freecode-sh 0.1.0-alpha.42 → 0.1.0-rc.3

package/install.sh

@@ -1,687 +0,0 @@
-#!/bin/sh
-
-# Free Code native installer for macOS.
-# Review this script before running it: https://freecode.sh/install
-
-set -eu
-
-DEFAULT_CHANNEL="alpha"
-DEFAULT_DOWNLOAD_BASE_URL="https://releases.freecode.sh/releases"
-DEFAULT_CHANNEL_BASE_URL="https://releases.freecode.sh/channels"
-EXPECTED_TEAM_IDENTIFIER="GD597P8KJ2"
-# Apple code requirement language. "anchor apple generic" forces the signing
-# chain to terminate at Apple's root certificate, so only a real Developer ID
-# certificate issued to this team can satisfy it. Text printed by
-# `codesign --display` cannot be trusted for this: Authority and TeamIdentifier
-# lines are read straight out of the certificate, so a self-signed certificate
-# can present any subject and OU it likes.
-RELEASE_CODE_REQUIREMENT="=anchor apple generic and certificate leaf[subject.OU] = \"$EXPECTED_TEAM_IDENTIFIER\""
-CODESIGN_BIN="/usr/bin/codesign"
-LEGACY_ALPHA6_MANIFEST_SHA256="1bf63e0d6114b12d61c07094936bd2606ae82ce87d5b054fbfb01c5f3d3646d8"
-LAUNCHER_RELATIVE_PATH="bin/freecode"
-INTERFACE_RELATIVE_PATH="libexec/freecode/freecode-tui"
-ENGINE_RELATIVE_PATH="libexec/freecode/freecode-engine"
-
-VERSION="${FREECODE_INSTALL_VERSION:-}"
-CHANNEL="${FREECODE_INSTALL_CHANNEL:-$DEFAULT_CHANNEL}"
-DOWNLOAD_BASE_URL="${FREECODE_INSTALL_BASE_URL:-$DEFAULT_DOWNLOAD_BASE_URL}"
-CHANNEL_BASE_URL="${FREECODE_CHANNEL_BASE_URL:-$DEFAULT_CHANNEL_BASE_URL}"
-INSTALL_ROOT="${FREECODE_INSTALL_ROOT:-${HOME:?HOME is required}/.local/share/freecode}"
-BIN_DIR="${FREECODE_BIN_DIR:-${HOME}/.local/bin}"
-OS_NAME="${FREECODE_INSTALL_OS:-$(uname -s)}"
-MACHINE="${FREECODE_INSTALL_ARCH:-$(uname -m)}"
-TEMP_DIR=""
-STAGE_DIR=""
-INSTALL_LOCK_PATH=""
-INSTALL_LOCK_HELD="false"
-INSTALL_LOCK_OWNER_TOKEN=""
-INSTALL_LOCK_GUARD_HELD="false"
-ALLOW_UNSIGNED_INSTALL="${FREECODE_ALLOW_UNSIGNED_INSTALL:-false}"
-EMBEDDED_INSTALL="${FREECODE_INSTALL_EMBEDDED:-false}"
-LAUNCH_AFTER_INSTALL="${FREECODE_INSTALL_LAUNCH:-true}"
-RELEASE_MODE=""
-PATH_PROFILE=""
-PATH_CONFIGURED="false"
-
-usage() {
-  cat <<'EOF'
-Install Free Code's native macOS release.
-
-Usage:
-  curl -fsSL https://freecode.sh/install.sh | sh
-  curl -fsSL https://freecode.sh/install.sh | sh -s -- --version 0.1.0-alpha.1
-
-Options:
-  --version VERSION          Install an exact immutable version.
-  --channel CHANNEL          Resolve a channel (default: alpha).
-  --base-url URL             Override the immutable release download base URL.
-  --channel-base-url URL     Override the channel manifest base URL.
-  --install-root PATH        Version store (default: ~/.local/share/freecode).
-  --bin-dir PATH             Executable link directory (default: ~/.local/bin).
-  --no-launch                Install without opening Free Code.
-  -h, --help                 Show this help.
-
-Environment equivalents:
-  FREECODE_INSTALL_VERSION, FREECODE_INSTALL_CHANNEL,
-  FREECODE_INSTALL_BASE_URL, FREECODE_CHANNEL_BASE_URL,
-  FREECODE_INSTALL_ROOT, FREECODE_BIN_DIR, FREECODE_INSTALL_LAUNCH
-
-Internal testing only:
-  FREECODE_ALLOW_UNSIGNED_INSTALL=true permits an explicitly marked unsigned
-  release outside the alpha channel. Never use this for a normal install.
-EOF
-}
-
-fail() {
-  printf 'freecode installer: %s\n' "$*" >&2
-  exit 1
-}
-
-cleanup() {
-  if [ -n "$TEMP_DIR" ] && [ -d "$TEMP_DIR" ]; then
-    rm -rf "$TEMP_DIR"
-  fi
-  if [ -n "$STAGE_DIR" ] && [ -d "$STAGE_DIR" ]; then
-    rm -rf "$STAGE_DIR"
-  fi
-  release_install_lock
-}
-
-require_value() {
-  [ "$#" -ge 2 ] || fail "$1 requires a value"
-  [ -n "$2" ] || fail "$1 requires a non-empty value"
-}
-
-release_install_lock() {
-  if [ "$INSTALL_LOCK_HELD" = "true" ]; then
-    lock_owner=$(sed -n '1p' "$INSTALL_LOCK_PATH" 2>/dev/null || true)
-    lock_owner_token=$(sed -n '2p' "$INSTALL_LOCK_PATH" 2>/dev/null || true)
-    if [ "$lock_owner" = "$$" ] && [ "$lock_owner_token" = "$INSTALL_LOCK_OWNER_TOKEN" ]; then
-      rm -f "$INSTALL_LOCK_PATH"
-    fi
-  fi
-  INSTALL_LOCK_HELD="false"
-  if [ "$INSTALL_LOCK_GUARD_HELD" = "true" ]; then
-    exec 9>&-
-    INSTALL_LOCK_GUARD_HELD="false"
-  fi
-}
-
-create_install_lock() {
-  (
-    umask 077
-    set -C
-    printf '%s\n%s\n' "$$" "$INSTALL_LOCK_OWNER_TOKEN" > "$INSTALL_LOCK_PATH"
-  ) 2>/dev/null
-}
-
-process_start_token() {
-  LC_ALL=C ps -o lstart= -p "$1" 2>/dev/null \
-    | sed -n '1{s/^[[:space:]]*//;s/[[:space:]]*$//;p;}'
-}
-
-acquire_install_lock() {
-  INSTALL_LOCK_PATH="$INSTALL_ROOT/.update-lock"
-  INSTALL_LOCK_OWNER_TOKEN=$(process_start_token "$$")
-  [ -n "$INSTALL_LOCK_OWNER_TOKEN" ] \
-    || fail "could not identify the installer process for update locking"
-  mkdir -p "$INSTALL_ROOT"
-  exec 9>"$INSTALL_LOCK_PATH.guard"
-  # Descriptor-mode locks remain attached to fd 9 after the helper exits and
-  # are held until release_install_lock closes the descriptor.
-  if [ -x /usr/bin/lockf ]; then
-    guard_acquired=false
-    /usr/bin/lockf -s -t 120 9 && guard_acquired=true
-  elif [ "$(uname -s)" = "Linux" ] && command -v flock >/dev/null 2>&1; then
-    # The Linux CI host emulates Darwin to exercise this macOS-only installer.
-    guard_acquired=false
-    flock -w 120 9 && guard_acquired=true
-  else
-    exec 9>&-
-    fail "the system lock utility is unavailable"
-  fi
-  if [ "$guard_acquired" != "true" ]; then
-    exec 9>&-
-    fail "another Free Code install or update is still in progress"
-  fi
-  INSTALL_LOCK_GUARD_HELD="true"
-  attempts=0
-  while ! create_install_lock; do
-    # Read both the regular-file protocol and the short-lived directory format
-    # used by development builds before the lock contract was unified.
-    if [ -d "$INSTALL_LOCK_PATH" ]; then
-      lock_owner=$(sed -n '1p' "$INSTALL_LOCK_PATH/pid" 2>/dev/null || true)
-      lock_owner_token=""
-    else
-      lock_owner=$(sed -n '1p' "$INSTALL_LOCK_PATH" 2>/dev/null || true)
-      lock_owner_token=$(sed -n '2p' "$INSTALL_LOCK_PATH" 2>/dev/null || true)
-    fi
-    case "$lock_owner" in
-      ''|*[!0-9]*) ;;
-      *)
-        if ! kill -0 "$lock_owner" 2>/dev/null; then
-          rm -rf "$INSTALL_LOCK_PATH"
-          continue
-        fi
-        if [ -n "$lock_owner_token" ]; then
-          current_owner_token=$(process_start_token "$lock_owner")
-          if [ -n "$current_owner_token" ] && [ "$current_owner_token" != "$lock_owner_token" ]; then
-            rm -rf "$INSTALL_LOCK_PATH"
-            continue
-          fi
-        fi
-        ;;
-    esac
-    attempts=$((attempts + 1))
-    [ "$attempts" -lt 120 ] \
-      || fail "another Free Code install or update is still in progress"
-    sleep 1
-  done
-  INSTALL_LOCK_HELD="true"
-
-  if [ -n "${FREECODE_TEST_HOLD_INSTALL_LOCK_SECONDS:-}" ]; then
-    case "$DOWNLOAD_BASE_URL" in
-      file://*) sleep "$FREECODE_TEST_HOLD_INSTALL_LOCK_SECONDS" ;;
-      *) fail "the test install delay is permitted only with local file URLs" ;;
-    esac
-  fi
-}
-
-configure_profile() {
-  profile=$1
-  path_line=$2
-  legacy_path_line=${3:-}
-  profile_dir=$(dirname "$profile")
-
-  [ -d "$profile_dir" ] || return 1
-  if [ -e "$profile" ] || [ -L "$profile" ]; then
-    [ -f "$profile" ] || return 1
-  fi
-  if grep -Fqx "$path_line" "$profile" 2>/dev/null \
-    || { [ -n "$legacy_path_line" ] && grep -Fqx "$legacy_path_line" "$profile" 2>/dev/null; }
-  then
-    return 0
-  fi
-  if [ -s "$profile" ] && ! printf '\n' >> "$profile"; then
-    return 1
-  fi
-  printf '# Free Code\n%s\n' "$path_line" >> "$profile"
-}
-
-configure_path() {
-  [ "$BIN_DIR" = "$HOME/.local/bin" ] || return 0
-
-  guarded_path_line='case ":$PATH:" in *":$HOME/.local/bin:"*) ;; *) export PATH="$HOME/.local/bin:$PATH" ;; esac'
-  legacy_path_line='export PATH="$HOME/.local/bin:$PATH"'
-  detected_shell=${SHELL:-/bin/zsh}
-
-  case "$detected_shell" in
-    */zsh)
-      zsh_config_dir=${ZDOTDIR:-$HOME}
-      if configure_profile "$zsh_config_dir/.zprofile" "$guarded_path_line" "$legacy_path_line" \
-        && configure_profile "$zsh_config_dir/.zshrc" "$guarded_path_line" "$legacy_path_line"
-      then
-        PATH_PROFILE="$zsh_config_dir/.zprofile and $zsh_config_dir/.zshrc"
-        PATH_CONFIGURED="true"
-      fi
-      ;;
-    */bash)
-      if [ -e "$HOME/.bash_profile" ] || [ -L "$HOME/.bash_profile" ]; then
-        bash_login_profile="$HOME/.bash_profile"
-      elif [ -e "$HOME/.bash_login" ] || [ -L "$HOME/.bash_login" ]; then
-        bash_login_profile="$HOME/.bash_login"
-      elif [ -e "$HOME/.profile" ] || [ -L "$HOME/.profile" ]; then
-        bash_login_profile="$HOME/.profile"
-      else
-        bash_login_profile="$HOME/.bash_profile"
-      fi
-      if configure_profile "$bash_login_profile" "$guarded_path_line" "$legacy_path_line" \
-        && configure_profile "$HOME/.bashrc" "$guarded_path_line" "$legacy_path_line"
-      then
-        PATH_PROFILE="$bash_login_profile and $HOME/.bashrc"
-        PATH_CONFIGURED="true"
-      fi
-      ;;
-    */fish)
-      fish_config_dir="${XDG_CONFIG_HOME:-$HOME/.config}/fish/conf.d"
-      if mkdir -p "$fish_config_dir" 2>/dev/null \
-        && configure_profile "$fish_config_dir/freecode.fish" \
-          'contains -- "$HOME/.local/bin" $PATH; or set -gx PATH "$HOME/.local/bin" $PATH'
-      then
-        PATH_PROFILE="$fish_config_dir/freecode.fish"
-        PATH_CONFIGURED="true"
-      fi
-      ;;
-  esac
-}
-
-trap cleanup EXIT HUP INT TERM
-
-while [ "$#" -gt 0 ]; do
-  case "$1" in
-    --version)
-      require_value "$@"
-      VERSION=$2
-      shift 2
-      ;;
-    --channel)
-      require_value "$@"
-      CHANNEL=$2
-      shift 2
-      ;;
-    --base-url)
-      require_value "$@"
-      DOWNLOAD_BASE_URL=$2
-      shift 2
-      ;;
-    --channel-base-url)
-      require_value "$@"
-      CHANNEL_BASE_URL=$2
-      shift 2
-      ;;
-    --install-root)
-      require_value "$@"
-      INSTALL_ROOT=$2
-      shift 2
-      ;;
-    --bin-dir)
-      require_value "$@"
-      BIN_DIR=$2
-      shift 2
-      ;;
-    --no-launch)
-      LAUNCH_AFTER_INSTALL="false"
-      shift
-      ;;
-    -h|--help)
-      usage
-      exit 0
-      ;;
-    --)
-      shift
-      break
-      ;;
-    *)
-      fail "unknown option: $1"
-      ;;
-  esac
-done
-
-[ "$#" -eq 0 ] || fail "unexpected positional arguments: $*"
-command -v curl >/dev/null 2>&1 || fail "curl is required"
-command -v tar >/dev/null 2>&1 || fail "tar is required"
-command -v shasum >/dev/null 2>&1 || fail "shasum is required"
-
-case "$ALLOW_UNSIGNED_INSTALL" in
-  true|false) ;;
-  *) fail "FREECODE_ALLOW_UNSIGNED_INSTALL must be exactly true or false" ;;
-esac
-
-case "$EMBEDDED_INSTALL" in
-  true|false) ;;
-  *) fail "FREECODE_INSTALL_EMBEDDED must be exactly true or false" ;;
-esac
-
-case "$LAUNCH_AFTER_INSTALL" in
-  true|false) ;;
-  *) fail "FREECODE_INSTALL_LAUNCH must be exactly true or false" ;;
-esac
-
-case "$OS_NAME" in
-  Darwin) ;;
-  *) fail "only macOS is supported right now (detected $OS_NAME)" ;;
-esac
-
-case "$MACHINE" in
-  arm64|aarch64)
-    ARCH="arm64"
-    ;;
-  x86_64|amd64)
-    # Prefer the native Apple Silicon build when this shell is running under Rosetta.
-    if [ "${FREECODE_INSTALL_ARCH:-}" = "" ] && [ "$(sysctl -in sysctl.proc_translated 2>/dev/null || true)" = "1" ]; then
-      ARCH="arm64"
-    else
-      ARCH="x64"
-    fi
-    ;;
-  *)
-    fail "unsupported Mac architecture: $MACHINE"
-    ;;
-esac
-
-validate_version() {
-  printf '%s\n' "$1" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z][0-9A-Za-z.-]*)?$' \
-    || fail "invalid release version: $1"
-}
-
-validate_channel() {
-  printf '%s\n' "$1" | grep -Eq '^[0-9A-Za-z][0-9A-Za-z._-]*$' \
-    || fail "invalid release channel: $1"
-}
-
-validate_release_security() {
-  manifest_path=$1
-  context=$2
-  release_mode=$(sed -n 's/.*"releaseMode"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$manifest_path" | head -n 1)
-  manifest_channel=$(sed -n 's/.*"channel"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$manifest_path" | head -n 1)
-  case "$release_mode" in
-    signed-notarized)
-      RELEASE_MODE="signed-notarized"
-      ;;
-    unsigned-override)
-      if [ "$CHANNEL" = "alpha" ] && [ "$manifest_channel" = "alpha" ]; then
-        printf 'WARNING: %s is an unsigned Free Code alpha and is not Apple notarized. Its SHA-256 checksum will still be verified.\n' "$context" >&2
-      elif [ "$ALLOW_UNSIGNED_INSTALL" = "true" ]; then
-        printf 'WARNING: %s declares unsigned-override security metadata outside the alpha channel.\n' "$context" >&2
-      else
-        fail "$context is unsigned and is not an alpha release; refusing to install it"
-      fi
-      RELEASE_MODE="unsigned-override"
-      ;;
-    *) fail "$context does not contain valid signed-notarized release security metadata" ;;
-  esac
-}
-
-# Test-only seam. Signature verification runs /usr/bin/codesign by absolute path
-# so nothing on PATH can impersonate it; the installer test suite substitutes a
-# stub, and like every other FREECODE_TEST_* override it is refused unless the
-# release is being read from a local file:// URL.
-resolve_codesign_bin() {
-  [ -n "${FREECODE_TEST_CODESIGN_BIN:-}" ] || return 0
-  case "$DOWNLOAD_BASE_URL" in
-    file://*) CODESIGN_BIN="$FREECODE_TEST_CODESIGN_BIN" ;;
-    *) fail "the test codesign override is permitted only with local file URLs" ;;
-  esac
-}
-
-verify_release_signatures() {
-  root=$1
-  if [ "$RELEASE_MODE" = "unsigned-override" ]; then
-    printf 'WARNING: skipping Apple signature and Team ID verification for this explicitly marked unsigned release.\n' >&2
-    return
-  fi
-
-  [ -x "$CODESIGN_BIN" ] || fail "$CODESIGN_BIN is required to verify this release"
-  for executable in \
-    "$root/$LAUNCHER_RELATIVE_PATH" \
-    "$root/$INTERFACE_RELATIVE_PATH" \
-    "$root/$ENGINE_RELATIVE_PATH"
-  do
-    # Without -R this only proves the seal is intact, not who signed it.
-    "$CODESIGN_BIN" --verify --strict --verbose=2 -R "$RELEASE_CODE_REQUIREMENT" "$executable" \
-      || fail "Apple signature verification failed for $executable; it must be Developer ID signed by Apple team $EXPECTED_TEAM_IDENTIFIER"
-  done
-}
-
-write_release_public_key() {
-  destination=$1
-  if [ -n "${FREECODE_TEST_RELEASE_PUBLIC_KEY_FILE:-}" ]; then
-    case "$DOWNLOAD_BASE_URL" in
-      file://*) cp "$FREECODE_TEST_RELEASE_PUBLIC_KEY_FILE" "$destination" ;;
-      *) fail "the test release key override is permitted only with local file URLs" ;;
-    esac
-    return
-  fi
-  cat > "$destination" <<'EOF'
------BEGIN PUBLIC KEY-----
-MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEA8so4sWArOV0GXihYvoSo
-xDLI1yMoILnVfCjYQwe4CKQ9EC10JV30cntMJZWXvXZS6STqQGIjyWisa6Op4nId
-OuXKDjaEcQIeftgZBzzyGrMmAMC3W57VAi3d+w/F2XnkXBaH3NOphfftF6Fxt3Q0
-2CxN3PjuuFaOGytKsYF5uDLCvEb+MpzJlD3HZoBzhhMCAoY6wmCdlgaDxD20UFdy
-EigF5wwpcUWpYmbYMFp+6SLe/Fi8IrYirwiCv5eLur6PzFFcwFrJgUeZAdxmGuM8
-eJzZlc7mK0+gzi8KpC2FZ9eOx1SafPE4An4+u8rZ7WA1Qk5eCAhNU9lm+JAeeKcC
-XzhQpPUafybJg75dIbIayOC3tf5mn+X+Vl5+uY19nT2qcJsjgUeIcqbMs9FGXiIA
-2G292N5WppyiDcx8yAIG6rOrAUGzHMYCrhvxQLAx2KP5QfC53VZ3La7yZOATY5ic
-F78qSSBrKDrT42vinbosbX++Wr34YB6pXhiZF6jHPHrxAgMBAAE=
------END PUBLIC KEY-----
-EOF
-}
-
-authenticate_release_manifest() {
-  manifest_path=$1
-  signature_path=$2
-  context=$3
-  if [ -s "$signature_path" ] && \
-    /usr/bin/openssl dgst -sha256 \
-      -verify "$RELEASE_PUBLIC_KEY" \
-      -signature "$signature_path" \
-      "$manifest_path" >/dev/null 2>&1
-  then
-    return
-  fi
-
-  manifest_sha=$(shasum -a 256 "$manifest_path" | awk '{ print $1 }')
-  if [ "$manifest_sha" = "$LEGACY_ALPHA6_MANIFEST_SHA256" ]; then
-    printf 'WARNING: %s predates release-manifest signatures; accepting its exact pinned alpha.6 manifest.\n' "$context" >&2
-    return
-  fi
-  fail "$context does not have a valid Free Code release signature"
-}
-
-manifest_asset_value() {
-  manifest_path=$1
-  target=$2
-  field=$3
-  awk -v target="$target" -v field="$field" '
-    /^[[:space:]]*"assets"[[:space:]]*:[[:space:]]*{/ { in_assets = 1; next }
-    in_assets && index($0, "\"" target "\"") && index($0, ":") { in_target = 1; next }
-    in_target && index($0, "\"" field "\"") {
-      value = $0
-      sub(/^[^:]*:[[:space:]]*/, "", value)
-      sub(/,[[:space:]]*$/, "", value)
-      sub(/^"/, "", value)
-      sub(/"$/, "", value)
-      print value
-      exit
-    }
-    in_target && /^[[:space:]]*}[,]?[[:space:]]*$/ { exit }
-  ' "$manifest_path"
-}
-
-DOWNLOAD_BASE_URL=${DOWNLOAD_BASE_URL%/}
-CHANNEL_BASE_URL=${CHANNEL_BASE_URL%/}
-validate_channel "$CHANNEL"
-
-resolve_codesign_bin
-
-TEMP_DIR=$(mktemp -d "${TMPDIR:-/tmp}/freecode-install.XXXXXX")
-RELEASE_PUBLIC_KEY="$TEMP_DIR/release-signing-public.pem"
-write_release_public_key "$RELEASE_PUBLIC_KEY"
-
-if [ -z "$VERSION" ]; then
-  CHANNEL_MANIFEST="$TEMP_DIR/channel.json"
-  CHANNEL_SIGNATURE="$TEMP_DIR/channel.json.sig"
-  CHANNEL_URL="$CHANNEL_BASE_URL/$CHANNEL.json"
-  printf 'Resolving Free Code channel %s...\n' "$CHANNEL"
-  curl -fsSL --retry 3 --connect-timeout 15 "$CHANNEL_URL" -o "$CHANNEL_MANIFEST" \
-    || fail "could not download channel manifest: $CHANNEL_URL"
-  curl -fsSL --retry 3 --connect-timeout 15 "$CHANNEL_URL.sig" -o "$CHANNEL_SIGNATURE" 2>/dev/null \
-    || rm -f "$CHANNEL_SIGNATURE"
-  authenticate_release_manifest "$CHANNEL_MANIFEST" "$CHANNEL_SIGNATURE" "channel $CHANNEL"
-  VERSION=$(sed -n 's/.*"version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$CHANNEL_MANIFEST" | head -n 1)
-  [ -n "$VERSION" ] || fail "channel manifest does not contain a version"
-  validate_release_security "$CHANNEL_MANIFEST" "channel $CHANNEL"
-fi
-validate_version "$VERSION"
-
-mkdir -p "$INSTALL_ROOT"
-acquire_install_lock
-
-ASSET="freecode-darwin-$ARCH.tar.gz"
-TAG="v$VERSION"
-RELEASE_URL="$DOWNLOAD_BASE_URL/$TAG"
-ARCHIVE="$TEMP_DIR/$ASSET"
-RELEASE_MANIFEST="$TEMP_DIR/release-manifest.json"
-RELEASE_SIGNATURE="$TEMP_DIR/release-manifest.json.sig"
-
-curl -fsSL --retry 3 --connect-timeout 15 "$RELEASE_URL/release-manifest.json" -o "$RELEASE_MANIFEST" \
-  || fail "could not download release manifest: $RELEASE_URL/release-manifest.json"
-curl -fsSL --retry 3 --connect-timeout 15 "$RELEASE_URL/release-manifest.json.sig" -o "$RELEASE_SIGNATURE" 2>/dev/null \
-  || rm -f "$RELEASE_SIGNATURE"
-authenticate_release_manifest "$RELEASE_MANIFEST" "$RELEASE_SIGNATURE" "release $VERSION"
-
-MANIFEST_VERSION=$(sed -n 's/.*"version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$RELEASE_MANIFEST" | head -n 1)
-[ "$MANIFEST_VERSION" = "$VERSION" ] \
-  || fail "release manifest version ${MANIFEST_VERSION:-missing} does not match requested version $VERSION"
-validate_release_security "$RELEASE_MANIFEST" "release $VERSION"
-
-MANIFEST_TARGET="darwin-$ARCH"
-MANIFEST_ARCHIVE=$(manifest_asset_value "$RELEASE_MANIFEST" "$MANIFEST_TARGET" archive)
-[ "$MANIFEST_ARCHIVE" = "$ASSET" ] \
-  || fail "release manifest does not declare the expected archive $ASSET"
-EXPECTED_SHA=$(manifest_asset_value "$RELEASE_MANIFEST" "$MANIFEST_TARGET" sha256)
-printf '%s\n' "$EXPECTED_SHA" | grep -Eq '^[0-9a-fA-F]{64}$' \
-  || fail "release checksum is not a SHA-256 digest"
-EXPECTED_SIZE=$(manifest_asset_value "$RELEASE_MANIFEST" "$MANIFEST_TARGET" size)
-printf '%s\n' "$EXPECTED_SIZE" | grep -Eq '^[1-9][0-9]*$' \
-  || fail "release manifest does not contain a valid archive size"
-
-printf 'Downloading Free Code %s for darwin-%s...\n' "$VERSION" "$ARCH"
-curl -fsSL --retry 3 --connect-timeout 15 "$RELEASE_URL/$ASSET" -o "$ARCHIVE" \
-  || fail "could not download release asset: $RELEASE_URL/$ASSET"
-ACTUAL_SIZE=$(wc -c < "$ARCHIVE" | tr -d '[:space:]')
-[ "$ACTUAL_SIZE" = "$EXPECTED_SIZE" ] \
-  || fail "download size verification failed for $ASSET"
-ACTUAL_SHA=$(shasum -a 256 "$ARCHIVE" | awk '{ print $1 }')
-[ "$ACTUAL_SHA" = "$EXPECTED_SHA" ] \
-  || fail "checksum verification failed for $ASSET"
-
-if tar -tzf "$ARCHIVE" | grep -Eq '(^/|(^|/)\.\.(/|$))'; then
-  fail "release archive contains an unsafe path"
-fi
-
-mkdir -p "$INSTALL_ROOT/versions" "$BIN_DIR"
-VERSION_DIR="$INSTALL_ROOT/versions/$VERSION"
-NEW_INSTALL="false"
-
-if [ ! -d "$VERSION_DIR" ]; then
-  STAGE_DIR=$(mktemp -d "$INSTALL_ROOT/.install-$VERSION.XXXXXX")
-  tar -xzf "$ARCHIVE" -C "$STAGE_DIR"
-  [ -x "$STAGE_DIR/$LAUNCHER_RELATIVE_PATH" ] \
-    || fail "release archive is missing executable $LAUNCHER_RELATIVE_PATH"
-  [ -x "$STAGE_DIR/$INTERFACE_RELATIVE_PATH" ] \
-    || fail "release archive is missing $INTERFACE_RELATIVE_PATH"
-  [ -x "$STAGE_DIR/$ENGINE_RELATIVE_PATH" ] \
-    || fail "release archive is missing $ENGINE_RELATIVE_PATH"
-  verify_release_signatures "$STAGE_DIR"
-  mv "$STAGE_DIR" "$VERSION_DIR"
-  STAGE_DIR=""
-  NEW_INSTALL="true"
-else
-  [ -x "$VERSION_DIR/$LAUNCHER_RELATIVE_PATH" ] \
-    || fail "existing install is incomplete: $VERSION_DIR"
-  [ -x "$VERSION_DIR/$INTERFACE_RELATIVE_PATH" ] \
-    || fail "existing install is incomplete: $VERSION_DIR/$INTERFACE_RELATIVE_PATH"
-  [ -x "$VERSION_DIR/$ENGINE_RELATIVE_PATH" ] \
-    || fail "existing install is incomplete: $VERSION_DIR/$ENGINE_RELATIVE_PATH"
-  verify_release_signatures "$VERSION_DIR"
-fi
-
-PREVIOUS_LINK=""
-if [ -L "$BIN_DIR/freecode" ]; then
-  PREVIOUS_LINK=$(readlink "$BIN_DIR/freecode")
-elif [ -e "$BIN_DIR/freecode" ]; then
-  fail "refusing to replace non-symlink executable: $BIN_DIR/freecode"
-fi
-LINK_TEMP="$BIN_DIR/.freecode-link.$$"
-rm -f "$LINK_TEMP"
-ln -s "$VERSION_DIR/$LAUNCHER_RELATIVE_PATH" "$LINK_TEMP"
-mv -f "$LINK_TEMP" "$BIN_DIR/freecode"
-
-rollback_activation() {
-  rm -f "$BIN_DIR/freecode"
-  if [ -n "$PREVIOUS_LINK" ]; then
-    ln -s "$PREVIOUS_LINK" "$BIN_DIR/freecode"
-  fi
-  if [ "$NEW_INSTALL" = "true" ]; then
-    rm -rf "$VERSION_DIR"
-  fi
-}
-
-printf 'Verifying Free Code %s...\n' "$VERSION"
-# Runtime diagnostics (such as Bun's AVX warning under Rosetta) go to stderr;
-# only stdout carries the version, and it must match exactly.
-VERSION_STDERR="$TEMP_DIR/version.stderr"
-VERSION_OUTPUT=$("$BIN_DIR/freecode" --version 2>"$VERSION_STDERR") || {
-  cat "$VERSION_STDERR" >&2
-  rollback_activation
-  fail "freecode --version failed; restored the previous install"
-}
-cat "$VERSION_STDERR" >&2
-printf '%s\n' "$VERSION_OUTPUT"
-[ "$VERSION_OUTPUT" = "freecode-sh $VERSION" ] || {
-  rollback_activation
-  fail "freecode --version reported the wrong release; restored the previous install"
-}
-if ! "$BIN_DIR/freecode" doctor; then
-  rollback_activation
-  fail "freecode doctor failed; restored the previous install"
-fi
-
-rm -f "$INSTALL_ROOT/current-version"
-printf '%s\n' "$BIN_DIR" > "$INSTALL_ROOT/bin-dir"
-printf '%s\n' "$CHANNEL" > "$INSTALL_ROOT/channel"
-printf '%s\n' "$DOWNLOAD_BASE_URL" > "$INSTALL_ROOT/release-base-url"
-printf '%s\n' "$CHANNEL_BASE_URL" > "$INSTALL_ROOT/channel-base-url"
-
-release_install_lock
-
-printf '\nFree Code %s installed successfully.\n' "$VERSION"
-printf 'Executable: %s/freecode\n' "$BIN_DIR"
-
-if [ "$EMBEDDED_INSTALL" = "true" ]; then
-  exit 0
-fi
-
-configure_path
-
-if [ "$PATH_CONFIGURED" = "true" ]; then
-  printf 'Added Free Code to your PATH in %s.\n' "$PATH_PROFILE"
-else
-  printf '\nFree Code could not update your shell profile automatically.\n'
-  printf 'Add this line to your shell profile for future Terminal windows:\n'
-  printf '  export PATH="%s:$PATH"\n' "$BIN_DIR"
-fi
-
-printf '\nVerify the install:\n'
-printf '  %s/freecode --version\n' "$BIN_DIR"
-printf '  %s/freecode doctor\n' "$BIN_DIR"
-printf '\nUninstall:\n'
-printf '  rm -f "%s/freecode" && rm -rf "%s"\n' "$BIN_DIR" "$INSTALL_ROOT"
-
-if [ "$LAUNCH_AFTER_INSTALL" = "true" ]; then
-  if [ -n "${FREECODE_TEST_TTY_FILE:-}" ]; then
-    if [ -r "$FREECODE_TEST_TTY_FILE" ]; then
-      CAN_LAUNCH="true"
-    else
-      CAN_LAUNCH="false"
-    fi
-  elif [ -t 1 ]; then
-    CAN_LAUNCH="true"
-  else
-    CAN_LAUNCH="false"
-  fi
-
-  if [ "$CAN_LAUNCH" = "true" ]; then
-    printf '\nStarting Free Code...\n'
-    if [ -n "${FREECODE_TEST_TTY_FILE:-}" ]; then
-      if "$BIN_DIR/freecode" < "$FREECODE_TEST_TTY_FILE"; then
-        LAUNCH_SUCCEEDED="true"
-      else
-        LAUNCH_SUCCEEDED="false"
-      fi
-    elif "$BIN_DIR/freecode" 0<&1; then
-      LAUNCH_SUCCEEDED="true"
-    else
-      LAUNCH_SUCCEEDED="false"
-    fi
-
-    if [ "$LAUNCH_SUCCEEDED" != "true" ]; then
-      printf '\nFree Code could not start automatically, but the installation succeeded.\n' >&2
-      printf 'Open a Terminal and run:\n  "%s/freecode"\n' "$BIN_DIR" >&2
-    fi
-  else
-    printf '\nFree Code is installed. Open a Terminal and run:\n'
-    printf '  "%s/freecode"\n' "$BIN_DIR"
-  fi
-fi

package/npm-bootstrap-environment.mjs

@@ -1,7 +0,0 @@
-export function withoutPowerShellModulePath(environment) {
-  const clean = { ...environment }
-  for (const key of Object.keys(clean)) {
-    if (key.toLowerCase() === 'psmodulepath') delete clean[key]
-  }
-  return clean
-}