boosted-cli 0.1.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 monokaijs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,58 @@
+# Boosted
+
+Boosted is a local-first, multi-user coding workspace with a task board, task-specific Codex planning conversations, and separate general Codex chats. It ships one Vite + React frontend for both the browser and a Tauri desktop shell.
+
+## Development
+
+Prerequisites: Node 22+, pnpm 10+, Rust 1.85+, Git, and the Codex CLI.
+
+```bash
+pnpm install
+pnpm dev
+cargo run -p boosted-server
+```
+
+The web client defaults to `http://127.0.0.1:4782`. Set `VITE_BOOSTED_API_URL` when the service runs elsewhere. The server stores local state under the platform application-data directory, or under `BOOSTED_DATA_DIR` when set.
+
+The first browser visit creates the administrator. The admin then creates member accounts. All authenticated users share projects, tasks, history, terminals, and host-level execution access; only the first user can manage accounts and the shared Codex connection.
+
+> Boosted currently starts Codex with full host access, matching the selected product policy. Only expose the server to trusted users, and put remote access behind your own authenticated TLS proxy or tunnel.
+
+## Headless server
+
+The quickest way to start the headless server is through npm (Node.js 18+):
+
+```bash
+npx boosted-cli
+```
+
+Or install it globally and run `boosted-cli`. The npm launcher downloads and caches the native CLI for Linux x64, macOS Intel/Apple Silicon, or Windows x64. The CLI has the web app embedded, so it does not need a desktop environment or WebKit. The server host still needs Git and the Codex CLI.
+
+No data-directory argument is required. Boosted stores its database, uploads, and managed worktrees in the platform application-data directory by default (`BOOSTED_DATA_DIR` remains available when a custom location is needed).
+
+Open `http://<server>:4782` in a browser. The first launch listens publicly on `0.0.0.0:4782`. Administrators can change the port, disable browser UI serving, or allowlist remote IPv4/IPv6 addresses under **Settings → Global → Web interface**; saved changes apply after restarting Boosted. Localhost remains available when an allowlist is active.
+
+Run `npx boosted-cli --help` for launch overrides. `--bind`, `--port`, `--disable-web-ui`, repeated `--allow-ip`, and `--public` override saved settings for that launch. `BOOSTED_BIND`, `BOOSTED_PORT`, `BOOSTED_DISABLE_WEB_UI`, `BOOSTED_ALLOWED_IPS`, `BOOSTED_DATA_DIR`, and `BOOSTED_WEB_DIR` provide environment equivalents; an external web directory overrides the embedded frontend.
+
+Public access gives authenticated users host-level execution access. Use the IP allowlist or a firewall for trusted networks, and put internet-facing access behind an authenticated TLS proxy or tunnel.
+
+To build and run the self-contained CLI from source:
+
+```bash
+pnpm build
+cargo run --release -p boosted-server --features embedded-web -- serve
+```
+
+GitHub Releases also provide the standalone native CLI executables used by the npm launcher.
+
+## Releases
+
+Run the **Release Boosted** workflow from the repository's Actions tab and choose a `patch`, `minor`, or `major` version increment. The workflow builds standalone CLIs for Linux x64, Windows x64, and macOS Intel/Apple Silicon, plus Linux (`.deb` and `.AppImage`), Windows (`.exe` and `.msi`), and universal macOS (`.dmg`) installers. Once every build succeeds, it commits the synchronized version bump, creates the version tag, publishes a GitHub Release with SHA-256 checksums, and publishes `boosted-cli` to npm through Trusted Publishing.
+
+Trusted Publishing requires an existing npm package. Bootstrap `boosted-cli` with one authenticated manual publish, then configure its npm package settings with GitHub organization/user `monokaijs`, repository `boosted`, and workflow filename `release.yml`. No npm token is needed for later releases.
+
+Desktop builds check `monokaijs/boosted` GitHub Releases shortly after startup and every six hours. When a newer signed release is available, Boosted downloads it, verifies its updater signature, installs it, and relaunches. A manual **Check now** action and update progress are available under **Settings → Application**. Browser and headless-server sessions do not run the desktop updater.
+
+Updater packages are signed with the Tauri key whose public half is embedded in `desktop/src-tauri/tauri.conf.json`. The release workflow requires its private half in the `TAURI_SIGNING_PRIVATE_KEY` repository secret; `TAURI_SIGNING_PRIVATE_KEY_PASSWORD` is optional. Keep an offline backup of the private key: losing or replacing it prevents installed copies from trusting future updates. For a local release build using an unencrypted key, set `TAURI_SIGNING_PRIVATE_KEY` to the key’s path, export `TAURI_SIGNING_PRIVATE_KEY_PASSWORD=""`, then run `pnpm desktop:build`.
+
+The release workflow requires a Developer ID certificate and Apple notarization credentials for macOS. Follow [the macOS signing guide](docs/macos-signing.md) before the first release. Local macOS builds fall back to an ad-hoc signature; Windows installers remain unsigned.

package/bin/boosted-cli.mjs

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+
+import { run } from "../npm/launcher.mjs";
+
+run().catch((error) => {
+  console.error(`boosted-cli: ${error.message}`);
+  process.exitCode = 1;
+});

package/npm/launcher.mjs

@@ -0,0 +1,136 @@
+import { createHash } from "node:crypto";
+import { spawn } from "node:child_process";
+import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { homedir, tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const packagePath = fileURLToPath(new URL("../package.json", import.meta.url));
+const packageJson = JSON.parse(await readFile(packagePath, "utf8"));
+
+export const version = packageJson.version;
+
+export function releaseAsset(platform = process.platform, arch = process.arch) {
+  const targets = {
+    "darwin-arm64": `boosted-${version}-darwin-aarch64`,
+    "darwin-x64": `boosted-${version}-darwin-x86_64`,
+    "linux-x64": `boosted-${version}-linux-x86_64`,
+    "win32-x64": `boosted-${version}-windows-x86_64.exe`,
+  };
+  const key = `${platform}-${arch}`;
+  const asset = targets[key];
+
+  if (!asset) {
+    throw new Error(
+      `unsupported platform ${platform}/${arch}; supported platforms are macOS arm64/x64, Linux x64, and Windows x64`,
+    );
+  }
+
+  return asset;
+}
+
+export function cacheRoot(platform = process.platform, env = process.env) {
+  if (env.BOOSTED_CLI_CACHE_DIR) return env.BOOSTED_CLI_CACHE_DIR;
+  if (platform === "darwin") return join(homedir(), "Library", "Caches", "boosted-cli");
+  if (platform === "win32") {
+    return join(env.LOCALAPPDATA || tmpdir(), "boosted-cli", "Cache");
+  }
+  return join(env.XDG_CACHE_HOME || join(homedir(), ".cache"), "boosted-cli");
+}
+
+function releaseBaseUrl(env = process.env) {
+  return (
+    env.BOOSTED_CLI_DOWNLOAD_BASE_URL ||
+    `https://github.com/monokaijs/boosted/releases/download/v${version}`
+  ).replace(/\/$/, "");
+}
+
+async function download(url) {
+  const response = await fetch(url, {
+    headers: {
+      Accept: "application/octet-stream",
+      "User-Agent": `boosted-cli/${version}`,
+    },
+    redirect: "follow",
+  });
+
+  if (!response.ok) {
+    throw new Error(`download failed (${response.status} ${response.statusText}): ${url}`);
+  }
+
+  return Buffer.from(await response.arrayBuffer());
+}
+
+function expectedChecksum(checksums, asset) {
+  for (const line of checksums.split(/\r?\n/)) {
+    const match = line.match(/^([a-fA-F0-9]{64})\s+\*?(.+)$/);
+    if (match?.[2] === asset) return match[1].toLowerCase();
+  }
+  throw new Error(`SHA256SUMS.txt does not contain ${asset}`);
+}
+
+export async function installBinary({
+  platform = process.platform,
+  arch = process.arch,
+  env = process.env,
+} = {}) {
+  const asset = releaseAsset(platform, arch);
+  const binary = join(
+    cacheRoot(platform, env),
+    version,
+    platform === "win32" ? "boosted-cli.exe" : "boosted-cli",
+  );
+
+  try {
+    await chmod(binary, 0o755);
+    return binary;
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+
+  const baseUrl = releaseBaseUrl(env);
+  console.error(`boosted-cli: downloading Boosted ${version} for ${platform}/${arch}...`);
+  const [contents, checksumContents] = await Promise.all([
+    download(`${baseUrl}/${asset}`),
+    download(`${baseUrl}/SHA256SUMS.txt`).then((value) => value.toString("utf8")),
+  ]);
+  const actual = createHash("sha256").update(contents).digest("hex");
+  const expected = expectedChecksum(checksumContents, asset);
+
+  if (actual !== expected) {
+    throw new Error(`checksum verification failed for ${asset}`);
+  }
+
+  await mkdir(dirname(binary), { recursive: true });
+  const temporary = `${binary}.${process.pid}.tmp`;
+  try {
+    await writeFile(temporary, contents, { mode: 0o755 });
+    await chmod(temporary, 0o755);
+    await rename(temporary, binary);
+  } finally {
+    await rm(temporary, { force: true });
+  }
+
+  return binary;
+}
+
+export async function run({ argv = process.argv.slice(2), env = process.env } = {}) {
+  const binary = await installBinary({ env });
+  const child = spawn(binary, argv, {
+    env,
+    stdio: "inherit",
+    windowsHide: false,
+  });
+
+  await new Promise((resolve, reject) => {
+    child.once("error", reject);
+    child.once("exit", (code, signal) => {
+      if (signal) {
+        process.kill(process.pid, signal);
+        return;
+      }
+      process.exitCode = code ?? 1;
+      resolve();
+    });
+  });
+}

package/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "boosted-cli",
+  "version": "0.1.2",
+  "description": "Run the Boosted local-first coding workspace from the command line",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/monokaijs/boosted.git"
+  },
+  "homepage": "https://github.com/monokaijs/boosted#readme",
+  "bugs": "https://github.com/monokaijs/boosted/issues",
+  "type": "module",
+  "bin": {
+    "boosted-cli": "bin/boosted-cli.mjs"
+  },
+  "files": [
+    "bin/boosted-cli.mjs",
+    "npm/launcher.mjs"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "packageManager": "pnpm@10.34.5",
+  "scripts": {
+    "dev": "pnpm --filter @boosted/web dev",
+    "build": "pnpm --filter @boosted/web build",
+    "test": "pnpm --filter @boosted/web test",
+    "typecheck": "pnpm --filter @boosted/web typecheck",
+    "desktop": "pnpm --filter @boosted/desktop tauri dev",
+    "desktop:build": "pnpm --filter @boosted/desktop tauri build",
+    "server": "cargo run -p boosted-server",
+    "test:cli": "node --test test/npm-cli.test.mjs"
+  }
+}