flowleap 0.2.3 → 0.2.4

package/bin/flowleap

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { execFileSync } from "child_process";
-import { join, dirname } from "path";
-import { fileURLToPath } from "url";
-import { existsSync } from "fs";
+import { ensureBinary, findBinary } from "../download.mjs";
 
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const isWindows = process.platform === "win32";
-const bin = join(__dirname, isWindows ? "flowleap-native.exe" : "flowleap-native");
-
-if (!existsSync(bin)) {
-  console.error("flowleap binary not found. Try reinstalling: npm i -g flowleap");
-  process.exit(1);
+let bin = findBinary();
+if (!bin) {
+  try {
+    bin = await ensureBinary();
+  } catch (err) {
+    console.error(`flowleap: could not fetch the native binary: ${err.message}`);
+    console.error("Retry, or download it manually from https://github.com/abdullahatrash/flowleap-cli/releases");
+    process.exit(1);
+  }
 }
 
 try {

package/download.mjs

@@ -0,0 +1,164 @@
+// Lazy binary fetcher, invoked from bin/flowleap on first run. There is
+// deliberately no npm install script: install-time code is what npm's
+// allow-scripts guard exists to flag. The binary is downloaded from the
+// GitHub release matching this package's version and verified against the
+// release's checksums.txt before it is ever executed.
+//
+// All human-facing output goes to stderr — the first run may be
+// `flowleap --json …` piped by an agent, and stdout must stay parseable.
+
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  writeFileSync,
+} from "fs";
+import { createHash } from "crypto";
+import { join, dirname } from "path";
+import { homedir } from "os";
+import { fileURLToPath } from "url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const REPO = "abdullahatrash/flowleap-cli";
+const isWindows = process.platform === "win32";
+const binaryName = isWindows ? "flowleap-native.exe" : "flowleap-native";
+
+// Release tags are named "v<version>"; the publish workflow stamps the npm
+// version from the tag, so package.json is always the source of truth.
+const pkg = JSON.parse(readFileSync(join(__dirname, "package.json"), "utf8"));
+const VERSION = `v${pkg.version}`;
+
+const PLATFORM_MAP = {
+  "darwin-arm64": "flowleap-darwin-aarch64",
+  "darwin-x64": "flowleap-darwin-x86_64",
+  "linux-arm64": "flowleap-linux-aarch64",
+  "linux-x64": "flowleap-linux-x86_64",
+  "win32-x64": "flowleap-windows-x86_64.exe",
+};
+
+// Preferred location is inside the package (fast path, removed on uninstall);
+// the per-user cache is the fallback when the package dir isn't writable
+// (e.g. sudo-installed global node).
+function candidates() {
+  const cacheBase = process.env.XDG_CACHE_HOME || join(homedir(), ".cache");
+  return [
+    join(__dirname, "bin", binaryName),
+    join(cacheBase, "flowleap", VERSION, binaryName),
+  ];
+}
+
+export function findBinary() {
+  return candidates().find(existsSync) ?? null;
+}
+
+function formatBytes(n) {
+  if (!Number.isFinite(n) || n <= 0) return "0 B";
+  const units = ["B", "KB", "MB", "GB"];
+  let i = 0;
+  while (n >= 1024 && i < units.length - 1) {
+    n /= 1024;
+    i++;
+  }
+  return `${n.toFixed(i === 0 ? 0 : 1)} ${units[i]}`;
+}
+
+function progressReporter(total) {
+  const isTTY = Boolean(process.stderr.isTTY);
+  const hasTotal = Number.isFinite(total) && total > 0;
+  let received = 0;
+  let lastRenderAt = 0;
+
+  return {
+    update(chunkSize) {
+      received += chunkSize;
+      if (!isTTY) return; // non-TTY (agents, CI): stay quiet beyond the one-line notice
+      const now = Date.now();
+      if (now - lastRenderAt < 100 && received !== total) return;
+      lastRenderAt = now;
+      const line = hasTotal
+        ? `  ${formatBytes(received)} / ${formatBytes(total)} (${Math.floor((received / total) * 100)}%)`
+        : `  ${formatBytes(received)}…`;
+      process.stderr.write(`\r${line}`);
+    },
+    finish() {
+      if (isTTY) process.stderr.write("\n");
+    },
+  };
+}
+
+async function fetchOk(url) {
+  const res = await fetch(url, { redirect: "follow" });
+  if (!res.ok) {
+    throw new Error(`download failed: HTTP ${res.status} for ${url}`);
+  }
+  return res;
+}
+
+async function downloadBytes(url) {
+  const res = await fetchOk(url);
+  const total = parseInt(res.headers.get("content-length") || "", 10);
+  const progress = progressReporter(total);
+  const reader = res.body.getReader();
+  const chunks = [];
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    chunks.push(value);
+    progress.update(value.length);
+  }
+  progress.finish();
+  return Buffer.concat(chunks);
+}
+
+// checksums.txt lines look like "<sha256>  <asset-dir>/<asset>".
+function expectedChecksum(text, asset) {
+  for (const line of text.split("\n")) {
+    const [hash, file] = line.trim().split(/\s+/);
+    if (file && (file === asset || file.endsWith(`/${asset}`))) return hash;
+  }
+  throw new Error(`no checksum entry for ${asset} in checksums.txt`);
+}
+
+export async function ensureBinary() {
+  const existing = findBinary();
+  if (existing) return existing;
+
+  const key = `${process.platform}-${process.arch}`;
+  const asset = PLATFORM_MAP[key];
+  if (!asset) {
+    throw new Error(
+      `unsupported platform ${key} (supported: ${Object.keys(PLATFORM_MAP).join(", ")})`
+    );
+  }
+
+  process.stderr.write(`flowleap: first run — downloading ${VERSION} for ${key}…\n`);
+  const base = `https://github.com/${REPO}/releases/download/${VERSION}`;
+  const [bytes, checksums] = await Promise.all([
+    downloadBytes(`${base}/${asset}`),
+    fetchOk(`${base}/checksums.txt`).then((r) => r.text()),
+  ]);
+
+  const expected = expectedChecksum(checksums, asset);
+  const actual = createHash("sha256").update(bytes).digest("hex");
+  if (actual !== expected) {
+    throw new Error(
+      `sha256 mismatch for ${asset}: expected ${expected}, got ${actual} — refusing to install`
+    );
+  }
+
+  for (const target of candidates()) {
+    try {
+      mkdirSync(dirname(target), { recursive: true });
+      const tmp = `${target}.tmp-${process.pid}`;
+      writeFileSync(tmp, bytes, { mode: 0o755 });
+      renameSync(tmp, target);
+      process.stderr.write(`flowleap: sha256 verified, installed to ${target}\n`);
+      return target;
+    } catch (err) {
+      if (["EACCES", "EPERM", "EROFS"].includes(err.code)) continue;
+      throw err;
+    }
+  }
+  throw new Error("no writable location for the flowleap binary");
+}

package/package.json

@@ -1,13 +1,10 @@
 {
   "name": "flowleap",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "One CLI for FlowLeap Patent AI — built for humans and AI agents",
   "bin": {
     "flowleap": "bin/flowleap"
   },
-  "scripts": {
-    "postinstall": "node install.mjs"
-  },
   "keywords": [
     "patent",
     "ai",
@@ -25,6 +22,6 @@
   },
   "homepage": "https://flowleap.co",
   "engines": {
-    "node": ">=16"
+    "node": ">=18"
   }
 }

package/install.mjs

@@ -1,148 +0,0 @@
-import { createWriteStream, chmodSync, mkdirSync, existsSync, readFileSync } from "fs";
-import { join, dirname } from "path";
-import { fileURLToPath } from "url";
-import { get } from "https";
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const REPO = "abdullahatrash/flowleap-cli";
-
-// Read version from package.json so the release tag stays in sync with the
-// published npm version automatically. Assumes release tags are named "v<version>".
-const pkg = JSON.parse(readFileSync(join(__dirname, "package.json"), "utf8"));
-const VERSION = `v${pkg.version}`;
-
-const PLATFORM_MAP = {
-  "darwin-arm64": "flowleap-darwin-aarch64",
-  "darwin-x64": "flowleap-darwin-x86_64",
-  "linux-arm64": "flowleap-linux-aarch64",
-  "linux-x64": "flowleap-linux-x86_64",
-  "win32-x64": "flowleap-windows-x86_64.exe",
-};
-
-const key = `${process.platform}-${process.arch}`;
-const asset = PLATFORM_MAP[key];
-
-if (!asset) {
-  console.error(`Unsupported platform: ${key}`);
-  console.error(`Supported: ${Object.keys(PLATFORM_MAP).join(", ")}`);
-  process.exit(1);
-}
-
-const binDir = join(__dirname, "bin");
-const isWindows = process.platform === "win32";
-const binaryName = isWindows ? "flowleap-native.exe" : "flowleap-native";
-const binPath = join(binDir, binaryName);
-
-if (existsSync(binPath)) {
-  process.exit(0);
-}
-
-mkdirSync(binDir, { recursive: true });
-
-const url = `https://github.com/${REPO}/releases/download/${VERSION}/${asset}`;
-
-console.log(`Downloading flowleap ${VERSION} for ${key}...`);
-
-function formatBytes(n) {
-  if (!Number.isFinite(n) || n <= 0) return "0 B";
-  const units = ["B", "KB", "MB", "GB"];
-  let i = 0;
-  while (n >= 1024 && i < units.length - 1) {
-    n /= 1024;
-    i++;
-  }
-  return `${n.toFixed(i === 0 ? 0 : 1)} ${units[i]}`;
-}
-
-function renderBar(fraction, width = 24) {
-  const filled = Math.max(0, Math.min(width, Math.round(fraction * width)));
-  const empty = width - filled;
-  return `[${"=".repeat(filled)}${filled > 0 && empty > 0 ? ">" : ""}${" ".repeat(Math.max(0, empty - (filled > 0 ? 1 : 0)))}]`;
-}
-
-function createProgressReporter(total) {
-  const isTTY = Boolean(process.stdout.isTTY);
-  const hasTotal = Number.isFinite(total) && total > 0;
-  let received = 0;
-  let lastRenderAt = 0;
-  let lastMilestone = -1;
-
-  const update = (chunkSize) => {
-    received += chunkSize;
-    const now = Date.now();
-
-    if (isTTY) {
-      // Throttle TTY redraws to ~10 Hz
-      if (now - lastRenderAt < 100 && received !== total) return;
-      lastRenderAt = now;
-      if (hasTotal) {
-        const fraction = received / total;
-        const pct = Math.floor(fraction * 100);
-        const line = `  ${renderBar(fraction)} ${formatBytes(received)} / ${formatBytes(total)} (${pct}%)`;
-        process.stdout.write(`\r${line}`);
-      } else {
-        process.stdout.write(`\r  Downloaded ${formatBytes(received)}...`);
-      }
-    } else if (hasTotal) {
-      // Non-TTY: emit milestone lines so CI logs stay readable
-      const pct = Math.floor((received / total) * 100);
-      const milestone = Math.floor(pct / 25) * 25;
-      if (milestone > lastMilestone && milestone <= 100) {
-        lastMilestone = milestone;
-        console.log(`  ${milestone}% (${formatBytes(received)} / ${formatBytes(total)})`);
-      }
-    }
-  };
-
-  const finish = () => {
-    if (isTTY) process.stdout.write("\n");
-  };
-
-  return { update, finish };
-}
-
-function download(url) {
-  return new Promise((resolve, reject) => {
-    get(url, (res) => {
-      if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
-        res.resume();
-        download(res.headers.location).then(resolve).catch(reject);
-        return;
-      }
-      if (res.statusCode !== 200) {
-        reject(new Error(`Download failed: HTTP ${res.statusCode}`));
-        return;
-      }
-
-      const total = parseInt(res.headers["content-length"] || "", 10);
-      const progress = createProgressReporter(total);
-
-      const file = createWriteStream(binPath);
-      res.on("data", (chunk) => progress.update(chunk.length));
-      res.pipe(file);
-      file.on("finish", () => {
-        file.close();
-        progress.finish();
-        if (!isWindows) {
-          chmodSync(binPath, 0o755);
-        }
-        resolve();
-      });
-      file.on("error", (err) => {
-        progress.finish();
-        reject(err);
-      });
-      res.on("error", (err) => {
-        progress.finish();
-        reject(err);
-      });
-    }).on("error", reject);
-  });
-}
-
-download(url)
-  .then(() => console.log("flowleap installed successfully!"))
-  .catch((err) => {
-    console.error(`Failed to install flowleap: ${err.message}`);
-    process.exit(1);
-  });