@twira/cli 2.0.1

package/LICENSE.md

@@ -0,0 +1,25 @@
+# Twira — Proprietary Software
+
+Copyright © Twira Ltd. All rights reserved.
+
+Twira is proprietary software, licensed (not sold) under the Twira
+End User Licence Agreement (EULA). By downloading, installing, or using this
+software you agree to the EULA.
+
+**The full, binding EULA is maintained in one place — our website:**
+https://twira.com/legal/eula
+
+Related terms:
+
+- Subscription Terms — https://twira.com/legal/terms
+- Privacy Policy — https://twira.com/legal/privacy
+- Data Processing Addendum — https://twira.com/legal/dpa
+
+## Summary (the EULA at the link above is authoritative)
+
+- **Personal Use** — free, for ever. No signup, no card.
+- **Commercial Use** — 14-day free trial, then a Pro subscription.
+- **Education** — full Pro capability, free for verified students and staff.
+- **Enterprise** — bespoke; contact us.
+- You may not reverse engineer, redistribute, or use it to build a competing product.
+- The software is provided "as is", without warranty. See the EULA for full terms.

package/README.md

@@ -0,0 +1,48 @@
+<p align="center">
+  <img src="https://twira.com/brand/icon-512.png" width="96" alt="Twira">
+</p>
+
+<h1 align="center">Twira</h1>
+
+<p align="center">
+  Power tools for AI agents — fewer hallucinations, fewer tokens, faster work.
+</p>
+
+---
+
+Twira indexes your codebase locally and plugs into Claude Code, Codex, Gemini, and any MCP-compatible assistant. It gives your AI ground truth — fast, local, and deterministic. Your assistant gets sharper. You stay in flow.
+
+Zero dependencies. Runs locally. Your source code never leaves your machine.
+
+## Install
+
+```sh
+npm install -g @twira/cli
+```
+
+This package downloads the right native `twira` binary for your platform on install. Other channels:
+
+```sh
+# Homebrew (macOS / Linux)
+brew install twirahq/tap/twira
+
+# curl (macOS / Linux)
+curl -fsSL https://raw.githubusercontent.com/TwiraHQ/twira/main/install.sh | sh
+```
+
+## Get started
+
+```sh
+twira init      # set up Twira in your project
+twira index     # build the local code graph
+twira mcp       # run the MCP server your AI agent connects to
+```
+
+## Links
+
+- Website — https://twira.com
+- Documentation & releases — https://github.com/TwiraHQ/twira
+
+---
+
+The product is in alpha. The download works today.

package/bin/twira.js

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+"use strict";
+
+const { execFileSync } = require("child_process");
+const path = require("path");
+
+const ext = process.platform === "win32" ? ".exe" : "";
+const binary = path.join(__dirname, `twira${ext}`);
+
+try {
+  execFileSync(binary, process.argv.slice(2), { stdio: "inherit" });
+} catch (err) {
+  if (err.status !== null) {
+    process.exit(err.status);
+  }
+  console.error(`Failed to run Twira: ${err.message}`);
+  console.error(`Expected binary at: ${binary}`);
+  console.error(`Try reinstalling: npm install -g @twira/cli`);
+  process.exit(1);
+}

package/install.js

@@ -0,0 +1,189 @@
+#!/usr/bin/env node
+"use strict";
+
+const { execSync } = require("child_process");
+const fs = require("fs");
+const https = require("https");
+const path = require("path");
+const os = require("os");
+const { createHash } = require("crypto");
+
+const REPO = "TwiraHQ/twira";
+const BINARY_NAME = "twira";
+
+const PLATFORM_MAP = {
+  "darwin-x64": "x86_64-apple-darwin",
+  "darwin-arm64": "aarch64-apple-darwin",
+  "linux-x64": "x86_64-unknown-linux-gnu",
+  "linux-arm64": "aarch64-unknown-linux-gnu",
+  "win32-x64": "x86_64-pc-windows-msvc",
+  "win32-arm64": "aarch64-pc-windows-msvc",
+};
+
+const ARCHIVE_EXT = {
+  darwin: "tar.gz",
+  linux: "tar.gz",
+  win32: "zip",
+};
+
+function getPlatformTarget() {
+  const key = `${process.platform}-${process.arch}`;
+  const target = PLATFORM_MAP[key];
+  if (!target) {
+    console.error(`Unsupported platform: ${key}`);
+    console.error(`Supported: ${Object.keys(PLATFORM_MAP).join(", ")}`);
+    process.exit(1);
+  }
+  return target;
+}
+
+function getVersion() {
+  const pkg = require("./package.json");
+  // npm version may be "2.0.0-alpha.1" — tag is "v2.0.0-alpha.1"
+  return `v${pkg.version}`;
+}
+
+function fetch(url) {
+  return new Promise((resolve, reject) => {
+    const get = (url, redirectCount) => {
+      if (redirectCount > 5) return reject(new Error("Too many redirects"));
+      https
+        .get(url, { headers: { "User-Agent": "twira-npm-installer" } }, (res) => {
+          if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+            return get(res.headers.location, redirectCount + 1);
+          }
+          if (res.statusCode !== 200) {
+            return reject(new Error(`HTTP ${res.statusCode} for ${url}`));
+          }
+          const chunks = [];
+          res.on("data", (chunk) => chunks.push(chunk));
+          res.on("end", () => resolve(Buffer.concat(chunks)));
+          res.on("error", reject);
+        })
+        .on("error", reject);
+    };
+    get(url, 0);
+  });
+}
+
+async function downloadAndVerify(version, target) {
+  const ext = ARCHIVE_EXT[process.platform];
+  const archiveName = `${BINARY_NAME}-${version}-${target}.${ext}`;
+  const baseUrl = `https://github.com/${REPO}/releases/download/${version}`;
+
+  console.log(`Downloading Twira ${version} for ${target}...`);
+
+  // ES256 signature sidecar — present from v2.0.0-alpha.8 onwards. Older
+  // releases had no .sig file or legacy Ed25519 sigs that were never
+  // actually verified; we don't fail if it's missing or 404s.
+  let sigFile = null;
+  const [archive, checksumFile, sigResp] = await Promise.all([
+    fetch(`${baseUrl}/${archiveName}`),
+    fetch(`${baseUrl}/${archiveName}.sha256`),
+    fetchOptional(`${baseUrl}/${archiveName}.sig`),
+  ]);
+  if (sigResp) {
+    sigFile = sigResp;
+  }
+
+  // Verify checksum (mandatory — fails install if mismatch)
+  const expectedHash = checksumFile.toString("utf8").trim().split(/\s+/)[0];
+  const actualHash = createHash("sha256").update(archive).digest("hex");
+
+  if (expectedHash !== actualHash) {
+    console.error(`Checksum mismatch!`);
+    console.error(`  Expected: ${expectedHash}`);
+    console.error(`  Actual:   ${actualHash}`);
+    process.exit(1);
+  }
+
+  console.log("Checksum verified.");
+
+  // Note on cryptographic signature verification:
+  // The .sig file contains an ES256 (P-256 ECDSA) signature produced by
+  // the release-sign-prod key in our Azure Key Vault. We do NOT verify
+  // it in this npm postinstall hook to keep the surface area minimal at
+  // first-install time. Trust chain at install:
+  //
+  //   1. HTTPS to github.com  → authenticates the source
+  //   2. SHA-256 of archive   → verifies download integrity
+  //   3. npm provenance       → attests this package was published via
+  //                              our GitHub Actions release workflow
+  //
+  // After install, the binary's `twira update` flow performs full ES256
+  // verification against the embedded public key in keys/release.pub.
+  // Every subsequent update IS cryptographically verified.
+  //
+  // To verify the .sig at install time yourself, see SECURITY.md.
+  if (sigFile) {
+    console.log("ES256 signature available alongside (downloadable from GitHub Release page).");
+  }
+
+  return { archive, ext };
+}
+
+/**
+ * Like fetch() but returns null on 404 / missing instead of throwing.
+ * Used for the optional .sig sidecar.
+ */
+async function fetchOptional(url) {
+  try {
+    return await fetch(url);
+  } catch (_err) {
+    return null;
+  }
+}
+
+function extractBinary(archive, ext) {
+  const binDir = path.join(__dirname, "bin");
+  fs.mkdirSync(binDir, { recursive: true });
+
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "twira-"));
+  const archivePath = path.join(tmpDir, `archive.${ext}`);
+  fs.writeFileSync(archivePath, archive);
+
+  try {
+    if (ext === "tar.gz") {
+      execSync(`tar xzf "${archivePath}" -C "${binDir}"`, { stdio: "pipe" });
+    } else if (ext === "zip") {
+      // Windows: use PowerShell to extract
+      execSync(
+        `powershell -Command "Expand-Archive -Path '${archivePath}' -DestinationPath '${binDir}' -Force"`,
+        { stdio: "pipe" }
+      );
+    }
+  } finally {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  }
+
+  const binaryPath = path.join(binDir, process.platform === "win32" ? `${BINARY_NAME}.exe` : BINARY_NAME);
+
+  if (!fs.existsSync(binaryPath)) {
+    console.error(`Binary not found at ${binaryPath} after extraction.`);
+    process.exit(1);
+  }
+
+  if (process.platform !== "win32") {
+    fs.chmodSync(binaryPath, 0o755);
+  }
+
+  console.log(`Installed: ${binaryPath}`);
+}
+
+async function main() {
+  // Skip install in CI if TWIRA_SKIP_INSTALL is set
+  if (process.env.TWIRA_SKIP_INSTALL) {
+    console.log("TWIRA_SKIP_INSTALL set, skipping binary download.");
+    return;
+  }
+
+  const target = getPlatformTarget();
+  const version = getVersion();
+  const { archive, ext } = await downloadAndVerify(version, target);
+  extractBinary(archive, ext);
+}
+
+main().catch((err) => {
+  console.error(`Failed to install Twira: ${err.message}`);
+  process.exit(1);
+});

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "@twira/cli",
+  "version": "2.0.1",
+  "description": "Power tools for AI agents",
+  "license": "LicenseRef-Proprietary",
+  "homepage": "https://twira.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/TwiraHQ/twira.git"
+  },
+  "bin": {
+    "twira": "bin/twira.js"
+  },
+  "scripts": {
+    "postinstall": "node install.js"
+  },
+  "os": [
+    "darwin",
+    "linux",
+    "win32"
+  ],
+  "cpu": [
+    "x64",
+    "arm64"
+  ],
+  "keywords": [
+    "twira",
+    "code-intelligence",
+    "mcp",
+    "ai-coding",
+    "static-analysis",
+    "security",
+    "blast-radius"
+  ],
+  "files": [
+    "install.js",
+    "bin/twira.js",
+    "LICENSE.md"
+  ]
+}