freecode-sh 0.1.0-alpha.42 → 0.1.0-rc.3

package/README.md

@@ -1,39 +1,9 @@
-<p align="center"><img src="https://freecode.sh/icon.svg" width="128" alt="freecode"></p>
-
 # freecode
 
-the free coding agent
-
-This npm package is a small macOS and Windows bootstrapper. On first launch it
-installs the matching native freecode release, verifies its publisher signature
-and checksum, and then runs the native executable. Application code and prompts
-are not shipped in the npm package.
-
-Both `freecode` and `freecode-sh` launch the same freecode CLI.
-
-The signed native `alpha` channel is the canonical current release. npm
-`latest` mirrors that version; npm `alpha` is intentionally not used.
-
-## Install
-
-```bash
-npm install -g freecode-sh
-freecode --version
-freecode doctor
-freecode
-```
-
-For a reproducible clean install of this immutable release:
+Install the interactive TUI with `npm install -g freecode-sh`, then run `freecode login` and `freecode [folder]`.
 
-```bash
-npm install -g freecode-sh@0.1.0-alpha.42
-freecode --version
-```
+This package runs TUI 0.1.0-rc.3, the same signed binaries as the standalone download. Desktop releases independently. Requires Node 22.18 or later, Apple silicon macOS or Windows x64. Intel Mac, Linux and Windows ARM are not supported by this release.
 
-```bash
-freecode logout
-npm uninstall -g freecode-sh
-rm -rf ~/.local/share/freecode # macOS: optionally remove downloaded native versions
-```
+Updating npm replaces the npm-owned command. The first launch verifies and downloads this exact TUI release. No postinstall download or headless runner is used. Existing project folders and older installations are preserved. Sign in again; legacy conversation databases are not imported. If an older command takes precedence, remove it using its original installer and check your PATH.
 
-freecode supports Apple Silicon and Intel Macs, plus Windows x64.
+Use `npm uninstall -g freecode-sh` to remove the command. Downloaded payloads are in `~/.freecode/terminal-npm`.

package/check-platform.mjs

@@ -1,20 +1,2 @@
-#!/usr/bin/env node
-
-const requestedPlatform = process.env.FREECODE_INSTALL_OS
-const platform = requestedPlatform === 'Darwin'
-  ? 'darwin'
-  : requestedPlatform === 'Windows_NT'
-    ? 'win32'
-    : process.platform
-const architecture = process.env.FREECODE_INSTALL_ARCH || process.arch
-const supportedHost = (
-  (platform === 'darwin' && ['arm64', 'x64'].includes(architecture))
-  || (platform === 'win32' && architecture === 'x64')
-)
-
-if (!supportedHost) {
-  process.stderr.write(
-    `freecode: Free Code's native npm installer supports macOS arm64/x64 and Windows x64 (detected ${platform}/${architecture}).\n`,
-  )
-  process.exit(1)
-}
+import { targetFor } from './freecode.mjs'
+targetFor()

package/freecode.mjs

@@ -1,199 +1,119 @@
 #!/usr/bin/env node
-
-import { spawn } from 'node:child_process'
-import { constants } from 'node:fs'
-import { access, chmod, lstat, mkdir, readFile, realpath, writeFile } from 'node:fs/promises'
+// npm owns the command. This package downloads only its exact signed TUI release.
+import { spawn, execFileSync } from 'node:child_process'
+import { createHash } from 'node:crypto'
+import { createReadStream, createWriteStream, realpathSync } from 'node:fs'
+import { chmod, mkdir, mkdtemp, readFile, rename, rm, lstat, readdir, writeFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
-import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path'
+import { dirname, join, resolve, sep } from 'node:path'
 import { fileURLToPath } from 'node:url'
-import { withoutPowerShellModulePath } from './npm-bootstrap-environment.mjs'
-
-const packageDirectory = dirname(fileURLToPath(import.meta.url))
-const bootstrapPath = fileURLToPath(import.meta.url)
-const packageMetadata = JSON.parse(await readFile(join(packageDirectory, 'package.json'), 'utf8'))
+import { pipeline } from 'node:stream/promises'
+import { Transform } from 'node:stream'
+import { signedTerminalManifest } from './release.mjs'
+import { createRefreshLock } from './install-lock.mjs'
 
-const releaseContract = packageMetadata.freecodeRelease
-if (
-  packageMetadata.name !== 'freecode-sh'
-  || !/^\d+\.\d+\.\d+-alpha\.\d+$/.test(packageMetadata.version)
-  || releaseContract?.channel !== 'alpha'
-  || releaseContract?.nativeVersion !== packageMetadata.version
-) {
-  fail('The npm package metadata is invalid. Reinstall freecode-sh and try again.')
+export function targetFor(platform = process.platform, arch = process.arch) {
+  if (platform === 'darwin' && arch === 'arm64') return 'darwin-arm64'
+  if (platform === 'win32' && arch === 'x64') return 'windows-x64'
+  throw new Error(`Freecode TUI currently supports Apple silicon macOS and Windows x64; detected ${platform}/${arch}. See https://freecode.sh/download.`)
 }
-
-const homeDirectory = homedir()
-if (!homeDirectory) fail('A home directory is required to install Free Code.')
-
-const requestedPlatform = process.env.FREECODE_INSTALL_OS
-const platform = requestedPlatform === 'Darwin'
-  ? 'darwin'
-  : requestedPlatform === 'Windows_NT'
-    ? 'win32'
-    : process.platform
-const architecture = process.env.FREECODE_INSTALL_ARCH || process.arch
-const supportedHost = (
-  (platform === 'darwin' && ['arm64', 'x64'].includes(architecture))
-  || (platform === 'win32' && architecture === 'x64')
-)
-if (!supportedHost) {
-  fail(`Free Code's native npm installer supports macOS arm64/x64 and Windows x64 (detected ${platform}/${architecture}).`)
-}
-const windows = platform === 'win32'
-const defaultInstallRoot = windows
-  ? join(process.env.LOCALAPPDATA || join(homeDirectory, 'AppData', 'Local'), 'Freecode')
-  : join(homeDirectory, '.local', 'share', 'freecode')
-const installRoot = resolve(process.env.FREECODE_INSTALL_ROOT || defaultInstallRoot)
-const recordedBinDirectory = await readFirstLine(join(installRoot, 'bin-dir'))
-let binDirectory = resolve(
-  windows
-    ? join(installRoot, 'bin')
-    : process.env.FREECODE_BIN_DIR || recordedBinDirectory || join(installRoot, 'npm-bin'),
-)
-let nativeExecutable = join(binDirectory, windows ? 'freecode.cmd' : 'freecode')
-let nativeVersion = await managedNativeVersion(nativeExecutable, installRoot, platform)
-
-if (nativeVersion && compareAlphaVersions(nativeVersion, packageMetadata.version) >= 0) {
-  process.exitCode = await runManaged(nativeExecutable, nativeVersion, process.argv.slice(2))
-} else {
-  if (!windows && await sameFile(nativeExecutable, bootstrapPath)) {
-    binDirectory = join(installRoot, 'npm-bin')
-    nativeExecutable = join(binDirectory, 'freecode')
-  }
-
-  process.stderr.write(`Installing Free Code ${packageMetadata.version}…\n`)
-  const installer = windows
-    ? {
-        command: 'powershell.exe',
-        args: ['-NoLogo', '-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', join(packageDirectory, 'install.ps1'), '-Channel', releaseContract.channel, '-Version', releaseContract.nativeVersion],
-      }
-    : { command: '/bin/sh', args: [join(packageDirectory, 'install.sh'), '--channel', releaseContract.channel, '--version', releaseContract.nativeVersion] }
-  const installerEnvironment = {
-    ...process.env,
-    FREECODE_INSTALL_ROOT: installRoot,
-    FREECODE_BIN_DIR: binDirectory,
-    FREECODE_INSTALL_EMBEDDED: 'true',
-  }
-  const installStartedAt = Date.now()
-  const installStatus = await run(
-    installer.command,
-    installer.args,
-    windows ? withoutPowerShellModulePath(installerEnvironment) : installerEnvironment,
-  )
-  if (installStatus !== 0) process.exit(installStatus)
-  nativeVersion = await managedNativeVersion(nativeExecutable, installRoot, platform)
-  if (!nativeVersion || compareAlphaVersions(nativeVersion, packageMetadata.version) < 0) {
-    fail('The signed installer completed without creating a managed Free Code executable.')
-  }
-  await writeInstallTelemetryReceipt({
-    releaseId: packageMetadata.version,
-    platform: ['darwin', 'linux', 'win32'].includes(platform) ? platform : 'unknown',
-    durationMs: Math.min(86_400_000, Math.max(0, Date.now() - installStartedAt)),
-  })
-  process.exitCode = await runManaged(nativeExecutable, nativeVersion, process.argv.slice(2))
+async function digest(file) {
+  const hash = createHash('sha256')
+  for await (const chunk of createReadStream(file)) hash.update(chunk)
+  return hash.digest('hex')
 }
-
-async function managedNativeVersion(path, root, currentPlatform) {
-  try {
-    await access(path, currentPlatform === 'win32' ? constants.F_OK : constants.X_OK)
-    if (currentPlatform === 'win32') {
-      const version = await readFirstLine(join(root, 'current-version'))
-      if (!/^\d+\.\d+\.\d+-alpha\.\d+$/.test(version || '')) return undefined
-      await access(join(root, 'versions', version, 'bin', 'freecode.exe'), constants.F_OK)
-      return version
-    }
-    const target = await realpath(path)
-    const versionsDirectory = await realpath(resolve(root, 'versions'))
-    const relativeTarget = relative(versionsDirectory, target)
-    const parts = relativeTarget.split(sep)
-    if (
-      relativeTarget === '..' ||
-      relativeTarget.startsWith(`..${sep}`) ||
-      isAbsolute(relativeTarget) ||
-      parts.length !== 3 ||
-      parts[1] !== 'bin' ||
-      parts[2] !== 'freecode' ||
-      !/^\d+\.\d+\.\d+-alpha\.\d+$/.test(parts[0])
-    ) {
-      return undefined
-    }
-    return parts[0]
-  } catch {
-    return undefined
+async function verifyPayload(directory, manifest, target) {
+  const metadata = JSON.parse(await readFile(join(directory, 'terminal.json'), 'utf8'))
+  if (metadata.product !== 'freecode-terminal' || metadata.version !== manifest.version || metadata.engineVersion !== manifest.engineVersion || metadata.sourceRevision !== manifest.sourceRevision || !metadata.files || Object.keys(metadata.files).length < 6)
+    throw new Error('Installed TUI identity does not match its signed release')
+  const executable = target === 'windows-x64' ? 'bin/freecode.exe' : 'bin/freecode'
+  if (!metadata.files[executable]) throw new Error('TUI launcher is missing from its inventory')
+  for (const [name, expected] of Object.entries(metadata.files)) {
+    const path = resolve(directory, name)
+    if (!path.startsWith(directory + sep) || !/^[a-f0-9]{64}$/.test(expected) || await digest(path) !== expected) throw new Error(`TUI payload verification failed: ${name}`)
   }
+  return join(directory, executable)
 }
-
-function runManaged(path, version, args) {
-  const command = windows ? join(installRoot, 'versions', version, 'bin', 'freecode.exe') : path
-  return run(command, args)
-}
-
-async function writeInstallTelemetryReceipt({ releaseId, platform: receiptPlatform, durationMs }) {
-  const configRoot = windows && process.env.APPDATA ? process.env.APPDATA : join(homeDirectory, '.config')
-  const directory = resolve(configRoot, 'freecode')
-  const path = join(directory, 'install-receipt.json')
-  try {
-    await mkdir(directory, { recursive: true, mode: 0o700 })
-    if ((await lstat(directory)).isSymbolicLink()) return
-    try {
-      if ((await lstat(path)).isSymbolicLink()) return
-    } catch (error) {
-      if (error?.code !== 'ENOENT') return
-    }
-    if (!windows) await chmod(directory, 0o700)
-    await writeFile(path, `${JSON.stringify({ version: 1, releaseId, platform: receiptPlatform, durationMs })}\n`, {
-      encoding: 'utf8',
-      mode: 0o600,
-    })
-    if (!windows) await chmod(path, 0o600)
-  } catch {
-    // Install telemetry is best effort and must never fail a verified install.
+async function rejectLinks(directory) {
+  for (const entry of await readdir(directory)) {
+    const path = join(directory, entry), stat = await lstat(path)
+    if (stat.isSymbolicLink() || (!stat.isFile() && !stat.isDirectory())) throw new Error('Links and special files are not supported in TUI archives')
+    if (stat.isDirectory()) await rejectLinks(path)
   }
 }
-
-function compareAlphaVersions(left, right) {
-  const parse = (version) => {
-    const match = version.match(/^(\d+)\.(\d+)\.(\d+)-alpha\.(\d+)$/)
-    if (!match) fail(`The managed Free Code version is invalid: ${version}`)
-    return match.slice(1).map(Number)
+export async function installRelease(manifest, target, cacheRoot, { fetchImpl = fetch } = {}) {
+  const asset = manifest.assets[target]
+  if (!asset) throw new Error('This TUI release has no archive for this computer')
+  const root = resolve(cacheRoot, manifest.version, target)
+  await mkdir(root, { recursive: true })
+  const installed = join(root, asset.sha256)
+  const verifyInstalled = async () => {
+    const marker = JSON.parse(await readFile(join(installed, 'verified-release.json'), 'utf8'))
+    if (marker.sha256 !== asset.sha256) throw new Error('Installed release archive identity differs')
+    return verifyPayload(join(installed, 'terminal'), manifest, target)
   }
-  const leftParts = parse(left)
-  const rightParts = parse(right)
-  for (let index = 0; index < leftParts.length; index += 1) {
-    if (leftParts[index] !== rightParts[index]) return leftParts[index] - rightParts[index]
-  }
-  return 0
-}
-
-async function sameFile(left, right) {
+  try { return await verifyInstalled() }
+  catch (error) { if (error.code !== 'ENOENT') throw error }
+  const staging = await mkdtemp(join(root, '.download-'))
   try {
-    return (await realpath(left)) === (await realpath(right))
-  } catch {
-    return false
-  }
+    const response = await fetchImpl(asset.url, { redirect: 'error', signal: AbortSignal.timeout(300000) })
+    if (!response.ok || !response.body) throw new Error(`TUI download failed (${response.status})`)
+    const archive = join(staging, 'terminal.zip'), hash = createHash('sha256')
+    let size = 0
+    await pipeline(response.body, new Transform({ transform(chunk, _encoding, callback) {
+      size += chunk.length
+      if (size > asset.size) return callback(new Error('TUI archive exceeds its signed size'))
+      hash.update(chunk); callback(null, chunk)
+    } }), createWriteStream(archive, { flags: 'wx' }))
+    if (size !== asset.size || hash.digest('hex') !== asset.sha256) throw new Error('TUI archive does not match its signed digest')
+    // Both supported hosts ship bsdtar. Verify the archive before executing any payload.
+    const entries = execFileSync('tar', ['-tf', archive], { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 }).trim().split(/\r?\n/)
+    if (!entries.length || entries.some(name => !name.startsWith('terminal/') || name.includes('\\') || name.split('/').some(part => part === '..' || part === '.') || name.includes(':')))
+      throw new Error('Unsafe TUI archive paths')
+    const listing = execFileSync('tar', ['-tvf', archive], { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 })
+    if (listing.trim().split(/\r?\n/).some(line => !['-', 'd'].includes(line[0]) || line.includes(' link to '))) throw new Error('Links and special files are not supported in TUI archives')
+    const extract = join(staging, 'payload')
+    await mkdir(extract)
+    execFileSync('tar', ['-xf', archive, '-C', extract], { stdio: 'pipe' })
+    await rejectLinks(extract)
+    await verifyPayload(join(extract, 'terminal'), manifest, target)
+    if (target !== 'windows-x64') await chmod(join(extract, 'terminal/bin/freecode'), 0o755)
+    await writeFile(join(extract, 'verified-release.json'), JSON.stringify({ sha256: asset.sha256 }))
+    // Reuse the cross-process lock used by native auth. Activation is short;
+    // downloads happen outside it, and a crashed owner can be recovered safely.
+    return await createRefreshLock({ path: installed }).run(async () => {
+      // Another launcher may have completed installation while we downloaded.
+      try { return await verifyInstalled() }
+      catch (error) { if (error.code !== 'ENOENT') throw error }
+      const previous = join(staging, 'incomplete')
+      let moved = false
+      try { await rename(installed, previous); moved = true }
+      catch (error) { if (error.code !== 'ENOENT') throw error }
+      try { await rename(extract, installed) }
+      catch (error) { if (moved) await rename(previous, installed); throw error }
+      return verifyInstalled()
+    })
+  } finally { await rm(staging, { recursive: true, force: true }) }
 }
-
-async function readFirstLine(path) {
+export async function main({ platform = process.platform, arch = process.arch, home = homedir(), publicKey, fetchImpl = fetch } = {}) {
+  const directory = dirname(fileURLToPath(import.meta.url))
+  const pkg = JSON.parse(await readFile(join(directory, 'package.json'), 'utf8'))
+  const manifest = signedTerminalManifest(await readFile(join(directory, 'terminal-release.json')), await readFile(join(directory, 'terminal-release.json.sig')), publicKey)
+  if (pkg.name !== 'freecode-sh' || pkg.version !== manifest.version) throw new Error('npm and TUI release identities differ')
+  const target = targetFor(platform, arch)
+  const executable = await installRelease(manifest, target, join(home, '.freecode/terminal-npm'), { fetchImpl })
+  const args = process.argv.slice(2)
+  // The compiled TUI owns login and argument validation, including non-TTY rejection.
+  const child = spawn(executable, args, { stdio: 'inherit', env: process.env })
+  const interrupt = () => child.kill('SIGINT'), terminate = () => child.kill('SIGTERM')
+  process.on('SIGINT', interrupt); process.on('SIGTERM', terminate)
   try {
-    return (await readFile(path, 'utf8')).split(/\r?\n/, 1)[0]?.trim() || undefined
-  } catch {
-    return undefined
-  }
-}
-
-function run(command, args, environment = process.env) {
-  return new Promise((resolvePromise, reject) => {
-    const child = spawn(command, args, {
-      cwd: process.cwd(),
-      env: environment,
-      stdio: 'inherit',
+    await new Promise((resolve, reject) => {
+      child.once('error', reject)
+      child.once('exit', (code, signal) => { process.exitCode = code ?? (signal ? 1 : 0); resolve() })
     })
-    child.once('error', reject)
-    child.once('exit', (code, signal) => resolvePromise(code ?? (signal ? 1 : 0)))
-  }).catch((error) => fail(`Could not start ${command}: ${error.message}`))
+  } finally { process.off('SIGINT', interrupt); process.off('SIGTERM', terminate) }
 }
-
-function fail(message) {
-  process.stderr.write(`freecode: ${message}\n`)
-  process.exit(1)
+if (process.argv[1] && realpathSync(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  main().catch(error => { console.error(error.message); process.exitCode = 1 })
 }

package/install-lock.mjs

@@ -0,0 +1,153 @@
+import { createHash, randomUUID } from 'node:crypto'
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+
+// Two terminal tabs are two processes sharing one credential. Without a lock
+// across them, both present the same one-time refresh token and the server sees
+// exactly the replay that rotation exists to detect — signing out a user who did
+// nothing wrong. In-process single-flight cannot see the other process, so the
+// lock lives on the filesystem next to the credential.
+
+const STALE_MS = 30_000
+const RETRY_MS = 50
+// Never hang a user's CLI on a lock. Refreshing without the lock is unsafe:
+// presenting the same one-time token twice looks exactly like theft.
+const TIMEOUT_MS = 10_000
+
+export class RefreshLockError extends Error {
+  constructor(code = 'refresh_lock_unavailable') {
+    super(code)
+    this.name = 'RefreshLockError'
+    this.code = code
+  }
+}
+
+export function createRefreshLock({
+  path,
+  staleMs = STALE_MS,
+  retryMs = RETRY_MS,
+  timeoutMs = TIMEOUT_MS,
+  now = Date.now,
+  isProcessAlive = processIsAlive,
+} = {}) {
+  // A store without a filesystem path (an injected test double) gets in-process
+  // serialization only, which is all a single process needs.
+  if (!path) return Object.freeze({ run: (task) => task() })
+  const lockPath = `${path}.lock`
+  const ownerPath = join(lockPath, 'owner')
+
+  // 'acquired' | 'busy' | 'unavailable'. Rotation makes this lock a correctness
+  // precondition; failing retryably is safer than invalidating the token family.
+  function acquire() {
+    try {
+      mkdirSync(dirname(lockPath), { recursive: true, mode: 0o700 })
+    } catch {
+      // Kept separate from the write below: a recursive mkdir also reports
+      // EEXIST when the directory path is an ordinary file, and reading that as
+      // "someone holds the lock" would spin until the timeout instead of going
+      // straight through.
+      return 'unavailable'
+    }
+    const instance = randomUUID()
+    const candidatePath = `${lockPath}.${process.pid}.${instance}.candidate`
+    try {
+      // Build a non-empty directory first, then atomically rename it into place.
+      // A populated directory cannot be replaced by another rename, which makes
+      // both acquisition and stale recovery safe across macOS, Linux, and Windows.
+      mkdirSync(candidatePath, { mode: 0o700 })
+      writeFileSync(join(candidatePath, 'owner'), `${process.pid}:${instance}\n`, {
+        encoding: 'utf8', mode: 0o600, flag: 'wx',
+      })
+      renameSync(candidatePath, lockPath)
+      return 'acquired'
+    } catch (error) {
+      return existsSync(lockPath) || error?.code === 'EEXIST' || error?.code === 'ENOTEMPTY'
+        ? 'busy'
+        : 'unavailable'
+    } finally {
+      try { rmSync(candidatePath, { recursive: true, force: true }) } catch {}
+    }
+  }
+
+  function staleLock() {
+    try {
+      if (now() - statSync(lockPath).mtimeMs <= staleMs) return false
+      const contents = readFileSync(ownerPath, 'utf8')
+      const owner = Number.parseInt(contents.split(':', 1)[0], 10)
+      // Age alone is not enough: a suspended process can still resume its
+      // refresh. Only a lock whose recorded owner is gone may be recovered.
+      if (Number.isSafeInteger(owner) && owner > 0 && isProcessAlive(owner)) return false
+      return { recoveryPath: recoveryPathFor(lockPath, contents) }
+    } catch {
+      // Released while we were looking; the next acquire settles it.
+      return false
+    }
+  }
+
+  function recover(stale) {
+    // This one rename both claims and removes the stale directory. The recovery
+    // directory remains populated, so a delayed waiter cannot rename a live
+    // replacement over it.
+    try {
+      renameSync(lockPath, stale.recoveryPath)
+      return 'recovered'
+    } catch (error) {
+      return !existsSync(lockPath) || existsSync(stale.recoveryPath) || error?.code === 'ENOENT'
+        ? 'claimed'
+        : 'unavailable'
+    }
+  }
+
+  function release() {
+    // Windows can refuse removal while another handle is open. A stuck lock
+    // directory is broken by staleness, so a failed release must never surface
+    // to the caller as a refresh error.
+    try { rmSync(lockPath, { recursive: true, force: true }) } catch {}
+  }
+
+  async function run(task) {
+    const deadline = now() + timeoutMs
+    let held = false
+    while (now() < deadline) {
+      const state = acquire()
+      if (state === 'acquired') { held = true; break }
+      if (state === 'unavailable') throw new RefreshLockError()
+      // A crashed process leaves its lock behind. Break it once it is clearly
+      // older than any real refresh.
+      const stale = staleLock()
+      if (stale) {
+        const recovery = recover(stale)
+        if (recovery === 'unavailable') throw new RefreshLockError()
+        if (recovery !== 'recovered') await delay(retryMs)
+      } else await delay(retryMs)
+    }
+    if (!held) throw new RefreshLockError('refresh_lock_timeout')
+    try {
+      return await task()
+    } finally {
+      if (held) release()
+    }
+  }
+
+  return Object.freeze({ run, lockPath, ownerPath })
+}
+
+function recoveryPathFor(lockPath, contents) {
+  const identity = createHash('sha256').update(contents).digest('hex').slice(0, 32)
+  return `${lockPath}.${identity}.recovered`
+}
+
+function delay(ms) {
+  return new Promise((resolve) => { setTimeout(resolve, ms) })
+}
+
+function processIsAlive(pid) {
+  try {
+    process.kill(pid, 0)
+    return true
+  } catch (error) {
+    // EPERM means the process exists but cannot be signalled. Only ESRCH is
+    // evidence that the recorded owner is gone.
+    return error?.code !== 'ESRCH'
+  }
+}

package/package.json

@@ -1,52 +1,41 @@
 {
   "name": "freecode-sh",
-  "version": "0.1.0-alpha.42",
-  "description": "A free coding agent for your terminal.",
+  "version": "0.1.0-rc.3",
+  "description": "The free interactive coding agent for your terminal.",
   "license": "UNLICENSED",
-  "author": "freecode",
-  "homepage": "https://freecode.sh",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/freecode-sh/freecode.git"
-  },
-  "bugs": {
-    "url": "https://github.com/freecode-sh/freecode/issues"
-  },
-  "keywords": [
-    "ai",
-    "agent",
-    "coding-agent",
-    "cli",
-    "developer-tools"
-  ],
   "type": "module",
   "bin": {
     "freecode": "./freecode.mjs",
     "freecode-sh": "./freecode.mjs"
   },
-  "files": [
-    "check-platform.mjs",
-    "freecode.mjs",
-    "npm-bootstrap-environment.mjs",
-    "install.sh",
-    "install.ps1"
-  ],
   "engines": {
-    "node": ">=18.18.0"
+    "node": ">=22.18.0"
   },
   "os": [
     "darwin",
     "win32"
   ],
+  "cpu": [
+    "arm64",
+    "x64"
+  ],
   "scripts": {
     "preinstall": "node check-platform.mjs"
   },
+  "files": [
+    "install-lock.mjs",
+    "check-platform.mjs",
+    "freecode.mjs",
+    "release.mjs",
+    "release-trust.mjs",
+    "release-version.cjs",
+    "terminal-release.json",
+    "terminal-release.json.sig",
+    "README.md"
+  ],
+  "homepage": "https://freecode.sh/download",
   "publishConfig": {
     "access": "public",
     "tag": "latest"
-  },
-  "freecodeRelease": {
-    "channel": "alpha",
-    "nativeVersion": "0.1.0-alpha.42"
   }
 }

package/release-trust.mjs

@@ -0,0 +1,24 @@
+import { createVerify } from 'node:crypto'
+
+export const RELEASE_SIGNING_PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
+MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEA8so4sWArOV0GXihYvoSo
+xDLI1yMoILnVfCjYQwe4CKQ9EC10JV30cntMJZWXvXZS6STqQGIjyWisa6Op4nId
+OuXKDjaEcQIeftgZBzzyGrMmAMC3W57VAi3d+w/F2XnkXBaH3NOphfftF6Fxt3Q0
+2CxN3PjuuFaOGytKsYF5uDLCvEb+MpzJlD3HZoBzhhMCAoY6wmCdlgaDxD20UFdy
+EigF5wwpcUWpYmbYMFp+6SLe/Fi8IrYirwiCv5eLur6PzFFcwFrJgUeZAdxmGuM8
+eJzZlc7mK0+gzi8KpC2FZ9eOx1SafPE4An4+u8rZ7WA1Qk5eCAhNU9lm+JAeeKcC
+XzhQpPUafybJg75dIbIayOC3tf5mn+X+Vl5+uY19nT2qcJsjgUeIcqbMs9FGXiIA
+2G292N5WppyiDcx8yAIG6rOrAUGzHMYCrhvxQLAx2KP5QfC53VZ3La7yZOATY5ic
+F78qSSBrKDrT42vinbosbX++Wr34YB6pXhiZF6jHPHrxAgMBAAE=
+-----END PUBLIC KEY-----`
+
+export function verifyReleaseSignature(payload, signature, publicKey = RELEASE_SIGNING_PUBLIC_KEY_PEM) {
+  try {
+    const verifier = createVerify('SHA256')
+    verifier.update(payload)
+    verifier.end()
+    return verifier.verify(publicKey, signature)
+  } catch {
+    return false
+  }
+}

package/release-version.cjs

@@ -0,0 +1,17 @@
+// Display versions and native build numbers have independent lifecycles.
+const pattern = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-(alpha|rc)\.(0|[1-9]\d*))?$/
+function releaseVersion(version) {
+  if (typeof version !== 'string' || !pattern.test(version)) throw new Error('Use a release version such as 0.1.0-alpha.53, 0.1.0-rc.1 or 0.1.0.')
+  return version
+}
+function nativeVersions(version, buildNumber) {
+  releaseVersion(version)
+  const n = Number(buildNumber)
+  if (!/^[1-9]\d*$/.test(String(buildNumber)) || !Number.isSafeInteger(n) || n > 999999)
+    throw new Error('Pass --build-number: an increasing release sequence between 1 and 999999.')
+  // Start above legacy 0.x build numbers. All components respect Apple's limits
+  // (four digits, two digits, two digits) and Windows' 16-bit component limits.
+  const build = [1 + Math.floor(n / 10000), Math.floor(n / 100) % 100, n % 100]
+  return { short: version.split('-')[0], mac: build.join('.'), windows: [build[0], 0, ...build.slice(1)].join('.'), buildNumber: n }
+}
+module.exports = { releaseVersion, nativeVersions }