anairyspirit 0.0.2 → 0.1.391

package/README.md

@@ -1,14 +1,51 @@
 # anairyspirit
 
 A personal AI memory graph that runs on your own machine. Your AI agents keep
-long-term memory in it over MCP and REST.
+long-term memory in it over MCP and REST; nothing leaves the machine.
 
-This npm package is not the installer yet — it will install the signed program
-for your platform. Until then, install it from
-https://github.com/Seventhwalllab/anairyspirit — a macOS disk image, Homebrew,
-Debian/Ubuntu and Fedora/openSUSE packages, an archive for any Linux, or Docker:
+This package installs it and runs it — macOS and Linux (x86_64, arm64), Node 18
+or newer. It carries no program itself: it downloads the release it was built
+for from GitHub and checks it against the checksums of that release's signed
+manifest before anything runs.
 
-    docker pull ghcr.io/seventhwalllab/anairyspirit:latest
+## Install
+
+```bash
+npx anairyspirit setup
+```
+
+`setup` asks about encryption and the rest, installs the program as
+`anairyspirit` (in `/usr/local/bin`, or `~/.local/bin` — then open a new
+terminal) and starts its service.
+
+## Use it from an AI client
+
+Once installed, every command goes to the installed program, so an MCP client
+can start it like this:
+
+```json
+{ "command": "npx", "args": ["-y", "anairyspirit", "mcp"] }
+```
+
+## Update
+
+```bash
+npx anairyspirit@latest update
+```
+
+installs the newest release over yours — your memory, settings and keys stay.
+An install made by Homebrew or a package is updated the way it came; the
+program says how.
+
+## Installed with `npm i -g`
+
+The command is then `anairyspirit-npm` (the program itself is `anairyspirit`,
+and the two must not share a name): `anairyspirit-npm setup`,
+`anairyspirit-npm update`.
+
+Other ways to install — a macOS disk image, Homebrew, Debian/Ubuntu and
+Fedora/openSUSE packages, Docker — and the manual:
+https://github.com/Seventhwalllab/anairyspirit
 
 The program is distributed under its own licence agreement (EULA), shipped with
-every release.
+every release and shown by `setup`.

package/bin/anairyspirit.js

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+'use strict';
+// `anairyspirit` from npm: see lib/core.js for what it does and does not do.
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { main } = require('../lib/core.js');
+
+const sumsFile = path.join(__dirname, '..', 'sums.json');
+if (!fs.existsSync(sumsFile)) {
+  process.stderr.write('anairyspirit (npm): this copy carries no release (sums.json is made when the package is built).\n');
+  process.exit(1);
+}
+const sums = JSON.parse(fs.readFileSync(sumsFile, 'utf8'));
+
+main(process.argv.slice(2), {
+  sums,
+  env: process.env,
+  home: os.homedir(),
+  platform: process.platform,
+  arch: process.arch,
+  self: __filename,
+  baseUrl: process.env.ANAIRYSPIRIT_NPM_BASE_URL,
+}).then(
+  (code) => process.exit(code),
+  (err) => {
+    process.stderr.write(`anairyspirit (npm): ${err.message}\n`);
+    process.exit(1);
+  },
+);

package/lib/core.js

@@ -0,0 +1,243 @@
+'use strict';
+// The npm package of anairyspirit is an installer and a launcher, not the
+// program: it carries no binary. It knows one release — the version in
+// sums.json, with the sha256 of that release's archives, taken from the
+// release's GPG-signed SHA256SUMS when the package was built — and does three
+// things:
+//
+//   * nothing installed yet: `anairyspirit` / `anairyspirit setup` downloads
+//     the archive for this machine from the GitHub release, checks its sha256,
+//     unpacks it and runs `./anairyspirit setup` from it — the same install as
+//     from the archive by hand;
+//   * installed (any way — disk image, Homebrew, .deb/.rpm, archive): every
+//     command goes to the installed program, so `npx -y anairyspirit mcp`
+//     works in an MCP client's configuration;
+//   * `anairyspirit update`: when the installed program is older than this
+//     package's release, downloads and checks that release and hands it to
+//     `anairyspirit update --from`, the program's own update.
+//
+// Its one command is `anairyspirit-npm`, never `anairyspirit`: `npm i -g` puts
+// its commands into npm's bin folder — /usr/local/bin, /opt/homebrew/bin or
+// /usr/bin — and `setup` installs the program as /usr/local/bin/anairyspirit
+// (or ~/.local/bin). Under one name the copy would write through npm's link
+// into this package, and in /usr/bin the program would take itself for a
+// system package. `npx anairyspirit …` still runs it: npx runs a package's
+// only command whatever its name.
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const crypto = require('crypto');
+const http = require('http');
+const https = require('https');
+const { spawn, spawnSync } = require('child_process');
+
+const RELEASES = 'https://github.com/Seventhwalllab/anairyspirit/releases/download';
+const TAG = 'anairyspirit (npm)';
+
+/** The release archive for this platform, or null where there is none. */
+function archiveFor(platform, arch, version) {
+  if (platform === 'darwin') {
+    // One universal archive for both Mac arches, flat: `anairyspirit` at its root.
+    return { file: `anairyspirit-${version}-macos-universal.tar.gz`, dir: '' };
+  }
+  if (platform === 'linux') {
+    const a = { x64: 'x86_64', arm64: 'arm64' }[arch];
+    if (!a) return null;
+    return { file: `anairyspirit-${version}-${a}.tar.gz`, dir: `anairyspirit-${version}-${a}` };
+  }
+  return null;
+}
+
+/** The places installs put the program, beside PATH. */
+function usualDirs(home) {
+  return ['/usr/local/bin', path.join(home, '.local', 'bin'), '/usr/bin',
+    '/opt/homebrew/bin', '/home/linuxbrew/.linuxbrew/bin'];
+}
+
+/** Where an installed program may be: PATH first, then `extra` (default: usualDirs). */
+function candidates(env, home, extra) {
+  const dirs = (env.PATH || '').split(path.delimiter).filter(Boolean);
+  dirs.push(...(extra || usualDirs(home)));
+  const seen = new Set();
+  const out = [];
+  for (const d of dirs) {
+    const f = path.join(d, 'anairyspirit');
+    if (!seen.has(f)) { seen.add(f); out.push(f); }
+  }
+  return out;
+}
+
+function realOrNull(f) {
+  try { return fs.realpathSync(f); } catch { return null; }
+}
+
+/** A Node launcher — this one, or a copy of it in another npm prefix or npx cache. */
+function isLauncher(file, selfReal) {
+  const real = realOrNull(file);
+  if (!real || real === selfReal) return true;
+  try {
+    const fd = fs.openSync(real, 'r');
+    const head = Buffer.alloc(64);
+    const n = fs.readSync(fd, head, 0, 64, 0);
+    fs.closeSync(fd);
+    const s = head.subarray(0, n).toString('latin1');
+    return s.startsWith('#!') && s.includes('node');
+  } catch {
+    return true;
+  }
+}
+
+/** The installed program, if there is one. */
+function findInstalled(env, home, selfFile, extra) {
+  const selfReal = realOrNull(selfFile);
+  for (const f of candidates(env, home, extra)) {
+    try {
+      fs.accessSync(f, fs.constants.X_OK);
+      if (!fs.statSync(f).isFile()) continue;
+    } catch {
+      continue;
+    }
+    if (isLauncher(f, selfReal)) continue;
+    return f;
+  }
+  return null;
+}
+
+/** `Anairyspirit v0.1.391` → [0, 1, 391]; null when it says no version. */
+function parseVersion(text) {
+  const m = /(\d+)\.(\d+)\.(\d+)/.exec(text || '');
+  return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : null;
+}
+
+function compareVersions(a, b) {
+  for (let i = 0; i < 3; i++) if (a[i] !== b[i]) return a[i] < b[i] ? -1 : 1;
+  return 0;
+}
+
+/** Download `url` to `dest` (following redirects); resolves to its sha256. */
+function download(url, dest, redirects = 5) {
+  return new Promise((resolve, reject) => {
+    const mod = url.startsWith('http://') ? http : https;
+    const req = mod.get(url, { headers: { 'User-Agent': 'anairyspirit-npm' } }, (res) => {
+      if ([301, 302, 303, 307, 308].includes(res.statusCode) && res.headers.location) {
+        res.resume();
+        if (redirects <= 0) return reject(new Error(`too many redirects for ${url}`));
+        return resolve(download(new URL(res.headers.location, url).toString(), dest, redirects - 1));
+      }
+      if (res.statusCode !== 200) {
+        res.resume();
+        return reject(new Error(`HTTP ${res.statusCode} for ${url}`));
+      }
+      const hash = crypto.createHash('sha256');
+      const out = fs.createWriteStream(dest);
+      res.on('data', (chunk) => hash.update(chunk));
+      res.on('error', reject);
+      out.on('error', reject);
+      out.on('finish', () => resolve(hash.digest('hex')));
+      res.pipe(out);
+    });
+    req.on('error', reject);
+  });
+}
+
+/**
+ * Download this package's release for this machine into a fresh temporary
+ * folder, check it against sums.json and unpack it. Returns the folder, the
+ * unpacked directory and the program in it. Nothing is unpacked unless the
+ * sha256 matches.
+ */
+async function fetchRelease(sums, opts) {
+  const a = archiveFor(opts.platform, opts.arch, sums.version);
+  if (!a) throw new Error(`no release archive for ${opts.platform}/${opts.arch}`);
+  const expected = sums.files[a.file];
+  if (!expected) throw new Error(`this package lists no checksum for ${a.file}`);
+  const base = opts.baseUrl || `${RELEASES}/v${sums.version}`;
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'anairyspirit-npm-'));
+  const archive = path.join(tmp, a.file);
+  opts.log(`Downloading ${a.file} …`);
+  let got;
+  try {
+    got = await download(`${base}/${a.file}`, archive);
+  } catch (e) {
+    fs.rmSync(tmp, { recursive: true, force: true });
+    throw e;
+  }
+  if (got !== expected) {
+    fs.rmSync(tmp, { recursive: true, force: true });
+    throw new Error(`${a.file}: sha256 ${got} is not the release's ${expected} — nothing was installed`);
+  }
+  opts.log('Checksum matches the release.');
+  const x = spawnSync('tar', ['-xzf', archive, '-C', tmp], { stdio: 'inherit' });
+  if (x.status !== 0) {
+    fs.rmSync(tmp, { recursive: true, force: true });
+    throw new Error(`could not unpack ${a.file}`);
+  }
+  const dir = path.join(tmp, a.dir);
+  return { tmp, dir, program: path.join(dir, 'anairyspirit') };
+}
+
+/** Run a program with this process's terminal; resolves to its exit code. */
+function run(program, args, cwd) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(program, args, { stdio: 'inherit', cwd });
+    const forward = (sig) => () => { try { child.kill(sig); } catch { /* gone */ } };
+    const handlers = { SIGINT: forward('SIGINT'), SIGTERM: forward('SIGTERM'), SIGHUP: forward('SIGHUP') };
+    for (const [sig, h] of Object.entries(handlers)) process.on(sig, h);
+    const done = () => { for (const [sig, h] of Object.entries(handlers)) process.removeListener(sig, h); };
+    child.on('error', (e) => { done(); reject(e); });
+    child.on('exit', (code, signal) => {
+      done();
+      resolve(code !== null ? code : 128 + (os.constants.signals[signal] || 0));
+    });
+  });
+}
+
+async function main(args, opts) {
+  const log = opts.log || ((m) => process.stderr.write(`${m}\n`));
+  const o = { ...opts, log };
+  if (!archiveFor(o.platform, o.arch, o.sums.version)) {
+    log(`${TAG}: anairyspirit runs on macOS and on Linux (x86_64, arm64); this is ${o.platform}/${o.arch}.`);
+    log('On Windows, run it in Docker: https://github.com/Seventhwalllab/anairyspirit#install');
+    return 1;
+  }
+  const installed = findInstalled(o.env, o.home, o.self, o.extraDirs);
+
+  if (!installed) {
+    if (args.length === 0 || args[0] === 'setup') {
+      const r = await fetchRelease(o.sums, o);
+      try {
+        return await run(r.program, ['setup', ...args.slice(1)], r.dir);
+      } finally {
+        fs.rmSync(r.tmp, { recursive: true, force: true });
+      }
+    }
+    log(`${TAG}: anairyspirit is not installed on this machine yet.`);
+    log('Install it first:  npx anairyspirit setup');
+    return 1;
+  }
+
+  if (args[0] === 'update' && !args.includes('--from')) {
+    const v = spawnSync(installed, ['--version'], { encoding: 'utf8' });
+    const have = parseVersion(v.stdout);
+    const want = parseVersion(o.sums.version);
+    if (have && compareVersions(have, want) >= 0) {
+      log(`${TAG}: the installed anairyspirit is v${have.join('.')}; this package carries v${o.sums.version} — nothing newer here.`);
+      log('For the newest release:  npx anairyspirit@latest update');
+      return 0;
+    }
+    const r = await fetchRelease(o.sums, o);
+    try {
+      return await run(installed, ['update', '--from', r.program, ...args.slice(1)], r.dir);
+    } finally {
+      fs.rmSync(r.tmp, { recursive: true, force: true });
+    }
+  }
+
+  return run(installed, args);
+}
+
+module.exports = {
+  archiveFor, usualDirs, candidates, isLauncher, findInstalled, parseVersion, compareVersions,
+  download, fetchRelease, run, main,
+};

package/package.json

@@ -1,13 +1,39 @@
 {
   "name": "anairyspirit",
-  "version": "0.0.2",
+  "version": "0.1.391",
   "description": "Personal AI memory graph that runs locally: long-term memory for your AI agents over MCP and REST",
   "homepage": "https://github.com/Seventhwalllab/anairyspirit",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/Seventhwalllab/anairyspirit.git"
+    "url": "git+https://github.com/Seventhwalllab/anairyspirit.git",
+    "directory": "npm"
   },
   "license": "SEE LICENSE IN README.md",
-  "keywords": ["ai", "memory", "mcp", "agents", "knowledge-graph", "local-first"],
-  "files": ["README.md"]
+  "keywords": [
+    "ai",
+    "memory",
+    "mcp",
+    "agents",
+    "knowledge-graph",
+    "local-first"
+  ],
+  "bin": {
+    "anairyspirit-npm": "bin/anairyspirit.js"
+  },
+  "files": [
+    "bin",
+    "lib",
+    "sums.json",
+    "README.md"
+  ],
+  "os": [
+    "darwin",
+    "linux"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "test": "node --test"
+  }
 }

package/sums.json

@@ -0,0 +1,8 @@
+{
+  "version": "0.1.391",
+  "files": {
+    "anairyspirit-0.1.391-macos-universal.tar.gz": "2f6e552bdf498641daf50cb745cd87f924318c730ef39a853b56c48a0fc08137",
+    "anairyspirit-0.1.391-arm64.tar.gz": "53001c120d0d95f01deac6f3cdd7103e619c86a7a09027cb2e739d2e03822695",
+    "anairyspirit-0.1.391-x86_64.tar.gz": "ffcacdef050ecdb2fa6a7568e6d09ed5951da093c71480e1b7a2f32af1974f69"
+  }
+}