@lumi-ai-lab/harness-data 0.0.4 → 0.0.5

package/README.md

@@ -1,19 +1,43 @@
 # Harness Data npm installer
 
+Install a Harness Data runtime in the current directory:
+
 ```bash
 npx @lumi-ai-lab/harness-data install
-npx @lumi-ai-lab/harness-data install --git-protocol ssh
-npx @lumi-ai-lab/harness-data install --git-protocol https
-GITHUB_TOKEN=... npx @lumi-ai-lab/harness-data install --yes --agent codex --git-protocol https --github-token-env GITHUB_TOKEN --cas-config-dir /secure/path/to/cas
-npx @lumi-ai-lab/harness-data install --yes --agent pi --cas-config-dir /secure/path/to/cas
-npx @lumi-ai-lab/harness-data doctor --dir ~/harness-data
-npx @lumi-ai-lab/harness-data update --dir ~/harness-data
 ```
 
-This package is only the installer and updater. The full Harness Data workspace is cloned and maintained outside the npm package.
+Install into an explicit runtime directory:
+
+```bash
+npx @lumi-ai-lab/harness-data install --dir /path/to/runtime
+```
+
+Use a GitHub token for private Release assets:
+
+```bash
+npx @lumi-ai-lab/harness-data install --github-token ...
+```
+
+or:
+
+```bash
+GITHUB_TOKEN=... npx @lumi-ai-lab/harness-data install
+```
+
+Without a GitHub token, the installer interactively asks for local absolute paths to `cas-cli`, `qdm-indicators-cli`, `qdm-cmr-cli`, and `harness-data-wikis`. CAS username and password are always collected interactively.
+
+Update an existing runtime interactively:
+
+```bash
+npx @lumi-ai-lab/harness-data update
+```
+
+Diagnose a runtime:
 
-Private GitHub repository access defaults to `--git-protocol auto`: SSH is tried first, then HTTPS. HTTPS uses Git Credential Manager, `gh auth login`, or a token supplied through `--github-token-env`; GitHub account passwords are not supported.
+```bash
+npx @lumi-ai-lab/harness-data doctor
+```
 
-The `qdm-cmr-cli`, `qdm-indicators-cli`, and `cas-cli` binaries are downloaded from private GitHub Releases in `pengmide/qdm-cmr-cli`, `pengmide/qdm-indicators-cli`, and `pengmide/qdm-cas-cli`. The installer uses `gh auth login` first and falls back to `--github-token-env`.
+The runtime is assembled from the `harness-data` runtime bundle, platform-specific CLI Release assets, `harness-data-wikis`, generated local config, CAS credentials, and selected Agent symlinks.
 
-`--agent` supports `claude`, `codex`, `pi`, `both` (Claude + Codex), and `all` (Claude + Codex + Pi).
+`--agent` supports `claude`, `codex`, `pi`, and `all`; the default is `all`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumi-ai-lab/harness-data",
-  "version": "0.0.4",
+  "version": "0.0.5",
   "description": "Installer and updater for Harness Data",
   "type": "module",
   "bin": {

package/src/cli.js

@@ -36,13 +36,13 @@ export async function main(argv) {
   console.log(`Usage: harness-data <install|update|doctor|version> [options]
 
 Commands:
-  install  Clone/reuse a Harness Data workspace and complete setup
-  update   Check and apply installer, repository, CLI, and wikis updates
+  install  Install a Harness Data runtime in the current directory
+  update   Interactively check and apply runtime, CLI, and wikis updates
   doctor   Diagnose workspace CLI, config, auth, index, and Agent hooks
   version  Print installer, repository, wikis, and manifest versions
 
 Install options:
-  --git-protocol auto|ssh|https      Git protocol for private repositories (default: auto)
-  --github-token-env NAME            Token env var for HTTPS fallback or CI`);
+  --dir PATH                         Runtime directory (default: current directory)
+  --github-token TOKEN               GitHub token for private Release assets`);
   if (unknown) process.exitCode = 1;
 }

package/src/commands/doctor.js

@@ -2,8 +2,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { run } from "../lib/exec.js";
 import { findWorkspaceDir } from "../lib/paths.js";
-import { currentCommit, submoduleCommit } from "../lib/git.js";
-import { validateCasConfigDir } from "../lib/config.js";
+import { binaryName } from "../lib/platform.js";
 
 function existsExecutable(file) {
   try {
@@ -16,7 +15,7 @@ function existsExecutable(file) {
 
 function agentOk(workspace, name) {
   const target = path.join(workspace, `.${name}`);
-  const source = path.join(workspace, ".agents", name);
+  const source = path.join(workspace, "agents", name);
   if (!fs.existsSync(target) || !fs.existsSync(source)) return false;
   try {
     return fs.realpathSync(target) === fs.realpathSync(source);
@@ -26,7 +25,7 @@ function agentOk(workspace, name) {
 }
 
 async function tokenCheck(workspace, binary, env) {
-  const file = path.join(workspace, "bin", binary);
+  const file = path.join(workspace, "bin", binaryName(binary));
   if (!existsExecutable(file)) return false;
   const result = await run(file, ["config", "check-token"], { cwd: workspace, env, allowFailure: true });
   return result.code === 0;
@@ -40,9 +39,9 @@ function configPathsValid(workspace) {
   return matches.length >= 3 && matches.every((entry) => fs.existsSync(entry));
 }
 
-function casCredentialsValid(dir) {
+function jsonFileValid(file) {
   try {
-    validateCasConfigDir(dir);
+    JSON.parse(fs.readFileSync(file, "utf8"));
     return true;
   } catch {
     return false;
@@ -55,24 +54,27 @@ export async function collectDoctor(workspace, options = {}) {
   const checks = [];
   const add = (name, ok, detail = "") => checks.push({ name, ok, detail });
 
-  add("workspace", fs.existsSync(path.join(workspace, "bootstrap", "cli-manifest.json")), workspace);
-  add("wikis submodule", fs.existsSync(path.join(workspace, "wikis", ".git")) || fs.existsSync(path.join(workspace, ".git", "modules", "wikis")));
+  add("runtime", fs.existsSync(path.join(workspace, "bootstrap", "cli-manifest.json")) && fs.existsSync(path.join(workspace, "agents")), workspace);
+  add("wikis/spec", fs.existsSync(path.join(workspace, "wikis", "spec")));
+  add("wikis/playbooks", fs.existsSync(path.join(workspace, "wikis", "playbooks")));
+  add("wikis/templates", fs.existsSync(path.join(workspace, "wikis", "templates")));
   for (const binary of ["data-harness-cli", "qdm-cmr-cli", "qdm-indicators-cli", "cas-cli"]) {
-    add(`bin/${binary}`, existsExecutable(path.join(workspace, "bin", binary)));
+    add(`bin/${binary}`, existsExecutable(path.join(workspace, "bin", binaryName(binary))));
   }
   add("config/harness-config.yaml", fs.existsSync(path.join(workspace, "config", "harness-config.yaml")));
   add("config/qdm-cli-paths.env", fs.existsSync(path.join(workspace, "config", "qdm-cli-paths.env")));
   add("config CLI paths", configPathsValid(workspace));
-  add("CAS credentials", casCredentialsValid(casConfigDir), casConfigDir);
+  add("CAS credentials file", jsonFileValid(path.join(casConfigDir, "config.json")), casConfigDir);
   add("CMR token", await tokenCheck(workspace, "qdm-cmr-cli", env));
   add("Indicators token", await tokenCheck(workspace, "qdm-indicators-cli", env));
-  add("wikis index", fs.existsSync(path.join(workspace, ".harness", "index", "wikis-index.json")) || fs.existsSync(path.join(workspace, ".harness", "index", "wikis-runtime-index.json")));
   add("Agent hook", agentOk(workspace, "claude") || agentOk(workspace, "codex") || agentOk(workspace, "pi"));
+  if (!fs.existsSync(path.join(workspace, ".harness", "index", "wikis-index.json")) &&
+      !fs.existsSync(path.join(workspace, ".harness", "index", "wikis-runtime-index.json"))) {
+    checks.push({ name: "wikis index", ok: true, detail: "missing; run data-harness-cli wikis build-index --skip-checks" });
+  }
 
   return {
     workspace,
-    mainCommit: await currentCommit(workspace),
-    wikisCommit: await submoduleCommit(workspace),
     checks
   };
 }
@@ -83,7 +85,7 @@ export async function doctorCommand(options = {}) {
   if (options.json) {
     console.log(JSON.stringify(report, null, 2));
   } else {
-    console.log(`Harness Data doctor: ${report.workspace}`);
+    console.log(`Harness Data runtime doctor: ${report.workspace}`);
     for (const check of report.checks) {
       console.log(`${check.ok ? "PASS" : "FAIL"} ${check.name}${check.detail ? ` (${check.detail})` : ""}`);
     }

package/src/commands/install.js

@@ -1,16 +1,17 @@
 import fs from "node:fs";
 import path from "node:path";
 import { commandExists, run } from "../lib/exec.js";
-import { writeLocalConfig, validateCasConfigDir, linkAgents } from "../lib/config.js";
-import { confirm, chooseAgent } from "../lib/prompt.js";
-import { defaultWorkspaceDir, looksLikeWorkspace, resolveWorkspaceDir, writeState } from "../lib/paths.js";
-import { isGitRepo, currentCommit, submoduleCommit } from "../lib/git.js";
+import { writeLocalConfig, linkAgents } from "../lib/config.js";
+import { ask, askSecret, chooseAgent } from "../lib/prompt.js";
+import { resolveWorkspaceDir, writeState } from "../lib/paths.js";
 import { installToolsFromManifest, manifestDigest, readManifest } from "../lib/manifest.js";
-import { platformKey } from "../lib/platform.js";
+import { binaryName, platformKey } from "../lib/platform.js";
 import { collectDoctor } from "./doctor.js";
-import { checkUpdates } from "./update.js";
 import { packageVersion } from "../lib/package.js";
-import { gitUrls, repoProtocol, repoUrl, resolveInstallProtocol, runGitWithProtocol, syncWikisSubmodule } from "../lib/git-auth.js";
+import { downloadReleaseAsset, findReleaseAsset, githubToken, hasGithubAuth, latestRelease } from "../lib/github.js";
+
+const runtimeRepo = "lumi-ai-lab/harness-data";
+const wikisRepo = "lumi-ai-lab/harness-data-wikis";
 
 async function requireCommands(commands) {
   for (const command of commands) {
@@ -18,107 +19,192 @@ async function requireCommands(commands) {
   }
 }
 
-async function prepareWorkspace(options) {
-  const target = resolveWorkspaceDir(options.dir || (looksLikeWorkspace(process.cwd()) ? process.cwd() : defaultWorkspaceDir()));
-  const branch = options.branch || "master";
-  if (!fs.existsSync(target)) {
-    const protocol = await resolveInstallProtocol(options);
-    const repo = options.repo || gitUrls[protocol].repo;
-    if (!(await confirm(`Clone ${repo} to ${target}?`, { yes: options.yes }))) throw new Error("install cancelled");
-    fs.mkdirSync(path.dirname(target), { recursive: true });
-    await runGitWithProtocol(protocol, ["clone", "--branch", branch, repo, target], { ...options, stdio: "inherit" });
-    await syncWikisSubmodule(target, protocol);
-    await runGitWithProtocol(protocol, ["submodule", "update", "--init", "--recursive", "wikis"], { ...options, cwd: target, stdio: "inherit" });
-    return { workspace: target, gitProtocol: protocol, repoUrl: repo };
+async function prepareRuntimeDir(options) {
+  const runtimeDir = resolveWorkspaceDir(options.dir || process.cwd());
+  fs.mkdirSync(runtimeDir, { recursive: true });
+  return runtimeDir;
+}
+
+export async function installRuntimeBundle(runtimeDir, options = {}) {
+  if (!options.force && fs.existsSync(path.join(runtimeDir, "agents")) &&
+      fs.existsSync(path.join(runtimeDir, "config")) &&
+      fs.existsSync(path.join(runtimeDir, "bootstrap", "cli-manifest.json"))) {
+    return { tag: "", skipped: true };
+  }
+
+  const release = await latestRelease(runtimeRepo, options);
+  const tag = release.tag_name;
+  const assetName = `harness-data-runtime-${tag}.tar.gz`;
+  const asset = findReleaseAsset(release, assetName);
+  const shaAsset = findReleaseAsset(release, `${assetName}.sha256`);
+  if (!asset) throw new Error(`runtime bundle asset missing in ${runtimeRepo} ${tag}: ${assetName}`);
+
+  const cacheDir = path.join(runtimeDir, ".bootstrap-cache");
+  fs.mkdirSync(cacheDir, { recursive: true });
+  const archive = path.join(cacheDir, assetName);
+  await downloadReleaseAsset(asset, archive, options);
+  if (shaAsset) {
+    const shaFile = `${archive}.sha256`;
+    await downloadReleaseAsset(shaAsset, shaFile, options);
+    const expected = fs.readFileSync(shaFile, "utf8").trim().split(/\s+/)[0];
+    const crypto = await import("node:crypto");
+    const actual = crypto.createHash("sha256").update(fs.readFileSync(archive)).digest("hex");
+    if (expected && actual !== expected) throw new Error("runtime bundle sha256 mismatch");
+  } else {
+    console.warn("warning: runtime bundle has no sha256 asset; continuing without checksum");
+  }
+
+  const extractDir = fs.mkdtempSync(path.join(cacheDir, "runtime-"));
+  await run("tar", ["-xzf", archive, "-C", extractDir], { stdio: "inherit" });
+  for (const dir of ["agents", "bootstrap"]) {
+    const source = path.join(extractDir, dir);
+    if (!fs.existsSync(source)) throw new Error(`runtime bundle missing ${dir}/`);
+    fs.rmSync(path.join(runtimeDir, dir), { recursive: true, force: true });
+    fs.cpSync(source, path.join(runtimeDir, dir), { recursive: true });
   }
-  if (!(await isGitRepo(target)) || !looksLikeWorkspace(target)) {
-    throw new Error(`${target} exists but is not a valid harness-data workspace; pass --dir or move the directory`);
+  const configSource = path.join(extractDir, "config");
+  if (!fs.existsSync(configSource)) throw new Error("runtime bundle missing config/");
+  fs.mkdirSync(path.join(runtimeDir, "config"), { recursive: true });
+  for (const file of fs.readdirSync(configSource)) {
+    fs.copyFileSync(path.join(configSource, file), path.join(runtimeDir, "config", file));
   }
-  if (!(await confirm(`Reuse existing workspace ${target}?`, { yes: options.yes }))) throw new Error("install cancelled");
-  return { workspace: target, gitProtocol: await repoProtocol(target), repoUrl: await repoUrl(target) };
+  fs.rmSync(extractDir, { recursive: true, force: true });
+  return { tag, skipped: false };
 }
 
-async function configureAuth(workspace, options) {
-  const casConfigDir = path.resolve(options.casConfigDir || path.join(workspace, ".qdm-auth", "cas"));
-  fs.mkdirSync(casConfigDir, { recursive: true, mode: 0o700 });
-  const env = { QDM_CAS_CONFIG_DIR: casConfigDir };
-  if (options.casConfigDir) {
-    validateCasConfigDir(casConfigDir);
-  } else if (options.yes) {
-    throw new Error("non-interactive install requires --cas-config-dir with existing CAS credentials");
-  } else {
-    await run(path.join(workspace, "bin", "cas-cli"), ["config", "set-credentials"], { cwd: workspace, env, stdio: "inherit" });
-    validateCasConfigDir(casConfigDir);
+function executable(file) {
+  try {
+    fs.accessSync(file, fs.constants.X_OK);
+    return true;
+  } catch {
+    return false;
   }
-  await run("sh", ["-c", `"${path.join(workspace, "bin", "qdm-cmr-cli")}" config set-token "$("${path.join(workspace, "bin", "cas-cli")}" token --app cmr)"`], {
-    cwd: workspace,
-    env,
-    stdio: "inherit"
-  });
-  await run("sh", ["-c", `"${path.join(workspace, "bin", "qdm-indicators-cli")}" config set-token "$("${path.join(workspace, "bin", "cas-cli")}" token --app indicators)"`], {
-    cwd: workspace,
-    env,
-    stdio: "inherit"
-  });
-  await run(path.join(workspace, "bin", "qdm-cmr-cli"), ["config", "check-token"], { cwd: workspace, env, stdio: "inherit" });
-  await run(path.join(workspace, "bin", "qdm-indicators-cli"), ["config", "check-token"], { cwd: workspace, env, stdio: "inherit" });
-  return casConfigDir;
 }
 
-export async function buildAndCheck(workspace, options) {
-  const cli = path.join(workspace, "bin", "data-harness-cli");
-  const buildIndexArgs = ["wikis", "build-index"];
-  if (options.skipWikisCheck) buildIndexArgs.push("--skip-checks");
-  await run(cli, buildIndexArgs, { cwd: workspace, stdio: "inherit" });
-  await run(cli, ["context", "--question", "会员复购为什么下降？", "--json"], { cwd: workspace, stdio: "inherit" });
-  let runFullCheck = !options.skipWikisCheck;
-  if (!options.yes && !options.skipWikisCheck) {
-    runFullCheck = await confirm("Run wikis check-all?", { defaultNo: false });
+async function promptExecutable(runtimeDir, name, options = {}) {
+  const auto = path.join(runtimeDir, "bin", binaryName(name));
+  if (executable(auto)) return auto;
+  const value = await ask(`Path to ${name}:`, options);
+  const file = path.resolve(value);
+  if (!executable(file)) throw new Error(`${name} path is missing or not executable: ${file}`);
+  return file;
+}
+
+async function installLocalTools(runtimeDir, options = {}) {
+  const binDir = path.join(runtimeDir, "bin");
+  fs.mkdirSync(binDir, { recursive: true });
+  const installed = {};
+  for (const name of ["cas-cli", "qdm-indicators-cli", "qdm-cmr-cli"]) {
+    const source = await promptExecutable(runtimeDir, name, options);
+    const target = path.join(binDir, binaryName(name));
+    if (path.resolve(source) !== path.resolve(target)) {
+      fs.copyFileSync(source, target);
+      fs.chmodSync(target, 0o755);
+    }
+    installed[name] = { mode: "local-path", source };
   }
-  if (runFullCheck) {
-    const result = await run(cli, ["wikis", "check-all"], { cwd: workspace, stdio: "inherit", allowFailure: true });
-    if (result.code !== 0) console.warn("warning: wikis check-all reported issues");
-  } else {
-    console.warn("warning: wikis check-all skipped");
+  return installed;
+}
+
+async function installWikis(runtimeDir, options = {}) {
+  const target = path.join(runtimeDir, "wikis");
+  if (githubToken(options)) {
+    if (fs.existsSync(path.join(target, ".git"))) {
+      await run("git", ["-C", target, "pull", "--ff-only"], { stdio: "inherit" });
+    } else {
+      fs.rmSync(target, { recursive: true, force: true });
+      await run("git", ["clone", `https://x-access-token:${githubToken(options)}@github.com/${wikisRepo}.git`, target], { stdio: "inherit" });
+    }
+    return { mode: "github", path: target };
   }
+  if (await hasGithubAuth(options)) {
+    if (fs.existsSync(path.join(target, ".git"))) {
+      await run("git", ["-C", target, "pull", "--ff-only"], { stdio: "inherit" });
+    } else {
+      fs.rmSync(target, { recursive: true, force: true });
+      await run("gh", ["repo", "clone", wikisRepo, target], { stdio: "inherit" });
+    }
+    return { mode: "github", path: target };
+  }
+
+  const auto = path.join(runtimeDir, "harness-data-wikis");
+  const source = fs.existsSync(auto) ? auto : path.resolve(await ask("Path to harness-data-wikis:", options));
+  for (const dir of ["spec", "playbooks", "templates"]) {
+    if (!fs.existsSync(path.join(source, dir))) throw new Error(`harness-data-wikis missing ${dir}/: ${source}`);
+  }
+  fs.rmSync(target, { recursive: true, force: true });
+  fs.cpSync(source, target, { recursive: true });
+  return { mode: "local-path", source, path: target };
+}
+
+function casConfigDir(runtimeDir) {
+  return path.join(runtimeDir, ".qdm-auth", "cas");
+}
+
+async function writeCasCredentials(runtimeDir, options = {}) {
+  const username = await ask("CAS username:", options);
+  const password = await askSecret("CAS password:", options);
+  if (!username || !password) throw new Error("CAS username and password are required");
+  const dir = casConfigDir(runtimeDir);
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  fs.writeFileSync(path.join(dir, "config.json"), `${JSON.stringify({ cas: { username, password } }, null, 2)}\n`, { mode: 0o600 });
+  return dir;
+}
+
+async function configureTokens(runtimeDir, casDir) {
+  const env = { QDM_CAS_CONFIG_DIR: casDir };
+  const bin = (name) => path.join(runtimeDir, "bin", binaryName(name));
+  const cmrToken = (await run(bin("cas-cli"), ["token", "--app", "cmr"], { cwd: runtimeDir, env })).stdout.trim();
+  await run(bin("qdm-cmr-cli"), ["config", "set-token", cmrToken], { cwd: runtimeDir, env, stdio: "inherit" });
+  const indicatorsToken = (await run(bin("cas-cli"), ["token", "--app", "indicators"], { cwd: runtimeDir, env })).stdout.trim();
+  await run(bin("qdm-indicators-cli"), ["config", "set-token", indicatorsToken], { cwd: runtimeDir, env, stdio: "inherit" });
+  await run(bin("qdm-cmr-cli"), ["config", "check-token"], { cwd: runtimeDir, env, stdio: "inherit" });
+  await run(bin("qdm-indicators-cli"), ["config", "check-token"], { cwd: runtimeDir, env, stdio: "inherit" });
+}
+
+export async function buildAndCheck(runtimeDir, options = {}) {
+  const cli = path.join(runtimeDir, "bin", binaryName("data-harness-cli"));
+  const result = await run(cli, ["wikis", "build-index", "--skip-checks"], { cwd: runtimeDir, stdio: "inherit", allowFailure: true });
+  if (result.code !== 0) console.warn("warning: wikis build-index --skip-checks failed; continue install and retry manually later");
 }
 
 export async function installCommand(options = {}) {
   platformKey();
-  await requireCommands(["git", "curl", "tar", "unzip"]);
-  const prepared = await prepareWorkspace(options);
-  const workspace = prepared.workspace;
-  const manifestPath = path.resolve(options.manifest || path.join(workspace, "bootstrap", "cli-manifest.json"));
-  if (!(await confirm("Download or refresh CLI binaries?", { yes: options.yes }))) throw new Error("install cancelled");
-  const manifest = await installToolsFromManifest(workspace, manifestPath, options);
-  const configExists = fs.existsSync(path.join(workspace, "config", "harness-config.yaml")) ||
-    fs.existsSync(path.join(workspace, "config", "qdm-cli-paths.env"));
-  const overwrite = configExists && !options.yes ? await confirm("Overwrite existing local config files?", { defaultNo: true }) : !configExists;
-  if (configExists && !overwrite) {
-    console.log("Reusing existing local config files");
+  await requireCommands(["git", "tar", "unzip"]);
+  const runtimeDir = await prepareRuntimeDir(options);
+  const bundle = await installRuntimeBundle(runtimeDir, options);
+  const manifestPath = path.resolve(options.manifest || path.join(runtimeDir, "bootstrap", "cli-manifest.json"));
+  const tokenMode = await hasGithubAuth(options);
+
+  let manifest;
+  let localTools = {};
+  if (tokenMode) {
+    manifest = await installToolsFromManifest(runtimeDir, manifestPath, options);
   } else {
-    writeLocalConfig(workspace, { overwrite: true });
+    manifest = readManifest(manifestPath);
+    await installToolsFromManifest(runtimeDir, manifestPath, { ...options, tools: ["data-harness-cli"] });
+    localTools = await installLocalTools(runtimeDir, options);
   }
-  const casConfigDir = await configureAuth(workspace, options);
-  await buildAndCheck(workspace, options);
-  const agent = await chooseAgent(options);
-  linkAgents(workspace, agent);
-  const doctor = await collectDoctor(workspace, { ...options, casConfigDir });
+
+  await installWikis(runtimeDir, options);
+  writeLocalConfig(runtimeDir, { overwrite: true });
+  const casDir = await writeCasCredentials(runtimeDir, options);
+  await configureTokens(runtimeDir, casDir);
+  await buildAndCheck(runtimeDir, options);
+  linkAgents(runtimeDir, await chooseAgent(options));
+
+  const doctor = await collectDoctor(runtimeDir, { ...options, casConfigDir: casDir });
   for (const check of doctor.checks) console.log(`${check.ok ? "PASS" : "FAIL"} ${check.name}`);
   if (doctor.checks.some((check) => !check.ok)) throw new Error("doctor failed; install is incomplete");
-  const gitProtocol = prepared.gitProtocol || await repoProtocol(workspace) || "ssh";
-  const updates = await checkUpdates(workspace, { ...options, gitProtocol });
-  if (updates.hasUpdates) {
-    console.log(`Updates available. Next step: npx @lumi-ai-lab/harness-data update --dir "${workspace}"`);
-  }
-  writeState(workspace, {
-    mainCommit: await currentCommit(workspace),
-    wikisCommit: await submoduleCommit(workspace),
+
+  writeState(runtimeDir, {
+    installMode: tokenMode ? "github-token" : "local-path",
+    runtimeTag: bundle.tag,
+    localTools,
+    tools: manifest.installedTools || {},
     manifestSha256: manifestDigest(manifest),
-    lastCheckAt: new Date().toISOString(),
     packageVersion: packageVersion(),
-    gitProtocol,
-    repoUrl: prepared.repoUrl
+    lastCheckAt: new Date().toISOString()
   });
-  console.log(`Harness Data installed: ${workspace}`);
+  console.log(`Harness Data runtime installed: ${runtimeDir}`);
 }

package/src/commands/update.js

@@ -4,10 +4,11 @@ import { confirm } from "../lib/prompt.js";
 import { findWorkspaceDir, readUserState, writeState } from "../lib/paths.js";
 import { run } from "../lib/exec.js";
 import { installToolsFromManifest, manifestDigest, readManifest } from "../lib/manifest.js";
-import { behindCount, currentCommit, dirtyPaths, submoduleCommit, submodulePointerChanged, submoduleRemoteBehind } from "../lib/git.js";
 import { packageVersion } from "../lib/package.js";
+import { platformKey } from "../lib/platform.js";
+import { githubToken, latestRelease } from "../lib/github.js";
+import { buildAndCheck, installRuntimeBundle } from "./install.js";
 import { collectDoctor } from "./doctor.js";
-import { normalizeGitProtocol, repoProtocol, repoUrl, runGitWithProtocol, syncWikisSubmodule } from "../lib/git-auth.js";
 
 async function npmLatest() {
   try {
@@ -20,139 +21,169 @@ async function npmLatest() {
   }
 }
 
-async function remoteManifest(workspace) {
-  const upstream = (await run("git", ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"], { cwd: workspace, allowFailure: true })).stdout.trim();
-  if (!upstream) return null;
-  const result = await run("git", ["show", `${upstream}:bootstrap/cli-manifest.json`], { cwd: workspace, allowFailure: true });
-  if (result.code !== 0 || !result.stdout.trim()) return null;
-  try {
-    return JSON.parse(result.stdout);
-  } catch {
-    return null;
-  }
+function archiveSuffix(url) {
+  if (url.endsWith(".zip")) return "zip";
+  if (url.endsWith(".tar.gz")) return "tar.gz";
+  return "";
 }
 
-function versionChanged(current, latest) {
-  return latest && latest !== current;
+function toolAssetName(tool, tag, key) {
+  const current = tool.platforms?.[key]?.url || "";
+  const suffix = archiveSuffix(current) || (key.startsWith("windows-") ? "zip" : "tar.gz");
+  return `${tool.binary}-${tag}-${key}.${suffix}`;
 }
 
-export async function checkUpdates(workspace, gitOptions = {}) {
-  const manifestPath = path.join(workspace, "bootstrap", "cli-manifest.json");
-  const currentInstaller = packageVersion();
-  const latestInstaller = await npmLatest();
-  const mainBehind = await behindCount(workspace, gitOptions);
-  const wikisBehind = await submoduleRemoteBehind(workspace, "wikis", gitOptions);
-  const manifest = fs.existsSync(manifestPath) ? readManifest(manifestPath) : { tools: [] };
-  const digest = manifestDigest(manifest);
-  const remote = await remoteManifest(workspace);
-  const remoteDigest = remote ? manifestDigest(remote) : "";
-  const state = readUserState();
-  const updates = {
-    installer: { current: currentInstaller, latest: latestInstaller, update: versionChanged(currentInstaller, latestInstaller) },
-    mainRepo: { behind: mainBehind, update: mainBehind > 0 },
-    wikis: { remoteBehind: wikisBehind, pointerChanged: await submodulePointerChanged(workspace), update: wikisBehind > 0 },
-    cli: {
-      digest,
-      remoteDigest,
-      previousDigest: state.manifestSha256 || "",
-      update: Boolean((state.manifestSha256 && state.manifestSha256 !== digest) || (remoteDigest && remoteDigest !== digest)),
-      tools: manifest.tools || [],
-      remoteTools: remote?.tools || []
-    }
+function releaseAsset(release, name) {
+  return (release.assets || []).find((asset) => asset.name === name);
+}
+
+function oneToolManifest(manifest, tool, tag, asset, key) {
+  return {
+    ...manifest,
+    tools: [{
+      ...tool,
+      version: tag,
+      platforms: {
+        [key]: {
+          url: asset.browser_download_url || `https://github.com/${tool.repo}/releases/download/${tag}/${asset.name}`,
+          sha256: ""
+        }
+      }
+    }]
   };
-  updates.wikis.update = updates.wikis.update || updates.wikis.pointerChanged;
-  updates.hasUpdates = updates.installer.update || updates.mainRepo.update || updates.wikis.update || updates.cli.update;
-  return updates;
 }
 
-function printUpdateSummary(updates) {
-  console.log("Update summary:");
-  console.log(`installer: ${updates.installer.current}${updates.installer.latest ? ` -> ${updates.installer.latest}` : " (latest unavailable)"}`);
-  console.log(`main repo: ${updates.mainRepo.behind} commits behind`);
-  console.log(`wikis: ${updates.wikis.remoteBehind} commits behind remote${updates.wikis.pointerChanged ? ", submodule pointer changed" : ""}`);
-  console.log(`CLI manifest: ${updates.cli.update ? "changed" : "unchanged or first check"}`);
-  const remoteByName = new Map(updates.cli.remoteTools.map((tool) => [tool.name, tool]));
-  for (const tool of updates.cli.tools) {
-    const remote = remoteByName.get(tool.name);
-    const target = remote && remote.version !== tool.version ? ` -> ${remote.version}` : "";
-    console.log(`  ${tool.name} ${tool.version}${target}`);
+async function maybeUpdateTool(runtimeDir, manifest, tool, options, state) {
+  const key = platformKey();
+  const release = await latestRelease(tool.repo, options);
+  const tag = release.tag_name;
+  const assetName = toolAssetName(tool, tag, key);
+  const asset = releaseAsset(release, assetName);
+  if (!asset) {
+    console.warn(`warning: ${tool.name} latest release has no ${assetName}; skipped`);
+    return null;
+  }
+  const current = state.tools?.[tool.name] || {};
+  const tagChanged = current.version && current.version !== tag;
+  const firstInstall = !current.version;
+  if (!tagChanged && !firstInstall) {
+    console.log(`${tool.name}: up to date (${tag})`);
+    return null;
   }
+  console.log(`${tool.name} has update:`);
+  console.log(`  current: ${current.version || "unknown"}`);
+  console.log(`  remote:  ${tag}`);
+  if (!(await confirm(`Update ${tool.name}?`, { defaultNo: true }))) {
+    console.log(`Skipped ${tool.name}`);
+    return null;
+  }
+  const updatedManifest = oneToolManifest(manifest, tool, tag, asset, key);
+  const installed = await installToolsFromManifest(runtimeDir, path.join(runtimeDir, ".bootstrap-cache", `${tool.name}-manifest.json`), {
+    ...options,
+    manifestOverride: updatedManifest
+  });
+  return installed.installedTools?.[tool.name] || { version: tag, asset: assetName };
 }
 
-async function updateProtocol(workspace, options) {
-  const requested = normalizeGitProtocol(options.gitProtocol);
-  if (requested !== "auto") return requested;
+async function updateWikis(runtimeDir, options, state) {
+  const wikisDir = path.join(runtimeDir, "wikis");
+  if (!githubToken(options) && state.installMode !== "github-token") {
+    console.log("wikis: local path mode; check manually");
+    return null;
+  }
+  if (!fs.existsSync(path.join(wikisDir, ".git"))) {
+    console.log("wikis: not a git checkout; skipped");
+    return null;
+  }
+  await run("git", ["-C", wikisDir, "fetch", "origin"], { stdio: "inherit" });
+  const local = (await run("git", ["-C", wikisDir, "rev-parse", "HEAD"])).stdout.trim();
+  const remote = (await run("git", ["-C", wikisDir, "rev-parse", "origin/HEAD"], { allowFailure: true })).stdout.trim();
+  if (!remote || local === remote) {
+    console.log(`wikis: up to date (${local.slice(0, 12)})`);
+    return null;
+  }
+  console.log("wikis has update:");
+  console.log(`  current: ${local}`);
+  console.log(`  remote:  ${remote}`);
+  if (!(await confirm("Update wikis?", { defaultNo: true }))) {
+    console.log("Skipped wikis");
+    return null;
+  }
+  await run("git", ["-C", wikisDir, "pull", "--ff-only"], { stdio: "inherit" });
+  return { commit: (await run("git", ["-C", wikisDir, "rev-parse", "HEAD"])).stdout.trim() };
+}
+
+export async function checkUpdates(workspace, options = {}) {
   const state = readUserState();
-  return state.gitProtocol || await repoProtocol(workspace) || "ssh";
+  const latestInstaller = await npmLatest();
+  return {
+    installer: { current: packageVersion(), latest: latestInstaller, update: Boolean(latestInstaller && latestInstaller !== packageVersion()) },
+    state,
+    hasUpdates: Boolean(latestInstaller && latestInstaller !== packageVersion())
+  };
 }
 
 export async function updateCommand(options = {}) {
-  const workspace = findWorkspaceDir(options.dir);
-  if (!fs.existsSync(workspace)) throw new Error(`workspace does not exist: ${workspace}`);
-  const mainDirty = await dirtyPaths(workspace);
-  const wikisDirty = fs.existsSync(path.join(workspace, "wikis")) ? await dirtyPaths(path.join(workspace, "wikis")) : [];
-  if (mainDirty.length || wikisDirty.length) {
-    console.error("Dirty worktree detected; update will not overwrite local changes.");
-    for (const line of mainDirty) console.error(`main: ${line}`);
-    for (const line of wikisDirty) console.error(`wikis: ${line}`);
-    process.exitCode = 1;
-    return;
-  }
-  const gitProtocol = await updateProtocol(workspace, options);
-  await syncWikisSubmodule(workspace, gitProtocol);
-  const originUrl = await repoUrl(workspace);
-  const updates = await checkUpdates(workspace, { ...options, gitProtocol });
-  printUpdateSummary(updates);
-  if (options.check) {
-    writeState(workspace, {
-      mainCommit: await currentCommit(workspace),
-      wikisCommit: await submoduleCommit(workspace),
-      manifestSha256: updates.cli.digest,
-      packageVersion: packageVersion(),
-      lastCheckAt: new Date().toISOString(),
-      gitProtocol,
-      repoUrl: originUrl
-    });
-    return updates;
-  }
-  if (!updates.hasUpdates) {
-    console.log("No repository or wikis updates detected.");
-    writeState(workspace, {
-      mainCommit: await currentCommit(workspace),
-      wikisCommit: await submoduleCommit(workspace),
-      manifestSha256: updates.cli.digest,
-      packageVersion: packageVersion(),
-      lastCheckAt: new Date().toISOString(),
-      gitProtocol,
-      repoUrl: originUrl
-    });
-    return updates;
-  }
-  if (!(await confirm(`Apply updates to ${workspace}?`, { yes: options.yes, defaultNo: true }))) throw new Error("update cancelled");
-  if (updates.mainRepo.update) {
-    await runGitWithProtocol(gitProtocol, ["pull", "--ff-only"], { ...options, cwd: workspace, stdio: "inherit" });
+  const runtimeDir = findWorkspaceDir(options.dir);
+  if (!fs.existsSync(runtimeDir)) throw new Error(`runtime directory does not exist: ${runtimeDir}`);
+  const state = readUserState();
+  const manifestPath = path.join(runtimeDir, "bootstrap", "cli-manifest.json");
+  const manifest = readManifest(manifestPath);
+  let changed = false;
+  let runtimeTag = state.runtimeTag || "";
+  const nextTools = { ...(state.tools || {}) };
+
+  const latestInstaller = await npmLatest();
+  if (latestInstaller && latestInstaller !== packageVersion()) {
+    console.log(`installer has update: ${packageVersion()} -> ${latestInstaller}`);
+    console.log("Run the same npx command again to use the latest npm installer.");
+  } else {
+    console.log(`installer: up to date (${packageVersion()})`);
   }
-  if (updates.wikis.update || updates.mainRepo.update) {
-    if (!(await confirm("Update wikis submodule? This can change Agent behavior.", { yes: options.yes, defaultNo: true }))) {
-      console.warn("warning: wikis update skipped");
+
+  const runtimeRelease = await latestRelease("lumi-ai-lab/harness-data", options);
+  if (state.runtimeTag && state.runtimeTag !== runtimeRelease.tag_name) {
+    console.log(`runtime bundle has update: ${state.runtimeTag} -> ${runtimeRelease.tag_name}`);
+    if (await confirm("Update runtime bundle?", { defaultNo: true })) {
+      const bundle = await installRuntimeBundle(runtimeDir, { ...options, force: true });
+      runtimeTag = bundle.tag || runtimeRelease.tag_name;
+      changed = true;
     } else {
-      await syncWikisSubmodule(workspace, gitProtocol);
-      await runGitWithProtocol(gitProtocol, ["submodule", "update", "--init", "--recursive", "--remote", "wikis"], { ...options, cwd: workspace, stdio: "inherit" });
+      console.log("Skipped runtime bundle");
     }
+  } else {
+    console.log(`runtime bundle: up to date (${state.runtimeTag || runtimeRelease.tag_name})`);
+  }
+
+  for (const tool of manifest.tools || []) {
+    if (state.installMode === "local-path" && tool.name !== "data-harness-cli") {
+      console.log(`${tool.name}: local path mode; check manually`);
+      continue;
+    }
+    const installed = await maybeUpdateTool(runtimeDir, manifest, tool, options, state);
+    if (installed) {
+      nextTools[tool.name] = installed;
+      changed = true;
+    }
+  }
+
+  const wikis = await updateWikis(runtimeDir, options, state);
+  if (wikis) changed = true;
+
+  if (changed) {
+    await buildAndCheck(runtimeDir, options);
+    const doctor = await collectDoctor(runtimeDir, options);
+    for (const check of doctor.checks) console.log(`${check.ok ? "PASS" : "FAIL"} ${check.name}${check.detail ? ` (${check.detail})` : ""}`);
+    writeState(runtimeDir, {
+      ...state,
+      runtimeTag,
+      tools: nextTools,
+      manifestSha256: manifestDigest(manifest),
+      lastCheckAt: new Date().toISOString()
+    });
+    console.log("Harness Data runtime updated.");
+  } else {
+    writeState(runtimeDir, { ...state, lastCheckAt: new Date().toISOString() });
+    console.log("No selected updates were applied.");
   }
-  await installToolsFromManifest(workspace, path.join(workspace, "bootstrap", "cli-manifest.json"), options);
-  await run(path.join(workspace, "bin", "data-harness-cli"), ["wikis", "build-index"], { cwd: workspace, stdio: "inherit" });
-  const doctor = await collectDoctor(workspace, options);
-  for (const check of doctor.checks) console.log(`${check.ok ? "PASS" : "FAIL"} ${check.name}`);
-  if (doctor.checks.some((check) => !check.ok)) throw new Error("doctor failed after update");
-  writeState(workspace, {
-    mainCommit: await currentCommit(workspace),
-    wikisCommit: await submoduleCommit(workspace),
-    manifestSha256: updates.cli.digest,
-    packageVersion: packageVersion(),
-    lastCheckAt: new Date().toISOString(),
-    gitProtocol,
-    repoUrl: originUrl
-  });
-  console.log(`Harness Data updated: ${workspace}`);
 }

package/src/commands/version.js

@@ -1,18 +1,18 @@
 import fs from "node:fs";
 import path from "node:path";
-import { findWorkspaceDir } from "../lib/paths.js";
-import { currentCommit, submoduleCommit } from "../lib/git.js";
+import { findWorkspaceDir, readUserState } from "../lib/paths.js";
 import { readManifest } from "../lib/manifest.js";
 import { packageVersion } from "../lib/package.js";
 
 export async function versionCommand(options = {}) {
   const workspace = findWorkspaceDir(options.dir);
   const manifestPath = path.join(workspace, "bootstrap", "cli-manifest.json");
+  const state = readUserState();
   const result = {
     installer: packageVersion(),
-    workspace,
-    mainCommit: fs.existsSync(workspace) ? await currentCommit(workspace) : "",
-    wikisCommit: fs.existsSync(workspace) ? await submoduleCommit(workspace) : "",
+    runtime: workspace,
+    runtimeTag: state.runtimeTag || "",
+    installMode: state.installMode || "",
     tools: []
   };
   if (fs.existsSync(manifestPath)) {
@@ -26,9 +26,9 @@ export async function versionCommand(options = {}) {
     console.log(JSON.stringify(result, null, 2));
   } else {
     console.log(`installer ${result.installer}`);
-    console.log(`workspace ${result.workspace}`);
-    if (result.mainCommit) console.log(`main ${result.mainCommit}`);
-    if (result.wikisCommit) console.log(`wikis ${result.wikisCommit}`);
+    console.log(`runtime ${result.runtime}`);
+    if (result.runtimeTag) console.log(`runtime bundle ${result.runtimeTag}`);
+    if (result.installMode) console.log(`install mode ${result.installMode}`);
     for (const tool of result.tools) console.log(`${tool.name} ${tool.version}`);
   }
   return result;

package/src/lib/config.js

@@ -1,5 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
+import { binaryName } from "./platform.js";
 
 export function writeLocalConfig(workspace, options = {}) {
   const configDir = path.join(workspace, "config");
@@ -9,7 +10,7 @@ export function writeLocalConfig(workspace, options = {}) {
   if ((fs.existsSync(harness) || fs.existsSync(env)) && !options.overwrite) {
     throw new Error("local config already exists; rerun interactively and confirm overwrite or remove the files");
   }
-  const bin = (name) => path.join(workspace, "bin", name).replaceAll("\\", "/");
+  const bin = (name) => path.join(workspace, "bin", binaryName(name)).replaceAll("\\", "/");
   fs.writeFileSync(harness, `paths:\n  spec: wikis/spec\n  playbooks: wikis/playbooks\n  templates: wikis/templates\n\ncli:\n  qdm_cmr_cli: ${bin("qdm-cmr-cli")}\n  qdm_indicators_cli: ${bin("qdm-indicators-cli")}\n  qdm_cas_cli: ${bin("cas-cli")}\n`);
   fs.writeFileSync(env, `export QDM_CMR_CLI="${bin("qdm-cmr-cli")}"\nexport QDM_INDICATORS_CLI="${bin("qdm-indicators-cli")}"\nexport QDM_CAS_CLI="${bin("cas-cli")}"\n`);
 }
@@ -29,9 +30,9 @@ export function validateCasConfigDir(dir) {
 
 export function linkAgents(workspace, agent) {
   const pairs = [];
-  if (agent === "claude" || agent === "both" || agent === "all") pairs.push([".agents/claude", ".claude"]);
-  if (agent === "codex" || agent === "both" || agent === "all") pairs.push([".agents/codex", ".codex"]);
-  if (agent === "pi" || agent === "all") pairs.push([".agents/pi", ".pi"]);
+  if (agent === "claude" || agent === "all") pairs.push(["agents/claude", ".claude"]);
+  if (agent === "codex" || agent === "all") pairs.push(["agents/codex", ".codex"]);
+  if (agent === "pi" || agent === "all") pairs.push(["agents/pi", ".pi"]);
   for (const [sourceRel, targetRel] of pairs) {
     const source = path.join(workspace, sourceRel);
     const target = path.join(workspace, targetRel);

package/src/lib/git-auth.js

@@ -40,21 +40,17 @@ function httpsFailureMessage() {
   return [
     "HTTPS access to the private GitHub repositories failed.",
     "Fix by configuring a GitHub SSH key, running gh auth login, enabling Git Credential Manager,",
-    "or passing --github-token-env GITHUB_TOKEN with a token stored in that environment variable."
+    "or passing --github-token TOKEN."
   ].join(" ");
 }
 
 function tokenEnvName(options = {}) {
-  const name = options.githubTokenEnv;
-  if (!name) return "";
-  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) throw new Error("--github-token-env must be a valid environment variable name");
-  if (!process.env[name]) throw new Error(`environment variable ${name} is empty or unset`);
-  return name;
+  return options.githubToken || process.env.GITHUB_TOKEN || "";
 }
 
 async function withHttpsAuthEnv(options, callback) {
-  const name = tokenEnvName(options);
-  if (!name) return callback({ GIT_TERMINAL_PROMPT: "0" });
+  const token = tokenEnvName(options);
+  if (!token) return callback({ GIT_TERMINAL_PROMPT: "0" });
 
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), "harness-data-git-"));
   const askpass = path.join(dir, "askpass.sh");
@@ -62,7 +58,7 @@ async function withHttpsAuthEnv(options, callback) {
     "#!/bin/sh",
     "case \"$1\" in",
     "*Username*) printf '%s\\n' x-access-token ;;",
-    "*Password*) printenv \"$GITHUB_TOKEN_ENV_NAME\" ;;",
+    "*Password*) printf '%s\\n' \"$GITHUB_TOKEN_VALUE\" ;;",
     "*) printf '\\n' ;;",
     "esac",
     ""
@@ -71,7 +67,7 @@ async function withHttpsAuthEnv(options, callback) {
   try {
     return await callback({
       GIT_ASKPASS: askpass,
-      GITHUB_TOKEN_ENV_NAME: name,
+      GITHUB_TOKEN_VALUE: token,
       GIT_TERMINAL_PROMPT: "0"
     });
   } finally {

package/src/lib/github.js

@@ -0,0 +1,52 @@
+import fs from "node:fs";
+import path from "node:path";
+import { commandExists, run } from "./exec.js";
+import { download } from "./manifest.js";
+
+const userAgent = "harness-data-installer";
+
+export function githubToken(options = {}) {
+  return options.githubToken || process.env.GITHUB_TOKEN || "";
+}
+
+export async function hasGithubAuth(options = {}) {
+  if (githubToken(options)) return true;
+  if (!(await commandExists("gh"))) return false;
+  const result = await run("gh", ["auth", "status"], { allowFailure: true });
+  return result.code === 0;
+}
+
+export function githubHeaders(options = {}) {
+  const headers = { "User-Agent": userAgent };
+  const token = githubToken(options);
+  if (token) headers.Authorization = `Bearer ${token}`;
+  return headers;
+}
+
+export async function githubJson(url, options = {}) {
+  if (!githubToken(options) && await commandExists("gh")) {
+    const apiPath = new URL(url).pathname.replace(/^\/repos\//, "repos/");
+    const result = await run("gh", ["api", apiPath], { allowFailure: true });
+    if (result.code === 0 && result.stdout.trim()) return JSON.parse(result.stdout);
+  }
+  const tmp = path.join(fs.mkdtempSync(path.join(process.cwd(), ".github-api-")), "response.json");
+  try {
+    await download(url, tmp, githubHeaders(options));
+    return JSON.parse(fs.readFileSync(tmp, "utf8"));
+  } finally {
+    fs.rmSync(path.dirname(tmp), { recursive: true, force: true });
+  }
+}
+
+export async function latestRelease(repo, options = {}) {
+  return githubJson(`https://api.github.com/repos/${repo}/releases/latest`, options);
+}
+
+export function findReleaseAsset(release, name) {
+  return (release.assets || []).find((asset) => asset.name === name);
+}
+
+export async function downloadReleaseAsset(asset, file, options = {}) {
+  const headers = { ...githubHeaders(options), Accept: "application/octet-stream" };
+  await download(asset.url, file, headers);
+}

package/src/lib/manifest.js

@@ -13,7 +13,7 @@ export function manifestDigest(manifest) {
   return crypto.createHash("sha256").update(JSON.stringify(manifest)).digest("hex");
 }
 
-function download(url, file, headers = {}) {
+export function download(url, file, headers = {}) {
   return new Promise((resolve, reject) => {
     const request = https.get(url, { headers }, (response) => {
       if ([301, 302, 307, 308].includes(response.statusCode) && response.headers.location) {
@@ -77,10 +77,7 @@ async function downloadPrivateWithGh(asset, file) {
 }
 
 function githubToken(options = {}) {
-  const name = options.githubTokenEnv;
-  if (!name) return "";
-  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) throw new Error("--github-token-env must be a valid environment variable name");
-  return process.env[name] || "";
+  return options.githubToken || process.env.GITHUB_TOKEN || "";
 }
 
 async function githubAssetApiUrl(asset, token) {
@@ -121,7 +118,7 @@ async function downloadAsset(tool, asset, file, options = {}) {
   console.log(`Downloading private ${tool.name} asset from ${tool.repo}`);
   if (await downloadPrivateWithGh(asset, file)) return;
   if (await downloadPrivateWithToken(asset, file, options)) return;
-  throw new Error(`private GitHub Release asset requires gh auth login or --github-token-env GITHUB_TOKEN: ${assetName(asset)}`);
+  throw new Error(`private GitHub Release asset requires gh auth login, GITHUB_TOKEN, or --github-token: ${assetName(asset)}`);
 }
 
 async function expectedSha256(tool, asset, options = {}) {
@@ -140,21 +137,25 @@ function fileSha256(file) {
 }
 
 export async function installToolsFromManifest(workspace, manifestPath, options = {}) {
-  const manifest = readManifest(manifestPath);
+  const manifest = options.manifestOverride || readManifest(manifestPath);
+  const only = options.tools ? new Set(options.tools) : null;
   const key = platformKey();
   const cacheDir = path.join(workspace, ".bootstrap-cache");
   const binDir = path.join(workspace, "bin");
   fs.mkdirSync(cacheDir, { recursive: true });
   fs.mkdirSync(binDir, { recursive: true });
+  const installedTools = {};
 
   for (const tool of manifest.tools || []) {
+    if (only && !only.has(tool.name)) continue;
     const asset = tool.platforms?.[key];
     if (!asset?.url) throw new Error(`manifest missing ${tool.name} asset for ${key}`);
     const archive = path.join(cacheDir, assetName(asset));
     console.log(`Downloading ${tool.name} ${tool.version} (${key})`);
     await downloadAsset(tool, asset, archive, options);
     const sha = await expectedSha256(tool, asset, options);
-    if (sha && fileSha256(archive) !== sha) throw new Error(`${tool.name} sha256 mismatch`);
+    const actualSha = fileSha256(archive);
+    if (sha && actualSha !== sha) throw new Error(`${tool.name} sha256 mismatch`);
     if (!sha) console.warn(`warning: ${tool.name} has no sha256; continuing without checksum`);
     if (archive.endsWith(".zip")) {
       await run("unzip", ["-o", archive, "-d", binDir], { stdio: "inherit" });
@@ -164,6 +165,12 @@ export async function installToolsFromManifest(workspace, manifestPath, options
     const binary = path.join(binDir, tool.binary);
     if (!fs.existsSync(binary)) throw new Error(`${tool.binary} was not extracted to bin/`);
     fs.chmodSync(binary, 0o755);
+    installedTools[tool.name] = {
+      version: tool.version || "",
+      asset: assetName(asset),
+      sha256: sha || actualSha
+    };
   }
+  Object.defineProperty(manifest, "installedTools", { value: installedTools, enumerable: false });
   return manifest;
 }

package/src/lib/paths.js

@@ -2,7 +2,6 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
-const appDir = path.join("lumi-ai-lab", "harness-data");
 const stateDir = path.join("lumi-ai-lab", "harness-data-installer");
 
 export function expandHome(value) {
@@ -13,9 +12,7 @@ export function expandHome(value) {
 }
 
 export function defaultWorkspaceDir() {
-  if (process.platform === "darwin") return path.join(os.homedir(), "Library", "Application Support", appDir);
-  if (process.platform === "win32") return path.join(process.env.LOCALAPPDATA || path.join(os.homedir(), "AppData", "Local"), appDir);
-  return path.join(process.env.XDG_DATA_HOME || path.join(os.homedir(), ".local", "share"), appDir);
+  return process.cwd();
 }
 
 export function userStatePath() {
@@ -62,6 +59,6 @@ export function findWorkspaceDir(explicitDir) {
 
 export function looksLikeWorkspace(dir) {
   return fs.existsSync(path.join(dir, "bootstrap", "cli-manifest.json")) &&
-    fs.existsSync(path.join(dir, ".agents")) &&
+    fs.existsSync(path.join(dir, "agents")) &&
     fs.existsSync(path.join(dir, "wikis"));
 }

package/src/lib/platform.js

@@ -2,8 +2,12 @@ export function platformKey() {
   const os = process.platform === "darwin" ? "darwin" : process.platform === "linux" ? "linux" : process.platform === "win32" ? "windows" : process.platform;
   const arch = process.arch === "x64" ? "amd64" : process.arch;
   const key = `${os}-${arch}`;
-  if (!["darwin-arm64", "darwin-amd64", "linux-arm64", "linux-amd64"].includes(key)) {
+  if (!["darwin-arm64", "darwin-amd64", "linux-amd64", "windows-amd64"].includes(key)) {
     throw new Error(`unsupported platform: ${key}`);
   }
   return key;
 }
+
+export function binaryName(name) {
+  return process.platform === "win32" ? `${name}.exe` : name;
+}

package/src/lib/prompt.js

@@ -1,7 +1,8 @@
 import readline from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
+import { Writable } from "node:stream";
 
-const agentChoices = ["claude", "codex", "pi", "both", "all"];
+const agentChoices = ["claude", "codex", "pi", "all"];
 
 export async function confirm(message, options = {}) {
   if (options.yes) return true;
@@ -19,17 +20,47 @@ export async function confirm(message, options = {}) {
 export async function chooseAgent(options = {}) {
   if (options.agent) {
     const value = String(options.agent).trim().toLowerCase();
-    if (!agentChoices.includes(value)) throw new Error("agent must be claude, codex, pi, both, or all");
+    if (!agentChoices.includes(value)) throw new Error("agent must be claude, codex, pi, or all");
     return value;
   }
-  if (options.yes) throw new Error("non-interactive install requires --agent claude|codex|pi|both|all");
+  if (options.yes) return "all";
   const rl = readline.createInterface({ input, output });
   try {
-    const answer = (await rl.question("Choose Agent: claude, codex, pi, both, all [codex] ")).trim().toLowerCase();
-    const value = answer || "codex";
-    if (!agentChoices.includes(value)) throw new Error("agent must be claude, codex, pi, both, or all");
+    const answer = (await rl.question("Choose Agent: claude, codex, pi, all [all] ")).trim().toLowerCase();
+    const value = answer || "all";
+    if (!agentChoices.includes(value)) throw new Error("agent must be claude, codex, pi, or all");
     return value;
   } finally {
     rl.close();
   }
 }
+
+export async function ask(message, options = {}) {
+  if (options.value) return String(options.value);
+  if (options.yes) throw new Error(`${message} is required`);
+  const rl = readline.createInterface({ input, output });
+  try {
+    return (await rl.question(`${message} `)).trim();
+  } finally {
+    rl.close();
+  }
+}
+
+export async function askSecret(message, options = {}) {
+  if (options.value) return String(options.value);
+  if (options.yes) throw new Error(`${message} is required`);
+  const muted = new Writable({
+    write(_chunk, _encoding, callback) {
+      callback();
+    }
+  });
+  output.write(`${message} `);
+  const rl = readline.createInterface({ input, output: muted, terminal: true });
+  try {
+    const answer = (await rl.question("")).trim();
+    output.write("\n");
+    return answer;
+  } finally {
+    rl.close();
+  }
+}