rainbo-cli 0.1.5 → 0.1.6

package/README.md

@@ -17,9 +17,9 @@ rainbo-cli --version
 ## Development
 
 ```bash
-Rscript src/rainbo-cli.R --version
+Rscript bin/rainbo-cli.R --version
 npm run build:release
-node scripts/run.js help
+node packaging/npm/run.js help
 ```
 
 ## Release
@@ -29,13 +29,21 @@ node scripts/run.js help
 3. Run:
 
 ```bash
-bash scripts/tag-release.sh
+npm run release:tag
 ```
 
 Pushing the `vX.Y.Z` tag triggers GitHub Actions to create GitHub Release
 archives and publish the npm wrapper package.
 
-Required repository secret:
+Publishing uses npm Trusted Publishing (OIDC) from GitHub Actions. No long-lived
+`NPM_TOKEN` secret is required.
 
-- `NPM_TOKEN`: npm automation token with publish permission for `rainbo-cli`.
+## Project layout
 
+```text
+bin/                 Rscript entrypoint used by source and release archives
+R/rainbo_cli/        CLI command, version, output, and update logic
+packaging/npm/       npm postinstall downloader and bin launcher
+tools/release/       release archive builder and tag helper
+.github/workflows/  GitHub Release + npm Trusted Publishing workflow
+```

package/checksums.txt

@@ -1,6 +1,6 @@
-20cd6f4f46d641bcdd574160533093743d2db7005ff3accb28df94973f30b5f1  rainbo-cli-0.1.5-darwin-amd64.tar.gz
-75f63b5d3a47b63e3d74293b6998bd4d247e3d742a6b00923af58efe1b60d2ac  rainbo-cli-0.1.5-darwin-arm64.tar.gz
-8d03e90f6e6909b60378ed9157666d833a34ddb3b6ae5ee77094d6eb9e81c1a5  rainbo-cli-0.1.5-linux-amd64.tar.gz
-744e9163cde429aae19b70f7d800c92826cc6c5d8e59e26855623684df85e372  rainbo-cli-0.1.5-linux-arm64.tar.gz
-e198b1df9f3684c49a5a65d41b6178d3270f1ca4a48111b05680feb42b3645a5  rainbo-cli-0.1.5-windows-amd64.zip
-e198b1df9f3684c49a5a65d41b6178d3270f1ca4a48111b05680feb42b3645a5  rainbo-cli-0.1.5-windows-arm64.zip
+1eefc9876d83642be4a2326447fc1cd1cdc2147b5c968efe3a7d954b5c990346  rainbo-cli-0.1.6-darwin-amd64.tar.gz
+50d9bdceae09a3b91d5faac0c3766e07f60b66cf9d25aae31c21ef9dfb8674db  rainbo-cli-0.1.6-darwin-arm64.tar.gz
+2bd8eaaa8db300fe7366a84b551e68a5bb52567b34eb33831d237d0548e866b5  rainbo-cli-0.1.6-linux-amd64.tar.gz
+fd6aa48c8af7bef44e1cde5118921f495666bd54c37e2f70de61c71e2cc42634  rainbo-cli-0.1.6-linux-arm64.tar.gz
+4141becb64dfbc4229d6969a08c2fb83566af8eb96c012717156cbf8c2f6d8e3  rainbo-cli-0.1.6-windows-amd64.zip
+4141becb64dfbc4229d6969a08c2fb83566af8eb96c012717156cbf8c2f6d8e3  rainbo-cli-0.1.6-windows-arm64.zip

package/package.json

@@ -1,14 +1,15 @@
 {
   "name": "rainbo-cli",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Rainbo command line tools for data migration workflows",
   "bin": {
-    "rainbo-cli": "scripts/run.js"
+    "rainbo-cli": "packaging/npm/run.js"
   },
   "scripts": {
-    "build:release": "bash scripts/build-release.sh",
-    "postinstall": "node scripts/install.js",
-    "test": "node scripts/run.js --version && node scripts/run.js help"
+    "build:release": "bash tools/release/build-release.sh",
+    "postinstall": "node packaging/npm/install.js",
+    "release:tag": "bash tools/release/tag-release.sh",
+    "test": "node packaging/npm/run.js --version && node packaging/npm/run.js help && node packaging/npm/run.js update --check"
   },
   "os": [
     "darwin",
@@ -28,8 +29,8 @@
   },
   "license": "MIT",
   "files": [
-    "scripts/install.js",
-    "scripts/run.js",
+    "packaging/npm/install.js",
+    "packaging/npm/run.js",
     "checksums.txt",
     "README.md",
     "LICENSE"

package/packaging/npm/install.js

@@ -0,0 +1,167 @@
+#!/usr/bin/env node
+
+const crypto = require("crypto");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const { execFileSync } = require("child_process");
+
+const repoRoot = path.join(__dirname, "..", "..");
+const VERSION = require(path.join(repoRoot, "package.json")).version.replace(/-.*$/, "");
+const REPO = "work2a/rainbo-cli";
+const NAME = "rainbo-cli";
+const DEFAULT_MIRROR_HOST = "https://registry.npmmirror.com";
+const ALLOWED_HOSTS = new Set(["github.com", "objects.githubusercontent.com", "registry.npmmirror.com"]);
+
+const PLATFORM_MAP = { darwin: "darwin", linux: "linux", win32: "windows" };
+const ARCH_MAP = { x64: "amd64", arm64: "arm64" };
+
+const platform = PLATFORM_MAP[process.platform];
+const arch = ARCH_MAP[process.arch];
+const isWindows = process.platform === "win32";
+const ext = isWindows ? ".zip" : ".tar.gz";
+const archiveName = `${NAME}-${VERSION}-${platform}-${arch}${ext}`;
+const githubUrl = `https://github.com/${REPO}/releases/download/v${VERSION}/${archiveName}`;
+const installDir = path.join(repoRoot, "vendor", NAME);
+
+function joinUrl(base, suffix) {
+  return base.replace(/\/+$/, "") + suffix;
+}
+
+function isDefaultNpmjsRegistry(url) {
+  try {
+    return new URL(url).hostname === "registry.npmjs.org";
+  } catch (_) {
+    return false;
+  }
+}
+
+function isValidDownloadBase(raw) {
+  try {
+    const parsed = new URL(raw);
+    return parsed.protocol === "https:" && !!parsed.hostname;
+  } catch (_) {
+    return false;
+  }
+}
+
+function resolveMirrorUrls(env, archive, version) {
+  const binaryPath = `/-/binary/${NAME}/v${version}/${archive}`;
+  const urls = [];
+  const registry = (env.npm_config_registry || "").trim();
+  if (registry && !isDefaultNpmjsRegistry(registry) && isValidDownloadBase(registry)) {
+    const base = new URL(registry);
+    urls.push(joinUrl(base.origin + base.pathname, binaryPath));
+  }
+  const defaultUrl = joinUrl(DEFAULT_MIRROR_HOST, binaryPath);
+  if (!urls.includes(defaultUrl)) urls.push(defaultUrl);
+  return urls;
+}
+
+function assertAllowedHost(url) {
+  const host = new URL(url).hostname;
+  if (!ALLOWED_HOSTS.has(host)) throw new Error(`Download host not allowed: ${host}`);
+}
+
+function download(url, destPath) {
+  assertAllowedHost(url);
+  execFileSync("curl", [
+    "--fail", "--location", "--silent", "--show-error",
+    "--connect-timeout", "10", "--max-time", "120", "--max-redirs", "3",
+    "--output", destPath, url,
+  ], { stdio: ["ignore", "ignore", "pipe"] });
+}
+
+function getExpectedChecksum(archive, checksumsDir) {
+  const checksumsPath = path.join(checksumsDir || repoRoot, "checksums.txt");
+  if (!fs.existsSync(checksumsPath)) {
+    console.error("[WARN] checksums.txt not found, skipping checksum verification");
+    return null;
+  }
+  const content = fs.readFileSync(checksumsPath, "utf8");
+  for (const line of content.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    const idx = trimmed.indexOf("  ");
+    if (idx === -1) continue;
+    if (trimmed.slice(idx + 2) === archive) return trimmed.slice(0, idx);
+  }
+  throw new Error(`Checksum entry not found for ${archive}`);
+}
+
+function verifyChecksum(archivePath, expectedHash) {
+  if (expectedHash === null) return;
+  const hash = crypto.createHash("sha256");
+  const fd = fs.openSync(archivePath, "r");
+  try {
+    const buf = Buffer.alloc(64 * 1024);
+    let bytesRead;
+    while ((bytesRead = fs.readSync(fd, buf, 0, buf.length, null)) > 0) {
+      hash.update(buf.subarray(0, bytesRead));
+    }
+  } finally {
+    fs.closeSync(fd);
+  }
+  const actual = hash.digest("hex");
+  if (actual.toLowerCase() !== expectedHash.toLowerCase()) {
+    throw new Error(`Checksum mismatch for ${path.basename(archivePath)}`);
+  }
+}
+
+function extractArchive(archivePath, destDir) {
+  fs.rmSync(destDir, { recursive: true, force: true });
+  fs.mkdirSync(destDir, { recursive: true });
+  if (isWindows) {
+    const psCommand = "$ErrorActionPreference='Stop';" +
+      "Expand-Archive -LiteralPath $env:RAINBO_CLI_ARCHIVE -DestinationPath $env:RAINBO_CLI_DEST -Force";
+    execFileSync("powershell.exe", ["-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", psCommand], {
+      stdio: "inherit",
+      env: { ...process.env, RAINBO_CLI_ARCHIVE: archivePath, RAINBO_CLI_DEST: destDir },
+    });
+  } else {
+    execFileSync("tar", ["-xzf", archivePath, "-C", destDir, "--strip-components", "1"], { stdio: "inherit" });
+  }
+}
+
+function install() {
+  if (!platform || !arch) throw new Error(`Unsupported platform: ${process.platform}-${process.arch}`);
+  const mirrors = resolveMirrorUrls(process.env, archiveName, VERSION);
+  for (const url of mirrors) ALLOWED_HOSTS.add(new URL(url).hostname);
+  const urls = [githubUrl, ...mirrors];
+
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), `${NAME}-`));
+  const archivePath = path.join(tmpDir, archiveName);
+  try {
+    let lastErr;
+    for (const url of urls) {
+      try {
+        download(url, archivePath);
+        lastErr = null;
+        break;
+      } catch (err) {
+        lastErr = err;
+      }
+    }
+    if (lastErr) throw lastErr;
+    verifyChecksum(archivePath, getExpectedChecksum(archiveName));
+    extractArchive(archivePath, installDir);
+    console.log(`${NAME} v${VERSION} installed successfully`);
+  } finally {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  }
+}
+
+if (require.main === module) {
+  const isNpxPostinstall = process.env.npm_command === "exec" && !process.env.RAINBO_CLI_RUN;
+  if (isNpxPostinstall) process.exit(0);
+  try {
+    install();
+  } catch (err) {
+    console.error(`Failed to install ${NAME}: ${err.message}`);
+    console.error(`Make sure Rscript is installed and the v${VERSION} GitHub Release exists.`);
+    process.exit(1);
+  }
+}
+
+module.exports = { getExpectedChecksum, verifyChecksum, resolveMirrorUrls, assertAllowedHost };
+

package/{scripts → packaging/npm}/run.js

@@ -5,40 +5,46 @@ const fs = require("fs");
 const path = require("path");
 
 const isWindows = process.platform === "win32";
-const launcher = path.join(
-  __dirname,
-  "..",
-  "vendor",
-  "rainbo-cli",
-  isWindows ? "rainbo-cli.cmd" : "rainbo-cli"
-);
-const sourceEntry = path.join(__dirname, "..", "src", "rainbo-cli.R");
+const repoRoot = path.join(__dirname, "..", "..");
+const vendorRoot = path.join(repoRoot, "vendor", "rainbo-cli");
+const launcher = path.join(vendorRoot, isWindows ? "rainbo-cli.cmd" : "rainbo-cli");
+const sourceEntry = path.join(repoRoot, "bin", "rainbo-cli.R");
 
 function installIfMissing() {
-  if (fs.existsSync(launcher)) return;
-  if (fs.existsSync(sourceEntry)) return;
-
+  if (fs.existsSync(launcher) || fs.existsSync(sourceEntry)) return;
   const result = spawnSync(process.execPath, [path.join(__dirname, "install.js")], {
     stdio: "inherit",
     env: { ...process.env, RAINBO_CLI_RUN: "true" },
   });
+  if (result.status !== 0) process.exit(result.status || 1);
+}
 
-  if (result.status !== 0) {
-    process.exit(result.status || 1);
+function recoverWindowsOldLauncher() {
+  if (!isWindows) return;
+  const oldLauncher = launcher + ".old";
+  if (!fs.existsSync(oldLauncher)) return;
+  try {
+    if (!fs.existsSync(launcher)) {
+      fs.renameSync(oldLauncher, launcher);
+      return;
+    }
+    fs.rmSync(oldLauncher, { force: true });
+  } catch (_) {
+    // Best-effort cleanup only.
   }
 }
 
+recoverWindowsOldLauncher();
 installIfMissing();
 
 const useSource = fs.existsSync(sourceEntry);
 const command = useSource ? "Rscript" : launcher;
 const args = useSource ? [sourceEntry, ...process.argv.slice(2)] : process.argv.slice(2);
-
 const result = spawnSync(command, args, { stdio: "inherit", shell: isWindows });
 
 if (result.error) {
   console.error(result.error.message);
   process.exit(1);
 }
-
 process.exit(result.status || 0);
+

package/scripts/install.js

@@ -1,143 +0,0 @@
-#!/usr/bin/env node
-
-const crypto = require("crypto");
-const fs = require("fs");
-const os = require("os");
-const path = require("path");
-const { execFileSync } = require("child_process");
-
-const VERSION = require("../package.json").version.replace(/-.*$/, "");
-const REPO = "work2a/rainbo-cli";
-const NAME = "rainbo-cli";
-
-const PLATFORM_MAP = {
-  darwin: "darwin",
-  linux: "linux",
-  win32: "windows",
-};
-
-const ARCH_MAP = {
-  x64: "amd64",
-  arm64: "arm64",
-};
-
-const platform = PLATFORM_MAP[process.platform];
-const arch = ARCH_MAP[process.arch];
-const isWindows = process.platform === "win32";
-const ext = isWindows ? ".zip" : ".tar.gz";
-const archiveName = `${NAME}-${VERSION}-${platform}-${arch}${ext}`;
-const githubUrl = `https://github.com/${REPO}/releases/download/v${VERSION}/${archiveName}`;
-const vendorDir = path.join(__dirname, "..", "vendor");
-const installDir = path.join(vendorDir, NAME);
-
-function download(url, destPath) {
-  execFileSync("curl", [
-    "--fail",
-    "--location",
-    "--silent",
-    "--show-error",
-    "--connect-timeout",
-    "10",
-    "--max-time",
-    "120",
-    "--max-redirs",
-    "3",
-    "--output",
-    destPath,
-    url,
-  ], { stdio: ["ignore", "ignore", "pipe"] });
-}
-
-function getExpectedChecksum(archive) {
-  const checksumsPath = path.join(__dirname, "..", "checksums.txt");
-  if (!fs.existsSync(checksumsPath)) {
-    console.error("[WARN] checksums.txt not found, skipping checksum verification");
-    return null;
-  }
-
-  const content = fs.readFileSync(checksumsPath, "utf8");
-  for (const line of content.split("\n")) {
-    const trimmed = line.trim();
-    if (!trimmed) continue;
-    const idx = trimmed.indexOf("  ");
-    if (idx === -1) continue;
-    if (trimmed.slice(idx + 2) === archive) return trimmed.slice(0, idx);
-  }
-
-  throw new Error(`Checksum entry not found for ${archive}`);
-}
-
-function verifyChecksum(archivePath, expectedHash) {
-  if (expectedHash === null) return;
-
-  const actual = crypto.createHash("sha256")
-    .update(fs.readFileSync(archivePath))
-    .digest("hex");
-
-  if (actual.toLowerCase() !== expectedHash.toLowerCase()) {
-    throw new Error(`Checksum mismatch for ${path.basename(archivePath)}`);
-  }
-}
-
-function extractArchive(archivePath, destDir) {
-  fs.rmSync(destDir, { recursive: true, force: true });
-  fs.mkdirSync(destDir, { recursive: true });
-
-  if (isWindows) {
-    const psCommand =
-      "$ErrorActionPreference='Stop';" +
-      "Expand-Archive -LiteralPath $env:RAINBO_CLI_ARCHIVE -DestinationPath $env:RAINBO_CLI_DEST -Force";
-    execFileSync("powershell.exe", [
-      "-NoProfile",
-      "-ExecutionPolicy",
-      "Bypass",
-      "-Command",
-      psCommand,
-    ], {
-      stdio: "inherit",
-      env: {
-        ...process.env,
-        RAINBO_CLI_ARCHIVE: archivePath,
-        RAINBO_CLI_DEST: destDir,
-      },
-    });
-  } else {
-    execFileSync("tar", ["-xzf", archivePath, "-C", destDir, "--strip-components", "1"], {
-      stdio: "inherit",
-    });
-  }
-}
-
-function install() {
-  if (!platform || !arch) {
-    throw new Error(`Unsupported platform: ${process.platform}-${process.arch}`);
-  }
-
-  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), `${NAME}-`));
-  const archivePath = path.join(tmpDir, archiveName);
-
-  try {
-    download(githubUrl, archivePath);
-    verifyChecksum(archivePath, getExpectedChecksum(archiveName));
-    extractArchive(archivePath, installDir);
-    console.log(`${NAME} v${VERSION} installed successfully`);
-  } finally {
-    fs.rmSync(tmpDir, { recursive: true, force: true });
-  }
-}
-
-if (require.main === module) {
-  const isNpxPostinstall = process.env.npm_command === "exec" && !process.env.RAINBO_CLI_RUN;
-  if (isNpxPostinstall) process.exit(0);
-
-  try {
-    install();
-  } catch (err) {
-    console.error(`Failed to install ${NAME}: ${err.message}`);
-    console.error(`Make sure the v${VERSION} GitHub Release exists and Rscript is installed.`);
-    process.exit(1);
-  }
-}
-
-module.exports = { getExpectedChecksum, verifyChecksum };
-