rainbo-cli 0.1.5 → 0.1.7

package/README.md

@@ -5,23 +5,64 @@ Rainbo command line tools for data migration workflows.
 ## Requirements
 
 - Node.js 16+
-- R with `Rscript` available on `PATH`
+- Rust toolchain for source development. End users installing from npm get a prebuilt binary.
 
 ## Install
 
 ```bash
 npm install -g rainbo-cli
-rainbo-cli --version
+rainbo-cli version
 ```
 
 ## Development
 
 ```bash
-Rscript src/rainbo-cli.R --version
+cargo run --manifest-path rust/Cargo.toml -- --version
 npm run build:release
-node scripts/run.js help
+node packaging/npm/run.js help
+npm run check:skills
 ```
 
+## Output
+
+Command output is structured for humans, scripts, and AI agents:
+
+```bash
+rainbo-cli version                 # JSON envelope on stdout
+rainbo-cli version --format pretty # Human-readable output
+```
+
+Successful JSON output uses:
+
+```json
+{"ok":true,"data":{...}}
+```
+
+Errors are written to stderr:
+
+```json
+{"ok":false,"error":{"type":"validation","subtype":"invalid_argument","message":"..."}}
+```
+
+## Update
+
+```bash
+rainbo-cli update --check
+rainbo-cli update
+rainbo-cli update --force
+```
+
+`update --check` only reports status. `update` detects npm installations,
+runs `npm install -g rainbo-cli@<latest>` when auto-update is available,
+verifies the new binary, and syncs repository skills with:
+
+```bash
+npx skills add work2a/rainbo-cli -y -g
+```
+
+If automatic update is unavailable, the JSON action is `manual_required` and
+the response includes release and changelog URLs.
+
 ## Release
 
 1. Update `package.json` version.
@@ -29,13 +70,34 @@ node scripts/run.js help
 3. Run:
 
 ```bash
-bash scripts/tag-release.sh
+npm run release:tag
 ```
 
 Pushing the `vX.Y.Z` tag triggers GitHub Actions to create GitHub Release
 archives and publish the npm wrapper package.
 
-Required repository secret:
+Publishing uses npm Trusted Publishing (OIDC) from GitHub Actions. No long-lived
+`NPM_TOKEN` secret is required.
+
+## Skills
 
-- `NPM_TOKEN`: npm automation token with publish permission for `rainbo-cli`.
+Repository skills live in `skills/`. They can be installed from the repository:
 
+```bash
+npx skills add work2a/rainbo-cli#main -y -g
+```
+
+Pull requests publish a preview npm package with `pkg.pr.new` and comment with
+both the CLI update command and the matching skill install command.
+
+## Project layout
+
+```text
+rust/               Rust CLI implementation
+packaging/npm/       npm postinstall downloader and bin launcher
+tools/release/       release archive builder and tag helper
+skills/              Rainbo skills installable with `npx skills add`
+skill-template/      Template for new Rainbo skills
+scripts/             PR preview packaging and skill format checks
+.github/workflows/  GitHub Release + npm Trusted Publishing workflow
+```

package/checksums.txt

@@ -1,6 +1,6 @@
-20cd6f4f46d641bcdd574160533093743d2db7005ff3accb28df94973f30b5f1  rainbo-cli-0.1.5-darwin-amd64.tar.gz
-75f63b5d3a47b63e3d74293b6998bd4d247e3d742a6b00923af58efe1b60d2ac  rainbo-cli-0.1.5-darwin-arm64.tar.gz
-8d03e90f6e6909b60378ed9157666d833a34ddb3b6ae5ee77094d6eb9e81c1a5  rainbo-cli-0.1.5-linux-amd64.tar.gz
-744e9163cde429aae19b70f7d800c92826cc6c5d8e59e26855623684df85e372  rainbo-cli-0.1.5-linux-arm64.tar.gz
-e198b1df9f3684c49a5a65d41b6178d3270f1ca4a48111b05680feb42b3645a5  rainbo-cli-0.1.5-windows-amd64.zip
-e198b1df9f3684c49a5a65d41b6178d3270f1ca4a48111b05680feb42b3645a5  rainbo-cli-0.1.5-windows-arm64.zip
+3ed156f93253d1aa1f33c8d4551d397ca623fed93a4bbc59da0030779430e15b  rainbo-cli-0.1.7-darwin-amd64.tar.gz
+37e7cc7c758996b05208c8464fee05b8160a1e4bfc845f4035cbc939855903b0  rainbo-cli-0.1.7-darwin-arm64.tar.gz
+4b21440ba1919bbfaf35759e0596e9072dab937bf70f79f72122e681f897bd30  rainbo-cli-0.1.7-linux-amd64.tar.gz
+8842f49579994fe08cf273fd1f0a3ed436886087337c32810c683820c94c5f92  rainbo-cli-0.1.7-linux-arm64.tar.gz
+44779d87de1f1fb5018f69a4ed021162531f4cf99e3de491d2da8747cf370652  rainbo-cli-0.1.7-windows-amd64.zip
+691d327c1cbbd4ef1bead22c5561a762890f860d73fd1899c6cda6f7ce13c3d0  rainbo-cli-0.1.7-windows-arm64.zip

package/package.json

@@ -1,14 +1,17 @@
 {
   "name": "rainbo-cli",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "Rainbo command line tools for data migration workflows",
   "bin": {
-    "rainbo-cli": "scripts/run.js"
+    "rainbo-cli": "packaging/npm/run.js"
   },
   "scripts": {
-    "build:release": "bash scripts/build-release.sh",
-    "postinstall": "node scripts/install.js",
-    "test": "node scripts/run.js --version && node scripts/run.js help"
+    "build:release": "bash tools/release/build-release.sh",
+    "build:pkg-pr-new": "bash scripts/build-pkg-pr-new.sh",
+    "check:skills": "node scripts/skill-format-check/index.js",
+    "postinstall": "node packaging/npm/install.js",
+    "release:tag": "bash tools/release/tag-release.sh",
+    "test": "cargo test --manifest-path rust/Cargo.toml && node packaging/npm/run.js version && node packaging/npm/run.js help && node packaging/npm/run.js update --check"
   },
   "os": [
     "darwin",
@@ -28,8 +31,8 @@
   },
   "license": "MIT",
   "files": [
-    "scripts/install.js",
-    "scripts/run.js",
+    "packaging/npm/install.js",
+    "packaging/npm/run.js",
     "checksums.txt",
     "README.md",
     "LICENSE"

package/packaging/npm/install.js

@@ -0,0 +1,166 @@
+#!/usr/bin/env node
+
+const crypto = require("crypto");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const { execFileSync } = require("child_process");
+
+const repoRoot = path.join(__dirname, "..", "..");
+const VERSION = require(path.join(repoRoot, "package.json")).version.replace(/-.*$/, "");
+const REPO = "work2a/rainbo-cli";
+const NAME = "rainbo-cli";
+const DEFAULT_MIRROR_HOST = "https://registry.npmmirror.com";
+const ALLOWED_HOSTS = new Set(["github.com", "objects.githubusercontent.com", "registry.npmmirror.com"]);
+
+const PLATFORM_MAP = { darwin: "darwin", linux: "linux", win32: "windows" };
+const ARCH_MAP = { x64: "amd64", arm64: "arm64" };
+
+const platform = PLATFORM_MAP[process.platform];
+const arch = ARCH_MAP[process.arch];
+const isWindows = process.platform === "win32";
+const ext = isWindows ? ".zip" : ".tar.gz";
+const archiveName = `${NAME}-${VERSION}-${platform}-${arch}${ext}`;
+const githubUrl = `https://github.com/${REPO}/releases/download/v${VERSION}/${archiveName}`;
+const installDir = path.join(repoRoot, "vendor", NAME);
+
+function joinUrl(base, suffix) {
+  return base.replace(/\/+$/, "") + suffix;
+}
+
+function isDefaultNpmjsRegistry(url) {
+  try {
+    return new URL(url).hostname === "registry.npmjs.org";
+  } catch (_) {
+    return false;
+  }
+}
+
+function isValidDownloadBase(raw) {
+  try {
+    const parsed = new URL(raw);
+    return parsed.protocol === "https:" && !!parsed.hostname;
+  } catch (_) {
+    return false;
+  }
+}
+
+function resolveMirrorUrls(env, archive, version) {
+  const binaryPath = `/-/binary/${NAME}/v${version}/${archive}`;
+  const urls = [];
+  const registry = (env.npm_config_registry || "").trim();
+  if (registry && !isDefaultNpmjsRegistry(registry) && isValidDownloadBase(registry)) {
+    const base = new URL(registry);
+    urls.push(joinUrl(base.origin + base.pathname, binaryPath));
+  }
+  const defaultUrl = joinUrl(DEFAULT_MIRROR_HOST, binaryPath);
+  if (!urls.includes(defaultUrl)) urls.push(defaultUrl);
+  return urls;
+}
+
+function assertAllowedHost(url) {
+  const host = new URL(url).hostname;
+  if (!ALLOWED_HOSTS.has(host)) throw new Error(`Download host not allowed: ${host}`);
+}
+
+function download(url, destPath) {
+  assertAllowedHost(url);
+  execFileSync("curl", [
+    "--fail", "--location", "--silent", "--show-error",
+    "--connect-timeout", "10", "--max-time", "120", "--max-redirs", "3",
+    "--output", destPath, url,
+  ], { stdio: ["ignore", "ignore", "pipe"] });
+}
+
+function getExpectedChecksum(archive, checksumsDir) {
+  const checksumsPath = path.join(checksumsDir || repoRoot, "checksums.txt");
+  if (!fs.existsSync(checksumsPath)) {
+    console.error("[WARN] checksums.txt not found, skipping checksum verification");
+    return null;
+  }
+  const content = fs.readFileSync(checksumsPath, "utf8");
+  for (const line of content.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    const idx = trimmed.indexOf("  ");
+    if (idx === -1) continue;
+    if (trimmed.slice(idx + 2) === archive) return trimmed.slice(0, idx);
+  }
+  throw new Error(`Checksum entry not found for ${archive}`);
+}
+
+function verifyChecksum(archivePath, expectedHash) {
+  if (expectedHash === null) return;
+  const hash = crypto.createHash("sha256");
+  const fd = fs.openSync(archivePath, "r");
+  try {
+    const buf = Buffer.alloc(64 * 1024);
+    let bytesRead;
+    while ((bytesRead = fs.readSync(fd, buf, 0, buf.length, null)) > 0) {
+      hash.update(buf.subarray(0, bytesRead));
+    }
+  } finally {
+    fs.closeSync(fd);
+  }
+  const actual = hash.digest("hex");
+  if (actual.toLowerCase() !== expectedHash.toLowerCase()) {
+    throw new Error(`Checksum mismatch for ${path.basename(archivePath)}`);
+  }
+}
+
+function extractArchive(archivePath, destDir) {
+  fs.rmSync(destDir, { recursive: true, force: true });
+  fs.mkdirSync(destDir, { recursive: true });
+  if (isWindows) {
+    const psCommand = "$ErrorActionPreference='Stop';" +
+      "Expand-Archive -LiteralPath $env:RAINBO_CLI_ARCHIVE -DestinationPath $env:RAINBO_CLI_DEST -Force";
+    execFileSync("powershell.exe", ["-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", psCommand], {
+      stdio: "inherit",
+      env: { ...process.env, RAINBO_CLI_ARCHIVE: archivePath, RAINBO_CLI_DEST: destDir },
+    });
+  } else {
+    execFileSync("tar", ["-xzf", archivePath, "-C", destDir, "--strip-components", "1"], { stdio: "inherit" });
+  }
+}
+
+function install() {
+  if (!platform || !arch) throw new Error(`Unsupported platform: ${process.platform}-${process.arch}`);
+  const mirrors = resolveMirrorUrls(process.env, archiveName, VERSION);
+  for (const url of mirrors) ALLOWED_HOSTS.add(new URL(url).hostname);
+  const urls = [githubUrl, ...mirrors];
+
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), `${NAME}-`));
+  const archivePath = path.join(tmpDir, archiveName);
+  try {
+    let lastErr;
+    for (const url of urls) {
+      try {
+        download(url, archivePath);
+        lastErr = null;
+        break;
+      } catch (err) {
+        lastErr = err;
+      }
+    }
+    if (lastErr) throw lastErr;
+    verifyChecksum(archivePath, getExpectedChecksum(archiveName));
+    extractArchive(archivePath, installDir);
+    console.log(`${NAME} v${VERSION} installed successfully`);
+  } finally {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  }
+}
+
+if (require.main === module) {
+  const isNpxPostinstall = process.env.npm_command === "exec" && !process.env.RAINBO_CLI_RUN;
+  if (isNpxPostinstall) process.exit(0);
+  try {
+    install();
+  } catch (err) {
+    console.error(`Failed to install ${NAME}: ${err.message}`);
+    console.error(`Make sure the v${VERSION} GitHub Release exists for your platform.`);
+    process.exit(1);
+  }
+}
+
+module.exports = { getExpectedChecksum, verifyChecksum, resolveMirrorUrls, assertAllowedHost };

package/packaging/npm/run.js

@@ -0,0 +1,51 @@
+#!/usr/bin/env node
+
+const { spawnSync } = require("child_process");
+const fs = require("fs");
+const path = require("path");
+
+const isWindows = process.platform === "win32";
+const repoRoot = path.join(__dirname, "..", "..");
+const vendorRoot = path.join(repoRoot, "vendor", "rainbo-cli");
+const launcher = path.join(vendorRoot, isWindows ? "rainbo-cli.exe" : "rainbo-cli");
+const sourceManifest = path.join(repoRoot, "rust", "Cargo.toml");
+
+function installIfMissing() {
+  if (fs.existsSync(launcher) || fs.existsSync(sourceManifest)) return;
+  const result = spawnSync(process.execPath, [path.join(__dirname, "install.js")], {
+    stdio: "inherit",
+    env: { ...process.env, RAINBO_CLI_RUN: "true" },
+  });
+  if (result.status !== 0) process.exit(result.status || 1);
+}
+
+function recoverWindowsOldLauncher() {
+  if (!isWindows) return;
+  const oldLauncher = launcher + ".old";
+  if (!fs.existsSync(oldLauncher)) return;
+  try {
+    if (!fs.existsSync(launcher)) {
+      fs.renameSync(oldLauncher, launcher);
+      return;
+    }
+    fs.rmSync(oldLauncher, { force: true });
+  } catch (_) {
+    // Best-effort cleanup only.
+  }
+}
+
+recoverWindowsOldLauncher();
+installIfMissing();
+
+const useSource = fs.existsSync(sourceManifest);
+const command = useSource ? "cargo" : launcher;
+const args = useSource
+  ? ["run", "--quiet", "--manifest-path", sourceManifest, "--", ...process.argv.slice(2)]
+  : process.argv.slice(2);
+const result = spawnSync(command, args, { stdio: "inherit", shell: isWindows });
+
+if (result.error) {
+  console.error(result.error.message);
+  process.exit(1);
+}
+process.exit(result.status || 0);

package/scripts/install.js

@@ -1,143 +0,0 @@
-#!/usr/bin/env node
-
-const crypto = require("crypto");
-const fs = require("fs");
-const os = require("os");
-const path = require("path");
-const { execFileSync } = require("child_process");
-
-const VERSION = require("../package.json").version.replace(/-.*$/, "");
-const REPO = "work2a/rainbo-cli";
-const NAME = "rainbo-cli";
-
-const PLATFORM_MAP = {
-  darwin: "darwin",
-  linux: "linux",
-  win32: "windows",
-};
-
-const ARCH_MAP = {
-  x64: "amd64",
-  arm64: "arm64",
-};
-
-const platform = PLATFORM_MAP[process.platform];
-const arch = ARCH_MAP[process.arch];
-const isWindows = process.platform === "win32";
-const ext = isWindows ? ".zip" : ".tar.gz";
-const archiveName = `${NAME}-${VERSION}-${platform}-${arch}${ext}`;
-const githubUrl = `https://github.com/${REPO}/releases/download/v${VERSION}/${archiveName}`;
-const vendorDir = path.join(__dirname, "..", "vendor");
-const installDir = path.join(vendorDir, NAME);
-
-function download(url, destPath) {
-  execFileSync("curl", [
-    "--fail",
-    "--location",
-    "--silent",
-    "--show-error",
-    "--connect-timeout",
-    "10",
-    "--max-time",
-    "120",
-    "--max-redirs",
-    "3",
-    "--output",
-    destPath,
-    url,
-  ], { stdio: ["ignore", "ignore", "pipe"] });
-}
-
-function getExpectedChecksum(archive) {
-  const checksumsPath = path.join(__dirname, "..", "checksums.txt");
-  if (!fs.existsSync(checksumsPath)) {
-    console.error("[WARN] checksums.txt not found, skipping checksum verification");
-    return null;
-  }
-
-  const content = fs.readFileSync(checksumsPath, "utf8");
-  for (const line of content.split("\n")) {
-    const trimmed = line.trim();
-    if (!trimmed) continue;
-    const idx = trimmed.indexOf("  ");
-    if (idx === -1) continue;
-    if (trimmed.slice(idx + 2) === archive) return trimmed.slice(0, idx);
-  }
-
-  throw new Error(`Checksum entry not found for ${archive}`);
-}
-
-function verifyChecksum(archivePath, expectedHash) {
-  if (expectedHash === null) return;
-
-  const actual = crypto.createHash("sha256")
-    .update(fs.readFileSync(archivePath))
-    .digest("hex");
-
-  if (actual.toLowerCase() !== expectedHash.toLowerCase()) {
-    throw new Error(`Checksum mismatch for ${path.basename(archivePath)}`);
-  }
-}
-
-function extractArchive(archivePath, destDir) {
-  fs.rmSync(destDir, { recursive: true, force: true });
-  fs.mkdirSync(destDir, { recursive: true });
-
-  if (isWindows) {
-    const psCommand =
-      "$ErrorActionPreference='Stop';" +
-      "Expand-Archive -LiteralPath $env:RAINBO_CLI_ARCHIVE -DestinationPath $env:RAINBO_CLI_DEST -Force";
-    execFileSync("powershell.exe", [
-      "-NoProfile",
-      "-ExecutionPolicy",
-      "Bypass",
-      "-Command",
-      psCommand,
-    ], {
-      stdio: "inherit",
-      env: {
-        ...process.env,
-        RAINBO_CLI_ARCHIVE: archivePath,
-        RAINBO_CLI_DEST: destDir,
-      },
-    });
-  } else {
-    execFileSync("tar", ["-xzf", archivePath, "-C", destDir, "--strip-components", "1"], {
-      stdio: "inherit",
-    });
-  }
-}
-
-function install() {
-  if (!platform || !arch) {
-    throw new Error(`Unsupported platform: ${process.platform}-${process.arch}`);
-  }
-
-  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), `${NAME}-`));
-  const archivePath = path.join(tmpDir, archiveName);
-
-  try {
-    download(githubUrl, archivePath);
-    verifyChecksum(archivePath, getExpectedChecksum(archiveName));
-    extractArchive(archivePath, installDir);
-    console.log(`${NAME} v${VERSION} installed successfully`);
-  } finally {
-    fs.rmSync(tmpDir, { recursive: true, force: true });
-  }
-}
-
-if (require.main === module) {
-  const isNpxPostinstall = process.env.npm_command === "exec" && !process.env.RAINBO_CLI_RUN;
-  if (isNpxPostinstall) process.exit(0);
-
-  try {
-    install();
-  } catch (err) {
-    console.error(`Failed to install ${NAME}: ${err.message}`);
-    console.error(`Make sure the v${VERSION} GitHub Release exists and Rscript is installed.`);
-    process.exit(1);
-  }
-}
-
-module.exports = { getExpectedChecksum, verifyChecksum };
-

package/scripts/run.js

@@ -1,44 +0,0 @@
-#!/usr/bin/env node
-
-const { spawnSync } = require("child_process");
-const fs = require("fs");
-const path = require("path");
-
-const isWindows = process.platform === "win32";
-const launcher = path.join(
-  __dirname,
-  "..",
-  "vendor",
-  "rainbo-cli",
-  isWindows ? "rainbo-cli.cmd" : "rainbo-cli"
-);
-const sourceEntry = path.join(__dirname, "..", "src", "rainbo-cli.R");
-
-function installIfMissing() {
-  if (fs.existsSync(launcher)) return;
-  if (fs.existsSync(sourceEntry)) return;
-
-  const result = spawnSync(process.execPath, [path.join(__dirname, "install.js")], {
-    stdio: "inherit",
-    env: { ...process.env, RAINBO_CLI_RUN: "true" },
-  });
-
-  if (result.status !== 0) {
-    process.exit(result.status || 1);
-  }
-}
-
-installIfMissing();
-
-const useSource = fs.existsSync(sourceEntry);
-const command = useSource ? "Rscript" : launcher;
-const args = useSource ? [sourceEntry, ...process.argv.slice(2)] : process.argv.slice(2);
-
-const result = spawnSync(command, args, { stdio: "inherit", shell: isWindows });
-
-if (result.error) {
-  console.error(result.error.message);
-  process.exit(1);
-}
-
-process.exit(result.status || 0);