corkcli 0.0.0-stage → 2.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Lithometric
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,32 @@
-# Temporary Holding Version
+# corkcli
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Your coding agents, working as a team. One command installs Cork for every repo on your machine: Claude Code, Codex and Cursor agents in the same repo see each other's changes as they happen, get briefed on the code they are about to touch, and can message each other.
+
+```sh
+npx corkcli
+```
+
+Free, no account, and nothing leaves your machine. Works on macOS, Linux and Windows (PowerShell, cmd or Git Bash).
+
+It downloads the `cork` program for your platform, checks it against its SHA-256 and Cork's release signature before running it, installs it into `~/.cork/bin`, connects your agent tools, and adds `cork` to your PATH.
+
+## Commands
+
+```sh
+npx corkcli            # install or update
+npx corkcli status     # what Cork did on this machine
+npx corkcli login      # link this machine to a Cork account
+npx corkcli upgrade    # bring in your team
+```
+
+After install, `cork <command>` works directly in a new terminal.
+
+## Installed before the rename
+
+Cork was called Collide, and this package was `collide-cli` (and `collidemcp` before that). It still answers as `collide`, `collide-cli` and `collidemcp`, so old instructions keep working. A machine set up then keeps its `~/.collide` folder, its account and its history: nothing is moved, and a `cork` is placed beside its `~/.collide/bin/collide`, so `cork <command>` works there too. Settings read `CORK_*` first, then the `COLLIDE_*` names from before.
+
+No Node? `curl -fsSL https://corkcli.com/install.sh | sh`, or with Python, `pipx run cork-sdk install`.
+
+Is the service up? On a machine signed in to an account, `cork status` adds one line from [corkcli.com/status](https://corkcli.com/status) (`Cork service: operational`, or what is not); agents can read [status.json](https://corkcli.com/status.json).
+
+More at [corkcli.com](https://corkcli.com).

package/bin/cork.js

@@ -0,0 +1,249 @@
+#!/usr/bin/env node
+// npx corkcli: Cork for every repo on this machine, in one command.
+// (It also answers as `cork`, and as `collide`, `collide-cli` and
+// `collidemcp`, its names before the rename, so old instructions work.)
+//
+// Downloads the cork program for this platform from Cork's releases,
+// checks it against its SHA-256 and CI's Ed25519 signature before it runs,
+// puts it in ~/.cork/bin, sets it up for Claude Code, Codex and Cursor,
+// and adds it to PATH. The same program the install script installs.
+//
+// A machine set up before the rename keeps its ~/.collide folder and its
+// ~/.collide/bin/collide for as long as no ~/.cork exists beside it (the
+// program picks the same folder, and puts a `cork` beside that `collide`).
+//
+//   npx corkcli              install (or update) Cork on this machine
+//   npx corkcli <command>    run a cork command: login, status, upgrade, ...
+//   npx corkcli --help       what it does, without installing anything
+
+"use strict";
+
+const crypto = require("node:crypto");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const { spawnSync } = require("node:child_process");
+
+/** A setting: CORK_X, else the COLLIDE_X it was called before the rename. */
+const setting = (name) => process.env[`CORK_${name}`] || process.env[`COLLIDE_${name}`] || "";
+
+const SERVER = (setting("INSTALL_SERVER") || "https://mcp.corkcli.com").replace(/\/+$/, "");
+const EXE = process.platform === "win32" ? ".exe" : "";
+
+/** Where Cork lives on this machine: ~/.cork with `cork`, or, on a machine
+ * set up before the rename, ~/.collide with its `collide` (kept, never
+ * moved, for as long as no ~/.cork exists beside it). */
+function layout() {
+  const home = setting("HOME") || os.homedir();
+  const cork = path.join(home, ".cork");
+  const collide = path.join(home, ".collide");
+  const legacy = !fs.existsSync(cork) && fs.existsSync(collide);
+  const dir = legacy ? collide : cork;
+  const name = legacy ? "collide" : "cork";
+  return { home, dir, legacy, bin: path.join(dir, "bin"), program: path.join(dir, "bin", name + EXE) };
+}
+// CI's release-signing key; the program checks its own updates against the same one
+const SIGNING_KEY = "17092e6d5632783f1d9b08fc134b0343c7e67b4a4b42feb52df6ca295f325ef8";
+
+const color = process.stdout.isTTY && !process.env.NO_COLOR;
+const paint = (code) => (text) => (color ? `\x1b[${code}m${text}\x1b[0m` : text);
+const mint = paint("38;2;52;211;153");
+const dim = paint("2");
+const bold = paint("1");
+
+function fail(message) {
+  console.error(`Cork: ${message}`);
+  process.exit(1);
+}
+
+function target() {
+  const arch = { arm64: "aarch64", x64: "x86_64" }[process.arch];
+  const system = { darwin: "apple-darwin", linux: "unknown-linux-gnu", win32: "pc-windows-msvc" }[process.platform];
+  if (!arch || !system) fail(`there is no build for ${process.platform}-${process.arch} yet.`);
+  return `${arch}-${system}`;
+}
+
+function verifySignature(statement, signature) {
+  const der = Buffer.concat([Buffer.from("302a300506032b6570032100", "hex"), Buffer.from(SIGNING_KEY, "hex")]);
+  const key = crypto.createPublicKey({ key: der, format: "der", type: "spki" });
+  return crypto.verify(null, Buffer.from(statement), key, Buffer.from(signature, "base64"));
+}
+
+function banner(version) {
+  if (!process.stdout.isTTY) return;
+  const art = [
+    " ██████╗ ██████╗ ██████╗ ██╗  ██╗",
+    "██╔════╝██╔═══██╗██╔══██╗██║ ██╔╝",
+    "██║     ██║   ██║██████╔╝█████╔╝ ",
+    "██║     ██║   ██║██╔══██╗██╔═██╗ ",
+    "╚██████╗╚██████╔╝██║  ██║██║  ██╗",
+    " ╚═════╝ ╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═╝",
+  ];
+  console.log("\n" + art.map(mint).join("\n"));
+  console.log(`  ${dim(`free · v${version} · your agents, working as a team`)}\n`);
+}
+
+/** `cork` by name in every new terminal: ~/.cork/bin (or an old install's
+ * ~/.collide/bin, where a `cork` sits beside its `collide`) joins PATH once. */
+function addToPath(binDir) {
+  if (setting("NO_MODIFY_PATH") === "1") return "";
+  const home = os.homedir();
+  const rel = path.relative(home, binDir).split(path.sep).join("/");
+  // under the home folder as $HOME/..., else (a CORK_HOME elsewhere) as is
+  const entry = rel.startsWith("..") || path.isAbsolute(rel) ? binDir : `$HOME/${rel}`;
+  if (process.platform === "win32") {
+    // the user's own PATH, read and written through PowerShell (setx truncates long values)
+    const script =
+      `$p=[Environment]::GetEnvironmentVariable('Path','User'); if(-not $p){$p=''}; ` +
+      `if(($p -split ';') -notcontains '${binDir}'){[Environment]::SetEnvironmentVariable('Path',($p.TrimEnd(';')+';${binDir}').TrimStart(';'),'User'); 'added'}`;
+    const out = spawnSync("powershell", ["-NoProfile", "-Command", script], { encoding: "utf8" });
+    return out.stdout && out.stdout.includes("added") ? "your user PATH" : "";
+  }
+  const shell = process.env.SHELL || "";
+  const files = shell.endsWith("/zsh")
+    ? [".zshrc"]
+    : shell.endsWith("/bash")
+      ? process.platform === "darwin" ? [".bashrc", ".bash_profile"] : [".bashrc"]
+      : shell.endsWith("/fish")
+        ? [".config/fish/conf.d/cork.fish"]
+        : [".profile"];
+  const added = [];
+  for (const name of files) {
+    const file = path.join(home, name);
+    let current = "";
+    try {
+      current = fs.readFileSync(file, "utf8");
+    } catch {}
+    if (current.includes(entry.replace("$HOME/", ""))) continue;
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.appendFileSync(
+      file,
+      name.endsWith(".fish") ? `fish_add_path "${entry}"\n` : `\n# Cork\nexport PATH="${entry}:$PATH"\n`,
+    );
+    added.push(`~/${name}`);
+  }
+  return added.join(", ");
+}
+
+async function install(args) {
+  const triple = target();
+  let index;
+  try {
+    const response = await fetch(`${SERVER}/artifacts/hooks`, { headers: { "user-agent": "corkcli-npm" } });
+    if (!response.ok) throw new Error(String(response.status));
+    index = await response.json();
+  } catch (err) {
+    fail(`could not reach Cork's releases (${err.message}). Check your connection and run it again.`);
+  }
+  // a release whose builds are still on their way: the version before,
+  // which every installed copy then updates from by itself
+  let version = index.version;
+  let build = (index.free_builds || []).find((b) => b.target === triple);
+  if (!build && index.previous) {
+    build = (index.previous.free_builds || []).find((b) => b.target === triple);
+    if (build) version = index.previous.version;
+  }
+  if (!build) fail(`there is no build for ${triple} in release v${index.version} yet; try again in a few minutes.`);
+  banner(version);
+
+  console.log(`  ${dim(`Downloading cork for ${triple}...`)}`);
+  const response = await fetch(build.url, { headers: { "user-agent": "corkcli-npm" } });
+  if (!response.ok) fail(`the download failed (${response.status}). Run it again.`);
+  const bytes = Buffer.from(await response.arrayBuffer());
+  const digest = crypto.createHash("sha256").update(bytes).digest("hex");
+  if (digest !== build.sha256) fail("the download did not match its checksum, so nothing was installed.");
+  // CI signs the free program as `collide`, whatever it is called on the machine
+  if (!build.sig || !verifySignature(`collide ${triple} v${version} sha256:${digest}`, build.sig)) {
+    fail("the download is not signed by Cork's release key, so nothing was installed.");
+  }
+  console.log(`  ${mint("✓")} Downloaded and verified ${dim("(SHA-256 and signature)")}`);
+
+  const where = layout();
+  const binDir = where.bin;
+  fs.mkdirSync(binDir, { recursive: true });
+  const program = where.program;
+  const staged = `${program}.part`;
+  fs.writeFileSync(staged, bytes, { mode: 0o755 });
+  // a running copy on Windows cannot be replaced, only renamed aside
+  if (fs.existsSync(program)) {
+    try {
+      fs.renameSync(program, `${program}.old`);
+    } catch {}
+  }
+  fs.renameSync(staged, program);
+
+  const noLogin = args.includes("--no-login") || setting("NO_LOGIN") === "1";
+  const passed = args.filter((a) => a !== "--no-login");
+  // the program's own install also places a `cork` beside an old `collide`
+  const setup = spawnSync(program, ["install", ...passed], { stdio: "inherit", env: { ...process.env, CORK_STYLE: "1", COLLIDE_STYLE: "1" } });
+  if (setup.status !== 0) process.exit(setup.status || 1);
+  const added = addToPath(binDir);
+  if (added) console.log(`  ${mint("✓")} Added to your PATH ${dim(`(${added})`)}`);
+
+  // one sign-in, in the browser, as part of the install: the dashboard opens
+  // there, and this terminal comes back to the front when it is done
+  if (!noLogin && process.stdin.isTTY && process.stdout.isTTY && !linked()) {
+    console.log(`\n  ${bold("Sign in")} ${dim("(opens your browser · free · links this machine to your dashboard)")}`);
+    const login = spawnSync(program, ["login"], { stdio: "inherit" });
+    focusTerminal();
+    if (login.status !== 0) console.log(`  ${dim("Not signed in. Any time:")} ${mint("cork login")}`);
+  }
+
+  console.log(`\n  ${bold("Next")}`);
+  console.log(`    ${mint("1")}  Open a new terminal, so the ${bold("cork")} command works`);
+  console.log(`    ${mint("2")}  Start or restart your agent sessions: agents in the same repo now see`);
+  console.log("       each other's work and can message each other");
+  console.log(`\n  ${dim("Bring in your team:")} ${mint("cork upgrade")} ${dim("(100 agent hours a month for $20)")}\n`);
+}
+
+/** This machine already signed in (`cork login` keeps the account in
+ * machine.json): the install leaves it as it is. */
+function linked() {
+  try {
+    return Boolean(JSON.parse(fs.readFileSync(path.join(layout().dir, "machine.json"), "utf8")).account);
+  } catch {
+    return false;
+  }
+}
+
+/** Back to the app the install was run from, once the browser is done with
+ * the sign-in. macOS names that app in __CFBundleIdentifier (Terminal,
+ * iTerm, Ghostty, VS Code, Cursor...); elsewhere the person switches back. */
+function focusTerminal() {
+  const app = process.env.__CFBundleIdentifier;
+  if (process.platform === "darwin" && app && /^[\w.-]+$/.test(app)) spawnSync("open", ["-b", app]);
+}
+
+function run(args) {
+  const where = layout();
+  // the `cork` beside an old install's `collide` when it is there yet
+  const cork = path.join(where.bin, "cork" + EXE);
+  const program = fs.existsSync(cork) ? cork : where.program;
+  if (!fs.existsSync(program)) return install([]).then(() => run(args));
+  const result = spawnSync(program, args, { stdio: "inherit" });
+  process.exit(result.status ?? 1);
+}
+
+function help() {
+  // the package's name as it was run (`npx collidemcp`, `npx collide-cli` still work)
+  const invoked = path.basename(process.argv[1] || "").replace(/\.js$/, "");
+  const name = ["collidemcp", "collide-cli"].includes(invoked) ? invoked : "corkcli";
+  console.log(`${bold("corkcli")} ${dim(`v${require("../package.json").version}`)}: Cork for every repo on this machine.
+
+  ${mint(`npx ${name}`)}              install or update Cork (checks SHA-256 and signature first)
+  ${mint(`npx ${name} --no-login`)}   install without the browser sign-in
+  ${mint(`npx ${name} <command>`)}    run a cork command: status, login, upgrade, ...
+  ${mint(`npx ${name} --help`)}       this text
+
+After the install, ${bold("cork <command>")} works directly in a new terminal.
+More at https://corkcli.com/docs/cli`);
+}
+
+const args = process.argv.slice(2);
+if (args[0] === "--help" || args[0] === "-h") {
+  help();
+} else if (args.length === 0 || args[0] === "install" || args[0].startsWith("--")) {
+  install(args[0] === "install" ? args.slice(1) : args).catch((err) => fail(err.message));
+} else {
+  run(args);
+}

package/package.json

@@ -1,6 +1,36 @@
 {
   "name": "corkcli",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "2.0.0",
+  "description": "Cork: your coding agents (Claude Code, Codex, Cursor) working as a team. One command installs it for every repo on your machine.",
+  "bin": {
+    "corkcli": "bin/cork.js",
+    "cork": "bin/cork.js",
+    "collide": "bin/cork.js",
+    "collide-cli": "bin/cork.js",
+    "collidemcp": "bin/cork.js"
+  },
+  "files": [
+    "bin/cork.js",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "keywords": [
+    "claude-code",
+    "codex",
+    "cursor",
+    "mcp",
+    "ai-agents",
+    "multi-agent",
+    "collaboration"
+  ],
+  "homepage": "https://corkcli.com",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/lithometric/cork"
+  },
+  "license": "MIT",
+  "author": "Lithometric"
+}