Skip to content

companions: add diskpush, and allow an installer that is not npm - #34

Merged
ralyodio merged 1 commit into
masterfrom
add-diskpush-companion
Aug 30, 2026
Merged

companions: add diskpush, and allow an installer that is not npm#34
ralyodio merged 1 commit into
masterfrom
add-diskpush-companion

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

Adds diskpush to the companions, and generalises the mechanism so a companion
can come from something other than npm.

Why it is a companion

Same reason as timer and billing: a command worth having on PATH that this
repository should not implement. diskpush.com — browse
servers like FileZilla, transfer with rsync, incremental and resumable, and
directly between two servers.

What changed

Companion gains an install method:

export type InstallMethod =
  | { kind: 'npm'; package: string }
  | { kind: 'script'; url: string; args?: readonly string[] };

npm behaves exactly as before. script pipes the project's own installer into
sh. That is not a workaround for not being on npm — one command places a
desktop application and a CLI together and decides between them by what the
machine can actually run, which npm cannot express.

installArgs becomes installCommand, returning { command, args, display },
so the caller runs whatever it is handed rather than assuming npm. source()
gives the package or url for display, and a failed install now names the real
command instead of always saying npm.

--cli-only

Deliberate. A toolbelt being installed on a server should not be answered with
100MB of Electron; the installer would otherwise place the desktop app wherever
it finds a desktop session. Anyone wanting the app runs the installer directly.

Verification

Ran the exact command this generates against a throwaway HOME:

curl -fsSL https://diskpush.com/install.sh | sh -s -- --cli-only
installed version: 0.1.2

cli-tools companions lists it and reports it as missing/installed correctly.

538 tests pass. pnpm typecheck still reports the pre-existing error in
src/free-names.ts — untouched here, and it fails the same way on master.

`diskpush` browses servers like FileZilla and transfers with rsync —
incremental, resumable, and directly between two servers. It belongs in this
set for the same reason timer and billing do: it is a command worth having on
PATH that this repository should not be implementing.

It is not on npm, so `Companion` gains an install method. `npm` is unchanged;
`script` pipes an installer into sh the way the project documents it. That is
not a lesser arrangement — one command places a desktop application and a CLI
together and decides between them by what the machine can actually run, which
npm cannot express.

Here it installs with `--cli-only`. A command-line toolbelt being set up on a
server should not be answered with 100MB of Electron, and the installer would
otherwise place the desktop app wherever it finds a desktop session.

`installArgs` becomes `installCommand`, returning a command, its arguments and
the line a person would type; the caller runs whatever it is handed instead of
assuming npm. `source()` gives the package or url for display. The failure
message names the real command rather than always saying npm.

Verified by running the exact command this generates against a throwaway HOME:
it installed diskpush and `diskpush --version` answered 0.1.2.

538 tests pass. `pnpm typecheck` still reports the pre-existing error in
src/free-names.ts, which is untouched here and fails the same way on master.
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

16 finding(s)

HIGH/CRITICAL: 5 | MEDIUM: 2 | LOW: 9

Severity Rule Location
HIGH sh-remote-script-execution root-ubuntu.sh:134
HIGH sh-remote-script-execution root-ubuntu.sh:2597
HIGH sh-remote-script-execution root-ubuntu.sh:2601
HIGH sh-remote-script-execution root-ubuntu.sh:2654
HIGH sh-remote-script-execution root-ubuntu.sh:3683
MEDIUM redos-nested-quantifier src/domain-free.ts:56
MEDIUM redos-nested-quantifier src/porkbun.ts:506
LOW secret-generic-credential src/credentials.ts:36
LOW insecure-temp-file test/blog.test.ts:73
LOW insecure-temp-file test/blog.test.ts:74
LOW insecure-temp-file test/credentials.test.ts:43
LOW insecure-temp-file test/credentials.test.ts:44
LOW secret-generic-api-key test/credentials.test.ts:208
LOW insecure-temp-file test/download.test.ts:99
LOW insecure-temp-file test/download.test.ts:100
LOW secret-generic-credential test/shorten.test.ts:36

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 809a5c0 into master Aug 30, 2026
5 checks passed
ralyodio added a commit that referenced this pull request Aug 30, 2026
Eight commits since 0.15.0, one of them a new command, so the minor moves.

- sysupdate: apt lists, apt packages and snaps in one command, reachable
  from the pit as /update (#37)
- root-ubuntu.sh: a 2G swapfile on a box with no swap at all, plus
  vm.swappiness=10 (#36)
- root-ubuntu.sh: one ssh-agent per user under systemd (#35)
- root-ubuntu.sh: lm-sensors, smartmontools and the rest of the hardware
  inventory set, with sensor detection on bare metal
- companions: diskpush, and installers that are not npm (#34)
- porkbun: Porkbun's own pre-flight, structured refusals, and the fact that
  registration spends prepaid credit rather than a card (#32, #33)


Claude-Session: https://claude.ai/code/session_013TerE4nvNU3jvS51nRR6Pd

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant