herozion 1.2.18 → 1.2.21

package/bin/checksums.json

@@ -1,8 +1,8 @@
 {
   "_comment": "SHA-256 hashes for each platform binary. Auto-generated in CI from release CHECKSUMS.sha256. DO NOT edit manually.",
-  "_version": "1.2.18",
-  "herozion-linux-amd64": "0b5b3567b3a1e406f1e76f429a3cac42239090776770893503e1b02a41477abe",
-  "herozion-macos-amd64": "bea591d89e92c74952e10764494ea9716a8c7c6baccdd56a1b39a7492ebd45f8",
-  "herozion-macos-arm64": "2b7a7f9d408a537ade7aacf7e922a570f5e91b7d4e8704ed1f87371c38674adb",
-  "herozion-windows-amd64.exe": "b75d5afffd05088681ae40265e79d0c424dee70abb15d334518e183e12a059c6"
+  "_version": "1.2.21",
+  "herozion-linux-amd64": "bb6f1e265aeedfa1682a79bf23aa31974fc7c1574ca46de749f7ba5389701d27",
+  "herozion-macos-amd64.tar.gz": "d2bba8f4e864d0a3cb7311e0d0cd4a81b7a555ab8d22744240f8dd51c93c0abd",
+  "herozion-macos-arm64.tar.gz": "88c3c7068816511cce9e8ab5674ba9d19324969e7fd1f6a3ebe6687be3be7bd5",
+  "herozion-windows-amd64.exe": "bea4f187a14394a5c866896a1ba0b9079833af5ab6e046d5556a37699cec958a"
 }

package/bin/herozion.js

@@ -18,7 +18,29 @@ const fs = require("fs");
 
 const isWindows = process.platform === "win32";
 const binaryName = isWindows ? "herozion.exe" : "herozion";
-const binaryPath = path.join(__dirname, binaryName);
+
+function resolveBinaryPath() {
+  const direct = path.join(__dirname, binaryName);
+  if (fs.existsSync(direct)) {
+    return direct;
+  }
+
+  if (!isWindows) {
+    const runtimeRoot = path.join(__dirname, "runtime");
+    if (fs.existsSync(runtimeRoot)) {
+      for (const entry of fs.readdirSync(runtimeRoot)) {
+        const candidate = path.join(runtimeRoot, entry, entry);
+        if (fs.existsSync(candidate)) {
+          return candidate;
+        }
+      }
+    }
+  }
+
+  return direct;
+}
+
+const binaryPath = resolveBinaryPath();
 
 if (!fs.existsSync(binaryPath)) {
   console.error(

package/install.js

@@ -20,8 +20,8 @@
  * Supported platforms:
  *   Windows  x64  → herozion-windows-amd64.exe
  *   Linux    x64  → herozion-linux-amd64
- *   macOS    arm64 → herozion-macos-arm64
- *   macOS    x64  → herozion-macos-amd64
+ *   macOS    arm64 → herozion-macos-arm64.tar.gz
+ *   macOS    x64  → herozion-macos-amd64.tar.gz
  */
 
 "use strict";
@@ -50,8 +50,8 @@ function getBinaryName() {
     );
   }
   if (platform === "linux" && (arch === "x64" || arch === "ia32")) return "herozion-linux-amd64";
-  if (platform === "darwin" && arch === "arm64") return "herozion-macos-arm64";
-  if (platform === "darwin" && (arch === "x64" || arch === "ia32")) return "herozion-macos-amd64";
+  if (platform === "darwin" && arch === "arm64") return "herozion-macos-arm64.tar.gz";
+  if (platform === "darwin" && (arch === "x64" || arch === "ia32")) return "herozion-macos-amd64.tar.gz";
 
   throw new Error(
     `Herozion: unsupported platform ${platform}/${arch}.\n` +
@@ -151,7 +151,36 @@ function sha256File(filePath) {
 
 
 
-function shouldSkipInstall() {
+function isMacosTarball(binaryName) {
+  return process.platform === "darwin" && binaryName.endsWith(".tar.gz");
+}
+
+function macosBundleFolder(binaryName) {
+  return binaryName.replace(/\.tar\.gz$/, "");
+}
+
+function installMacosOnedirBundle(binDir, tarballPath, bundleFolder) {
+  const runtimeDir = path.join(binDir, "runtime");
+  const bundleDir = path.join(runtimeDir, bundleFolder);
+  const innerBinary = path.join(bundleDir, bundleFolder);
+  const destPath = path.join(binDir, "herozion");
+
+  if (fs.existsSync(runtimeDir)) {
+    fs.rmSync(runtimeDir, { recursive: true, force: true });
+  }
+  fs.mkdirSync(runtimeDir, { recursive: true });
+  execSync(`tar -xzf ${JSON.stringify(tarballPath)} -C ${JSON.stringify(runtimeDir)}`, {
+    stdio: "inherit",
+  });
+  if (!fs.existsSync(innerBinary)) {
+    throw new Error(`Extracted bundle missing executable: ${innerBinary}`);
+  }
+  fs.chmodSync(innerBinary, 0o755);
+  try {
+    fs.unlinkSync(destPath);
+  } catch (_) {}
+  fs.symlinkSync(path.relative(binDir, innerBinary), destPath);
+}
   const lifecycle = process.env.npm_lifecycle_event || "";
   const command = process.env.npm_command || "";
 
@@ -190,20 +219,26 @@ async function main() {
 
   // Skip download only when the on-disk binary matches this npm package version.
   const markerPath = path.join(binDir, `.version-${VERSION}`);
-  if (fs.existsSync(destPath) && fs.existsSync(markerPath)) {
+  const hasInstalledBinary = isMacosTarball(binaryName)
+    ? fs.existsSync(path.join(binDir, "runtime", macosBundleFolder(binaryName), macosBundleFolder(binaryName)))
+    : fs.existsSync(destPath);
+  if (hasInstalledBinary && fs.existsSync(markerPath)) {
     console.log(`herozion: binary v${VERSION} already present, skipping download.`);
     return;
   }
 
   // Upgrade path: npm bumped the package but postinstall was skipped earlier, or an
   // old binary (e.g. v1.1.80) is still on disk while package.json is v1.1.87.
-  if (fs.existsSync(destPath) && !fs.existsSync(markerPath)) {
+  if (hasInstalledBinary && !fs.existsSync(markerPath)) {
     console.log(
       `herozion: replacing stale binary with v${VERSION} (previous install out of date).`
     );
     try {
       fs.unlinkSync(destPath);
     } catch (_) {}
+    try {
+      fs.rmSync(path.join(binDir, "runtime"), { recursive: true, force: true });
+    } catch (_) {}
     try {
       for (const entry of fs.readdirSync(binDir)) {
         if (entry.startsWith(".version-")) {
@@ -301,10 +336,15 @@ async function main() {
       );
     }
 
-    // Verification passed — move binary into place
-    fs.renameSync(tmpPath, destPath);
-    if (!isWindows) {
-      fs.chmodSync(destPath, 0o755);
+    // Verification passed — place binary (or macOS onedir bundle) on disk
+    if (isMacosTarball(binaryName)) {
+      installMacosOnedirBundle(binDir, tmpPath, macosBundleFolder(binaryName));
+      fs.unlinkSync(tmpPath);
+    } else {
+      fs.renameSync(tmpPath, destPath);
+      if (!isWindows) {
+        fs.chmodSync(destPath, 0o755);
+      }
     }
     // Write version marker so we don't re-download on repeated installs
     fs.writeFileSync(markerPath, VERSION, "utf8");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "herozion",
-  "version": "1.2.18",
+  "version": "1.2.21",
   "description": "Security audit and performance analysis CLI tool for developers",
   "keywords": [
     "security",