gramatr 0.3.58 → 0.3.59

package/bin/gmtr-login.ts

@@ -496,37 +496,54 @@ async function loginBrowser(): Promise<void> {
 }
 
 // ── CLI ──
+//
+// Defense in depth (Fix A' for Windows top-level await crash):
+// All CLI code is wrapped in an async `main()` and invoked via a
+// module-run guard. This keeps the module importable without firing
+// side effects and avoids top-level await entirely, so the file stays
+// safe even if the package ever loses `"type": "module"` or tsx
+// changes its default target to CJS.
+
+export async function main(): Promise<void> {
+  const args = process.argv.slice(2);
+
+  if (args.includes('--status') || args.includes('status')) {
+    await showStatus();
+    return;
+  }
 
-const args = process.argv.slice(2);
+  if (args.includes('--logout') || args.includes('logout')) {
+    await logout();
+    return;
+  }
 
-if (args.includes('--status') || args.includes('status')) {
-  await showStatus();
-} else if (args.includes('--logout') || args.includes('logout')) {
-  await logout();
-} else if (args.includes('--token') || args.includes('-t')) {
-  const tokenIdx = args.indexOf('--token') !== -1 ? args.indexOf('--token') : args.indexOf('-t');
-  const token = args[tokenIdx + 1];
-  if (!token) {
-    // Interactive paste mode — like Claude's login
-    console.log('\n  Paste your gramatr token below.');
-    console.log('  (API keys start with aios_sk_ or gmtr_sk_)\n');
-    process.stdout.write('  Token: ');
-
-    const { createInterface } = await import('readline');
-    const rl = createInterface({ input: process.stdin, output: process.stdout });
-    const pastedToken = await new Promise<string>((resolve) => {
-      rl.on('line', (line: string) => { rl.close(); resolve(line.trim()); });
-    });
-    if (!pastedToken) {
-      console.log('  No token provided.\n');
-      process.exit(1);
+  if (args.includes('--token') || args.includes('-t')) {
+    const tokenIdx = args.indexOf('--token') !== -1 ? args.indexOf('--token') : args.indexOf('-t');
+    const token = args[tokenIdx + 1];
+    if (!token) {
+      // Interactive paste mode — like Claude's login
+      console.log('\n  Paste your gramatr token below.');
+      console.log('  (API keys start with aios_sk_ or gmtr_sk_)\n');
+      process.stdout.write('  Token: ');
+
+      const { createInterface } = await import('readline');
+      const rl = createInterface({ input: process.stdin, output: process.stdout });
+      const pastedToken = await new Promise<string>((resolve) => {
+        rl.on('line', (line: string) => { rl.close(); resolve(line.trim()); });
+      });
+      if (!pastedToken) {
+        console.log('  No token provided.\n');
+        process.exit(1);
+      }
+      await loginWithToken(pastedToken);
+    } else {
+      await loginWithToken(token);
     }
-    await loginWithToken(pastedToken);
-  } else {
-    await loginWithToken(token);
+    return;
   }
-} else if (args.includes('--help') || args.includes('-h')) {
-  console.log(`
+
+  if (args.includes('--help') || args.includes('-h')) {
+    console.log(`
   gmtr-login — Authenticate with the gramatr server
 
   Usage:
@@ -541,7 +558,26 @@ if (args.includes('--status') || args.includes('status')) {
   Server: ${SERVER_BASE}
   Dashboard: ${DASHBOARD_BASE}
 `);
-} else {
+    return;
+  }
+
   // Default: browser login flow
   await loginBrowser();
 }
+
+// Module-run guard. Works both when invoked directly via
+// `tsx bin/gmtr-login.ts` and when imported from another module
+// (tests, programmatic use). Under ESM, import.meta.url is the
+// canonical check; we also accept a path-suffix match as a belt.
+const invokedAs = process.argv[1] || '';
+const isMain =
+  import.meta.url === `file://${invokedAs}` ||
+  invokedAs.endsWith('gmtr-login.ts') ||
+  invokedAs.endsWith('gmtr-login.js');
+
+if (isMain) {
+  main().catch((err) => {
+    console.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  });
+}

package/bin/gramatr.ts

@@ -2,6 +2,7 @@
 
 import { spawnSync } from 'child_process';
 import { existsSync } from 'fs';
+import { createRequire } from 'module';
 import { homedir } from 'os';
 import { dirname, join } from 'path';
 import { fileURLToPath } from 'url';
@@ -47,8 +48,9 @@ function runTs(script: string, extraArgs: string[] = []): void {
   // Resolve tsx from this package's node_modules (not CWD) so `npx tsx` works
   // even on hosts where the user hasn't globally installed tsx.
   try {
-    const { dirname, join } = require('path');
-    const tsxCli = join(dirname(require.resolve('tsx/package.json')), 'dist', 'cli.mjs');
+    // ESM-safe: createRequire gives us require.resolve for finding tsx on disk.
+    const req = createRequire(import.meta.url);
+    const tsxCli = join(dirname(req.resolve('tsx/package.json')), 'dist', 'cli.mjs');
     run(process.execPath, [tsxCli, script, ...extraArgs]);
   } catch {
     // Fallback: global npx tsx

package/bin/install.ts

@@ -123,9 +123,23 @@ function dirSize(dir: string): string {
 }
 
 function which(cmd: string): string | null {
+  // Platform-aware: `command -v` is a POSIX shell builtin that does not exist
+  // on Windows cmd.exe / PowerShell. Use `where` on Windows.
+  // stdio: ['ignore', 'pipe', 'ignore'] suppresses the "not found" stderr
+  // noise that previously leaked to the user's terminal during install.
+  // Closes #483 Bug 1.
+  const probe = process.platform === 'win32' ? `where ${cmd}` : `command -v ${cmd}`;
   try {
-    return execSync(`command -v ${cmd}`, { encoding: 'utf8' }).trim() || null;
-  } catch { return null; }
+    const out = execSync(probe, {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    });
+    // `where` on Windows returns multiple lines when the binary is on PATH
+    // multiple times; take the first match.
+    return out.trim().split(/\r?\n/)[0] || null;
+  } catch {
+    return null;
+  }
 }
 
 function copyFileIfExists(src: string, dest: string, executable = false): boolean {
@@ -375,7 +389,7 @@ async function handleAuth(legacyToken: string): Promise<{ url: string; token: st
     log('');
     log(e?.message || String(e));
     log('');
-    log('Authentication skipped — run `gramatr login` later to authenticate');
+    log('Authentication skipped — run `npx gramatr@latest login` later to authenticate');
     log('');
   }
 

package/core/auth.ts

@@ -121,13 +121,13 @@ function spawnOAuthLogin(): { ok: boolean; reason?: string } {
 const HEADLESS_ERROR =
   "No gramatr credentials found. Set one of:\n" +
   "  - GRAMATR_API_KEY environment variable\n" +
-  "  - Run: gramatr login            (interactive, recommended)\n" +
-  "  - Run: gramatr add-api-key      (for headless / CI use)\n" +
+  "  - Run: npx gramatr@latest login            (interactive, recommended)\n" +
+  "  - Run: npx gramatr@latest add-api-key      (for headless / CI use)\n" +
   "Then re-run the install.";
 
 const OAUTH_FAILED_ERROR =
-  'OAuth login failed. Run "gramatr login" to retry, ' +
-  'or "gramatr add-api-key" to use an API key instead.';
+  'OAuth login failed. Run "npx gramatr@latest login" to retry, ' +
+  'or "npx gramatr@latest add-api-key" to use an API key instead.';
 
 /**
  * Resolve a gramatr auth token, OAuth-first.

package/desktop/build-mcpb.ts

@@ -12,7 +12,7 @@
  * Usage: bun desktop/build-mcpb.ts [--out <path>]
  */
 
-import { existsSync, mkdirSync, writeFileSync } from 'fs';
+import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
 import { join, dirname } from 'path';
 import { fileURLToPath } from 'url';
 
@@ -65,7 +65,6 @@ interface McpbManifest {
 function readPackageVersion(): string {
   try {
     const pkgPath = join(clientDir, 'package.json');
-    const { readFileSync } = require('fs');
     const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
     return pkg.version || '0.0.0';
   } catch {

package/hooks/GMTRPromptEnricher.hook.ts

@@ -20,6 +20,7 @@
  * - Token savings metadata
  */
 
+import { readFileSync } from 'fs';
 import { getGitContext } from './lib/gmtr-hook-utils.ts';
 import {
   persistClassificationResult,
@@ -51,7 +52,7 @@ function resolveProjectId(): string | null {
     // Read from the context file written by session-start.sh
     const home = process.env.HOME || process.env.USERPROFILE || '';
     const contextPath = `${home}/.claude/current-project-context.json`;
-    const context = JSON.parse(require('fs').readFileSync(contextPath, 'utf8'));
+    const context = JSON.parse(readFileSync(contextPath, 'utf8'));
     const remote = context.git_remote;
     if (!remote || remote === 'no-remote') return null;
 

package/hooks/GMTRRatingCapture.hook.ts

@@ -24,6 +24,7 @@
  */
 
 import { appendFileSync, mkdirSync, existsSync } from 'fs';
+import { spawn } from 'child_process';
 import { join, dirname } from 'path';
 import { getGmtrDir } from './lib/paths';
 
@@ -140,7 +141,6 @@ function notifyLowRating(rating: number, comment?: string): void {
     const msg = comment
       ? `Rating ${rating}/10: ${comment}`
       : `Rating ${rating}/10 received`;
-    const { spawn } = require('child_process');
     spawn('osascript', ['-e', `display notification "${msg}" with title "gramatr" subtitle "Low Rating Alert"`], {
       stdio: 'ignore',
       detached: true,

package/hooks/lib/gmtr-hook-utils.ts

@@ -8,7 +8,7 @@
  */
 
 import { execSync } from 'child_process';
-import { readFileSync, writeFileSync, renameSync, mkdirSync, existsSync } from 'fs';
+import { readFileSync, writeFileSync, renameSync, mkdirSync, existsSync, appendFileSync } from 'fs';
 import { join, basename } from 'path';
 
 // ── Types ──
@@ -680,7 +680,6 @@ export function appendLine(filePath: string, line: string): void {
   if (dir && !existsSync(dir)) {
     mkdirSync(dir, { recursive: true });
   }
-  const { appendFileSync } = require('fs');
   appendFileSync(filePath, line + '\n', 'utf8');
 }
 

package/hooks/lib/notify.ts

@@ -10,6 +10,7 @@
  */
 
 import { platform } from 'os';
+import { spawn } from 'child_process';
 
 /**
  * Send a local push notification.
@@ -24,7 +25,6 @@ export function notify(subtitle: string, message: string): void {
     const safeMsg = message.replace(/"/g, '\\"');
     const safeSub = subtitle.replace(/"/g, '\\"');
 
-    const { spawn } = require('child_process');
     spawn('osascript', ['-e',
       `display notification "${safeMsg}" with title "gramatr" subtitle "${safeSub}"`,
     ], { stdio: 'ignore', detached: true }).unref();

package/hooks/session-end.hook.ts

@@ -94,7 +94,7 @@ async function main(): Promise<void> {
         // Build session summary from git data
         let branch = 'unknown';
         try {
-          const { execSync } = require('child_process');
+          const { execSync } = await import('child_process');
           branch = execSync('git rev-parse --abbrev-ref HEAD', {
             encoding: 'utf8',
             stdio: ['pipe', 'pipe', 'pipe'],

package/package.json

@@ -1,8 +1,9 @@
 {
   "name": "gramatr",
-  "version": "0.3.58",
+  "version": "0.3.59",
   "description": "grāmatr — context engineering layer for AI coding agents. Every prompt gets a pre-computed intelligence packet: decision routing, capability audit, behavioral directives, memory pre-load, and ISC scaffolds. Continuity across sessions for Claude Code, Codex, and Gemini CLI.",
   "license": "SEE LICENSE IN LICENSE",
+  "type": "module",
   "repository": {
     "type": "git",
     "url": "https://github.com/gramatr/gramatr.git",