@webnori/agent-one 0.5.0

package/README.md

@@ -0,0 +1,54 @@
+# @webnori/agent-one
+
+A standalone CLI agent: ask a question, it reads your workspace through a small
+set of tools and answers. Windows, macOS and Linux.
+
+```bash
+npm install -g @webnori/agent-one
+
+agent-one run "hello" --provider echo      # offline smoke test, no API key
+agent-one run "what does this project do?"
+agent-one chat
+```
+
+## What this package is
+
+A thin wrapper. It ships **no binary**: `postinstall` downloads the native
+`agent-one` build for your OS/arch from the matching GitHub Release, verifies
+its SHA256 against `checksums.txt`, and unpacks it next to the launcher. The npm
+version and the release tag are published together, so they cannot drift.
+
+Supported: `win-x64`, `linux-x64`, `osx-arm64` (Node ≥ 18). Intel Macs (`osx-x64`) have no prebuilt binary — build from source.
+
+## Configuration
+
+```bash
+agent-one config set provider openai
+agent-one config set model gpt-4o-mini
+export OPENAI_API_KEY=sk-...
+```
+
+Any OpenAI-compatible endpoint works — Ollama, LM Studio, vLLM, llama.cpp:
+
+```bash
+agent-one config set baseUrl http://localhost:11434/v1
+agent-one config set model qwen2.5-coder:7b
+```
+
+Settings live in `~/.agent-one/config.json`. The API key is never written
+there — `apiKeyEnv` names the environment variable to read it from.
+
+## Environment variables
+
+| Variable | Effect |
+|---|---|
+| `AGENT_ONE_SKIP_DOWNLOAD=1` | Skip the postinstall download (offline / vendored installs) |
+| `AGENT_ONE_VERSION` | Download a specific release instead of the package version |
+| `AGENT_ONE_REPO` | Download from a fork instead of `psmon/AgentZeroLite` |
+| `AGENT_ONE_HOME` | Relocate `~/.agent-one/` |
+
+Uninstalling removes only the downloaded binary; `~/.agent-one/` is your data
+and is left where it is.
+
+Full documentation:
+<https://github.com/psmon/AgentZeroLite/tree/main/Project/AgentOne>

package/bin/agent-one.js

@@ -0,0 +1,41 @@
+#!/usr/bin/env node
+//
+// Thin launcher — forwards argv to the native agent-one binary that
+// scripts/install.js placed in ../vendor/agent-one/.
+//
+// It stays thin on purpose: every flag, every exit code and every byte of
+// output belongs to the binary, so `agent-one` behaves identically whether it
+// was installed from npm, from a release ZIP, or built from source.
+
+'use strict';
+
+const path = require('path');
+const fs = require('fs');
+const { spawnSync } = require('child_process');
+
+const PKG = '@webnori/agent-one';
+const exeName = process.platform === 'win32' ? 'agent-one.exe' : 'agent-one';
+const vendorBin = path.resolve(__dirname, '..', 'vendor', 'agent-one', exeName);
+
+if (!fs.existsSync(vendorBin)) {
+    console.error(`${PKG}: binary not found at ${vendorBin}`);
+    console.error(`${PKG}: did the postinstall step run? Try reinstalling:`);
+    console.error(`${PKG}:   npm install -g ${PKG} --force`);
+    console.error(`${PKG}: or install it manually from`);
+    console.error(`${PKG}:   https://github.com/psmon/AgentZeroLite/releases`);
+    process.exit(1);
+}
+
+const result = spawnSync(vendorBin, process.argv.slice(2), {
+    stdio: 'inherit',
+    windowsHide: false
+});
+
+if (result.error) {
+    console.error(`${PKG}: failed to spawn binary: ${result.error.message}`);
+    process.exit(1);
+}
+
+// Preserve the child's exit code; a signal death becomes 128+n like a shell would report.
+if (result.signal) process.exit(1);
+process.exit(result.status ?? 0);

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@webnori/agent-one",
+  "version": "0.5.0",
+  "description": "A standalone CLI agent: ask a question, it reads your workspace and answers. (npm wrapper around the prebuilt agent-one binary.)",
+  "keywords": [
+    "agent",
+    "cli",
+    "llm",
+    "openai-compatible",
+    "ollama",
+    "tool-use"
+  ],
+  "homepage": "https://github.com/psmon/AgentZeroLite/tree/main/Project/AgentOne",
+  "bugs": {
+    "url": "https://github.com/psmon/AgentZeroLite/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/psmon/AgentZeroLite.git",
+    "directory": "Project/AgentOne/packaging/npm/agent-one"
+  },
+  "license": "MIT",
+  "author": "psmon",
+  "bin": {
+    "agent-one": "bin/agent-one.js"
+  },
+  "files": [
+    "bin/",
+    "scripts/",
+    "README.md"
+  ],
+  "scripts": {
+    "postinstall": "node scripts/install.js",
+    "preuninstall": "node scripts/uninstall.js"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "os": [
+    "linux",
+    "darwin",
+    "win32"
+  ],
+  "cpu": [
+    "x64",
+    "arm64"
+  ]
+}

package/scripts/install.js

@@ -0,0 +1,180 @@
+#!/usr/bin/env node
+//
+// postinstall: download the agent-one binary for this OS/arch from GitHub
+// Releases, verify its SHA256 against checksums.txt, extract into
+// ../vendor/agent-one/.
+//
+// User data in ~/.agent-one/ (config, sessions) is never touched — install and
+// uninstall only ever manage the vendored binary.
+
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const crypto = require('crypto');
+const https = require('https');
+const { execFileSync } = require('child_process');
+
+const PKG = '@webnori/agent-one';
+const REPO = process.env.AGENT_ONE_REPO || 'psmon/AgentZeroLite';
+const TAG_PREFIX = 'agent-one-v';
+
+function log(msg) { process.stdout.write(`${PKG}: ${msg}\n`); }
+function warn(msg) { process.stderr.write(`${PKG}: ${msg}\n`); }
+function die(msg) { warn(msg); process.exit(1); }
+
+// 1. Opt-out, for offline CI and mirrored caches that vendor the binary themselves.
+if (process.env.AGENT_ONE_SKIP_DOWNLOAD === '1') {
+    log('AGENT_ONE_SKIP_DOWNLOAD=1 — skipping binary download.');
+    process.exit(0);
+}
+
+// 2. platform/arch -> .NET RID
+const rid = (() => {
+    const arch = ({ x64: 'x64', arm64: 'arm64' })[process.arch];
+    if (!arch) die(`unsupported CPU arch: ${process.arch}`);
+    if (process.platform === 'linux') return `linux-${arch}`;
+    if (process.platform === 'darwin') return `osx-${arch}`;
+    if (process.platform === 'win32') return `win-${arch}`;
+    return die(`unsupported platform: ${process.platform}`);
+})();
+
+// Intel Macs are not built (the macOS x64 runners were retired); say so rather than 404.
+if (rid === 'osx-x64') {
+    die('no prebuilt binary for Intel Macs (osx-x64). Build from source: ' +
+        'dotnet publish Project/AgentOne/AgentOne.csproj -c Release -r osx-x64 ' +
+        '(https://github.com/psmon/AgentZeroLite/tree/main/Project/AgentOne)');
+}
+
+const ext = process.platform === 'win32' ? 'zip' : 'tar.gz';
+const asset = `agent-one-${rid}.${ext}`;
+
+// 3. The npm version IS the release tag — they are published together.
+const pkg = require(path.resolve(__dirname, '..', 'package.json'));
+const version = process.env.AGENT_ONE_VERSION || pkg.version;
+if (!version || version === '0.0.0') {
+    die('package.json version is unset (0.0.0). Publish with a real version, or set AGENT_ONE_VERSION.');
+}
+
+const tag = version.startsWith(TAG_PREFIX) ? version : TAG_PREFIX + version.replace(/^v/, '');
+const base = `https://github.com/${REPO}/releases/download/${tag}`;
+const assetUrl = `${base}/${asset}`;
+const sumsUrl = `${base}/checksums.txt`;
+
+function get(url, redirectsLeft = 5) {
+    return new Promise((resolve, reject) => {
+        if (redirectsLeft < 0) return reject(new Error('too many redirects'));
+        const opts = { headers: { 'User-Agent': 'agent-one-npm-installer' } };
+        https.get(url, opts, (res) => {
+            if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+                res.resume();
+                return resolve(get(res.headers.location, redirectsLeft - 1));
+            }
+            if (res.statusCode !== 200) {
+                res.resume();
+                return reject(new Error(`HTTP ${res.statusCode} for ${url}`));
+            }
+            resolve(res);
+        }).on('error', reject);
+    });
+}
+
+async function download(url, destPath) {
+    const res = await get(url);
+    await new Promise((resolve, reject) => {
+        const out = fs.createWriteStream(destPath);
+        res.pipe(out);
+        out.on('finish', resolve);
+        out.on('error', reject);
+        res.on('error', reject);
+    });
+}
+
+async function fetchText(url) {
+    const res = await get(url);
+    return new Promise((resolve, reject) => {
+        let buf = '';
+        res.on('data', (c) => { buf += c.toString('utf8'); });
+        res.on('end', () => resolve(buf));
+        res.on('error', reject);
+    });
+}
+
+function sha256(file) {
+    return crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+}
+
+function extract(archive, destDir) {
+    if (ext === 'zip') {
+        try {
+            execFileSync('powershell', [
+                '-NoProfile', '-NonInteractive', '-Command',
+                `Expand-Archive -LiteralPath '${archive}' -DestinationPath '${destDir}' -Force`
+            ], { stdio: 'inherit' });
+            return;
+        } catch {
+            execFileSync('unzip', ['-o', archive, '-d', destDir], { stdio: 'inherit' });
+            return;
+        }
+    }
+    execFileSync('tar', ['-xzf', archive, '-C', destDir], { stdio: 'inherit' });
+}
+
+async function main() {
+    const root = path.resolve(__dirname, '..');
+    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'agent-one-install-'));
+    const archive = path.join(tmp, asset);
+
+    log(`release ${tag}, platform ${rid}`);
+    log(`downloading ${assetUrl}`);
+    try {
+        await download(assetUrl, archive);
+    } catch (e) {
+        die(`download failed: ${e.message}\n  manual install: ${assetUrl}`);
+    }
+
+    // A checksum that cannot be fetched is a warning, but one that does not
+    // match is fatal — a wrong binary is worse than no binary.
+    let expected = null;
+    try {
+        const sums = await fetchText(sumsUrl);
+        for (const line of sums.split(/\r?\n/)) {
+            if (line.includes(asset)) { expected = line.trim().split(/\s+/)[0]; break; }
+        }
+    } catch (e) {
+        warn(`could not fetch checksums.txt (${e.message}) — continuing without verification`);
+    }
+
+    if (expected) {
+        const actual = sha256(archive);
+        if (actual.toLowerCase() !== expected.toLowerCase()) {
+            die(`checksum mismatch\n  expected: ${expected}\n  actual:   ${actual}`);
+        }
+        log(`sha256 verified: ${actual}`);
+    }
+
+    const vendor = path.join(root, 'vendor');
+    fs.rmSync(vendor, { recursive: true, force: true });
+    fs.mkdirSync(vendor, { recursive: true });
+
+    log(`extracting into ${vendor}`);
+    try {
+        extract(archive, vendor);
+    } catch (e) {
+        die(`extraction failed: ${e.message}`);
+    }
+
+    const exeName = process.platform === 'win32' ? 'agent-one.exe' : 'agent-one';
+    const finalBin = path.join(vendor, 'agent-one', exeName);
+    if (!fs.existsSync(finalBin)) {
+        die(`expected ${finalBin} after extraction, but it is not there`);
+    }
+    if (process.platform !== 'win32') fs.chmodSync(finalBin, 0o755);
+
+    fs.rmSync(tmp, { recursive: true, force: true });
+    log(`installed ${finalBin}`);
+    log('try: agent-one run "hello" --provider echo');
+}
+
+main().catch((e) => die(e.stack || e.message));

package/scripts/uninstall.js

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+//
+// preuninstall: remove only the vendored binary this package downloaded.
+// ~/.agent-one/ (config, sessions) is the user's data and is left alone —
+// reinstalling should find the same settings where they were.
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const vendor = path.resolve(__dirname, '..', 'vendor');
+
+try {
+    fs.rmSync(vendor, { recursive: true, force: true });
+} catch (e) {
+    process.stderr.write(`@webnori/agent-one: could not remove ${vendor}: ${e.message}\n`);
+}