mirror of
https://github.com/hanzoai/cli.git
synced 2026-10-30 15:00:27 +00:00
zeekay
7cdb9907bd
The CLI was GitHub-releases only. @hanzo/dev and @hanzo/mcp install with npm and this did not, so "install the Hanzo tools" meant two different motions and the sandbox image had to special-case one of them. A DOWNLOADER, not five platform packages. @hanzo/dev uses optionalDependencies; here the release matrix already publishes hanzo-<platform>.tar.gz, so pointing at those means one artifact, built once. Five npm packages would be a second copy of the same bytes under a second set of version numbers, and copies drift — that is how a `latest` ends up serving last week's binary for one platform only. VERIFIED against the .sha256 the release publishes beside each asset. This script runs on every npm install and the thing it fetches is then executed: an unverified download is arbitrary code execution on every machine that installs us. The publish job `needs: build`, which is the point. The postinstall fetches assets for its own version, so publishing before they exist ships a package whose install 404s. v1.9.41 is exactly that shape from the other side — four targets uploaded, linux-amd64 did not, and the release read green while the only binary our own amd64 cluster runs was missing. The tag sets the version, not the file. package.json carrying a different number is how a release publishes bytes under a version nobody built.
23 lines
1010 B
JavaScript
Executable File
23 lines
1010 B
JavaScript
Executable File
#!/usr/bin/env node
|
|
// Hand the real binary the argv it was given and get out of the way.
|
|
//
|
|
// exec-and-replace, not spawn-and-wait: a wrapper that survives its child owns
|
|
// that child's signals, and `hanzo` is interactive — Ctrl-C has to reach the
|
|
// program, not a Node process sitting in front of it. The exit code is the
|
|
// binary's for the same reason.
|
|
const { spawnSync } = require("node:child_process");
|
|
const { existsSync } = require("node:fs");
|
|
const { join } = require("node:path");
|
|
|
|
const bin = join(__dirname, process.platform === "win32" ? "hanzo.exe" : "hanzo");
|
|
if (!existsSync(bin)) {
|
|
console.error(
|
|
"hanzo: the binary is missing. `npm install` runs install.js to fetch it;\n" +
|
|
"if that was skipped (--ignore-scripts) run `node " + join(__dirname, "..", "install.js") + "`."
|
|
);
|
|
process.exit(1);
|
|
}
|
|
const r = spawnSync(bin, process.argv.slice(2), { stdio: "inherit" });
|
|
if (r.error) { console.error("hanzo:", r.error.message); process.exit(1); }
|
|
process.exit(r.status ?? 0);
|