herozion 1.2.17 → 1.2.19

package/bin/checksums.json

@@ -1,8 +1,8 @@
 {
   "_comment": "SHA-256 hashes for each platform binary. Auto-generated in CI from release CHECKSUMS.sha256. DO NOT edit manually.",
-  "_version": "1.2.17",
-  "herozion-linux-amd64": "52d8e78dd757efa9e7573c01fc686299802a1d3ce16e05e423e70a9c3fa1a8fe",
-  "herozion-macos-amd64": "e36540b6fc5faad7dd55959e3e3b82033cbb74dea277b17c5578059a430bea38",
-  "herozion-macos-arm64": "510ab1d701ee5de81026ad043250d48c19b3213ee7034f67dea9b9c99ad99e8a",
-  "herozion-windows-amd64.exe": "cf5741bc695a18e545be13292e2cafd8ce590a6189810c35784b170654538810"
+  "_version": "1.2.19",
+  "herozion-linux-amd64": "50fcbd8e420554d188c3e6e79d95ad36e67a43c1cc944a0da99ebfd0d6a0ac2a",
+  "herozion-macos-amd64.tar.gz": "31d3c7cdb70ef5ddb01294685f5964e00c0a58e5eb4f8a87e89b0a134dc75edd",
+  "herozion-macos-arm64.tar.gz": "9a04354b02ace79015ea3e7c4aa7a60b6f78e55dd0916ccb100cfdd4eb8a9a7e",
+  "herozion-windows-amd64.exe": "4769290d70dda885c8ee6529ccf93fd5dd1ed6e81bdec2ae7db6fdb978e58fc9"
 }

package/bin/herozion.js

@@ -18,7 +18,29 @@ const fs = require("fs");
 
 const isWindows = process.platform === "win32";
 const binaryName = isWindows ? "herozion.exe" : "herozion";
-const binaryPath = path.join(__dirname, binaryName);
+
+function resolveBinaryPath() {
+  const direct = path.join(__dirname, binaryName);
+  if (fs.existsSync(direct)) {
+    return direct;
+  }
+
+  if (!isWindows) {
+    const runtimeRoot = path.join(__dirname, "runtime");
+    if (fs.existsSync(runtimeRoot)) {
+      for (const entry of fs.readdirSync(runtimeRoot)) {
+        const candidate = path.join(runtimeRoot, entry, entry);
+        if (fs.existsSync(candidate)) {
+          return candidate;
+        }
+      }
+    }
+  }
+
+  return direct;
+}
+
+const binaryPath = resolveBinaryPath();
 
 if (!fs.existsSync(binaryPath)) {
   console.error(

package/install.js

@@ -20,8 +20,8 @@
  * Supported platforms:
  *   Windows  x64  → herozion-windows-amd64.exe
  *   Linux    x64  → herozion-linux-amd64
- *   macOS    arm64 → herozion-macos-arm64
- *   macOS    x64  → herozion-macos-amd64
+ *   macOS    arm64 → herozion-macos-arm64.tar.gz
+ *   macOS    x64  → herozion-macos-amd64.tar.gz
  */
 
 "use strict";
@@ -50,8 +50,8 @@ function getBinaryName() {
     );
   }
   if (platform === "linux" && (arch === "x64" || arch === "ia32")) return "herozion-linux-amd64";
-  if (platform === "darwin" && arch === "arm64") return "herozion-macos-arm64";
-  if (platform === "darwin" && (arch === "x64" || arch === "ia32")) return "herozion-macos-amd64";
+  if (platform === "darwin" && arch === "arm64") return "herozion-macos-arm64.tar.gz";
+  if (platform === "darwin" && (arch === "x64" || arch === "ia32")) return "herozion-macos-amd64.tar.gz";
 
   throw new Error(
     `Herozion: unsupported platform ${platform}/${arch}.\n` +
@@ -151,7 +151,36 @@ function sha256File(filePath) {
 
 
 
-function shouldSkipInstall() {
+function isMacosTarball(binaryName) {
+  return process.platform === "darwin" && binaryName.endsWith(".tar.gz");
+}
+
+function macosBundleFolder(binaryName) {
+  return binaryName.replace(/\.tar\.gz$/, "");
+}
+
+function installMacosOnedirBundle(binDir, tarballPath, bundleFolder) {
+  const runtimeDir = path.join(binDir, "runtime");
+  const bundleDir = path.join(runtimeDir, bundleFolder);
+  const innerBinary = path.join(bundleDir, bundleFolder);
+  const destPath = path.join(binDir, "herozion");
+
+  if (fs.existsSync(runtimeDir)) {
+    fs.rmSync(runtimeDir, { recursive: true, force: true });
+  }
+  fs.mkdirSync(runtimeDir, { recursive: true });
+  execSync(`tar -xzf ${JSON.stringify(tarballPath)} -C ${JSON.stringify(runtimeDir)}`, {
+    stdio: "inherit",
+  });
+  if (!fs.existsSync(innerBinary)) {
+    throw new Error(`Extracted bundle missing executable: ${innerBinary}`);
+  }
+  fs.chmodSync(innerBinary, 0o755);
+  try {
+    fs.unlinkSync(destPath);
+  } catch (_) {}
+  fs.symlinkSync(path.relative(binDir, innerBinary), destPath);
+}
   const lifecycle = process.env.npm_lifecycle_event || "";
   const command = process.env.npm_command || "";
 
@@ -190,20 +219,26 @@ async function main() {
 
   // Skip download only when the on-disk binary matches this npm package version.
   const markerPath = path.join(binDir, `.version-${VERSION}`);
-  if (fs.existsSync(destPath) && fs.existsSync(markerPath)) {
+  const hasInstalledBinary = isMacosTarball(binaryName)
+    ? fs.existsSync(path.join(binDir, "runtime", macosBundleFolder(binaryName), macosBundleFolder(binaryName)))
+    : fs.existsSync(destPath);
+  if (hasInstalledBinary && fs.existsSync(markerPath)) {
     console.log(`herozion: binary v${VERSION} already present, skipping download.`);
     return;
   }
 
   // Upgrade path: npm bumped the package but postinstall was skipped earlier, or an
   // old binary (e.g. v1.1.80) is still on disk while package.json is v1.1.87.
-  if (fs.existsSync(destPath) && !fs.existsSync(markerPath)) {
+  if (hasInstalledBinary && !fs.existsSync(markerPath)) {
     console.log(
       `herozion: replacing stale binary with v${VERSION} (previous install out of date).`
     );
     try {
       fs.unlinkSync(destPath);
     } catch (_) {}
+    try {
+      fs.rmSync(path.join(binDir, "runtime"), { recursive: true, force: true });
+    } catch (_) {}
     try {
       for (const entry of fs.readdirSync(binDir)) {
         if (entry.startsWith(".version-")) {
@@ -301,10 +336,15 @@ async function main() {
       );
     }
 
-    // Verification passed — move binary into place
-    fs.renameSync(tmpPath, destPath);
-    if (!isWindows) {
-      fs.chmodSync(destPath, 0o755);
+    // Verification passed — place binary (or macOS onedir bundle) on disk
+    if (isMacosTarball(binaryName)) {
+      installMacosOnedirBundle(binDir, tmpPath, macosBundleFolder(binaryName));
+      fs.unlinkSync(tmpPath);
+    } else {
+      fs.renameSync(tmpPath, destPath);
+      if (!isWindows) {
+        fs.chmodSync(destPath, 0o755);
+      }
     }
     // Write version marker so we don't re-download on repeated installs
     fs.writeFileSync(markerPath, VERSION, "utf8");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "herozion",
-  "version": "1.2.17",
+  "version": "1.2.19",
   "description": "Security audit and performance analysis CLI tool for developers",
   "keywords": [
     "security",