fitguard 0.1.0

package/bin/cli.js

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+"use strict";
+
+const { spawnSync } = require("child_process");
+const fs = require("fs");
+const { binPath } = require("../scripts/platform");
+
+const bin = binPath();
+
+if (!fs.existsSync(bin)) {
+  console.error(
+    `fitguard binary not found at ${bin}.\n` +
+      "The postinstall download may have failed. Try: npm install fitguard --force"
+  );
+  process.exit(1);
+}
+
+// stdio: "inherit" hands the real terminal (including the masked
+// password prompts `fitguard init` uses) straight to the Go binary,
+// rather than this wrapper trying to proxy stdin/stdout itself.
+const result = spawnSync(bin, process.argv.slice(2), { stdio: "inherit" });
+
+if (result.error) {
+  console.error(`fitguard: ${result.error.message}`);
+  process.exit(1);
+}
+
+// status is null when the child was killed by a signal (e.g. Ctrl+C)
+// rather than exiting normally; process.exit() requires a number, so
+// that case falls back to a generic failure code.
+process.exit(result.status === null ? 1 : result.status);

package/package.json

@@ -0,0 +1,26 @@
+{
+  "name": "fitguard",
+  "version": "0.1.0",
+  "description": "Self-hosted, OpenAI-compatible AI gateway that stops runaway LLM bills before they happen.",
+  "license": "Apache-2.0",
+  "homepage": "https://github.com/Oluiy/ai-cost-guard",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Oluiy/ai-cost-guard.git"
+  },
+  "bin": {
+    "fitguard": "bin/cli.js"
+  },
+  "files": [
+    "bin",
+    "scripts"
+  ],
+  "scripts": {
+    "postinstall": "node scripts/postinstall.js"
+  },
+  "os": ["darwin", "linux", "win32"],
+  "cpu": ["x64", "arm64"],
+  "engines": {
+    "node": ">=14"
+  }
+}

package/scripts/platform.js

@@ -0,0 +1,49 @@
+"use strict";
+// Shared between postinstall.js (downloads the binary) and bin/cli.js
+// (runs it), so the two can never disagree on where it lives or what
+// GoReleaser named it.
+
+const path = require("path");
+
+// Node's process.platform/arch values vs. GoOS/GoArch, which is what
+// .goreleaser.yaml's archive name_template uses (fitguard_<os>_<arch>).
+const OS_MAP = { darwin: "darwin", linux: "linux", win32: "windows" };
+const ARCH_MAP = { x64: "amd64", arm64: "arm64" };
+
+// Must match .goreleaser.yaml's `ignore:` list: every GOOS/GOARCH pair
+// that isn't built has no release asset to download.
+const UNSUPPORTED = new Set(["windows/arm64"]);
+
+function resolvePlatform() {
+  const goos = OS_MAP[process.platform];
+  const goarch = ARCH_MAP[process.arch];
+  if (!goos || !goarch) {
+    throw new Error(
+      `fitguard has no prebuilt binary for ${process.platform}/${process.arch}. ` +
+        "Build from source instead: https://github.com/Oluiy/ai-cost-guard#installation"
+    );
+  }
+  if (UNSUPPORTED.has(`${goos}/${goarch}`)) {
+    throw new Error(
+      `fitguard does not build for ${goos}/${goarch}. ` +
+        "Build from source instead: https://github.com/Oluiy/ai-cost-guard#installation"
+    );
+  }
+  return { goos, goarch };
+}
+
+function archiveName(goos, goarch) {
+  const ext = goos === "windows" ? "zip" : "tar.gz";
+  return `fitguard_${goos}_${goarch}.${ext}`;
+}
+
+function binDir() {
+  return path.join(__dirname, "..", "dist");
+}
+
+function binPath() {
+  const ext = process.platform === "win32" ? ".exe" : "";
+  return path.join(binDir(), `fitguard${ext}`);
+}
+
+module.exports = { resolvePlatform, archiveName, binDir, binPath };

package/scripts/postinstall.js

@@ -0,0 +1,113 @@
+#!/usr/bin/env node
+"use strict";
+// Downloads the fitguard binary matching this machine from GitHub
+// Releases, verifies it against the published checksums (same check
+// install.sh does), and extracts it into npm/dist/. No dependencies:
+// https (built-in) for the download, and the system `tar` for
+// extraction — present by default on macOS, Linux, and Windows 10+
+// (bsdtar, which also opens .zip), so there's nothing extra to install
+// just to install this.
+
+const fs = require("fs");
+const path = require("path");
+const http = require("http");
+const https = require("https");
+const crypto = require("crypto");
+const { execFileSync } = require("child_process");
+
+const { resolvePlatform, archiveName, binDir, binPath } = require("./platform");
+const pkg = require("../package.json");
+
+const REPO = "Oluiy/ai-cost-guard";
+// The npm package version and the git tag are kept in lockstep (1.2.3 <-> v1.2.3),
+// so there's one version number to bump per release rather than two to keep in sync.
+const VERSION = process.env.FITGUARD_VERSION || `v${pkg.version}`;
+const BASE_URL =
+  process.env.FITGUARD_BASE_URL || `https://github.com/${REPO}/releases/download`;
+
+function get(url, redirects) {
+  redirects = redirects || 0;
+  return new Promise((resolve, reject) => {
+    if (redirects > 5) return reject(new Error(`too many redirects fetching ${url}`));
+    // GitHub always serves https, but FITGUARD_BASE_URL is also the hook
+    // this postinstall step is tested against locally, so the transport
+    // follows the URL rather than being hardcoded to https.
+    const transport = url.startsWith("http://") ? http : https;
+    transport
+      .get(url, { headers: { "User-Agent": "fitguard-npm-installer" } }, (res) => {
+        if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+          res.resume();
+          return resolve(get(res.headers.location, redirects + 1));
+        }
+        if (res.statusCode !== 200) {
+          res.resume();
+          return reject(new Error(`GET ${url} -> HTTP ${res.statusCode}`));
+        }
+        const chunks = [];
+        res.on("data", (c) => chunks.push(c));
+        res.on("end", () => resolve(Buffer.concat(chunks)));
+        res.on("error", reject);
+      })
+      .on("error", reject);
+  });
+}
+
+function sha256(buf) {
+  return crypto.createHash("sha256").update(buf).digest("hex");
+}
+
+async function main() {
+  const { goos, goarch } = resolvePlatform();
+  const archive = archiveName(goos, goarch);
+  const archiveUrl = `${BASE_URL}/${VERSION}/${archive}`;
+  const checksumsUrl = `${BASE_URL}/${VERSION}/checksums.txt`;
+
+  console.log(`fitguard: downloading ${archive} (${VERSION})...`);
+  const [archiveBuf, checksumsBuf] = await Promise.all([
+    get(archiveUrl),
+    get(checksumsUrl),
+  ]);
+
+  const line = checksumsBuf
+    .toString("utf8")
+    .split("\n")
+    .find((l) => l.trim().endsWith(archive));
+  if (!line) {
+    throw new Error(`no checksum entry for ${archive} in checksums.txt`);
+  }
+  const expected = line.trim().split(/\s+/)[0];
+  const actual = sha256(archiveBuf);
+  if (expected !== actual) {
+    throw new Error(
+      `checksum mismatch for ${archive}: expected ${expected}, got ${actual}`
+    );
+  }
+
+  const dist = binDir();
+  fs.mkdirSync(dist, { recursive: true });
+  const archivePath = path.join(dist, archive);
+  fs.writeFileSync(archivePath, archiveBuf);
+
+  console.log("fitguard: extracting...");
+  // bsdtar (macOS/BSD tar, and Windows 10 1803+'s tar.exe) opens .zip
+  // through the same `tar -xf`, so this one call covers every platform
+  // this package targets without a separate zip codepath.
+  execFileSync("tar", ["-xf", archivePath, "-C", dist, "fitguard" + (goos === "windows" ? ".exe" : "")], {
+    stdio: "inherit",
+  });
+  fs.unlinkSync(archivePath);
+
+  if (goos !== "windows") {
+    fs.chmodSync(binPath(), 0o755);
+  }
+
+  console.log(`fitguard: installed to ${binPath()}`);
+}
+
+main().catch((err) => {
+  console.error(`fitguard: install failed: ${err.message}`);
+  console.error(
+    "You can install manually instead: https://github.com/Oluiy/ai-cost-guard#installation"
+  );
+  process.exit(1);
+});