nestweaver 9.0.5 → 9.2.0

package/README.md

@@ -3,22 +3,45 @@
 Code knowledge graph for AI agents — 42 MCP tools, 32 languages, graph
 visualization.
 
-This package is a thin wrapper. Its `postinstall` downloads the NestWeaver
-binary matching this package's version from the project's GitHub Releases,
-verifies it against the SHA-256 published alongside the archive, and puts a
-`nestweaver` executable on your PATH.
+This package is a thin wrapper with **no install-time (`postinstall`) script**.
+It ships one prebuilt-binary package per platform —
+`nestweaver-darwin-arm64`, `nestweaver-darwin-x64`, `nestweaver-linux-arm64`,
+`nestweaver-linux-x64` — as an `optionalDependencies` entry, the same pattern
+esbuild, swc, and Rollup use. npm, pnpm, and Yarn each install only the one
+matching your machine's `os`/`cpu` through their own ordinary dependency
+resolution; the `nestweaver` executable on your PATH resolves and runs
+whichever one actually landed, at invocation time.
+
+**No lifecycle scripts to allow.** There is nothing for
+`npm install --ignore-scripts` to skip, and pnpm 10+'s default block on
+lifecycle scripts (which used to leave a wrapper with no binary and no
+`pnpm.onlyBuiltDependencies` clue why) no longer applies — there is no script
+to block.
+
+If your package manager skipped optional dependencies entirely
+(`--omit=optional`, `--no-optional`, or a lockfile resolved without one),
+`nestweaver` exits 1 and names the exact optional package to install instead
+of silently doing nothing. If your organisation disallows this platform
+package entirely, install a release archive from GitHub or build from source
+(`cargo install --locked --path .`) instead.
 
 ## Platforms
 
-macOS and Linux, on x86_64 and arm64. On any other platform the install step
-exits without failing and prints the supported targets; use a release archive
-or a source build instead.
+macOS and Linux, on x86_64 and arm64. Every other platform has no published
+optional package, so `nestweaver` FAILS with the supported-targets list at
+invocation time rather than leaving you with a wrapper that silently cannot
+run; use a release archive or a source build instead. The two Linux platform
+packages additionally declare `libc: ["glibc"]` (musl/Alpine is not
+currently supported). Declaring `libc` is safe on a Linux-only package; it was
+not safe on the earlier combined macOS+Linux wrapper, where it made npm reject
+every macOS install with `EBADPLATFORM` because `libc` is not a concept on
+macOS. The field itself was never the problem — the package it sat on was.
 
 Linux builds target **glibc 2.35**, which covers Ubuntu 22.04 LTS and newer and
-Debian 12. The archive includes the GCC 13 runtime LadybugDB needs and the npm
-installer preserves it beside the binary. Check your glibc with `ldd --version`;
-on anything older the binary will not start and the error names a missing
-`GLIBC_` symbol. macOS builds target **13.3**.
+Debian 12. The platform package includes the GCC 13 runtime LadybugDB needs
+beside the binary. Check your glibc with `ldd --version`; on anything older
+the binary will not start and the error names a missing `GLIBC_` symbol.
+macOS builds target **13.3**.
 
 ## Upgrading an existing graph
 

package/bin/nestweaver

@@ -1,11 +1,172 @@
-#!/usr/bin/env bash
-set -e
-DIR="$(cd "$(dirname "$0")/.." && pwd)"
-BINARY="$DIR/.nestweaver-bin/nestweaver"
+#!/usr/bin/env node
+"use strict";
 
-if [ ! -x "$BINARY" ]; then
-  echo "NestWeaver binary not found. Install a verified GitHub Release archive, or from a source checkout run: cargo install --locked --path ." >&2
-  exit 1
-fi
+const path = require("path");
 
-exec "$BINARY" "$@"
+// ── Decision logic ──────────────────────────────────────────────────────
+// Pure, exported, and covered by nestweaver.test.js. Everything below the
+// `main()` boundary does I/O (module resolution, process spawn) and is not
+// directly testable; keeping the judgements out here is what makes the
+// launcher assertable at all.
+//
+// nw-425 / nw-433: this package used to have a `postinstall` that downloaded
+// the matching GitHub Release archive at install time. pnpm 10+ blocks
+// lifecycle scripts by default, so `pnpm add nestweaver` silently produced a
+// wrapper with no binary and no indication why -- the documented workaround
+// (`"pnpm": {"onlyBuiltDependencies": ["nestweaver"]}`) required knowing the
+// failure existed in the first place. There is now no lifecycle script at
+// all. Each supported platform ships as its own optionalDependency (the
+// esbuild/@rollup/swc pattern): npm/pnpm/yarn install ONLY the one whose
+// package.json `os`/`cpu` match the current machine, entirely through their
+// own normal dependency resolution -- nothing here runs at install time.
+// This file is what runs at INVOCATION time: it resolves which platform
+// package actually landed and execs its binary.
+
+const PLATFORM_PACKAGES = {
+  "darwin-x64": "nestweaver-darwin-x64",
+  "darwin-arm64": "nestweaver-darwin-arm64",
+  "linux-x64": "nestweaver-linux-x64",
+  "linux-arm64": "nestweaver-linux-arm64",
+};
+
+function platformKey(platform, arch) {
+  return `${platform}-${arch}`;
+}
+
+/// Which optional platform package this machine should have installed, or
+/// `null` if none is published for it.
+function platformPackageName(platform, arch) {
+  return PLATFORM_PACKAGES[platformKey(platform, arch)] || null;
+}
+
+/// Whether the running system is musl (Alpine and similar), not glibc.
+///
+/// Ported from the retired install.js unchanged (nw-433): `glibcVersionRuntime`
+/// is populated by Node's own `process.report` only when Node itself is linked
+/// against glibc, so a musl-linked Node (Alpine's system Node, every
+/// `node:*-alpine`/`node:*-musl` image) never has it. THREE states, not two:
+/// `reportAvailable` is separate from `glibcVersionRuntime` so "the report
+/// could not be produced at all" (sandboxed container, unusual build) and
+/// "the report WAS produced and shows no glibc" (genuine musl) cannot
+/// collapse into the same `undefined` -- that collapse would refuse a working
+/// glibc-Linux box whenever the report merely couldn't be read. An
+/// unavailable report fails OPEN (false, i.e. "not musl, proceed"); only a
+/// report that was actually read and shows no glibc fails closed.
+function isMuslLinux(platform, glibcVersionRuntime, reportAvailable) {
+  if (platform !== "linux" || !reportAvailable) {
+    return false;
+  }
+  return !glibcVersionRuntime;
+}
+
+function unsupportedPlatformMessage(platform, arch) {
+  return [
+    `Unsupported platform: ${platform}-${arch}`,
+    "Supported: darwin-x64, darwin-arm64, linux-x64, linux-arm64",
+    "Install from a source checkout instead: cargo install --locked --path .",
+  ].join("\n");
+}
+
+function muslMessage(platform, arch) {
+  return [
+    `Unsupported platform: ${platform}-${arch} (musl libc)`,
+    "NestWeaver's published Linux packages are glibc-only (nestweaver-linux-x64, nestweaver-linux-arm64). musl/Alpine is not currently supported.",
+    "Build from a source checkout instead: cargo install --locked --path .",
+  ].join("\n");
+}
+
+/// Why `require.resolve` on the platform package's binary failed. This is
+/// reached only when `platformPackageName` already matched a real target --
+/// the package manager should have installed it -- so the likely causes are
+/// operator-controlled (optional dependencies were explicitly skipped) rather
+/// than "wrong platform", and the message says so instead of guessing.
+function missingPlatformPackageMessage(pkgName, version) {
+  return [
+    `NestWeaver binary not found: optional dependency "${pkgName}@${version}" is not installed.`,
+    "This usually means your package manager skipped optional dependencies",
+    "(npm/yarn --omit=optional or --no-optional, or a lockfile resolved without it).",
+    `Install it explicitly: npm install ${pkgName}@${version}`,
+    "Or install from a source checkout instead: cargo install --locked --path .",
+  ].join("\n");
+}
+
+/// Resolve the platform package's binary via Node's own module resolution
+/// (`resolveFn`, ordinarily `require.resolve`) rather than constructing a
+/// path by hand. Module resolution is what makes this correct under every
+/// package manager's node_modules layout -- including pnpm's strict,
+/// symlinked store, which is exactly the layout a hand-built relative path
+/// would get wrong and the reason nw-425 existed. Takes `resolveFn` as a
+/// parameter so this is testable without a real installed dependency tree.
+function resolveBinaryPath(pkgName, resolveFn) {
+  try {
+    return { binaryPath: resolveFn(`${pkgName}/bin/nestweaver`), error: null };
+  } catch (err) {
+    return { binaryPath: null, error: err };
+  }
+}
+
+module.exports = {
+  PLATFORM_PACKAGES,
+  platformKey,
+  platformPackageName,
+  isMuslLinux,
+  unsupportedPlatformMessage,
+  muslMessage,
+  missingPlatformPackageMessage,
+  resolveBinaryPath,
+};
+
+// ── Execution ────────────────────────────────────────────────────────────
+
+function main() {
+  const { spawnSync } = require("child_process");
+  const platform = process.platform;
+  const arch = process.arch;
+
+  if (platform === "linux") {
+    let glibcVersionRuntime;
+    let reportAvailable = false;
+    try {
+      if (process.report && typeof process.report.getReport === "function") {
+        glibcVersionRuntime = process.report.getReport().header.glibcVersionRuntime;
+        reportAvailable = true;
+      }
+    } catch {
+      reportAvailable = false;
+    }
+    if (isMuslLinux(platform, glibcVersionRuntime, reportAvailable)) {
+      console.error(muslMessage(platform, arch));
+      process.exit(1);
+    }
+  }
+
+  const pkgName = platformPackageName(platform, arch);
+  if (!pkgName) {
+    console.error(unsupportedPlatformMessage(platform, arch));
+    process.exit(1);
+  }
+
+  const version = require(path.join(__dirname, "..", "package.json")).version;
+  const { binaryPath, error } = resolveBinaryPath(pkgName, (specifier) =>
+    require.resolve(specifier),
+  );
+  if (error) {
+    console.error(missingPlatformPackageMessage(pkgName, version));
+    process.exit(1);
+  }
+
+  const result = spawnSync(binaryPath, process.argv.slice(2), { stdio: "inherit" });
+  if (result.error) {
+    console.error(
+      `Failed to execute NestWeaver binary at ${binaryPath}: ${result.error.message}`,
+    );
+    process.exit(1);
+  }
+  process.exit(result.status === null ? 1 : result.status);
+}
+
+// Only run when executed as the npm bin entry point; `require` must be free
+// of side effects so the decision logic above can be tested at all.
+if (require.main === module) {
+  main();
+}

package/package.json

@@ -1,18 +1,14 @@
 {
   "name": "nestweaver",
-  "version": "9.0.5",
+  "version": "9.2.0",
   "description": "Code knowledge graph for AI agents — 42 MCP tools, 32 languages, graph visualization",
   "bin": {
     "nestweaver": "bin/nestweaver"
   },
   "files": [
     "bin/",
-    "install.js",
     "README.md"
   ],
-  "scripts": {
-    "postinstall": "node install.js"
-  },
   "os": [
     "darwin",
     "linux"
@@ -21,6 +17,15 @@
     "x64",
     "arm64"
   ],
+  "engines": {
+    "node": ">=18"
+  },
+  "optionalDependencies": {
+    "nestweaver-darwin-arm64": "9.2.0",
+    "nestweaver-darwin-x64": "9.2.0",
+    "nestweaver-linux-arm64": "9.2.0",
+    "nestweaver-linux-x64": "9.2.0"
+  },
   "keywords": [
     "mcp",
     "code-graph",

package/install.js

@@ -1,82 +0,0 @@
-#!/usr/bin/env node
-
-const { execSync } = require("child_process");
-const fs = require("fs");
-const path = require("path");
-
-const PLATFORM_MAP = {
-  "darwin-x64": "x86_64-apple-darwin",
-  "darwin-arm64": "aarch64-apple-darwin",
-  "linux-x64": "x86_64-unknown-linux-gnu",
-  "linux-arm64": "aarch64-unknown-linux-gnu",
-};
-
-const key = `${process.platform}-${process.arch}`;
-const target = PLATFORM_MAP[key];
-
-if (!target) {
-  console.warn(`Unsupported platform: ${key}`);
-  console.warn("Supported: darwin-x64, darwin-arm64, linux-x64, linux-arm64");
-  console.warn(
-    "Unsupported platform. Install a verified GitHub Release archive for a supported target, or from a source checkout: cargo install --locked --path .",
-  );
-  process.exit(0); // Don't break npm install
-}
-
-const version = require("./package.json").version;
-const repo = "Kehl-io/nestweaver";
-// Release tags are `v<version>` (release-please config: include-component-in-tag
-// false) and assets are `nestweaver-v<version>-<target>.tar.gz` (see the
-// `build` job in .github/workflows/release-please.yml). Keep these in sync.
-const tag = `v${version}`;
-const archive = `nestweaver-${tag}-${target}.tar.gz`;
-const base = `https://github.com/${repo}/releases/download/${tag}`;
-const url = `${base}/${archive}`;
-
-const binDir = path.join(__dirname, ".nestweaver-bin");
-fs.mkdirSync(binDir, { recursive: true });
-const archivePath = path.join(binDir, archive);
-
-console.log(`Downloading NestWeaver v${version} for ${target}...`);
-
-try {
-  execSync(`curl -fsSL "${url}" -o "${archivePath}"`, { stdio: "inherit" });
-
-  // Verify the SHA-256 the release ships alongside the archive — a mismatch
-  // means a corrupted or tampered download, which must fail loudly.
-  try {
-    const expected = execSync(`curl -fsSL "${url}.sha256"`)
-      .toString()
-      .trim()
-      .split(/\s+/)[0];
-    const actual = execSync(`shasum -a 256 "${archivePath}"`)
-      .toString()
-      .trim()
-      .split(/\s+/)[0];
-    if (expected && actual && expected !== actual) {
-      throw new Error(
-        `checksum mismatch: expected ${expected}, got ${actual}`,
-      );
-    }
-  } catch (checksumErr) {
-    if (String(checksumErr.message || "").includes("checksum mismatch")) {
-      throw checksumErr; // integrity failure — do not install
-    }
-    // Missing/unreadable .sha256 is not fatal; proceed with the download.
-  }
-
-  execSync(`tar xz -C "${binDir}" -f "${archivePath}"`, { stdio: "inherit" });
-  fs.rmSync(archivePath, { force: true });
-  fs.chmodSync(path.join(binDir, "nestweaver"), 0o755);
-  console.log("NestWeaver installed successfully.");
-  console.log(
-    "Upgrading an existing pre-publication brain? Stop its daemon and run `nestweaver publication rebuild --config /path/to/instance.toml`; the incumbent remains recoverable until validated cutover.",
-  );
-} catch (err) {
-  console.warn(`Failed to install NestWeaver binary: ${err.message}`);
-  console.warn(`  URL: ${url}`);
-  console.warn(
-    "Download a verified GitHub Release archive, or build from a source checkout: cargo install --locked --path .",
-  );
-  process.exit(0); // Don't break npm install on transient/network failures
-}