create-egregore 0.21.0-runtime-mvp.5 → 0.21.0-runtime-mvp.6

package/assets/egregore-launcher.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// egregore-launcher-version: 0.21.0-runtime-mvp.5
+// egregore-launcher-version: 0.21.0-runtime-mvp.6
 //
 // egregore — launch and browse Egregore instances from your terminal.
 // Installed by create-egregore. Reads ~/.egregore/instances.json.
@@ -35,7 +35,7 @@ const crypto = require("node:crypto");
 const { spawnSync, spawn } = require("node:child_process");
 const readline = require("node:readline");
 
-const VERSION = "0.21.0-runtime-mvp.5";
+const VERSION = "0.21.0-runtime-mvp.6";
 const REGISTRY = path.join(os.homedir(), ".egregore", "instances.json");
 const DEFAULT_FILE = path.join(os.homedir(), ".egregore", "default");
 const UPDATE_CACHE_FILE = path.join(os.homedir(), ".egregore", "update-check.json");
@@ -2564,6 +2564,54 @@ async function fetchRuntimeMvpCandidate() {
   }
 }
 
+// Fetch the published candidate tarball from the npm registry and verify its
+// integrity before staging. The first-timer path: `p prepare` with nothing
+// staged must not dead-end into a CLI instruction referencing a tarball the
+// user does not have — the registry has it, digest-verified.
+function fetchCandidateTarball(version, cb) {
+  const metaUrl = new URL(`https://registry.npmjs.org/${PUBLIC_NPX_PACKAGE}/${version}`);
+  requestJson({
+    hostname: metaUrl.hostname,
+    path: metaUrl.pathname,
+    method: "GET",
+    protocol: metaUrl.protocol,
+    timeoutMs: 10000,
+    headers: { Accept: "application/json" },
+  }).then((meta) => {
+    const dist = meta && meta.status === 200 && meta.data && meta.data.dist;
+    if (!dist || !dist.tarball) return cb(new Error(`candidate ${version} not found on the registry`));
+    const dest = path.join(os.tmpdir(), `egregore-candidate-${version}.tgz`);
+    const fetchTarball = (url, redirects) => {
+      https.get(url, { headers: { "User-Agent": "egregore-launcher" } }, (res) => {
+        if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location && redirects > 0) {
+          res.resume();
+          return fetchTarball(res.headers.location, redirects - 1);
+        }
+        if (res.statusCode !== 200) {
+          res.resume();
+          return cb(new Error(`tarball download failed (HTTP ${res.statusCode})`));
+        }
+        const hash = crypto.createHash("sha512");
+        const out = fs.createWriteStream(dest);
+        res.on("data", (d) => hash.update(d));
+        res.pipe(out);
+        out.on("finish", () => {
+          out.close(() => {
+            const digest = `sha512-${hash.digest("base64")}`;
+            if (dist.integrity && digest !== dist.integrity) {
+              fs.rmSync(dest, { force: true });
+              return cb(new Error("candidate integrity mismatch — refusing to stage"));
+            }
+            cb(null, dest);
+          });
+        });
+        out.on("error", (err) => cb(err));
+      }).on("error", (err) => cb(err));
+    };
+    fetchTarball(dist.tarball, 3);
+  }).catch((err) => cb(err));
+}
+
 const UPGRADE_STATUS_LABEL = {
   none: "no update staged",
   pending: "staged, not started",
@@ -3784,8 +3832,36 @@ async function browser(args = {}) {
             && !["none", "cancelled", "rolled-back"].includes(status)
             && state.upgradeData.candidate_version;
           if (!staged) {
-            state.upgradeNotice = `${DIM}Stage a candidate package first: egregore settings ${state.upgradeInst.slug} runtime init <version> <candidate.tgz>${RESET}`;
-            render(); return;
+            const candidate = state.upgradeCandidate;
+            if (!candidate) {
+              state.upgradeNotice = `${DIM}No published candidate found. Stage one manually: egregore settings ${state.upgradeInst.slug} runtime init --candidate <version> --tarball <candidate.tgz>${RESET}`;
+              render(); return;
+            }
+            if (state.upgradeFetching) { render(); return; }
+            state.upgradeFetching = true;
+            const inst = state.upgradeInst;
+            state.upgradeNotice = `${DIM}Downloading ${candidate} from npm…${RESET}`;
+            render();
+            fetchCandidateTarball(candidate, (err, tgz) => {
+              state.upgradeFetching = false;
+              if (!state.upgradeInst || state.upgradeInst !== inst) return;
+              if (err) {
+                state.upgradeNotice = `${YELLOW}${err.message}${RESET}`;
+                render(); return;
+              }
+              const r = runUpgrade(inst, ["init", "--candidate", candidate, "--tarball", tgz]);
+              if (r === null || r.status !== 0) {
+                const detail = ((r && (r.stderr || r.stdout)) || "staging failed").trim().split("\n")[0];
+                state.upgradeNotice = `${YELLOW}${detail}${RESET}`;
+                render(); return;
+              }
+              refreshUpgrade();
+              state.upgradeData = upgradeStatus(inst) || state.upgradeData;
+              state.upgradeNotice = "";
+              state.upgradeMode = "confirm-prepare";
+              render();
+            });
+            return;
           }
           state.upgradeMode = "confirm-prepare"; render(); return;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.21.0-runtime-mvp.5",
+  "version": "0.21.0-runtime-mvp.6",
   "description": "Set up Egregore for your team in one command — installs the egregore launcher and your choice of Claude Code, Codex, or Pi.",
   "license": "MIT",
   "bin": {