nebula-ai 0.0.1-dev.20260415044357.874f788

package/bin/nebula-ai.js

@@ -0,0 +1,293 @@
+#!/usr/bin/env node
+// Launcher for the `nebula-ai` npm package.
+//
+// The npm package itself is a tiny stub: no JS dependencies, no binary.
+// The first time the user runs `nebula-ai`, this script downloads the
+// matching native Bun single-file executable from the binary host,
+// verifies its integrity against a signed manifest, caches it under
+// `~/.cache/nebula-ai/v<version>/`, and execs it. Subsequent invocations
+// short-circuit straight to exec.
+//
+// ─── Supply-chain integrity gate ────────────────────────────────────────────
+//
+// Before any downloaded binary is marked executable we verify:
+//
+//   1. a per-version `checksums.json` signed with ed25519,
+//   2. the signature in `checksums.json.sig`, against an ed25519 public
+//      key baked into this file below (`EMBEDDED_PUBLIC_KEY_PEM`),
+//   3. the downloaded binary's SHA-256 against the entry in the manifest.
+//
+// A mismatch aborts before `chmodSync`/`renameSync`, and the staged
+// tempfile is unlinked. This means a CDN or on-path compromise of the
+// binary host cannot result in arbitrary code execution on the user's
+// machine without also compromising the offline signing key.
+//
+// ─── Key rotation ───────────────────────────────────────────────────────────
+//
+// The ed25519 signing key is stored as the `NEBULA_AI_SIGNING_PRIVATE_KEY`
+// GitHub Actions secret. To rotate:
+//
+//   1. Generate a new keypair locally:
+//        openssl genpkey -algorithm ED25519 -out new.key
+//        openssl pkey -in new.key -pubout -out new.pub
+//   2. Replace `NEBULA_AI_SIGNING_PRIVATE_KEY` in repo secrets with the
+//      contents of new.key.
+//   3. Paste the contents of new.pub into `EMBEDDED_PUBLIC_KEY_PEM` below
+//      and ship a new wrapper release. Users on older wrapper versions
+//      will continue to verify against the old key until they upgrade,
+//      so keep the old key valid (publish one more release with it)
+//      long enough for the dist-tag to catch up, then delete the old
+//      key material.
+
+import { spawnSync } from "node:child_process";
+import { createHash, createPublicKey, verify as cryptoVerify } from "node:crypto";
+import {
+  chmodSync,
+  createWriteStream,
+  existsSync,
+  mkdirSync,
+  renameSync,
+  rmSync,
+} from "node:fs";
+import { readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { pipeline } from "node:stream/promises";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+// The public half of the ed25519 key that signs `checksums.json`. The
+// private half lives only in the `NEBULA_AI_SIGNING_PRIVATE_KEY` GitHub
+// Actions secret.
+const EMBEDDED_PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAd8QFvCTSMY0HmSsJgL6jtFQas00WedvSZhkc9bxdAl0=
+-----END PUBLIC KEY-----
+`;
+
+// Stamped by `scripts/publish/prepare.mjs` at wrapper staging time with
+// the channel-appropriate base URL (dev vs prod). The `__NEBULA_AI_…__`
+// sentinel lets us keep the checked-in source runnable for local tests
+// without pointing at any real host.
+const STAMPED_DOWNLOAD_BASE_URL = "https://cli-assets.nebula-dev.ai/dev";
+const DOWNLOAD_BASE_URL =
+  process.env.NEBULA_AI_DOWNLOAD_BASE ?? STAMPED_DOWNLOAD_BASE_URL;
+
+const SUPPORTED_PLATFORMS = new Set([
+  "darwin-arm64",
+  "darwin-x64",
+  "linux-x64",
+  "linux-arm64",
+  "win32-x64",
+]);
+
+// ─── pure helpers (exported for tests) ─────────────────────────────────────
+
+export function sha256HexSync(buffer) {
+  return createHash("sha256").update(buffer).digest("hex");
+}
+
+/**
+ * Verify a signed checksums.json blob and return the parsed manifest.
+ * Throws if the signature is invalid or the manifest is malformed.
+ */
+export function verifyManifest(manifestBytes, signatureBase64, publicKeyPem) {
+  const pubKey = createPublicKey(publicKeyPem);
+  if (pubKey.asymmetricKeyType !== "ed25519") {
+    throw new Error(
+      `embedded public key is not ed25519 (got ${pubKey.asymmetricKeyType})`,
+    );
+  }
+  const sig = Buffer.from(signatureBase64.trim(), "base64");
+  const ok = cryptoVerify(null, manifestBytes, pubKey, sig);
+  if (!ok) {
+    throw new Error("manifest signature verification failed");
+  }
+  const manifest = JSON.parse(manifestBytes.toString("utf8"));
+  if (!manifest || typeof manifest !== "object") {
+    throw new Error("manifest is not a JSON object");
+  }
+  if (manifest.algorithm !== "sha256") {
+    throw new Error(
+      `unsupported manifest algorithm: ${manifest.algorithm ?? "(missing)"}`,
+    );
+  }
+  if (!manifest.binaries || typeof manifest.binaries !== "object") {
+    throw new Error("manifest is missing the `binaries` map");
+  }
+  return manifest;
+}
+
+/**
+ * Given a verified manifest + a platform key + the bytes of a downloaded
+ * binary, confirm the binary's SHA-256 matches the manifest entry. Throws
+ * on mismatch.
+ */
+export function assertBinaryMatchesManifest(manifest, platformKey, binName, binaryBuffer) {
+  const entryKey = `${platformKey}/${binName}`;
+  const expected = manifest.binaries[entryKey];
+  if (typeof expected !== "string") {
+    throw new Error(`manifest has no entry for ${entryKey}`);
+  }
+  const actual = sha256HexSync(binaryBuffer);
+  if (actual !== expected) {
+    throw new Error(
+      `binary digest mismatch for ${entryKey}\n  expected: ${expected}\n  actual:   ${actual}`,
+    );
+  }
+}
+
+// ─── runtime (only runs when this file is the entrypoint) ─────────────────
+
+const platformKey = `${process.platform}-${process.arch}`;
+const binName = process.platform === "win32" ? "nebula-ai.exe" : "nebula-ai";
+
+async function readVersion() {
+  const here = dirname(fileURLToPath(import.meta.url));
+  const pkgPath = join(here, "..", "package.json");
+  const raw = await readFile(pkgPath, "utf8");
+  const pkg = JSON.parse(raw);
+  if (typeof pkg.version !== "string") {
+    throw new Error("nebula-ai: package.json is missing a version field");
+  }
+  return pkg.version;
+}
+
+function getCacheDir(version) {
+  // Respect XDG_CACHE_HOME on linux, honor LOCALAPPDATA on windows, default
+  // to ~/.cache elsewhere. Keeps behavior predictable across platforms.
+  const base =
+    process.env.NEBULA_AI_CACHE_DIR ||
+    (process.platform === "win32"
+      ? process.env.LOCALAPPDATA || join(homedir(), "AppData", "Local")
+      : process.env.XDG_CACHE_HOME || join(homedir(), ".cache"));
+  return join(base, "nebula-ai", `v${version}`, platformKey);
+}
+
+async function fetchManifest(version) {
+  const manifestUrl = `${DOWNLOAD_BASE_URL}/v${version}/checksums.json`;
+  const sigUrl = `${DOWNLOAD_BASE_URL}/v${version}/checksums.json.sig`;
+  const [manifestRes, sigRes] = await Promise.all([
+    fetch(manifestUrl, { redirect: "follow" }),
+    fetch(sigUrl, { redirect: "follow" }),
+  ]);
+  if (!manifestRes.ok) {
+    throw new Error(
+      `manifest download failed: ${manifestRes.status} ${manifestRes.statusText}\n  url: ${manifestUrl}`,
+    );
+  }
+  if (!sigRes.ok) {
+    throw new Error(
+      `signature download failed: ${sigRes.status} ${sigRes.statusText}\n  url: ${sigUrl}`,
+    );
+  }
+  const manifestBytes = Buffer.from(await manifestRes.arrayBuffer());
+  const signatureBase64 = await sigRes.text();
+  return verifyManifest(manifestBytes, signatureBase64, EMBEDDED_PUBLIC_KEY_PEM);
+}
+
+async function downloadBinary(version, destPath) {
+  const url = `${DOWNLOAD_BASE_URL}/v${version}/${platformKey}/${binName}`;
+
+  process.stderr.write(
+    `nebula-ai: fetching ${platformKey} v${version} prebuilt binary…\n`,
+  );
+
+  const manifest = await fetchManifest(version);
+
+  const res = await fetch(url, { redirect: "follow" });
+  if (!res.ok || !res.body) {
+    throw new Error(
+      `download failed: ${res.status} ${res.statusText}\n  url: ${url}`,
+    );
+  }
+
+  mkdirSync(dirname(destPath), { recursive: true });
+
+  // Stage under a unique temp name in the SAME directory as destPath so the
+  // final renameSync is always an intra-filesystem move. tmpdir() can live on
+  // a different mount (tmpfs on linux, user-local tmp on some sandboxes) and
+  // rename across mounts fails with EXDEV.
+  const tmpPath = join(
+    dirname(destPath),
+    `.nebula-ai-${version}-${process.pid}-${Date.now()}.partial`,
+  );
+  try {
+    await pipeline(res.body, createWriteStream(tmpPath));
+    const tmpBytes = await readFile(tmpPath);
+    assertBinaryMatchesManifest(manifest, platformKey, binName, tmpBytes);
+    if (process.platform !== "win32") chmodSync(tmpPath, 0o755);
+    renameSync(tmpPath, destPath);
+  } catch (err) {
+    try {
+      rmSync(tmpPath, { force: true });
+    } catch {
+      // best-effort cleanup
+    }
+    throw err;
+  }
+}
+
+async function main() {
+  if (DOWNLOAD_BASE_URL.includes("__NEBULA_AI_DOWNLOAD_BASE__")) {
+    console.error(
+      "nebula-ai: this build of the wrapper was not stamped with a download base URL.\n" +
+        "  Set NEBULA_AI_DOWNLOAD_BASE to a reachable mirror, or install\n" +
+        "  nebula-ai from a dev checkout of https://github.com/thirdweb-dev/nebula-cli.",
+    );
+    process.exit(1);
+  }
+
+  if (!SUPPORTED_PLATFORMS.has(platformKey)) {
+    console.error(
+      `nebula-ai: no prebuilt binary for ${platformKey}.\n` +
+        `Supported platforms: ${[...SUPPORTED_PLATFORMS].join(", ")}.\n` +
+        `File an issue at https://github.com/thirdweb-dev/nebula-cli/issues`,
+    );
+    process.exit(1);
+  }
+
+  let version;
+  try {
+    version = await readVersion();
+  } catch (err) {
+    console.error(`nebula-ai: ${err instanceof Error ? err.message : err}`);
+    process.exit(1);
+  }
+
+  const cacheDir = getCacheDir(version);
+  const binaryPath = join(cacheDir, binName);
+
+  if (!existsSync(binaryPath)) {
+    try {
+      await downloadBinary(version, binaryPath);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      console.error(
+        `nebula-ai: failed to install prebuilt binary.\n  ${msg}\n` +
+          `\nIf your environment blocks outbound HTTPS, set NEBULA_AI_DOWNLOAD_BASE\n` +
+          `to a reachable mirror, or install from source.`,
+      );
+      process.exit(1);
+    }
+  }
+
+  const result = spawnSync(binaryPath, process.argv.slice(2), {
+    stdio: "inherit",
+  });
+  if (result.error) {
+    console.error(`nebula-ai: failed to exec binary: ${result.error.message}`);
+    process.exit(1);
+  }
+  process.exit(result.status ?? 0);
+}
+
+// Only run main() when this file is the CLI entrypoint, so tests can
+// import the pure helpers above without triggering a download. Use
+// pathToFileURL so the comparison round-trips correctly on Windows
+// (where process.argv[1] uses backslashes but import.meta.url uses
+// forward slashes inside a file:// URL).
+const isEntrypoint =
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(process.argv[1]).href;
+if (isEntrypoint) {
+  main();
+}

package/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "nebula-ai",
+  "version": "0.0.1-dev.20260415044357.874f788",
+  "description": "CLI/TUI for the nebula.gg AI task orchestration platform",
+  "type": "module",
+  "bin": {
+    "nebula-ai": "./bin/nebula-ai.js"
+  },
+  "files": [
+    "bin"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "keywords": [
+    "nebula",
+    "cli",
+    "tui",
+    "ai",
+    "agents",
+    "tasks"
+  ],
+  "license": "MIT",
+  "homepage": "https://github.com/thirdweb-dev/nebula-cli#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/thirdweb-dev/nebula-cli.git"
+  },
+  "bugs": {
+    "url": "https://github.com/thirdweb-dev/nebula-cli/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}