@qoder-ai/qoder-agent-sdk 1.0.17 → 1.0.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qoder-ai/qoder-agent-sdk",
-  "version": "1.0.17",
+  "version": "1.0.20",
   "description": "TypeScript SDK for building Qoder-powered coding agents.",
   "type": "module",
   "main": "dist/index.js",
@@ -34,54 +34,7 @@
     "node": ">=18.0.0"
   },
   "scripts": {
-    "build": "tsc",
-    "watch": "tsc --watch",
-    "clean": "rm -rf dist",
-    "bundle": "npm run clean && tsc && node scripts/bundle.mjs",
-    "bundle:worker": "npm run clean && tsc && node scripts/bundle.mjs --runtime-transport=worker --require-worker-runtime",
-    "build:obfuscated": "npm run bundle",
-    "check:package-version": "node scripts/check-package-version.mjs",
-    "hooks:install": "sh scripts/install-git-hooks.sh",
-    "release:check": "bash scripts/release-npm.sh check",
-    "release:beta": "bash scripts/release-npm.sh beta",
-    "release:latest": "bash scripts/release-npm.sh latest",
-    "release:promote": "bash scripts/release-npm.sh promote",
-    "prepublishOnly": "npm run bundle",
-    "postinstall": "node scripts/postinstall.cjs",
-    "demo:minimal": "npm run demo:chat",
-    "demo:image": "node examples/image-input-demo/demo.mjs",
-    "demo:models": "npm run build && node examples/list-models-demo/demo.mjs",
-    "demo:service-account-token": "npm run build && node examples/service-account-token-demo/demo.mjs",
-    "demo:usage": "npm run build && node examples/usage-info-demo/demo.mjs",
-    "demo:steer-control": "npm run build && node examples/steer-control-demo/demo.mjs",
-    "demo:chat": "npm run build && node examples/interactive-chat-demo/demo.mjs",
-    "demo:mcp-oauth": "npm run build && node examples/mcp-oauth-demo/demo.mjs",
-    "demo:inprocess-mcp": "npm run build && node examples/inprocess-mcp-demo/demo.mjs",
-    "demo:byok": "npm run build && node examples/byok-validation-demo/demo.mjs",
-    "test": "npm run test:unit",
-    "test:unit": "npm run build && node --test tests/*.test.mjs",
-    "test:query-session-control:unit": "npm run build && node --test tests/query-session-control/unit/*.test.mjs",
-    "test:query-session-control:functional": "npm run build && node --test tests/query-session-control/functional/*.test.mjs",
-    "test:query-input-output:unit": "npm run build && node --test tests/query-input-output/unit/*.test.mjs",
-    "test:query-input-output:functional": "npm run build && node --test tests/query-input-output/functional/*.test.mjs",
-    "test:query-auth": "npm run test:query-auth:unit && npm run test:query-auth:functional",
-    "test:query-auth:unit": "npm run build && node --test tests/query-auth/unit/*.test.mjs",
-    "test:query-auth:functional": "npm run build && node --test tests/query-auth/functional/*.test.mjs",
-    "test:query-auth:e2e": "npm run test:query-auth:functional",
-    "test:query-system-prompt:unit": "npm run build && node --test tests/query-system-prompt/unit/*.test.mjs",
-    "test:query-system-prompt:functional": "npm run build && node --test tests/query-system-prompt/functional/*.test.mjs",
-    "test:query-mcp:functional": "npm run build && node --test tests/query-mcp/functional/*.test.mjs",
-    "test:query-output-events:unit": "npm run build && node --test tests/query-output-events/unit/*.test.mjs",
-    "test:query-output-events:functional": "npm run build && node --test tests/query-output-events/functional/*.test.mjs",
-    "test:query-working-directory:functional": "npm run build && node --test tests/query-working-directory/functional/*.test.mjs",
-    "test:query-runtime-control:unit": "npm run build && node --test tests/query-runtime-control/unit/*.test.mjs",
-    "test:query-runtime-control:functional": "npm run build && node --test tests/query-runtime-control/functional/*.test.mjs",
-    "test:worker-runtime:functional": "npm run build && node --test tests/worker-runtime/functional/*.test.mjs",
-    "test:skills-loading-control:unit": "npm run build && node --test tests/skills-loading-control/unit/*.test.mjs",
-    "test:skills-loading-control:functional": "npm run build && node --test tests/skills-loading-control/functional/*.test.mjs",
-    "test:plugins-loading-control:unit": "npm run build && node --test tests/plugins-loading-control/unit/*.test.mjs",
-    "test:plugins-loading-control:functional": "npm run build && node --test tests/plugins-loading-control/functional/*.test.mjs",
-    "test:integration": "npm run build && node --test tests/integration/**/*.test.mjs"
+    "postinstall": "node scripts/postinstall.cjs"
   },
   "keywords": [
     "qoder",
@@ -97,12 +50,7 @@
   "peerDependencies": {
     "zod": "^3.25.0 || ^4.0.0"
   },
-  "devDependencies": {
-    "@types/node": "^22.0.0",
-    "esbuild": "^0.24.2",
-    "typescript": "^5.7.0",
-    "zod": "^4.0.0"
-  },
-  "qoderCliVersion": "1.1.11",
+  "qoderCliVersion": "1.1.18",
+  "qoderSdkBrand": "global",
   "license": "SEE LICENSE IN LICENSE"
 }

package/scripts/postinstall.cjs

@@ -22,22 +22,15 @@ const https = require('https');
 const os = require('os');
 const path = require('path');
 
-const GLOBAL_PROD_DOWNLOAD_BASE_URL =
-  'https://download.qoder.com/qodercli/releases';
+const GLOBAL_PROD_DOWNLOAD_BASE_URL = 'https://download.qoder.com/qodercli/releases';
 const GLOBAL_DEV_DOWNLOAD_BASE_URL =
   'https://qs-cli-dev.oss-cn-hangzhou.aliyuncs.com/qodercli/dev/releases';
-const CN_PROD_DOWNLOAD_BASE_URL =
-  'https://static.qoder.com.cn/qoder-cli-cn/releases';
-const CN_DEV_DOWNLOAD_BASE_URL =
-  'https://static.qoder.com.cn/qoder-cli-cn/dev/releases';
-const LOG_PREFIX = '[@qoder-ai/qoder-agent-sdk]';
-const WORKER_RUNTIME_ENTRY_NAMES = [
-  'qoder-worker-runtime.obf.mjs',
-  'qoder-worker-runtime.mjs',
-];
-const REQUIRED_WORKER_RUNTIME_ASSETS = [
-  path.join('vendor', 'ripgrep', 'x64-win32', 'rg.exe'),
-];
+const CN_PROD_DOWNLOAD_BASE_URL = 'https://static.qoder.com.cn/qoder-cli-cn/releases';
+const CN_DEV_DOWNLOAD_BASE_URL = 'https://static.qoder.com.cn/qoder-cli-cn/dev/releases';
+const PACKAGE_JSON = require('../package.json');
+const LOG_PREFIX = `[${PACKAGE_JSON.name ?? '@qoder-ai/qoder-agent-sdk'}]`;
+const WORKER_RUNTIME_ENTRY_NAMES = ['qoder-worker-runtime.obf.mjs', 'qoder-worker-runtime.mjs'];
+const REQUIRED_WORKER_RUNTIME_ASSETS = [path.join('vendor', 'ripgrep', 'x64-win32', 'rg.exe')];
 
 function isTruthy(value) {
   return value === '1' || value === 'true';
@@ -48,12 +41,9 @@ function getCliVersion() {
   if (fromEnv) return fromEnv.replace(/^v/, '');
 
   try {
-    const packageJson = require('../package.json');
-    const version = packageJson.qoderCliVersion ?? packageJson.version;
+    const version = PACKAGE_JSON.qoderCliVersion ?? PACKAGE_JSON.version;
     if (!version) {
-      throw new Error(
-        'package.json must define "qoderCliVersion" or "version".',
-      );
+      throw new Error('package.json must define "qoderCliVersion" or "version".');
     }
     return String(version).replace(/^v/, '');
   } catch (error) {
@@ -62,20 +52,21 @@ function getCliVersion() {
 }
 
 function isDevCliVersion(version) {
-  return /(?:^|[.-])(alpha|dev|nightly)(?:[.-]|$)/i.test(version);
+  return (
+    /^\d+\.\d+\.\d+-/.test(version) ||
+    /(?:^|[.-])(alpha|beta|dev|nightly|rc|canary)(?:[.-]|$)/i.test(version)
+  );
 }
 
 function normalizeCliSite(value) {
   const normalized = String(value).trim().toLowerCase();
   if (normalized === 'global') return 'global';
   if (normalized === 'cn') return 'cn';
-  throw new Error(
-    `Unsupported QODER_CLI_SITE "${value}". Supported: global, cn`,
-  );
+  throw new Error(`Unsupported QODER_CLI_SITE "${value}". Supported: global, cn`);
 }
 
 function getCliSite() {
-  return normalizeCliSite(process.env.QODER_CLI_SITE ?? 'global');
+  return normalizeCliSite(process.env.QODER_CLI_SITE ?? PACKAGE_JSON.qoderSdkBrand ?? 'global');
 }
 
 function getCliArtifactPrefix(site = getCliSite()) {
@@ -87,10 +78,8 @@ function getDownloadBaseUrl(version = getCliVersion()) {
     return process.env.QODER_CLI_MIRROR;
   }
   const site = getCliSite();
-  if (site !== 'global') {
-    throw new Error(
-      'QODER_CLI_SITE=cn requires QODER_CLI_MIRROR for CLI downloads.',
-    );
+  if (site === 'cn') {
+    return isDevCliVersion(version) ? CN_DEV_DOWNLOAD_BASE_URL : CN_PROD_DOWNLOAD_BASE_URL;
   }
   if (isDevCliVersion(version)) {
     return GLOBAL_DEV_DOWNLOAD_BASE_URL;
@@ -104,13 +93,9 @@ function getWorkerRuntimeDownloadBaseUrl(version = getCliVersion()) {
   }
   const site = getCliSite();
   if (site === 'cn') {
-    return isDevCliVersion(version)
-      ? CN_DEV_DOWNLOAD_BASE_URL
-      : CN_PROD_DOWNLOAD_BASE_URL;
+    return isDevCliVersion(version) ? CN_DEV_DOWNLOAD_BASE_URL : CN_PROD_DOWNLOAD_BASE_URL;
   }
-  return isDevCliVersion(version)
-    ? GLOBAL_DEV_DOWNLOAD_BASE_URL
-    : GLOBAL_PROD_DOWNLOAD_BASE_URL;
+  return isDevCliVersion(version) ? GLOBAL_DEV_DOWNLOAD_BASE_URL : GLOBAL_PROD_DOWNLOAD_BASE_URL;
 }
 
 function normalizeDownloadBaseUrl(baseUrl, version = getCliVersion()) {
@@ -158,6 +143,7 @@ function normalizePlatformOverride(value) {
     'linux-x64',
     'linux-x64-baseline',
     'linux-x64-musl',
+    'windows-arm64',
     'windows-x64',
   ]);
 
@@ -180,10 +166,10 @@ function getPlatformTarget() {
   }
 
   if (process.platform === 'win32') {
-    if (process.arch !== 'x64') {
+    if (process.arch !== 'x64' && process.arch !== 'arm64') {
       throw new Error(`Unsupported Windows architecture: ${process.arch}`);
     }
-    return 'windows-x64';
+    return `windows-${process.arch}`;
   }
 
   if (process.platform === 'linux') {
@@ -209,10 +195,7 @@ function getArtifactName(target = getPlatformTarget()) {
 
 function getDownloadUrl() {
   const version = getCliVersion();
-  const baseUrl = normalizeDownloadBaseUrl(
-    getDownloadBaseUrl(version),
-    version,
-  );
+  const baseUrl = normalizeDownloadBaseUrl(getDownloadBaseUrl(version), version);
   return `${baseUrl}/${getArtifactName()}`;
 }
 
@@ -226,23 +209,15 @@ function hasWorkerRuntimeDownloadSiteOverride() {
 
 function getManifestWorkerRuntime(manifest = readRuntimeManifest()) {
   const workerRuntime = manifest?.workerRuntime;
-  return workerRuntime && typeof workerRuntime === 'object'
-    ? workerRuntime
-    : null;
+  return workerRuntime && typeof workerRuntime === 'object' ? workerRuntime : null;
 }
 
 function getManifestWorkerRuntimeDownloadUrl(manifest = readRuntimeManifest()) {
   const workerRuntime = getManifestWorkerRuntime(manifest);
   if (!workerRuntime || workerRuntime.packaged === true) return null;
 
-  const candidates = [
-    workerRuntime.url,
-    workerRuntime.artifact?.url,
-    workerRuntime.source?.url,
-  ];
-  const url = candidates.find(
-    (candidate) => typeof candidate === 'string' && candidate.length > 0,
-  );
+  const candidates = [workerRuntime.url, workerRuntime.artifact?.url, workerRuntime.source?.url];
+  const url = candidates.find((candidate) => typeof candidate === 'string' && candidate.length > 0);
   return url ?? null;
 }
 
@@ -256,9 +231,7 @@ function getManifestWorkerRuntimeSha256(manifest = readRuntimeManifest()) {
     workerRuntime.source?.sha256,
   ];
   const checksum = candidates.find(
-    (candidate) =>
-      typeof candidate === 'string' &&
-      /^[a-fA-F0-9]{64}$/.test(candidate.trim()),
+    (candidate) => typeof candidate === 'string' && /^[a-fA-F0-9]{64}$/.test(candidate.trim()),
   );
   return checksum ? checksum.trim().toLowerCase() : null;
 }
@@ -276,10 +249,7 @@ function getWorkerRuntimeDownloadUrl() {
   }
 
   const version = getCliVersion();
-  const baseUrl = normalizeDownloadBaseUrl(
-    getWorkerRuntimeDownloadBaseUrl(version),
-    version,
-  );
+  const baseUrl = normalizeDownloadBaseUrl(getWorkerRuntimeDownloadBaseUrl(version), version);
   return `${baseUrl}/${getWorkerRuntimeArtifactName()}`;
 }
 
@@ -297,8 +267,52 @@ function getBundledDir() {
 }
 
 function getBundledCliPath() {
-  const cliName = process.platform === 'win32' ? 'qodercli.exe' : 'qodercli';
-  return path.join(getBundledDir(), cliName);
+  const names = getCliSite() === 'cn' ? ['qodercn', 'qoderclicn'] : ['qoder', 'qodercli'];
+  for (const name of names) {
+    const cliName = process.platform === 'win32' ? `${name}.exe` : name;
+    const candidate = path.join(getBundledDir(), cliName);
+    if (fs.existsSync(candidate)) return candidate;
+  }
+  const fallback = names[1];
+  return path.join(getBundledDir(), process.platform === 'win32' ? `${fallback}.exe` : fallback);
+}
+
+function getReleaseManifestUrl(version = getCliVersion()) {
+  const site = getCliSite();
+  let base;
+  if (site === 'cn') {
+    base = isDevCliVersion(version)
+      ? 'https://static.qoder.com.cn/qoder-cli-cn/dev'
+      : 'https://static.qoder.com.cn/qoder-cli-cn';
+  } else {
+    base = isDevCliVersion(version)
+      ? 'https://qs-cli-dev.oss-cn-hangzhou.aliyuncs.com/qodercli/dev'
+      : 'https://download.qoder.com/qodercli';
+  }
+  return `${base}/channels/${version}/manifest.json`;
+}
+
+function manifestTarget(target = getPlatformTarget()) {
+  const [osName, rawArch, variant] = target.split('-');
+  const arch = rawArch === 'x64' ? 'amd64' : rawArch;
+  return {
+    os: osName === 'windows' ? 'windows' : osName,
+    arch: variant ? `${arch}-${variant}` : arch,
+  };
+}
+
+function selectManifestArtifact(manifest, target = getPlatformTarget()) {
+  const expected = manifestTarget(target);
+  const candidates = (manifest?.files ?? []).filter(
+    (file) => file.os === expected.os && file.arch === expected.arch,
+  );
+  const selected = candidates.find((file) => file.variant !== 'legacy') ?? candidates[0];
+  if (!selected?.url || !selected?.sha256) {
+    throw new Error(
+      `CLI release manifest has no artifact for ${target}: ${getReleaseManifestUrl()}`,
+    );
+  }
+  return selected;
 }
 
 function getPackagedWorkerRuntimeDir() {
@@ -323,9 +337,7 @@ function getPackagedWorkerRuntimeInfoPath() {
 }
 
 function hasPackagedWorkerRuntime() {
-  return getPackagedWorkerRuntimePaths().some((candidate) =>
-    fs.existsSync(candidate),
-  );
+  return getPackagedWorkerRuntimePaths().some((candidate) => fs.existsSync(candidate));
 }
 
 function readPackagedWorkerRuntimeInfo() {
@@ -350,9 +362,7 @@ function isPackagedWorkerRuntimeCompatibleWithSite(site = getCliSite()) {
 
   const expectedProductName = getCliArtifactPrefix(site);
   const buildInfo =
-    runtimeInfo.build && typeof runtimeInfo.build === 'object'
-      ? runtimeInfo.build
-      : {};
+    runtimeInfo.build && typeof runtimeInfo.build === 'object' ? runtimeInfo.build : {};
   const actualProductName = buildInfo.productName;
   const actualSite = buildInfo.site;
 
@@ -364,11 +374,7 @@ function isPackagedWorkerRuntimeCompatibleWithSite(site = getCliSite()) {
     return false;
   }
 
-  if (
-    typeof actualSite === 'string' &&
-    actualSite.length > 0 &&
-    actualSite !== site
-  ) {
+  if (typeof actualSite === 'string' && actualSite.length > 0 && actualSite !== site) {
     return false;
   }
 
@@ -398,10 +404,7 @@ function getDefaultRuntimeTransport() {
 }
 
 function shouldInstallWorkerRuntimeForDefaultWorker() {
-  return (
-    getDefaultRuntimeTransport() === 'worker' &&
-    !isPackagedWorkerRuntimeCompatibleWithSite()
-  );
+  return getDefaultRuntimeTransport() === 'worker' && !isPackagedWorkerRuntimeCompatibleWithSite();
 }
 
 function shouldSkipBundledCliDownloadForWorkerRuntime() {
@@ -429,9 +432,7 @@ function requestUrl(url, redirectCount = 0) {
           reject(new Error('Redirect response missing location header'));
           return;
         }
-        const nextUrl = location.startsWith('http')
-          ? location
-          : new URL(location, url).href;
+        const nextUrl = location.startsWith('http') ? location : new URL(location, url).href;
         response.resume();
         resolve(requestUrl(nextUrl, redirectCount + 1));
         return;
@@ -456,10 +457,7 @@ async function downloadFile(url, destPath) {
   }
 
   await new Promise((resolve, reject) => {
-    const totalSize = Number.parseInt(
-      response.headers['content-length'] || '0',
-      10,
-    );
+    const totalSize = Number.parseInt(response.headers['content-length'] || '0', 10);
     let downloadedSize = 0;
     let lastProgress = 0;
     const file = fs.createWriteStream(destPath);
@@ -519,9 +517,7 @@ function sha256File(filePath) {
 
 async function verifyChecksum(archiveUrl, archivePath, expectedSha256) {
   if (isTruthy(process.env.QODER_SKIP_CHECKSUM)) {
-    console.log(
-      `${LOG_PREFIX} QODER_SKIP_CHECKSUM is set, skipping checksum verification.`,
-    );
+    console.log(`${LOG_PREFIX} QODER_SKIP_CHECKSUM is set, skipping checksum verification.`);
     return;
   }
 
@@ -532,9 +528,7 @@ async function verifyChecksum(archiveUrl, archivePath, expectedSha256) {
     }
     const actual = sha256File(archivePath);
     if (actual !== expected) {
-      throw new Error(
-        `Checksum verification failed. Expected ${expected}, actual ${actual}`,
-      );
+      throw new Error(`Checksum verification failed. Expected ${expected}, actual ${actual}`);
     }
     console.log(`${LOG_PREFIX} Checksum verified.`);
     return;
@@ -545,9 +539,7 @@ async function verifyChecksum(archiveUrl, archivePath, expectedSha256) {
   const expected = parseSha256(fs.readFileSync(checksumPath, 'utf8'));
   const actual = sha256File(archivePath);
   if (actual !== expected) {
-    throw new Error(
-      `Checksum verification failed. Expected ${expected}, actual ${actual}`,
-    );
+    throw new Error(`Checksum verification failed. Expected ${expected}, actual ${actual}`);
   }
   console.log(`${LOG_PREFIX} Checksum verified.`);
 }
@@ -577,12 +569,7 @@ function getTarExtractInvocation(archivePath, destDir) {
   const cwd = pathApi.dirname(archivePath);
   return {
     cwd,
-    args: [
-      '-xzf',
-      pathApi.basename(archivePath),
-      '-C',
-      pathApi.relative(cwd, destDir) || '.',
-    ],
+    args: ['-xzf', pathApi.basename(archivePath), '-C', pathApi.relative(cwd, destDir) || '.'],
   };
 }
 
@@ -624,7 +611,7 @@ function findCliBinary(dir, cliName) {
 
 function isCliBinaryName(fileName, cliName) {
   if (fileName === cliName) return true;
-  const sourceNames = ['qodercli', 'qoderclicn'];
+  const sourceNames = ['qoder', 'qodercli', 'qodercn', 'qoderclicn'];
   if (process.platform === 'win32') {
     return sourceNames.some(
       (sourceName) =>
@@ -635,8 +622,7 @@ function isCliBinaryName(fileName, cliName) {
   return sourceNames.some(
     (sourceName) =>
       fileName === sourceName ||
-      (new RegExp(`^${sourceName}-.+$`, 'i').test(fileName) &&
-        !fileName.endsWith('.sha256')),
+      (new RegExp(`^${sourceName}-.+$`, 'i').test(fileName) && !fileName.endsWith('.sha256')),
   );
 }
 
@@ -658,11 +644,12 @@ function copyDirContents(srcDir, destDir) {
 }
 
 function installExtractedContents(extractDir, bundledDir) {
-  const cliName = process.platform === 'win32' ? 'qodercli.exe' : 'qodercli';
+  const canonicalName = getCliSite() === 'cn' ? 'qoderclicn' : 'qodercli';
+  const cliName = process.platform === 'win32' ? `${canonicalName}.exe` : canonicalName;
   const extractedCli = findCliBinary(extractDir, cliName);
   if (!extractedCli) {
     throw new Error(
-      'CLI binary not found in extracted archive. Expected qodercli/qoderclicn or platform-suffixed variants.',
+      'CLI binary not found in extracted archive. Expected qoder/qodercli/qodercn/qoderclicn or platform-suffixed variants.',
     );
   }
 
@@ -679,17 +666,14 @@ function installExtractedContents(extractDir, bundledDir) {
   }
 
   const files = fs.readdirSync(bundledDir);
-  console.log(
-    `${LOG_PREFIX} Copied ${files.length} file(s) to _bundled: ${files.join(', ')}`,
-  );
+  console.log(`${LOG_PREFIX} Copied ${files.length} file(s) to _bundled: ${files.join(', ')}`);
   return target;
 }
 
 function findWorkerRuntimeRoot(dir) {
   const entries = fs.readdirSync(dir, { withFileTypes: true });
   const hasWorkerRuntime = entries.some(
-    (entry) =>
-      entry.isFile() && WORKER_RUNTIME_ENTRY_NAMES.includes(entry.name),
+    (entry) => entry.isFile() && WORKER_RUNTIME_ENTRY_NAMES.includes(entry.name),
   );
   if (hasWorkerRuntime) return dir;
 
@@ -712,9 +696,7 @@ function getWorkerRuntimeEntryPath(runtimeDir) {
 function assertWorkerRuntimeComplete(runtimeDir, sourceDescription) {
   const runtimePath = getWorkerRuntimeEntryPath(runtimeDir);
   if (!fs.existsSync(runtimePath)) {
-    throw new Error(
-      `Worker runtime entry missing in ${sourceDescription}: ${runtimePath}`,
-    );
+    throw new Error(`Worker runtime entry missing in ${sourceDescription}: ${runtimePath}`);
   }
 
   const missingAssets = REQUIRED_WORKER_RUNTIME_ASSETS.filter(
@@ -748,18 +730,14 @@ function installExtractedWorkerRuntime(extractDir, workerDir) {
   const runtimePath = assertWorkerRuntimeComplete(workerDir, workerDir);
 
   const files = fs.readdirSync(workerDir);
-  console.log(
-    `${LOG_PREFIX} Copied ${files.length} file(s) to _worker: ${files.join(', ')}`,
-  );
+  console.log(`${LOG_PREFIX} Copied ${files.length} file(s) to _worker: ${files.join(', ')}`);
   return runtimePath;
 }
 
 async function installWorkerRuntimeFromDownload() {
   const url = getWorkerRuntimeDownloadUrl();
   const expectedSha256 = getWorkerRuntimeExpectedSha256(url);
-  const tempDir = fs.mkdtempSync(
-    path.join(os.tmpdir(), 'qoder-worker-runtime-'),
-  );
+  const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'qoder-worker-runtime-'));
   const archivePath = path.join(tempDir, path.basename(new URL(url).pathname));
   const extractDir = path.join(tempDir, 'extract');
 
@@ -768,10 +746,7 @@ async function installWorkerRuntimeFromDownload() {
     await verifyChecksum(url, archivePath, expectedSha256);
     fs.mkdirSync(extractDir, { recursive: true });
     await extractArchive(archivePath, extractDir);
-    return installExtractedWorkerRuntime(
-      extractDir,
-      getPackagedWorkerRuntimeDir(),
-    );
+    return installExtractedWorkerRuntime(extractDir, getPackagedWorkerRuntimeDir());
   } finally {
     fs.rmSync(tempDir, { recursive: true, force: true });
   }
@@ -779,16 +754,12 @@ async function installWorkerRuntimeFromDownload() {
 
 async function main() {
   if (isTruthy(process.env.QODER_SKIP_DOWNLOAD)) {
-    console.log(
-      `${LOG_PREFIX} QODER_SKIP_DOWNLOAD is set, skipping runtime downloads.`,
-    );
+    console.log(`${LOG_PREFIX} QODER_SKIP_DOWNLOAD is set, skipping runtime downloads.`);
     return;
   }
 
   if (shouldInstallWorkerRuntimeForDefaultWorker()) {
-    console.log(
-      `${LOG_PREFIX} Package default runtime is Worker; downloading Worker runtime.`,
-    );
+    console.log(`${LOG_PREFIX} Package default runtime is Worker; downloading Worker runtime.`);
     await installWorkerRuntimeFromDownload();
   }
 
@@ -808,20 +779,41 @@ async function main() {
   const version = getCliVersion();
   const bundleName = getCliArtifactPrefix();
   const target = getPlatformTarget();
-  const archiveName = getArtifactName(target);
-  const downloadUrl = getDownloadUrl();
+  let archiveName;
+  let downloadUrl;
+  let expectedSha256;
+  if (process.env.QODER_CLI_MIRROR) {
+    archiveName = getArtifactName(target);
+    downloadUrl = getDownloadUrl();
+  } else {
+    const manifestUrl = getReleaseManifestUrl(version);
+    const manifestPath = path.join(
+      fs.mkdtempSync(path.join(os.tmpdir(), 'qoder-cli-manifest-')),
+      'manifest.json',
+    );
+    try {
+      await downloadWithRetry(manifestUrl, manifestPath);
+      const selected = selectManifestArtifact(
+        JSON.parse(fs.readFileSync(manifestPath, 'utf8')),
+        target,
+      );
+      downloadUrl = selected.url;
+      expectedSha256 = selected.sha256;
+      archiveName = path.basename(new URL(downloadUrl).pathname);
+    } finally {
+      fs.rmSync(path.dirname(manifestPath), { recursive: true, force: true });
+    }
+  }
   const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'qoder-cli-'));
   const archivePath = path.join(tempDir, archiveName);
   const extractDir = path.join(tempDir, 'extract');
 
-  console.log(
-    `${LOG_PREFIX} Installing ${bundleName} ${version} for ${target}.`,
-  );
+  console.log(`${LOG_PREFIX} Installing ${bundleName} ${version} for ${target}.`);
 
   try {
     fs.mkdirSync(extractDir, { recursive: true });
     await downloadWithRetry(downloadUrl, archivePath);
-    await verifyChecksum(downloadUrl, archivePath);
+    await verifyChecksum(downloadUrl, archivePath, expectedSha256);
     await extractArchive(archivePath, extractDir);
     const installedPath = installExtractedContents(extractDir, getBundledDir());
     const stats = fs.statSync(installedPath);
@@ -829,9 +821,7 @@ async function main() {
       `${LOG_PREFIX} CLI binary installed: ${installedPath} (${(stats.size / 1024 / 1024).toFixed(2)} MB)`,
     );
   } catch (error) {
-    console.error(
-      `${LOG_PREFIX} ERROR: Failed to install bundled CLI: ${error.message}`,
-    );
+    console.error(`${LOG_PREFIX} ERROR: Failed to install bundled CLI: ${error.message}`);
     console.error(
       `${LOG_PREFIX} Set QODER_SKIP_DOWNLOAD=1 to skip download and use a system qodercli.`,
     );
@@ -866,6 +856,7 @@ module.exports = {
   getPackagedWorkerRuntimePaths,
   getRuntimeManifestPath,
   getPlatformTarget,
+  getReleaseManifestUrl,
   getDefaultRuntimeTransport,
   getWorkerRuntimeExpectedSha256,
   getWorkerRuntimeArtifactName,
@@ -879,6 +870,7 @@ module.exports = {
   isDevCliVersion,
   normalizeDownloadBaseUrl,
   normalizePlatformOverride,
+  selectManifestArtifact,
   readPackagedWorkerRuntimeInfo,
   readRuntimeManifest,
   shouldInstallWorkerRuntimeForDefaultWorker,