@everme/cli 0.1.0-beta.1

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for describing the origin of the Work and
+      reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Support. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or support.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Evermind AI
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,51 @@
+# @everme/cli
+
+npm-distributed installer for [EverMe CLI](https://github.com/alwaysday1/everme). Detects your platform on install, downloads the matching pre-built binary from GitHub Releases, verifies its SHA-256 checksum, and exposes it as the `everme` command.
+
+```bash
+npm install -g @everme/cli@beta
+everme --help
+
+# or, no install
+npx @everme/cli@beta --version
+```
+
+## What this package does
+
+`@everme/cli` is a thin Node-side installer + runner; the actual CLI is a pre-compiled binary downloaded on first install. On `npm install`:
+
+1. Detect platform / arch (darwin/linux/windows × amd64/arm64)
+2. Download the matching archive from `https://github.com/alwaysday1/everme/releases/download/v<version>/evercli_<os>_<arch>.{tar.gz|zip}`
+3. Verify SHA-256 against the `sha256sums.txt` shipped inside this npm package
+4. Extract and place the binary under the package's `bin/` directory
+5. The `everme` shim (`scripts/run.js`) execs that binary with your args
+
+If `postinstall` was skipped (some `npx` flows, restricted CI), the installer runs lazily on first invocation.
+
+### Mirrors / restricted networks
+
+The installer tries download sources in this order:
+
+1. `https://github.com/alwaysday1/everme/releases/...` (canonical)
+2. The npm registry's binary mirror path (`<registry>/-/binary/everme-cli/...`), if your `npm_config_registry` is non-default
+3. `https://registry.npmmirror.com/-/binary/everme-cli/...` (always tried as final fallback)
+
+The first source to succeed wins. SHA-256 verification runs regardless of source.
+
+### Self-hosted backend
+
+Point the CLI at your own EverMe gateway:
+
+```bash
+export EVERCLI_API_BASE_URL=https://memory.acme-internal.com
+everme auth login
+```
+
+## Release channels
+
+- `@everme/cli@beta` — pre-release builds
+- `@everme/cli@latest` — stable releases
+
+## License
+
+Apache-2.0.

package/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "@everme/cli",
+  "version": "0.1.0-beta.1",
+  "description": "EverMe CLI — npm wrapper that downloads and runs the platform-native evercli binary on first use.",
+  "license": "Apache-2.0",
+  "bin": {
+    "everme": "scripts/run.js"
+  },
+  "scripts": {
+    "postinstall": "node scripts/install.js",
+    "test": "node --test tests/install.test.js"
+  },
+  "os": [
+    "darwin",
+    "linux",
+    "win32"
+  ],
+  "cpu": [
+    "x64",
+    "arm64"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "files": [
+    "scripts/install.js",
+    "scripts/install-wizard.js",
+    "scripts/run.js",
+    "sha256sums.txt",
+    "LICENSE",
+    "README.md"
+  ],
+  "keywords": [
+    "evermind",
+    "everme",
+    "cli",
+    "memory",
+    "ai",
+    "agent"
+  ],
+  "homepage": "https://everme.ai",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alwaysday1/everme.git",
+    "directory": "plugins/cli"
+  },
+  "bugs": {
+    "url": "https://github.com/alwaysday1/everme/issues"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  },
+  "dependencies": {}
+}

package/scripts/install-wizard.js

@@ -0,0 +1,60 @@
+#!/usr/bin/env node
+// Copyright 2026 Evermind AI
+// SPDX-License-Identifier: Apache-2.0
+
+/**
+ * `everme install` wizard. Runs without the binary present, which lets
+ * `npx @everme/cli install` work even when the postinstall step was skipped
+ * (npx, restricted CI). Responsibilities:
+ *
+ *   1. Print a short banner so users know what's happening.
+ *   2. Ensure the platform-native binary is downloaded (calls install.js
+ *      with EVERME_CLI_RUN=true to bypass the npx-skip guard).
+ *   3. Exec the binary's own `install` subcommand, which is where the real
+ *      provisioning lives (login, agent token, plugin registration into
+ *      Claude Code / Cursor / OpenClaw config files).
+ *
+ * Anything beyond step 3 belongs in the Go binary, not here. Keeping this
+ * thin means we don't have to ship feature parity in JS.
+ */
+
+const path = require("path");
+const fs = require("fs");
+const { execFileSync } = require("child_process");
+
+const NAME = "evercli";
+const ext = process.platform === "win32" ? ".exe" : "";
+const bin = path.join(__dirname, "..", "bin", NAME + ext);
+
+const VERSION = require("../package.json").version;
+
+console.log(`\n  EverMe CLI installer (v${VERSION})`);
+console.log(`  ────────────────────────────────────`);
+console.log(`  Persistent memory for AI agents.\n`);
+
+if (!fs.existsSync(bin)) {
+  console.log(`  → downloading evercli binary for ${process.platform}-${process.arch}`);
+  try {
+    execFileSync(process.execPath, [path.join(__dirname, "install.js")], {
+      stdio: "inherit",
+      env: { ...process.env, EVERME_CLI_RUN: "true" },
+    });
+  } catch (_) {
+    console.error(
+      `\n  Could not download the evercli binary. See errors above for details.\n` +
+        `  Once resolved, re-run: npx @everme/cli install\n`,
+    );
+    process.exit(1);
+  }
+}
+
+// Hand off to the Go binary's own install/setup flow. If the binary doesn't
+// implement an `install` subcommand yet, surfacing the help text is still a
+// reasonable "first-run" experience.
+try {
+  execFileSync(bin, ["install"], { stdio: "inherit" });
+} catch (e) {
+  // Exit with the binary's status if it ran but failed; fall back to 1
+  // (binary missing, EACCES, etc.).
+  process.exit(e.status || 1);
+}

package/scripts/install.js

@@ -0,0 +1,335 @@
+#!/usr/bin/env node
+// Copyright 2026 Evermind AI
+// SPDX-License-Identifier: Apache-2.0
+
+/**
+ * postinstall hook for @everme/cli — downloads, verifies, and extracts the
+ * platform-native evercli binary into <pkg>/bin.
+ *
+ * Conventions match this monorepo's existing goreleaser config and shell
+ * installer (cli/.goreleaser.yml, cli/scripts/install.sh):
+ *
+ *   tag      cli/vX.Y.Z
+ *   archive  evercli_<os>_<arch>.tar.gz   (Unix)
+ *            evercli_<os>_<arch>.zip      (Windows)
+ *   checksum sha256sums.txt
+ *
+ * Why curl rather than node:https: matches install.sh, behaves consistently
+ * across corporate proxies, and follows redirects without us reimplementing
+ * the redirect chain.
+ */
+
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+const crypto = require("crypto");
+const { execFileSync } = require("child_process");
+
+// Keep prerelease suffix (e.g. "0.1.0-beta.1") intact — GoReleaser tags
+// match package.json version verbatim, so stripping after `-` would build
+// TAG = cli/v0.1.0 for a 0.1.0-beta.1 publish and 404 against the real
+// cli/v0.1.0-beta.1 release.
+const VERSION = require("../package.json").version;
+const REPO = "alwaysday1/everme";
+const NAME = "evercli";
+
+// Allowlist gates the *initial* request URL. curl --location follows redirects
+// (capped by --max-redirs 3) without re-checking the target host. Acceptable
+// because the SHA256 check on the downloaded archive is the primary integrity
+// control; the allowlist is defense-in-depth against obviously wrong URLs.
+const ALLOWED_HOSTS = new Set([
+  "github.com",
+  "objects.githubusercontent.com",
+  "registry.npmmirror.com",
+]);
+
+const PLATFORM_MAP = {
+  darwin: "darwin",
+  linux: "linux",
+  win32: "windows",
+};
+
+const ARCH_MAP = {
+  x64: "amd64",
+  arm64: "arm64",
+};
+
+const platform = PLATFORM_MAP[process.platform];
+const arch = ARCH_MAP[process.arch];
+
+const isWindows = process.platform === "win32";
+const ext = isWindows ? ".zip" : ".tar.gz";
+const archiveName = `${NAME}_${platform}_${arch}${ext}`;
+
+// Tag scheme is bare semver `vX.Y.Z`. The original design used a monorepo
+// prefix `cli/vX.Y.Z`, but goreleaser OSS rejects prefixed tags as invalid
+// semver (the `monorepo.tag_prefix` setting is Pro-only). Since server is
+// deployed separately (not tagged), the cli/ prefix carried no real value.
+const TAG = `v${VERSION}`;
+const GITHUB_URL = `https://github.com/${REPO}/releases/download/${TAG}/${archiveName}`;
+
+const binDir = path.join(__dirname, "..", "bin");
+const dest = path.join(binDir, NAME + (isWindows ? ".exe" : ""));
+
+function joinUrl(base, suffix) {
+  return base.replace(/\/+$/, "") + suffix;
+}
+
+function isValidDownloadBase(raw) {
+  try {
+    const parsed = new URL(raw);
+    return parsed.protocol === "https:" && !!parsed.hostname;
+  } catch (_) {
+    return false;
+  }
+}
+
+function isDefaultNpmjsRegistry(url) {
+  try {
+    const { hostname } = new URL(url);
+    return hostname === "registry.npmjs.org";
+  } catch (_) {
+    return false;
+  }
+}
+
+/**
+ * Build the ordered list of binary mirror URLs to try.
+ *
+ *   1. npm_config_registry — when the user has set a non-default registry
+ *      (npmmirror clone, corp Verdaccio, Artifactory), we prepend the
+ *      derived path. Many proxies don't host /-/binary/<pkg>/..., so we
+ *      always append the public npmmirror as a final fallback.
+ *   2. registry.npmmirror.com — public China mirror, always tried last.
+ *
+ * The default public npmjs registry is skipped because it doesn't host
+ * binaries under /-/binary/...
+ *
+ * Non-https / malformed npm_config_registry is silently ignored so npm users
+ * with http-only internal registries don't have their installs broken.
+ */
+function resolveMirrorUrls(env) {
+  const binaryPath = `/-/binary/everme-cli/${TAG}/${archiveName}`;
+  const defaultUrl = joinUrl("https://registry.npmmirror.com", binaryPath);
+
+  const urls = [];
+  const registry = (env.npm_config_registry || "").trim();
+  if (registry && !isDefaultNpmjsRegistry(registry) && isValidDownloadBase(registry)) {
+    const base = new URL(registry);
+    urls.push(joinUrl(base.origin + base.pathname, binaryPath));
+  }
+  if (!urls.includes(defaultUrl)) urls.push(defaultUrl);
+  return urls;
+}
+
+function getMirrorUrls(env) {
+  const urls = resolveMirrorUrls(env);
+  for (const u of urls) ALLOWED_HOSTS.add(new URL(u).hostname);
+  return urls;
+}
+
+function assertAllowedHost(url) {
+  const { hostname } = new URL(url);
+  if (!ALLOWED_HOSTS.has(hostname)) {
+    throw new Error(`Download host not allowed: ${hostname}`);
+  }
+}
+
+function download(url, destPath) {
+  assertAllowedHost(url);
+  const args = [
+    "--fail", "--location", "--silent", "--show-error",
+    "--connect-timeout", "10", "--max-time", "120",
+    "--max-redirs", "3",
+    "--output", destPath,
+  ];
+  // On Windows (Schannel), avoid CRYPT_E_REVOCATION_OFFLINE errors when the
+  // CRL server is unreachable.
+  if (isWindows) args.unshift("--ssl-revoke-best-effort");
+  args.push(url);
+  execFileSync("curl", args, { stdio: ["ignore", "ignore", "pipe"] });
+}
+
+function extractZipWindows(archivePath, destDir) {
+  const psOpts = ["-NoProfile", "-ExecutionPolicy", "Bypass", "-Command"];
+  const psStdio = ["ignore", "inherit", "inherit"];
+  const psEnv = {
+    ...process.env,
+    EVERME_CLI_ARCHIVE: archivePath,
+    EVERME_CLI_DEST: destDir,
+  };
+  try {
+    const dotnet =
+      "$ErrorActionPreference='Stop';" +
+      "Add-Type -AssemblyName System.IO.Compression.FileSystem;" +
+      "[System.IO.Compression.ZipFile]::ExtractToDirectory($env:EVERME_CLI_ARCHIVE,$env:EVERME_CLI_DEST)";
+    execFileSync("powershell.exe", [...psOpts, dotnet], { stdio: psStdio, env: psEnv });
+  } catch (primaryErr) {
+    try {
+      const cmdlet =
+        "$ErrorActionPreference='Stop';" +
+        "Expand-Archive -LiteralPath $env:EVERME_CLI_ARCHIVE -DestinationPath $env:EVERME_CLI_DEST -Force";
+      execFileSync("powershell.exe", [...psOpts, cmdlet], { stdio: psStdio, env: psEnv });
+    } catch (fallbackErr) {
+      throw new Error(
+        `Failed to extract ${archivePath}. ` +
+          `.NET ZipFile attempt: ${primaryErr.message}. ` +
+          `Expand-Archive fallback: ${fallbackErr.message}`,
+      );
+    }
+  }
+}
+
+/**
+ * Look up the SHA256 checksum for the archive from sha256sums.txt that ships
+ * inside this npm package. If the file is missing (e.g. local dev pack), warn
+ * and skip — the goreleaser CI is expected to copy sha256sums.txt before
+ * publishing.
+ */
+function getExpectedChecksum(archive, checksumsDir) {
+  const dir = checksumsDir || path.join(__dirname, "..");
+  const checksumsPath = path.join(dir, "sha256sums.txt");
+  if (!fs.existsSync(checksumsPath)) {
+    console.error("[WARN] sha256sums.txt not found, skipping checksum verification");
+    return null;
+  }
+  const content = fs.readFileSync(checksumsPath, "utf8");
+  for (const line of content.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    // sha256sums.txt uses two-space separator: "<hash>  <filename>"
+    const idx = trimmed.indexOf("  ");
+    if (idx === -1) continue;
+    const hash = trimmed.slice(0, idx);
+    const name = trimmed.slice(idx + 2);
+    if (name === archive) return hash;
+  }
+  throw new Error(`Checksum entry not found for ${archive}`);
+}
+
+function verifyChecksum(archivePath, expectedHash) {
+  if (expectedHash === null) return;
+  // Stream to keep RSS constant; archives can be ~10MB+.
+  const hash = crypto.createHash("sha256");
+  const fd = fs.openSync(archivePath, "r");
+  try {
+    const buf = Buffer.alloc(64 * 1024);
+    let bytesRead;
+    while ((bytesRead = fs.readSync(fd, buf, 0, buf.length, null)) > 0) {
+      hash.update(buf.subarray(0, bytesRead));
+    }
+  } finally {
+    fs.closeSync(fd);
+  }
+  const actual = hash.digest("hex");
+  if (actual.toLowerCase() !== expectedHash.toLowerCase()) {
+    throw new Error(
+      `[SECURITY] Checksum mismatch for ${path.basename(archivePath)}: ` +
+        `expected ${expectedHash} but got ${actual}`,
+    );
+  }
+}
+
+function install() {
+  const mirrorUrls = getMirrorUrls(process.env);
+  const downloadUrls = [GITHUB_URL, ...mirrorUrls];
+
+  fs.mkdirSync(binDir, { recursive: true });
+
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "everme-cli-"));
+  const archivePath = path.join(tmpDir, archiveName);
+
+  try {
+    // Walk the chain in order; stop at the first success.
+    let lastErr;
+    let downloaded = false;
+    for (const url of downloadUrls) {
+      try {
+        download(url, archivePath);
+        downloaded = true;
+        break;
+      } catch (e) {
+        lastErr = e;
+      }
+    }
+    if (!downloaded) throw lastErr;
+
+    const expectedHash = getExpectedChecksum(archiveName);
+    verifyChecksum(archivePath, expectedHash);
+
+    if (isWindows) {
+      extractZipWindows(archivePath, tmpDir);
+    } else {
+      execFileSync("tar", ["-xzf", archivePath, "-C", tmpDir], { stdio: "ignore" });
+    }
+
+    const binaryName = NAME + (isWindows ? ".exe" : "");
+    const extractedBinary = path.join(tmpDir, binaryName);
+    fs.copyFileSync(extractedBinary, dest);
+    fs.chmodSync(dest, 0o755);
+    console.log(`${NAME} v${VERSION} installed successfully`);
+  } finally {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  }
+}
+
+if (require.main === module) {
+  if (!platform || !arch) {
+    console.error(`Unsupported platform: ${process.platform}-${process.arch}`);
+    process.exit(1);
+  }
+
+  // Skip when this script is running from a source-tree workspace install
+  // rather than a real install of the published package. Real installs
+  // place the package under .../node_modules/@everme/cli/scripts/install.js;
+  // workspace dev installs leave __dirname pointing at the source path
+  // (e.g. .../plugins/cli/scripts/) since npm symlinks the workspace into
+  // node_modules but `__filename` is canonicalized via the symlink target.
+  // Without this guard, `npm install` at the repo root fails when no GitHub
+  // release exists yet for the in-development version.
+  if (!__dirname.includes(`${path.sep}node_modules${path.sep}`)) {
+    console.log(
+      `[@everme/cli] Skipping binary download during workspace dev install. ` +
+        `Set EVERME_CLI_FORCE_INSTALL=1 to override.`,
+    );
+    if (!process.env.EVERME_CLI_FORCE_INSTALL) process.exit(0);
+  }
+
+  // Explicit opt-out for sandboxed CI / Docker builds where network access
+  // isn't available; users who set this know they need to download by hand.
+  if (process.env.EVERME_CLI_SKIP_INSTALL) {
+    console.log(`[@everme/cli] EVERME_CLI_SKIP_INSTALL=1, skipping download.`);
+    process.exit(0);
+  }
+
+  // Under `npx`, npm runs postinstall but the user usually wants a quick
+  // throwaway invocation — downloading the binary up-front blocks for ~5s
+  // for nothing if their command doesn't actually run the binary
+  // (e.g. `npx @everme/cli install` triggers the wizard, which doesn't
+  // need the binary). Skip here and let run.js download lazily on first
+  // real exec.
+  const isNpxPostinstall = process.env.npm_command === "exec" && !process.env.EVERME_CLI_RUN;
+  if (isNpxPostinstall) process.exit(0);
+
+  try {
+    install();
+  } catch (err) {
+    console.error(`Failed to install ${NAME}:`, err.message);
+    console.error(
+      `\nIf you are behind a firewall or in a restricted network, try one of:\n` +
+        `  # 1. Use a proxy:\n` +
+        `  export https_proxy=http://your-proxy:port\n` +
+        `  npm install -g @everme/cli\n\n` +
+        `  # 2. Point to a corporate npm mirror that proxies /-/binary/everme-cli/...:\n` +
+        `  npm install -g @everme/cli --registry=https://your-corp-mirror/\n`,
+    );
+    process.exit(1);
+  }
+}
+
+module.exports = {
+  getExpectedChecksum,
+  verifyChecksum,
+  assertAllowedHost,
+  resolveMirrorUrls,
+};

package/scripts/run.js

@@ -0,0 +1,88 @@
+#!/usr/bin/env node
+// Copyright 2026 Evermind AI
+// SPDX-License-Identifier: Apache-2.0
+
+/**
+ * `everme` bin entry. Three responsibilities:
+ *
+ *   1. On Windows, recover from a crashed self-update that left the binary
+ *      renamed to `.old` (evercli is expected to atomically rename
+ *      <bin> → <bin>.old, write new <bin>, and clear <bin>.old on success;
+ *      if the process dies between rename and write, we restore here).
+ *
+ *   2. Route the `install` subcommand to install-wizard.js without exec'ing
+ *      the binary. The wizard provisions tokens and writes plugin entries
+ *      into Claude Code / Cursor / OpenClaw config files; it doesn't need
+ *      the Go binary itself.
+ *
+ *   3. For every other subcommand, ensure the binary is on disk (lazy
+ *      download via install.js if missing — covers the npx postinstall-skip
+ *      path), then exec it with the user's args.
+ */
+
+const { execFileSync } = require("child_process");
+const fs = require("fs");
+const path = require("path");
+
+const NAME = "evercli";
+const ext = process.platform === "win32" ? ".exe" : "";
+const bin = path.join(__dirname, "..", "bin", NAME + ext);
+const oldBin = bin + ".old";
+
+function restoreOldBinary() {
+  try {
+    if (fs.existsSync(bin)) fs.rmSync(bin, { force: true });
+    fs.renameSync(oldBin, bin);
+    return true;
+  } catch (_) {
+    return false;
+  }
+}
+
+if (process.platform === "win32" && fs.existsSync(oldBin)) {
+  if (!fs.existsSync(bin)) {
+    restoreOldBinary();
+  } else {
+    // Both bin and bin.old exist — verify the new one works; if it does,
+    // drop bin.old; otherwise restore it.
+    try {
+      execFileSync(bin, ["--version"], { stdio: "ignore", timeout: 10000 });
+      try {
+        fs.rmSync(oldBin, { force: true });
+      } catch (_) {
+        // Best-effort cleanup; the healthy binary still runs.
+      }
+    } catch (_) {
+      restoreOldBinary();
+    }
+  }
+}
+
+const args = process.argv.slice(2);
+
+if (args[0] === "install") {
+  // The wizard runs even if the binary is missing — that's the whole point
+  // of having it on the JS side.
+  require("./install-wizard.js");
+} else {
+  if (!fs.existsSync(bin)) {
+    try {
+      execFileSync(process.execPath, [path.join(__dirname, "install.js")], {
+        stdio: "inherit",
+        env: { ...process.env, EVERME_CLI_RUN: "true" },
+      });
+    } catch (_) {
+      console.error(
+        `\nFailed to auto-install ${NAME} binary.\n` +
+          `To fix, run the install script manually:\n` +
+          `  node "${path.join(__dirname, "install.js")}"\n`,
+      );
+      process.exit(1);
+    }
+  }
+  try {
+    execFileSync(bin, args, { stdio: "inherit" });
+  } catch (e) {
+    process.exit(e.status || 1);
+  }
+}

package/sha256sums.txt

@@ -0,0 +1,6 @@
+b351ee7393eefe8eaa96fe2487694e17bd8a44623abf7a6570bd61871623e1b2  evercli_darwin_amd64.tar.gz
+22254cf2e28c6b9a31395b6cfcdb9ae7d6f31698b775a679cdb2a6a1664174c3  evercli_darwin_arm64.tar.gz
+d2505defd953c9367417618b391bfcb7beb08934522e378ba15d3629beb5f7b6  evercli_linux_amd64.tar.gz
+911acb9f4ca8e5f1be7d5ee7a62a7b2bdc7a720a08c80313e1f5f8843a27c5cd  evercli_linux_arm64.tar.gz
+9e8ff7f3ba4ca936a891042aace8d05f18424233e42d92d9d7f5715a947ff827  evercli_windows_amd64.zip
+e15a32e8ef17a42671b4288d6e37b85dd3e73ff636f61447864c11af67917ceb  evercli_windows_arm64.zip