settlekit 0.1.0

package/README.md

@@ -0,0 +1,43 @@
+# SettleKit CLI
+
+Install globally:
+
+```bash
+npm install -g settlekit
+settle login
+```
+
+Or install in a project:
+
+```bash
+npm install settlekit
+npx settlekit login
+```
+
+One-off usage also works without adding it to `package.json`:
+
+```bash
+npx settlekit login
+```
+
+`settle login` opens the SettleKit website, lets you authorize the CLI, and stores a local CLI config. After that:
+
+```bash
+settle tool list
+settle tool call web.search --input '{"q":"SettleKit","count":5}'
+settle credits balance
+```
+
+For staging or self-hosted deployments:
+
+```bash
+SETTLE_PLATFORM_URL=https://app.example.com SETTLE_BASE_URL=https://api.example.com settle login
+```
+
+The npm package bundles platform binaries and verifies the matching `.sha256` file during `postinstall`. If a bundled binary is unavailable, installation falls back to downloading the binary and checksum from GitHub Releases. Private release channels can override:
+
+```bash
+SETTLEKIT_CLI_RELEASE_BASE=https://github.com/your-org/your-repo/releases/download \
+SETTLEKIT_CLI_RELEASE_TAG=v0.1.0 \
+npm install -g settlekit
+```

package/bin/settle.js

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+
+const { spawnSync } = require("node:child_process");
+const fs = require("node:fs");
+const path = require("node:path");
+
+const binaryOverride = process.env.SETTLEKIT_CLI_BINARY;
+const binaryName = process.platform === "win32" ? "settle.exe" : "settle";
+const binaryPath = binaryOverride || path.join(__dirname, "..", "vendor", binaryName);
+
+if (!fs.existsSync(binaryPath)) {
+  console.error("settle: CLI binary was not found.");
+  console.error("Run `npm rebuild -g settlekit` or reinstall with `npm install -g settlekit`.");
+  if (process.env.SETTLEKIT_CLI_RELEASE_BASE || process.env.SETTLEKIT_CLI_RELEASE_TAG) {
+    console.error("Check SETTLEKIT_CLI_RELEASE_BASE and SETTLEKIT_CLI_RELEASE_TAG.");
+  }
+  process.exit(1);
+}
+
+const result = spawnSync(binaryPath, process.argv.slice(2), {
+  stdio: "inherit",
+  env: process.env,
+});
+
+if (result.error) {
+  console.error(`settle: ${result.error.message}`);
+  process.exit(1);
+}
+
+process.exit(result.status ?? 0);

package/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "settlekit",
+  "version": "0.1.0",
+  "description": "SettleKit CLI",
+  "license": "UNLICENSED",
+  "homepage": "https://settlekit.io",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/CalLeeLQY/SettleKit.git",
+    "directory": "npm/settlekit"
+  },
+  "bugs": {
+    "url": "https://github.com/CalLeeLQY/SettleKit/issues"
+  },
+  "keywords": [
+    "settlekit",
+    "cli",
+    "agent",
+    "ai",
+    "tools"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "bin": {
+    "kit": "bin/settle.js",
+    "settle": "bin/settle.js",
+    "settlekit": "bin/settle.js"
+  },
+  "scripts": {
+    "prepack": "node scripts/stage-binaries.js",
+    "postpack": "node scripts/clean-staged-binaries.js",
+    "postinstall": "node scripts/install.js"
+  },
+  "files": [
+    "bin/",
+    "scripts/",
+    "vendor/",
+    "README.md"
+  ],
+  "config": {
+    "release_base": "https://github.com/CalLeeLQY/SettleKit/releases/download"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "os": [
+    "darwin",
+    "linux",
+    "win32"
+  ],
+  "cpu": [
+    "x64",
+    "arm64"
+  ]
+}

package/scripts/clean-staged-binaries.js

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+
+const fs = require("node:fs");
+const path = require("node:path");
+
+const vendorDir = path.resolve(__dirname, "..", "vendor");
+const assets = [
+  "settle-darwin-arm64",
+  "settle-darwin-x64",
+  "settle-linux-arm64",
+  "settle-linux-x64",
+  "settle-win32-arm64.exe",
+  "settle-win32-x64.exe",
+];
+
+for (const asset of assets) {
+  fs.rmSync(path.join(vendorDir, asset), { force: true });
+  fs.rmSync(path.join(vendorDir, `${asset}.sha256`), { force: true });
+}
+
+try {
+  if (fs.existsSync(vendorDir) && fs.readdirSync(vendorDir).length === 0) {
+    fs.rmdirSync(vendorDir);
+  }
+} catch {
+  // Best-effort cleanup only.
+}

package/scripts/install.js

@@ -0,0 +1,189 @@
+#!/usr/bin/env node
+
+const fs = require("node:fs");
+const crypto = require("node:crypto");
+const http = require("node:http");
+const https = require("node:https");
+const os = require("node:os");
+const path = require("node:path");
+const { fileURLToPath } = require("node:url");
+
+const root = path.resolve(__dirname, "..");
+const pkg = require(path.join(root, "package.json"));
+
+if (process.env.SETTLEKIT_SKIP_BINARY_INSTALL === "1") {
+  console.log("settle: skipping binary install because SETTLEKIT_SKIP_BINARY_INSTALL=1");
+  process.exit(0);
+}
+
+const platform = platformName(process.platform);
+const arch = archName(process.arch);
+const binaryName = process.platform === "win32" ? "settle.exe" : "settle";
+const assetName = process.platform === "win32" ? `settle-${platform}-${arch}.exe` : `settle-${platform}-${arch}`;
+const vendorDir = path.join(root, "vendor");
+const target = path.join(vendorDir, binaryName);
+const bundledAsset = path.join(vendorDir, assetName);
+const bundledChecksum = `${bundledAsset}.sha256`;
+const tmp = path.join(os.tmpdir(), `settle-${process.pid}-${Date.now()}`);
+const checksumTmp = `${tmp}.sha256`;
+const releaseBase = stripTrailingSlash(
+    process.env.SETTLEKIT_CLI_RELEASE_BASE ||
+    process.env.npm_package_config_release_base ||
+    pkg.config?.release_base ||
+    "https://github.com/CalLeeLQY/SettleKit/releases/download",
+);
+const releaseTag = process.env.SETTLEKIT_CLI_RELEASE_TAG || `v${pkg.version}`;
+const url = `${releaseBase}/${releaseTag}/${assetName}`;
+const checksumURL = `${url}.sha256`;
+
+fs.mkdirSync(vendorDir, { recursive: true });
+
+if (fs.existsSync(bundledAsset)) {
+  try {
+    installFromLocalAsset(bundledAsset, bundledChecksum, target);
+    console.log(`settle: installed bundled ${assetName}`);
+    process.exit(0);
+  } catch (err) {
+    console.error(`settle: bundled ${assetName} failed verification`);
+    console.error(`settle: ${err.message}`);
+    process.exit(1);
+  }
+}
+
+download(url, tmp, 0, (err) => {
+  if (err) {
+    console.error(`settle: failed to download ${assetName}`);
+    console.error(`settle: ${err.message}`);
+    console.error(`settle: attempted ${url}`);
+    console.error("settle: set SETTLEKIT_CLI_RELEASE_BASE or SETTLEKIT_CLI_RELEASE_TAG for private/staging releases.");
+    process.exit(1);
+  }
+  download(checksumURL, checksumTmp, 0, (checksumErr) => {
+    if (checksumErr && process.env.SETTLEKIT_SKIP_CHECKSUM !== "1") {
+      fs.rmSync(tmp, { force: true });
+      fs.rmSync(checksumTmp, { force: true });
+      console.error(`settle: failed to download checksum for ${assetName}`);
+      console.error(`settle: ${checksumErr.message}`);
+      console.error(`settle: attempted ${checksumURL}`);
+      console.error("settle: set SETTLEKIT_SKIP_CHECKSUM=1 only for trusted private test releases.");
+      process.exit(1);
+    }
+    if (!checksumErr && process.env.SETTLEKIT_SKIP_CHECKSUM !== "1") {
+      const expected = parseChecksum(fs.readFileSync(checksumTmp, "utf8"));
+      const actual = sha256File(tmp);
+      if (!expected || expected !== actual) {
+        fs.rmSync(tmp, { force: true });
+        fs.rmSync(checksumTmp, { force: true });
+        console.error(`settle: checksum mismatch for ${assetName}`);
+        console.error(`settle: expected ${expected || "(missing checksum)"}`);
+        console.error(`settle: actual   ${actual}`);
+        process.exit(1);
+      }
+    }
+    fs.copyFileSync(tmp, target);
+    fs.rmSync(tmp, { force: true });
+    fs.rmSync(checksumTmp, { force: true });
+    if (process.platform !== "win32") {
+      fs.chmodSync(target, 0o755);
+    }
+    console.log(`settle: installed ${assetName}`);
+  });
+});
+
+function installFromLocalAsset(source, checksumPath, destination) {
+  if (process.env.SETTLEKIT_SKIP_CHECKSUM !== "1") {
+    if (!fs.existsSync(checksumPath)) {
+      throw new Error(`missing checksum ${path.basename(checksumPath)}`);
+    }
+    const expected = parseChecksum(fs.readFileSync(checksumPath, "utf8"));
+    const actual = sha256File(source);
+    if (!expected || expected !== actual) {
+      throw new Error(`checksum mismatch: expected ${expected || "(missing checksum)"}, actual ${actual}`);
+    }
+  }
+  fs.copyFileSync(source, destination);
+  if (process.platform !== "win32") {
+    fs.chmodSync(destination, 0o755);
+  }
+}
+
+function parseChecksum(value) {
+  const match = String(value || "").match(/[a-fA-F0-9]{64}/);
+  return match ? match[0].toLowerCase() : "";
+}
+
+function sha256File(filePath) {
+  const hash = crypto.createHash("sha256");
+  const data = fs.readFileSync(filePath);
+  hash.update(data);
+  return hash.digest("hex");
+}
+
+function platformName(value) {
+  switch (value) {
+    case "darwin":
+    case "linux":
+    case "win32":
+      return value;
+    default:
+      throw new Error(`unsupported platform ${value}`);
+  }
+}
+
+function archName(value) {
+  switch (value) {
+    case "x64":
+    case "arm64":
+      return value;
+    default:
+      throw new Error(`unsupported architecture ${value}`);
+  }
+}
+
+function stripTrailingSlash(value) {
+  return String(value || "").replace(/\/+$/, "");
+}
+
+function download(rawURL, destination, redirectCount, done) {
+  if (redirectCount > 5) {
+    done(new Error("too many redirects"));
+    return;
+  }
+  let parsed;
+  try {
+    parsed = new URL(rawURL);
+  } catch (err) {
+    done(err);
+    return;
+  }
+  if (parsed.protocol === "file:") {
+    try {
+      fs.copyFileSync(fileURLToPath(parsed), destination);
+      done();
+    } catch (err) {
+      done(err);
+    }
+    return;
+  }
+  const client = parsed.protocol === "http:" ? http : https;
+  const request = client.get(rawURL, (response) => {
+    const status = response.statusCode || 0;
+    const location = response.headers.location;
+    if (status >= 300 && status < 400 && location) {
+      response.resume();
+      download(new URL(location, rawURL).toString(), destination, redirectCount + 1, done);
+      return;
+    }
+    if (status !== 200) {
+      response.resume();
+      done(new Error(`HTTP ${status}`));
+      return;
+    }
+    const file = fs.createWriteStream(destination, { mode: 0o755 });
+    response.pipe(file);
+    file.on("finish", () => file.close(done));
+    file.on("error", done);
+  });
+  request.on("error", done);
+  request.setTimeout(120000, () => request.destroy(new Error("download timed out")));
+}

package/scripts/stage-binaries.js

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+
+const fs = require("node:fs");
+const path = require("node:path");
+
+const root = path.resolve(__dirname, "..", "..", "..");
+const pkgRoot = path.resolve(__dirname, "..");
+const distDir = path.join(root, "dist");
+const vendorDir = path.join(pkgRoot, "vendor");
+const assets = [
+  "settle-darwin-arm64",
+  "settle-darwin-x64",
+  "settle-linux-arm64",
+  "settle-linux-x64",
+  "settle-win32-arm64.exe",
+  "settle-win32-x64.exe",
+];
+
+if (process.env.SETTLEKIT_SKIP_VENDOR_STAGE === "1") {
+  console.log("settle: skipping bundled binary staging because SETTLEKIT_SKIP_VENDOR_STAGE=1");
+  process.exit(0);
+}
+
+if (!fs.existsSync(distDir)) {
+  console.warn("settle: dist/ was not found; npm package will rely on release download fallback");
+  process.exit(0);
+}
+
+fs.mkdirSync(vendorDir, { recursive: true });
+cleanupVendor();
+
+for (const asset of assets) {
+  const source = path.join(distDir, asset);
+  const checksum = `${source}.sha256`;
+  if (!fs.existsSync(source) || !fs.existsSync(checksum)) {
+    throw new Error(`missing release asset or checksum for ${asset}; run make cli-release first`);
+  }
+  fs.copyFileSync(source, path.join(vendorDir, asset));
+  fs.copyFileSync(checksum, path.join(vendorDir, `${asset}.sha256`));
+}
+
+console.log(`settle: staged ${assets.length} bundled CLI binaries`);
+
+function cleanupVendor() {
+  for (const asset of assets) {
+    fs.rmSync(path.join(vendorDir, asset), { force: true });
+    fs.rmSync(path.join(vendorDir, `${asset}.sha256`), { force: true });
+  }
+}

package/vendor/settle-darwin-arm64.sha256

@@ -0,0 +1 @@
+31e93db71c2ad07319f827a675e65caaa5193a7a94430016bc1f8ca2f08a1345

package/vendor/settle-darwin-x64.sha256

@@ -0,0 +1 @@
+1532c4535ce91c58517731da64431b844651f57158a54de7a78f4d603f5fd127

package/vendor/settle-linux-arm64.sha256

@@ -0,0 +1 @@
+c2c5e1496f78fdd2a7ec0ecbea1b352dd73be617aacb3691f6345690cb6db443

package/vendor/settle-linux-x64.sha256

@@ -0,0 +1 @@
+fdeb89c62e701963b8b87f8413bcc3f4b6efb885d5872e47719079d1ea892b97

package/vendor/settle-win32-arm64.exe.sha256

@@ -0,0 +1 @@
+6fc51dd2dadf7543dee4786d147a9ef2a34a6ff03f84be177ebd1776715e25de

package/vendor/settle-win32-x64.exe.sha256

@@ -0,0 +1 @@
+98f51ba91d2ec9a7937ed7426c079145fddf730ff7bb912793b535171d657889