infynon 0.2.5 → 0.2.7

package/README.md

@@ -1,19 +1,26 @@
 # infynon
 
-INFYNON is a security-first CLI for package intelligence, API flow testing, repository memory, and bounded AI task execution.
+[![npm version](https://img.shields.io/npm/v/infynon?style=flat-square&logo=npm)](https://www.npmjs.com/package/infynon)
+[![npm downloads](https://img.shields.io/badge/dynamic/json?style=flat-square&logo=npm&label=npm%20downloads&query=%24.downloads&url=https%3A%2F%2Fapi.npmjs.org%2Fdownloads%2Fpoint%2F2025-05-04%3A2050-12-31%2Finfynon&cacheSeconds=3600)](https://www.npmjs.com/package/infynon)
+[![GitHub release](https://img.shields.io/github/v/release/d4rkNinja/infynon-cli?style=flat-square&logo=github)](https://github.com/d4rkNinja/infynon-cli/releases)
+[![Agent control plane](https://img.shields.io/badge/agent%20control%20plane-Codex%20%7C%20Claude%20%7C%20Gemini-7c3aed?style=flat-square)](https://github.com/d4rkNinja/infynon-cli/blob/main/docs/agent-control-plane.md)
+[![Package security](https://img.shields.io/badge/pkg-secure%20installs-ef4444?style=flat-square)](https://github.com/d4rkNinja/infynon-cli/blob/main/docs/commands.md)
 
-This npm package is the official installer wrapper for the INFYNON native binary. It does not contain the Rust source code. During installation, it downloads the matching prebuilt binary from the official GitHub Releases page.
+INFYNON is a terminal control plane for agentic engineering: multi-agent workspace/task orchestration, package intelligence, API flow testing, and repository memory in one native CLI.
+
+This npm package is the official wrapper for the INFYNON native binary. npm installs the matching optional platform package when available; otherwise the wrapper downloads and verifies the matching GitHub Release binary on first launch. The public distribution repo includes installers, npm/go wrappers, docs, and release assets; the core Rust implementation is not included.
 
 ## Why Install INFYNON
 
-INFYNON is built for teams that need one terminal tool for four connected workflows:
+INFYNON is built for teams that need one terminal tool for five connected workflows:
 
 | Workflow | Command Area | Purpose |
 |---|---|---|
+| Agent control plane | `infynon workspace`, `infynon task`, `infynon coding` | Coordinate Codex, Claude Code, Gemini CLI, and child agent sessions through durable workspace and task records. |
 | Package intelligence | `infynon pkg` | Scan dependencies, inspect risk, audit package changes, and support safer install workflows. |
 | API flow testing | `infynon weave` | Run multi-step API flows with context passed between requests. |
 | Repository memory | `infynon trace` | Preserve structured handoff notes, branch context, package ownership, and repo memory. |
-| Agent task contracts | `infynon task` | Turn vague AI work requests into GCCD task briefs with a goal, context, constraints, and completion criteria. |
+| Agent task contracts | GCCD briefs | Turn vague AI work requests into Goal, Context, Constraints, and Done When. |
 
 ## Install
 
@@ -21,7 +28,7 @@ INFYNON is built for teams that need one terminal tool for four connected workfl
 npm install -g infynon
 ```
 
-The installer downloads the binary for the current platform and makes `infynon` available through npm's global binary directory.
+npm installs the wrapper and, when available, the matching optional native package for the current platform. If the optional package is unavailable, first launch downloads and verifies the matching GitHub Release binary.
 
 ## Supported Platforms
 
@@ -33,17 +40,55 @@ The installer downloads the binary for the current platform and makes `infynon`
 
 Unsupported platforms can still install the npm wrapper, but the wrapper will not be able to download a native binary until a matching release asset exists.
 
+## Provenance and Platform Packages
+
+INFYNON npm packages are configured for npm provenance from the release pipeline. Provenance links the published package to the GitHub Actions workflow that produced it.
+
+The package can use optional native binary packages:
+
+- `@infynon/cli-win32-x64`
+- `@infynon/cli-linux-x64`
+- `@infynon/cli-linux-arm64`
+- `@infynon/cli-darwin-x64`
+- `@infynon/cli-darwin-arm64`
+
 ## Quick Start
 
 ```bash
 infynon --help
+infynon workspace agent-root-show
 infynon pkg scan
 infynon pkg audit
 infynon weave flow run checkout
 infynon trace tui
-infynon task create task_001 --mutate --workspace . --prompt "Ship the settings API patch"
+infynon task create task_001 --mutate --workspace app --agent codex --prompt "Ship the settings API patch"
+```
+
+## Agent Control Plane
+
+Use INFYNON when one lead session needs to coordinate child coding agents.
+
+```bash
+infynon workspace agent-root-set --mutate --path D:/Codeverse/infynon-agent
+infynon workspace create app --mutate --folder-name web --path D:/Codeverse/app --default
+
+infynon task create task_ui_review \
+  --mutate \
+  --workspace app \
+  --folder-name web \
+  --agent claude \
+  --prompt "Review the settings UI change. Do not edit backend files. Done when findings are recorded."
+
+infynon coding tui
 ```
 
+Good fit:
+
+- parent and child agent work
+- Codex, Claude Code, and Gemini CLI sessions launched from the right workspace
+- task retries where context and completion criteria must stay intact
+- reviewable handoffs between agents and humans
+
 ## Package Intelligence
 
 Use `infynon pkg` to inspect dependency risk and package state.
@@ -113,7 +158,6 @@ infynon task create task_001 \
 
 Good fit:
 
-- parent and child agent work
 - scoped implementation tasks
 - reviewable handoffs
 - retries where completion criteria must stay intact
@@ -155,10 +199,14 @@ https://github.com/d4rkNinja/infynon-cli/releases
 ## Documentation
 
 - Public docs: https://github.com/d4rkNinja/infynon-cli/tree/main/docs
+- Agent control plane: https://github.com/d4rkNinja/infynon-cli/blob/main/docs/agent-control-plane.md
+- AI agent workflow: https://github.com/d4rkNinja/infynon-cli/blob/main/docs/ai-agent-workflow.md
 - GCCD task contracts: https://github.com/d4rkNinja/infynon-cli/blob/main/docs/gccd.md
+- npm install: https://github.com/d4rkNinja/infynon-cli/blob/main/docs/npm-install.md
+- Windows troubleshooting: https://github.com/d4rkNinja/infynon-cli/blob/main/docs/windows-troubleshooting.md
 - Releases: https://github.com/d4rkNinja/infynon-cli/releases
 - Issues: https://github.com/d4rkNinja/infynon-cli/issues
 
 ## Source Availability
 
-This npm package distributes the INFYNON binary and installer wrapper only. The Rust source code is proprietary and is not bundled in this package.
+This npm package distributes the INFYNON binary and installer wrapper only. The core Rust implementation is not bundled in this package.

package/package.json

@@ -1,36 +1,55 @@
 {
-    "name":  "infynon",
-    "version":  "0.2.5",
-    "description":  "Thin npm installer for the proprietary INFYNON CLI binary releases.",
-    "bin":  {
-                "infynon":  "run.js",
-                "infynon-pkg":  "run-pkg.js"
-            },
-    "scripts":  {
-                    "postinstall":  "node postinstall.js",
-                    "preuninstall":  "node preuninstall.js"
-                },
-    "files":  [
-                  "LICENSE",
-                  "run.js",
-                  "run-pkg.js",
-                  "postinstall.js",
-                  "preuninstall.js"
-              ],
-    "engines":  {
-                    "node":  "\u003e=14.14"
-                },
-    "author":  "d4rkNinja",
-    "license":  "SEE LICENSE IN LICENSE",
-    "repository":  {
-                       "type":  "git",
-                       "url":  "git+https://github.com/d4rkNinja/infynon-cli.git"
-                   },
-    "bugs":  {
-                 "url":  "https://github.com/d4rkNinja/infynon-cli/issues"
-             },
-    "homepage":  "https://github.com/d4rkNinja/infynon-cli#readme",
-    "publishConfig":  {
-                          "access":  "public"
-                      }
+  "name": "infynon",
+  "version": "0.2.7",
+  "description": "Security-first CLI for AI-assisted development: safe package installs, dependency scanning, API flow testing, and agent task orchestration.",
+  "bin": {
+    "infynon": "run.js",
+    "infynon-pkg": "run-pkg.js"
+  },
+  "files": [
+    "README.md",
+    "LICENSE",
+    "run.js",
+    "run-pkg.js",
+    "postinstall.js",
+    "preuninstall.js"
+  ],
+  "optionalDependencies": {
+    "@infynon/cli-win32-x64": "0.2.7",
+    "@infynon/cli-linux-x64": "0.2.7",
+    "@infynon/cli-linux-arm64": "0.2.7",
+    "@infynon/cli-darwin-x64": "0.2.7",
+    "@infynon/cli-darwin-arm64": "0.2.7"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "packageManager": "npm@11.8.0",
+  "author": "d4rkNinja",
+  "license": "SEE LICENSE IN LICENSE",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/d4rkNinja/infynon-cli.git",
+    "directory": "npm"
+  },
+  "bugs": {
+    "url": "https://github.com/d4rkNinja/infynon-cli/issues"
+  },
+  "homepage": "https://cli.infynon.com",
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "keywords": [
+    "cli",
+    "security",
+    "supply-chain",
+    "dependency-scanning",
+    "ai-agents",
+    "claude-code",
+    "codex",
+    "gemini-cli",
+    "api-testing",
+    "devtools"
+  ]
 }

package/postinstall.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 "use strict";
 
+const crypto = require("crypto");
 const https = require("https");
 const fs = require("fs");
 const path = require("path");
@@ -10,27 +11,75 @@ const REPO = "d4rkNinja/infynon-cli";
 const VERSION = require("./package.json").version;
 const BIN_DIR = path.join(__dirname, "bin");
 const BIN_PATH = path.join(BIN_DIR, process.platform === "win32" ? "infynon.exe" : "infynon");
+const TEMP_BIN_PATH = BIN_PATH + ".download-" + process.pid;
+const TEMP_CHECKSUMS_PATH = BIN_PATH + ".checksums-" + process.pid + ".txt";
+const TEMP_MANIFEST_PATH = BIN_PATH + ".manifest-" + process.pid + ".json";
 
 function getTarget() {
-  if (process.platform === "win32" && process.arch === "x64") return { target: "x86_64-pc-windows-msvc", ext: ".exe" };
-  if (process.platform === "linux" && process.arch === "x64") return { target: "x86_64-unknown-linux-musl", ext: "" };
-  if (process.platform === "linux" && process.arch === "arm64") return { target: "aarch64-unknown-linux-musl", ext: "" };
-  if (process.platform === "darwin" && process.arch === "x64") return { target: "x86_64-apple-darwin", ext: "" };
-  if (process.platform === "darwin" && process.arch === "arm64") return { target: "aarch64-apple-darwin", ext: "" };
+  if (process.platform === "win32" && process.arch === "x64") {
+    return {
+      target: "x86_64-pc-windows-msvc",
+      ext: ".exe",
+      packageName: "@infynon/cli-win32-x64",
+      binaryName: "infynon.exe",
+    };
+  }
+  if (process.platform === "linux" && process.arch === "x64") {
+    return {
+      target: "x86_64-unknown-linux-musl",
+      ext: "",
+      packageName: "@infynon/cli-linux-x64",
+      binaryName: "infynon",
+    };
+  }
+  if (process.platform === "linux" && process.arch === "arm64") {
+    return {
+      target: "aarch64-unknown-linux-musl",
+      ext: "",
+      packageName: "@infynon/cli-linux-arm64",
+      binaryName: "infynon",
+    };
+  }
+  if (process.platform === "darwin" && process.arch === "x64") {
+    return {
+      target: "x86_64-apple-darwin",
+      ext: "",
+      packageName: "@infynon/cli-darwin-x64",
+      binaryName: "infynon",
+    };
+  }
+  if (process.platform === "darwin" && process.arch === "arm64") {
+    return {
+      target: "aarch64-apple-darwin",
+      ext: "",
+      packageName: "@infynon/cli-darwin-arm64",
+      binaryName: "infynon",
+    };
+  }
   return null;
 }
 
 function downloadFile(url, dest, redirects) {
   redirects = redirects === undefined ? 0 : redirects;
   if (redirects > 5) {
-    throw new Error("Too many redirects while downloading binary");
+    return Promise.reject(new Error("Too many redirects while downloading binary"));
   }
 
   return new Promise(function (resolve, reject) {
     https
       .get(url, { headers: { "User-Agent": "infynon-npm-installer" } }, function (res) {
-        if (res.statusCode === 301 || res.statusCode === 302) {
-          return downloadFile(res.headers.location, dest, redirects + 1)
+        if (res.statusCode >= 300 && res.statusCode < 400) {
+          res.resume();
+          if (!res.headers.location) {
+            return reject(new Error("Redirect response did not include a Location header"));
+          }
+          let nextUrl;
+          try {
+            nextUrl = new URL(res.headers.location, url).toString();
+          } catch (err) {
+            return reject(err);
+          }
+          return downloadFile(nextUrl, dest, redirects + 1)
             .then(resolve)
             .catch(reject);
         }
@@ -48,6 +97,12 @@ function downloadFile(url, dest, redirects) {
         file.on("finish", function () {
           file.close(resolve);
         });
+        res.on("error", function (err) {
+          file.close(function () {
+            fs.unlink(dest, function () {});
+            reject(err);
+          });
+        });
         res.pipe(file);
       })
       .on("error", function (err) {
@@ -57,21 +112,280 @@ function downloadFile(url, dest, redirects) {
   });
 }
 
-function verifyBinary() {
-  const result = spawnSync(BIN_PATH, ["--version"], {
+function removeQuietly(filePath) {
+  try {
+    fs.rmSync(filePath, { force: true });
+  } catch (_) {}
+}
+
+function isFile(filePath) {
+  try {
+    return fs.statSync(filePath).isFile();
+  } catch (_) {
+    return false;
+  }
+}
+
+function checksumForAsset(checksumsText, assetName) {
+  const lines = checksumsText.split(/\r?\n/);
+  for (const line of lines) {
+    const match = line.match(/^([a-fA-F0-9]{64})\s+[* ]?(.+)$/);
+    if (!match) continue;
+    if (path.basename(match[2].trim()) === assetName) {
+      return match[1].toLowerCase();
+    }
+  }
+  throw new Error("checksums.txt does not include " + assetName);
+}
+
+function sha256File(filePath) {
+  return crypto.createHash("sha256").update(fs.readFileSync(filePath)).digest("hex");
+}
+
+function verifyChecksum(checksumsPath, filePath, assetName) {
+  const expected = checksumForAsset(fs.readFileSync(checksumsPath, "utf8"), assetName);
+  const actual = sha256File(filePath);
+  if (actual !== expected) {
+    throw new Error("SHA-256 mismatch for " + assetName);
+  }
+}
+
+function unavailable(message) {
+  const err = new Error(message);
+  err.fallbackAllowed = true;
+  return err;
+}
+
+function integrityFailure(message) {
+  const err = new Error(message);
+  err.integrityFailure = true;
+  return err;
+}
+
+function basenameMatches(value, assetName) {
+  return typeof value === "string" && path.basename(value) === assetName;
+}
+
+function entryName(entry) {
+  if (!entry || typeof entry !== "object") {
+    return null;
+  }
+  return entry.name || entry.filename || entry.file || entry.path || entry.asset || entry.asset_name || null;
+}
+
+function objectEntryForAsset(objectValue, assetName) {
+  if (!objectValue || typeof objectValue !== "object" || Array.isArray(objectValue)) {
+    return null;
+  }
+
+  if (Object.prototype.hasOwnProperty.call(objectValue, assetName)) {
+    const value = objectValue[assetName];
+    if (value && typeof value === "object") {
+      return Object.assign({ name: assetName }, value);
+    }
+    return { name: assetName, sha256: value };
+  }
+
+  for (const key of Object.keys(objectValue)) {
+    const value = objectValue[key];
+    if (path.basename(key) === assetName) {
+      if (value && typeof value === "object") {
+        return Object.assign({ name: key }, value);
+      }
+      return { name: key, sha256: value };
+    }
+    if (value && typeof value === "object" && basenameMatches(entryName(value), assetName)) {
+      return value;
+    }
+  }
+
+  return null;
+}
+
+function findManifestEntry(manifest, assetName) {
+  if (basenameMatches(entryName(manifest), assetName)) {
+    return manifest;
+  }
+
+  const collections = [
+    manifest && manifest.assets,
+    manifest && manifest.files,
+    manifest && manifest.binaries,
+    manifest && manifest.artifacts,
+    manifest && manifest.release_assets,
+  ];
+
+  for (const collection of collections) {
+    if (Array.isArray(collection)) {
+      for (const entry of collection) {
+        if (basenameMatches(entryName(entry), assetName)) {
+          return entry;
+        }
+      }
+    } else {
+      const entry = objectEntryForAsset(collection, assetName);
+      if (entry) {
+        return entry;
+      }
+    }
+  }
+
+  return objectEntryForAsset(manifest, assetName);
+}
+
+function fieldValue(entry, names) {
+  for (const name of names) {
+    if (Object.prototype.hasOwnProperty.call(entry, name)) {
+      return entry[name];
+    }
+  }
+  return null;
+}
+
+function normalizeSha256(value) {
+  if (typeof value !== "string") {
+    return null;
+  }
+  const normalized = value.trim().toLowerCase().replace(/^sha256[:=\s]+/, "");
+  if (/^[a-f0-9]{64}$/.test(normalized)) {
+    return normalized;
+  }
+  return null;
+}
+
+function normalizeSize(value) {
+  if (typeof value === "number" && Number.isSafeInteger(value) && value >= 0) {
+    return value;
+  }
+  if (typeof value === "string" && /^\d+$/.test(value.trim())) {
+    const parsed = Number(value.trim());
+    if (Number.isSafeInteger(parsed)) {
+      return parsed;
+    }
+  }
+  return null;
+}
+
+function manifestVerificationForAsset(manifestPath, assetName) {
+  let manifest;
+  try {
+    manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+  } catch (err) {
+    throw unavailable("release-manifest.json is not valid JSON: " + err.message);
+  }
+
+  const entry = findManifestEntry(manifest, assetName);
+  if (!entry) {
+    throw unavailable("release-manifest.json does not include " + assetName);
+  }
+
+  const sha256 = normalizeSha256(
+    fieldValue(entry, ["sha256", "sha_256", "sha256sum", "checksum", "digest"])
+  );
+  if (!sha256) {
+    throw unavailable("release-manifest.json does not include a SHA-256 for " + assetName);
+  }
+
+  const size = normalizeSize(fieldValue(entry, ["size", "size_bytes", "bytes", "length"]));
+  if (size === null) {
+    throw unavailable("release-manifest.json does not include a size for " + assetName);
+  }
+
+  return { sha256: sha256, size: size };
+}
+
+async function fetchManifestVerification(manifestUrl, assetName) {
+  try {
+    removeQuietly(TEMP_MANIFEST_PATH);
+    await downloadFile(manifestUrl, TEMP_MANIFEST_PATH);
+    return manifestVerificationForAsset(TEMP_MANIFEST_PATH, assetName);
+  } catch (err) {
+    if (err && err.integrityFailure) {
+      throw err;
+    }
+    console.warn("[infynon] release-manifest.json verification unavailable: " + err.message);
+    console.warn("[infynon] Falling back to checksums.txt.");
+    return null;
+  } finally {
+    removeQuietly(TEMP_MANIFEST_PATH);
+  }
+}
+
+function verifyManifestAsset(expected, filePath, assetName) {
+  const actualSize = fs.statSync(filePath).size;
+  if (actualSize !== expected.size) {
+    throw integrityFailure("Size mismatch for " + assetName);
+  }
+  const actualSha256 = sha256File(filePath);
+  if (actualSha256 !== expected.sha256) {
+    throw integrityFailure("SHA-256 mismatch for " + assetName);
+  }
+}
+
+function verifyBinary(binaryPath, label) {
+  const result = spawnSync(binaryPath, ["--version"], {
     encoding: "utf8",
     windowsHide: true,
   });
   if (result.error) {
-    throw new Error("Downloaded binary is not executable: " + result.error.message);
+    throw new Error(label + " is not executable: " + result.error.message);
   }
   if (result.status !== 0) {
     const detail = (result.stderr || result.stdout || "").trim();
     throw new Error(
-      "Downloaded binary failed verification" +
-      (detail ? ": " + detail : " with exit code " + result.status)
+      label + " failed verification" + (detail ? ": " + detail : " with exit code " + result.status)
     );
   }
+  const versionFields = String((result.stdout || "") + " " + (result.stderr || ""))
+    .trim()
+    .split(/\s+/)
+    .map(function (field) {
+      return field.replace(/^v/, "");
+    });
+  if (versionFields.indexOf(VERSION) === -1) {
+    throw new Error(label + " did not report version " + VERSION);
+  }
+}
+
+function resolvePlatformPackageBinary(info) {
+  let packageJsonPath;
+  try {
+    packageJsonPath = require.resolve(info.packageName + "/package.json", { paths: [__dirname] });
+  } catch (err) {
+    if (err && err.code !== "MODULE_NOT_FOUND") {
+      console.warn("[infynon] Could not inspect " + info.packageName + ": " + err.message);
+    }
+    return null;
+  }
+
+  let packageVersion = null;
+  try {
+    packageVersion = JSON.parse(fs.readFileSync(packageJsonPath, "utf8")).version;
+  } catch (err) {
+    console.warn("[infynon] Could not read " + info.packageName + " metadata: " + err.message);
+    return null;
+  }
+
+  if (packageVersion !== VERSION) {
+    console.warn(
+      "[infynon] Ignoring " +
+        info.packageName +
+        " " +
+        packageVersion +
+        "; expected wrapper version " +
+        VERSION +
+        "."
+    );
+    return null;
+  }
+
+  const binaryPath = path.join(path.dirname(packageJsonPath), "bin", info.binaryName);
+  if (!isFile(binaryPath)) {
+    console.warn("[infynon] Ignoring " + info.packageName + "; missing binary at " + binaryPath + ".");
+    return null;
+  }
+
+  return { path: binaryPath, packageName: info.packageName };
 }
 
 async function main() {
@@ -79,15 +393,36 @@ async function main() {
 
   if (!info) {
     console.warn(
-      "[infynon] Unsupported platform: " + process.platform + " " + process.arch + ".\n" +
-      "         Download a release manually: https://github.com/" + REPO + "/releases"
+      "[infynon] Unsupported platform: " +
+        process.platform +
+        " " +
+        process.arch +
+        ".\n" +
+        "         Download a release manually: https://github.com/" +
+        REPO +
+        "/releases"
     );
     process.exit(0);
   }
 
+  const platformBinary = resolvePlatformPackageBinary(info);
+  if (platformBinary) {
+    try {
+      verifyBinary(platformBinary.path, "Installed platform package " + platformBinary.packageName);
+    } catch (err) {
+      console.error("[infynon] Platform package verification failed: " + err.message);
+      console.error("[infynon] Reinstall after the package is corrected: npm install -g infynon");
+      process.exit(1);
+    }
+    console.log("[infynon] Using installed native package " + platformBinary.packageName + ".");
+    return;
+  }
+
   const tag = "v" + VERSION;
   const assetName = "infynon-" + info.target + info.ext;
   const url = "https://github.com/" + REPO + "/releases/download/" + tag + "/" + assetName;
+  const manifestUrl = "https://github.com/" + REPO + "/releases/download/" + tag + "/release-manifest.json";
+  const checksumsUrl = "https://github.com/" + REPO + "/releases/download/" + tag + "/checksums.txt";
 
   if (!fs.existsSync(BIN_DIR)) {
     fs.mkdirSync(BIN_DIR, { recursive: true });
@@ -96,11 +431,31 @@ async function main() {
   console.log("[infynon] Downloading " + assetName + " from " + tag + " release...");
 
   try {
-    await downloadFile(url, BIN_PATH);
+    removeQuietly(TEMP_BIN_PATH);
+    removeQuietly(TEMP_CHECKSUMS_PATH);
+    removeQuietly(TEMP_MANIFEST_PATH);
+
+    const manifestVerification = await fetchManifestVerification(manifestUrl, assetName);
+    await downloadFile(url, TEMP_BIN_PATH);
+    if (manifestVerification) {
+      verifyManifestAsset(manifestVerification, TEMP_BIN_PATH, assetName);
+    } else {
+      await downloadFile(checksumsUrl, TEMP_CHECKSUMS_PATH);
+      verifyChecksum(TEMP_CHECKSUMS_PATH, TEMP_BIN_PATH, assetName);
+    }
+
+    removeQuietly(BIN_PATH);
+    fs.renameSync(TEMP_BIN_PATH, BIN_PATH);
   } catch (err) {
+    removeQuietly(TEMP_BIN_PATH);
+    removeQuietly(TEMP_CHECKSUMS_PATH);
+    removeQuietly(TEMP_MANIFEST_PATH);
     console.error("[infynon] Download failed: " + err.message);
     console.error("[infynon] Manual install: https://github.com/" + REPO + "/releases/tag/" + tag);
     process.exit(1);
+  } finally {
+    removeQuietly(TEMP_CHECKSUMS_PATH);
+    removeQuietly(TEMP_MANIFEST_PATH);
   }
 
   if (process.platform !== "win32") {
@@ -108,9 +463,9 @@ async function main() {
   }
 
   try {
-    verifyBinary();
+    verifyBinary(BIN_PATH, "Downloaded binary");
   } catch (err) {
-    fs.unlink(BIN_PATH, function () {});
+    removeQuietly(BIN_PATH);
     console.error("[infynon] Binary verification failed: " + err.message);
     console.error("[infynon] Reinstall after the release asset is corrected: npm install -g infynon");
     process.exit(1);

package/preuninstall.js

@@ -3,54 +3,9 @@
 
 const fs = require("fs");
 const path = require("path");
-const os = require("os");
 
-// Mirror the same path logic as src/firewall/config.rs → config_dir()
-const INFYNON_DIR = path.join(os.homedir(), ".infynon");
+const BIN_DIR = path.join(__dirname, "bin");
 
-// Files/dirs managed by infynon that live outside the npm package
-const MANAGED_PATHS = [
-  { p: path.join(INFYNON_DIR, "infynon.toml"),    label: "firewall config" },
-  { p: path.join(INFYNON_DIR, "eagle-eye.toml"),  label: "eagle eye config" },
-  { p: path.join(INFYNON_DIR, "access.jsonl"),    label: "access log" },
-  { p: path.join(INFYNON_DIR, "blocked.jsonl"),   label: "blocked log" },
-  { p: path.join(INFYNON_DIR, "sbom.json"),       label: "SBOM" },
-];
-
-console.log("\n[infynon] Cleaning up...\n");
-
-let removed = 0;
-
-for (const { p, label } of MANAGED_PATHS) {
-  if (fs.existsSync(p)) {
-    try {
-      fs.rmSync(p, { force: true });
-      console.log("  removed  " + label + " (" + p + ")");
-      removed++;
-    } catch (err) {
-      console.warn("  skipped  " + label + " — " + err.message);
-    }
-  }
-}
-
-// Remove ~/.infynon/ itself if it is now empty
-if (fs.existsSync(INFYNON_DIR)) {
-  try {
-    const remaining = fs.readdirSync(INFYNON_DIR);
-    if (remaining.length === 0) {
-      fs.rmdirSync(INFYNON_DIR);
-      console.log("  removed  ~/.infynon/ directory");
-    } else {
-      console.log(
-        "  kept     ~/.infynon/ — " + remaining.length +
-        " user file(s) remain: " + remaining.join(", ")
-      );
-    }
-  } catch (_) {}
-}
-
-if (removed === 0) {
-  console.log("  nothing to clean up.\n");
-} else {
-  console.log("\n[infynon] Clean uninstall complete.\n");
+if (fs.existsSync(BIN_DIR)) {
+  fs.rmSync(BIN_DIR, { recursive: true, force: true });
 }

package/run.js

@@ -1,45 +1,265 @@
 #!/usr/bin/env node
 "use strict";
 
-const path = require("path");
-const { spawnSync } = require("child_process");
 const fs = require("fs");
+const path = require("path");
+const { spawn } = require("child_process");
 
-const BIN_PATH = path.join(
-  __dirname,
+const PACKAGE_DIR = __dirname;
+const VERSION = require("./package.json").version;
+const RELEASES_URL = "https://github.com/d4rkNinja/infynon-cli/releases";
+const LOCAL_BIN_PATH = path.join(
+  PACKAGE_DIR,
   "bin",
   process.platform === "win32" ? "infynon.exe" : "infynon"
 );
+const POSTINSTALL_PATH = path.join(PACKAGE_DIR, "postinstall.js");
+
+function getPlatformPackage() {
+  if (process.platform === "win32" && process.arch === "x64") {
+    return { packageName: "@infynon/cli-win32-x64", binaryName: "infynon.exe" };
+  }
+  if (process.platform === "linux" && process.arch === "x64") {
+    return { packageName: "@infynon/cli-linux-x64", binaryName: "infynon" };
+  }
+  if (process.platform === "linux" && process.arch === "arm64") {
+    return { packageName: "@infynon/cli-linux-arm64", binaryName: "infynon" };
+  }
+  if (process.platform === "darwin" && process.arch === "x64") {
+    return { packageName: "@infynon/cli-darwin-x64", binaryName: "infynon" };
+  }
+  if (process.platform === "darwin" && process.arch === "arm64") {
+    return { packageName: "@infynon/cli-darwin-arm64", binaryName: "infynon" };
+  }
+  return null;
+}
+
+function isFile(filePath) {
+  try {
+    return fs.statSync(filePath).isFile();
+  } catch (_) {
+    return false;
+  }
+}
+
+function resolvePlatformBinary(notes) {
+  const info = getPlatformPackage();
+  if (!info) {
+    notes.push("No optional native package is published for " + process.platform + " " + process.arch + ".");
+    return null;
+  }
+
+  let packageJsonPath;
+  try {
+    packageJsonPath = require.resolve(info.packageName + "/package.json", { paths: [PACKAGE_DIR] });
+  } catch (err) {
+    if (err && err.code !== "MODULE_NOT_FOUND") {
+      notes.push("Could not inspect " + info.packageName + ": " + err.message);
+    }
+    return null;
+  }
+
+  const packageDir = path.dirname(packageJsonPath);
+  let packageVersion = null;
+  try {
+    packageVersion = JSON.parse(fs.readFileSync(packageJsonPath, "utf8")).version;
+  } catch (err) {
+    notes.push("Could not read " + info.packageName + " metadata: " + err.message);
+    return null;
+  }
+
+  if (packageVersion !== VERSION) {
+    notes.push(
+      info.packageName + " is version " + packageVersion + ", but the wrapper is version " + VERSION + "."
+    );
+    return null;
+  }
+
+  const binaryPath = path.join(packageDir, "bin", info.binaryName);
+  if (!isFile(binaryPath)) {
+    notes.push("Found " + info.packageName + ", but its binary is missing at " + binaryPath + ".");
+    return null;
+  }
+
+  return { path: binaryPath, source: info.packageName };
+}
+
+function spawnInherited(command, args, options) {
+  return new Promise(function (resolve, reject) {
+    let child;
+    try {
+      child = spawn(
+        command,
+        args,
+        Object.assign(
+          {
+            stdio: "inherit",
+            windowsHide: false,
+          },
+          options || {}
+        )
+      );
+    } catch (err) {
+      reject(err);
+      return;
+    }
+
+    child.on("error", reject);
+    child.on("exit", function (code, signal) {
+      resolve({ code: code, signal: signal });
+    });
+  });
+}
 
-if (!fs.existsSync(BIN_PATH)) {
-  console.error(
-    "[infynon] Binary not found at: " + BIN_PATH + "\n" +
-    "         Try reinstalling: npm install -g infynon\n" +
-    "         Or download a release manually: https://github.com/d4rkNinja/infynon-cli/releases"
+async function runPostinstallFallback() {
+  if (!isFile(POSTINSTALL_PATH)) {
+    throw new Error("postinstall.js is missing at " + POSTINSTALL_PATH);
+  }
+
+  console.error("[infynon] Native binary is missing; running npm postinstall fallback once.");
+  const result = await spawnInherited(process.execPath, [POSTINSTALL_PATH], {
+    env: Object.assign({}, process.env, {
+      INFYNON_NPM_POSTINSTALL_FALLBACK: "1",
+    }),
+  });
+
+  if (result.signal) {
+    throw new Error("postinstall.js was terminated by signal " + result.signal);
+  }
+  if (result.code !== 0) {
+    throw new Error("postinstall.js failed with exit code " + result.code);
+  }
+}
+
+async function resolveNativeBinary() {
+  const notes = [];
+  const platformBinary = resolvePlatformBinary(notes);
+  if (platformBinary) {
+    return platformBinary;
+  }
+
+  if (isFile(LOCAL_BIN_PATH)) {
+    return { path: LOCAL_BIN_PATH, source: "npm/bin" };
+  }
+
+  await runPostinstallFallback();
+  if (isFile(LOCAL_BIN_PATH)) {
+    return { path: LOCAL_BIN_PATH, source: "npm/bin:postinstall" };
+  }
+
+  const message = [
+    "Binary not found for " + process.platform + " " + process.arch + ".",
+    "Expected local fallback at: " + LOCAL_BIN_PATH,
+  ];
+  if (notes.length > 0) {
+    message.push("Resolution notes:");
+    for (const note of notes) {
+      message.push("  - " + note);
+    }
+  }
+  message.push("Try reinstalling: npm install -g infynon");
+  message.push("Or download a release manually: " + RELEASES_URL);
+  const err = new Error(message.join("\n"));
+  err.code = "BINARY_NOT_FOUND";
+  throw err;
+}
+
+function assertWindowsCommandLineFits(binaryPath, args) {
+  if (process.platform !== "win32") {
+    return;
+  }
+  const estimatedLength = binaryPath.length + args.reduce(function (total, arg) {
+    return total + String(arg).length + 3;
+  }, 0);
+  if (estimatedLength <= 30000) {
+    return;
+  }
+  const err = new Error(
+    "command line is too long for Windows process creation; reduce arguments or use file-based package-manager input"
   );
-  process.exit(1);
+  err.code = "COMMAND_TOO_LONG";
+  throw err;
 }
 
-function runBinary(args) {
-  return spawnSync(BIN_PATH, args, {
-    stdio: "inherit",
-    windowsHide: false,
+async function runBinary(resolution, args) {
+  assertWindowsCommandLineFits(resolution.path, args);
+  return spawnInherited(resolution.path, args, {
+    env: Object.assign({}, process.env, {
+      INFYNON_NPM_WRAPPER: __filename,
+      INFYNON_NPM_PACKAGE_DIR: PACKAGE_DIR,
+      INFYNON_NPM_BINARY: resolution.path,
+      INFYNON_NPM_BINARY_SOURCE: resolution.source,
+    }),
   });
 }
 
-const result = runBinary(process.argv.slice(2));
+function exitFromChild(result) {
+  if (result.signal) {
+    try {
+      process.kill(process.pid, result.signal);
+    } catch (_) {
+      const signalExitCodes = { SIGHUP: 129, SIGINT: 130, SIGTERM: 143 };
+      process.exit(signalExitCodes[result.signal] || 1);
+    }
+    setTimeout(function () {
+      process.exit(1);
+    }, 1000);
+    return;
+  }
+
+  process.exit(result.code === null ? 1 : result.code);
+}
+
+function printLaunchError(err, resolution) {
+  const detected = [
+    "platform: " + process.platform + " " + process.arch,
+    "wrapper: " + __filename,
+    "package dir: " + PACKAGE_DIR,
+    "binary: " + (resolution ? resolution.path : "unresolved"),
+    "binary source: " + (resolution ? resolution.source : "unresolved"),
+    "node: " + process.version,
+  ];
+
+  if (err && err.code === "BINARY_NOT_FOUND") {
+    console.error("[infynon] " + err.message);
+    console.error("[infynon] Detected:\n  - " + detected.join("\n  - "));
+    return;
+  }
 
-if (result.error) {
-  console.error("[infynon] Failed to run binary:", result.error.message);
-  if (process.platform === "win32" && result.error.code === "UNKNOWN") {
-    console.error("[infynon] The installed Windows binary could not be executed.");
-    console.error("[infynon] Reinstall to download and verify a fresh release asset: npm install -g infynon");
+  if (resolution) {
+    console.error("[infynon] Failed to launch native binary: " + resolution.path);
+  } else {
+    console.error("[infynon] Failed to resolve native binary.");
   }
-  process.exit(1);
+  console.error("[infynon] " + (err && err.message ? err.message : String(err)));
+
+  if (err && err.code === "COMMAND_TOO_LONG") {
+    console.error("[infynon] On Windows, pass large package-manager input through files instead of argv.");
+  } else if (err && err.code === "ENOENT") {
+    console.error("[infynon] The resolved binary path no longer exists. Try reinstalling: npm install -g infynon");
+  } else if (err && (err.code === "EACCES" || err.code === "EPERM")) {
+    console.error("[infynon] The resolved binary is not executable. Try reinstalling: npm install -g infynon");
+  } else if (process.platform === "win32") {
+    console.error("[infynon] If Windows blocked or quarantined the executable, reinstall to restore a verified copy.");
+    console.error("[infynon] Reinstall command: npm install -g infynon");
+  } else {
+    console.error("[infynon] Try reinstalling: npm install -g infynon");
+  }
+  console.error("[infynon] Detected:\n  - " + detected.join("\n  - "));
+  console.error("[infynon] Diagnostics: infynon doctor npm");
+  console.error("[infynon] Manual release downloads: " + RELEASES_URL);
 }
 
-if (result.signal) {
-  process.kill(process.pid, result.signal);
+async function main() {
+  let resolution = null;
+  try {
+    resolution = await resolveNativeBinary();
+    const result = await runBinary(resolution, process.argv.slice(2));
+    exitFromChild(result);
+  } catch (err) {
+    printLaunchError(err, resolution);
+    process.exit(1);
+  }
 }
 
-process.exit(result.status !== null ? result.status : 1);
+main();