create-egregore 0.21.0-runtime-mvp.4 → 0.21.0-runtime-mvp.6

package/assets/egregore-launcher.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// egregore-launcher-version: 0.21.0-runtime-mvp.4
+// egregore-launcher-version: 0.21.0-runtime-mvp.6
 //
 // egregore — launch and browse Egregore instances from your terminal.
 // Installed by create-egregore. Reads ~/.egregore/instances.json.
@@ -35,7 +35,7 @@ const crypto = require("node:crypto");
 const { spawnSync, spawn } = require("node:child_process");
 const readline = require("node:readline");
 
-const VERSION = "0.21.0-runtime-mvp.4";
+const VERSION = "0.21.0-runtime-mvp.6";
 const REGISTRY = path.join(os.homedir(), ".egregore", "instances.json");
 const DEFAULT_FILE = path.join(os.homedir(), ".egregore", "default");
 const UPDATE_CACHE_FILE = path.join(os.homedir(), ".egregore", "update-check.json");
@@ -2564,6 +2564,54 @@ async function fetchRuntimeMvpCandidate() {
   }
 }
 
+// Fetch the published candidate tarball from the npm registry and verify its
+// integrity before staging. The first-timer path: `p prepare` with nothing
+// staged must not dead-end into a CLI instruction referencing a tarball the
+// user does not have — the registry has it, digest-verified.
+function fetchCandidateTarball(version, cb) {
+  const metaUrl = new URL(`https://registry.npmjs.org/${PUBLIC_NPX_PACKAGE}/${version}`);
+  requestJson({
+    hostname: metaUrl.hostname,
+    path: metaUrl.pathname,
+    method: "GET",
+    protocol: metaUrl.protocol,
+    timeoutMs: 10000,
+    headers: { Accept: "application/json" },
+  }).then((meta) => {
+    const dist = meta && meta.status === 200 && meta.data && meta.data.dist;
+    if (!dist || !dist.tarball) return cb(new Error(`candidate ${version} not found on the registry`));
+    const dest = path.join(os.tmpdir(), `egregore-candidate-${version}.tgz`);
+    const fetchTarball = (url, redirects) => {
+      https.get(url, { headers: { "User-Agent": "egregore-launcher" } }, (res) => {
+        if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location && redirects > 0) {
+          res.resume();
+          return fetchTarball(res.headers.location, redirects - 1);
+        }
+        if (res.statusCode !== 200) {
+          res.resume();
+          return cb(new Error(`tarball download failed (HTTP ${res.statusCode})`));
+        }
+        const hash = crypto.createHash("sha512");
+        const out = fs.createWriteStream(dest);
+        res.on("data", (d) => hash.update(d));
+        res.pipe(out);
+        out.on("finish", () => {
+          out.close(() => {
+            const digest = `sha512-${hash.digest("base64")}`;
+            if (dist.integrity && digest !== dist.integrity) {
+              fs.rmSync(dest, { force: true });
+              return cb(new Error("candidate integrity mismatch — refusing to stage"));
+            }
+            cb(null, dest);
+          });
+        });
+        out.on("error", (err) => cb(err));
+      }).on("error", (err) => cb(err));
+    };
+    fetchTarball(dist.tarball, 3);
+  }).catch((err) => cb(err));
+}
+
 const UPGRADE_STATUS_LABEL = {
   none: "no update staged",
   pending: "staged, not started",
@@ -2576,6 +2624,26 @@ const UPGRADE_STATUS_LABEL = {
   "rolled-back": "rolled back",
 };
 
+// Settings-row truth for the Runtime update line. The row must say outright
+// whether this egregore runs the new Runtime — "no update staged" is
+// transaction state, not the condition the user needs to see.
+function runtimeUpdateRowValue(st, candidate) {
+  if (st === undefined) return `${DIM}checking…${RESET}`;
+  if (st === null) return `${DIM}unavailable${RESET}`;
+  if (st.status === "active") {
+    const v = st.active_version || "?";
+    if (candidate && candidate !== v) return `${v} active ${YELLOW}· update available ${candidate}${RESET}`;
+    return `${GREEN}${v} active${RESET}${candidate ? `${DIM} · up to date${RESET}` : ""}`;
+  }
+  if (st.status === "ready-to-activate") return `${GREEN}${upgradeSummary(st)}${RESET}`;
+  if (st.status === "failed" || st.status === "interrupted") return `${YELLOW}${upgradeSummary(st)}${RESET}`;
+  if (st.status === "preparing" || st.status === "pending") return `${DIM}${upgradeSummary(st)}${RESET}`;
+  // No activation record (or cancelled/rolled back): this egregore is not on
+  // the new Runtime. Say so, and name the candidate when we know it.
+  const base = `${YELLOW}not updated to the new Runtime${RESET}`;
+  return candidate ? `${base}${DIM} · ${candidate} available${RESET}` : base;
+}
+
 function upgradeSummary(st) {
   // "none" means no activation record — a first-time state, not freshness.
   if (!st || st.status === "none") return "no update staged";
@@ -3086,7 +3154,7 @@ function renderUpgradePanel({ inst, data, candidate, retrieval, mode, notice, wi
   return lines;
 }
 
-function renderSettingsPanel({ inst, data, cursor, view, domain, items, listCursor, mode, input, notice, width, upgrade, retrieval }) {
+function renderSettingsPanel({ inst, data, cursor, view, domain, items, listCursor, mode, input, notice, width, upgrade, retrieval, candidate }) {
   const title = inst.slug || inst.name || path.basename(inst.path);
   const outerWidth = Math.min(Math.max(50, width - 2), 126);
   const innerWidth = Math.max(48, outerWidth - 2);
@@ -3231,15 +3299,7 @@ function renderSettingsPanel({ inst, data, cursor, view, domain, items, listCurs
       lines.push(boxLine(`${DIM}↑↓ nav · ${RESET}${BOLD}a${RESET}${DIM} add · ${RESET}${BOLD}d${RESET}${DIM} delete · ← back · q quit${RESET}`, innerWidth, margin));
     }
   } else {
-    const upgradeValue = upgrade === undefined
-      ? `${DIM}checking…${RESET}`
-      : upgrade === null
-        ? `${DIM}unavailable${RESET}`
-        : upgrade.status === "ready-to-activate"
-          ? `${GREEN}${upgradeSummary(upgrade)}${RESET}`
-          : upgrade.status === "failed" || upgrade.status === "interrupted"
-            ? `${YELLOW}${upgradeSummary(upgrade)}${RESET}`
-            : `${DIM}${upgradeSummary(upgrade)}${RESET}`;
+    const upgradeValue = runtimeUpdateRowValue(upgrade, candidate);
     const rows = [
       {
         name: "Runtime update",
@@ -3427,6 +3487,7 @@ async function browser(args = {}) {
         width: w,
         upgrade: state.settingsUpgrade,
         retrieval: state.settingsRetrieval,
+        candidate: state.upgradeCandidate,
       });
       for (const line of settingsLines) out.push(line + ANSI.clearLine + "\n");
       const remainingRows = Math.max(0, h - settingsLines.length - 1);
@@ -3771,8 +3832,36 @@ async function browser(args = {}) {
             && !["none", "cancelled", "rolled-back"].includes(status)
             && state.upgradeData.candidate_version;
           if (!staged) {
-            state.upgradeNotice = `${DIM}Stage a candidate package first: egregore settings ${state.upgradeInst.slug} runtime init <version> <candidate.tgz>${RESET}`;
-            render(); return;
+            const candidate = state.upgradeCandidate;
+            if (!candidate) {
+              state.upgradeNotice = `${DIM}No published candidate found. Stage one manually: egregore settings ${state.upgradeInst.slug} runtime init --candidate <version> --tarball <candidate.tgz>${RESET}`;
+              render(); return;
+            }
+            if (state.upgradeFetching) { render(); return; }
+            state.upgradeFetching = true;
+            const inst = state.upgradeInst;
+            state.upgradeNotice = `${DIM}Downloading ${candidate} from npm…${RESET}`;
+            render();
+            fetchCandidateTarball(candidate, (err, tgz) => {
+              state.upgradeFetching = false;
+              if (!state.upgradeInst || state.upgradeInst !== inst) return;
+              if (err) {
+                state.upgradeNotice = `${YELLOW}${err.message}${RESET}`;
+                render(); return;
+              }
+              const r = runUpgrade(inst, ["init", "--candidate", candidate, "--tarball", tgz]);
+              if (r === null || r.status !== 0) {
+                const detail = ((r && (r.stderr || r.stdout)) || "staging failed").trim().split("\n")[0];
+                state.upgradeNotice = `${YELLOW}${detail}${RESET}`;
+                render(); return;
+              }
+              refreshUpgrade();
+              state.upgradeData = upgradeStatus(inst) || state.upgradeData;
+              state.upgradeNotice = "";
+              state.upgradeMode = "confirm-prepare";
+              render();
+            });
+            return;
           }
           state.upgradeMode = "confirm-prepare"; render(); return;
         }
@@ -4256,6 +4345,12 @@ async function browser(args = {}) {
           state.settingsRetrieval = health;
           if (state.settingsInst === pick && !state.upgradeInst) render();
         });
+        if (!state.upgradeCandidate) {
+          fetchRuntimeMvpCandidate().then((v) => {
+            state.upgradeCandidate = v || "";
+            if (state.settingsInst === pick && !state.upgradeInst) render();
+          });
+        }
         state.settingsNotice = "";
         render();
         return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.21.0-runtime-mvp.4",
+  "version": "0.21.0-runtime-mvp.6",
   "description": "Set up Egregore for your team in one command — installs the egregore launcher and your choice of Claude Code, Codex, or Pi.",
   "license": "MIT",
   "bin": {