feat: Add npm binary wrapper package & bump version to v9.20.46

[AnkanSaha]

📝 Summary

This PR introduces an npm package wrapper (InstallController.js) for cross-platform local installation of ContainDB native binaries (linux, darwin, win32) and updates the hardcoded version strings across the codebase to v9.20.46-stable.

🛠️ Changes

• Version Upgrades: Bumped version from 9.20.44-stable to 9.20.46-stable in:
  • INSTALLATION.md
  • Scripts/installer.sh
  • VERSION
  • src/Core/main.go
  • src/base/Banner.go
• NPM Package: Added npm directory package settings (package.json, .npmignore)
• Install Controller: Added npm/InstallController.js which detects OS architecture and spawns native binary natively via node process.

🧪 Verification

• Verify npm platform detection works cleanly on standard platforms (x64/arm64).
• Confirm Go compilation builds run correctly on newer versions.

[github-actions]

🤖 Review Buddy - General Code Review

👥 Attention: @AnkanSaha

Oye AnkanSaha! 👋

Bhai, sabse pehle toh thodi der chup baitho aur gehri saans lo. 9.20.44 se 9.20.46-stable par aane ke liye tumne jo dimaag lagaya hai na, usse dekh kar lagta hai ki tum manual labor ke bohot bade fan ho!

Matlab ek version bump karne ke liye tumne paanch alag files me jaakar hardcoding ki hai? Ek Go file me, dusri Go file me, installer bash script me, flat version file me, aur installation markdown me! Bhai, agar kal ko tumhara manager tumse bole ki 'Beta, din me teen baar release karo', toh tum toh bas copy-paste karte-karte hi retired life plan kar loge!

Aur ye kya bawasir naya JS controller ghusa diya hai npm folder me? Bina kisi error handling ke, bina executable checks ke, direct process spawn kar rahe ho. 'Karan Arjun' film ke Thakur ki tarah tumhara ye controller bhi bol raha hai: 'Mera beta aayega, direct run ho jayega!' Lekin asal zindagi me binary crash karegi aur user tumko gaaliyaan dega.

Code Quality Score: 3.5 / 10

Chalo, ab is kachre ko thoda saf kar lete hain aur deep dive karte hain ki tumne kahan-kahan raita phailaya hai.

---

Generated by Review Buddy | Tone: roast | Language: hinglish

[github-actions]

⚡ Review Buddy - Performance Analysis

👥 Attention: @AnkanSaha

🚀 PERFORMANCES KA JANAZA NIKAL DIYA HAI!

Ankan bhai, tumne ek compiled high-performance Go binary ko ek Node.js wrapper ke andar wrap kiya hai. Ye wahi baat hui na ki Ferrari khareed li par usko chalane ke liye aage do bail baandh diye! Chalo step-by-step batata hoon ki tumne performance ki kaise vaat lagayi hai:

1. Startup Latency Ka Mahasangram (Node.js Bootstrapping Overhead)

• Samasya: Go binary direct execute hoti toh micro-seconds me load ho jati. Par nahi! Tumhe toh Node.js ka V8 engine initialize karna hai, uske internal modules load karne hain, stack setup karna hai, aur phir jaakar InstallController.js execute hoga.
• Impact: Har execution pe flat ~50ms to 120ms ka startup latency penalty lag raha hai. CLI tools me users ko instantaneous feedback chahiye hota hai, par yahan tumhara wrapper V8 VM ko sleep mode se jaga raha hai.

2. Synchronous Environment Copying ({ ...process.env })

• Samasya: Tumne ye likha hai:

  const env = { ...process.env, CONTAINDB_INSTALL_SOURCE: 'npm' };

• Impact: process.env koi normal JavaScript object nahi hai. Ye ek getter/setter bindings ka collection hai OS environment variables ke sath. Jab tum isko destructure karte ho, toh Node.js ko saare environment variables ke string pairs ko memory me allocate karke naya object banana padta hai. Agar user ke environment me 500 lines ka config hai, toh tum fuzool me garbage collection overhead badha rahe ho.
• Solution: Direct assignment use karo ya sirf child process spawn karte waqt specific target override karo.

3. Stream Piping and I/O Bottlenecks (stdio: 'inherit')

• Samasya: Tumne binary ke pure input/output streams ko parent Node process ke standard streams se map kar diya bina backpressure handle kiye.
• Impact: Jab Go application heavy JSON stream ya logs console pe dump karegi, toh standard streams me backpressure build up hoga. Node.js ka Event Loop un system-level streams ko read aur pipe karne me block hoga, jisse output rendering me stuttering aur CPU context switching badh jayegi.

4. Memory Footprint Double-Dhamaka

• Samasya: Go binary khud me lightweight hai (approx 5-15MB RAM maximum runtime memory depending on GC configuration).
• Impact: Ab tumhare wrapper ki wajah se user ko ek full-blown Node.js runtime process ko memory me hold karna padega jab tak Go binary run ho rahi hai. Ye wrapper faltu me system par extra 30MB memory block karke baitha rahega bina kisi actual work ke.

---

🛠️ High-Performance Alternative (No-Node Wrapper)

Agar wrapper banana hi hai, toh bina heavy heap allocation aur destructuring ke likho:

#!/usr/bin/env node

const { spawn } = require('child_process');
const path = require('path');
const os = require('os');

const platform = os.platform();
const arch = os.arch();

const supported = {
  'linux': { 'x64': 'containdb_linux_amd64' },
  'darwin': { 'x64': 'containdb_darwin_amd64', 'arm64': 'containdb_darwin_arm64' },
  'win32': { 'x64': 'containdb_windows_amd64.exe' }
};

const binaryName = supported[platform]?.[arch];
if (!binaryName) {
  console.error(`❌ Unsupported platform/architecture: ${platform} ${arch}`);
  process.exit(1);
}

const binaryPath = path.join(__dirname, 'bin', binaryName);

// performance-friendly process.env mutation without shallow-copying
process.env.CONTAINDB_INSTALL_SOURCE = 'npm';

const child = spawn(binaryPath, process.argv.slice(2), {
  stdio: 'inherit',
  // detached: false keeps parent control without orphan risks
  detached: false 
});

child.on('error', (err) => {
  console.error('💥 Failed to start ContainDB binary:', err.message);
  process.exit(127);
});

child.on('exit', (code) => {
  process.exit(code ?? 0);
});

Is approach se tum memory churn aur CPU instructions dono bacha loge! Par tumse kisne bola tha ki manual heap allocation badhane ke liye pooray env object ka cloning karo?

---

Generated by Review Buddy | Tone: roast | Language: hinglish

[github-actions]

🔐 Review Buddy - Security Audit

👥 Attention: @AnkanSaha

🛑 SECURITY AUDIT: SECURITY KA 'S' BHI PATA HAI KYA?

Bhai, code me security aisi hai ki chor bhi aayega toh bolega 'rehne do, ye toh khud hi barbad hai'. Chalo dikhata hoon kahan-kahan tumne attack vectors khol rakhe hain:

1. Binary Hijacking & Execution of Untrusted Binaries

• Severity: 🔥 High / Critical
• Location: npm/InstallController.js (Line 29-34)
• Exploit Scenario: Tum local directory me target binaries (bin/containdb_*) ko execute kar rahe ho. Node packages me directories pre-populated aati hain, par agar runtime environment me user ke machine par bin/ directory writable hai, toh koi bhi local process in binaries ko malicious binaries se replace kar sakta hai. Jab next time user globally containdb run karega, toh tumhara controller directly us hijacked malicious binary ko bina runtime signature verification ya hash-checking ke spawn kar dega! Root privilege escalation ho jayegi aasani se.
• OWASP Reference: OWASP Top 10 A08:2021 - Software and Data Integrity Failures
• Remediation: Execution se pehle check karo ki binary path valid hai, check file owners, aur agar ho sake toh internal binaries ka SHA-256 hash verify karo runtime par script ke andar run karne se pehle.

2. Missing Executable Permission Handling (Denial of Service - DoS)

• Severity: ⚠️ Medium
• Location: npm/InstallController.js
• Exploit Scenario: Jab global npm installation hoti hai, tab standard zip extraction me UNIX systems par files ka executable permission bit (+x) kharab ho jata hai ya strips ho jata hai. Agar application direct binary bina permissions verify kiye execute karegi, toh spawn synchronous throw karega EACCES error, jisse program crash ho jayega.
• Remediation: Check permissions at runtime using fs.access or apply fs.chmodSync(binaryPath, 0o755) programmatically inside a try-catch block before spawning!

3. Uncaught Exception in Process Spawning (Process Crash)

• Severity: ⚠️ Medium
• Location: npm/InstallController.js (Line 34)
• Exploit Scenario: Agar machine pe bin/ directory se binary kisi wajah se delete ho gayi hai, toh spawn immediately error emit karega. Tumne .on('error') hook likha hi nahi hai! Iske bina, Node.js process ek uncaught exception raise karega, crash dump generate karega, aur crash logs me internal stack trace leak karega.
• CWE Reference: CWE-248 (Uncaught Exception)
• Remediation: Child process stream par hamesha 'error' event listener register karo.

---

Generated by Review Buddy | Tone: roast | Language: hinglish

[github-actions]

📊 Review Buddy - Code Quality & Maintainability Analysis

👥 Attention: @AnkanSaha

🎯 Overall Benchmark: 40/100 (Poor)

💩 CODE QUALITY ANALYSIS: SOLID KE NAAM PAR DHOOL HAI!

Ankan, tumne jo code likha hai, use dekh kar SOLID principles ke saare founders ne apna sar pakad liya hoga. Chalo detail me baat karte hain ki tumhari engineering skills kahan so rahi thi:

1. DRY Principle Ka Katle-Aam (Don't Repeat Yourself)

• Category: Architecture & Maintainability
• Severity: High
• Location: Multiple Files
  • INSTALLATION.md
  • Scripts/installer.sh
  • VERSION
  • src/Core/main.go
  • src/base/Banner.go
• Explanation: Bhai, Version 9.20.46-stable ko tumne har jagah copy-paste karke hardcode kar diya hai. Kal ko agar version change karna ho, toh tumhare jaisa lazy developer 5 jagah updates karega. Ek bhi jagah miss hui (for example, Go binary me updated par main bash script me old), toh pooray production setup ke lag jayenge! System systems me versioning centralized honi chahiye.
• Refactoring Suggestion (Go Build Flags): Go files me hardcoding hatane ke liye -ldflags use karo build pipelines me:

  // src/Core/main.go
  package main
  import "fmt"
  var Version = "dev-build" // Default fallback
  func main() {
      fmt.Println("Version is:", Version)
  }

  Aur build script me compile karte waqt ye pass karo:
  go build -ldflags "-X main.Version=9.20.46-stable" -o containdb src/Core/main.go

2. Clean Architecture and Separation of Concerns Violations

• Category: Software Design
• Severity: Medium
• Location: npm/InstallController.js
• Explanation: Ye single file platform identification, architecture detection, path calculations, environment injection, and orchestration of system binaries sab ek sath kar rahi hai. Separation of concerns naam ki chiz hoti hai jo is code ko door-door tak nahi mili.
• Refactoring Suggestion: Is pure execution mapping ko configuration file (e.g., JSON structure) se separate karo taaki system-wise dynamic binary loading asaan ho sake.

3. Missing Proper Unit Tests & Validation

• Category: Testability
• Severity: High
• Location: npm/ folder
• Explanation: package.json me likha hai: "test": "echo \"Error: no test specified\" && exit 1". Wah beta! CLI install wrapper likh diya bina kisi regression tests ke. Windows par execute hoga ki nahi? Darwin arm64 par run karega ki nahi? Bas 'Bhagwan bharose' code chal raha hai.
• Refactoring Suggestion: Platform-matching logic ke functions ko export karo aur Jest/Mocha se mocking setup karke platform returns test karo.

4. Hardcoded Platforms/Architectures (Extensibility failure)

• Category: Maintainability
• Severity: Low
• Location: npm/InstallController.js (Line 10-21)
• Explanation: Agar future me standard linux-arm64 support add karna ho, toh tumhare controller code me deep modification karni padegi. Yeh Open-Closed Principle (OCP) ki maut hai.
• Refactoring Suggestion: Use external platform mapping schema file or manifest pattern.

---

Generated by Review Buddy | Tone: roast | Language: hinglish

[github-actions]

💡 Review Buddy - Best Practices & Alternative Suggestions

👥 Attention: @AnkanSaha

💡 BEST PRACTICES: SUDHAR JAO BHAI!

Tumne purani dharra standard coding chhod kar thoda modern likhne ki koshish toh ki hai, par fir wahi kacha limbu jaisi galtiyan kar di. Dekho isko kaise behtar kar sakte ho:

1. Optional Chaining for Safe Object Access

• Pehle ka code:

if (!supported[platform] || !supported[platform][arch]) {
  console.error(`Unsupported platform or architecture: ${platform} ${arch}`);
  process.exit(1);
}
const binaryName = supported[platform][arch];

• Sahi Code (Modern ES6+):

const binaryName = supported[platform]?.[arch];
if (!binaryName) {
  console.error(`❌ Unsupported platform or architecture: ${platform} ${arch}`);
  process.exit(1);
}

• Kyitna behtar hai? Isse readable code milta hai, double checking redundant nahi hoti aur properties access karte waqt safe check execution asaan ho jata hai.

---

2. Avoid Manual Path Concatenation or Magic Constants

• Pehle ka code:

const binaryPath = path.join(__dirname, 'bin', binaryName);

• Sahi Code:

const BINARY_DIR = path.resolve(__dirname, 'bin');
const binaryPath = path.join(BINARY_DIR, binaryName);

• Kyu? Path execution me absolute paths resolve karna safe hota hai runtimes me, taaki unexpected symbolic links issues avoid ho sake.

---

3. Version Management Automation in Scripts

• Pehle ka code:

# Scripts/installer.sh
VERSION="9.20.46-stable"

• Sahi Code (Dynamic Version Loading):

# Load version directly from VERSION file at root folder
SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
VERSION=$(cat "$SCRIPT_DIR/../VERSION" || echo "dev-build")

• Kyu? Isse version configuration ek single source (VERSION) file me hi limited rahega. Pure codebase me 10 jagah edits karne se chutkara milega!

---

Generated by Review Buddy | Tone: roast | Language: hinglish

[github-actions]

⚠️ Review Buddy - Final Recommendation

👥 Attention: @AnkanSaha

Recommendation: REQUEST CHANGES

Changes chahiye, bhai! Abhi approve nahi kar sakte.

Reasoning:

• Version variables are hardcoded in 5 different files! This violates the DRY principle and will lead to synchronization bugs in future releases.
• InstallController.js is missing an '.on("error")' listener on child process spawning, leading to potential uncaught exception process crashes if the binary does not exist or lacks execution rights.
• The child process spawn lacks validation on binary file path existence and executable permissions on Unix systems (no dynamic chmod +x fallback).
• Process environment cloning utilizes destructured shallow-copying { ...process.env } which creates redundant heap objects instead of in-place variable setting.

---

📋 Review Checklist for Reviewers:

• Code changes align with the PR description
• No security vulnerabilities introduced
• Performance considerations addressed
• Code follows project conventions
• Tests are adequate (if applicable)
• Documentation updated (if needed)

🎯 Next Steps:

⚠️ Pehle suggestions address karo, phir approve karna.

Generated by Review Buddy | Tone: roast | Language: hinglish