herozion 1.1.87 → 1.1.88

package/README.md

@@ -15,6 +15,47 @@ npx herozion scan .
 
 The binary is stored inside `node_modules/herozion/bin/` — it never touches your system PATH.
 
+## Update (global install)
+
+```bash
+npm install -g herozion@latest --foreground-scripts
+```
+
+`herozion --version` reads the **downloaded binary**, not the npm wrapper alone. If the version does not change after update, the postinstall download was skipped — force it:
+
+```bash
+rm -rf "$(npm root -g)/herozion"
+npm install -g herozion@latest --foreground-scripts
+which -a herozion
+herozion --version
+```
+
+## Uninstall (global install)
+
+```bash
+npm uninstall -g herozion
+```
+
+If you see a binary download instead of a removal (older package versions), use:
+
+```bash
+npm uninstall -g herozion --ignore-scripts
+```
+
+Then verify removal:
+
+```bash
+npm list -g herozion    # should report empty
+command -v herozion     # should print nothing
+```
+
+If the command still exists, remove leftovers manually:
+
+```bash
+rm -rf "$(npm root -g)/herozion"
+rm -f "$(npm bin -g)/herozion"
+```
+
 ## Full documentation
 
 See [github.com/Herozion/scanner](https://github.com/Herozion/scanner#readme)

package/bin/checksums.json

@@ -1,8 +1,8 @@
 {
   "_comment": "SHA-256 hashes for each platform binary. Auto-generated in CI from release CHECKSUMS.sha256. DO NOT edit manually.",
-  "_version": "1.1.87",
-  "herozion-linux-amd64": "feab66c6df5fee00aab00c3d593882cfcf1f3fd48a546ec7f4f0d0a9ddfc9eb6",
-  "herozion-macos-amd64": "a9dd1fa3e8d57d0b565a22eaaae4cd5eee688eb9860972bdb95c35e94d5789b3",
-  "herozion-macos-arm64": "5484c69d84eb0c568af6144d41cb82c7c9e38a216bb547ee7ef9ab6300c2e86b",
-  "herozion-windows-amd64.exe": "5ef2f7d8a7a4b907ada68b7fc56ce9edb159b674cd7c5c5d6a0669286eafa05d"
+  "_version": "1.1.88",
+  "herozion-linux-amd64": "097a6451cf73b1b2988bf8c79549f88061673c4eb84091a5a133af9274557de3",
+  "herozion-macos-amd64": "24a8d848ca59cff41fc903374614b93777ccd1c03d741ca24f4d1798e5bd6d94",
+  "herozion-macos-arm64": "95148e52080f2a9a79708110663687b21c927f109e51687afb21e34d70215220",
+  "herozion-windows-amd64.exe": "bd874fd07aa25d41b0f73e76db3f741051f358242a04f906f36031dc9d587770"
 }

package/install.js

@@ -151,7 +151,29 @@ function sha256File(filePath) {
 
 
 
+function shouldSkipInstall() {
+  const lifecycle = process.env.npm_lifecycle_event || "";
+  const command = process.env.npm_command || "";
+
+  // Never download during uninstall/remove (some npm versions can invoke scripts).
+  if (command === "uninstall" || command === "remove") {
+    return true;
+  }
+  if (lifecycle === "preuninstall" || lifecycle === "postuninstall") {
+    return true;
+  }
+  // Allow direct `node install.js` (dev) and normal postinstall only.
+  if (lifecycle && lifecycle !== "postinstall") {
+    return true;
+  }
+  return false;
+}
+
 async function main() {
+  if (shouldSkipInstall()) {
+    return;
+  }
+
   const binaryName = getBinaryName();
   const url = `${BASE_URL}/${binaryName}`;
   // The release ships a combined CHECKSUMS.sha256 file, not per-binary .sha256 files.
@@ -166,13 +188,31 @@ async function main() {
   const destPath = path.join(binDir, destName);
   const tmpPath = destPath + ".tmp";
 
-  // Skip download if binary already exists and matches binary version
+  // Skip download only when the on-disk binary matches this npm package version.
   const markerPath = path.join(binDir, `.version-${VERSION}`);
   if (fs.existsSync(destPath) && fs.existsSync(markerPath)) {
     console.log(`herozion: binary v${VERSION} already present, skipping download.`);
     return;
   }
 
+  // Upgrade path: npm bumped the package but postinstall was skipped earlier, or an
+  // old binary (e.g. v1.1.80) is still on disk while package.json is v1.1.87.
+  if (fs.existsSync(destPath) && !fs.existsSync(markerPath)) {
+    console.log(
+      `herozion: replacing stale binary with v${VERSION} (previous install out of date).`
+    );
+    try {
+      fs.unlinkSync(destPath);
+    } catch (_) {}
+    try {
+      for (const entry of fs.readdirSync(binDir)) {
+        if (entry.startsWith(".version-")) {
+          fs.unlinkSync(path.join(binDir, entry));
+        }
+      }
+    } catch (_) {}
+  }
+
   // ── Load bundled checksums (primary trust anchor) ─────────────────────────
   const bundledChecksumsPath = path.join(__dirname, "bin", "checksums.json");
   let bundledHash = "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "herozion",
-  "version": "1.1.87",
+  "version": "1.1.88",
   "description": "Security audit and performance analysis CLI tool for developers",
   "keywords": [
     "security",
@@ -25,10 +25,12 @@
     "bin/herozion.js",
     "bin/checksums.json",
     "install.js",
+    "uninstall.js",
     "README.md"
   ],
   "scripts": {
-    "postinstall": "node install.js"
+    "postinstall": "node install.js",
+    "preuninstall": "node uninstall.js"
   },
   "engines": {
     "node": ">=16.0.0"

package/uninstall.js

@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+/**
+ * Herozion preuninstall script.
+ *
+ * Ensures we never download a binary while npm is removing this package.
+ * npm may invoke lifecycle scripts in edge cases; this script is a no-op cleanup
+ * hook so uninstall stays a true removal.
+ */
+
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+
+const binDir = path.join(__dirname, "bin");
+const targets = ["herozion", "herozion.exe", "herozion.tmp"];
+
+for (const name of targets) {
+  try {
+    fs.unlinkSync(path.join(binDir, name));
+  } catch (_) {
+    // already gone
+  }
+}
+
+try {
+  for (const entry of fs.readdirSync(binDir)) {
+    if (entry.startsWith(".version-")) {
+      try {
+        fs.unlinkSync(path.join(binDir, entry));
+      } catch (_) {}
+    }
+  }
+} catch (_) {}