dejima 0.8.1 → 0.8.7

package/README.md

@@ -8,10 +8,11 @@ npm install -g dejima
 dejima --version
 ```
 
-On install, this package downloads the prebuilt `dejima` binary matching its
-version from the [GitHub Release](https://github.com/aoos/dejima/releases),
-checksum-verifies it, and puts a `dejima` command on your PATH. No Go toolchain
-required.
+The prebuilt `dejima` binary for your platform ships inside a per-platform
+package (`@dejima/cli-<platform>-<arch>`) that npm installs automatically as an
+optional dependency — only the one matching your OS/CPU. There's **no install
+script** (so it works under npm 11's default script-blocking), and no Go
+toolchain required; the `dejima` command lands on your PATH.
 
 ## What this installs (and what it doesn't)
 
@@ -46,13 +47,13 @@ See <https://dejima.tech/> for the full picture.
 
 ## Environment knobs
 
-- `DEJIMA_SKIP_DOWNLOAD=1` — skip the postinstall download (offline / sandboxed
-  CI). Provide your own binary at runtime with `DEJIMA_BINARY=/path/to/dejima`.
-- `DEJIMA_BINARY=/path/to/dejima` — run a specific binary instead of the
-  downloaded one.
+- `DEJIMA_BINARY=/path/to/dejima` — run a specific binary instead of the bundled
+  platform one (offline installs, `npm i --no-optional`, or a binary you built).
 
 ## Notes
 
-- Requires Node 16+ and a `tar` on PATH (bundled on macOS, Linux, and Windows 10+).
-- macOS binaries are currently unsigned; the installer strips the Gatekeeper
-  quarantine attribute on download. Notarization is on the roadmap.
+- Requires Node 16+.
+- macOS binaries are currently unsigned. When downloaded via npm, Gatekeeper may
+  quarantine them; if macOS blocks the binary, clear it with
+  `xattr -d com.apple.quarantine "$(npm root -g)/dejima/node_modules/@dejima/cli-darwin-arm64/bin/dejima"`
+  (adjust the arch). Notarization is on the roadmap.

package/bin/dejima.js

@@ -1,20 +1,49 @@
 #!/usr/bin/env node
-// Thin shim: exec the dejima binary that install.js placed in ../binary/,
-// forwarding argv, stdio, and the exit code. Lets `npm install -g dejima`
-// expose a real `dejima` command on PATH.
+// Launcher for the `dejima` CLI. The real binary ships INSIDE a per-platform
+// package (@dejima/cli-<platform>-<arch>) declared as an optionalDependency, so
+// npm installs only the one matching this host (os/cpu fields) and skips the
+// rest. There is NO postinstall download — that was blocked by npm 11's default
+// script-blocking and left the CLI non-functional. This shim resolves the
+// platform package and execs its binary, forwarding argv, stdio, and exit code.
+//
+// DEJIMA_BINARY overrides the resolved path (offline installs / CI / a binary
+// you provide yourself, e.g. when installed with --no-optional).
 'use strict';
 
 const fs = require('fs');
 const path = require('path');
 const { spawnSync } = require('child_process');
 
+// node's process.platform is already darwin|linux|win32; process.arch is
+// x64|arm64 — the exact suffixes our platform packages use.
+const pkgName = `@dejima/cli-${process.platform}-${process.arch}`;
 const exe = process.platform === 'win32' ? 'dejima.exe' : 'dejima';
-const binary = process.env.DEJIMA_BINARY || path.join(__dirname, '..', 'binary', exe);
 
-if (!fs.existsSync(binary)) {
-  console.error(`dejima: binary not found at ${binary}`);
-  console.error('The postinstall download may have failed. Reinstall the package, or');
-  console.error('set DEJIMA_BINARY to the path of a dejima binary you provide yourself.');
+function resolveBinary() {
+  if (process.env.DEJIMA_BINARY) {
+    return process.env.DEJIMA_BINARY;
+  }
+  // Resolve the package's own package.json (always present + resolvable) and
+  // join the binary path, rather than require.resolve-ing the extensionless
+  // binary directly — more robust across node versions and bundlers. esbuild,
+  // swc and turbo resolve their platform binaries the same way.
+  try {
+    const pkgJson = require.resolve(`${pkgName}/package.json`);
+    return path.join(path.dirname(pkgJson), 'bin', exe);
+  } catch (_) {
+    return null;
+  }
+}
+
+const binary = resolveBinary();
+if (!binary || !fs.existsSync(binary)) {
+  console.error(`dejima: no prebuilt binary for ${process.platform}-${process.arch}.`);
+  console.error(`Expected the optional dependency ${pkgName} to be installed.`);
+  console.error('This usually means the platform is unsupported, or the package was');
+  console.error('installed with --no-optional / --omit=optional. Alternatives:');
+  console.error('  • curl -fsSL https://dejima.tech/install-client.sh | bash');
+  console.error('  • brew install aoos/dejima/dejima');
+  console.error('  • set DEJIMA_BINARY to the path of a dejima binary you provide.');
   process.exit(1);
 }
 

package/package.json

@@ -1,19 +1,23 @@
 {
   "name": "dejima",
-  "version": "0.8.1",
+  "version": "0.8.7",
   "description": "CLI for Dejima — run a fleet of isolated AI coding agents on hardware you own.",
   "license": "Apache-2.0",
   "bin": {
     "dejima": "bin/dejima.js"
   },
-  "scripts": {
-    "postinstall": "node ./install.js"
-  },
   "files": [
     "bin/dejima.js",
-    "install.js",
     "README.md"
   ],
+  "optionalDependencies": {
+    "@dejima/cli-darwin-arm64": "0.8.7",
+    "@dejima/cli-darwin-x64": "0.8.7",
+    "@dejima/cli-linux-arm64": "0.8.7",
+    "@dejima/cli-linux-x64": "0.8.7",
+    "@dejima/cli-win32-arm64": "0.8.7",
+    "@dejima/cli-win32-x64": "0.8.7"
+  },
   "engines": {
     "node": ">=16"
   },

package/install.js

@@ -1,169 +0,0 @@
-#!/usr/bin/env node
-// Postinstall hook for the `dejima` npm package.
-//
-// Downloads the dejima CLI binary that matches this package's version from the
-// GitHub Release, verifies its SHA256 against the release's SHA256SUMS, and
-// unpacks it into ./binary/. The bin shim (bin/dejima.js) execs it.
-//
-// This package ships only the CLI *client* — the cross-platform binary you
-// drive a Dejima host with. The daemon (dejimad) and the island image are
-// Unix-host-only; install those with `curl -fsSL https://dejima.tech/install.sh
-// | bash` or Homebrew. See README.md.
-//
-// Knobs:
-//   DEJIMA_SKIP_DOWNLOAD=1   skip the download (e.g. offline CI); provide your
-//                            own binary via DEJIMA_BINARY at runtime instead.
-'use strict';
-
-const fs = require('fs');
-const path = require('path');
-const https = require('https');
-const crypto = require('crypto');
-const { execFileSync } = require('child_process');
-
-const REPO = 'aoos/dejima';
-const pkg = require('./package.json');
-const version = String(pkg.version).replace(/^v/, '');
-const tag = `v${version}`;
-
-if (process.env.DEJIMA_SKIP_DOWNLOAD === '1') {
-  console.log('dejima: DEJIMA_SKIP_DOWNLOAD=1 set — skipping binary download.');
-  process.exit(0);
-}
-
-function mapPlatform() {
-  switch (process.platform) {
-    case 'darwin': return 'darwin';
-    case 'linux': return 'linux';
-    case 'win32': return 'windows';
-    default: throw new Error(`unsupported platform: ${process.platform}`);
-  }
-}
-function mapArch() {
-  switch (process.arch) {
-    case 'x64': return 'amd64';
-    case 'arm64': return 'arm64';
-    default: throw new Error(`unsupported arch: ${process.arch}`);
-  }
-}
-
-const plat = mapPlatform();
-const arch = mapArch();
-const ext = plat === 'windows' ? 'zip' : 'tar.gz';
-const asset = `dejima_${tag}_${plat}_${arch}.${ext}`;
-const base = `https://github.com/${REPO}/releases/download/${tag}`;
-
-// GET that follows redirects (GitHub release assets 302 to a CDN) and buffers
-// the body. Caps redirects so a misconfigured mirror can't loop forever.
-function get(url, redirects = 0) {
-  return new Promise((resolve, reject) => {
-    if (redirects > 10) return reject(new Error('too many redirects'));
-    https
-      .get(url, { headers: { 'User-Agent': 'dejima-npm-installer' } }, (res) => {
-        const { statusCode, headers } = res;
-        if (statusCode >= 300 && statusCode < 400 && headers.location) {
-          res.resume();
-          resolve(get(headers.location, redirects + 1));
-          return;
-        }
-        if (statusCode !== 200) {
-          res.resume();
-          reject(new Error(`GET ${url} -> HTTP ${statusCode}`));
-          return;
-        }
-        const chunks = [];
-        res.on('data', (c) => chunks.push(c));
-        res.on('end', () => resolve(Buffer.concat(chunks)));
-      })
-      .on('error', reject);
-  });
-}
-
-async function verifyChecksum(tarball) {
-  let sums;
-  try {
-    sums = (await get(`${base}/SHA256SUMS`)).toString('utf8');
-  } catch (e) {
-    console.warn(`dejima: could not fetch SHA256SUMS (${e.message}) — skipping checksum.`);
-    return;
-  }
-  const row = sums
-    .split('\n')
-    .map((l) => l.trim().split(/\s+/))
-    .find((p) => p[1] === asset);
-  if (!row) {
-    console.warn(`dejima: ${asset} not listed in SHA256SUMS — skipping checksum.`);
-    return;
-  }
-  const got = crypto.createHash('sha256').update(tarball).digest('hex');
-  if (got !== row[0]) {
-    throw new Error(`checksum mismatch for ${asset}\n  want ${row[0]}\n  got  ${got}`);
-  }
-  console.log('dejima: checksum OK');
-}
-
-async function main() {
-  const binDir = path.join(__dirname, 'binary');
-  fs.mkdirSync(binDir, { recursive: true });
-
-  console.log(`dejima: downloading ${asset} …`);
-  let tarball;
-  try {
-    tarball = await get(`${base}/${asset}`);
-  } catch (e) {
-    // A 404 here almost always means there's no published Release for this exact
-    // version/platform yet (or the tag isn't out). Say so plainly instead of
-    // surfacing a raw "HTTP 404" the way a generic failure would.
-    if (/HTTP 404/.test(e.message)) {
-      throw new Error(
-        `no prebuilt binary for this version/platform yet — ${asset} isn't in ` +
-          `release ${tag}.\n  See https://github.com/${REPO}/releases for what's published.`
-      );
-    }
-    throw e;
-  }
-  await verifyChecksum(tarball);
-
-  // Unpack with the system tar. bsdtar (Windows 10+ `tar.exe`) reads .zip too;
-  // gnutar/bsdtar read .tar.gz on Unix. Archives carry dejima (+ dejimad on
-  // Unix, which we leave unused) and LICENSE/README.
-  const archivePath = path.join(binDir, asset);
-  fs.writeFileSync(archivePath, tarball);
-  const flags = ext === 'tar.gz' ? ['-xzf'] : ['-xf'];
-  execFileSync('tar', [...flags, archivePath, '-C', binDir], { stdio: 'inherit' });
-  fs.unlinkSync(archivePath);
-
-  const exe = plat === 'windows' ? 'dejima.exe' : 'dejima';
-  const exePath = path.join(binDir, exe);
-  if (!fs.existsSync(exePath)) {
-    throw new Error(`expected ${exe} in ${asset}, but it was not found after extraction`);
-  }
-  if (plat !== 'windows') fs.chmodSync(exePath, 0o755);
-
-  // Drop the extras the archive carries (dejimad, LICENSE, README) — this
-  // package is the CLI client only, so keep just the one binary.
-  for (const f of fs.readdirSync(binDir)) {
-    if (f !== exe) fs.rmSync(path.join(binDir, f), { force: true });
-  }
-
-  // Strip the macOS quarantine xattr — binaries are unsigned until notarization
-  // lands, so Gatekeeper would otherwise block the downloaded executable.
-  if (plat === 'darwin') {
-    try {
-      execFileSync('xattr', ['-d', 'com.apple.quarantine', exePath], { stdio: 'ignore' });
-    } catch (_) {
-      /* attribute may be absent; ignore */
-    }
-  }
-
-  console.log(`dejima ${version} installed → ${exePath}`);
-}
-
-main().catch((err) => {
-  console.error(`\ndejima: install failed: ${err.message}\n`);
-  console.error('Alternatives:');
-  console.error('  • curl -fsSL https://dejima.tech/install-client.sh | bash');
-  console.error('  • brew install aoos/dejima/dejima');
-  console.error('  • set DEJIMA_SKIP_DOWNLOAD=1 and point DEJIMA_BINARY at a dejima binary.');
-  process.exit(1);
-});