pytxo 1.2.0 → 1.2.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Pytxo contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,12 +1,12 @@
-# pytxo (npm)
-
-npm wrapper for the [Pytxo](https://pytxo.com) CLI. It downloads the same-version prebuilt binary from the public [pytxo-releases](https://github.com/Pytxo-dev/pytxo-releases) repository during `postinstall`.
-
-Community: [Discord](https://discord.gg/AUFRPFjSYv)
-
-```bash
-npm i -g pytxo
-pytxo doctor
-```
-
-Set `PYTXO_SKIP_DOWNLOAD=1` and `PYTXO_BINARY=/path/to/pytxo` for local development.
+# pytxo (npm)
+
+npm wrapper for the [Pytxo](https://pytxo.com) CLI. It downloads the same-version prebuilt binary from the public [pytxo-releases](https://github.com/Pytxo-dev/pytxo-releases) repository during `postinstall`.
+
+Community: [Discord](https://discord.gg/AUFRPFjSYv)
+
+```bash
+npm i -g pytxo
+pytxo doctor
+```
+
+Set `PYTXO_SKIP_DOWNLOAD=1` and `PYTXO_BINARY=/path/to/pytxo` for local development.

package/bin/pytxo.js

@@ -1,28 +1,28 @@
-#!/usr/bin/env node
-"use strict";
-
-const { spawnSync } = require("node:child_process");
-const fs = require("node:fs");
-const path = require("node:path");
-
-const binName = process.platform === "win32" ? "pytxo.exe" : "pytxo";
-const vendor = path.join(__dirname, "..", "vendor", binName);
-const envBin = process.env.PYTXO_BINARY;
-
-const candidates = [envBin, vendor].filter(Boolean);
-
-for (const bin of candidates) {
-  if (fs.existsSync(bin)) {
-    const result = spawnSync(bin, process.argv.slice(2), { stdio: "inherit" });
-    if (result.error) {
-      console.error(result.error.message);
-      process.exit(1);
-    }
-    process.exit(result.status ?? 1);
-  }
-}
-
-console.error(
-  "pytxo binary not found. Re-run npm install or set PYTXO_BINARY to a local build.",
-);
-process.exit(1);
+#!/usr/bin/env node
+"use strict";
+
+const { spawnSync } = require("node:child_process");
+const fs = require("node:fs");
+const path = require("node:path");
+
+const binName = process.platform === "win32" ? "pytxo.exe" : "pytxo";
+const vendor = path.join(__dirname, "..", "vendor", binName);
+const envBin = process.env.PYTXO_BINARY;
+
+const candidates = [envBin, vendor].filter(Boolean);
+
+for (const bin of candidates) {
+  if (fs.existsSync(bin)) {
+    const result = spawnSync(bin, process.argv.slice(2), { stdio: "inherit" });
+    if (result.error) {
+      console.error(result.error.message);
+      process.exit(1);
+    }
+    process.exit(result.status ?? 1);
+  }
+}
+
+console.error(
+  "pytxo binary not found. Re-run npm install or set PYTXO_BINARY to a local build.",
+);
+process.exit(1);

package/lib/platform.js

@@ -1,21 +1,18 @@
-"use strict";
-
-const { platform, arch } = process;
-
-function getAssetName() {
-  if (platform === "win32") {
-    if (arch === "arm64") return "pytxo-windows-arm64.exe";
-    return "pytxo-windows-x64.exe";
-  }
-  if (platform === "darwin") {
-    if (arch === "arm64") return "pytxo-darwin-arm64";
-    return "pytxo-darwin-x64";
-  }
-  if (platform === "linux") {
-    if (arch === "arm64") return "pytxo-linux-arm64";
-    return "pytxo-linux-x64";
-  }
-  throw new Error(`Unsupported platform: ${platform} ${arch}`);
-}
-
-module.exports = { getAssetName };
+"use strict";
+
+function getAssetName(platform = process.platform, arch = process.arch) {
+  const assets = {
+    "win32:x64": "pytxo-windows-x64.exe",
+    "darwin:arm64": "pytxo-darwin-arm64",
+    "darwin:x64": "pytxo-darwin-x64",
+    "linux:arm64": "pytxo-linux-arm64",
+    "linux:x64": "pytxo-linux-x64",
+  };
+  const asset = assets[`${platform}:${arch}`];
+  if (!asset) {
+    throw new Error(`Unsupported Pytxo release platform: ${platform} ${arch}`);
+  }
+  return asset;
+}
+
+module.exports = { getAssetName };

package/package.json

@@ -1,36 +1,38 @@
-{
-  "name": "pytxo",
-  "version": "1.2.0",
-  "description": "Pytxo agent hypervisor CLI — local-first PTY orchestration",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/Pytxo-dev/pytxo-releases.git"
-  },
-  "homepage": "https://pytxo.com",
-  "bugs": "https://github.com/Pytxo-dev/pytxo-releases/issues",
-  "keywords": [
-    "pytxo",
-    "cli",
-    "ai-agents",
-    "mcp",
-    "orchestration",
-    "terminal",
-    "rust"
-  ],
-  "engines": {
-    "node": ">=18"
-  },
-  "bin": {
-    "pytxo": "bin/pytxo.js"
-  },
-  "files": [
-    "bin",
-    "lib",
-    "postinstall.js",
-    "README.md"
-  ],
-  "scripts": {
-    "postinstall": "node postinstall.js"
-  }
-}
+{
+  "name": "pytxo",
+  "version": "1.2.1",
+  "description": "Pytxo agent hypervisor CLI — local-first PTY orchestration",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Pytxo-dev/pytxo-releases.git"
+  },
+  "homepage": "https://pytxo.com",
+  "bugs": "https://github.com/Pytxo-dev/pytxo-releases/issues",
+  "keywords": [
+    "pytxo",
+    "cli",
+    "ai-agents",
+    "mcp",
+    "orchestration",
+    "terminal",
+    "rust"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "bin": {
+    "pytxo": "bin/pytxo.js"
+  },
+  "files": [
+    "bin",
+    "lib",
+    "postinstall.js",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "postinstall": "node postinstall.js",
+    "test": "node --test test/*.test.js"
+  }
+}

package/postinstall.js

@@ -1,65 +1,167 @@
-"use strict";
-
-const fs = require("node:fs");
-const path = require("node:path");
-const https = require("node:https");
-
-const { getAssetName } = require("./lib/platform");
-
-const REPO = process.env.PYTXO_REPO || "Pytxo-dev/pytxo-releases";
-const VERSION = process.env.PYTXO_VERSION || require("./package.json").version;
-const TAG = VERSION.startsWith("v") ? VERSION : `v${VERSION}`;
-
-const vendorDir = path.join(__dirname, "vendor");
-const asset = getAssetName();
-const destName = process.platform === "win32" ? "pytxo.exe" : "pytxo";
-const dest = path.join(vendorDir, destName);
-
-function download(url) {
-  return new Promise((resolve, reject) => {
-    const file = fs.createWriteStream(dest);
-    https
-      .get(url, (res) => {
-        if (res.statusCode === 302 || res.statusCode === 301) {
-          const loc = res.headers.location;
-          if (!loc) return reject(new Error("Redirect without location"));
-          res.resume();
-          return download(loc).then(resolve, reject);
-        }
-        if (res.statusCode !== 200) {
-          res.resume();
-          return reject(new Error(`HTTP ${res.statusCode} for ${url}`));
-        }
-        res.pipe(file);
-        file.on("finish", () => file.close(resolve));
-      })
-      .on("error", reject);
-  });
-}
-
-async function main() {
-  if (process.env.PYTXO_SKIP_DOWNLOAD === "1") {
-    console.log("pytxo: PYTXO_SKIP_DOWNLOAD=1, skipping binary download");
-    return;
-  }
-  if (fs.existsSync(dest)) {
-    return;
-  }
-  fs.mkdirSync(vendorDir, { recursive: true });
-  const url = `https://github.com/${REPO}/releases/download/${TAG}/${asset}`;
-  console.log(`pytxo: downloading ${asset} from ${TAG}…`);
-  try {
-    await download(url);
-    if (process.platform !== "win32") {
-      fs.chmodSync(dest, 0o755);
-    }
-  } catch (err) {
-    console.warn(
-      `pytxo: could not download release binary (${err.message}).\n` +
-        `  Manual download: https://github.com/${REPO}/releases\n` +
-        `  Or run: curl -fsSL https://raw.githubusercontent.com/${REPO}/main/install.sh | bash`,
-    );
-  }
-}
-
-main();
+"use strict";
+
+const fs = require("node:fs");
+const path = require("node:path");
+const http = require("node:http");
+const https = require("node:https");
+const crypto = require("node:crypto");
+const { spawnSync } = require("node:child_process");
+
+const { getAssetName } = require("./lib/platform");
+
+const REPO = process.env.PYTXO_REPO || "Pytxo-dev/pytxo-releases";
+const VERSION = process.env.PYTXO_VERSION || require("./package.json").version;
+const TAG = VERSION.startsWith("v") ? VERSION : `v${VERSION}`;
+const NORMALIZED_VERSION = VERSION.replace(/^v/, "");
+const MAX_DOWNLOAD_BYTES = 200 * 1024 * 1024;
+const MAX_REDIRECTS = 8;
+
+const vendorDir = process.env.PYTXO_VENDOR_DIR || path.join(__dirname, "vendor");
+const destName = process.platform === "win32" ? "pytxo.exe" : "pytxo";
+const dest = path.join(vendorDir, destName);
+
+function downloadBuffer(url, redirects = 0) {
+  return new Promise((resolve, reject) => {
+    const transport = new URL(url).protocol === "https:" ? https : http;
+    transport
+      .get(url, (res) => {
+        if (res.statusCode === 302 || res.statusCode === 301) {
+          const loc = res.headers.location;
+          if (!loc) return reject(new Error("Redirect without location"));
+          if (redirects >= MAX_REDIRECTS) {
+            res.resume();
+            return reject(new Error(`Too many redirects for ${url}`));
+          }
+          res.resume();
+          return downloadBuffer(new URL(loc, url).toString(), redirects + 1).then(resolve, reject);
+        }
+        if (res.statusCode !== 200) {
+          res.resume();
+          return reject(new Error(`HTTP ${res.statusCode} for ${url}`));
+        }
+        const chunks = [];
+        let bytes = 0;
+        res.on("data", (chunk) => {
+          bytes += chunk.length;
+          if (bytes > MAX_DOWNLOAD_BYTES) {
+            res.destroy(new Error(`Download exceeds ${MAX_DOWNLOAD_BYTES} bytes`));
+            return;
+          }
+          chunks.push(chunk);
+        });
+        res.on("end", () => resolve(Buffer.concat(chunks)));
+        res.on("error", reject);
+      })
+      .on("error", reject);
+  });
+}
+
+function expectedChecksum(checksumText, asset) {
+  for (const line of checksumText.split(/\r?\n/)) {
+    const match = line.match(/^([a-fA-F0-9]{64})\s+\*?(.+)$/);
+    if (match && match[2].trim() === asset) return match[1].toLowerCase();
+  }
+  throw new Error(`SHA256SUMS.txt has no exact entry for ${asset}`);
+}
+
+function sha256(bytes) {
+  return crypto.createHash("sha256").update(bytes).digest("hex");
+}
+
+function assertChecksum(bytes, expected, label) {
+  const actual = sha256(bytes);
+  if (actual !== expected.toLowerCase()) {
+    throw new Error(`SHA-256 mismatch for ${label}: expected ${expected}, got ${actual}`);
+  }
+}
+
+function assertBinaryVersion(binaryPath, expectedVersion = NORMALIZED_VERSION) {
+  const result = spawnSync(binaryPath, ["--version"], {
+    encoding: "utf8",
+    windowsHide: true,
+  });
+  if (result.error) throw result.error;
+  if (result.status !== 0) {
+    throw new Error(`${path.basename(binaryPath)} --version exited ${result.status}`);
+  }
+  const output = `${result.stdout || ""}\n${result.stderr || ""}`.trim();
+  const match = output.match(/\bpytxo\s+v?(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)\b/i);
+  if (!match || match[1] !== expectedVersion) {
+    throw new Error(`Expected pytxo ${expectedVersion}, received ${JSON.stringify(output)}`);
+  }
+}
+
+function installAtomically(tempPath, destination) {
+  const backup = `${destination}.previous-${process.pid}`;
+  let movedExisting = false;
+  try {
+    if (fs.existsSync(destination)) {
+      fs.renameSync(destination, backup);
+      movedExisting = true;
+    }
+    fs.renameSync(tempPath, destination);
+    if (movedExisting) fs.rmSync(backup, { force: true });
+  } catch (error) {
+    if (!fs.existsSync(destination) && movedExisting && fs.existsSync(backup)) {
+      fs.renameSync(backup, destination);
+    }
+    throw error;
+  }
+}
+
+async function main() {
+  if (process.env.PYTXO_SKIP_DOWNLOAD === "1") {
+    console.log("pytxo: PYTXO_SKIP_DOWNLOAD=1, skipping binary download (development only)");
+    return;
+  }
+  const asset = getAssetName();
+  fs.mkdirSync(vendorDir, { recursive: true });
+  const releaseBase = process.env.PYTXO_RELEASE_BASE_URL
+    ? `${process.env.PYTXO_RELEASE_BASE_URL.replace(/\/$/, "")}/${TAG}`
+    : `https://github.com/${REPO}/releases/download/${TAG}`;
+  const checksumUrl = `${releaseBase}/SHA256SUMS.txt`;
+  const url = `${releaseBase}/${asset}`;
+  console.log(`pytxo: downloading ${asset} from ${TAG}…`);
+  const checksumText = (await downloadBuffer(checksumUrl)).toString("utf8");
+  const checksum = expectedChecksum(checksumText, asset);
+
+  if (fs.existsSync(dest)) {
+    const installed = fs.readFileSync(dest);
+    if (sha256(installed) === checksum) {
+      assertBinaryVersion(dest);
+      return;
+    }
+  }
+
+  const bytes = await downloadBuffer(url);
+  assertChecksum(bytes, checksum, asset);
+  const suffix = process.platform === "win32" ? ".exe" : "";
+  const temp = path.join(
+    vendorDir,
+    `.pytxo-download-${process.pid}-${crypto.randomBytes(6).toString("hex")}${suffix}`,
+  );
+  try {
+    fs.writeFileSync(temp, bytes, { flag: "wx", mode: 0o755 });
+    if (process.platform !== "win32") {
+      fs.chmodSync(temp, 0o755);
+    }
+    assertBinaryVersion(temp);
+    installAtomically(temp, dest);
+  } finally {
+    fs.rmSync(temp, { force: true });
+  }
+}
+
+if (require.main === module) {
+  main().catch((error) => {
+    console.error(`pytxo: install failed: ${error.message}`);
+    process.exitCode = 1;
+  });
+}
+
+module.exports = {
+  assertChecksum,
+  expectedChecksum,
+  installAtomically,
+  sha256,
+};