prized 0.0.1 → 0.18.0-rc.2

package/README.md

@@ -1,8 +1,11 @@
 # prized
 
-The Prized CLI — build internal tools against your company's real data sources
-with your own coding agent (Claude Code, Windsurf, Cursor, …), then deploy them
-behind your company's SSO in seconds.
+A cloud dev box for your coding agents.
 
-**This package is a placeholder while the CLI is in development.**
-Learn more at [prized.dev](https://prized.dev).
+```bash
+npx prized
+```
+
+Run it in the folder you want on your box. It signs you up with GitHub or Google, starts a box on the free credit, and sets up this machine: the Prized CLI installed and signed in, the folder synced, and Claude desktop, the ChatGPT app, Cursor or your terminal set up to work on the box.
+
+Docs: https://prized.dev/docs

package/bin/prized.js

@@ -1,10 +1,25 @@
 #!/usr/bin/env node
-console.log(`
-  Prized CLI — coming soon.
+// `npx prized`: runs this package's version of the signed Prized CLI,
+// fetched and verified on first use (lib/install.js). With no arguments it
+// is `prized start`: sign up, get a box, set up this machine
+// (docs/plans/npx-signup.md). Any arguments go to the CLI as they are.
+import { spawnSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { ensureCli } from '../lib/install.js';
+import { isReleaseVersion } from '../lib/release.js';
 
-  Build internal tools against your company's real data sources with
-  your own coding agent, then deploy them behind your company's SSO.
+const { version } = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
 
-  Learn more: https://prized.dev
-`);
-process.exit(0);
+try {
+  if (!isReleaseVersion(version)) {
+    throw new Error(`this is a development copy (${version}); run a published version: npx prized`);
+  }
+  const bin = await ensureCli(version, { log: (line) => process.stderr.write(`${line}\n`) });
+  const args = process.argv.slice(2);
+  const run = spawnSync(bin, args.length > 0 ? args : ['start'], { stdio: 'inherit' });
+  if (run.error) throw run.error;
+  process.exit(run.status ?? 1);
+} catch (err) {
+  process.stderr.write(`prized: ${err instanceof Error ? err.message : String(err)}\n`);
+  process.exit(1);
+}

package/lib/install.js

@@ -0,0 +1,112 @@
+// Fetch this package's own version of the signed Prized CLI, verify it, and
+// keep it in a per-version cache (docs/plans/npx-signup.md §5). Nothing runs
+// unless SHA256SUMS carries the release key's signature, its trusted comment
+// names exactly this version, and the archive matches its line.
+import { spawnSync } from 'node:child_process';
+import { createHash, randomBytes } from 'node:crypto';
+import { existsSync } from 'node:fs';
+import { mkdir, rename, rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { verifyMinisign } from './minisign.js';
+import { assetFor, binaryName, cacheRoot, RELEASE_PUBKEY, RELEASES_BASE } from './release.js';
+
+const VERIFIED = '.verified';
+
+/** The verified CLI for `version`, downloading it the first time. */
+export async function ensureCli(version, opts = {}) {
+  const {
+    base = RELEASES_BASE,
+    pubkey = RELEASE_PUBKEY,
+    platform = process.platform,
+    arch = process.arch,
+    root = cacheRoot(),
+    fetchImpl = fetch,
+    log = () => {},
+  } = opts;
+  const dir = join(root, version);
+  const bin = join(dir, binaryName(platform));
+  if (isVerified(dir, bin)) return bin;
+
+  const asset = assetFor(version, platform, arch);
+  const from = `${base}/cli/v${version}`;
+  log(`Downloading Prized ${version}…`);
+  const [sums, sig, archive] = await Promise.all([
+    get(fetchImpl, `${from}/SHA256SUMS`),
+    get(fetchImpl, `${from}/SHA256SUMS.minisig`),
+    get(fetchImpl, `${from}/${asset}`),
+  ]);
+  const trusted = verifyMinisign(sums, sig, pubkey);
+  if (trusted !== `prized ${version}`) {
+    throw new Error(`the release's signature names "${trusted}", not prized ${version}`);
+  }
+  const want = sumFor(sums.toString('utf8'), asset);
+  const got = createHash('sha256').update(archive).digest('hex');
+  if (want === null || want !== got) throw new Error(`${asset} does not match the signed SHA256SUMS`);
+
+  // Unpacked next to the cache and renamed in, so a half-written directory
+  // is never taken for a verified one.
+  await mkdir(root, { recursive: true });
+  const tmp = join(root, `.${version}.${randomBytes(6).toString('hex')}`);
+  await mkdir(tmp, { recursive: true });
+  try {
+    const file = join(tmp, asset);
+    await writeFile(file, archive, { mode: 0o600 });
+    const tar = spawnSync('tar', [asset.endsWith('.zip') ? '-xf' : '-xzf', file, '-C', tmp], { stdio: 'pipe' });
+    if (tar.status !== 0) {
+      throw new Error(`could not unpack ${asset}: ${(tar.stderr ?? '').toString().trim() || tar.error?.message || 'tar failed'}`);
+    }
+    await rm(file);
+    if (!existsSync(join(tmp, binaryName(platform)))) throw new Error(`${asset} has no ${binaryName(platform)}`);
+    await writeFile(join(tmp, VERIFIED), `${version}\n`);
+    await moveInto(tmp, dir, bin);
+  } catch (err) {
+    await rm(tmp, { recursive: true, force: true });
+    throw err;
+  }
+  return bin;
+}
+
+function isVerified(dir, bin) {
+  return existsSync(join(dir, VERIFIED)) && existsSync(bin);
+}
+
+/**
+ * Puts the unpacked tmp in place as dir. Another `npx prized` may have got
+ * there first, and may be running from it: its verified copy is the same
+ * signed release, so it stays and tmp goes. Only a copy that lost its binary
+ * (a cache cleaner) is moved aside and replaced.
+ */
+async function moveInto(tmp, dir, bin) {
+  for (let attempt = 0; ; attempt++) {
+    try {
+      await rename(tmp, dir);
+      return;
+    } catch (err) {
+      if (!['EEXIST', 'ENOTEMPTY', 'EPERM', 'EACCES', 'EBUSY'].includes(err.code) || attempt > 0) {
+        if (isVerified(dir, bin)) break;
+        throw err;
+      }
+    }
+    if (isVerified(dir, bin)) break;
+    const stale = `${dir}.stale-${randomBytes(6).toString('hex')}`;
+    await rename(dir, stale).catch(() => {}); // a racer may have moved it already
+    await rm(stale, { recursive: true, force: true });
+  }
+  await rm(tmp, { recursive: true, force: true });
+}
+
+/** The sha256 SHA256SUMS lists for `name`, or null. */
+export function sumFor(sums, name) {
+  for (const line of sums.split('\n')) {
+    const m = /^([0-9a-f]{64}) [ *](.+)$/.exec(line.trim());
+    if (m && m[2] === name) return m[1];
+  }
+  return null;
+}
+
+async function get(fetchImpl, url) {
+  const res = await fetchImpl(url, { redirect: 'follow' });
+  if (!res.ok) throw new Error(`${url} answered ${res.status}`);
+  return Buffer.from(await res.arrayBuffer());
+}
+

package/lib/minisign.js

@@ -0,0 +1,44 @@
+// minisign signature verification (https://jedisct1.github.io/minisign/),
+// Node's own crypto only: Ed25519 over the file (legacy "Ed") or over its
+// BLAKE2b-512 (prehashed "ED"), then the global signature over the
+// signature and the trusted comment. Returns the trusted comment; throws on
+// anything else.
+import { createHash, createPublicKey, verify } from 'node:crypto';
+
+// An Ed25519 SubjectPublicKeyInfo is this prefix and the 32 raw key bytes.
+const SPKI_ED25519 = Buffer.from('302a300506032b6570032100', 'hex');
+
+export function parsePublicKey(b64) {
+  const raw = Buffer.from(b64.trim(), 'base64');
+  if (raw.length !== 42 || raw.subarray(0, 2).toString('latin1') !== 'Ed') {
+    throw new Error('not a minisign public key');
+  }
+  return {
+    keyId: raw.subarray(2, 10),
+    key: createPublicKey({ key: Buffer.concat([SPKI_ED25519, raw.subarray(10)]), format: 'der', type: 'spki' }),
+  };
+}
+
+export function verifyMinisign(data, signatureFile, publicKeyB64) {
+  const pub = parsePublicKey(publicKeyB64);
+  const lines = signatureFile.toString('utf8').replace(/\r\n/g, '\n').split('\n');
+  if (!lines[0]?.startsWith('untrusted comment:') || !lines[2]?.startsWith('trusted comment: ')) {
+    throw new Error('not a minisign signature');
+  }
+  const sig = Buffer.from(lines[1] ?? '', 'base64');
+  const global = Buffer.from(lines[3] ?? '', 'base64');
+  if (sig.length !== 74 || global.length !== 64) throw new Error('not a minisign signature');
+  const alg = sig.subarray(0, 2).toString('latin1');
+  if (!sig.subarray(2, 10).equals(pub.keyId)) throw new Error('signed with another key');
+  let message;
+  if (alg === 'ED') message = createHash('blake2b512').update(data).digest();
+  else if (alg === 'Ed') message = data;
+  else throw new Error('unknown minisign algorithm');
+  const signature = sig.subarray(10);
+  if (!verify(null, message, pub.key, signature)) throw new Error('the signature does not match');
+  const trusted = lines[2].slice('trusted comment: '.length);
+  if (!verify(null, Buffer.concat([signature, Buffer.from(trusted, 'utf8')]), pub.key, global)) {
+    throw new Error('the trusted comment does not match its signature');
+  }
+  return trusted;
+}

package/lib/release.js

@@ -0,0 +1,36 @@
+// Where the signed Prized CLI lives and how to name this machine's build
+// (the release workflow's archive names, docs/plans/npx-signup.md §5).
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+export const RELEASES_BASE = 'https://doppel-releases-072456928225-usw2.s3.us-west-2.amazonaws.com';
+
+// The release key (minisign), the same one internal/release/pubkey.go
+// builds into the CLI; test/key.test.js keeps the two equal.
+export const RELEASE_PUBKEY = 'RWRIbc5tPnYdNEgRUmAmeIXR3z908C9Kn4ln7J0wiTBCjoSWMgTfvimR';
+
+const GOARCH = { x64: 'amd64', arm64: 'arm64' };
+
+/** The archive this platform installs for `version` (no leading v). */
+export function assetFor(version, platform = process.platform, arch = process.arch) {
+  if (platform === 'darwin') return `prized_${version}_darwin_all.tar.gz`;
+  const goarch = GOARCH[arch];
+  if (goarch && platform === 'linux') return `prized_${version}_linux_${goarch}.tar.gz`;
+  if (goarch && platform === 'win32') return `prized_${version}_windows_${goarch}.zip`;
+  throw new Error(`there is no Prized CLI for ${platform}/${arch}`);
+}
+
+export function binaryName(platform = process.platform) {
+  return platform === 'win32' ? 'prized.exe' : 'prized';
+}
+
+/** The per-version cache the verified CLI is kept in. */
+export function cacheRoot(env = process.env, platform = process.platform, home = homedir()) {
+  if (platform === 'win32') return join(env.LOCALAPPDATA || join(home, 'AppData', 'Local'), 'Prized', 'npm');
+  return join(env.XDG_CACHE_HOME || join(home, '.cache'), 'prized', 'npm');
+}
+
+/** A release version this package can run: x.y.z, optionally -pre. */
+export function isReleaseVersion(v) {
+  return /^\d+\.\d+\.\d+(-[0-9A-Za-z.]+)?$/.test(v) && !v.startsWith('0.0.0');
+}

package/package.json

@@ -1,15 +1,18 @@
 {
   "name": "prized",
-  "version": "0.0.1",
-  "description": "Prized CLI — build internal tools against your company's real data with your own coding agent. Coming soon.",
+  "version": "0.18.0-rc.2",
+  "description": "Prized: a cloud dev box for your coding agents. npx prized signs you up, starts your box and sets up this machine.",
+  "homepage": "https://prized.dev",
+  "license": "UNLICENSED",
+  "type": "module",
   "bin": {
     "prized": "bin/prized.js"
   },
-  "files": ["bin", "README.md"],
-  "keywords": ["prized", "internal-tools", "cli"],
-  "homepage": "https://prized.dev",
-  "author": "Prized (https://prized.dev)",
-  "license": "UNLICENSED",
+  "files": [
+    "bin",
+    "lib",
+    "README.md"
+  ],
   "engines": {
     "node": ">=18"
   }