riciplay 1.8.95 → 1.9.1

package/README.md

@@ -29,6 +29,18 @@ riciplay chat         # start an agent session
 
 ## The npm wrapper
 
-`bin/riciplay` prefers the pip-installed console script on PATH and falls back to invoking `riciplay_cli.main:app` through `python3`. `scripts/postinstall.js` pip-installs `riciplay-cli` if the module isn't importable — and degrades to a printed manual instruction when it can't (no network, `--ignore-scripts`, managed Python).
+`bin/riciplay` resolves the pip-installed console script via `PATH` and falls back to invoking `riciplay_cli.main:app` through `python3`. It explicitly excludes its own path as a candidate, so an npm global install (which symlinks this wrapper onto `PATH`) can never re-exec itself.
+
+`scripts/postinstall.js` pip-installs `riciplay-cli` **pinned to this launcher's exact version** (`riciplay-cli==<package.json version>`), and compares the *installed* version rather than merely checking that the module imports — so an out-of-date install is upgraded instead of being silently kept. It degrades to a printed manual command when it can't (no network, `--ignore-scripts`, managed Python).
+
+### The two versions are locked together
+
+The launcher and the Python package must be released at the same version, because postinstall pins the pair. That used to be an unenforced convention and it drifted (npm `1.8.95` against PyPI `1.8.96`). Three things now enforce it:
+
+- `npm test` / `npm publish` run `scripts/check-version-sync.js` — `prepublishOnly` **refuses to publish** a mismatched pair
+- `pytest tests/test_version_sync.py` fails the suite on drift, catching it at PR time
+- `python scripts/bump_version.py <version>` moves both files together, so the correct action is also the easy one (`--check` to verify, `--show` to inspect)
+
+Release order: **PyPI first, then npm** — the pinned postinstall needs the matching version to already exist on PyPI.
 
 Repository: [Zaidux/Riciplay](https://github.com/Zaidux/Riciplay)

package/bin/riciplay

@@ -5,17 +5,85 @@
 //                       python3 -c "from riciplay_cli.main import app; app()"
 //
 // The Python package is installed by scripts/postinstall.js (pip install
-// riciplay-cli). When the pip console script exists on PATH, exec it
-// directly (identical behavior to a native install); otherwise invoke
-// the app entry through python3 with argv[0] normalized so the CLI's
-// own help/version output stays correct.
+// riciplay-cli). The real console script is resolved through PATH — the same
+// resolution the OS/shell performs — so a venv/pipx install
+// (<venv>/bin/riciplay) is found instead of silently falling back to the
+// system python3. Crucially, this wrapper's own file is explicitly excluded
+// as a candidate: an npm global install puts a symlink to this very script on
+// PATH (/usr/local/bin/riciplay), and matching it re-executed the wrapper
+// forever. Only when no other candidate exists do we fall back to
+// `python3 -m`, which is exactly the case the wrapper must never feed itself.
 
 const { spawn } = require('child_process');
-const { existsSync } = require('fs');
+const fs = require('fs');
 const path = require('path');
 const { EOL } = require('os');
 
-const args = process.argv.slice(2);
+function realpathSafe(p) {
+  try {
+    return fs.realpathSync(p);
+  } catch {
+    return path.resolve(p);
+  }
+}
+
+/**
+ * Filesystem identities of this wrapper, so it can never be selected as its
+ * own target. Both the symlinked invoke path (process.argv[1]) and the real
+ * module path (__filename) are registered: npm's global bin is a symlink to
+ * the latter, while a plain copy would match the former.
+ */
+function selfIdentities({ filename, argv1 }) {
+  const ids = new Set();
+  if (filename) {
+    ids.add(realpathSafe(filename));
+    ids.add(path.resolve(filename));
+  }
+  if (argv1) {
+    ids.add(realpathSafe(argv1));
+    ids.add(path.resolve(argv1));
+  }
+  return ids;
+}
+
+/**
+ * Resolve the installed `riciplay` console script via PATH.
+ *
+ * Returns the candidate path, or null when the only match on PATH is this
+ * wrapper itself (in which case the caller falls back to `python3 -m`).
+ */
+function resolveConsoleScript(options = {}) {
+  const platform = options.platform || process.platform;
+  const env = options.env || process.env;
+  const filename = options.filename || __filename;
+  const argv1 = 'argv1' in options ? options.argv1 : process.argv[1];
+  const isWin = platform === 'win32';
+
+  // Windows: pip installs `riciplay.exe`. npm's own shim is a .cmd/.ps1, so
+  // searching for the .exe cannot accidentally match the npm shim.
+  const name = isWin ? 'riciplay.exe' : 'riciplay';
+  const pathEnv = env.PATH || env.Path || '';
+  const sep = isWin ? ';' : ':';
+  const own = selfIdentities({ filename, argv1 });
+
+  for (const dir of pathEnv.split(sep)) {
+    if (!dir) continue;
+    const candidate = path.join(dir, name);
+    let st;
+    try {
+      st = fs.statSync(candidate); // follows symlinks
+    } catch {
+      continue;
+    }
+    if (!st.isFile()) continue;
+    // Never re-exec this wrapper — by realpath (npm symlink) or by literal
+    // path (copied install).
+    if (own.has(realpathSafe(candidate)) || own.has(path.resolve(candidate))) continue;
+    if (!isWin && (st.mode & 0o111) === 0) continue; // not executable
+    return candidate;
+  }
+  return null;
+}
 
 function fail(msg) {
   process.stderr.write(`Error: ${msg}${EOL}`);
@@ -30,21 +98,25 @@ function run(cmd, argv) {
   proc.on('close', (code) => process.exit(code ?? 1));
 }
 
-// Prefer an installed console script (same PATH resolution pip used).
-const isWin = process.platform === 'win32';
-const exe = isWin ? 'riciplay.exe' : 'riciplay';
-for (const dir of ['/usr/local/bin', '/usr/bin', path.join(process.env.HOME || '', '.local', 'bin')]) {
-  const candidate = path.join(dir, exe);
-  if (existsSync(candidate)) {
-    run(candidate, args);
+function main(argv = process.argv.slice(2)) {
+  // Prefer an installed console script (same PATH resolution the OS used).
+  const candidate = resolveConsoleScript();
+  if (candidate) {
+    run(candidate, argv);
     return;
   }
+
+  // Module fallback — app() reads sys.argv; normalize argv[0] so usage
+  // strings and version output match the real console script.
+  run('python3', [
+    '-c',
+    "import sys; sys.argv[0] = 'riciplay'; from riciplay_cli.main import app; app()",
+    ...argv,
+  ]);
+}
+
+if (require.main === module) {
+  main();
 }
 
-// Module fallback — app() reads sys.argv; normalize argv[0] so usage
-// strings and version output match the real console script.
-run('python3', [
-  '-c',
-  "import sys; sys.argv[0] = 'riciplay'; from riciplay_cli.main import app; app()",
-  ...args,
-]);
+module.exports = { resolveConsoleScript, selfIdentities, main };

package/package.json

@@ -1,14 +1,14 @@
 {
   "name": "riciplay",
-  "version": "1.8.95",
-  "description": "AI-powered bug bounty reconnaissance and penetration testing agent — browser, proxy interception, recon, and exploit workflows",
+  "version": "1.9.1",
+  "description": "AI-powered bug bounty reconnaissance and penetration testing agent \u2014 browser, proxy interception, recon, and exploit workflows",
   "main": "index.js",
   "bin": {
     "riciplay": "./bin/riciplay"
   },
   "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1",
-    "prepublishOnly": "echo \"Ensure riciplay-cli is published to PyPI first\"",
+    "test": "node scripts/check-version-sync.js",
+    "prepublishOnly": "node scripts/check-version-sync.js || (echo 'Refusing to publish: npm and PyPI versions disagree.' && exit 1)",
     "postinstall": "node scripts/postinstall.js"
   },
   "repository": {

package/scripts/postinstall.js

@@ -1,40 +1,101 @@
 #!/usr/bin/env node
-// Riciplay npm postinstall — installs the Python package from PyPI.
+// Riciplay npm postinstall — installs the matching Python package from PyPI.
 //
-// This npm package is a launcher; the implementation is the Python
-// package `riciplay-cli` (PyPI). If it is not importable, pip install
-// it. Failures are warnings, not errors: the user may be installing
-// with --ignore-scripts, without network, or managing Python manually —
-// print the manual command instead of failing the install.
+// This npm package is a launcher; the implementation is the Python package
+// `riciplay-cli` (PyPI). The two versions are meant to be identical, and this
+// script enforces that:
+//
+//   * it installs the EXACT version matching this npm release
+//     (`riciplay-cli==<package.json version>`), never just "latest", so a
+//     launcher can never end up driving a different implementation than the
+//     one it was released with;
+//   * it compares the INSTALLED version, not merely whether the module
+//     imports. The previous check was `python -c "import riciplay_cli"`, which
+//     passed for any old version already present — so a fresh npm install
+//     silently kept a stale CLI and reported "already importable".
+//
+// Failures are warnings, not errors: the user may be installing with
+// --ignore-scripts, without network, or managing Python manually — print the
+// manual command instead of failing the install.
 
 const { execSync, spawnSync } = require('child_process');
 const os = require('os');
+const path = require('path');
 
-console.log('\n🕷️  Installing Riciplay (bug bounty AI agent)...\n');
+const npmVersion = require(path.join(__dirname, '..', 'package.json')).version;
 
 const isWin = os.platform() === 'win32';
 const python = isWin ? 'python' : 'python3';
 const pip = isWin ? 'pip' : 'pip3';
 
-function probe(module) {
-  const r = spawnSync(python, ['-c', `import ${module}`], { stdio: 'ignore' });
-  return r.status === 0;
+/**
+ * The version of `riciplay_cli` importable right now, or null if it is not
+ * installed / not importable.
+ *
+ * Read via `riciplay_cli.__version__`, which falls back to parsing
+ * pyproject.toml when dist metadata is unavailable, so this works for both a
+ * pip install and a source checkout.
+ */
+function installedVersion(py = python, run = spawnSync) {
+  const r = run(py, ['-c', 'import riciplay_cli; print(riciplay_cli.__version__)'], {
+    encoding: 'utf8',
+  });
+  if (r.status !== 0 || !r.stdout) return null;
+  const v = String(r.stdout).trim();
+  return v && v !== '0.0.0' ? v : null;
+}
+
+/** True when the installed CLI is not the version this launcher ships with. */
+function needsInstall(installed, target = npmVersion) {
+  return installed !== target;
+}
+
+/** The exact pip requirement pinning the Python package to this npm release. */
+function pipSpec(target = npmVersion) {
+  return `riciplay-cli==${target}`;
 }
 
-try {
-  if (probe('riciplay_cli')) {
-    console.log('✓ Python package `riciplay_cli` already importable.');
+function main() {
+  console.log('\n🕷️  Installing Riciplay (bug bounty AI agent)...\n');
+
+  let current = null;
+  try {
+    current = installedVersion();
+  } catch {
+    current = null; // treated as "not installed" below
+  }
+
+  if (!needsInstall(current)) {
+    console.log(`✓ riciplay-cli ${npmVersion} already installed.`);
   } else {
-    console.log('Installing riciplay-cli from PyPI (this also pulls Chrome/mitmproxy deps)...');
-    execSync(`${pip} install --upgrade riciplay-cli`, { stdio: 'inherit' });
-    console.log('✓ Installed riciplay-cli.');
+    if (current) {
+      console.log(
+        `Updating riciplay-cli ${current} → ${npmVersion} ` +
+        '(the launcher and the Python package are version-locked)...'
+      );
+    } else {
+      console.log(
+        `Installing riciplay-cli ${npmVersion} from PyPI ` +
+        '(this also pulls Chrome/mitmproxy deps)...'
+      );
+    }
+    try {
+      execSync(`${pip} install --upgrade ${pipSpec()}`, { stdio: 'inherit' });
+      console.log(`✓ Installed riciplay-cli ${npmVersion}.`);
+    } catch (err) {
+      console.warn(
+        `\n⚠ Could not install the Python package automatically (${err.message}).\n` +
+        '  Riciplay needs Python 3.10+. Install the matching version manually with:\n' +
+        `    pip install ${pipSpec()}\n`
+      );
+    }
   }
-} catch (err) {
-  console.warn(
-    `\n⚠ Could not install the Python package automatically (${err.message}).\n` +
-    '  Riciplay needs Python 3.10+. Install manually with:\n' +
-    '    pip install riciplay-cli\n'
-  );
+
+  console.log('\nUsage: riciplay chat   # start an agent session\n');
+}
+
+if (require.main === module) {
+  main();
 }
 
-console.log('\nUsage: riciplay chat   # start an agent session\n');
+module.exports = { npmVersion, installedVersion, needsInstall, pipSpec, main };