@redscope-ai/redscope 1.0.0

package/package.json

@@ -0,0 +1,243 @@
+{
+  "name": "@redscope-ai/redscope",
+  "version": "1.0.0",
+  "description": "RedScope AI - security-focused AI CLI for penetration testing, asset reconnaissance, threat tracing, and red-team orchestration",
+  "type": "module",
+  "author": "RedScope AI",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/redscope-ai/redscope-ai.git"
+  },
+  "homepage": "https://github.com/redscope-ai/redscope-ai#readme",
+  "bugs": {
+    "url": "https://github.com/redscope-ai/redscope-ai/issues"
+  },
+  "keywords": [
+    "redscope",
+    "security",
+    "pentest",
+    "red-team",
+    "ai",
+    "coding-assistant",
+    "terminal",
+    "repl"
+  ],
+  "engines": {
+    "bun": ">=1.2.0"
+  },
+  "bin": {
+    "redscope": "dist/cli-node.js",
+    "redscope-bun": "dist/cli-bun.js",
+    "ccb": "dist/cli-node.js",
+    "ccb-bun": "dist/cli-bun.js",
+    "claude-code-best": "dist/cli-node.js"
+  },
+  "workspaces": [
+    "packages/*",
+    "packages/@ant/*",
+    "packages/@anthropic-ai/*"
+  ],
+  "files": [
+    "dist",
+    "scripts/postinstall.cjs",
+    "scripts/run-parallel.mjs",
+    "scripts/setup-chrome-mcp.mjs",
+    "scripts/chrome-mcp-bridge-resolver.mjs",
+    "scripts/chrome-mcp-env.mjs"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "bun run build.ts",
+    "build:vite": "vite build && bun run scripts/post-build.ts",
+    "build:vite:only": "vite build",
+    "build:bun": "bun run build.ts",
+    "dev": "bun run scripts/dev.ts",
+    "dev:inspect": "bun run scripts/dev-debug.ts",
+    "prepublishOnly": "bun run build && bun run redscope:publish-guard",
+    "lint": "biome lint src/",
+    "lint:fix": "biome lint --fix src/",
+    "format": "biome format --write src/",
+    "test": "bun test",
+    "test:production": "bun run scripts/production-test.ts",
+    "test:production:offline": "bun run scripts/production-test.ts --offline",
+    "test:production:verbose": "bun run scripts/production-test.ts --verbose",
+    "test:production:bun": "bun run scripts/production-test.ts --bun",
+    "check:bundle": "bun run scripts/check-bundle-integrity.ts",
+    "check:unused": "knip-bun",
+    "health": "bun run scripts/health-check.ts",
+    "redscope:tool": "bun run scripts/redscope-tool-installer.ts",
+    "redscope:profile": "bun run scripts/redscope-profile-runner.ts",
+    "redscope:report": "bun run scripts/redscope-report-pipeline.ts",
+    "redscope:observe": "bun run scripts/redscope-observability.ts",
+    "redscope:graph": "bun run scripts/redscope-memory-graph.ts",
+    "redscope:graph-import": "bun run scripts/redscope-graph-import.ts",
+    "redscope:evtx": "bun run scripts/redscope-evtx-deep-parser.ts",
+    "redscope:workflow": "bun run scripts/redscope-workflow.ts",
+    "redscope:batch": "bun run scripts/redscope-batch-runner.ts",
+    "redscope:command": "bun run scripts/redscope-command-adapter.ts",
+    "redscope:deliver": "bun run scripts/redscope-delivery.ts",
+    "redscope:drafts": "bun run scripts/redscope-draft-generator.ts",
+    "redscope:sources": "bun run scripts/redscope-source-updater.ts",
+    "redscope:egress": "bun run scripts/redscope-egress-policy.ts",
+    "redscope:publish-guard": "bun run scripts/redscope-publish-guard.ts",
+    "postinstall": "node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs",
+    "docs:dev": "npx mintlify dev",
+    "typecheck": "tsc --noEmit",
+    "test:all": "bun run typecheck && bun test",
+    "rcs": "bun run scripts/rcs.ts"
+  },
+  "dependencies": {
+    "@agentclientprotocol/sdk": "^0.19.0",
+    "@redscope-ai/mcp-chrome-bridge": "^1.0.0",
+    "highlight.js": "^11.11.1",
+    "ws": "^8.20.0"
+  },
+  "devDependencies": {
+    "@alcalzone/ansi-tokenize": "^0.3.0",
+    "@ant/model-provider": "workspace:*",
+    "@ant/claude-for-chrome-mcp": "workspace:*",
+    "@ant/computer-use-input": "workspace:*",
+    "@ant/computer-use-mcp": "workspace:*",
+    "@ant/computer-use-swift": "workspace:*",
+    "@anthropic-ai/bedrock-sdk": "^0.29.0",
+    "@anthropic-ai/claude-agent-sdk": "^0.2.114",
+    "@anthropic-ai/foundry-sdk": "^0.2.3",
+    "@anthropic-ai/mcpb": "^2.1.2",
+    "@anthropic-ai/sandbox-runtime": "^0.0.44",
+    "@anthropic-ai/sdk": "^0.81.0",
+    "@anthropic-ai/vertex-sdk": "^0.16.0",
+    "@anthropic/ink": "workspace:*",
+    "@aws-sdk/client-bedrock": "^3.1037.0",
+    "@aws-sdk/client-bedrock-runtime": "^3.1037.0",
+    "@aws-sdk/client-sts": "^3.1037.0",
+    "@aws-sdk/credential-provider-node": "^3.972.36",
+    "@aws-sdk/credential-providers": "^3.1037.0",
+    "@azure/identity": "^4.13.1",
+    "@biomejs/biome": "^2.4.12",
+    "@redscope-ai/agent-tools": "workspace:*",
+    "@redscope-ai/builtin-tools": "workspace:*",
+    "@redscope-ai/mcp-client": "workspace:*",
+    "@redscope-ai/weixin": "workspace:*",
+    "@commander-js/extra-typings": "^14.0.0",
+    "@growthbook/growthbook": "^1.6.5",
+    "@langfuse/otel": "^5.1.0",
+    "@langfuse/tracing": "^5.1.0",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@opentelemetry/api": "^1.9.1",
+    "@opentelemetry/api-logs": "^0.215.0",
+    "@opentelemetry/core": "^2.7.0",
+    "@opentelemetry/exporter-logs-otlp-grpc": "^0.215.0",
+    "@opentelemetry/exporter-logs-otlp-http": "^0.215.0",
+    "@opentelemetry/exporter-logs-otlp-proto": "^0.215.0",
+    "@opentelemetry/exporter-metrics-otlp-grpc": "^0.215.0",
+    "@opentelemetry/exporter-metrics-otlp-http": "^0.215.0",
+    "@opentelemetry/exporter-metrics-otlp-proto": "^0.215.0",
+    "@opentelemetry/exporter-prometheus": "^0.215.0",
+    "@opentelemetry/exporter-trace-otlp-grpc": "^0.215.0",
+    "@opentelemetry/exporter-trace-otlp-http": "^0.215.0",
+    "@opentelemetry/exporter-trace-otlp-proto": "^0.215.0",
+    "@opentelemetry/resources": "^2.7.0",
+    "@opentelemetry/sdk-logs": "^0.215.0",
+    "@opentelemetry/sdk-metrics": "^2.7.0",
+    "@opentelemetry/sdk-trace-base": "^2.7.0",
+    "@opentelemetry/semantic-conventions": "^1.40.0",
+    "@sentry/node": "^10.49.0",
+    "@smithy/core": "^3.23.15",
+    "@smithy/node-http-handler": "^4.5.3",
+    "@types/bun": "^1.3.12",
+    "@types/cacache": "^20.0.1",
+    "@types/he": "^1.2.3",
+    "@types/lodash-es": "^4.17.12",
+    "@types/node": "^25.6.0",
+    "@types/picomatch": "^4.0.3",
+    "@types/plist": "^3.0.5",
+    "@types/proper-lockfile": "^4.1.4",
+    "@types/qrcode": "^1.5.6",
+    "@types/react": "^19.2.14",
+    "@types/react-reconciler": "^0.33.0",
+    "@types/semver": "^7.7.1",
+    "@types/sharp": "^0.32.0",
+    "@types/shell-quote": "^1.7.5",
+    "@types/stack-utils": "^2.0.3",
+    "@types/turndown": "^5.0.6",
+    "@types/ws": "^8.18.1",
+    "ajv": "^8.18.0",
+    "asciichart": "^1.5.25",
+    "audio-capture-napi": "workspace:*",
+    "auto-bind": "^5.0.1",
+    "axios": "^1.15.2",
+    "bidi-js": "^1.0.3",
+    "cacache": "^20.0.4",
+    "chalk": "^5.6.2",
+    "chokidar": "^5.0.0",
+    "cli-boxes": "^4.0.1",
+    "cli-highlight": "^2.1.11",
+    "code-excerpt": "^4.0.0",
+    "color-diff-napi": "workspace:*",
+    "diff": "^8.0.4",
+    "emoji-regex": "^10.6.0",
+    "env-paths": "^4.0.0",
+    "execa": "^9.6.1",
+    "fflate": "^0.8.2",
+    "figures": "^6.1.0",
+    "fuse.js": "^7.3.0",
+    "get-east-asian-width": "^1.5.0",
+    "google-auth-library": "^10.6.2",
+    "he": "^1.2.0",
+    "https-proxy-agent": "^8.0.0",
+    "ignore": "^7.0.5",
+    "image-processor-napi": "workspace:*",
+    "indent-string": "^5.0.0",
+    "jsonc-parser": "^3.3.1",
+    "knip": "^6.4.1",
+    "lodash-es": "^4.18.1",
+    "lru-cache": "^11.3.5",
+    "marked": "^17.0.6",
+    "modifiers-napi": "workspace:*",
+    "openai": "^6.34.0",
+    "p-map": "^7.0.4",
+    "picomatch": "^4.0.4",
+    "plist": "^3.1.0",
+    "proper-lockfile": "^4.1.2",
+    "qrcode": "^1.5.4",
+    "react": "^19.2.5",
+    "react-compiler-runtime": "^1.0.0",
+    "react-reconciler": "^0.33.0",
+    "rollup": "^4.60.2",
+    "semver": "^7.7.4",
+    "sharp": "^0.34.5",
+    "shell-quote": "^1.8.3",
+    "signal-exit": "^4.1.0",
+    "stack-utils": "^2.0.6",
+    "strip-ansi": "^7.2.0",
+    "supports-hyperlinks": "^4.4.0",
+    "tree-kill": "^1.2.2",
+    "turndown": "^7.2.4",
+    "type-fest": "^5.6.0",
+    "typescript": "^6.0.3",
+    "undici": "^7.25.0",
+    "url-handler-napi": "workspace:*",
+    "usehooks-ts": "^3.1.1",
+    "vite": "^8.0.8",
+    "vscode-jsonrpc": "^8.2.1",
+    "vscode-languageserver-protocol": "^3.17.5",
+    "vscode-languageserver-types": "^3.17.5",
+    "wrap-ansi": "^10.0.0",
+    "xss": "^1.0.15",
+    "yaml": "^2.8.3",
+    "zod": "^4.3.6"
+  },
+  "optionalDependencies": {
+    "doubaoime-asr": "^0.1.0"
+  },
+  "overrides": {
+    "@inquirer/prompts": "8.4.2",
+    "@xmldom/xmldom": "0.8.13",
+    "follow-redirects": "1.16.0",
+    "hono": "4.12.15",
+    "postcss": "8.5.10",
+    "uuid": "14.0.0"
+  }
+}

package/scripts/chrome-mcp-bridge-resolver.mjs

@@ -0,0 +1,43 @@
+import { existsSync } from "node:fs";
+import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
+
+const REDSCOPE_BRIDGE_PACKAGE = "@redscope-ai/mcp-chrome-bridge";
+const BRIDGE_CLI_SUBPATH = "dist/cli.js";
+
+export function getLocalRedScopeBridgeCliPath(baseUrl = import.meta.url) {
+  return fileURLToPath(
+    new URL("../packages/mcp-chrome-bridge/dist/cli.js", baseUrl),
+  );
+}
+
+export function resolveChromeMcpBridgeCliPath({
+  baseUrl = import.meta.url,
+  exists = existsSync,
+  requireFn = createRequire(import.meta.url),
+} = {}) {
+  const localRedScopeCliPath = getLocalRedScopeBridgeCliPath(baseUrl);
+  if (exists(localRedScopeCliPath)) {
+    return {
+      cliPath: localRedScopeCliPath,
+      packageName: REDSCOPE_BRIDGE_PACKAGE,
+      source: "workspace",
+    };
+  }
+
+  try {
+    return {
+      cliPath: requireFn.resolve(
+        `${REDSCOPE_BRIDGE_PACKAGE}/${BRIDGE_CLI_SUBPATH}`,
+      ),
+      packageName: REDSCOPE_BRIDGE_PACKAGE,
+      source: "package",
+    };
+  } catch {
+    // Fall through to the RedScope-scoped install error below.
+  }
+
+  throw new Error(
+    `Unable to locate Chrome MCP bridge CLI. Install ${REDSCOPE_BRIDGE_PACKAGE}.`,
+  );
+}

package/scripts/chrome-mcp-env.mjs

@@ -0,0 +1,19 @@
+const TRUTHY_VALUES = new Set(["1", "true", "yes", "on"]);
+
+export const REDSCOPE_SKIP_CHROME_MCP_SETUP =
+  "REDSCOPE_SKIP_CHROME_MCP_SETUP";
+export const LEGACY_SKIP_CHROME_MCP_SETUP =
+  "CLAUDE_CODE_SKIP_CHROME_MCP_SETUP";
+
+export function isTruthyEnvValue(value) {
+  if (value === undefined || value === null) return false;
+  if (typeof value === "boolean") return value;
+  return TRUTHY_VALUES.has(String(value).trim().toLowerCase());
+}
+
+export function shouldSkipChromeMcpSetup(env = process.env) {
+  return (
+    isTruthyEnvValue(env[REDSCOPE_SKIP_CHROME_MCP_SETUP]) ||
+    isTruthyEnvValue(env[LEGACY_SKIP_CHROME_MCP_SETUP])
+  );
+}

package/scripts/postinstall.cjs

@@ -0,0 +1,339 @@
+#!/usr/bin/env node
+/**
+ * Postinstall script — runs automatically after `bun install` or `npm install`.
+ *
+ * Downloads ripgrep binary (idempotent, skips if exists).
+ * Works in dev mode (src/ exists), published mode (dist/ exists), with bun or node.
+ *
+ * Usage:
+ *   node scripts/postinstall.js
+ *   node scripts/postinstall.js --force
+ *   bun run scripts/postinstall.js
+ */
+
+const { existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync, chmodSync } =
+  require("fs")
+const { spawnSync } = require("child_process")
+const { setDefaultResultOrder } = require("node:dns")
+const path = require("path")
+const os = require("os")
+
+// Prefer IPv4 first — Bun on Windows sometimes fails GitHub over broken IPv6 paths.
+try {
+  setDefaultResultOrder("ipv4first")
+} catch {
+  /* ignore */
+}
+
+// --- Config ---
+
+const RG_VERSION = "15.0.1"
+const DEFAULT_RELEASE_BASE = `https://github.com/microsoft/ripgrep-prebuilt/releases/download/v${RG_VERSION}`
+const MIRROR_RELEASE_BASE = `https://ghproxy.net/https://github.com/microsoft/ripgrep-prebuilt/releases/download/v${RG_VERSION}`
+const RELEASE_BASE = (process.env.RIPGREP_DOWNLOAD_BASE ?? DEFAULT_RELEASE_BASE).replace(/\/$/, "")
+
+const scriptDir = path.dirname(__filename)
+const projectRoot = path.resolve(scriptDir, "..")
+
+// --- Platform mapping ---
+
+function getPlatformMapping() {
+  const arch = process.arch
+  const platform = process.platform
+
+  if (platform === "darwin") {
+    if (arch === "arm64") return { target: "aarch64-apple-darwin", ext: "tar.gz" }
+    if (arch === "x64") return { target: "x86_64-apple-darwin", ext: "tar.gz" }
+    throw new Error(`Unsupported macOS arch: ${arch}`)
+  }
+
+  if (platform === "win32") {
+    if (arch === "x64") return { target: "x86_64-pc-windows-msvc", ext: "zip" }
+    if (arch === "arm64") return { target: "aarch64-pc-windows-msvc", ext: "zip" }
+    throw new Error(`Unsupported Windows arch: ${arch}`)
+  }
+
+  if (platform === "linux") {
+    const isMusl = detectMusl()
+    if (arch === "x64") {
+      return { target: "x86_64-unknown-linux-musl", ext: "tar.gz" }
+    }
+    if (arch === "arm64") {
+      return isMusl
+        ? { target: "aarch64-unknown-linux-musl", ext: "tar.gz" }
+        : { target: "aarch64-unknown-linux-gnu", ext: "tar.gz" }
+    }
+    throw new Error(`Unsupported Linux arch: ${arch}`)
+  }
+
+  throw new Error(`Unsupported platform: ${platform}`)
+}
+
+function detectMusl() {
+  const muslArch = process.arch === "x64" ? "x86_64" : "aarch64"
+  try {
+    statSync(`/lib/libc.musl-${muslArch}.so.1`)
+    return true
+  } catch {
+    return false
+  }
+}
+
+// --- Paths ---
+
+function getVendorDir() {
+  if (existsSync(path.join(projectRoot, "src"))) {
+    return path.resolve(projectRoot, "src", "utils", "vendor", "ripgrep")
+  }
+  return path.resolve(projectRoot, "dist", "vendor", "ripgrep")
+}
+
+function getBinaryPath() {
+  const dir = getVendorDir()
+  const subdir = `${process.arch}-${process.platform}`
+  const binary = process.platform === "win32" ? "rg.exe" : "rg"
+  return path.resolve(dir, subdir, binary)
+}
+
+// --- Download helpers ---
+
+function proxyEnvSet() {
+  const v = (s) => (s ?? "").trim()
+  return !!(v(process.env.HTTPS_PROXY) || v(process.env.HTTP_PROXY) || v(process.env.ALL_PROXY) || v(process.env.https_proxy) || v(process.env.http_proxy))
+}
+
+function tryPowerShellDownload(url, dest) {
+  const u = url.replace(/'/g, "''")
+  const d = dest.replace(/'/g, "''")
+  const cmd = `Invoke-WebRequest -Uri '${u}' -OutFile '${d}' -UseBasicParsing`
+  const result = spawnSync(
+    "powershell.exe",
+    ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command", cmd],
+    { stdio: "pipe", windowsHide: true },
+  )
+  return result.status === 0 && existsSync(dest) && statSync(dest).size > 0
+}
+
+function tryCurlDownload(url, dest) {
+  const curl = process.platform === "win32" ? "curl.exe" : "curl"
+  const result = spawnSync(curl, ["-fsSL", "-L", "--fail", "-o", dest, url], {
+    stdio: "pipe",
+    windowsHide: true,
+  })
+  return result.status === 0 && existsSync(dest) && statSync(dest).size > 0
+}
+
+async function fetchRelease(url) {
+  if (proxyEnvSet()) {
+    // Dynamic require so it works in node without bundling issues
+    const undici = require("undici")
+    return await undici.fetch(url, {
+      redirect: "follow",
+      dispatcher: new undici.EnvHttpProxyAgent(),
+    })
+  }
+  // Node 18+ has global fetch, Bun has it too
+  return await fetch(url, { redirect: "follow" })
+}
+
+async function downloadUrlToBuffer(url) {
+  const response = await fetchRelease(url)
+  if (!response.ok) {
+    throw new Error(`Download failed: ${response.status} ${response.statusText}`)
+  }
+  return Buffer.from(await response.arrayBuffer())
+}
+
+async function downloadUrlToBufferWithFallback(url) {
+  let firstError
+  try {
+    return await downloadUrlToBuffer(url)
+  } catch (e) {
+    firstError = e
+  }
+
+  const tmpRoot = path.join(os.tmpdir(), `ripgrep-dl-${process.pid}-${Date.now()}`)
+  const tmpFile = path.join(tmpRoot, "archive")
+  mkdirSync(tmpRoot, { recursive: true })
+  try {
+    if (process.platform === "win32" && tryPowerShellDownload(url, tmpFile)) {
+      return readFileSync(tmpFile)
+    }
+    if (tryCurlDownload(url, tmpFile)) {
+      return readFileSync(tmpFile)
+    }
+  } finally {
+    rmSync(tmpRoot, { recursive: true, force: true })
+  }
+
+  throw firstError
+}
+
+// --- Extract ---
+
+function findZipEntryKey(files, want) {
+  return Object.keys(files).find((k) => {
+    const norm = k.replace(/\\/g, "/")
+    return norm === want || norm.endsWith(`/${want}`)
+  })
+}
+
+async function extractZip(buffer, binaryPath, extractedBinary) {
+  const binaryDir = path.dirname(binaryPath)
+  // Try fflate first (bundled dep)
+  let fflateError
+  try {
+    const { unzipSync } = require("fflate")
+    const unzipped = unzipSync(new Uint8Array(buffer))
+    const key = findZipEntryKey(unzipped, extractedBinary)
+    if (!key) {
+      throw new Error(`Binary ${extractedBinary} not found in zip`)
+    }
+    writeFileSync(binaryPath, Buffer.from(unzipped[key]))
+    return
+  } catch (e) {
+    fflateError = e
+  }
+
+  // Fallback: PowerShell Expand-Archive or unzip CLI
+  const tmpDir = path.join(binaryDir, ".tmp-download")
+  rmSync(tmpDir, { recursive: true, force: true })
+  mkdirSync(tmpDir, { recursive: true })
+  try {
+    const assetName = `archive.zip`
+    const archivePath = path.join(tmpDir, assetName)
+    writeFileSync(archivePath, buffer)
+
+    let extracted = false
+    if (process.platform === "win32") {
+      const psCmd = `Expand-Archive -Path '${archivePath.replace(/'/g, "''")}' -DestinationPath '${tmpDir.replace(/'/g, "''")}' -Force`
+      const psResult = spawnSync(
+        "powershell.exe",
+        ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command", psCmd],
+        { stdio: "pipe", windowsHide: true },
+      )
+      if (psResult.status === 0) {
+        extracted = true
+      }
+    }
+
+    if (!extracted) {
+      const result = spawnSync("unzip", ["-o", archivePath, "-d", tmpDir], { stdio: "pipe" })
+      if (result.status !== 0) {
+        const unzipErr = result.stderr?.toString().trim() || "command not found"
+        const fflateMsg = fflateError instanceof Error ? fflateError.message : String(fflateError)
+        throw new Error(`zip extraction failed (fflate: ${fflateMsg}; unzip: ${unzipErr})`)
+      }
+    }
+
+    const srcBinary = path.join(tmpDir, extractedBinary)
+    if (!existsSync(srcBinary)) {
+      throw new Error(`Binary not found at expected path: ${srcBinary}`)
+    }
+    renameSync(srcBinary, binaryPath)
+  } finally {
+    rmSync(tmpDir, { recursive: true, force: true })
+  }
+}
+
+async function extractTarGz(buffer, binaryPath, extractedBinary, assetName) {
+  const binaryDir = path.dirname(binaryPath)
+  const tmpDir = path.join(binaryDir, ".tmp-download")
+  rmSync(tmpDir, { recursive: true, force: true })
+  mkdirSync(tmpDir, { recursive: true })
+  try {
+    const archivePath = path.join(tmpDir, assetName)
+    writeFileSync(archivePath, buffer)
+    const result = spawnSync("tar", ["xzf", archivePath, "-C", tmpDir], { stdio: "pipe" })
+    if (result.status !== 0) {
+      throw new Error(`tar extract failed: ${result.stderr?.toString()}`)
+    }
+    const srcBinary = path.join(tmpDir, extractedBinary)
+    if (!existsSync(srcBinary)) {
+      throw new Error(`Binary not found at expected path: ${srcBinary}`)
+    }
+    renameSync(srcBinary, binaryPath)
+  } finally {
+    rmSync(tmpDir, { recursive: true, force: true })
+  }
+}
+
+// --- Main ---
+
+async function downloadAndExtract() {
+  const { target, ext } = getPlatformMapping()
+  const assetName = `ripgrep-v${RG_VERSION}-${target}.${ext}`
+
+  const binaryPath = getBinaryPath()
+  const binaryDir = path.dirname(binaryPath)
+
+  const force = process.argv.includes("--force")
+  if (!force && existsSync(binaryPath)) {
+    const stat = statSync(binaryPath)
+    if (stat.size > 0) {
+      console.log(`[ripgrep] Binary already exists at ${binaryPath}, skipping.`)
+      return
+    }
+  }
+
+  console.log(`[ripgrep] Downloading v${RG_VERSION} for ${target}...`)
+
+  const extractedBinary = process.platform === "win32" ? "rg.exe" : "rg"
+
+  const mirrors = [RELEASE_BASE]
+  if (RELEASE_BASE === DEFAULT_RELEASE_BASE.replace(/\/$/, "")) {
+    mirrors.push(MIRROR_RELEASE_BASE.replace(/\/$/, ""))
+  }
+
+  let buffer
+  let lastError
+  for (const base of mirrors) {
+    const url = `${base}/${assetName}`
+    try {
+      console.log(`[ripgrep] Trying ${url}`)
+      buffer = await downloadUrlToBufferWithFallback(url)
+      break
+    } catch (e) {
+      console.warn(`[ripgrep] Download from ${base} failed: ${e instanceof Error ? e.message : e}`)
+      lastError = e
+    }
+  }
+  if (!buffer) {
+    throw lastError
+  }
+
+  try {
+    console.log(`[ripgrep] Downloaded ${Math.round(buffer.length / 1024)} KB`)
+
+    mkdirSync(binaryDir, { recursive: true })
+
+    if (ext === "tar.gz") {
+      await extractTarGz(buffer, binaryPath, extractedBinary, assetName)
+    } else {
+      await extractZip(buffer, binaryPath, extractedBinary)
+    }
+
+    if (process.platform !== "win32") {
+      chmodSync(binaryPath, 0o755)
+    }
+
+    console.log(`[ripgrep] Installed to ${binaryPath}`)
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e)
+    const hint =
+      "Check network or set HTTPS_PROXY. If GitHub is blocked, set RIPGREP_DOWNLOAD_BASE to a mirror (see script header)."
+    throw new Error(`${msg} ${hint}`)
+  }
+}
+
+async function main() {
+  await downloadAndExtract()
+}
+
+main().catch((error) => {
+  const msg = error instanceof Error ? error.message : String(error)
+  console.error(`[postinstall] ripgrep download failed (non-fatal): ${msg}`)
+  console.error(`[postinstall] You can install ripgrep manually: https://github.com/BurntSushi/ripgrep#installation`)
+  // Never exit with error code — postinstall must not break install
+  process.exit(0)
+})

package/scripts/run-parallel.mjs

@@ -0,0 +1,10 @@
+import { spawn } from "node:child_process"
+
+const scripts = process.argv.slice(2)
+if (scripts.length === 0) {
+  process.exit(0)
+}
+
+for (const script of scripts) {
+  spawn(process.execPath, [script], { stdio: "inherit", shell: false })
+}