@model-go/cli 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 modelgo
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,42 @@
+# modelgo-cli
+
+The official CLI for modelgo. Pairs with AI agent skills (Claude Code, Codex, Gemini CLI, etc.) so AI agents can operate modelgo on your behalf.
+
+> **v0 framework stage.** Business APIs are not wired up yet; the only command is `hello` (a demo to verify the install pipeline).
+
+## Install
+
+```bash
+npx @model-go/cli@latest install
+```
+
+This runs an interactive wizard that:
+
+1. Installs `@model-go/cli` globally via npm (which downloads the Go binary from GitHub Releases).
+2. Distributes `modelgo-*` skills to every AI agent installed on your machine (Claude Code, Trae, Trae CN, and other agents in the [skills](https://www.npmjs.com/package/skills) ecosystem).
+
+After install, restart your AI agent (open a new chat / session) and try:
+
+> "Have modelgo-cli say hello to me."
+
+Your AI should find the `modelgo-hello` skill and run `modelgo-cli hello`.
+
+## Direct commands
+
+```bash
+modelgo-cli --version
+modelgo-cli hello [--name NAME]
+modelgo-cli --help
+```
+
+## Upgrade
+
+Re-run the installer; it detects an out-of-date install and upgrades in place:
+
+```bash
+npx @model-go/cli@latest install
+```
+
+## License
+
+MIT — see [LICENSE](./LICENSE).

package/checksums.txt

@@ -0,0 +1,6 @@
+769fac4456815aeabc8517827df7d174b650e2d6d127eb7805aec3477179cd23  modelgo-cli-0.1.1-darwin-amd64.tar.gz
+5720ad47e70b7ad5a99688f47c7c345ee8a3e6306fbea7510276398011815801  modelgo-cli-0.1.1-darwin-arm64.tar.gz
+f4f46f11be9a485e8e12e26bb1c8f9b67c02d67466b46c96be32a4557c951ca4  modelgo-cli-0.1.1-linux-amd64.tar.gz
+7482afffe11cf8bf3c8798d77166ce5a6c0b79acdd53c030712b9b4fc69a0521  modelgo-cli-0.1.1-linux-arm64.tar.gz
+c86b6da335e95354b0cfe2b8bc11cd4b2fbeff5a32231c9fdef0a55440659bf1  modelgo-cli-0.1.1-windows-amd64.zip
+1f101449e834ff876ccc418d246e8b06b2a21031904d8c638066e0d6e1c52eb2  modelgo-cli-0.1.1-windows-arm64.zip

package/package.json

@@ -0,0 +1,51 @@
+{
+  "name": "@model-go/cli",
+  "version": "0.1.1",
+  "description": "The official CLI for modelgo. Pairs with AI agent skills so AI agents can operate modelgo on your behalf.",
+  "bin": {
+    "modelgo-cli": "scripts/run.js"
+  },
+  "scripts": {
+    "postinstall": "node scripts/install.js",
+    "test": "node --test scripts/__tests__/*.test.mjs",
+    "lint:skills": "node scripts/lint-skills.mjs"
+  },
+  "files": [
+    "scripts/install.js",
+    "scripts/install-wizard.js",
+    "scripts/run.js",
+    "checksums.txt",
+    "LICENSE",
+    "README.md"
+  ],
+  "os": [
+    "darwin",
+    "linux",
+    "win32"
+  ],
+  "cpu": [
+    "x64",
+    "arm64"
+  ],
+  "engines": {
+    "node": ">=20.12"
+  },
+  "dependencies": {
+    "@clack/prompts": "^1.2.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/modelgo/modelgo-cli.git"
+  },
+  "homepage": "https://github.com/modelgo/modelgo-cli#readme",
+  "bugs": {
+    "url": "https://github.com/modelgo/modelgo-cli/issues"
+  },
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "devDependencies": {
+    "yaml": "^2.9.0"
+  }
+}

package/scripts/install-wizard.js

@@ -0,0 +1,231 @@
+#!/usr/bin/env node
+// Copyright (c) 2026 modelgo
+// SPDX-License-Identifier: MIT
+
+const { execFileSync, execFile } = require("child_process");
+const p = require("@clack/prompts");
+const { semverLessThan } = require("./install.js");
+
+const PKG = "@model-go/cli";
+const SKILLS_REPO = "modelgo/modelgo-cli";
+const isWindows = process.platform === "win32";
+
+// ---------------------------------------------------------------------------
+// i18n
+// ---------------------------------------------------------------------------
+
+const messages = {
+  zh: {
+    setup:         "正在设置 modelgo CLI...",
+    step1:         "正在安装 %s...",
+    step1Upgrade:  "正在升级 %s (v%s → v%s)...",
+    step1Skip:     "已安装 (v%s)，跳过",
+    step1Done:     "已全局安装",
+    step1Upgraded: "已升级到 v%s",
+    step1Fail:     "全局安装失败。运行以下命令重试: npm install -g %s",
+    step2Spinner:  "正在安装 Skills...",
+    step2Done:     "Skills 已安装",
+    step2Fail:     "Skills 安装失败。运行以下命令重试: npx skills add %s -y -g",
+    done:          "安装完成！\n试试跟你的 AI 工具（Claude Code、Codex 等）说：\"用 modelgo-cli 跟我打个招呼\"",
+    cancelled:     "安装已取消",
+    nonTtyHint:    "非交互模式，已完成 npm 全局安装 + skills 安装。",
+  },
+  en: {
+    setup:         "Setting up modelgo CLI...",
+    step1:         "Installing %s globally...",
+    step1Upgrade:  "Upgrading %s (v%s → v%s)...",
+    step1Skip:     "Already installed (v%s). Skipped",
+    step1Done:     "Installed globally",
+    step1Upgraded: "Upgraded to v%s",
+    step1Fail:     "Failed to install globally. Run manually: npm install -g %s",
+    step2Spinner:  "Installing skills...",
+    step2Done:     "Skills installed",
+    step2Fail:     "Failed to install skills. Run manually: npx skills add %s -y -g",
+    done:          "You are all set!\nTry asking your AI tool (Claude Code, Codex, etc.): \"Have modelgo-cli say hello to me\"",
+    cancelled:     "Installation cancelled",
+    nonTtyHint:    "Non-interactive mode. Completed global install + skills install.",
+  },
+};
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function execCmd(cmd, args, opts) {
+  if (isWindows) {
+    return execFileSync("cmd.exe", ["/c", cmd, ...args], opts);
+  }
+  return execFileSync(cmd, args, opts);
+}
+
+function runSilent(cmd, args, opts = {}) {
+  return execCmd(cmd, args, { stdio: ["ignore", "pipe", "pipe"], ...opts });
+}
+
+function runSilentAsync(cmd, args, opts = {}) {
+  const actualCmd = isWindows ? "cmd.exe" : cmd;
+  const actualArgs = isWindows ? ["/c", cmd, ...args] : args;
+  return new Promise((resolve, reject) => {
+    execFile(actualCmd, actualArgs, { stdio: ["ignore", "pipe", "pipe"], ...opts }, (err, stdout) => {
+      if (err) reject(err);
+      else resolve(stdout);
+    });
+  });
+}
+
+function fmt(template, ...values) {
+  let i = 0;
+  return template.replace(/%s/g, () => values[i++] ?? "");
+}
+
+function getLatestVersion() {
+  try {
+    const out = runSilent("npm", ["view", PKG, "version"], { timeout: 15000 });
+    const ver = out.toString().trim();
+    return /^\d+\.\d+\.\d+/.test(ver) ? ver : null;
+  } catch (_) {
+    return null;
+  }
+}
+
+function getGloballyInstalledVersion() {
+  try {
+    const out = runSilent("npm", ["list", "-g", PKG], { timeout: 15000 });
+    const match = out.toString().match(/@(\d+\.\d+\.\d+[^\s]*)/);
+    return match ? match[1] : null;
+  } catch (_) {
+    return null;
+  }
+}
+
+function parseLangArg() {
+  const args = process.argv.slice(2);
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "--lang" && args[i + 1]) {
+      const val = args[i + 1].toLowerCase();
+      if (val === "zh" || val === "en") return val;
+    }
+    if (args[i].startsWith("--lang=")) {
+      const val = args[i].split("=")[1].toLowerCase();
+      if (val === "zh" || val === "en") return val;
+    }
+  }
+  return null;
+}
+
+function handleCancel(value, msg) {
+  if (p.isCancel(value)) {
+    p.cancel(msg.cancelled);
+    process.exit(0);
+  }
+  return value;
+}
+
+// ---------------------------------------------------------------------------
+// Steps
+// ---------------------------------------------------------------------------
+
+async function stepSelectLang() {
+  const fromArg = parseLangArg();
+  if (fromArg) return fromArg;
+  const lang = await p.select({
+    message: "请选择语言 / Select language",
+    options: [
+      { value: "zh", label: "中文" },
+      { value: "en", label: "English" },
+    ],
+  });
+  return handleCancel(lang, messages.zh);
+}
+
+function reportStart(isInteractive, message) {
+  if (!isInteractive) {
+    console.log(message);
+    return null;
+  }
+  const s = p.spinner();
+  s.start(message);
+  return s;
+}
+
+function reportStop(isInteractive, spinner, message) {
+  if (isInteractive && spinner) spinner.stop(message);
+  else console.log(message);
+}
+
+function reportFail(isInteractive, spinner, message, err) {
+  if (isInteractive && spinner) spinner.stop(message);
+  else console.error(message);
+  const stderr = err && err.stderr ? err.stderr.toString().trim() : "";
+  if (stderr) console.error("\n" + stderr);
+}
+
+async function stepInstallGlobally(msg, isInteractive) {
+  const installedVer = getGloballyInstalledVersion();
+  const latestVer = getLatestVersion();
+  const needsUpgrade = installedVer && latestVer && semverLessThan(installedVer, latestVer);
+
+  if (installedVer && !needsUpgrade) {
+    const skipMsg = fmt(msg.step1Skip, installedVer);
+    if (isInteractive) p.log.info(skipMsg);
+    else console.log(skipMsg);
+    return;
+  }
+
+  const startMsg = needsUpgrade
+    ? fmt(msg.step1Upgrade, PKG, installedVer, latestVer)
+    : fmt(msg.step1, PKG);
+  const doneMsg = needsUpgrade ? fmt(msg.step1Upgraded, latestVer) : msg.step1Done;
+
+  const s = reportStart(isInteractive, startMsg);
+  try {
+    await runSilentAsync("npm", ["install", "-g", PKG], { timeout: 120000 });
+    reportStop(isInteractive, s, doneMsg);
+  } catch (err) {
+    reportFail(isInteractive, s, fmt(msg.step1Fail, PKG), err);
+    process.exit(1);
+  }
+}
+
+async function stepInstallSkills(msg, isInteractive) {
+  // Always re-run `skills add` so new skills added in newer modelgo-cli
+  // versions actually land on the user's machine. The skills CLI is
+  // idempotent for existing skills (re-copies content) and additive for
+  // new ones; the slight extra GitHub fetch is worth keeping skill
+  // distribution in sync with the latest published bundle.
+  const s = reportStart(isInteractive, msg.step2Spinner);
+  try {
+    await runSilentAsync("npx", ["-y", "skills", "add", SKILLS_REPO, "-y", "-g"], { timeout: 120000 });
+    reportStop(isInteractive, s, msg.step2Done);
+  } catch (err) {
+    reportFail(isInteractive, s, fmt(msg.step2Fail, SKILLS_REPO), err);
+    process.exit(1);
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Main
+// ---------------------------------------------------------------------------
+
+async function main() {
+  const isInteractive = !!process.stdin.isTTY;
+  const lang = isInteractive ? await stepSelectLang() : (parseLangArg() || "en");
+  const msg = messages[lang];
+
+  if (isInteractive) {
+    p.intro(msg.setup);
+    await stepInstallGlobally(msg, isInteractive);
+    await stepInstallSkills(msg, isInteractive);
+    p.outro(msg.done);
+  } else {
+    console.log(msg.setup);
+    await stepInstallGlobally(msg, isInteractive);
+    await stepInstallSkills(msg, isInteractive);
+    console.log(msg.nonTtyHint);
+  }
+}
+
+main().catch((err) => {
+  p.cancel("Unexpected error: " + (err.message || err));
+  process.exit(1);
+});

package/scripts/install.js

@@ -0,0 +1,308 @@
+// Copyright (c) 2026 modelgo
+// SPDX-License-Identifier: MIT
+
+const fs = require("fs");
+const path = require("path");
+const { execFileSync } = require("child_process");
+const os = require("os");
+const crypto = require("crypto");
+
+const VERSION = require("../package.json").version;
+const REPO = "modelgo/modelgo-cli";
+const NAME = "modelgo-cli";
+const DEFAULT_MIRROR_HOST = "https://registry.npmmirror.com";
+
+// Allowlist gates the initial request host. curl --location follows redirects
+// up to --max-redirs without re-checking; checksum verification is the
+// primary integrity control, this allowlist is defense-in-depth.
+const ALLOWED_HOSTS = new Set([
+  "github.com",
+  "objects.githubusercontent.com",
+  "registry.npmmirror.com",
+]);
+
+const PLATFORM_MAP = { darwin: "darwin", linux: "linux", win32: "windows" };
+const ARCH_MAP = { x64: "amd64", arm64: "arm64" };
+
+const platform = PLATFORM_MAP[process.platform];
+const arch = ARCH_MAP[process.arch];
+const isWindows = process.platform === "win32";
+const ext = isWindows ? ".zip" : ".tar.gz";
+const archiveName = `${NAME}-${VERSION}-${platform}-${arch}${ext}`;
+const GITHUB_URL = `https://github.com/${REPO}/releases/download/v${VERSION}/${archiveName}`;
+
+const binDir = path.join(__dirname, "..", "bin");
+const dest = path.join(binDir, NAME + (isWindows ? ".exe" : ""));
+
+function joinUrl(base, suffix) {
+  return base.replace(/\/+$/, "") + suffix;
+}
+
+function isValidDownloadBase(raw) {
+  try {
+    const parsed = new URL(raw);
+    return parsed.protocol === "https:" && !!parsed.hostname;
+  } catch (_) {
+    return false;
+  }
+}
+
+function isDefaultNpmjsRegistry(url) {
+  try {
+    const { hostname } = new URL(url);
+    return hostname === "registry.npmjs.org";
+  } catch (_) {
+    return false;
+  }
+}
+
+function assertAllowedHost(url) {
+  const { hostname } = new URL(url);
+  if (!ALLOWED_HOSTS.has(hostname)) {
+    throw new Error(`Download host not allowed: ${hostname}`);
+  }
+}
+
+function resolveMirrorUrls(env, archive, version) {
+  const binaryPath = `/-/binary/${NAME}/v${version}/${archive}`;
+  const defaultUrl = joinUrl(DEFAULT_MIRROR_HOST, binaryPath);
+
+  const urls = [];
+  const registry = (env.npm_config_registry || "").trim();
+  if (registry && !isDefaultNpmjsRegistry(registry) && isValidDownloadBase(registry)) {
+    const base = new URL(registry);
+    urls.push(joinUrl(base.origin + base.pathname, binaryPath));
+  }
+  if (!urls.includes(defaultUrl)) urls.push(defaultUrl);
+  return urls;
+}
+
+function getExpectedChecksum(archiveName, checksumsDir) {
+  const dir = checksumsDir || path.join(__dirname, "..");
+  const checksumsPath = path.join(dir, "checksums.txt");
+
+  if (!fs.existsSync(checksumsPath)) {
+    console.error("[WARN] checksums.txt not found, skipping checksum verification");
+    return null;
+  }
+
+  const content = fs.readFileSync(checksumsPath, "utf8");
+  for (const line of content.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    const idx = trimmed.indexOf("  ");
+    if (idx === -1) continue;
+    const hash = trimmed.slice(0, idx);
+    const name = trimmed.slice(idx + 2);
+    if (name === archiveName) return hash;
+  }
+
+  throw new Error(`Checksum entry not found for ${archiveName}`);
+}
+
+function verifyChecksum(archivePath, expectedHash) {
+  if (expectedHash === null) return;
+
+  const hash = crypto.createHash("sha256");
+  const fd = fs.openSync(archivePath, "r");
+  try {
+    const buf = Buffer.alloc(64 * 1024);
+    let bytesRead;
+    while ((bytesRead = fs.readSync(fd, buf, 0, buf.length, null)) > 0) {
+      hash.update(buf.subarray(0, bytesRead));
+    }
+  } finally {
+    fs.closeSync(fd);
+  }
+  const actual = hash.digest("hex");
+
+  if (actual.toLowerCase() !== expectedHash.toLowerCase()) {
+    throw new Error(
+      `[SECURITY] Checksum mismatch for ${path.basename(archivePath)}: ` +
+      `expected ${expectedHash} but got ${actual}`
+    );
+  }
+}
+
+function semverLessThan(a, b) {
+  const split = (v) => {
+    const idx = v.indexOf("-");
+    return idx === -1 ? [v, ""] : [v.slice(0, idx), v.slice(idx + 1)];
+  };
+  const [coreA, preA] = split(a);
+  const [coreB, preB] = split(b);
+  const pa = coreA.split(".").map(Number);
+  const pb = coreB.split(".").map(Number);
+  for (let i = 0; i < 3; i++) {
+    if ((pa[i] || 0) < (pb[i] || 0)) return true;
+    if ((pa[i] || 0) > (pb[i] || 0)) return false;
+  }
+  if (preA === preB) return false;
+  if (preA === "") return false;
+  if (preB === "") return true;
+  const idsA = preA.split(".");
+  const idsB = preB.split(".");
+  const n = Math.max(idsA.length, idsB.length);
+  for (let i = 0; i < n; i++) {
+    const x = idsA[i];
+    const y = idsB[i];
+    if (x === undefined) return true;
+    if (y === undefined) return false;
+    const numX = /^\d+$/.test(x) ? parseInt(x, 10) : null;
+    const numY = /^\d+$/.test(y) ? parseInt(y, 10) : null;
+    if (numX !== null && numY !== null) {
+      if (numX < numY) return true;
+      if (numX > numY) return false;
+    } else if (numX !== null) {
+      return true;
+    } else if (numY !== null) {
+      return false;
+    } else {
+      if (x < y) return true;
+      if (x > y) return false;
+    }
+  }
+  return false;
+}
+
+function getMirrorUrls(env) {
+  const urls = resolveMirrorUrls(env, archiveName, VERSION);
+  for (const u of urls) ALLOWED_HOSTS.add(new URL(u).hostname);
+  return urls;
+}
+
+function download(url, destPath) {
+  assertAllowedHost(url);
+  const args = [
+    "--fail", "--location", "--silent", "--show-error",
+    "--connect-timeout", "10", "--max-time", "120",
+    "--max-redirs", "3",
+    "--output", destPath,
+  ];
+  if (isWindows) args.unshift("--ssl-revoke-best-effort");
+  args.push(url);
+  execFileSync("curl", args, { stdio: ["ignore", "ignore", "pipe"] });
+}
+
+function extractZipWindows(archivePath, destDir) {
+  const psOpts = ["-NoProfile", "-ExecutionPolicy", "Bypass", "-Command"];
+  const psStdio = ["ignore", "inherit", "inherit"];
+  const psEnv = {
+    ...process.env,
+    MODELGO_CLI_ARCHIVE: archivePath,
+    MODELGO_CLI_DEST: destDir,
+  };
+  try {
+    const dotnet =
+      "$ErrorActionPreference='Stop';" +
+      "Add-Type -AssemblyName System.IO.Compression.FileSystem;" +
+      "[System.IO.Compression.ZipFile]::ExtractToDirectory($env:MODELGO_CLI_ARCHIVE,$env:MODELGO_CLI_DEST)";
+    execFileSync("powershell.exe", [...psOpts, dotnet], { stdio: psStdio, env: psEnv });
+  } catch (primaryErr) {
+    try {
+      const cmdlet =
+        "$ErrorActionPreference='Stop';" +
+        "Expand-Archive -LiteralPath $env:MODELGO_CLI_ARCHIVE -DestinationPath $env:MODELGO_CLI_DEST -Force";
+      execFileSync("powershell.exe", [...psOpts, cmdlet], { stdio: psStdio, env: psEnv });
+    } catch (secondErr) {
+      try {
+        execFileSync("tar", ["-xf", archivePath, "-C", destDir], { stdio: psStdio });
+      } catch (fallbackErr) {
+        throw new Error(
+          `Failed to extract ${archivePath}. ` +
+          `.NET ZipFile: ${primaryErr.message}. ` +
+          `Expand-Archive: ${secondErr.message}. ` +
+          `tar: ${fallbackErr.message}`
+        );
+      }
+    }
+  }
+}
+
+function install() {
+  const mirrorUrls = getMirrorUrls(process.env);
+  const downloadUrls = [GITHUB_URL, ...mirrorUrls];
+
+  fs.mkdirSync(binDir, { recursive: true });
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "modelgo-cli-"));
+  const archivePath = path.join(tmpDir, archiveName);
+
+  try {
+    let lastErr;
+    let downloaded = false;
+    for (const url of downloadUrls) {
+      try {
+        download(url, archivePath);
+        downloaded = true;
+        break;
+      } catch (e) {
+        lastErr = e;
+      }
+    }
+    if (!downloaded) throw lastErr;
+
+    const expectedHash = getExpectedChecksum(archiveName);
+    verifyChecksum(archivePath, expectedHash);
+
+    if (isWindows) {
+      extractZipWindows(archivePath, tmpDir);
+    } else {
+      execFileSync("tar", ["-xzf", archivePath, "-C", tmpDir], { stdio: "ignore" });
+    }
+
+    const binaryName = NAME + (isWindows ? ".exe" : "");
+    const extractedBinary = path.join(tmpDir, binaryName);
+    fs.copyFileSync(extractedBinary, dest);
+    fs.chmodSync(dest, 0o755);
+    console.log(`${NAME} v${VERSION} installed successfully`);
+  } finally {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  }
+}
+
+if (require.main === module) {
+  if (!platform || !arch) {
+    console.error(`Unsupported platform: ${process.platform}-${process.arch}`);
+    process.exit(1);
+  }
+
+  // Skip binary download when triggered as postinstall under `npx <pkg> install`.
+  // The wizard does not need the binary; run.js will be called next, and it
+  // dispatches to install-wizard.js for the "install" arg.
+  const isNpxPostinstall = process.env.npm_command === "exec";
+  if (isNpxPostinstall) {
+    process.exit(0);
+  }
+
+  try {
+    install();
+  } catch (err) {
+    console.error(`Failed to install ${NAME}:`, err.message);
+    console.error(
+      `\nIf you are behind a firewall or in a restricted network, try one of:\n` +
+      `  # 1. Use a proxy:\n` +
+      `  export https_proxy=http://your-proxy:port\n` +
+      `  npm install -g @model-go/cli\n\n` +
+      `  # 2. Point to a corporate npm mirror that proxies /-/binary/${NAME}/...:\n` +
+      `  npm install -g @model-go/cli --registry=https://your-corp-mirror/`
+    );
+    process.exit(1);
+  }
+}
+
+module.exports = {
+  // exported for testing
+  ALLOWED_HOSTS,
+  resolveMirrorUrls,
+  isValidDownloadBase,
+  isDefaultNpmjsRegistry,
+  assertAllowedHost,
+  getExpectedChecksum,
+  verifyChecksum,
+  semverLessThan,
+  // exported for install-wizard
+  archiveName,
+  VERSION,
+  binDir,
+  dest,
+};

package/scripts/run.js

@@ -0,0 +1,35 @@
+#!/usr/bin/env node
+// Copyright (c) 2026 modelgo
+// SPDX-License-Identifier: MIT
+//
+// npm bin entrypoint. Routes:
+//   - `modelgo-cli install`  → install-wizard.js (interactive setup)
+//   - everything else        → exec bin/modelgo-cli (the downloaded Go binary)
+
+const { execFileSync } = require("child_process");
+const path = require("path");
+const fs = require("fs");
+
+const args = process.argv.slice(2);
+
+if (args[0] === "install") {
+  require("./install-wizard.js");
+} else {
+  const isWindows = process.platform === "win32";
+  const binName = "modelgo-cli" + (isWindows ? ".exe" : "");
+  const binPath = path.join(__dirname, "..", "bin", binName);
+
+  if (!fs.existsSync(binPath)) {
+    console.error(
+      `modelgo-cli binary not found at ${binPath}\n` +
+      `Please reinstall: npm install -g @model-go/cli`
+    );
+    process.exit(1);
+  }
+
+  try {
+    execFileSync(binPath, args, { stdio: "inherit" });
+  } catch (e) {
+    process.exit(typeof e.status === "number" ? e.status : 1);
+  }
+}