@tuel/code-oz 0.20.0-alpha.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Omer Akben (Ozzy)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,70 @@
+# code-oz
+
+Repo-native agentic SDLC runtime that makes AI code pass through debate, evidence, and cross-family review before it can ship.
+
+[![Tests](https://github.com/omerakben/code-oz/actions/workflows/test.yml/badge.svg)](https://github.com/omerakben/code-oz/actions/workflows/test.yml)
+[![Release](https://github.com/omerakben/code-oz/actions/workflows/release.yml/badge.svg)](https://github.com/omerakben/code-oz/actions/workflows/release.yml)
+[![npm version](https://img.shields.io/npm/v/@tuel/code-oz.svg)](https://www.npmjs.com/package/@tuel/code-oz)
+[![Homebrew](https://img.shields.io/badge/Homebrew-omerakben%2Fcode--oz-orange)](https://github.com/omerakben/homebrew-code-oz)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+[![Platform](https://img.shields.io/badge/platform-macOS%20%7C%20Linux-lightgrey)](https://github.com/omerakben/code-oz/releases)
+[![Tests passing](https://img.shields.io/badge/tests-3366%20passing-brightgreen)](https://github.com/omerakben/code-oz/actions/workflows/test.yml)
+
+> **macOS note:** code-oz binaries are not yet Apple-Developer-signed (signing + notarization deferred to v0.x stable). Gatekeeper may prompt on first launch; the install script applies `xattr -d com.apple.quarantine` as a workaround, and `brew install` handles this automatically.
+
+## Install
+
+Three channels deliver the same single binary, verified against the same `checksums.txt`.
+
+```sh
+# curl | sh
+curl -fsSL https://github.com/omerakben/code-oz/releases/download/v0.20.0-alpha.0/install.sh \
+  | sh -s -- --version v0.20.0-alpha.0
+
+# npm (scoped under the TUEL AI publisher; binary still runs as `code-oz`)
+npm install -g @tuel/code-oz
+
+# Homebrew
+brew tap omerakben/code-oz
+brew install omerakben/code-oz/code-oz
+```
+
+Platform support: macOS arm64, macOS x64, Linux x64, Linux arm64. Windows + Scoop are deferred to v0.20.1.
+
+## What it is
+
+`code-oz` is a standalone terminal CLI that runs your favorite coding agents (Claude, Codex, Gemini, OpenCode, Roo Code) through a real software delivery lifecycle. It coordinates role-specialized agents over a hybrid phase-graph + agentic sub-orchestration spine with hard gates between phases, file-based state, and cross-family adversarial review. The tool runs on the user's own Claude / Codex / Gemini CLI subscriptions (via SDKs that read CLI OAuth tokens from disk). No API keys required for the supported families.
+
+Phases (greenfield): `DEFINE → PLAN → BUILD → VERIFY → REVIEW → SHIP`. Phases (brownfield): `AUDIT → PLAN → BUILD → VERIFY → REVIEW → SHIP`. Auto-detected on boot.
+
+## Demo
+
+A 5-minute runnable end-to-end walkthrough lives in [`docs/demo/01-todo-cli/`](docs/demo/01-todo-cli/README.md). One full DEFINE → SHIP cycle on a greenfield todo CLI via `FakeProvider`, all 5 gate files, cross-family REVIEW (BUILD on Claude family, REVIEW on Codex family), `--effort` envelope captures at three levels, and the full `events.jsonl` ledger. Captured outputs at all three effort levels are committed under `docs/demo/01-todo-cli/output/` so you can read the produced artifacts without running anything.
+
+```sh
+bun run demo:todo-cli                # default (balanced)
+bun run demo:todo-cli --effort lite  # multiplier 0.4
+bun run demo:todo-cli --effort beast # multiplier 6.0
+```
+
+## Try it from source
+
+```sh
+git clone https://github.com/omerakben/code-oz.git
+cd code-oz && bun install && bun test
+bun run build:binary
+
+mkdir /tmp/code-oz-smoke && cd /tmp/code-oz-smoke
+~/Projects/code-oz/dist/code-oz init
+~/Projects/code-oz/dist/code-oz doctor tools
+```
+
+## Status
+
+`v0.20.0-alpha.0` — first release with official install channels (curl|sh, npm, Homebrew). 3366 tests pass offline; live xAI integration gated behind opt-in env flags.
+
+See [`docs/ABOUT.md`](docs/ABOUT.md) for the milestone inventory, product thesis, influence library, and architecture deep-dive. The milestone plan beyond v0.20 lives in [`docs/design/ROADMAP.md`](docs/design/ROADMAP.md).
+
+## License
+
+MIT. See [LICENSE](LICENSE).

package/npm-wrapper/index.cjs

@@ -0,0 +1,197 @@
+#!/usr/bin/env node
+
+// code-oz npm launcher. Reads the package version, resolves the platform
+// binary from ~/.cache/code-oz/<version>/code-oz (downloading + verifying it
+// on cache miss), then execs it with the user's argv. No bun dependency on
+// the user's machine. No postinstall hook (runs on first invocation), so
+// survives `npm ci --ignore-scripts`.
+//
+// Override hooks (test/internal only — never set in production):
+//   CODE_OZ_NPM_BASE_URL   base URL containing tarballs + checksums.txt
+//                          (defaults to the GitHub release for this version)
+//   CODE_OZ_NPM_CACHE_DIR  cache root (defaults to $HOME/.cache/code-oz)
+
+'use strict'
+
+const fs = require('node:fs')
+const os = require('node:os')
+const path = require('node:path')
+const { createHash } = require('node:crypto')
+const { spawn, spawnSync } = require('node:child_process')
+const { Readable } = require('node:stream')
+const { pipeline } = require('node:stream/promises')
+
+const GH_OWNER = 'omerakben'
+const GH_REPO = 'code-oz'
+
+function die(message) {
+  process.stderr.write(`code-oz launcher: ${message}\n`)
+  process.exit(1)
+}
+
+function readPackageVersion() {
+  const pkgPath = path.join(__dirname, '..', 'package.json')
+  let raw
+  try {
+    raw = fs.readFileSync(pkgPath, 'utf8')
+  } catch (err) {
+    die(`cannot read ${pkgPath}: ${err.message}`)
+  }
+  let parsed
+  try {
+    parsed = JSON.parse(raw)
+  } catch (err) {
+    die(`package.json is not valid JSON: ${err.message}`)
+  }
+  if (typeof parsed.version !== 'string' || parsed.version.length === 0) {
+    die('package.json missing string "version"')
+  }
+  return parsed.version
+}
+
+function detectPlatform() {
+  if (process.platform !== 'darwin' && process.platform !== 'linux') {
+    die(
+      `unsupported platform: ${process.platform}. Supported: darwin, linux. ` +
+        'Windows is deferred to v0.20.1.',
+    )
+  }
+  if (process.arch !== 'arm64' && process.arch !== 'x64') {
+    die(`unsupported architecture: ${process.arch}. Supported: arm64, x64.`)
+  }
+  return { os: process.platform, arch: process.arch }
+}
+
+async function download(url, destination) {
+  if (url.startsWith('file://')) {
+    const sourcePath = url.slice('file://'.length)
+    if (!fs.existsSync(sourcePath)) {
+      throw new Error(`source file does not exist: ${sourcePath}`)
+    }
+    await fs.promises.copyFile(sourcePath, destination)
+    return
+  }
+  const protocol = url.startsWith('https://') ? require('node:https') : require('node:http')
+  await new Promise((resolve, reject) => {
+    const request = protocol.get(url, (response) => {
+      const status = response.statusCode ?? 0
+      if (status >= 300 && status < 400 && response.headers.location) {
+        response.resume()
+        download(response.headers.location, destination).then(resolve, reject)
+        return
+      }
+      if (status < 200 || status >= 300) {
+        response.resume()
+        reject(new Error(`HTTP ${status} for ${url}`))
+        return
+      }
+      const fileStream = fs.createWriteStream(destination)
+      pipeline(Readable.from(response), fileStream).then(resolve, reject)
+    })
+    request.on('error', reject)
+    request.setTimeout(60_000, () => {
+      request.destroy(new Error(`timeout downloading ${url}`))
+    })
+  })
+}
+
+function sha256File(filePath) {
+  const hash = createHash('sha256')
+  hash.update(fs.readFileSync(filePath))
+  return hash.digest('hex')
+}
+
+function findChecksumEntry(text, assetName) {
+  const lines = text.split(/\r?\n/)
+  for (const line of lines) {
+    if (line.length === 0) continue
+    const match = line.match(/^([0-9a-f]+)\s+\*?(.+)$/i)
+    if (!match) continue
+    const [, sha, name] = match
+    if (name.trim() === assetName) return sha.toLowerCase()
+  }
+  return null
+}
+
+function extractTarball(tarballPath, destinationDir) {
+  const result = spawnSync('tar', ['-C', destinationDir, '-xzf', tarballPath], {
+    stdio: ['ignore', 'inherit', 'inherit'],
+  })
+  if (result.status !== 0) {
+    throw new Error(`tar exited with status ${result.status}`)
+  }
+}
+
+async function ensureBinary({ version, host, cacheRoot, baseUrl }) {
+  const cacheDir = path.join(cacheRoot, version)
+  const cachedBinary = path.join(cacheDir, 'code-oz')
+  if (fs.existsSync(cachedBinary)) return cachedBinary
+
+  await fs.promises.mkdir(cacheDir, { recursive: true })
+  const stageName = `code-oz-v${version}-${host.os}-${host.arch}`
+  const assetName = `${stageName}.tar.gz`
+  const tarballPath = path.join(cacheDir, assetName)
+  const checksumsPath = path.join(cacheDir, 'checksums.txt')
+
+  try {
+    await download(`${baseUrl}/${assetName}`, tarballPath)
+  } catch (err) {
+    throw new Error(`failed to download ${baseUrl}/${assetName}: ${err.message}`)
+  }
+  try {
+    await download(`${baseUrl}/checksums.txt`, checksumsPath)
+  } catch (err) {
+    throw new Error(`failed to download ${baseUrl}/checksums.txt: ${err.message}`)
+  }
+
+  const checksumsText = fs.readFileSync(checksumsPath, 'utf8')
+  const expectedSha = findChecksumEntry(checksumsText, assetName)
+  if (!expectedSha) {
+    throw new Error(`no checksum entry for ${assetName} in checksums.txt at ${baseUrl}`)
+  }
+  const actualSha = sha256File(tarballPath)
+  if (actualSha !== expectedSha) {
+    throw new Error(`checksum mismatch for ${assetName}: expected ${expectedSha}, got ${actualSha}`)
+  }
+
+  extractTarball(tarballPath, cacheDir)
+  const stagedBinary = path.join(cacheDir, stageName, 'code-oz')
+  if (!fs.existsSync(stagedBinary)) {
+    throw new Error(`extracted tarball missing binary at ${stagedBinary}`)
+  }
+
+  await fs.promises.copyFile(stagedBinary, cachedBinary)
+  await fs.promises.chmod(cachedBinary, 0o755)
+  await fs.promises.rm(path.join(cacheDir, stageName), { recursive: true, force: true })
+  await fs.promises.rm(tarballPath, { force: true })
+  await fs.promises.rm(checksumsPath, { force: true })
+  return cachedBinary
+}
+
+async function main() {
+  const version = readPackageVersion()
+  const host = detectPlatform()
+  const cacheRoot = process.env.CODE_OZ_NPM_CACHE_DIR
+    || path.join(os.homedir(), '.cache', 'code-oz')
+  const baseUrl = process.env.CODE_OZ_NPM_BASE_URL
+    || `https://github.com/${GH_OWNER}/${GH_REPO}/releases/download/v${version}`
+
+  let binary
+  try {
+    binary = await ensureBinary({ version, host, cacheRoot, baseUrl })
+  } catch (err) {
+    die(err.message)
+  }
+
+  const child = spawn(binary, process.argv.slice(2), { stdio: 'inherit' })
+  child.on('error', (err) => die(`failed to exec ${binary}: ${err.message}`))
+  child.on('exit', (code, signal) => {
+    if (signal) {
+      process.kill(process.pid, signal)
+      return
+    }
+    process.exit(code ?? 0)
+  })
+}
+
+main().catch((err) => die(err.message))

package/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "@tuel/code-oz",
+  "version": "0.20.0-alpha.0",
+  "description": "Multi-agent software-company simulation CLI with hard SDLC gates",
+  "type": "module",
+  "bin": {
+    "code-oz": "npm-wrapper/index.cjs"
+  },
+  "scripts": {
+    "test": "bun test",
+    "test:watch": "bun test --watch",
+    "dev": "bun run src/cli.ts",
+    "build:binary": "bun build --compile --target=bun src/cli.ts --outfile dist/code-oz",
+    "build:binaries": "bun run scripts/build-binaries.ts",
+    "smoke": "bun run scripts/smoke-test.ts",
+    "typecheck": "tsc --noEmit",
+    "eval:repo_context": "bun run scripts/eval-repo-context.ts",
+    "demo:todo-cli": "bun run scripts/demo/01-todo-cli/run-demo.ts"
+  },
+  "engines": {
+    "node": ">=18",
+    "bun": ">=1.3.0"
+  },
+  "license": "MIT",
+  "author": "Omer Akben (Ozzy)",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/omerakben/code-oz.git"
+  },
+  "homepage": "https://github.com/omerakben/code-oz",
+  "bugs": "https://github.com/omerakben/code-oz/issues",
+  "keywords": [
+    "ai",
+    "agents",
+    "claude",
+    "codex",
+    "gemini",
+    "sdlc",
+    "orchestrator",
+    "multi-agent",
+    "cli"
+  ],
+  "files": [
+    "npm-wrapper/",
+    "README.md",
+    "LICENSE"
+  ],
+  "devDependencies": {
+    "@types/bun": "^1.3.13",
+    "typescript": "^5.9.3"
+  },
+  "dependencies": {
+    "yaml": "^2.6.1"
+  }
+}