codo-ai 2.23.12 → 2.23.14

package/README.md

@@ -100,6 +100,8 @@ npx codo-ai
 
 Requirements: Node 18+ or Bun · macOS / Linux / Windows · any provider API key (Anthropic, OpenAI, NVIDIA free tier, Google, or OpenAI-compatible).
 
+> No extra flags needed: the install works out of the box even when install scripts are blocked (`allowScripts` policies, `--ignore-scripts`), because the launcher resolves the prebuilt platform binary automatically on first run.
+
 > Migrating from `@codo-ai/cli`? That package is deprecated — `codo-ai` replaces it.
 
 ## Documentation

package/bin/codo.js

@@ -0,0 +1,307 @@
+#!/usr/bin/env node
+
+const childProcess = require("child_process")
+const fs = require("fs")
+const path = require("path")
+const os = require("os")
+
+const forwardedSignals = ["SIGINT", "SIGTERM", "SIGHUP"]
+
+function run(target) {
+  const child = childProcess.spawn(target, process.argv.slice(2), {
+    stdio: "inherit",
+  })
+
+  child.on("error", (error) => {
+    console.error(error.message)
+    process.exit(1)
+  })
+
+  const forwarders = {}
+  for (const signal of forwardedSignals) {
+    forwarders[signal] = () => {
+      try {
+        child.kill(signal)
+      } catch {
+        // The child may have already exited.
+      }
+    }
+    process.on(signal, forwarders[signal])
+  }
+
+  child.on("exit", (code, signal) => {
+    for (const forwardedSignal of forwardedSignals) {
+      process.removeListener(forwardedSignal, forwarders[forwardedSignal])
+    }
+
+    if (signal) {
+      process.kill(process.pid, signal)
+      return
+    }
+
+    process.exit(typeof code === "number" ? code : 0)
+  })
+}
+
+const envPath = process.env.CODO_BIN_PATH
+
+const scriptPath = fs.realpathSync(__filename)
+const scriptDir = path.dirname(scriptPath)
+
+const platformMap = {
+  darwin: "darwin",
+  linux: "linux",
+  win32: "windows",
+}
+const archMap = {
+  x64: "x64",
+  arm64: "arm64",
+  arm: "arm",
+}
+
+let platform = platformMap[os.platform()]
+if (!platform) {
+  platform = os.platform()
+}
+let arch = archMap[os.arch()]
+if (!arch) {
+  arch = os.arch()
+}
+const base = "codo-" + platform + "-" + arch
+const binary = platform === "windows" ? "codo.exe" : "codo"
+
+function supportsAvx2() {
+  if (arch !== "x64") return false
+
+  if (platform === "linux") {
+    try {
+      return /(^|\s)avx2(\s|$)/i.test(fs.readFileSync("/proc/cpuinfo", "utf8"))
+    } catch {
+      return false
+    }
+  }
+
+  if (platform === "darwin") {
+    try {
+      const result = childProcess.spawnSync("sysctl", ["-n", "hw.optional.avx2_0"], {
+        encoding: "utf8",
+        timeout: 1500,
+      })
+      if (result.status !== 0) return false
+      return (result.stdout || "").trim() === "1"
+    } catch {
+      return false
+    }
+  }
+
+  if (platform === "windows") {
+    const cmd =
+      '(Add-Type -MemberDefinition "[DllImport(""kernel32.dll"")] public static extern bool IsProcessorFeaturePresent(int ProcessorFeature);" -Name Kernel32 -Namespace Win32 -PassThru)::IsProcessorFeaturePresent(40)'
+
+    for (const exe of ["powershell.exe", "pwsh.exe", "pwsh", "powershell"]) {
+      try {
+        const result = childProcess.spawnSync(exe, ["-NoProfile", "-NonInteractive", "-Command", cmd], {
+          encoding: "utf8",
+          timeout: 3000,
+          windowsHide: true,
+        })
+        if (result.status !== 0) continue
+        const out = (result.stdout || "").trim().toLowerCase()
+        if (out === "true" || out === "1") return true
+        if (out === "false" || out === "0") return false
+      } catch {
+        continue
+      }
+    }
+
+    return false
+  }
+
+  return false
+}
+
+const names = (() => {
+  const avx2 = supportsAvx2()
+  const baseline = arch === "x64" && !avx2
+
+  if (platform === "linux") {
+    const musl = (() => {
+      try {
+        if (fs.existsSync("/etc/alpine-release")) return true
+      } catch {
+        // ignore
+      }
+
+      try {
+        const result = childProcess.spawnSync("ldd", ["--version"], { encoding: "utf8" })
+        const text = ((result.stdout || "") + (result.stderr || "")).toLowerCase()
+        if (text.includes("musl")) return true
+      } catch {
+        // ignore
+      }
+
+      return false
+    })()
+
+    if (musl) {
+      if (arch === "x64") {
+        if (baseline) return [`${base}-baseline-musl`, `${base}-musl`, `${base}-baseline`, base]
+        return [`${base}-musl`, `${base}-baseline-musl`, base, `${base}-baseline`]
+      }
+      return [`${base}-musl`, base]
+    }
+
+    if (arch === "x64") {
+      if (baseline) return [`${base}-baseline`, base, `${base}-baseline-musl`, `${base}-musl`]
+      return [base, `${base}-baseline`, `${base}-musl`, `${base}-baseline-musl`]
+    }
+    return [base, `${base}-musl`]
+  }
+
+  if (arch === "x64") {
+    if (baseline) return [`${base}-baseline`, base]
+    return [base, `${base}-baseline`]
+  }
+  return [base]
+})()
+
+// Published platform packages name the binary with a version suffix
+// ("codo-2.23.12" / "codo-2.23.12.exe"), so resolve by pattern rather than
+// by a single hardcoded filename. Prefer an exact (unsuffixed) match so a
+// binary staged by postinstall wins over a stale suffixed one.
+function findBinaryIn(packageDir) {
+  let entries
+  try {
+    entries = fs.readdirSync(path.join(packageDir, "bin"))
+  } catch {
+    return undefined
+  }
+  if (entries.includes(binary)) return path.join(packageDir, "bin", binary)
+  const suffix = platform === "windows" ? ".exe" : ""
+  const match = entries
+    .filter((entry) => entry.startsWith("codo-") && (suffix === "" ? !entry.endsWith(".exe") : entry.endsWith(suffix)))
+    .sort()
+    .at(-1)
+  if (!match) return undefined
+  return path.join(packageDir, "bin", match)
+}
+
+function findBinary(startDir) {
+  let current = startDir
+  for (;;) {
+    const modules = path.join(current, "node_modules")
+    if (fs.existsSync(modules)) {
+      for (const name of names) {
+        const candidate = findBinaryIn(path.join(modules, `@codo-ai/${name}`))
+        if (candidate && fs.existsSync(candidate)) return candidate
+      }
+    }
+    const parent = path.dirname(current)
+    if (parent === current) {
+      return
+    }
+    current = parent
+  }
+}
+
+// A fetched binary is staged next to this launcher so it can be found
+// without walking node_modules on later runs.
+const stagedName = platform === "windows" ? "codo.exe" : "codo"
+const staged = path.join(scriptDir, stagedName)
+const stagedBinary = (() => {
+  try {
+    if (fs.existsSync(staged)) return staged
+  } catch {
+    // ignore
+  }
+  return undefined
+})()
+
+const wrapperPkg = (() => {
+  try {
+    return JSON.parse(fs.readFileSync(path.join(scriptDir, "..", "package.json"), "utf8"))
+  } catch {
+    return {}
+  }
+})()
+
+// Last resort: download the platform package on demand with npm and stage
+// its binary next to this launcher. Runs only when the package manager
+// skipped the optional platform packages at install time.
+function fetchBinary() {
+  const deps = wrapperPkg.optionalDependencies || {}
+  for (const name of names) {
+    const scoped = `@codo-ai/${name}`
+    const version = deps[scoped]
+    if (!version) continue
+    let tmp
+    try {
+      tmp = fs.mkdtempSync(path.join(os.tmpdir(), "codo-bin-"))
+    } catch {
+      continue
+    }
+    try {
+      // `npm` is a shell script on Windows, so plain spawn fails with
+      // ENOENT. Prefer node + npm-cli.js (no shell, no quoting hazards);
+      // fall back to a shell spawn only when the CLI file is missing.
+      let cmd = "npm"
+      const args = ["install", "--ignore-scripts", "--no-save", "--loglevel=error", "--prefix", tmp, `${scoped}@${version}`]
+      const opts = { encoding: "utf8", timeout: 300000, windowsHide: true }
+      if (process.platform === "win32") {
+        const cli = path.join(path.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js")
+        let cliExists = false
+        try {
+          cliExists = fs.existsSync(cli)
+        } catch {
+          cliExists = false
+        }
+        if (cliExists) {
+          cmd = process.execPath
+          args.unshift(cli)
+        } else {
+          opts.shell = true
+        }
+      }
+      const result = childProcess.spawnSync(cmd, args, opts)
+      if (result.status !== 0) continue
+      const found = findBinaryIn(path.join(tmp, "node_modules", scoped))
+      if (!found) continue
+      try {
+        if (!fs.existsSync(found)) continue
+      } catch {
+        continue
+      }
+      try {
+        fs.copyFileSync(found, staged)
+        try {
+          fs.chmodSync(staged, 0o755)
+        } catch {
+          // chmod is best-effort on Windows.
+        }
+        return staged
+      } catch {
+        return found
+      }
+    } catch {
+      continue
+    } finally {
+      try {
+        fs.rmSync(tmp, { recursive: true, force: true })
+      } catch {
+        // ignore
+      }
+    }
+  }
+  return undefined
+}
+
+const resolved = envPath || stagedBinary || findBinary(scriptDir) || fetchBinary()
+if (!resolved) {
+  console.error(
+    "Could not find the codo native binary. Your package manager may have skipped the optional platform packages. Try installing manually: " +
+      names.map((n) => `"@codo-ai/${n}"`).join(" or "),
+  )
+  process.exit(1)
+}
+
+run(resolved)

package/package.json

@@ -3,7 +3,9 @@
   "description": "The security-native AI coding agent. Six Sec-Test security personas, compliance-first /scraper, a business documents & research suite, and multi-agent Compose orchestration — spec-driven workflow engines in one terminal-first CLI.",
   "keywords": [
     "ai",
+    "ai-agent",
     "coding-agent",
+    "coding-assistant",
     "cli",
     "terminal",
     "tui",
@@ -16,8 +18,14 @@
     "pentest",
     "spec-driven",
     "multi-agent",
+    "autonomous",
+    "mcp",
+    "devtools",
     "opencode"
   ],
+  "engines": {
+    "node": ">=18"
+  },
   "homepage": "https://codo-ai.vercel.app/",
   "repository": {
     "type": "git",
@@ -27,12 +35,9 @@
     "url": "https://github.com/Mosalah4351/COdo/issues"
   },
   "bin": {
-    "codo": "./bin/codo"
-  },
-  "scripts": {
-    "postinstall": "node ./postinstall.mjs"
+    "codo": "./bin/codo.js"
   },
-  "version": "2.23.12",
+  "version": "2.23.14",
   "license": "MIT",
   "os": [
     "darwin",
@@ -44,17 +49,17 @@
     "x64"
   ],
   "optionalDependencies": {
-    "@codo-ai/codo-windows-x64-baseline": "2.23.12",
-    "@codo-ai/codo-windows-x64": "2.23.12",
-    "@codo-ai/codo-windows-arm64": "2.23.12",
-    "@codo-ai/codo-linux-x64-musl": "2.23.12",
-    "@codo-ai/codo-linux-x64-baseline-musl": "2.23.12",
-    "@codo-ai/codo-linux-x64-baseline": "2.23.12",
-    "@codo-ai/codo-linux-x64": "2.23.12",
-    "@codo-ai/codo-linux-arm64-musl": "2.23.12",
-    "@codo-ai/codo-linux-arm64": "2.23.12",
-    "@codo-ai/codo-darwin-x64-baseline": "2.23.12",
-    "@codo-ai/codo-darwin-x64": "2.23.12",
-    "@codo-ai/codo-darwin-arm64": "2.23.12"
+    "@codo-ai/codo-windows-x64-baseline": "2.23.14",
+    "@codo-ai/codo-windows-x64": "2.23.14",
+    "@codo-ai/codo-windows-arm64": "2.23.14",
+    "@codo-ai/codo-linux-x64-musl": "2.23.14",
+    "@codo-ai/codo-linux-x64-baseline-musl": "2.23.14",
+    "@codo-ai/codo-linux-x64-baseline": "2.23.14",
+    "@codo-ai/codo-linux-x64": "2.23.14",
+    "@codo-ai/codo-linux-arm64-musl": "2.23.14",
+    "@codo-ai/codo-linux-arm64": "2.23.14",
+    "@codo-ai/codo-darwin-x64-baseline": "2.23.14",
+    "@codo-ai/codo-darwin-x64": "2.23.14",
+    "@codo-ai/codo-darwin-arm64": "2.23.14"
   }
-}
+}

package/bin/codo

@@ -1,10 +0,0 @@
-echo "Error: codo-ai's postinstall script was not run." >&2
-echo "" >&2
-echo "This occurs when using --ignore-scripts during installation, or when using a" >&2
-echo "package manager like pnpm that does not run postinstall scripts by default." >&2
-echo "" >&2
-echo "To fix this, run the postinstall script manually:" >&2
-echo "  cd node_modules/codo-ai && node postinstall.mjs" >&2
-echo "" >&2
-echo "Or reinstall codo-ai without the --ignore-scripts flag." >&2
-exit 1

package/postinstall.mjs

@@ -1,205 +0,0 @@
-#!/usr/bin/env node
-
-import childProcess from "child_process"
-import fs from "fs"
-import os from "os"
-import path from "path"
-import { createRequire } from "module"
-import { fileURLToPath } from "url"
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url))
-const require = createRequire(import.meta.url)
-const packageJson = JSON.parse(fs.readFileSync(path.join(__dirname, "package.json"), "utf8"))
-
-const platformMap = {
-  darwin: "darwin",
-  linux: "linux",
-  win32: "windows",
-}
-const archMap = {
-  x64: "x64",
-  arm64: "arm64",
-  arm: "arm",
-}
-
-const platform = platformMap[os.platform()] ?? os.platform()
-const arch = archMap[os.arch()] ?? os.arch()
-const base = `codo-${platform}-${arch}`
-const sourceBinary = platform === "windows" ? "codo.exe" : "codo"
-const targetBinary = path.join(__dirname, "bin", "codo.exe")
-
-function supportsAvx2() {
-  if (arch !== "x64") return false
-
-  if (platform === "linux") {
-    try {
-      return /(^|\s)avx2(\s|$)/i.test(fs.readFileSync("/proc/cpuinfo", "utf8"))
-    } catch {
-      return false
-    }
-  }
-
-  if (platform === "darwin") {
-    try {
-      const result = childProcess.spawnSync("sysctl", ["-n", "hw.optional.avx2_0"], {
-        encoding: "utf8",
-        timeout: 1500,
-      })
-      if (result.status !== 0) return false
-      return (result.stdout || "").trim() === "1"
-    } catch {
-      return false
-    }
-  }
-
-  if (platform === "windows") {
-    const command =
-      '(Add-Type -MemberDefinition "[DllImport(""kernel32.dll"")] public static extern bool IsProcessorFeaturePresent(int ProcessorFeature);" -Name Kernel32 -Namespace Win32 -PassThru)::IsProcessorFeaturePresent(40)'
-
-    for (const executable of ["powershell.exe", "pwsh.exe", "pwsh", "powershell"]) {
-      try {
-        const result = childProcess.spawnSync(executable, ["-NoProfile", "-NonInteractive", "-Command", command], {
-          encoding: "utf8",
-          timeout: 3000,
-          windowsHide: true,
-        })
-        if (result.status !== 0) continue
-        const output = (result.stdout || "").trim().toLowerCase()
-        if (output === "true" || output === "1") return true
-        if (output === "false" || output === "0") return false
-      } catch {
-        continue
-      }
-    }
-  }
-
-  return false
-}
-
-function isMusl() {
-  if (platform !== "linux") return false
-
-  try {
-    if (fs.existsSync("/etc/alpine-release")) return true
-  } catch {
-    // Ignore filesystem probes that are blocked by the host.
-  }
-
-  try {
-    const result = childProcess.spawnSync("ldd", ["--version"], { encoding: "utf8" })
-    return `${result.stdout || ""}${result.stderr || ""}`.toLowerCase().includes("musl")
-  } catch {
-    return false
-  }
-}
-
-function packageNames() {
-  const baseline = arch === "x64" && !supportsAvx2()
-
-  if (platform === "linux") {
-    if (isMusl()) {
-      if (arch === "x64")
-        return baseline
-          ? [`${base}-baseline-musl`, `${base}-musl`, `${base}-baseline`, base]
-          : [`${base}-musl`, `${base}-baseline-musl`, base, `${base}-baseline`]
-      return [`${base}-musl`, base]
-    }
-
-    if (arch === "x64")
-      return baseline
-        ? [`${base}-baseline`, base, `${base}-baseline-musl`, `${base}-musl`]
-        : [base, `${base}-baseline`, `${base}-musl`, `${base}-baseline-musl`]
-    return [base, `${base}-musl`]
-  }
-
-  if (arch === "x64") return baseline ? [`${base}-baseline`, base] : [base, `${base}-baseline`]
-  return [base]
-}
-
-// Published packages may name the binary exactly ("codo.exe" / "codo") or with
-// a version suffix ("codo-2.23.5.exe"), so resolve by pattern rather than by
-// a single hardcoded filename.
-function findBinary(dir) {
-  const entries = fs.readdirSync(path.join(dir, "bin"))
-  const match =
-    entries.find((entry) => entry === sourceBinary) ??
-    (platform === "windows"
-      ? entries.find((entry) => entry.startsWith("codo") && entry.endsWith(".exe"))
-      : undefined) ??
-    entries.find((entry) => entry.startsWith("codo"))
-  if (!match) throw new Error(`Binary not found in ${path.join(dir, "bin")}`)
-  return path.join(dir, "bin", match)
-}
-
-// Platform binaries live in scoped packages (@codo-ai/codo-<platform>-<arch>),
-// while packageNames() works with the unscoped suffix.
-const scope = "@codo-ai/"
-
-function resolveBinary(name) {
-  return findBinary(path.dirname(require.resolve(`${scope}${name}/package.json`)))
-}
-
-function installPackage(name) {
-  const version = packageJson.optionalDependencies?.[`${scope}${name}`]
-  if (!version) return
-
-  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "codo-install-"))
-  try {
-    const result = childProcess.spawnSync(
-      "npm",
-      ["install", "--ignore-scripts", "--no-save", "--loglevel=error", "--prefix", temp, `${scope}${name}@${version}`],
-      { stdio: "inherit", windowsHide: true },
-    )
-    if (result.status !== 0) return
-    const packageDir = path.join(temp, "node_modules", scope, name)
-    copyBinary(findBinary(packageDir), targetBinary)
-    return true
-  } finally {
-    fs.rmSync(temp, { recursive: true, force: true })
-  }
-}
-
-function copyBinary(source, target) {
-  if (!fs.existsSync(source)) throw new Error(`Binary not found at ${source}`)
-  fs.mkdirSync(path.dirname(target), { recursive: true })
-  if (fs.existsSync(target)) fs.unlinkSync(target)
-  try {
-    fs.linkSync(source, target)
-  } catch {
-    fs.copyFileSync(source, target)
-  }
-  fs.chmodSync(target, 0o755)
-}
-
-function verifyBinary() {
-  const result = childProcess.spawnSync(targetBinary, ["--version"], {
-    encoding: "utf8",
-    stdio: "ignore",
-    windowsHide: true,
-  })
-  return result.status === 0
-}
-
-function main() {
-  for (const name of packageNames()) {
-    try {
-      copyBinary(resolveBinary(name), targetBinary)
-      if (verifyBinary()) return
-    } catch {
-      if (installPackage(name) && verifyBinary()) return
-    }
-  }
-
-  throw new Error(
-    `It seems your package manager failed to install the right codo CLI package. Try manually installing ${packageNames()
-      .map((name) => JSON.stringify(`@codo-ai/${name}`))
-      .join(" or ")}.`,
-  )
-}
-
-try {
-  main()
-} catch (error) {
-  console.error(error.message)
-  process.exit(1)
-}