tachograph 0.2.5 → 0.2.7

package/install.js

@@ -16,24 +16,56 @@ const { assetFor, downloadURL, checksumsURL, checksumFor } = require("./asset");
 const { version } = require("./package.json");
 const binDir = path.join(__dirname, "bin");
 
+// Abort hung downloads instead of letting `npm install` block forever; the
+// timeout covers headers and body, and the catch at the bottom points users
+// at the go-install fallback.
+const FETCH_TIMEOUT_MS = 120_000;
+
+// fetchBuffer downloads url fully and maps failures (HTTP errors, timeouts)
+// to messages that name what was being fetched.
+async function fetchBuffer(url, what) {
+  try {
+    const res = await fetch(url, {
+      redirect: "follow",
+      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+    });
+    if (!res.ok) {
+      throw new Error(`${what} failed: ${res.status} ${res.statusText} for ${url}`);
+    }
+    return Buffer.from(await res.arrayBuffer());
+  } catch (err) {
+    if (err.name === "TimeoutError") {
+      throw new Error(`${what} timed out after ${FETCH_TIMEOUT_MS / 1000}s for ${url}`);
+    }
+    throw err;
+  }
+}
+
+// tarBin picks the extractor. On Windows the zip asset needs bsdtar, but PATH
+// can resolve Git for Windows' GNU tar, which cannot read zip archives
+// ("This does not look like a tar archive"). System32's tar.exe is bsdtar on
+// Windows 10 1803+, so prefer it explicitly; elsewhere the system tar handles
+// our tar.gz (bsdtar on macOS, GNU tar on Linux).
+function tarBin() {
+  if (process.platform !== "win32") return "tar";
+  const sys = path.join(
+    process.env.SystemRoot || "C:\\Windows",
+    "System32",
+    "tar.exe",
+  );
+  return fs.existsSync(sys) ? sys : "tar";
+}
+
 async function main() {
   const { asset, binary } = assetFor(process.platform, process.arch);
-  const url = downloadURL(version, asset);
 
-  const res = await fetch(url, { redirect: "follow" });
-  if (!res.ok) {
-    throw new Error(`download failed: ${res.status} ${res.statusText} for ${url}`);
-  }
-  const buf = Buffer.from(await res.arrayBuffer());
+  const buf = await fetchBuffer(downloadURL(version, asset), "download");
 
   // Verify the archive against GoReleaser's published checksums.txt before
   // extracting and running it, so a corrupted/tampered/partial download is
   // caught rather than executed.
-  const sums = await fetch(checksumsURL(version), { redirect: "follow" });
-  if (!sums.ok) {
-    throw new Error(`checksums download failed: ${sums.status} ${sums.statusText}`);
-  }
-  const want = checksumFor(await sums.text(), asset);
+  const sums = await fetchBuffer(checksumsURL(version), "checksums download");
+  const want = checksumFor(sums.toString("utf8"), asset);
   if (!want) {
     throw new Error(`no checksum listed for ${asset}`);
   }
@@ -43,17 +75,26 @@ async function main() {
   }
 
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "tacho-"));
-  const archive = path.join(tmp, asset);
-  fs.writeFileSync(archive, buf);
+  const binPath = path.join(binDir, binary);
+  try {
+    fs.writeFileSync(path.join(tmp, asset), buf);
 
-  fs.mkdirSync(binDir, { recursive: true });
-  // bsdtar/GNU tar both extract by extension; -C lands the binary in bin/.
-  execFileSync("tar", ["-xf", archive, "-C", binDir], { stdio: "inherit" });
-  fs.rmSync(tmp, { recursive: true, force: true });
+    // Run inside tmp with relative names only: GNU tar (which can shadow
+    // bsdtar in PATH, e.g. Git for Windows' usr/bin) parses the colon in
+    // absolute Windows paths ("C:\...") as a remote host:path spec and fails
+    // with "Cannot connect to C:".
+    execFileSync(tarBin(), ["-xf", asset], { cwd: tmp, stdio: "inherit" });
 
-  const binPath = path.join(binDir, binary);
-  if (!fs.existsSync(binPath)) {
-    throw new Error(`extracted archive but ${binary} not found in ${binDir}`);
+    const extracted = path.join(tmp, binary);
+    if (!fs.existsSync(extracted)) {
+      throw new Error(`extracted archive but ${binary} not found in it`);
+    }
+    // Copy just the binary; the archive also carries LICENSE/README, which
+    // don't belong in bin/.
+    fs.mkdirSync(binDir, { recursive: true });
+    fs.copyFileSync(extracted, binPath);
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
   }
   if (process.platform !== "win32") {
     fs.chmodSync(binPath, 0o755);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tachograph",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "description": "A compact instrument cluster for your coding agents (Claude Code / Codex). Shows model, rate-limit usage, and context at a glance.",
   "keywords": [
     "claude-code",