@vikat/vikat-gateway-cli 1.0.1

package/bin.js

@@ -0,0 +1,444 @@
+#!/usr/bin/env node
+
+import { createHash } from "crypto";
+import { chmodSync, createWriteStream, existsSync, fsyncSync, mkdirSync, readFileSync, appendFileSync, renameSync, unlinkSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+import { Readable } from "stream";
+import { createInterface } from "readline";
+
+const BASE_URL = "https://downloads.vikat.ai";
+// Matches the migration CLI. Without a bound, a hung host hangs the install.
+const REQUEST_TIMEOUT_MS = 30_000;
+
+// Parse CLI version from command line arguments
+function parseCliVersion() {
+	const args = process.argv.slice(2);
+	let cliVersion = "latest"; // Default to latest
+
+	// Find --cli-version argument
+	const versionArgIndex = args.findIndex((arg) => arg.startsWith("--cli-version"));
+
+	if (versionArgIndex !== -1) {
+		const versionArg = args[versionArgIndex];
+
+		if (versionArg.includes("=")) {
+			// Format: --cli-version=v1.2.3
+			cliVersion = versionArg.split("=")[1];
+			if (!cliVersion) {
+				console.error("--cli-version requires a value");
+				process.exit(1);
+			}
+		} else if (versionArgIndex + 1 < args.length) {
+			// Format: --cli-version v1.2.3
+			cliVersion = args[versionArgIndex + 1];
+		} else {
+			console.error("--cli-version requires a value");
+			process.exit(1);
+		}
+	}
+
+	return validateCliVersion(cliVersion);
+}
+
+// Validate a CLI version and NORMALISE it to the form the download server uses.
+//
+// ─── THE BARE VERSION IS THE ONE ON THE SERVER ──────────────────────────────
+//
+// deploy/publish.sh uploads to s3://…/vikat-cli/$VERSION/… with VERSION exactly
+// as release.sh cut it: bare, no "v". This function used to REQUIRE the "v"
+// prefix and pass it straight through into the URL, so the only input form it
+// accepted produced the one path that does not exist:
+//
+//     /vikat-cli/v1.6.3/darwin/arm64/vikat  -> 404
+//     /vikat-cli/1.6.3/darwin/arm64/vikat   -> 200
+//
+// Both forms are accepted now, because "v1.7.0" is what a person types and what
+// the git tag looks like, and the bare form is what S3 holds. The prefix is
+// stripped here, once, so every caller below builds a URL that can resolve.
+function validateCliVersion(version) {
+	if (version === "latest") {
+		return version;
+	}
+
+	// Accept "v1.2.3" or "1.2.3", with an optional pre-release suffix.
+	const versionRegex = /^v?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$/;
+	const match = versionRegex.exec(version);
+	if (match) {
+		return match[1]; // normalised: always bare
+	}
+
+	console.error(`Invalid CLI version format: ${version}`);
+	console.error(`CLI version must be "latest", "1.2.3", "v1.2.3", or "v1.2.3-prerelease1"`);
+	process.exit(1);
+}
+
+const VERSION = parseCliVersion();
+
+function getPlatformArchAndBinary() {
+	const platform = process.platform;
+	const arch = process.arch;
+
+	let platformDir;
+	let archDir;
+	let binaryName;
+
+	if (platform === "darwin") {
+		platformDir = "darwin";
+		if (arch === "arm64") archDir = "arm64";
+		else archDir = "amd64";
+		binaryName = "vikat";
+	} else if (platform === "linux") {
+		platformDir = "linux";
+		if (arch === "x64") archDir = "amd64";
+		else if (arch === "ia32") archDir = "386";
+		else archDir = arch; // fallback
+		binaryName = "vikat";
+	} else if (platform === "win32") {
+		platformDir = "windows";
+		if (arch === "x64") archDir = "amd64";
+		else if (arch === "ia32") archDir = "386";
+		else archDir = arch; // fallback
+		binaryName = "vikat.exe";
+	} else {
+		console.error(`Unsupported platform/arch: ${platform}/${arch}`);
+		process.exit(1);
+	}
+
+	return { platformDir, archDir, binaryName };
+}
+
+async function downloadBinary(url, dest) {
+	const res = await fetch(url);
+
+	if (!res.ok) {
+		console.error(`❌ Download failed: ${res.status} ${res.statusText}`);
+		process.exit(1);
+	}
+
+	const contentLength = res.headers.get("content-length");
+	const totalSize = contentLength ? parseInt(contentLength, 10) : null;
+	let downloadedSize = 0;
+
+	const fileStream = createWriteStream(dest, { flags: "w" });
+	await new Promise((resolve, reject) => {
+		try {
+			// Convert the fetch response body to a Node.js readable stream
+			const nodeStream = Readable.fromWeb(res.body);
+
+			// Add progress tracking
+			nodeStream.on("data", (chunk) => {
+				downloadedSize += chunk.length;
+				if (totalSize) {
+					const progress = ((downloadedSize / totalSize) * 100).toFixed(1);
+					process.stdout.write(`\r⏱️ Downloading Binary: ${progress}% (${formatBytes(downloadedSize)}/${formatBytes(totalSize)})`);
+				} else {
+					process.stdout.write(`\r⏱️ Downloaded: ${formatBytes(downloadedSize)}`);
+				}
+			});
+
+			nodeStream.pipe(fileStream);
+			fileStream.on("finish", () => {
+				process.stdout.write("\n");
+
+				// Ensure file is fully written to disk
+				try {
+					fsyncSync(fileStream.fd);
+				} catch (syncError) {
+					// fsync might fail on some systems, ignore
+				}
+
+				resolve();
+			});
+			fileStream.on("error", reject);
+			nodeStream.on("error", reject);
+		} catch (error) {
+			reject(error);
+		}
+	});
+
+	chmodSync(dest, 0o755);
+}
+
+// Check if a specific version exists on the download server
+async function checkVersionExists(version, platformDir, archDir, binaryName) {
+	const url = `${BASE_URL}/vikat-cli/${version}/${platformDir}/${archDir}/${binaryName}`;
+	const res = await fetch(url, { method: "HEAD" });
+	return res.ok;
+}
+
+// Resolve the "latest" pointer to a concrete version, then prove that version
+// actually has a binary for this platform before returning it.
+//
+// The two-step matters. version.txt is written LAST by publish.sh, deliberately,
+// so the binaries are in place before anything advertises them — but a partial
+// upload, or a platform that was never built, still leaves the pointer naming a
+// version with no artifact for THIS os/arch. Checking here turns that into a
+// message naming the version and the platform, instead of a bare 404 later.
+async function fetchLatestVersion(platformDir, archDir, binaryName) {
+	const url = `${BASE_URL}/vikat-cli/latest/version.txt`;
+	let res;
+	try {
+		res = await fetch(url);
+	} catch (error) {
+		console.error(`❌ Could not reach the download server: ${error.message}`);
+		console.error(`   ${url}`);
+		process.exit(1);
+	}
+	if (!res.ok) {
+		console.error(`❌ Could not resolve the latest CLI version (HTTP ${res.status}).`);
+		console.error(`   ${url}`);
+		console.error(`Pass an explicit version instead, e.g. --cli-version 1.7.0`);
+		process.exit(1);
+	}
+
+	// Trimmed because publish.sh writes it with `printf '%s'` — no trailing
+	// newline today — but a hand-corrected pointer file would very likely have
+	// one, and a stray "\n" inside a URL path is a 404 nobody can read.
+	const raw = (await res.text()).trim();
+	const version = validateCliVersion(raw);
+	if (version === "latest") {
+		console.error(`❌ ${url} contains "latest", which would resolve to itself.`);
+		process.exit(1);
+	}
+
+	if (!(await checkVersionExists(version, platformDir, archDir, binaryName))) {
+		console.error(`❌ Latest is ${version}, but no ${platformDir}/${archDir} binary was published for it.`);
+		console.error(`   ${BASE_URL}/vikat-cli/${version}/${platformDir}/${archDir}/${binaryName}`);
+		process.exit(1);
+	}
+	return version;
+}
+
+// Verify the downloaded binary against its SHA-256 checksum.
+//
+// FAILS CLOSED. This warned and returned, and the caller then moved the
+// unverified binary into ~/.vikat/bin — a directory the installer appends to the
+// user's shell PATH. A check that can be skipped by declining to serve one file
+// is not a check: anyone able to serve a malicious binary is equally able to
+// withhold its sidecar. The sibling migration CLI already refused; this now
+// matches it.
+async function verifyChecksum(binaryPath, checksumUrl) {
+	let res;
+	try {
+		res = await fetch(checksumUrl, { signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) });
+	} catch (err) {
+		unlinkSync(binaryPath);
+		console.error(`❌ Could not fetch the checksum (${err.message}). Refusing to run an unverified binary.`);
+		process.exit(1);
+	}
+	if (!res.ok) {
+		unlinkSync(binaryPath);
+		console.error(`❌ Checksum file not available (${res.status}). Refusing to run an unverified binary.`);
+		process.exit(1);
+	}
+
+	const checksumContent = (await res.text()).trim();
+	// Format: "<hash>  <filename>" (shasum output)
+	const expectedHash = checksumContent.split(/\s+/)[0];
+	if (!expectedHash) {
+		console.warn("⚠️ Could not parse checksum file, skipping verification");
+		return;
+	}
+
+	const fileBuffer = readFileSync(binaryPath);
+	const actualHash = createHash("sha256").update(fileBuffer).digest("hex");
+
+	if (actualHash !== expectedHash) {
+		const { unlinkSync } = await import("fs");
+		unlinkSync(binaryPath);
+		console.error(`❌ Checksum verification failed!`);
+		console.error(`   Expected: ${expectedHash}`);
+		console.error(`   Got:      ${actualHash}`);
+		console.error(`   The downloaded binary has been deleted for safety.`);
+		process.exit(1);
+	}
+
+	console.log("✅ Checksum verified");
+}
+
+function formatBytes(bytes) {
+	if (bytes === 0) return "0 B";
+	const k = 1024;
+	const sizes = ["B", "KB", "MB", "GB"];
+	const i = Math.floor(Math.log(bytes) / Math.log(k));
+	return parseFloat((bytes / Math.pow(k, i)).toFixed(1)) + " " + sizes[i];
+}
+
+// Detect the user's shell and return the RC file path and the PATH export line
+function getShellConfig() {
+	const home = homedir();
+	const shell = (process.env.SHELL || "").toLowerCase();
+
+	if (process.platform === "win32") {
+		return null; // Windows — manual PATH setup
+	}
+
+	if (shell.endsWith("/fish") || shell.endsWith("/fish.exe")) {
+		return {
+			rcFile: join(home, ".config", "fish", "config.fish"),
+			exportLine: "fish_add_path $HOME/.vikat/bin",
+			shellName: "fish",
+		};
+	}
+
+	if (shell.endsWith("/zsh")) {
+		return {
+			rcFile: join(home, ".zshrc"),
+			exportLine: 'export PATH="$HOME/.vikat/bin:$PATH"',
+			shellName: "zsh",
+		};
+	}
+
+	if (shell.endsWith("/bash") || shell.endsWith("/bash.exe")) {
+		const rcFiles =
+			process.platform === "darwin"
+				? [join(home, ".bash_profile"), join(home, ".bashrc")]
+				: [join(home, ".bashrc")];
+		return {
+			rcFile: rcFiles[0],
+			extraRcFiles: rcFiles.slice(1),
+			exportLine: 'export PATH="$HOME/.vikat/bin:$PATH"',
+			shellName: "bash",
+		};
+	}
+
+	return null;
+}
+
+// Check if the PATH export line is already present in the given file
+function hasPathLine(filePath) {
+	if (!existsSync(filePath)) return false;
+	try {
+		const content = readFileSync(filePath, "utf-8");
+		return content.includes(".vikat/bin");
+	} catch {
+		return false;
+	}
+}
+
+// Prompt the user with a yes/no question
+async function promptYesNo(question) {
+	if (!process.stdin.isTTY || !process.stdout.isTTY) {
+		return false;
+	}
+	const rl = createInterface({ input: process.stdin, output: process.stdout });
+	return new Promise((resolve) => {
+		rl.question(question, (answer) => {
+			rl.close();
+			const normalized = (answer || "").trim().toLowerCase();
+			resolve(normalized === "" || normalized === "y" || normalized === "yes");
+		});
+	});
+}
+
+function printStartMessage(message) {
+	console.log(`\n${message}`);
+	console.log(`Enter 'vikat' when you're ready to start the CLI.`);
+}
+
+async function main() {
+	const { platformDir, archDir, binaryName } = getPlatformArchAndBinary();
+
+	let namedVersion;
+
+	if (VERSION === "latest") {
+		// ─── "latest" IS A POINTER FILE, NOT A DIRECTORY ────────────────────
+		//
+		// This used to HEAD /vikat-cli/latest/<os>/<arch>/vikat and, when that
+		// 404'd, tell the user to pass --cli-version. It 404s always:
+		// deploy/publish.sh writes exactly ONE object under that prefix,
+		// vikat-cli/latest/version.txt (publish.sh:250), and puts the binaries
+		// under /vikat-cli/$VERSION/ (publish.sh:237). So the documented install
+		// — `npx @vikat/vikat-gateway-cli` — could never work, and neither could
+		// the workaround it printed.
+		//
+		// Resolve the pointer first, then fetch the concrete version. That is
+		// exactly what the Go self-updater does (cli/internal/update/check.go
+		// reads the same version.txt), so the two installers now agree instead
+		// of disagreeing.
+		namedVersion = await fetchLatestVersion(platformDir, archDir, binaryName);
+	} else {
+		// For explicitly specified versions, verify it exists on the server
+		const versionExists = await checkVersionExists(VERSION, platformDir, archDir, binaryName);
+		if (!versionExists) {
+			console.error(`❌ CLI version '${VERSION}' not found.`);
+			console.error(`Please verify the version exists at: ${BASE_URL}/vikat-cli/`);
+			process.exit(1);
+		}
+		namedVersion = VERSION;
+	}
+
+	const downloadUrl = `${BASE_URL}/vikat-cli/${namedVersion}/${platformDir}/${archDir}/${binaryName}`;
+
+	// Install to ~/.vikat/bin/
+	const installDir = join(homedir(), ".vikat", "bin");
+	mkdirSync(installDir, { recursive: true });
+	const binaryPath = join(installDir, binaryName);
+
+	// Download to a temp file, verify, then atomically replace
+	const tempBinaryPath = `${binaryPath}.download-${process.pid}-${Date.now()}`;
+	try {
+		await downloadBinary(downloadUrl, tempBinaryPath);
+
+		const checksumUrl = `${BASE_URL}/vikat-cli/${namedVersion}/${platformDir}/${archDir}/${binaryName}.sha256`;
+		await verifyChecksum(tempBinaryPath, checksumUrl);
+		renameSync(tempBinaryPath, binaryPath);
+	} catch (err) {
+		try { unlinkSync(tempBinaryPath); } catch {}
+		throw err;
+	}
+	console.log(`✅ Installed vikat to ${binaryPath}`);
+
+	// Shell PATH setup
+	const shellConfig = getShellConfig();
+
+	if (!shellConfig) {
+		// Windows — print manual instructions
+		console.log(`\nTo complete installation, add the following directory to your PATH:`);
+		console.log(`  ${installDir}`);
+		console.log(`\nYou can do this in System Settings > Environment Variables.`);
+		printStartMessage("The installer won't start Vikat automatically.");
+		return;
+	}
+
+	// Check if PATH is already configured
+	const allRcFiles = [shellConfig.rcFile, ...(shellConfig.extraRcFiles || [])];
+	const missingRcFiles = allRcFiles.filter((rcFile) => !hasPathLine(rcFile));
+
+	if (missingRcFiles.length === 0) {
+		console.log(`\n✅ PATH already configured for vikat.`);
+		printStartMessage("The installer won't start Vikat automatically.");
+		return;
+	}
+
+	// Prompt user to add PATH
+	const rcDisplayName = shellConfig.rcFile.startsWith(homedir()) ? shellConfig.rcFile.slice(homedir().length + 1) : shellConfig.rcFile.split("/").pop();
+	const shouldAdd = await promptYesNo(`\nAdd vikat to your PATH in ~/${rcDisplayName}? [Y/n] `);
+
+	if (!shouldAdd) {
+		console.log(`\nSkipped PATH setup. You can manually add this to your shell config:`);
+		console.log(`  ${shellConfig.exportLine}`);
+		printStartMessage("After updating your PATH, start Vikat manually.");
+		return;
+	}
+
+	// Append the export line to RC file(s)
+	for (const rcFile of missingRcFiles) {
+		try {
+			mkdirSync(dirname(rcFile), { recursive: true });
+			appendFileSync(rcFile, `\n# Added by vikat installer\n${shellConfig.exportLine}\n`);
+			console.log(`✅ Added PATH to ${rcFile}`);
+		} catch (err) {
+			console.error(`⚠️ Failed to update ${rcFile}: ${err.message}`);
+		}
+	}
+
+	const rcRelative = shellConfig.rcFile.startsWith(homedir()) ? shellConfig.rcFile.slice(homedir().length + 1) : shellConfig.rcFile.split("/").pop();
+	printStartMessage(`Run 'source ~/${rcRelative}' or open a new terminal first.`);
+}
+
+main().catch((error) => {
+	console.error(`❌ Failed to install Vikat CLI: ${error.message}`);
+	process.exit(1);
+});

package/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "@vikat/vikat-gateway-cli",
+  "version": "1.0.1",
+  "description": "Vikat CLI - Use any harness + any models through Vikat gateway with full observability and governance",
+  "keywords": [
+    "ai",
+    "gateway",
+    "openai",
+    "anthropic",
+    "cli",
+    "vikat",
+    "ai-gateway"
+  ],
+  "homepage": "https://vikat.local",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Vikat-AI/vikat-gateway.git",
+    "directory": "npx/vikat-cli"
+  },
+  "license": "Apache-2.0",
+  "author": "Vikat",
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "bin": {
+    "vikat": "bin.js"
+  },
+  "type": "module",
+  "dependencies": {},
+  "files": [
+    "bin.js"
+  ]
+}