watchmen-cli 1.2.2 → 1.3.3

package/README.md

@@ -14,6 +14,22 @@ Or use directly:
 npx watchmen-cli version
 ```
 
+## How install works (no postinstall download)
+
+`watchmen-cli` is a small JS shim. The platform binary ships inside one of
+three sibling packages, picked by npm via `optionalDependencies` based on
+your host's `os` + `cpu`:
+
+| Platform | Package |
+|---|---|
+| macOS arm64 (Apple Silicon and Rosetta x86_64) | `watchmen-cli-darwin-arm64` |
+| Linux x86_64 | `watchmen-cli-linux-x64` |
+| Windows x86_64 | `watchmen-cli-win32-x64` |
+
+There is no `postinstall` script, no network download at install time, and
+no SHA-256 round-trip. npm itself verifies the tarball checksum of every
+package it downloads from the registry.
+
 ## What it does
 
 WatchmenCLI scans your development environment across 13 dimensions (packages, runtimes, secrets, Docker, network, permissions, databases, and more), indexes 30+ document formats with OCR, and exposes everything as 24 MCP tools for AI coding assistants.
@@ -32,5 +48,6 @@ wm doctor            # Self-diagnostic
 ## Links
 
 - Website: https://trywatchmen.cloud
-- GitHub: https://github.com/trywatchmen/watchmen-cli
+- Trust & verification: https://trywatchmen.cloud/trust
+- Public metadata repo: https://github.com/watchmencli/watchmen-cli-public
 - Docs: https://trywatchmen.cloud/docs

package/bin/wm.js

@@ -1,28 +1,40 @@
 #!/usr/bin/env node
 "use strict";
 
-const { execFileSync } = require("child_process");
-const path = require("path");
-const fs = require("fs");
+// TH-P0-03 — Platform-package entry shim.
+// Resolves the platform binary via shim.js (which delegates to npm's
+// optionalDependencies installation map) and execs it.  Forwards args,
+// stdio, env, and exit code transparently.
 
-const binDir = __dirname;
-const ext = process.platform === "win32" ? ".exe" : "";
-const binPath = path.join(binDir, `wm${ext}`);
-
-if (!fs.existsSync(binPath)) {
-  console.error(
-    "wm binary not found. Run: npm rebuild watchmen-cli\n" +
-    `Expected at: ${binPath}`
-  );
-  process.exit(1);
-}
+const { spawnSync } = require("child_process");
+const { resolveBinary } = require("..");
 
+let binary;
 try {
-  execFileSync(binPath, process.argv.slice(2), {
-    stdio: "inherit",
-    env: process.env,
-  });
+  binary = resolveBinary();
 } catch (err) {
-  // execFileSync throws on non-zero exit — forward the exit code
-  process.exit(err.status || 1);
+  console.error("\n  " + (err.message || String(err)) + "\n");
+  process.exit(127);
+}
+
+const result = spawnSync(binary, process.argv.slice(2), {
+  stdio: "inherit",
+  env: process.env,
+  windowsHide: false,
+});
+
+if (result.error) {
+  console.error("\n  Failed to spawn wm binary:");
+  console.error("    " + (result.error.message || String(result.error)));
+  console.error("    binary path: " + binary + "\n");
+  process.exit(127);
+}
+
+// Forward the exit status.  signal-terminations get encoded as 128+signo
+// (the standard shell convention).
+if (result.signal) {
+  const SIG = { SIGINT: 2, SIGTERM: 15, SIGKILL: 9, SIGHUP: 1 };
+  process.exit(128 + (SIG[result.signal] || 0));
 }
+
+process.exit(result.status || 0);

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "watchmen-cli",
-  "version": "1.2.2",
+  "version": "1.3.3",
   "description": "Capture, compare, and transfer your complete development environment",
-  "main": "install.js",
+  "main": "shim.js",
   "keywords": [
     "cli",
     "environment",
@@ -15,34 +15,27 @@
   "homepage": "https://trywatchmen.cloud",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/trywatchmen/watchmen-cli.git"
+    "url": "git+https://github.com/watchmencli/watchmen-cli-public.git"
   },
   "bugs": {
-    "url": "https://github.com/trywatchmen/watchmen-cli/issues"
+    "url": "https://github.com/watchmencli/watchmen-cli-public/issues"
   },
   "license": "MIT",
   "author": "Cristiano Pereira da Silva Muniz, LLC",
   "bin": {
     "wm": "bin/wm.js"
   },
-  "scripts": {
-    "postinstall": "node install.js"
-  },
-  "os": [
-    "darwin",
-    "linux",
-    "win32"
-  ],
-  "cpu": [
-    "arm64",
-    "x64"
-  ],
   "engines": {
     "node": ">=16"
   },
+  "optionalDependencies": {
+    "watchmen-cli-darwin-arm64": "1.3.3",
+    "watchmen-cli-linux-x64": "1.3.3",
+    "watchmen-cli-win32-x64": "1.3.3"
+  },
   "files": [
-    "install.js",
-    "README.md",
-    "bin/"
+    "shim.js",
+    "bin/wm.js",
+    "README.md"
   ]
 }

package/shim.js

@@ -0,0 +1,91 @@
+"use strict";
+
+// TH-P0-03 — Platform-package shim.
+//
+// `watchmen-cli` carries no binary itself.  At install time, npm picks the
+// correct platform package from `optionalDependencies` based on the host's
+// platform + arch (npm 7+, pnpm, bun all honor `os` and `cpu` filtering).
+// The binary lives inside that platform package's `bin/` directory.
+//
+// This file is the resolver.  It is required by `bin/wm.js` (the spawned
+// entrypoint) and by `package.json#main` (so callers can also do
+// `require('watchmen-cli').path` programmatically).
+//
+// We intentionally do NOT do any network IO.  No `postinstall`, no fetch,
+// no SHA verification at install time — npm's own tarball checksum already
+// verifies what we shipped.  The binary's authenticity comes from npm
+// publish provenance + the platform-package tarball SHA.
+
+const path = require("path");
+
+const PLATFORMS = {
+  // platform-key  →  npm-package-name + binary basename
+  // Only entries listed here get matched.  Anything else is "unsupported".
+  "darwin-arm64": { pkg: "watchmen-cli-darwin-arm64", bin: "wm" },
+  "darwin-x64":   { pkg: "watchmen-cli-darwin-arm64", bin: "wm" }, // Rosetta 2 fallback
+  "linux-x64":    { pkg: "watchmen-cli-linux-x64",    bin: "wm" },
+  "linux-arm64":  { pkg: "watchmen-cli-linux-x64",    bin: "wm" }, // best-effort until native arm64 ships
+  "win32-x64":    { pkg: "watchmen-cli-win32-x64",    bin: "wm.exe" },
+};
+
+function platformKey() {
+  return `${process.platform}-${process.arch}`;
+}
+
+function resolveBinary() {
+  const key = platformKey();
+  const entry = PLATFORMS[key];
+  if (!entry) {
+    const supported = Object.keys(PLATFORMS).join(", ");
+    throw new Error(
+      `Unsupported platform: ${key}\n` +
+      `  Supported: ${supported}\n\n` +
+      `  Manual install: https://trywatchmen.cloud/docs/getting-started/installation`
+    );
+  }
+  // Resolution strategy — try increasingly broad lookup paths.  In a normal
+  // npm registry install the shim and platform package are siblings under
+  // node_modules/, and the default Node resolver finds the platform package
+  // by walking up from __dirname.  For `file:` installs, symlinks point at
+  // the source dir which has no relevant node_modules, so we fall back to
+  // a default-paths resolve (which walks from process.cwd()).
+  let pkgJsonPath;
+  let lastErr;
+  const candidates = [
+    // 1. Default resolver — covers registry install (sibling under node_modules/).
+    () => require.resolve(`${entry.pkg}/package.json`),
+    // 2. Explicit paths from the shim's own directory upward — covers
+    //    global installs where the shim is at <prefix>/lib/node_modules/...
+    () => require.resolve(`${entry.pkg}/package.json`, {
+      paths: [__dirname, path.dirname(__dirname), path.dirname(path.dirname(__dirname))],
+    }),
+  ];
+  for (const tryResolve of candidates) {
+    try { pkgJsonPath = tryResolve(); break; }
+    catch (err) { lastErr = err; }
+  }
+  if (!pkgJsonPath) {
+    throw new Error(
+      `Platform package "${entry.pkg}" was not installed.\n` +
+      `  This usually means npm's optionalDependencies filter excluded it,\n` +
+      `  or your installer (yarn, pnpm, bun) did not honor the os/cpu fields.\n` +
+      `  Try:  npm install -g watchmen-cli@${require("./package.json").version}\n` +
+      `  Or download manually: https://trywatchmen.cloud/docs/getting-started/installation\n` +
+      `  Underlying error: ${lastErr ? (lastErr.code || lastErr.message) : "unknown"}`
+    );
+  }
+  const pkgRoot = path.dirname(pkgJsonPath);
+  return path.join(pkgRoot, "bin", entry.bin);
+}
+
+module.exports = {
+  /**
+   * Absolute path to the wm binary for the current platform.
+   * Throws if the platform package is missing.
+   */
+  get path() {
+    return resolveBinary();
+  },
+  resolveBinary,
+  platformKey,
+};

package/install.js

@@ -1,272 +0,0 @@
-#!/usr/bin/env node
-"use strict";
-
-const https = require("https");
-const http = require("http");
-const fs = require("fs");
-const path = require("path");
-const crypto = require("crypto");
-const { execSync } = require("child_process");
-
-const VERSION = require("./package.json").version;
-// Versioned URL first (exact-pin, immune to CDN drift on the latest alias);
-// fall back to /latest/ when the versioned path 404s (e.g. release mid-promote).
-// Either way, the binary's reported version is asserted against VERSION below.
-const DOWNLOAD_BASE = "https://releases.trywatchmen.cloud/download/community";
-const VERSIONED_URL_TMPL = (slug) => `${DOWNLOAD_BASE}/${VERSION}/${slug}`;
-const LATEST_URL_TMPL    = (slug) => `${DOWNLOAD_BASE}/${slug}`;
-
-// 60s connect timeout, 120s total — covers slow connections without hanging forever
-const CONNECT_TIMEOUT_MS = 60_000;
-const TOTAL_TIMEOUT_MS = 120_000;
-
-// Platform → download path mapping
-const PLATFORMS = {
-  "darwin-arm64": "macos-arm64",
-  "darwin-x64": "macos-arm64", // Rosetta 2 fallback
-  "linux-x64": "linux-x86_64",
-  "linux-arm64": "linux-x86_64", // best-effort — no native arm64 yet
-  "win32-x64": "windows-x86_64",
-};
-
-function getPlatformKey() {
-  return `${process.platform}-${process.arch}`;
-}
-
-function getPlatformSlug() {
-  const key = getPlatformKey();
-  const slug = PLATFORMS[key];
-  if (!slug) {
-    console.error(
-      `\n  Unsupported platform: ${key}\n` +
-      `  Supported: ${Object.keys(PLATFORMS).join(", ")}\n\n` +
-      `  You can download manually from: https://trywatchmen.cloud/docs/getting-started/installation\n`
-    );
-    process.exit(1);
-  }
-  return slug;
-}
-
-function formatBytes(bytes) {
-  if (bytes < 1024) return `${bytes} B`;
-  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(0)} KB`;
-  return `${(bytes / 1024 / 1024).toFixed(1)} MB`;
-}
-
-function download(url, maxRedirects = 5) {
-  return new Promise((resolve, reject) => {
-    if (maxRedirects <= 0) {
-      return reject(new Error("Too many redirects"));
-    }
-
-    const client = url.startsWith("https") ? https : http;
-    const req = client.get(
-      url,
-      {
-        headers: { "User-Agent": `watchmen-cli-npm/${VERSION}` },
-        timeout: CONNECT_TIMEOUT_MS,
-      },
-      (res) => {
-        // Follow redirects
-        if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
-          res.resume(); // drain response
-          return download(res.headers.location, maxRedirects - 1).then(resolve).catch(reject);
-        }
-        if (res.statusCode !== 200) {
-          res.resume();
-          return reject(new Error(`HTTP ${res.statusCode} from ${url.split("?")[0]}`));
-        }
-
-        const contentLength = parseInt(res.headers["content-length"], 10) || 0;
-        const chunks = [];
-        let received = 0;
-        const startTime = Date.now();
-
-        // Progress reporting
-        const progressInterval = setInterval(() => {
-          const elapsed = ((Date.now() - startTime) / 1000).toFixed(0);
-          if (contentLength > 0) {
-            const pct = ((received / contentLength) * 100).toFixed(0);
-            process.stdout.write(`\r  Downloading... ${formatBytes(received)} / ${formatBytes(contentLength)} (${pct}%) [${elapsed}s]`);
-          } else {
-            process.stdout.write(`\r  Downloading... ${formatBytes(received)} [${elapsed}s]`);
-          }
-        }, 500);
-
-        res.on("data", (chunk) => {
-          chunks.push(chunk);
-          received += chunk.length;
-        });
-
-        res.on("end", () => {
-          clearInterval(progressInterval);
-          const elapsed = ((Date.now() - startTime) / 1000).toFixed(1);
-          process.stdout.write(`\r  Downloaded ${formatBytes(received)} in ${elapsed}s${" ".repeat(20)}\n`);
-          resolve(Buffer.concat(chunks));
-        });
-
-        res.on("error", (err) => {
-          clearInterval(progressInterval);
-          reject(err);
-        });
-      }
-    );
-
-    req.on("timeout", () => {
-      req.destroy();
-      reject(new Error(`Connection timed out after ${CONNECT_TIMEOUT_MS / 1000}s`));
-    });
-
-    req.on("error", reject);
-
-    // Hard total timeout
-    setTimeout(() => {
-      req.destroy();
-      reject(new Error(`Download timed out after ${TOTAL_TIMEOUT_MS / 1000}s — try again or download manually from https://trywatchmen.cloud`));
-    }, TOTAL_TIMEOUT_MS);
-  });
-}
-
-async function main() {
-  const platformSlug = getPlatformSlug();
-  const platformKey = getPlatformKey();
-  const isWindows = process.platform === "win32";
-  const binDir = path.join(__dirname, "bin");
-  const binName = isWindows ? "wm.exe" : "wm";
-  const binPath = path.join(binDir, binName);
-
-  // Skip if already installed at correct version
-  if (fs.existsSync(binPath)) {
-    try {
-      const installed = execSync(`"${binPath}" version`, {
-        encoding: "utf8",
-        timeout: 10_000,
-      });
-      if (installed.includes(VERSION)) {
-        console.log(`  wm v${VERSION} already installed at ${binPath}`);
-        return;
-      }
-      console.log(`  Upgrading wm to v${VERSION}...`);
-    } catch {
-      // Binary exists but broken/wrong version — redownload
-    }
-  }
-
-  const versionedUrl = VERSIONED_URL_TMPL(platformSlug);
-  const latestUrl    = LATEST_URL_TMPL(platformSlug);
-
-  console.log(`\n  WatchmenCLI v${VERSION} — ${platformKey}`);
-
-  let binary;
-  let sourceUrl;
-  try {
-    console.log(`  ${versionedUrl}`);
-    binary = await download(versionedUrl);
-    sourceUrl = versionedUrl;
-  } catch (err) {
-    console.log(`  (versioned URL unavailable: ${err.message.split("\n")[0]})`);
-    console.log(`  falling back to: ${latestUrl}\n`);
-    binary = await download(latestUrl);
-    sourceUrl = latestUrl;
-  }
-
-  // Validate minimum binary size (real binaries are >5MB)
-  if (binary.length < 1024 * 1024) {
-    throw new Error(
-      `Downloaded file is only ${formatBytes(binary.length)} — expected >5MB.\n` +
-      `  This usually means the download URL returned an error page.\n` +
-      `  Try: npm cache clean --force && npm install -g watchmen-cli`
-    );
-  }
-
-  // SHA-256 verify against the .sha256 sibling published alongside the binary.
-  // Missing sibling is a warning (older releases don't publish it), not fatal.
-  const binaryDigest = crypto.createHash("sha256").update(binary).digest("hex");
-  try {
-    const shaUrl = sourceUrl + ".sha256";
-    const shaBytes = await download(shaUrl);
-    const expectedDigest = shaBytes.toString("utf8").trim().split(/\s+/)[0].toLowerCase();
-    if (expectedDigest && /^[0-9a-f]{64}$/.test(expectedDigest)) {
-      if (expectedDigest !== binaryDigest) {
-        throw new Error(
-          `SHA-256 mismatch:\n` +
-          `  expected: ${expectedDigest}\n` +
-          `  got:      ${binaryDigest}\n` +
-          `  source:   ${sourceUrl}\n` +
-          `Install aborted. Try: npm cache clean --force && npm install -g watchmen-cli`
-        );
-      }
-      console.log(`  SHA-256 verified: ${binaryDigest.slice(0, 16)}...`);
-    } else {
-      console.warn(`  (SHA-256 file present but unparseable; continuing without verification)`);
-    }
-  } catch (err) {
-    if (err.message && err.message.startsWith("SHA-256 mismatch")) throw err;
-    console.warn(`  (SHA-256 sibling unavailable — continuing without verification: ${err.message.split("\n")[0]})`);
-  }
-
-  // Write binary
-  fs.mkdirSync(binDir, { recursive: true });
-  fs.writeFileSync(binPath, binary);
-
-  // chmod on Unix (no-op concept on Windows, but doesn't hurt)
-  if (!isWindows) {
-    fs.chmodSync(binPath, 0o755);
-  }
-
-  // The downloaded binary must report the same version as the npm package.
-  // Fail-closed on mismatch: the /latest/ fallback could otherwise serve
-  // a stale version during a mid-promote window.
-  try {
-    const reported = execSync(`"${binPath}" version`, { encoding: "utf8", timeout: 10_000 });
-    const reportedMatch = reported.match(/(\d+\.\d+\.\d+)/);
-    const reportedVersion = reportedMatch ? reportedMatch[1] : null;
-    if (reportedVersion && reportedVersion !== VERSION) {
-      // Delete the bad binary so rerunning `npm install` actually retries
-      try { fs.unlinkSync(binPath); } catch {}
-      throw new Error(
-        `Downloaded binary reports version ${reportedVersion}, but npm package is ${VERSION}.\n` +
-        `  This means the release pipeline has drift between dist-tag and served binary.\n` +
-        `  Source: ${sourceUrl}\n` +
-        `  Install aborted. This is almost certainly a transient CDN cache issue —\n` +
-        `  try again in a few minutes, or: npm cache clean --force && npm install -g watchmen-cli`
-      );
-    }
-    console.log(`  Installed successfully: ${binPath}`);
-    console.log(`  Reports: ${reported.split("\n")[0]}\n`);
-  } catch (err) {
-    if (err.message && err.message.includes("reports version")) throw err;
-    console.warn(
-      `  Warning: binary installed but verification failed.\n` +
-      `  Path: ${binPath}\n` +
-      `  You may need to run: wm doctor\n`
-    );
-  }
-}
-
-main().catch((err) => {
-  console.error(`\n  Failed to install wm: ${err.message}\n`);
-  // On Linux/macOS permission errors, suggest the user-local npm prefix
-  // (most users don't have sudo-npm configured).
-  if (/EACCES|EPERM|permission denied/i.test(err.message || "") && process.platform !== "win32") {
-    console.error(
-      `  Looks like a permissions problem. On Linux/macOS without sudo, npm's\n` +
-      `  global install path is root-owned. The sustainable fix is a user-local\n` +
-      `  prefix:\n` +
-      `\n` +
-      `    mkdir -p ~/.npm-global\n` +
-      `    npm config set prefix ~/.npm-global\n` +
-      `    echo 'export PATH="$HOME/.npm-global/bin:$PATH"' >> ~/.bashrc   # or ~/.zshrc\n` +
-      `    source ~/.bashrc\n` +
-      `    npm install -g watchmen-cli@${VERSION}\n` +
-      `\n`
-    );
-  }
-  console.error(
-    `  Troubleshooting:\n` +
-    `    1. Check your internet connection\n` +
-    `    2. Try: npm cache clean --force && npm install -g watchmen-cli\n` +
-    `    3. Download manually: https://trywatchmen.cloud/docs/getting-started/installation\n`
-  );
-  process.exit(1);
-});