"));
-  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
-  const shimDir = path.join(root, "shim");
-  const nativeDir = path.join(root, "native");
-  fs.mkdirSync(shimDir);
-  fs.mkdirSync(nativeDir);
-  fs.symlinkSync(__dirname + "/a4.js", path.join(shimDir, "a4"));
-  const native = path.join(nativeDir, "a4");
-  fs.writeFileSync(native, "#!/bin/sh\nexit 0\n", { mode: 0o755 });
-
-  const selected = getBinaryPath({ PATH: [shimDir, nativeDir].join(path.delimiter) }, "darwin");
-  assert.equal(canonicalPath(selected), canonicalPath(native));
-});
-
-test("returns null when PATH only resolves to the launcher", (t) => {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), "arete-a4-launcher-"));
-  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
-  fs.symlinkSync(__dirname + "/a4.js", path.join(root, "a4"));
-  assert.equal(getBinaryPath({ PATH: root }, "darwin"), null);
-});
-
-test(
-  "skips non-executable files and directories before a native binary",
-  { skip: process.platform === "win32" },
-  (t) => {
-    const root = fs.mkdtempSync(path.join(os.tmpdir(), "arete-a4-launcher-"));
-    t.after(() => fs.rmSync(root, { recursive: true, force: true }));
-    const fileDir = path.join(root, "file");
-    const directoryDir = path.join(root, "directory");
-    const nativeDir = path.join(root, "native");
-    fs.mkdirSync(fileDir);
-    fs.mkdirSync(directoryDir);
-    fs.mkdirSync(nativeDir);
-    fs.writeFileSync(path.join(fileDir, "a4"), "not executable\n", { mode: 0o644 });
-    fs.mkdirSync(path.join(directoryDir, "a4"));
-    const native = path.join(nativeDir, "a4");
-    fs.writeFileSync(native, "#!/bin/sh\nexit 0\n", { mode: 0o755 });
-
-    const selected = getBinaryPath({
-      PATH: [fileDir, directoryDir, nativeDir].join(path.delimiter),
-    });
-    assert.equal(canonicalPath(selected), canonicalPath(native));
-  }
-);
-
-test("skips Windows command shims and directories before a native binary", (t) => {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), "arete-a4-launcher-"));
-  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
-  const shimDir = path.join(root, "shim");
-  const directoryDir = path.join(root, "directory");
-  const nativeDir = path.join(root, "native");
-  fs.mkdirSync(shimDir);
-  fs.mkdirSync(directoryDir);
-  fs.mkdirSync(nativeDir);
-  fs.writeFileSync(path.join(shimDir, "a4"), "#!/bin/sh\n");
-  fs.writeFileSync(path.join(shimDir, "a4.cmd"), "@echo off\n");
-  fs.writeFileSync(path.join(shimDir, "a4.bat"), "@echo off\n");
-  fs.mkdirSync(path.join(directoryDir, "a4.exe"));
-  const native = path.join(nativeDir, "a4.exe");
-  fs.writeFileSync(native, "native binary placeholder\n");
-
-  const selected = getBinaryPath({
-    PATH: [shimDir, directoryDir, nativeDir].join(path.delimiter),
-  }, "win32");
-  assert.equal(canonicalPath(selected), canonicalPath(native));
-});
-
-test("recursion sentinel stops the launcher before resolving another a4", () => {
-  const result = spawnSync(process.execPath, [path.join(__dirname, "a4.js")], {
-    encoding: "utf8",
-    env: { ...process.env, ARETE_A4_LAUNCHER_ACTIVE: "1" },
-  });
-
-  assert.equal(result.status, 1);
-  assert.match(result.stderr, /Refusing to recursively launch/);
-});

package/scripts/postinstall.js

@@ -1,214 +0,0 @@
-#!/usr/bin/env node
-
-const https = require("https");
-const fs = require("fs");
-const path = require("path");
-const crypto = require("crypto");
-
-const pkg = require("../package.json");
-const version = pkg.version;
-
-const PLATFORMS = {
-  "darwin-arm64": "a4-darwin-arm64",
-  "darwin-x64": "a4-darwin-x64",
-  "linux-x64": "a4-linux-x64",
-  "linux-arm64": "a4-linux-arm64",
-  "win32-x64": "a4-win32-x64.exe",
-};
-
-const platform = process.platform;
-const arch = process.arch;
-const key = `${platform}-${arch}`;
-
-const binaryName = PLATFORMS[key];
-if (!binaryName) {
-  console.warn(
-    `Arete CLI does not have a prebuilt binary for ${key}.\n` +
-    "You can build from source: cargo install a4-cli"
-  );
-  process.exit(0);
-}
-
-const binDir = path.join(__dirname, "..", "bin");
-const binPath = path.join(binDir, platform === "win32" ? "a4.exe" : "a4");
-
-if (fs.existsSync(binPath)) {
-  process.exit(0);
-}
-
-const releaseUrl = `https://github.com/AreteA4/arete/releases/download/a4-cli-v${version}`;
-const url = `${releaseUrl}/${binaryName}`;
-const checksumUrl = `${releaseUrl}/checksums.txt`;
-const MAX_REDIRECTS = 5;
-
-console.log(`Downloading Arete CLI v${version} for ${key}...`);
-
-function removeIfExists(filePath) {
-  try {
-    fs.unlinkSync(filePath);
-  } catch (err) {
-    if (err.code !== "ENOENT") {
-      throw err;
-    }
-  }
-}
-
-function getResponse(url, depth = 0) {
-  if (depth > MAX_REDIRECTS) {
-    return Promise.reject(new Error("Too many redirects"));
-  }
-
-  return new Promise((resolve, reject) => {
-    https
-      .get(url, (response) => {
-        if (response.statusCode === 302 || response.statusCode === 301) {
-          if (!response.headers.location) {
-            response.resume();
-            reject(new Error("Redirect missing location header"));
-            return;
-          }
-
-          response.resume();
-          resolve(
-            getResponse(
-              new URL(response.headers.location, url).toString(),
-              depth + 1
-            )
-          );
-          return;
-        }
-
-        resolve(response);
-      })
-      .on("error", reject);
-  });
-}
-
-async function download(url, dest) {
-  const response = await getResponse(url);
-
-  if (response.statusCode !== 200) {
-    response.resume();
-    removeIfExists(dest);
-    throw new Error(`Download failed: HTTP ${response.statusCode}`);
-  }
-
-  const total = parseInt(response.headers["content-length"], 10);
-  let downloaded = 0;
-
-  await new Promise((resolve, reject) => {
-    const file = fs.createWriteStream(dest, { mode: 0o755 });
-
-    response.on("data", (chunk) => {
-      downloaded += chunk.length;
-      if (total && process.stdout.isTTY) {
-        const pct = Math.round((downloaded / total) * 100);
-        process.stdout.write(`\rDownloading... ${pct}%`);
-      }
-    });
-
-    response.on("error", (err) => {
-      file.destroy();
-      removeIfExists(dest);
-      reject(err);
-    });
-
-    file.on("error", (err) => {
-      response.destroy();
-      removeIfExists(dest);
-      reject(err);
-    });
-
-    file.on("finish", () => {
-      file.close(() => {
-        if (process.stdout.isTTY) {
-          process.stdout.write("\n");
-        }
-        resolve();
-      });
-    });
-
-    response.pipe(file);
-  });
-}
-
-async function fetchText(url) {
-  const response = await getResponse(url);
-
-  if (response.statusCode !== 200) {
-    response.resume();
-    throw new Error(`Checksum download failed: HTTP ${response.statusCode}`);
-  }
-
-  return new Promise((resolve, reject) => {
-    let body = "";
-    response.setEncoding("utf8");
-    response.on("data", (chunk) => {
-      body += chunk;
-    });
-    response.on("end", () => resolve(body));
-    response.on("error", reject);
-  });
-}
-
-function sha256File(filePath) {
-  return new Promise((resolve, reject) => {
-    const hash = crypto.createHash("sha256");
-    const stream = fs.createReadStream(filePath);
-
-    stream.on("error", reject);
-    stream.on("data", (chunk) => hash.update(chunk));
-    stream.on("end", () => resolve(hash.digest("hex")));
-  });
-}
-
-async function verifyChecksum(checksumUrl, fileName, filePath) {
-  const checksums = await fetchText(checksumUrl);
-  const expected = checksums
-    .split(/\r?\n/)
-    .map((line) => line.match(/^([a-fA-F0-9]{64})\s+\*?(.+)$/))
-    .find((match) => match && match[2] === fileName);
-
-  if (!expected) {
-    throw new Error(`Missing checksum for ${fileName}`);
-  }
-
-  const actual = await sha256File(filePath);
-  if (actual !== expected[1].toLowerCase()) {
-    throw new Error(`Checksum mismatch for ${fileName}`);
-  }
-}
-
-async function main() {
-  try {
-    if (!fs.existsSync(binDir)) {
-      fs.mkdirSync(binDir, { recursive: true });
-    }
-    
-    await download(url, binPath);
-
-    try {
-      await verifyChecksum(checksumUrl, binaryName, binPath);
-    } catch (err) {
-      removeIfExists(binPath);
-      throw err;
-    }
-
-    if (platform !== "win32") {
-      fs.chmodSync(binPath, 0o755);
-    }
-
-    console.log("Arete CLI installed successfully.");
-  } catch (err) {
-    console.error(`\nFailed to download Arete CLI: ${err.message}`);
-    console.error(
-      "\nYou can install manually via Cargo:\n" +
-      "  cargo install a4-cli\n" +
-      "\nOr download directly from:\n" +
-      `  ${url}`
-    );
-    process.exit(0);
-  }
-}
-
-main();