@webority/ensemble 0.5.0 → 0.5.2

package/bin/ensemble.js

@@ -26,41 +26,54 @@ function reportSetup(wired) {
 }
 
 // Browser sign-in (device flow) — no token to copy. The recommended path.
+// Order matters: AUTHENTICATE FIRST (browser approval), and only download the runtime once the
+// machine is approved — so a cancelled or denied login never pulls ~90 MB for nothing.
 async function login(args) {
   const api = args.api || core.DEFAULT_API;
   const name = args.name || os.hostname();
-  core.log('Ensemble — signing in "' + name + '" via ' + api);
-  core.log('• fetching runner + bus binaries');
-  const { runnerPath } = await core.ensureBinaries();
+  core.assertSupported();
+  core.log('Ensemble — sign in for "' + name + '" via ' + api);
   const grant = await core.startDevice(api, name);
-  core.log('\n  Approve this machine in your browser:\n    ' + grant.verificationUriComplete +
-    '\n  Confirmation code:  ' + grant.userCode + '\n');
+  core.log('\n  1) Approve this machine in your browser:\n       ' + grant.verificationUriComplete +
+    '\n     Confirmation code:  ' + grant.userCode + '\n');
   core.openBrowser(grant.verificationUriComplete);
-  core.log('• waiting for approval …');
+  core.log('• waiting for your approval …');
+  const token = await waitForApproval(api, grant);
+  core.log('\n✓ Approved. Connecting this machine …');
+  const { runnerPath } = core.requireRuntime();
+  reportSetup(core.finishSetup(api, token, runnerPath));
+}
+
+async function waitForApproval(api, grant) {
   const deadline = Date.now() + grant.expiresIn * 1000;
-  let token = null;
   while (Date.now() < deadline) {
     await core.sleep((grant.interval || 5) * 1000);
     const r = await core.pollDevice(api, grant.deviceCode);
-    if (r.status === 'approved') { token = r.token; break; }
-    if (r.status === 'denied') core.die('approval was denied in the browser.');
+    if (r.status === 'approved') return r.token;
+    if (r.status === 'denied') core.die('approval was denied in the browser — nothing was installed.');
     if (r.status === 'expired') core.die('the login request expired — run `ensemble login` again.');
   }
-  if (!token) core.die('timed out waiting for approval — run `ensemble login` again.');
-  reportSetup(core.finishSetup(api, token, runnerPath));
+  core.die('timed out waiting for approval — nothing was installed. Run `ensemble login` again.');
+}
+
+// Explicit (re)install of the runner + bus. Normally runs automatically at `npm install`.
+async function install() {
+  core.assertSupported();
+  await core.ensureBinaries();
+  core.log('✓ Ensemble runtime installed. Next:  ensemble login');
 }
 
-// Headless / CI path: enrol with a copy-pasted enrollment token.
+// Headless / CI path: enrol with a copy-pasted enrollment token. Auth only — the runtime is
+// installed at `npm install` (or `ensemble install`).
 async function enroll(args) {
   const token = args.token || process.env.ENSEMBLE_ENROLL_TOKEN;
   if (!token) core.die('missing --token <enrollment-token> — get it from your Ensemble portal → Connect Runner, or use `ensemble login` for browser sign-in');
   const api = args.api || core.DEFAULT_API;
   const name = args.name || os.hostname();
   core.log('Ensemble — enrolling "' + name + '" with ' + api);
-  core.log('• fetching runner + bus binaries');
-  const { runnerPath } = await core.ensureBinaries();
-  core.log('• exchanging enrollment token for a per-machine token');
+  core.log('• exchanging the enrollment token for a per-machine token');
   const machineToken = await core.enrollMachine(api, token, name);
+  const { runnerPath } = core.requireRuntime();
   reportSetup(core.finishSetup(api, machineToken, runnerPath));
 }
 
@@ -84,9 +97,10 @@ function usage() {
 `ensemble — connect this machine to your Ensemble control plane
 
   ensemble login [--api <url>] [--name <machine>]
-        sign in via your browser (recommended) — approve the machine, no token to copy
+        sign in via your browser + connect this machine (runtime is installed at npm install)
   ensemble enroll --token <enrollment-token> [--api <url>] [--name <machine>]
         headless / CI: enrol with an enrollment token from the portal
+  ensemble install        (re)download the runner + bus for this platform
   ensemble status         show connection + your org's live session mailboxes
   ensemble hooks          (re)wire ensemble-bus into installed coding CLIs
   ensemble version
@@ -101,8 +115,9 @@ Run \`ensemble login\` and approve the machine in your browser.`);
   try {
     if (cmd === 'login') await login(args);
     else if (cmd === 'enroll') await enroll(args);
+    else if (cmd === 'install') await install();
     else if (cmd === 'status') await status(args);
-    else if (cmd === 'hooks') { await core.ensureBinaries(); core.log('wired: ' + (core.wireHooks().join(', ') || 'none')); }
+    else if (cmd === 'hooks') { core.log('wired: ' + (core.wireHooks().join(', ') || 'none')); }
     else if (cmd === 'version' || cmd === '--version' || cmd === '-v') core.log(require('../package.json').version);
     else usage();
   } catch (e) {

package/lib/core.js

@@ -11,8 +11,12 @@ const ENSEMBLE_DIR = path.join(HOME, '.ensemble');
 const BIN_DIR = path.join(ENSEMBLE_DIR, 'bin');
 const RUNNER_DIR = path.join(ENSEMBLE_DIR, 'runner');
 const DEFAULT_API = process.env.ENSEMBLE_API || 'https://api.ensemble.host';
-// Public host for the prebuilt binaries (runner + bus). Overridable for testing.
-const DL_BASE = process.env.ENSEMBLE_DL_BASE || 'https://ensembledl.blob.core.windows.net/cli';
+// Public host for the prebuilt binaries (runner + bus). Branded CDN in front of the blob
+// (Cloudflare Worker → ensembledl blob; the raw blob URL still works as a fallback). Overridable.
+const DL_BASE = process.env.ENSEMBLE_DL_BASE || 'https://storage.ensemble.host/cli';
+// RIDs we currently publish a prebuilt runner + bus for on DL_BASE. Expand as more are uploaded
+// (osx-x64 for Intel Macs, linux-arm64, win-arm64). Keep in sync with what the build pipeline ships.
+const SUPPORTED_PLATFORMS = ['win-x64', 'osx-arm64', 'osx-x64', 'linux-x64', 'linux-arm64'];
 
 function log(msg) { process.stdout.write(msg + '\n'); }
 function warn(msg) { process.stderr.write(msg + '\n'); }
@@ -64,9 +68,43 @@ function downloadTo(url, dest) {
   });
 }
 
+// Throws (not die) so the npm postinstall can catch and not fail the whole install on an
+// unsupported OS; the CLI dispatcher catches the throw and prints it cleanly.
+function assertSupported() {
+  const pf = platform();
+  if (!SUPPORTED_PLATFORMS.includes(pf.key)) {
+    throw new Error(`no prebuilt Ensemble runtime for "${pf.key}" (${process.platform}/${process.arch}) — ` +
+      `supported: ${SUPPORTED_PLATFORMS.join(', ')}. Ask us to add ${pf.key}, or build from source.`);
+  }
+}
+
+function runtimePaths() {
+  const pf = platform();
+  return {
+    pf,
+    busPath: path.join(BIN_DIR, 'ensemble-bus' + pf.exe),
+    runnerPath: path.join(RUNNER_DIR, 'Ensemble.Runner' + pf.exe),
+  };
+}
+
+// The runner + bus are downloaded at `npm install` (postinstall) or `ensemble install` — NOT at login.
+function runtimeInstalled() {
+  const p = runtimePaths();
+  const ok = (f) => fs.existsSync(f) && fs.statSync(f).size > 0;
+  return ok(p.busPath) && ok(p.runnerPath);
+}
+
+function requireRuntime() {
+  if (!runtimeInstalled()) {
+    die('the Ensemble runtime is not installed — run `ensemble install` (or reinstall @webority/ensemble).');
+  }
+  return runtimePaths();
+}
+
 async function ensureBinaries() {
   ensureDirs();
   const pf = platform();
+  assertSupported();
   const busPath = path.join(BIN_DIR, 'ensemble-bus' + pf.exe);
   const runnerPath = path.join(RUNNER_DIR, 'Ensemble.Runner' + pf.exe);
   const targets = [
@@ -276,5 +314,6 @@ function finishSetup(api, machineToken, runnerPath) {
 module.exports = {
   log, warn, die, platform, DEFAULT_API, ENSEMBLE_DIR, RUNNER_DIR, BIN_DIR,
   ensureBinaries, enrollMachine, writeRunnerConfig, wireHooks, installAutostart, startRunner, request,
-  sleep, openBrowser, startDevice, pollDevice, finishSetup,
+  sleep, openBrowser, startDevice, pollDevice, finishSetup, assertSupported,
+  runtimePaths, runtimeInstalled, requireRuntime,
 };

package/lib/postinstall.js

@@ -0,0 +1,22 @@
+'use strict';
+// Runs at `npm install` (postinstall). Downloads the runner + bus for this platform so that
+// `ensemble login` is auth-only. Resilient by design: any failure (offline, unsupported OS,
+// --ignore-scripts) warns and exits 0 so it never breaks `npm install` — `ensemble install`
+// (or the next install) can retry.
+const core = require('./core');
+
+(async () => {
+  try {
+    if (core.runtimeInstalled()) {
+      return; // already present (e.g. reinstall of the same version)
+    }
+    core.assertSupported();
+    core.log('Ensemble: installing the runner + bus for this machine …');
+    await core.ensureBinaries();
+    core.log('Ensemble: runtime installed. Next:  ensemble login');
+  } catch (e) {
+    core.warn('Ensemble: could not install the runtime now (' + (e && e.message ? e.message : e) + ').');
+    core.warn('          Run  ensemble install  when ready, then  ensemble login.');
+    // exit 0 — never fail `npm install`.
+  }
+})();

package/package.json

@@ -1,10 +1,13 @@
 {
   "name": "@webority/ensemble",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "Connect this machine to your Ensemble control plane — runs the local agent runner and wires the ensemble-bus session bus so your coding sessions talk (per-org, isolated).",
   "bin": {
     "ensemble": "bin/ensemble.js"
   },
+  "scripts": {
+    "postinstall": "node lib/postinstall.js"
+  },
   "engines": {
     "node": ">=18"
   },