@claudetools/cli 0.13.13 → 0.13.15

package/dist/webhooks/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/webhooks/index.ts"],"names":[],"mappings":"AA0BA,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CA2BrD;AAED,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAC9B,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWxE;AAED,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BtE"}

package/dist/webhooks/index.js

@@ -0,0 +1,81 @@
+import { runCommand } from '../lib/command-runner.js';
+import { required, requireActiveTeam } from '../lib/validators.js';
+import { emptyState } from '../lib/formatters.js';
+export async function runWebhooksList() {
+    await runCommand(async (client, config) => {
+        const activeTeam = requireActiveTeam(config);
+        const { data } = await client.get(`/teams/${activeTeam}/webhooks`);
+        const webhooks = data?.webhooks || [];
+        if (webhooks.length === 0) {
+            emptyState('No webhooks configured.', 'Create one with: claudetools webhooks create <url>');
+            return;
+        }
+        console.log();
+        console.log(`  Team Webhooks (${webhooks.length}):`);
+        console.log();
+        for (const webhook of webhooks) {
+            const statusDisplay = webhook.status === 'active' ? 'active' : 'inactive';
+            const createdDate = new Date(webhook.createdAt).toLocaleDateString();
+            console.log(`  ${webhook.url}`);
+            console.log(`    ID: ${webhook.id}`);
+            console.log(`    Events: ${webhook.events.join(', ')}`);
+            console.log(`    Status: ${statusDisplay} | Created: ${createdDate}`);
+            console.log();
+        }
+    });
+}
+export async function runWebhooksCreate(url, options) {
+    await runCommand(async (client, config) => {
+        const activeTeam = requireActiveTeam(config);
+        required(url, 'webhook URL');
+        const { data } = await client.post(`/teams/${activeTeam}/webhooks`, {
+            url,
+            events: options?.events || ['*'],
+        });
+        const result = required(data, 'webhook response');
+        console.log();
+        console.log('  Webhook created successfully!');
+        console.log();
+        console.log(`  URL: ${result.webhook.url}`);
+        console.log(`  ID: ${result.webhook.id}`);
+        console.log(`  Events: ${result.webhook.events.join(', ')}`);
+        console.log();
+        console.log('  Signing Secret:');
+        console.log(`  ${result.secret}`);
+        console.log();
+        console.log('  Store this secret securely - it will not be shown again.');
+        console.log();
+    });
+}
+export async function runWebhooksDelete(webhookId) {
+    await runCommand(async (client, config) => {
+        const activeTeam = requireActiveTeam(config);
+        required(webhookId, 'webhook ID');
+        await client.delete(`/teams/${activeTeam}/webhooks/${webhookId}`);
+        console.log();
+        console.log('  Webhook deleted successfully.');
+        console.log();
+    });
+}
+export async function runWebhooksTest(webhookId) {
+    await runCommand(async (client, config) => {
+        const activeTeam = requireActiveTeam(config);
+        required(webhookId, 'webhook ID');
+        const { data } = await client.post(`/teams/${activeTeam}/webhooks/${webhookId}/test`, {});
+        const testResult = required(data, 'test response');
+        console.log();
+        console.log('  Webhook test result:');
+        console.log();
+        console.log(`  Status Code: ${testResult.statusCode}`);
+        console.log(`  Latency: ${testResult.latencyMs}ms`);
+        console.log();
+        if (testResult.statusCode >= 200 && testResult.statusCode < 300) {
+            console.log('  Test successful!');
+        }
+        else {
+            console.log('  Test failed - check your webhook endpoint.');
+        }
+        console.log();
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/webhooks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/webhooks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAwBlD,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAE7C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CAAuB,UAAU,UAAU,WAAW,CAAC,CAAC;QACzF,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;QAEtC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,UAAU,CAAC,yBAAyB,EAAE,oDAAoD,CAAC,CAAC;YAC5F,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,oBAAoB,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,EAAE,CAAC;QAEd,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;YAC1E,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,kBAAkB,EAAE,CAAC;YAErE,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,WAAW,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YACrC,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,eAAe,aAAa,eAAe,WAAW,EAAE,CAAC,CAAC;YACtE,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAW,EACX,OAA+B;IAE/B,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAE7B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,UAAU,UAAU,WAAW,EAC/B;YACE,GAAG;YACH,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC;SACjC,CACF,CAAC;QAEF,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;QAElD,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,SAAS,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7D,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAClC,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;QAC1E,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAiB;IACvD,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAElC,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,UAAU,aAAa,SAAS,EAAE,CAAC,CAAC;QAElE,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,SAAiB;IACrD,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAElC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,UAAU,UAAU,aAAa,SAAS,OAAO,EACjD,EAAE,CACH,CAAC;QAEF,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QAEnD,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,kBAAkB,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,cAAc,UAAU,CAAC,SAAS,IAAI,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,EAAE,CAAC;QAEd,IAAI,UAAU,CAAC,UAAU,IAAI,GAAG,IAAI,UAAU,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;YAChE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claudetools/cli",
-  "version": "0.13.13",
+  "version": "0.13.15",
   "description": "AI agent project setup and documentation tools for Claude Code",
   "type": "module",
   "main": "dist/cli.js",
@@ -9,9 +9,21 @@
   },
   "files": [
     "dist",
+    "scripts",
+    "bin",
     "README.md",
     "LICENSE"
   ],
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsx src/cli.ts",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit",
+    "clean": "rm -rf dist",
+    "prepublishOnly": "npm run build && npm run typecheck",
+    "postinstall": "node scripts/postinstall.js"
+  },
   "keywords": [
     "claude",
     "claude-code",
@@ -31,24 +43,23 @@
     "access": "public"
   },
   "dependencies": {
-    "@anthropic-ai/claude-agent-sdk": "^0.2.19",
+    "boxen": "^8.0.1",
     "chalk": "^5.6.2",
+    "cli-table3": "^0.6.5",
+    "open": "^11.0.0",
     "ora": "^9.0.0",
-    "prompts": "^2.4.2"
+    "prompts": "^2.4.2",
+    "yaml": "^2.8.2"
+  },
+  "optionalDependencies": {
+    "keytar": "^7.9.0"
   },
   "devDependencies": {
-    "@types/node": "^20.10.0",
+    "@types/node": "^22.19.7",
     "@types/prompts": "^2.4.9",
-    "tsx": "^4.7.0",
-    "typescript": "^5.3.0",
+    "@vitest/coverage-v8": "^4.0.18",
+    "tsx": "^4.19.0",
+    "typescript": "^5.9.3",
     "vitest": "^4.0.15"
-  },
-  "scripts": {
-    "build": "tsc",
-    "dev": "tsx src/cli.ts",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "typecheck": "tsc --noEmit",
-    "clean": "rm -rf dist"
   }
-}
+}

package/scripts/postinstall.js

@@ -0,0 +1,282 @@
+#!/usr/bin/env node
+/**
+ * Postinstall script for @claudetools/cli
+ *
+ * Checks whether the platform-specific sync engine binary was installed
+ * via optionalDependencies. If not (e.g. npm bug, unsupported platform,
+ * offline install), falls back to downloading the binary from GitHub.
+ */
+import https from 'https';
+import fs from 'fs';
+import path from 'path';
+import crypto from 'crypto';
+import { fileURLToPath } from 'url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+const TRUSTED_DOMAINS = [
+  'github.com',
+  'objects.githubusercontent.com',
+  'github-releases.githubusercontent.com',
+];
+const MAX_REDIRECTS = 5;
+
+const PLATFORM_MAP = {
+  'darwin-arm64': '@claudetools/sync-darwin-arm64',
+  'darwin-x64': '@claudetools/sync-darwin-x64',
+  'linux-arm64': '@claudetools/sync-linux-arm64',
+  'linux-x64': '@claudetools/sync-linux-x64',
+  'win32-x64': '@claudetools/sync-win32-x64',
+};
+
+// Rust target triples used for GitHub release asset names
+const RUST_TARGETS = {
+  'darwin-arm64': 'aarch64-apple-darwin',
+  'darwin-x64': 'x86_64-apple-darwin',
+  'linux-arm64': 'aarch64-unknown-linux-musl',
+  'linux-x64': 'x86_64-unknown-linux-musl',
+  'win32-x64': 'x86_64-pc-windows-msvc',
+};
+
+const platformKey = `${process.platform}-${process.arch}`;
+const packageName = PLATFORM_MAP[platformKey];
+const binaryName = process.platform === 'win32' ? 'claudetools-sync.exe' : 'claudetools-sync';
+const BIN_DIR = path.join(__dirname, '..', 'bin');
+
+function tryResolveFromOptionalDep() {
+  if (!packageName) return null;
+
+  try {
+    // Try to resolve from node_modules
+    const modulePath = path.join(__dirname, '..', 'node_modules', packageName, 'bin', binaryName);
+    if (fs.existsSync(modulePath)) return modulePath;
+  } catch {
+    // Not installed — fall through to download
+  }
+  return null;
+}
+
+function getSyncVersion(packageJson) {
+  const optDeps = packageJson.optionalDependencies || {};
+  const platformPkg = PLATFORM_MAP[platformKey];
+  // Get version from optionalDependencies, fall back to CLI version
+  return optDeps[platformPkg] || packageJson.version;
+}
+
+function getDownloadUrl(version) {
+  const rustTarget = RUST_TARGETS[platformKey];
+  if (!rustTarget) return null;
+  const ext = process.platform === 'win32' ? '.exe' : '';
+  return `https://github.com/ClaudeTools/sync/releases/download/v${version}/claudetools-sync-${rustTarget}${ext}`;
+}
+
+function getChecksumsUrl(version) {
+  return `https://github.com/ClaudeTools/sync/releases/download/v${version}/checksums.sha256`;
+}
+
+function fetchToBuffer(url, redirectsLeft = MAX_REDIRECTS) {
+  if (redirectsLeft <= 0) {
+    return Promise.reject(new Error('Too many redirects'));
+  }
+
+  return new Promise((resolve, reject) => {
+    const parsedUrl = new URL(url);
+    if (parsedUrl.protocol !== 'https:') {
+      return reject(new Error(`Refusing non-HTTPS URL: ${url}`));
+    }
+    if (!TRUSTED_DOMAINS.includes(parsedUrl.hostname)) {
+      return reject(new Error(`Refusing redirect to untrusted domain: ${parsedUrl.hostname}`));
+    }
+
+    https.get(url, { headers: { 'User-Agent': 'claudetools-installer' } }, (response) => {
+      if (response.statusCode === 301 || response.statusCode === 302) {
+        const redirectUrl = response.headers.location;
+        if (!redirectUrl) {
+          return reject(new Error('Redirect with no Location header'));
+        }
+        return fetchToBuffer(redirectUrl, redirectsLeft - 1).then(resolve).catch(reject);
+      }
+
+      if (response.statusCode !== 200) {
+        return reject(new Error(`Fetch failed with status ${response.statusCode}`));
+      }
+
+      const chunks = [];
+      response.on('data', (chunk) => chunks.push(chunk));
+      response.on('end', () => resolve(Buffer.concat(chunks)));
+      response.on('error', reject);
+    }).on('error', reject);
+  });
+}
+
+function downloadFile(url, dest, redirectsLeft = MAX_REDIRECTS) {
+  if (redirectsLeft <= 0) {
+    return Promise.reject(new Error('Too many redirects'));
+  }
+
+  return new Promise((resolve, reject) => {
+    const parsedUrl = new URL(url);
+    if (parsedUrl.protocol !== 'https:') {
+      return reject(new Error(`Refusing non-HTTPS URL: ${url}`));
+    }
+    if (!TRUSTED_DOMAINS.includes(parsedUrl.hostname)) {
+      return reject(new Error(`Refusing redirect to untrusted domain: ${parsedUrl.hostname}`));
+    }
+
+    console.log(`  Downloading from: ${url}`);
+
+    https.get(url, { headers: { 'User-Agent': 'claudetools-installer' } }, (response) => {
+      if (response.statusCode === 301 || response.statusCode === 302) {
+        const redirectUrl = response.headers.location;
+        if (!redirectUrl) {
+          return reject(new Error('Redirect with no Location header'));
+        }
+        return downloadFile(redirectUrl, dest, redirectsLeft - 1).then(resolve).catch(reject);
+      }
+
+      if (response.statusCode !== 200) {
+        return reject(new Error(`Download failed with status ${response.statusCode}`));
+      }
+
+      const file = fs.createWriteStream(dest);
+      response.pipe(file);
+
+      file.on('finish', () => {
+        file.close();
+        resolve();
+      });
+
+      file.on('error', (err) => {
+        response.destroy();
+        try { fs.unlinkSync(dest); } catch { /* already cleaned up */ }
+        reject(err);
+      });
+    }).on('error', reject);
+  });
+}
+
+function computeSha256(filePath) {
+  const fileBuffer = fs.readFileSync(filePath);
+  return crypto.createHash('sha256').update(fileBuffer).digest('hex');
+}
+
+async function verifyChecksum(version, binaryPath, assetFilename) {
+  const checksumsUrl = getChecksumsUrl(version);
+  console.log('  Verifying checksum...');
+
+  try {
+    const checksumsBuffer = await fetchToBuffer(checksumsUrl);
+    const checksumsText = checksumsBuffer.toString('utf8');
+
+    // Format: sha256hash  filename
+    const expectedEntry = checksumsText
+      .split('\n')
+      .map((line) => line.trim())
+      .find((line) => line.endsWith(assetFilename));
+
+    if (!expectedEntry) {
+      console.warn(`  Checksum entry not found for ${assetFilename}, skipping verification`);
+      return;
+    }
+
+    const expectedHash = expectedEntry.split(/\s+/)[0];
+    const actualHash = computeSha256(binaryPath);
+
+    if (actualHash !== expectedHash) {
+      try { fs.unlinkSync(binaryPath); } catch { /* best effort cleanup */ }
+      throw new Error(
+        `Checksum mismatch for ${assetFilename}:\n` +
+        `  Expected: ${expectedHash}\n` +
+        `  Actual:   ${actualHash}`
+      );
+    }
+
+    console.log('  Checksum verified');
+  } catch (checksumError) {
+    // If the checksums file itself couldn't be fetched (404), abort to prevent unverified binary install
+    if (checksumError.message && checksumError.message.includes('status 404')) {
+      try { fs.unlinkSync(binaryPath); } catch { /* best effort cleanup */ }
+      throw new Error(
+        `Checksum file not found for version ${version}. ` +
+        'Refusing to install unverified binary. ' +
+        'This may indicate a misconfigured release. ' +
+        'Install manually from: https://github.com/ClaudeTools/sync/releases'
+      );
+    }
+    // Re-throw checksum mismatch and other real errors
+    throw checksumError;
+  }
+}
+
+async function install() {
+  // Allow users to skip the download entirely
+  if (process.env.CLAUDETOOLS_SYNC_SKIP_DOWNLOAD === '1') {
+    console.log('CLAUDETOOLS_SYNC_SKIP_DOWNLOAD=1 — skipping sync engine install');
+    return;
+  }
+
+  // Warn if a proxy is detected
+  if (process.env.HTTP_PROXY || process.env.HTTPS_PROXY || process.env.http_proxy || process.env.https_proxy) {
+    console.warn('claudetools: Proxy detected. Download may fail behind a proxy.');
+    console.warn('claudetools: Set CLAUDETOOLS_SYNC_SKIP_DOWNLOAD=1 and install manually if needed.');
+  }
+
+  if (!packageName) {
+    console.log(`Unsupported platform: ${platformKey} — skipping sync engine install`);
+    return;
+  }
+
+  // Step 1: Check if the optional dependency installed the binary
+  const resolvedBinary = tryResolveFromOptionalDep();
+  if (resolvedBinary) {
+    console.log(`Sync engine binary found via npm: ${resolvedBinary}`);
+    return;
+  }
+
+  // Step 2: Fallback — download from GitHub releases
+  console.log('Sync engine binary not found in optional dependencies, downloading...');
+
+  const packageJson = JSON.parse(
+    fs.readFileSync(path.join(__dirname, '..', 'package.json'), 'utf8')
+  );
+  const syncVersion = getSyncVersion(packageJson);
+
+  if (!fs.existsSync(BIN_DIR)) {
+    fs.mkdirSync(BIN_DIR, { recursive: true });
+  }
+
+  const binPath = path.join(BIN_DIR, binaryName);
+  const tmpPath = `${binPath}.tmp`;
+  const downloadUrl = getDownloadUrl(syncVersion);
+
+  // Derive the asset filename from the URL for checksum lookup
+  const assetFilename = path.basename(new URL(downloadUrl).pathname);
+
+  try {
+    // Download to temp file first (atomic write pattern)
+    await downloadFile(downloadUrl, tmpPath);
+
+    // Verify checksum before finalizing
+    await verifyChecksum(syncVersion, tmpPath, assetFilename);
+
+    // Atomic rename from .tmp to final destination
+    fs.renameSync(tmpPath, binPath);
+
+    if (process.platform !== 'win32') {
+      fs.chmodSync(binPath, 0o755);
+    }
+
+    console.log(`Sync engine installed at: ${binPath}`);
+  } catch (downloadError) {
+    // Clean up temp file on any failure
+    try { fs.unlinkSync(tmpPath); } catch { /* already cleaned up */ }
+
+    console.warn(`Failed to download sync engine: ${downloadError.message}`);
+    console.warn('The CLI will still work, but sync features require the sync engine.');
+    console.warn('Install manually: https://github.com/ClaudeTools/sync/releases');
+    // Non-fatal — CLI should still be usable without sync engine
+  }
+}
+
+install();