riciplay 1.9.0 → 1.9.1

package/README.md

@@ -29,6 +29,18 @@ riciplay chat         # start an agent session
 
 ## The npm wrapper
 
-`bin/riciplay` prefers the pip-installed console script on PATH and falls back to invoking `riciplay_cli.main:app` through `python3`. `scripts/postinstall.js` pip-installs `riciplay-cli` if the module isn't importable — and degrades to a printed manual instruction when it can't (no network, `--ignore-scripts`, managed Python).
+`bin/riciplay` resolves the pip-installed console script via `PATH` and falls back to invoking `riciplay_cli.main:app` through `python3`. It explicitly excludes its own path as a candidate, so an npm global install (which symlinks this wrapper onto `PATH`) can never re-exec itself.
+
+`scripts/postinstall.js` pip-installs `riciplay-cli` **pinned to this launcher's exact version** (`riciplay-cli==<package.json version>`), and compares the *installed* version rather than merely checking that the module imports — so an out-of-date install is upgraded instead of being silently kept. It degrades to a printed manual command when it can't (no network, `--ignore-scripts`, managed Python).
+
+### The two versions are locked together
+
+The launcher and the Python package must be released at the same version, because postinstall pins the pair. That used to be an unenforced convention and it drifted (npm `1.8.95` against PyPI `1.8.96`). Three things now enforce it:
+
+- `npm test` / `npm publish` run `scripts/check-version-sync.js` — `prepublishOnly` **refuses to publish** a mismatched pair
+- `pytest tests/test_version_sync.py` fails the suite on drift, catching it at PR time
+- `python scripts/bump_version.py <version>` moves both files together, so the correct action is also the easy one (`--check` to verify, `--show` to inspect)
+
+Release order: **PyPI first, then npm** — the pinned postinstall needs the matching version to already exist on PyPI.
 
 Repository: [Zaidux/Riciplay](https://github.com/Zaidux/Riciplay)

package/package.json

@@ -1,14 +1,14 @@
 {
   "name": "riciplay",
-  "version": "1.9.0",
+  "version": "1.9.1",
   "description": "AI-powered bug bounty reconnaissance and penetration testing agent \u2014 browser, proxy interception, recon, and exploit workflows",
   "main": "index.js",
   "bin": {
     "riciplay": "./bin/riciplay"
   },
   "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1",
-    "prepublishOnly": "echo \"Ensure riciplay-cli is published to PyPI first\"",
+    "test": "node scripts/check-version-sync.js",
+    "prepublishOnly": "node scripts/check-version-sync.js || (echo 'Refusing to publish: npm and PyPI versions disagree.' && exit 1)",
     "postinstall": "node scripts/postinstall.js"
   },
   "repository": {

package/scripts/postinstall.js

@@ -1,40 +1,101 @@
 #!/usr/bin/env node
-// Riciplay npm postinstall — installs the Python package from PyPI.
+// Riciplay npm postinstall — installs the matching Python package from PyPI.
 //
-// This npm package is a launcher; the implementation is the Python
-// package `riciplay-cli` (PyPI). If it is not importable, pip install
-// it. Failures are warnings, not errors: the user may be installing
-// with --ignore-scripts, without network, or managing Python manually —
-// print the manual command instead of failing the install.
+// This npm package is a launcher; the implementation is the Python package
+// `riciplay-cli` (PyPI). The two versions are meant to be identical, and this
+// script enforces that:
+//
+//   * it installs the EXACT version matching this npm release
+//     (`riciplay-cli==<package.json version>`), never just "latest", so a
+//     launcher can never end up driving a different implementation than the
+//     one it was released with;
+//   * it compares the INSTALLED version, not merely whether the module
+//     imports. The previous check was `python -c "import riciplay_cli"`, which
+//     passed for any old version already present — so a fresh npm install
+//     silently kept a stale CLI and reported "already importable".
+//
+// Failures are warnings, not errors: the user may be installing with
+// --ignore-scripts, without network, or managing Python manually — print the
+// manual command instead of failing the install.
 
 const { execSync, spawnSync } = require('child_process');
 const os = require('os');
+const path = require('path');
 
-console.log('\n🕷️  Installing Riciplay (bug bounty AI agent)...\n');
+const npmVersion = require(path.join(__dirname, '..', 'package.json')).version;
 
 const isWin = os.platform() === 'win32';
 const python = isWin ? 'python' : 'python3';
 const pip = isWin ? 'pip' : 'pip3';
 
-function probe(module) {
-  const r = spawnSync(python, ['-c', `import ${module}`], { stdio: 'ignore' });
-  return r.status === 0;
+/**
+ * The version of `riciplay_cli` importable right now, or null if it is not
+ * installed / not importable.
+ *
+ * Read via `riciplay_cli.__version__`, which falls back to parsing
+ * pyproject.toml when dist metadata is unavailable, so this works for both a
+ * pip install and a source checkout.
+ */
+function installedVersion(py = python, run = spawnSync) {
+  const r = run(py, ['-c', 'import riciplay_cli; print(riciplay_cli.__version__)'], {
+    encoding: 'utf8',
+  });
+  if (r.status !== 0 || !r.stdout) return null;
+  const v = String(r.stdout).trim();
+  return v && v !== '0.0.0' ? v : null;
+}
+
+/** True when the installed CLI is not the version this launcher ships with. */
+function needsInstall(installed, target = npmVersion) {
+  return installed !== target;
+}
+
+/** The exact pip requirement pinning the Python package to this npm release. */
+function pipSpec(target = npmVersion) {
+  return `riciplay-cli==${target}`;
 }
 
-try {
-  if (probe('riciplay_cli')) {
-    console.log('✓ Python package `riciplay_cli` already importable.');
+function main() {
+  console.log('\n🕷️  Installing Riciplay (bug bounty AI agent)...\n');
+
+  let current = null;
+  try {
+    current = installedVersion();
+  } catch {
+    current = null; // treated as "not installed" below
+  }
+
+  if (!needsInstall(current)) {
+    console.log(`✓ riciplay-cli ${npmVersion} already installed.`);
   } else {
-    console.log('Installing riciplay-cli from PyPI (this also pulls Chrome/mitmproxy deps)...');
-    execSync(`${pip} install --upgrade riciplay-cli`, { stdio: 'inherit' });
-    console.log('✓ Installed riciplay-cli.');
+    if (current) {
+      console.log(
+        `Updating riciplay-cli ${current} → ${npmVersion} ` +
+        '(the launcher and the Python package are version-locked)...'
+      );
+    } else {
+      console.log(
+        `Installing riciplay-cli ${npmVersion} from PyPI ` +
+        '(this also pulls Chrome/mitmproxy deps)...'
+      );
+    }
+    try {
+      execSync(`${pip} install --upgrade ${pipSpec()}`, { stdio: 'inherit' });
+      console.log(`✓ Installed riciplay-cli ${npmVersion}.`);
+    } catch (err) {
+      console.warn(
+        `\n⚠ Could not install the Python package automatically (${err.message}).\n` +
+        '  Riciplay needs Python 3.10+. Install the matching version manually with:\n' +
+        `    pip install ${pipSpec()}\n`
+      );
+    }
   }
-} catch (err) {
-  console.warn(
-    `\n⚠ Could not install the Python package automatically (${err.message}).\n` +
-    '  Riciplay needs Python 3.10+. Install manually with:\n' +
-    '    pip install riciplay-cli\n'
-  );
+
+  console.log('\nUsage: riciplay chat   # start an agent session\n');
+}
+
+if (require.main === module) {
+  main();
 }
 
-console.log('\nUsage: riciplay chat   # start an agent session\n');
+module.exports = { npmVersion, installedVersion, needsInstall, pipSpec, main };