balladeer 0.0.4 → 1.0.0

package/bin/balladeer.js

@@ -1,136 +0,0 @@
-#!/usr/bin/env node
-/**
- * Bootstrapper for the Balladeer client (npm name: balladeer).
- *
- * This package is not the client; it installs it. On consent it downloads the
- * current client tarball from Balladeer's central installer endpoints, verifies
- * the published sha256, and `npm install -g`s the verified file, which replaces
- * this package in place (the client ships under the same package name).
- *
- * Flags: --yes/-y skip the prompt; --download-only fetch + verify, print the path.
- */
-const { createHash } = require("node:crypto");
-const { existsSync, mkdtempSync, writeFileSync, rmSync } = require("node:fs");
-const { tmpdir } = require("node:os");
-const { join } = require("node:path");
-const { spawnSync } = require("node:child_process");
-const readline = require("node:readline");
-
-const BASE = process.env.BALLADEER_INSTALL_BASE ?? "https://get.balladeer.ai";
-const TGZ_URL = `${BASE}/install/client.tgz`;
-const SHA_URL = `${BASE}/install/client.tgz.sha256`;
-
-const args = process.argv.slice(2);
-const yes = args.includes("--yes") || args.includes("-y");
-const downloadOnly = args.includes("--download-only");
-
-function fail(msg, code = 1) {
-  console.error(msg);
-  process.exit(code);
-}
-
-async function fetchBytes(url) {
-  const res = await fetch(url, { redirect: "follow" });
-  if (!res.ok) {
-    fail(
-      `error: ${url} answered ${res.status}` +
-        (res.status === 503 ? " (the client artifact is not available on the server yet)" : ""),
-    );
-  }
-  return Buffer.from(await res.arrayBuffer());
-}
-
-async function main() {
-  console.error(
-    `balladeer: this npm package is the installer, not the client.\n` +
-      `It downloads the current Balladeer client from ${BASE}, verifies its\n` +
-      `sha256 checksum, and installs it globally (replacing this package).\n`,
-  );
-
-  if (!yes && !downloadOnly) {
-    if (!process.stdin.isTTY) {
-      fail(
-        `Non-interactive shell: re-run with --yes to install, or use the script installer:\n\n` +
-          `  curl -fsSL ${BASE} | sh\n`,
-      );
-    }
-    const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
-    const answer = await new Promise((res) => rl.question("Install the Balladeer client now? [Y/n] ", res));
-    rl.close();
-    if (answer.trim() !== "" && !/^y(es)?$/i.test(answer.trim())) fail("Nothing installed.");
-  }
-
-  console.error(`downloading ${TGZ_URL} ...`);
-  const [tgz, shaFile] = await Promise.all([fetchBytes(TGZ_URL), fetchBytes(SHA_URL)]);
-  const expected = shaFile.toString("utf8").trim().split(/\s+/)[0];
-  const actual = createHash("sha256").update(tgz).digest("hex");
-  if (!/^[0-9a-f]{64}$/.test(expected) || expected !== actual) {
-    fail(
-      `error: checksum mismatch; refusing to install a tampered download.\n` +
-        `  expected ${expected}\n  actual   ${actual}`,
-    );
-  }
-  console.error(`checksum OK (sha256 ${actual.slice(0, 16)}...)`);
-
-  // A private mkdtemp dir, not a predictable name in the shared tmpdir: the same posture as
-  // the script installer's `mktemp -d`, so nothing can pre-place a file/symlink at the path.
-  const dir = mkdtempSync(join(tmpdir(), "balladeer-"));
-  const file = join(dir, "balladeer-client.tgz");
-  writeFileSync(file, tgz);
-  if (downloadOnly) {
-    console.log(file);
-    return;
-  }
-
-  // Volta prepends its real-node bin dir to a child tool's PATH, so a bare `npm` spawned from
-  // here resolves to the RAW npm inside the node image and installs into that image's globals,
-  // while the `balladeer` on the user's PATH stays Volta's shim serving THIS bootstrapper — a
-  // split-brain where every run is the installer again. Route the install through Volta's own
-  // npm shim so its interception updates the package image the shim actually serves.
-  const voltaNpm = process.env.VOLTA_HOME ? join(process.env.VOLTA_HOME, "bin", "npm") : null;
-  const npmCmd = voltaNpm && existsSync(voltaNpm) ? voltaNpm : "npm";
-  // --ignore-scripts: the client has no install hooks, and this keeps a hostile tarball from
-  // running code at install time (the same flag the script installer passes).
-  const r = spawnSync(npmCmd, ["install", "-g", "--ignore-scripts", file], {
-    stdio: "inherit",
-    shell: process.platform === "win32",
-  });
-  try {
-    rmSync(dir, { recursive: true, force: true });
-  } catch {}
-  if (r.status !== 0) {
-    fail(`error: npm install -g failed (exit ${r.status ?? "?"}). Fix the npm error above and re-run \`balladeer\`.`, r.status ?? 1);
-  }
-
-  // Never report success on npm's exit code alone: prove the world changed. If `balladeer` still
-  // resolves to this installer (or to nothing), say so honestly instead of claiming victory.
-  const probe = spawnSync("balladeer", ["--version"], { encoding: "utf8", shell: process.platform === "win32" });
-  const probedVersion = (probe.stdout ?? "").trim();
-  if (probe.status !== 0 || !/^\d+\.\d+\.\d+/.test(probedVersion)) {
-    fail(
-      `error: npm reported success, but \`balladeer\` on your PATH is not the client yet.\n` +
-        `Your npm setup may install globals somewhere this shell does not look, or a version\n` +
-        `manager may be serving a stale copy. Try a fresh shell and \`balladeer --version\`,\n` +
-        `or use the script installer:\n\n  curl -fsSL ${BASE} | sh\n`,
-    );
-  }
-
-  // Plain `balladeer login` (the client defaults to hosted central). BASE is the INSTALL host
-  // (get.balladeer.ai), an alias that exists only for downloading — teaching it as --server
-  // would store it as the machine's permanent server URL. A custom BALLADEER_INSTALL_BASE
-  // means a self-hosted deploy whose central URL this bootstrapper cannot derive, so point at
-  // the flag rather than silently teaching the hosted default.
-  const pairHint =
-    BASE === "https://get.balladeer.ai"
-      ? "balladeer login"
-      : "balladeer login --server <your central server URL>";
-  console.error(
-    `\n✓ Balladeer client installed (${probedVersion}).\n\n` +
-      `  next   ${pairHint}     # approve in your browser; no token to copy\n` +
-      `  then   your coding agent gains get_context / consult / propose_decision\n` +
-      `  agent  or let your agent finish the wiring: paste into it -> Read ${BASE}/agent and follow it.\n\n` +
-      `  no workspace yet? create one at https://app.balladeer.ai`,
-  );
-}
-
-main().catch((err) => fail(`error: ${err?.message ?? err}`));