pi-courier 0.1.34 → 0.1.35

package/README.md

@@ -56,7 +56,7 @@ npm run build
 npm link          # make the `pi-courier` command available globally
 ```
 
-**Do not use `--ignore-scripts`**: the Matrix E2EE library downloads its native binary via postinstall. If your npm blocks it and you hit `Cannot find module '@matrix-org/matrix-sdk-crypto-nodejs-linux-x64-gnu'`, run:
+**Do not use `--ignore-scripts`**: the Matrix E2EE library downloads its native binary via postinstall. On npm >= 11 the `allow-scripts` default may block that dependency's postinstall; `pi-courier`'s own postinstall self-checks for it and auto-downloads the missing native binary (one extra download on first install). If you still hit `Cannot find module '@matrix-org/matrix-sdk-crypto-nodejs-linux-x64-gnu'` (e.g. the auto-download was skipped), run manually:
 
 ```bash
 cd node_modules/@matrix-org/matrix-sdk-crypto-nodejs

package/README.zh-CN.md

@@ -56,7 +56,7 @@ npm run build
 npm link          # 让 `pi-courier` 命令全局可用
 ```
 
-**不要用 `--ignore-scripts`**:Matrix E2EE 库的 postinstall 会下载原生二进制。如果被 npm 拦截,报 `Cannot find module '@matrix-org/matrix-sdk-crypto-nodejs-linux-x64-gnu'` 时手动补:
+**不要用 `--ignore-scripts`**:Matrix E2EE 库的 postinstall 会下载原生二进制。npm >= 11 的 `allow-scripts` 默认可能拦截该依赖的 postinstall;`pi-courier` 自己的 postinstall 会自检并**自动补下**缺失的原生二进制(首次安装多下载一次)。若仍报 `Cannot find module '@matrix-org/matrix-sdk-crypto-nodejs-linux-x64-gnu'`(比如自检被跳过),再手动补:
 
 ```bash
 cd node_modules/@matrix-org/matrix-sdk-crypto-nodejs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-courier",
-  "version": "0.1.34",
+  "version": "0.1.35",
   "description": "Run pi coding agent from Matrix. Slash commands, skills and prompts fully work from messengers via the RPC protocol.",
   "type": "module",
   "main": "dist/standalone.js",
@@ -11,12 +11,14 @@
     "dist/",
     "deploy/",
     "extensions/",
+    "scripts/",
     "README.md",
     "README.zh-CN.md"
   ],
   "scripts": {
     "build": "rm -rf dist && tsc",
     "prepare": "npm run build",
+    "postinstall": "node scripts/ensure-crypto-native.mjs",
     "watch": "tsc --watch",
     "clean": "rm -rf dist",
     "start": "node dist/standalone.js",

package/scripts/ensure-crypto-native.d.mts

@@ -0,0 +1,19 @@
+/** Type declarations for scripts/ensure-crypto-native.mjs (postinstall self-check). */
+
+export interface EnsureResult {
+  ok: boolean;
+  downloaded?: boolean;
+  reason?: string;
+}
+
+export function nativeBindingBasename(): string | null;
+
+export function isMusl(): boolean;
+
+export function resolveCryptoPackageDir(): string | null;
+
+export function isNativeBindingMissing(cryptoDir: string, basename: string | null): boolean;
+
+export function runNativeDownloader(cryptoDir: string): void;
+
+export function ensureCryptoNative(): EnsureResult;

package/scripts/ensure-crypto-native.mjs

@@ -0,0 +1,147 @@
+#!/usr/bin/env node
+/**
+ * Postinstall self-check for the matrix-rust-sdk-crypto native binding.
+ *
+ * WHY: `matrix-bot-sdk` depends on `@matrix-org/matrix-sdk-crypto-nodejs`, whose
+ * platform native binary (.node) is only produced by its own `postinstall`
+ * script (`node download-lib.js`) on first install. npm >= 11 ships
+ * `allow-scripts`, which by default BLOCKS a dependency's install scripts, so
+ * that binary never gets downloaded. At runtime the ESM top-level
+ * `import matrix-bot-sdk` synchronously requires the crypto module and the
+ * process dies with:
+ *
+ *   Cannot find module '@matrix-org/matrix-sdk-crypto-nodejs-linux-x64-gnu'
+ *
+ * This self-check runs during *our* (the root package's) postinstall — that
+ * script is NOT blocked by allow-scripts — and, when the native binding is
+ * missing, re-runs the crypto package's own downloader so the binary is
+ * present before first run. Any failure here degrades to a warning; it never
+ * fails the install (the bridge can still run without E2EE crypto).
+ *
+ * Usage (from package root): node scripts/ensure-crypto-native.mjs
+ */
+
+import { execFileSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { createRequire } from "node:module";
+
+const require = createRequire(import.meta.url);
+
+/** Current platform/arch names as napi-rs names them (no .node suffix). */
+export function nativeBindingBasename() {
+  const { platform, arch } = process;
+  if (platform === "win32") return `matrix-sdk-crypto.win32-${arch}-msvc`;
+  if (platform === "darwin") return `matrix-sdk-crypto.darwin-${arch}`;
+  if (platform === "linux") {
+    const libc = isMusl() ? "musl" : "gnu";
+    return `matrix-sdk-crypto.linux-${arch}-${libc}`;
+  }
+  return null; // unsupported platform — native E2EE unavailable, skip silently
+}
+
+export function isMusl() {
+  // Node >= 10 provides the runtime report; absent report => assume gnu.
+  try {
+    const { glibcVersionRuntime } = process.report.getReport().header;
+    return !glibcVersionRuntime;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Locate the crypto package's own directory. Works both when we are an npm
+ * dependency (node_modules/<scope>/<pkg>) and when running from a repo clone.
+ */
+export function resolveCryptoPackageDir() {
+  const paths = [
+    // As a dependency (global/local npm install). createRequire resolves
+    // relative to this script inside the installed package tree.
+    (() => {
+      try {
+        return require.resolve("@matrix-org/matrix-sdk-crypto-nodejs/package.json");
+      } catch {
+        return null;
+      }
+    })(),
+    // Nested copy under our own node_modules when hybrid layouts appear.
+    (() => {
+      try {
+        return require.resolve("@matrix-org/matrix-sdk-crypto-nodejs/package.json", {
+          paths: [process.cwd()],
+        });
+      } catch {
+        return null;
+      }
+    })(),
+  ].filter(Boolean);
+
+  // Prefer the one actually under a node_modules chain (global installs wire
+  // this via the primary resolution); fall back to any hit.
+  const hit = paths.find((p) => p.includes("node_modules")) ?? paths[0];
+  if (!hit) return null;
+  // hit is the package.json path; chop the filename to get the package dir.
+  return hit.slice(0, hit.lastIndexOf("package.json"));
+}
+
+/**
+ * True when the crypto package dir lacks the native binding this platform needs.
+ * A platform we don't recognise (nativeBindingBasename() === null) counts as
+ * "fine" (skips download) rather than "missing".
+ */
+export function isNativeBindingMissing(cryptoDir, basename) {
+  if (basename === null) return false;
+  return !existsSync(`${cryptoDir}/${basename}.node`);
+}
+
+/** Run the crypto package's own downloader to fetch the native binding. */
+export function runNativeDownloader(cryptoDir) {
+  const script = `${cryptoDir}/download-lib.js`;
+  if (!existsSync(script)) {
+    throw new Error(`crypto downloader not found: ${script}`);
+  }
+  execFileSync(process.execPath, [script], {
+    cwd: cryptoDir,
+    stdio: "inherit",
+    // Inherit proxy env so machines behind a proxy still reach GitHub.
+    env: process.env,
+  });
+}
+
+export function ensureCryptoNative() {
+  const basename = nativeBindingBasename();
+  const cryptoDir = resolveCryptoPackageDir();
+
+  if (!cryptoDir) {
+    console.warn(
+      "[pi-courier] crypto package not found — can't verify native binding; continuing (E2EE may be unavailable)."
+    );
+    return { ok: false, reason: "crypto-package-not-found" };
+  }
+
+  if (!isNativeBindingMissing(cryptoDir, basename)) {
+    // Already present (either downloaded once, or platform unsupported).
+    return { ok: true, downloaded: false };
+  }
+
+  console.info(
+    `[pi-courier] crypto native binding (${basename}.node) missing — downloading (POSTINSTALL due to npm 11 allow-scripts).`
+  );
+  try {
+    runNativeDownloader(cryptoDir);
+    return { ok: true, downloaded: true };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.warn(
+      `[pi-courier] could not auto-download crypto native binding: ${message}\n` +
+        `  The bridge may still run without E2EE. To install manually:\n` +
+        `  cd ${cryptoDir} && node download-lib.js`
+    );
+    return { ok: false, reason: "download-failed" };
+  }
+}
+
+// Allow running both as a bin and importing the named exports for tests.
+if (process.argv[1] && process.argv[1].endsWith("ensure-crypto-native.mjs")) {
+  ensureCryptoNative();
+}