beltsh 1.18.17 → 1.19.4

package/install.js

@@ -1,13 +1,17 @@
 #!/usr/bin/env node
 
+const http = require("http");
 const https = require("https");
+const tls = require("tls");
 const fs = require("fs");
 const path = require("path");
 const os = require("os");
 const zlib = require("zlib");
 const crypto = require("crypto");
 
-const MANIFEST_URL = "https://dist.inference.sh/cli/manifest.json";
+// BELT_MANIFEST_URL points the installer at a mirror of dist.inference.sh.
+const MANIFEST_URL =
+  process.env.BELT_MANIFEST_URL || "https://dist.inference.sh/cli/manifest.json";
 
 const PLATFORM = { darwin: "darwin", linux: "linux", win32: "windows" }[
   process.platform
@@ -21,6 +25,19 @@ if (!PLATFORM || !ARCH) {
 
 const KEY = `${PLATFORM}-${ARCH}`;
 
+// Pick the manifest build for `key`. Releases before the native windows-arm64
+// build have no such key; the amd64 build runs under emulation there.
+function selectBuild(builds, key = KEY, log = console.log) {
+  if (builds[key]) return { key, build: builds[key] };
+  if (key === "windows-arm64" && builds["windows-amd64"]) {
+    log("note: no windows-arm64 build in this release, using windows-amd64 under emulation");
+    return { key: "windows-amd64", build: builds["windows-amd64"] };
+  }
+  return null;
+}
+
+// Where the curl installer puts the binary; run.js falls back to it when the
+// package's own copy is missing (e.g. --ignore-scripts).
 function getInstallDir() {
   if (process.platform === "win32") {
     return path.join(os.homedir(), ".local", "bin");
@@ -31,22 +48,102 @@ function getInstallDir() {
   return path.join(os.homedir(), ".local", "bin");
 }
 
-function fetch(url) {
+// --- proxy support (HTTPS_PROXY / HTTP_PROXY / NO_PROXY), no dependencies ---
+
+function defaultPort(u) {
+  return Number(u.port) || (u.protocol === "https:" ? 443 : 80);
+}
+
+// NO_PROXY: comma-separated hosts or domain suffixes (leading dot optional,
+// port suffix ignored); "*" disables proxying entirely.
+function noProxyMatches(hostname, env = process.env) {
+  const raw = env.NO_PROXY || env.no_proxy;
+  if (!raw) return false;
+  const host = hostname.toLowerCase();
+  return raw
+    .split(",")
+    .map((r) => r.trim().toLowerCase())
+    .filter(Boolean)
+    .some((rule) => {
+      if (rule === "*") return true;
+      const r = rule.replace(/:\d+$/, "").replace(/^\./, "");
+      return host === r || host.endsWith(`.${r}`);
+    });
+}
+
+// The proxy URL to use for `target`, or null for a direct connection.
+function proxyFor(target, env = process.env) {
+  if (noProxyMatches(target.hostname, env)) return null;
+  const raw =
+    target.protocol === "https:"
+      ? env.HTTPS_PROXY || env.https_proxy
+      : env.HTTP_PROXY || env.http_proxy;
+  if (!raw) return null;
+  return new URL(raw.includes("://") ? raw : `http://${raw}`);
+}
+
+// Open a CONNECT tunnel to `target` through `proxy` and resolve the raw socket.
+function connectThroughProxy(proxy, target) {
   return new Promise((resolve, reject) => {
-    https
-      .get(url, (res) => {
-        if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
-          return fetch(res.headers.location).then(resolve, reject);
-        }
-        if (res.statusCode !== 200) {
-          return reject(new Error(`HTTP ${res.statusCode} for ${url}`));
-        }
-        const chunks = [];
-        res.on("data", (c) => chunks.push(c));
-        res.on("end", () => resolve(Buffer.concat(chunks)));
-        res.on("error", reject);
-      })
-      .on("error", reject);
+    const hostPort = `${target.hostname}:${defaultPort(target)}`;
+    const headers = { Host: hostPort };
+    if (proxy.username) {
+      const creds = `${decodeURIComponent(proxy.username)}:${decodeURIComponent(proxy.password)}`;
+      headers["Proxy-Authorization"] = `Basic ${Buffer.from(creds).toString("base64")}`;
+    }
+    const mod = proxy.protocol === "https:" ? https : http;
+    const req = mod.request({
+      host: proxy.hostname,
+      port: defaultPort(proxy),
+      method: "CONNECT",
+      path: hostPort,
+      headers,
+      agent: false,
+    });
+    req.on("connect", (res, socket) => {
+      if (res.statusCode !== 200) {
+        socket.destroy();
+        return reject(new Error(`proxy ${proxy.host} refused CONNECT ${hostPort}: HTTP ${res.statusCode}`));
+      }
+      resolve(socket);
+    });
+    req.on("error", (err) => reject(new Error(`proxy ${proxy.host}: ${err.message}`)));
+    req.end();
+  });
+}
+
+// GET `url` following redirects. Honors HTTPS_PROXY / HTTP_PROXY (http or
+// https proxy URL, optional basic auth) via a CONNECT tunnel, and NO_PROXY.
+async function fetch(url, redirects = 0) {
+  if (redirects > 10) throw new Error(`too many redirects for ${url}`);
+  const target = new URL(url);
+  const mod = target.protocol === "https:" ? https : http;
+  const options = {};
+  const proxy = proxyFor(target);
+  if (proxy) {
+    const socket = await connectThroughProxy(proxy, target);
+    // A createConnection without an agent makes the request use this socket.
+    options.createConnection =
+      target.protocol === "https:"
+        ? () => tls.connect({ socket, servername: target.hostname })
+        : () => socket;
+  }
+  const res = await new Promise((resolve, reject) => {
+    mod.get(url, options, resolve).on("error", reject);
+  });
+  if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+    res.resume();
+    return fetch(new URL(res.headers.location, url).href, redirects + 1);
+  }
+  if (res.statusCode !== 200) {
+    res.resume();
+    throw new Error(`HTTP ${res.statusCode} for ${url}`);
+  }
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    res.on("data", (c) => chunks.push(c));
+    res.on("end", () => resolve(Buffer.concat(chunks)));
+    res.on("error", reject);
   });
 }
 
@@ -118,16 +215,43 @@ function extractFromTarGz(buf, prefix) {
   return null;
 }
 
+// Write `data` to `dest` without ever leaving `dest` missing: stage next to it
+// and rename over. Windows refuses to replace a running exe but allows renaming
+// it, so the old file is moved aside first there.
+function installFile(dest, data) {
+  const staging = `${dest}.new-${process.pid}`;
+  fs.writeFileSync(staging, data, { mode: 0o755 });
+  try {
+    if (process.platform === "win32" && fs.existsSync(dest)) {
+      const old = `${dest}.old`;
+      try { fs.unlinkSync(old); } catch {}
+      fs.renameSync(dest, old);
+      try {
+        fs.renameSync(staging, dest);
+      } catch (err) {
+        fs.renameSync(old, dest);
+        throw err;
+      }
+      try { fs.unlinkSync(old); } catch {}
+    } else {
+      // rename replaces a symlink itself rather than writing through it.
+      fs.renameSync(staging, dest);
+    }
+  } finally {
+    try { fs.unlinkSync(staging); } catch {}
+  }
+}
+
 async function main() {
-  const installDir = getInstallDir();
   console.log(`Downloading belt for ${PLATFORM}/${ARCH}...`);
 
   const manifest = JSON.parse(await fetch(MANIFEST_URL));
-  const build = manifest.builds[KEY];
-  if (!build) {
+  const selected = selectBuild(manifest.builds || {});
+  if (!selected) {
     console.error(`No build found for ${KEY}`);
     process.exit(1);
   }
+  const { build } = selected;
 
   const archive = await fetch(build.url);
 
@@ -148,35 +272,16 @@ async function main() {
     process.exit(1);
   }
 
-  // Install to persistent location
+  // Only the package's own bin/ copy is written: npm's bin shims (belt,
+  // infsh, inferencesh -> run.js) put it on PATH for `npm i -g`, and npx runs
+  // it directly. Writing a second copy to ~/.local/bin left two binaries that
+  // self-updated independently and shadowed each other.
   const ext = PLATFORM === "windows" ? ".exe" : "";
-  fs.mkdirSync(installDir, { recursive: true });
-  const dest = path.join(installDir, `belt${ext}`);
-
-  // Remove any existing file/symlink first — copyFileSync follows symlinks,
-  // which corrupts installs where an older installer left belt as a symlink.
-  try { fs.unlinkSync(dest); } catch {}
-  fs.writeFileSync(dest, entry.data, { mode: PLATFORM === "windows" ? undefined : 0o755 });
-
-  // Create aliases (same as curl installer). Symlinks require elevation on
-  // Windows, so fall back to copying the binary there.
-  for (const alias of ["infsh", "inferencesh"]) {
-    const link = path.join(installDir, `${alias}${ext}`);
-    try { fs.unlinkSync(link); } catch {}
-    if (PLATFORM === "windows") {
-      fs.copyFileSync(dest, link);
-    } else {
-      fs.symlinkSync(`belt${ext}`, link);
-    }
-  }
-
-  // Also install into npm bin/ so run.js works for npx / npm install -g
   const npmBin = path.join(__dirname, "bin");
   fs.mkdirSync(npmBin, { recursive: true });
-  const npmDest = path.join(npmBin, `belt${ext}`);
-  fs.writeFileSync(npmDest, entry.data, { mode: PLATFORM === "windows" ? undefined : 0o755 });
+  installFile(path.join(npmBin, `belt${ext}`), entry.data);
 
-  console.log(`Installed belt ${manifest.version} to ${installDir}`);
+  console.log(`Installed belt ${manifest.version}`);
 }
 
 if (require.main === module) {
@@ -186,4 +291,14 @@ if (require.main === module) {
   });
 }
 
-module.exports = { extractFromZip, extractFromTarGz, getInstallDir };
+module.exports = {
+  extractFromZip,
+  extractFromTarGz,
+  fetch,
+  getInstallDir,
+  installFile,
+  main,
+  noProxyMatches,
+  proxyFor,
+  selectBuild,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "beltsh",
-  "version": "1.18.17",
+  "version": "1.19.4",
   "description": "inference.sh CLI — run AI apps, manage skills, connect MCP servers",
   "homepage": "https://inference.sh",
   "repository": {
@@ -15,7 +15,7 @@
   },
   "scripts": {
     "postinstall": "node install.js",
-    "test": "node --test install.test.js run.test.js"
+    "test": "node --test install.test.js run.test.js package.test.js"
   },
   "os": [
     "darwin",

package/run.js

@@ -3,22 +3,51 @@
 const { spawn } = require("child_process");
 const { existsSync } = require("fs");
 const path = require("path");
+const { getInstallDir, main: install } = require("./install.js");
 
 const ext = process.platform === "win32" ? ".exe" : "";
-const bin = path.join(__dirname, "bin", `belt${ext}`);
 
-if (!existsSync(bin)) {
-  console.error(
-    "belt binary not found at " + bin + "\n" +
-    "This can happen on Git Bash/MSYS — install directly instead:\n" +
-    "  curl -fsSL https://dist.inference.sh/install.sh | sh"
-  );
-  process.exit(1);
+// The postinstall copy, then the persistent one install.js also writes.
+function findBinary() {
+  const candidates = [
+    path.join(__dirname, "bin", `belt${ext}`),
+    path.join(getInstallDir(), `belt${ext}`),
+  ];
+  return candidates.find((p) => existsSync(p));
 }
 
-const child = spawn(bin, process.argv.slice(2), { stdio: "inherit" });
-child.on("error", (err) => {
-  console.error(err.message);
-  process.exit(1);
-});
-child.on("exit", (code) => process.exit(code ?? 1));
+function run(bin) {
+  const child = spawn(bin, process.argv.slice(2), { stdio: "inherit" });
+  child.on("error", (err) => {
+    console.error(err.message);
+    process.exit(1);
+  });
+  child.on("exit", (code) => process.exit(code ?? 1));
+}
+
+async function start() {
+  let bin = findBinary();
+  if (!bin) {
+    // postinstall did not run (--ignore-scripts) or failed: install now.
+    // Its progress goes to stderr so stdout stays clean for the command.
+    const log = console.log;
+    console.log = console.error;
+    try {
+      await install();
+    } catch (err) {
+      console.error(
+        "belt binary not found and could not be downloaded: " + err.message + "\n" +
+        "install directly instead:\n" +
+        "  macOS / Linux / Git Bash:  curl -fsSL https://cli.inference.sh | sh\n" +
+        "  Windows PowerShell:        irm https://cli.inference.sh/install.ps1 | iex"
+      );
+      process.exit(1);
+    } finally {
+      console.log = log;
+    }
+    bin = findBinary();
+  }
+  run(bin);
+}
+
+start();