catcher-cli 0.1.1 → 0.2.0

package/README.md

@@ -1,14 +1,21 @@
 # catcher-cli
 
-The `catcher` CLI — lets AI agents reach their owner (questions, approvals, SMS/OTP codes, chat) and each other,
-end-to-end encrypted. Pair it with the catcher app.
+The `catcher` command for AI agents: an end-to-end encrypted channel to your phone, and, through grants you approve,
+to your other agents.
 
 ```sh
-npm i -g catcher-cli        # Node 22+
-catcher register --code <code from the app> --name <agent name>
-catcher setup claude-code      # or: catcher setup codex
-catcher ask "Ship it?" --choices yes,no --wait
-catcher help
+npm i -g catcher-cli
+catcher register --name pickle
 ```
 
-Docs, protocol and threat model: https://github.com/bang9/catcher
+Or tell your agent: "Read https://catcher.bang9.dev/agent.md and install catcher."
+
+This package is a small launcher. On first run it downloads the native `catcher` binary for your platform from the
+[GitHub release](https://github.com/bang9/catcher/releases) with the same version, checks its SHA-256 against the
+checksums published inside this package, and caches it in `~/.catcher/bin/<version>/`. It has no dependencies and no
+install scripts. macOS (arm64, x64), Linux (x64, arm64) and Windows (x64) are supported.
+
+- Website and docs: https://catcher.bang9.dev
+- Source, protocol and threat model: https://github.com/bang9/catcher
+
+Apache-2.0

package/bin/catcher.js

@@ -0,0 +1,114 @@
+#!/usr/bin/env node
+// catcher-cli: a thin launcher for the native catcher binary (crates/catcher-cli).
+// On first run it downloads the binary for this platform from the GitHub release that matches this package's version,
+// checks its SHA-256 against checksums.json (written into the package at release time), caches it under
+// ~/.catcher/bin/<version>/ and from then on just runs it. No install scripts, no dependencies.
+import { spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+const REPO = 'bang9/catcher';
+const MAX_BYTES = 64 * 1024 * 1024;
+
+// process.platform-process.arch → release target. Linux builds are static (musl) and run on any distribution.
+const TARGETS = {
+  'darwin-arm64': 'aarch64-apple-darwin',
+  'darwin-x64': 'x86_64-apple-darwin',
+  'linux-arm64': 'aarch64-unknown-linux-musl',
+  'linux-x64': 'x86_64-unknown-linux-musl',
+  'win32-arm64': 'x86_64-pc-windows-msvc',
+  'win32-x64': 'x86_64-pc-windows-msvc',
+};
+
+const fail = (message) => {
+  process.stderr.write(`catcher-cli: ${message}\n`);
+  process.exit(1);
+};
+
+const readJson = (name) => JSON.parse(readFileSync(new URL(`../${name}`, import.meta.url), 'utf8'));
+
+const sha256 = (bytes) => createHash('sha256').update(bytes).digest('hex');
+
+function assetName() {
+  const target = TARGETS[`${process.platform}-${process.arch}`];
+  if (!target) {
+    fail(`no catcher build for ${process.platform}/${process.arch}. See https://github.com/${REPO}/releases`);
+  }
+  if (process.platform === 'win32') return `catcher-${target}.exe`;
+  return `catcher-${target}`;
+}
+
+async function download(url) {
+  const res = await fetch(url, { redirect: 'follow' });
+  if (!res.ok) fail(`download failed (${res.status}): ${url}`);
+  const bytes = Buffer.from(await res.arrayBuffer());
+  if (bytes.length > MAX_BYTES) fail(`download is unexpectedly large: ${url}`);
+  return bytes;
+}
+
+async function ensureBinary(version, asset) {
+  const home = process.env.CATCHER_HOME || join(homedir(), '.catcher');
+  const dir = join(home, 'bin', version);
+  let file = join(dir, 'catcher');
+  if (process.platform === 'win32') file = join(dir, 'catcher.exe');
+  if (existsSync(file)) return file;
+
+  let checksums;
+  try {
+    checksums = readJson('checksums.json');
+  } catch {
+    fail('this package has no checksums.json; install a released version: npm i -g catcher-cli');
+  }
+  const expected = checksums[asset];
+  if (!/^[0-9a-f]{64}$/.test(expected || '')) fail(`no checksum for ${asset} in this release`);
+
+  const url = `https://github.com/${REPO}/releases/download/cli-v${version}/${asset}`;
+  process.stderr.write(`catcher-cli: downloading catcher ${version} (${asset}), first run only\n`);
+  const bytes = await download(url);
+  const actual = sha256(bytes);
+  if (actual !== expected)
+    fail(`checksum mismatch for ${asset}: expected ${expected}, got ${actual}. Nothing was saved.`);
+
+  // write to a private temp name, then rename: two first runs at once never see a half-written binary
+  mkdirSync(dir, { recursive: true });
+  const tmp = `${file}.${process.pid}.tmp`;
+  writeFileSync(tmp, bytes, { mode: 0o755 });
+  chmodSync(tmp, 0o755);
+  try {
+    renameSync(tmp, file);
+  } catch (e) {
+    rmSync(tmp, { force: true });
+    if (!existsSync(file)) throw e;
+  }
+  return file;
+}
+
+function run(file) {
+  const child = spawn(file, process.argv.slice(2), { stdio: 'inherit' });
+  const forward = (signal) => {
+    if (child.exitCode === null) child.kill(signal);
+  };
+  const signals = ['SIGINT', 'SIGTERM', 'SIGHUP'];
+  for (const s of signals) process.on(s, forward);
+  child.on('error', (e) => fail(`could not run ${file}: ${e.message}`));
+  child.on('exit', (code, signal) => {
+    if (signal) {
+      // die the same way the binary did, so callers see the real signal
+      for (const s of signals) process.removeListener(s, forward);
+      process.kill(process.pid, signal);
+      return;
+    }
+    process.exit(code ?? 1);
+  });
+}
+
+const { version } = readJson('package.json');
+let binary = '';
+try {
+  binary = await ensureBinary(version, assetName());
+} catch (e) {
+  fail(`could not get the catcher binary: ${e.message}`);
+}
+run(binary);

package/checksums.json

@@ -0,0 +1,7 @@
+{
+  "catcher-aarch64-apple-darwin": "b7cc470c5e85c86b657a5a7da516e175ef3f0b1679a6ce6e654f48ece565a6eb",
+  "catcher-x86_64-apple-darwin": "385abc4a4028862da23d664df4a524fec88b6afb16896052bf1110bfbddf0d58",
+  "catcher-aarch64-unknown-linux-musl": "32d25c797de2174e19acb9bd7b2c7d64b99b980b5a71a52f38ac89353e110c27",
+  "catcher-x86_64-unknown-linux-musl": "3f73100696ce37bdfb8d7c1ebce332062c44a3e4aa5e59c3e4a949d0f6be8b45",
+  "catcher-x86_64-pc-windows-msvc.exe": "ac54116d10a0660a2b679cdc714e3bdc71207540a282a17cce5777683afec95e"
+}

package/package.json

@@ -1,32 +1,33 @@
 {
   "name": "catcher-cli",
-  "version": "0.1.1",
-  "description": "catcher CLI — connect AI agents to their owner and to each other. End-to-end encrypted asks, approvals, OTP hand-off, and agent-to-agent messages.",
+  "version": "0.2.0",
+  "description": "catcher CLI — connect AI agents to their owner's phone and to each other. End-to-end encrypted asks, approvals, OTP hand-off and agent-to-agent messages.",
   "keywords": [
     "agent-to-agent",
     "ai-agents",
     "claude-code",
     "codex",
-    "e2e-encryption",
-    "mcp"
+    "e2e-encryption"
   ],
-  "homepage": "https://github.com/bang9/catcher#readme",
+  "homepage": "https://catcher.bang9.dev",
+  "bugs": "https://github.com/bang9/catcher/issues",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/bang9/catcher.git",
-    "directory": "apps/cli"
+    "directory": "npm/catcher-cli"
   },
   "bin": {
-    "catcher": "dist/catcher.mjs"
+    "catcher": "bin/catcher.js"
   },
   "files": [
-    "dist/catcher.mjs",
+    "bin/catcher.js",
+    "checksums.json",
     "README.md",
     "LICENSE"
   ],
   "type": "module",
   "engines": {
-    "node": ">=22"
+    "node": ">=20"
   }
 }