crabot 0.1.3 → 0.1.4

package/README.md

@@ -8,10 +8,16 @@ Local-first AI agent runtime with a gateway, operator console, and CLI.
 the program itself needs no Bun or Node install. The package ships no install
 script; on the first `crabot` run a small launcher (running under the Node that
 npm already provides) downloads the prebuilt binary matching your platform from
-the matching GitHub release, verifies its checksum, and caches it for later runs.
+the matching GitHub release, verifies its checksum, unpacks it (the asset is
+zstd-compressed — ~16 MB to download vs ~63 MB on disk), and caches it for later
+runs. Unpacking uses `node:zlib`, so the launcher needs **Node ≥ 22.15**.
 
 Supported platforms: Linux (x64, arm64), macOS (x64, arm64), Windows (x64).
 
+If you are on an older Node, download the standalone binary for your platform
+directly from the [GitHub releases](https://github.com/gotry-io/Crabot/releases)
+(decompress the `.zst` asset) and put it on your `PATH` — it needs no Node.
+
 ## Install
 
 ```sh

package/package.json

@@ -1,11 +1,14 @@
 {
   "name": "crabot",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Local-first AI agent runtime with a gateway, operator console, and CLI.",
   "type": "module",
   "bin": {
     "crabot": "bin/crabot.mjs"
   },
+  "engines": {
+    "node": ">=22.15.0"
+  },
   "files": [
     "bin",
     "scripts",

package/scripts/install.mjs

@@ -1,13 +1,16 @@
 #!/usr/bin/env node
 // Downloads the crabot standalone binary for the host platform from the GitHub release that matches
-// this package's version, verifies its SHA-256, and caches it. Invoked by the launcher on first run
-// when the binary is not cached yet; the package ships no install script, so nothing runs at install
-// time. The binary embeds the Bun runtime, so running crabot needs no Bun or Node install.
+// this package's version, verifies its SHA-256, decompresses it, and caches it. Invoked by the
+// launcher on first run when the binary is not cached yet; the package ships no install script, so
+// nothing runs at install time. The release asset is zstd-compressed (the binary is ~63 MB raw but
+// ~16 MB compressed), so the launcher's Node must provide node:zlib zstd (Node >= 22.15, per the
+// package `engines`). The binary itself embeds the Bun runtime, so running crabot needs no runtime.
 import { createHash } from "node:crypto";
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
+import zlib from "node:zlib";
 
 const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
 const { version } = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf8"));
@@ -39,6 +42,56 @@ async function fetchBuffer(url) {
   return Buffer.from(await response.arrayBuffer());
 }
 
+function formatDownloadProgress(received, total) {
+  const mb = (bytes) => (bytes / 1_048_576).toFixed(1);
+  return total > 0
+    ? `${Math.floor((received / total) * 100)}% (${mb(received)}/${mb(total)} MB)`
+    : `${mb(received)} MB`;
+}
+
+// Fetch a URL while reporting progress to stderr: one in-place updating line on a TTY, or milestone
+// lines (every 20%) when output is redirected. The binary is the only large download, so only it
+// streams; the size only grows, so the TTY line never leaves stale characters behind.
+async function downloadWithProgress(url, label) {
+  const response = await fetch(url, { redirect: "follow" });
+  if (!response.ok) {
+    throw new Error(`request failed (${response.status}) for ${url}`);
+  }
+  if (response.body === null) {
+    return Buffer.from(await response.arrayBuffer());
+  }
+
+  const total = Number(response.headers.get("content-length")) || 0;
+  const isTty = process.stderr.isTTY === true;
+  const reader = response.body.getReader();
+  const chunks = [];
+  let received = 0;
+  let nextMilestone = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) {
+      break;
+    }
+
+    chunks.push(value);
+    received += value.length;
+    if (isTty) {
+      process.stderr.write(`\rcrabot: downloading ${label} ${formatDownloadProgress(received, total)}`);
+    } else if (total > 0 && (received / total) * 100 >= nextMilestone) {
+      process.stderr.write(`crabot: downloading ${label} ${formatDownloadProgress(received, total)}\n`);
+      nextMilestone += 20;
+    }
+  }
+
+  if (isTty) {
+    process.stderr.write("\n");
+  } else if (total === 0) {
+    process.stderr.write(`crabot: downloaded ${label} (${formatDownloadProgress(received, total)})\n`);
+  }
+
+  return Buffer.concat(chunks);
+}
+
 export async function ensureBinary() {
   const target = cachedBinaryPath();
   if (existsSync(target)) {
@@ -51,19 +104,30 @@ export async function ensureBinary() {
     throw new Error(`crabot: no prebuilt binary for ${key}. See https://github.com/${repository}/releases`);
   }
 
+  if (typeof zlib.zstdDecompressSync !== "function") {
+    throw new Error(
+      `crabot: the prebuilt binary is zstd-compressed and needs Node >= 22.15 to unpack (this is ` +
+      `${process.version}). Upgrade Node, or download the standalone binary for your platform from ` +
+      `https://github.com/${repository}/releases and put it on your PATH.`
+    );
+  }
+
   const base = `https://github.com/${repository}/releases/download/v${version}`;
-  process.stderr.write(`crabot: downloading ${asset} (v${version})...\n`);
-  const [binary, checksum] = await Promise.all([
-    fetchBuffer(`${base}/${asset}`),
-    fetchBuffer(`${base}/${asset}.sha256`).then((buffer) => buffer.toString("utf8"))
+  const [compressed, checksum] = await Promise.all([
+    downloadWithProgress(`${base}/${asset}.zst`, `${asset} (v${version})`),
+    fetchBuffer(`${base}/${asset}.zst.sha256`).then((buffer) => buffer.toString("utf8"))
   ]);
 
+  // Verify the bytes that crossed the network, then decompress (zstd's frame checksum transitively
+  // integrity-checks the result).
   const expected = checksum.trim().split(/\s+/u)[0];
-  const actual = createHash("sha256").update(binary).digest("hex");
+  const actual = createHash("sha256").update(compressed).digest("hex");
   if (expected !== actual) {
-    throw new Error(`crabot: checksum mismatch for ${asset} (expected ${expected}, got ${actual})`);
+    throw new Error(`crabot: checksum mismatch for ${asset}.zst (expected ${expected}, got ${actual})`);
   }
 
+  const binary = zlib.zstdDecompressSync(compressed);
+
   mkdirSync(dirname(target), { recursive: true });
   // Write to a sibling temp file then rename, so a concurrent install never sees a partial binary.
   const temporary = `${target}.${process.pid}.download`;