freecode-sh 0.1.0-alpha.12 → 0.1.0-alpha.15

package/install.sh

@@ -0,0 +1,641 @@
+#!/bin/sh
+
+# Free Code native installer for macOS.
+# Review this script before running it: https://freecode.sh/install
+
+set -eu
+
+DEFAULT_CHANNEL="alpha"
+DEFAULT_DOWNLOAD_BASE_URL="https://releases.freecode.sh/releases"
+DEFAULT_CHANNEL_BASE_URL="https://releases.freecode.sh/channels"
+EXPECTED_TEAM_IDENTIFIER="GD597P8KJ2"
+LEGACY_ALPHA6_MANIFEST_SHA256="1bf63e0d6114b12d61c07094936bd2606ae82ce87d5b054fbfb01c5f3d3646d8"
+LAUNCHER_RELATIVE_PATH="bin/freecode"
+INTERFACE_RELATIVE_PATH="libexec/freecode/freecode-tui"
+ENGINE_RELATIVE_PATH="libexec/freecode/freecode-engine"
+
+VERSION="${FREECODE_INSTALL_VERSION:-}"
+CHANNEL="${FREECODE_INSTALL_CHANNEL:-$DEFAULT_CHANNEL}"
+DOWNLOAD_BASE_URL="${FREECODE_INSTALL_BASE_URL:-$DEFAULT_DOWNLOAD_BASE_URL}"
+CHANNEL_BASE_URL="${FREECODE_CHANNEL_BASE_URL:-$DEFAULT_CHANNEL_BASE_URL}"
+INSTALL_ROOT="${FREECODE_INSTALL_ROOT:-${HOME:?HOME is required}/.local/share/freecode}"
+BIN_DIR="${FREECODE_BIN_DIR:-${HOME}/.local/bin}"
+OS_NAME="${FREECODE_INSTALL_OS:-$(uname -s)}"
+MACHINE="${FREECODE_INSTALL_ARCH:-$(uname -m)}"
+TEMP_DIR=""
+STAGE_DIR=""
+INSTALL_LOCK_PATH=""
+INSTALL_LOCK_HELD="false"
+INSTALL_LOCK_OWNER_TOKEN=""
+INSTALL_LOCK_GUARD_HELD="false"
+ALLOW_UNSIGNED_INSTALL="${FREECODE_ALLOW_UNSIGNED_INSTALL:-false}"
+EMBEDDED_INSTALL="${FREECODE_INSTALL_EMBEDDED:-false}"
+LAUNCH_AFTER_INSTALL="${FREECODE_INSTALL_LAUNCH:-true}"
+RELEASE_MODE=""
+PATH_PROFILE=""
+PATH_CONFIGURED="false"
+
+usage() {
+  cat <<'EOF'
+Install Free Code's native macOS release.
+
+Usage:
+  curl -fsSL https://freecode.sh/install.sh | sh
+  curl -fsSL https://freecode.sh/install.sh | sh -s -- --version 0.1.0-alpha.1
+
+Options:
+  --version VERSION          Install an exact immutable version.
+  --channel CHANNEL          Resolve a channel (default: alpha).
+  --base-url URL             Override the immutable release download base URL.
+  --channel-base-url URL     Override the channel manifest base URL.
+  --install-root PATH        Version store (default: ~/.local/share/freecode).
+  --bin-dir PATH             Executable link directory (default: ~/.local/bin).
+  --no-launch                Install without opening Free Code.
+  -h, --help                 Show this help.
+
+Environment equivalents:
+  FREECODE_INSTALL_VERSION, FREECODE_INSTALL_CHANNEL,
+  FREECODE_INSTALL_BASE_URL, FREECODE_CHANNEL_BASE_URL,
+  FREECODE_INSTALL_ROOT, FREECODE_BIN_DIR, FREECODE_INSTALL_LAUNCH
+
+Internal testing only:
+  FREECODE_ALLOW_UNSIGNED_INSTALL=true permits an explicitly marked unsigned
+  release outside the alpha channel. Never use this for a normal install.
+EOF
+}
+
+fail() {
+  printf 'freecode installer: %s\n' "$*" >&2
+  exit 1
+}
+
+cleanup() {
+  if [ -n "$TEMP_DIR" ] && [ -d "$TEMP_DIR" ]; then
+    rm -rf "$TEMP_DIR"
+  fi
+  if [ -n "$STAGE_DIR" ] && [ -d "$STAGE_DIR" ]; then
+    rm -rf "$STAGE_DIR"
+  fi
+  release_install_lock
+}
+
+require_value() {
+  [ "$#" -ge 2 ] || fail "$1 requires a value"
+  [ -n "$2" ] || fail "$1 requires a non-empty value"
+}
+
+release_install_lock() {
+  if [ "$INSTALL_LOCK_HELD" = "true" ]; then
+    lock_owner=$(sed -n '1p' "$INSTALL_LOCK_PATH" 2>/dev/null || true)
+    lock_owner_token=$(sed -n '2p' "$INSTALL_LOCK_PATH" 2>/dev/null || true)
+    if [ "$lock_owner" = "$$" ] && [ "$lock_owner_token" = "$INSTALL_LOCK_OWNER_TOKEN" ]; then
+      rm -f "$INSTALL_LOCK_PATH"
+    fi
+  fi
+  INSTALL_LOCK_HELD="false"
+  if [ "$INSTALL_LOCK_GUARD_HELD" = "true" ]; then
+    exec 9>&-
+    INSTALL_LOCK_GUARD_HELD="false"
+  fi
+}
+
+create_install_lock() {
+  (
+    umask 077
+    set -C
+    printf '%s\n%s\n' "$$" "$INSTALL_LOCK_OWNER_TOKEN" > "$INSTALL_LOCK_PATH"
+  ) 2>/dev/null
+}
+
+process_start_token() {
+  LC_ALL=C ps -o lstart= -p "$1" 2>/dev/null \
+    | sed -n '1{s/^[[:space:]]*//;s/[[:space:]]*$//;p;}'
+}
+
+acquire_install_lock() {
+  INSTALL_LOCK_PATH="$INSTALL_ROOT/.update-lock"
+  INSTALL_LOCK_OWNER_TOKEN=$(process_start_token "$$")
+  [ -n "$INSTALL_LOCK_OWNER_TOKEN" ] \
+    || fail "could not identify the installer process for update locking"
+  mkdir -p "$INSTALL_ROOT"
+  exec 9>"$INSTALL_LOCK_PATH.guard"
+  # Descriptor-mode locks remain attached to fd 9 after the helper exits and
+  # are held until release_install_lock closes the descriptor.
+  if [ -x /usr/bin/lockf ]; then
+    guard_acquired=false
+    /usr/bin/lockf -s -t 120 9 && guard_acquired=true
+  elif [ "$(uname -s)" = "Linux" ] && command -v flock >/dev/null 2>&1; then
+    # The Linux CI host emulates Darwin to exercise this macOS-only installer.
+    guard_acquired=false
+    flock -w 120 9 && guard_acquired=true
+  else
+    exec 9>&-
+    fail "the system lock utility is unavailable"
+  fi
+  if [ "$guard_acquired" != "true" ]; then
+    exec 9>&-
+    fail "another Free Code install or update is still in progress"
+  fi
+  INSTALL_LOCK_GUARD_HELD="true"
+  attempts=0
+  while ! create_install_lock; do
+    # Read both the regular-file protocol and the short-lived directory format
+    # used by development builds before the lock contract was unified.
+    if [ -d "$INSTALL_LOCK_PATH" ]; then
+      lock_owner=$(sed -n '1p' "$INSTALL_LOCK_PATH/pid" 2>/dev/null || true)
+      lock_owner_token=""
+    else
+      lock_owner=$(sed -n '1p' "$INSTALL_LOCK_PATH" 2>/dev/null || true)
+      lock_owner_token=$(sed -n '2p' "$INSTALL_LOCK_PATH" 2>/dev/null || true)
+    fi
+    case "$lock_owner" in
+      ''|*[!0-9]*) ;;
+      *)
+        if ! kill -0 "$lock_owner" 2>/dev/null; then
+          rm -rf "$INSTALL_LOCK_PATH"
+          continue
+        fi
+        if [ -n "$lock_owner_token" ]; then
+          current_owner_token=$(process_start_token "$lock_owner")
+          if [ -n "$current_owner_token" ] && [ "$current_owner_token" != "$lock_owner_token" ]; then
+            rm -rf "$INSTALL_LOCK_PATH"
+            continue
+          fi
+        fi
+        ;;
+    esac
+    attempts=$((attempts + 1))
+    [ "$attempts" -lt 120 ] \
+      || fail "another Free Code install or update is still in progress"
+    sleep 1
+  done
+  INSTALL_LOCK_HELD="true"
+
+  if [ -n "${FREECODE_TEST_HOLD_INSTALL_LOCK_SECONDS:-}" ]; then
+    case "$DOWNLOAD_BASE_URL" in
+      file://*) sleep "$FREECODE_TEST_HOLD_INSTALL_LOCK_SECONDS" ;;
+      *) fail "the test install delay is permitted only with local file URLs" ;;
+    esac
+  fi
+}
+
+configure_profile() {
+  profile=$1
+  path_line=$2
+  legacy_path_line=${3:-}
+  profile_dir=$(dirname "$profile")
+
+  [ -d "$profile_dir" ] || return 1
+  if [ -e "$profile" ] || [ -L "$profile" ]; then
+    [ -f "$profile" ] || return 1
+  fi
+  if grep -Fqx "$path_line" "$profile" 2>/dev/null \
+    || { [ -n "$legacy_path_line" ] && grep -Fqx "$legacy_path_line" "$profile" 2>/dev/null; }
+  then
+    return 0
+  fi
+  if [ -s "$profile" ] && ! printf '\n' >> "$profile"; then
+    return 1
+  fi
+  printf '# Free Code\n%s\n' "$path_line" >> "$profile"
+}
+
+configure_path() {
+  [ "$BIN_DIR" = "$HOME/.local/bin" ] || return 0
+
+  guarded_path_line='case ":$PATH:" in *":$HOME/.local/bin:"*) ;; *) export PATH="$HOME/.local/bin:$PATH" ;; esac'
+  legacy_path_line='export PATH="$HOME/.local/bin:$PATH"'
+  detected_shell=${SHELL:-/bin/zsh}
+
+  case "$detected_shell" in
+    */zsh)
+      zsh_config_dir=${ZDOTDIR:-$HOME}
+      if configure_profile "$zsh_config_dir/.zprofile" "$guarded_path_line" "$legacy_path_line" \
+        && configure_profile "$zsh_config_dir/.zshrc" "$guarded_path_line" "$legacy_path_line"
+      then
+        PATH_PROFILE="$zsh_config_dir/.zprofile and $zsh_config_dir/.zshrc"
+        PATH_CONFIGURED="true"
+      fi
+      ;;
+    */bash)
+      if [ -e "$HOME/.bash_profile" ] || [ -L "$HOME/.bash_profile" ]; then
+        bash_login_profile="$HOME/.bash_profile"
+      elif [ -e "$HOME/.bash_login" ] || [ -L "$HOME/.bash_login" ]; then
+        bash_login_profile="$HOME/.bash_login"
+      elif [ -e "$HOME/.profile" ] || [ -L "$HOME/.profile" ]; then
+        bash_login_profile="$HOME/.profile"
+      else
+        bash_login_profile="$HOME/.bash_profile"
+      fi
+      if configure_profile "$bash_login_profile" "$guarded_path_line" "$legacy_path_line" \
+        && configure_profile "$HOME/.bashrc" "$guarded_path_line" "$legacy_path_line"
+      then
+        PATH_PROFILE="$bash_login_profile and $HOME/.bashrc"
+        PATH_CONFIGURED="true"
+      fi
+      ;;
+    */fish)
+      fish_config_dir="${XDG_CONFIG_HOME:-$HOME/.config}/fish/conf.d"
+      if mkdir -p "$fish_config_dir" 2>/dev/null \
+        && configure_profile "$fish_config_dir/freecode.fish" \
+          'contains -- "$HOME/.local/bin" $PATH; or set -gx PATH "$HOME/.local/bin" $PATH'
+      then
+        PATH_PROFILE="$fish_config_dir/freecode.fish"
+        PATH_CONFIGURED="true"
+      fi
+      ;;
+  esac
+}
+
+trap cleanup EXIT HUP INT TERM
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --version)
+      require_value "$@"
+      VERSION=$2
+      shift 2
+      ;;
+    --channel)
+      require_value "$@"
+      CHANNEL=$2
+      shift 2
+      ;;
+    --base-url)
+      require_value "$@"
+      DOWNLOAD_BASE_URL=$2
+      shift 2
+      ;;
+    --channel-base-url)
+      require_value "$@"
+      CHANNEL_BASE_URL=$2
+      shift 2
+      ;;
+    --install-root)
+      require_value "$@"
+      INSTALL_ROOT=$2
+      shift 2
+      ;;
+    --bin-dir)
+      require_value "$@"
+      BIN_DIR=$2
+      shift 2
+      ;;
+    --no-launch)
+      LAUNCH_AFTER_INSTALL="false"
+      shift
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    --)
+      shift
+      break
+      ;;
+    *)
+      fail "unknown option: $1"
+      ;;
+  esac
+done
+
+[ "$#" -eq 0 ] || fail "unexpected positional arguments: $*"
+command -v curl >/dev/null 2>&1 || fail "curl is required"
+command -v tar >/dev/null 2>&1 || fail "tar is required"
+command -v shasum >/dev/null 2>&1 || fail "shasum is required"
+
+case "$ALLOW_UNSIGNED_INSTALL" in
+  true|false) ;;
+  *) fail "FREECODE_ALLOW_UNSIGNED_INSTALL must be exactly true or false" ;;
+esac
+
+case "$EMBEDDED_INSTALL" in
+  true|false) ;;
+  *) fail "FREECODE_INSTALL_EMBEDDED must be exactly true or false" ;;
+esac
+
+case "$LAUNCH_AFTER_INSTALL" in
+  true|false) ;;
+  *) fail "FREECODE_INSTALL_LAUNCH must be exactly true or false" ;;
+esac
+
+case "$OS_NAME" in
+  Darwin) ;;
+  *) fail "only macOS is supported right now (detected $OS_NAME)" ;;
+esac
+
+case "$MACHINE" in
+  arm64|aarch64)
+    ARCH="arm64"
+    ;;
+  x86_64|amd64)
+    # Prefer the native Apple Silicon build when this shell is running under Rosetta.
+    if [ "${FREECODE_INSTALL_ARCH:-}" = "" ] && [ "$(sysctl -in sysctl.proc_translated 2>/dev/null || true)" = "1" ]; then
+      ARCH="arm64"
+    else
+      ARCH="x64"
+    fi
+    ;;
+  *)
+    fail "unsupported Mac architecture: $MACHINE"
+    ;;
+esac
+
+validate_version() {
+  printf '%s\n' "$1" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z][0-9A-Za-z.-]*)?$' \
+    || fail "invalid release version: $1"
+}
+
+validate_channel() {
+  printf '%s\n' "$1" | grep -Eq '^[0-9A-Za-z][0-9A-Za-z._-]*$' \
+    || fail "invalid release channel: $1"
+}
+
+validate_release_security() {
+  manifest_path=$1
+  context=$2
+  release_mode=$(sed -n 's/.*"releaseMode"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$manifest_path" | head -n 1)
+  manifest_channel=$(sed -n 's/.*"channel"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$manifest_path" | head -n 1)
+  case "$release_mode" in
+    signed-notarized)
+      RELEASE_MODE="signed-notarized"
+      ;;
+    unsigned-override)
+      if [ "$CHANNEL" = "alpha" ] && [ "$manifest_channel" = "alpha" ]; then
+        printf 'WARNING: %s is an unsigned Free Code alpha and is not Apple notarized. Its SHA-256 checksum will still be verified.\n' "$context" >&2
+      elif [ "$ALLOW_UNSIGNED_INSTALL" = "true" ]; then
+        printf 'WARNING: %s declares unsigned-override security metadata outside the alpha channel.\n' "$context" >&2
+      else
+        fail "$context is unsigned and is not an alpha release; refusing to install it"
+      fi
+      RELEASE_MODE="unsigned-override"
+      ;;
+    *) fail "$context does not contain valid signed-notarized release security metadata" ;;
+  esac
+}
+
+verify_release_signatures() {
+  root=$1
+  if [ "$RELEASE_MODE" = "unsigned-override" ]; then
+    printf 'WARNING: skipping Apple signature and Team ID verification for this explicitly marked unsigned release.\n' >&2
+    return
+  fi
+
+  [ -x /usr/bin/codesign ] || fail "/usr/bin/codesign is required to verify this release"
+  for executable in \
+    "$root/$LAUNCHER_RELATIVE_PATH" \
+    "$root/$INTERFACE_RELATIVE_PATH" \
+    "$root/$ENGINE_RELATIVE_PATH"
+  do
+    /usr/bin/codesign --verify --strict --verbose=2 "$executable" \
+      || fail "Apple signature verification failed for $executable"
+    SIGNATURE_DETAILS=$(/usr/bin/codesign --display --verbose=4 "$executable" 2>&1) \
+      || fail "could not inspect Apple signature for $executable"
+    TEAM_IDENTIFIER=$(printf '%s\n' "$SIGNATURE_DETAILS" | sed -n 's/^TeamIdentifier=//p' | head -n 1)
+    [ "$TEAM_IDENTIFIER" = "$EXPECTED_TEAM_IDENTIFIER" ] \
+      || fail "unexpected Apple TeamIdentifier for $executable (expected $EXPECTED_TEAM_IDENTIFIER, received ${TEAM_IDENTIFIER:-missing})"
+  done
+}
+
+write_release_public_key() {
+  destination=$1
+  if [ -n "${FREECODE_TEST_RELEASE_PUBLIC_KEY_FILE:-}" ]; then
+    case "$DOWNLOAD_BASE_URL" in
+      file://*) cp "$FREECODE_TEST_RELEASE_PUBLIC_KEY_FILE" "$destination" ;;
+      *) fail "the test release key override is permitted only with local file URLs" ;;
+    esac
+    return
+  fi
+  cat > "$destination" <<'EOF'
+-----BEGIN PUBLIC KEY-----
+MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEA8so4sWArOV0GXihYvoSo
+xDLI1yMoILnVfCjYQwe4CKQ9EC10JV30cntMJZWXvXZS6STqQGIjyWisa6Op4nId
+OuXKDjaEcQIeftgZBzzyGrMmAMC3W57VAi3d+w/F2XnkXBaH3NOphfftF6Fxt3Q0
+2CxN3PjuuFaOGytKsYF5uDLCvEb+MpzJlD3HZoBzhhMCAoY6wmCdlgaDxD20UFdy
+EigF5wwpcUWpYmbYMFp+6SLe/Fi8IrYirwiCv5eLur6PzFFcwFrJgUeZAdxmGuM8
+eJzZlc7mK0+gzi8KpC2FZ9eOx1SafPE4An4+u8rZ7WA1Qk5eCAhNU9lm+JAeeKcC
+XzhQpPUafybJg75dIbIayOC3tf5mn+X+Vl5+uY19nT2qcJsjgUeIcqbMs9FGXiIA
+2G292N5WppyiDcx8yAIG6rOrAUGzHMYCrhvxQLAx2KP5QfC53VZ3La7yZOATY5ic
+F78qSSBrKDrT42vinbosbX++Wr34YB6pXhiZF6jHPHrxAgMBAAE=
+-----END PUBLIC KEY-----
+EOF
+}
+
+authenticate_release_manifest() {
+  manifest_path=$1
+  signature_path=$2
+  context=$3
+  if [ -s "$signature_path" ] && \
+    /usr/bin/openssl dgst -sha256 \
+      -verify "$RELEASE_PUBLIC_KEY" \
+      -signature "$signature_path" \
+      "$manifest_path" >/dev/null 2>&1
+  then
+    return
+  fi
+
+  manifest_sha=$(shasum -a 256 "$manifest_path" | awk '{ print $1 }')
+  if [ "$manifest_sha" = "$LEGACY_ALPHA6_MANIFEST_SHA256" ]; then
+    printf 'WARNING: %s predates release-manifest signatures; accepting its exact pinned alpha.6 manifest.\n' "$context" >&2
+    return
+  fi
+  fail "$context does not have a valid Free Code release signature"
+}
+
+manifest_asset_value() {
+  manifest_path=$1
+  target=$2
+  field=$3
+  awk -v target="$target" -v field="$field" '
+    index($0, "\"" target "\"") && index($0, ":") { in_target = 1; next }
+    in_target && index($0, "\"" field "\"") {
+      value = $0
+      sub(/^[^:]*:[[:space:]]*/, "", value)
+      sub(/,[[:space:]]*$/, "", value)
+      sub(/^"/, "", value)
+      sub(/"$/, "", value)
+      print value
+      exit
+    }
+    in_target && /^[[:space:]]*}[,]?[[:space:]]*$/ { exit }
+  ' "$manifest_path"
+}
+
+DOWNLOAD_BASE_URL=${DOWNLOAD_BASE_URL%/}
+CHANNEL_BASE_URL=${CHANNEL_BASE_URL%/}
+validate_channel "$CHANNEL"
+
+TEMP_DIR=$(mktemp -d "${TMPDIR:-/tmp}/freecode-install.XXXXXX")
+RELEASE_PUBLIC_KEY="$TEMP_DIR/release-signing-public.pem"
+write_release_public_key "$RELEASE_PUBLIC_KEY"
+
+if [ -z "$VERSION" ]; then
+  CHANNEL_MANIFEST="$TEMP_DIR/channel.json"
+  CHANNEL_SIGNATURE="$TEMP_DIR/channel.json.sig"
+  CHANNEL_URL="$CHANNEL_BASE_URL/$CHANNEL.json"
+  printf 'Resolving Free Code channel %s...\n' "$CHANNEL"
+  curl -fsSL --retry 3 --connect-timeout 15 "$CHANNEL_URL" -o "$CHANNEL_MANIFEST" \
+    || fail "could not download channel manifest: $CHANNEL_URL"
+  curl -fsSL --retry 3 --connect-timeout 15 "$CHANNEL_URL.sig" -o "$CHANNEL_SIGNATURE" 2>/dev/null \
+    || rm -f "$CHANNEL_SIGNATURE"
+  authenticate_release_manifest "$CHANNEL_MANIFEST" "$CHANNEL_SIGNATURE" "channel $CHANNEL"
+  VERSION=$(sed -n 's/.*"version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$CHANNEL_MANIFEST" | head -n 1)
+  [ -n "$VERSION" ] || fail "channel manifest does not contain a version"
+  validate_release_security "$CHANNEL_MANIFEST" "channel $CHANNEL"
+fi
+validate_version "$VERSION"
+
+mkdir -p "$INSTALL_ROOT"
+acquire_install_lock
+
+ASSET="freecode-darwin-$ARCH.tar.gz"
+TAG="v$VERSION"
+RELEASE_URL="$DOWNLOAD_BASE_URL/$TAG"
+ARCHIVE="$TEMP_DIR/$ASSET"
+RELEASE_MANIFEST="$TEMP_DIR/release-manifest.json"
+RELEASE_SIGNATURE="$TEMP_DIR/release-manifest.json.sig"
+
+curl -fsSL --retry 3 --connect-timeout 15 "$RELEASE_URL/release-manifest.json" -o "$RELEASE_MANIFEST" \
+  || fail "could not download release manifest: $RELEASE_URL/release-manifest.json"
+curl -fsSL --retry 3 --connect-timeout 15 "$RELEASE_URL/release-manifest.json.sig" -o "$RELEASE_SIGNATURE" 2>/dev/null \
+  || rm -f "$RELEASE_SIGNATURE"
+authenticate_release_manifest "$RELEASE_MANIFEST" "$RELEASE_SIGNATURE" "release $VERSION"
+
+MANIFEST_VERSION=$(sed -n 's/.*"version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$RELEASE_MANIFEST" | head -n 1)
+[ "$MANIFEST_VERSION" = "$VERSION" ] \
+  || fail "release manifest version ${MANIFEST_VERSION:-missing} does not match requested version $VERSION"
+validate_release_security "$RELEASE_MANIFEST" "release $VERSION"
+
+MANIFEST_TARGET="darwin-$ARCH"
+MANIFEST_ARCHIVE=$(manifest_asset_value "$RELEASE_MANIFEST" "$MANIFEST_TARGET" archive)
+[ "$MANIFEST_ARCHIVE" = "$ASSET" ] \
+  || fail "release manifest does not declare the expected archive $ASSET"
+EXPECTED_SHA=$(manifest_asset_value "$RELEASE_MANIFEST" "$MANIFEST_TARGET" sha256)
+printf '%s\n' "$EXPECTED_SHA" | grep -Eq '^[0-9a-fA-F]{64}$' \
+  || fail "release checksum is not a SHA-256 digest"
+EXPECTED_SIZE=$(manifest_asset_value "$RELEASE_MANIFEST" "$MANIFEST_TARGET" size)
+printf '%s\n' "$EXPECTED_SIZE" | grep -Eq '^[1-9][0-9]*$' \
+  || fail "release manifest does not contain a valid archive size"
+
+printf 'Downloading Free Code %s for darwin-%s...\n' "$VERSION" "$ARCH"
+curl -fsSL --retry 3 --connect-timeout 15 "$RELEASE_URL/$ASSET" -o "$ARCHIVE" \
+  || fail "could not download release asset: $RELEASE_URL/$ASSET"
+ACTUAL_SIZE=$(wc -c < "$ARCHIVE" | tr -d '[:space:]')
+[ "$ACTUAL_SIZE" = "$EXPECTED_SIZE" ] \
+  || fail "download size verification failed for $ASSET"
+ACTUAL_SHA=$(shasum -a 256 "$ARCHIVE" | awk '{ print $1 }')
+[ "$ACTUAL_SHA" = "$EXPECTED_SHA" ] \
+  || fail "checksum verification failed for $ASSET"
+
+if tar -tzf "$ARCHIVE" | grep -Eq '(^/|(^|/)\.\.(/|$))'; then
+  fail "release archive contains an unsafe path"
+fi
+
+mkdir -p "$INSTALL_ROOT/versions" "$BIN_DIR"
+VERSION_DIR="$INSTALL_ROOT/versions/$VERSION"
+NEW_INSTALL="false"
+
+if [ ! -d "$VERSION_DIR" ]; then
+  STAGE_DIR=$(mktemp -d "$INSTALL_ROOT/.install-$VERSION.XXXXXX")
+  tar -xzf "$ARCHIVE" -C "$STAGE_DIR"
+  [ -x "$STAGE_DIR/$LAUNCHER_RELATIVE_PATH" ] \
+    || fail "release archive is missing executable $LAUNCHER_RELATIVE_PATH"
+  [ -x "$STAGE_DIR/$INTERFACE_RELATIVE_PATH" ] \
+    || fail "release archive is missing $INTERFACE_RELATIVE_PATH"
+  [ -x "$STAGE_DIR/$ENGINE_RELATIVE_PATH" ] \
+    || fail "release archive is missing $ENGINE_RELATIVE_PATH"
+  verify_release_signatures "$STAGE_DIR"
+  mv "$STAGE_DIR" "$VERSION_DIR"
+  STAGE_DIR=""
+  NEW_INSTALL="true"
+else
+  [ -x "$VERSION_DIR/$LAUNCHER_RELATIVE_PATH" ] \
+    || fail "existing install is incomplete: $VERSION_DIR"
+  [ -x "$VERSION_DIR/$INTERFACE_RELATIVE_PATH" ] \
+    || fail "existing install is incomplete: $VERSION_DIR/$INTERFACE_RELATIVE_PATH"
+  [ -x "$VERSION_DIR/$ENGINE_RELATIVE_PATH" ] \
+    || fail "existing install is incomplete: $VERSION_DIR/$ENGINE_RELATIVE_PATH"
+  verify_release_signatures "$VERSION_DIR"
+fi
+
+PREVIOUS_LINK=""
+if [ -L "$BIN_DIR/freecode" ]; then
+  PREVIOUS_LINK=$(readlink "$BIN_DIR/freecode")
+elif [ -e "$BIN_DIR/freecode" ]; then
+  fail "refusing to replace non-symlink executable: $BIN_DIR/freecode"
+fi
+LINK_TEMP="$BIN_DIR/.freecode-link.$$"
+rm -f "$LINK_TEMP"
+ln -s "$VERSION_DIR/$LAUNCHER_RELATIVE_PATH" "$LINK_TEMP"
+mv -f "$LINK_TEMP" "$BIN_DIR/freecode"
+
+rollback_activation() {
+  rm -f "$BIN_DIR/freecode"
+  if [ -n "$PREVIOUS_LINK" ]; then
+    ln -s "$PREVIOUS_LINK" "$BIN_DIR/freecode"
+  fi
+  if [ "$NEW_INSTALL" = "true" ]; then
+    rm -rf "$VERSION_DIR"
+  fi
+}
+
+printf 'Verifying Free Code %s...\n' "$VERSION"
+VERSION_OUTPUT=$("$BIN_DIR/freecode" --version 2>&1) || {
+  rollback_activation
+  fail "freecode --version failed; restored the previous install"
+}
+printf '%s\n' "$VERSION_OUTPUT"
+[ "$(printf '%s\n' "$VERSION_OUTPUT" | sed -n '1p')" = "freecode-sh $VERSION" ] || {
+  rollback_activation
+  fail "freecode --version reported the wrong release; restored the previous install"
+}
+if ! "$BIN_DIR/freecode" doctor; then
+  rollback_activation
+  fail "freecode doctor failed; restored the previous install"
+fi
+
+rm -f "$INSTALL_ROOT/current-version"
+printf '%s\n' "$BIN_DIR" > "$INSTALL_ROOT/bin-dir"
+printf '%s\n' "$CHANNEL" > "$INSTALL_ROOT/channel"
+printf '%s\n' "$DOWNLOAD_BASE_URL" > "$INSTALL_ROOT/release-base-url"
+printf '%s\n' "$CHANNEL_BASE_URL" > "$INSTALL_ROOT/channel-base-url"
+
+release_install_lock
+
+printf '\nFree Code %s installed successfully.\n' "$VERSION"
+printf 'Executable: %s/freecode\n' "$BIN_DIR"
+
+if [ "$EMBEDDED_INSTALL" = "true" ]; then
+  exit 0
+fi
+
+configure_path
+
+if [ "$PATH_CONFIGURED" = "true" ]; then
+  printf 'Added Free Code to your PATH in %s.\n' "$PATH_PROFILE"
+else
+  printf '\nFree Code could not update your shell profile automatically.\n'
+  printf 'Add this line to your shell profile for future Terminal windows:\n'
+  printf '  export PATH="%s:$PATH"\n' "$BIN_DIR"
+fi
+
+printf '\nVerify the install:\n'
+printf '  %s/freecode --version\n' "$BIN_DIR"
+printf '  %s/freecode doctor\n' "$BIN_DIR"
+printf '\nUninstall:\n'
+printf '  rm -f "%s/freecode" && rm -rf "%s"\n' "$BIN_DIR" "$INSTALL_ROOT"
+
+if [ "$LAUNCH_AFTER_INSTALL" = "true" ]; then
+  TTY_DEVICE="${FREECODE_TEST_TTY_FILE:-}"
+  if [ -z "$TTY_DEVICE" ] && [ -t 1 ]; then
+    TTY_DEVICE="/dev/tty"
+  fi
+  if [ -n "$TTY_DEVICE" ] && [ -r "$TTY_DEVICE" ]; then
+    printf '\nStarting Free Code...\n'
+    if ! "$BIN_DIR/freecode" < "$TTY_DEVICE"; then
+      printf '\nFree Code closed before startup finished. The installation is still ready.\n' >&2
+    fi
+  else
+    printf '\nFree Code is installed. Open a Terminal and run freecode when you are ready.\n'
+  fi
+fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "freecode-sh",
-  "version": "0.1.0-alpha.12",
+  "version": "0.1.0-alpha.15",
   "description": "A free coding agent for your terminal.",
   "license": "UNLICENSED",
   "author": "Free Code",
@@ -21,37 +21,25 @@
   ],
   "type": "module",
   "bin": {
-    "freecode": "./freecode.mjs"
+    "freecode": "./freecode.mjs",
+    "freecode-sh": "./freecode.mjs"
   },
   "files": [
     "freecode.mjs",
-    "standalone.tsx",
-    "engine.manifest.json",
-    "release-manifest.json",
-    "README.md",
-    "THIRD_PARTY_NOTICES.md"
+    "install.sh"
   ],
   "engines": {
     "node": ">=20.9.0"
   },
   "os": [
-    "darwin",
-    "linux",
-    "win32"
+    "darwin"
+  ],
+  "cpu": [
+    "arm64",
+    "x64"
   ],
   "publishConfig": {
     "access": "public",
-    "tag": "alpha"
-  },
-  "dependencies": {
-    "@opencode-ai/sdk": "1.17.11",
-    "@opentui/core": "0.4.5",
-    "@opentui/keymap": "0.4.5",
-    "@opentui/solid": "0.4.5",
-    "bun": "1.3.14",
-    "diff": "9.0.0",
-    "opencode-ai": "1.17.11",
-    "solid-js": "1.9.12",
-    "ws": "8.21.0"
+    "tag": "latest"
   }
 }