omarion-sek 0.0.0-stage → 3.0.71

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,3 +1,58 @@
-# Temporary Holding Version
+# OmarionSek CLI
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+AI coding assistant in your terminal — autonomous agent that edits files, runs
+commands, browses the web, and more.
+
+This package ships **only a precompiled binary**. There is no JavaScript
+source code, no build step, and no Bun/Node runtime requirement beyond the thin
+`bin/omarion-sek` resolver that ships with npm.
+
+## Install
+
+```bash
+npm install -g omarion-sek
+```
+
+The `omarion-sek` command is placed on your `PATH` by npm automatically — no
+manual environment setup, no portable folder to manage.
+
+## Usage
+
+```bash
+omarion-sek                 # start in act mode
+omarion-sek "fix the tests" # start with a prompt
+omarion-sek --version
+omarion-sek --help
+```
+
+Hub (local daemon) management:
+
+```bash
+omarion-sek hub start
+omarion-sek hub status
+omarion-sek hub stop
+```
+
+## Supported platforms
+
+| Platform | Package |
+| --- | --- |
+| Linux x64 | `omarion-sek-linux-x64` |
+| Linux arm64 | `omarion-sek-linux-arm64` |
+| macOS x64 | `omarion-sek-darwin-x64` |
+| macOS arm64 | `omarion-sek-darwin-arm64` |
+| Windows x64 | `omarion-sek-windows-x64` |
+| Windows arm64 | `omarion-sek-windows-arm64` |
+
+Platform binaries are pulled in automatically as `optionalDependencies`; npm
+installs only the one matching your machine.
+
+## Uninstall
+
+```bash
+npm uninstall -g omarion-sek
+```
+
+## License
+
+Apache-2.0

package/bin/ca-certs.cjs

@@ -0,0 +1,281 @@
+// Auto-discovery of OS trust anchors for the OmarionSek CLI.
+//
+// Bun does not read the OS trust store, so the 3.x CLI cannot see corporate
+// MITM / self-signed CAs out of the box. This runs in the Node `bin/omarion-sek`
+// wrapper (not Bun), reads the full OS store via tls.getCACertificates("system")
+// (Node >= 22, no --use-system-ca flag), and hands the certs to the Bun child
+// via NODE_EXTRA_CA_CERTS, which both runtimes honor. Mirrors the JetBrains
+// plugin's configureCertificates(), sourcing from the OS instead of the IDE.
+//
+// Dependency-free CommonJS with injectable modules so it is unit-testable and
+// ships verbatim in the published wrapper package.
+
+const PEM_MARKER = "-----BEGIN CERTIFICATE-----";
+const CERT_BLOCK =
+	/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g;
+
+/**
+ * Returns only the complete certificate blocks from PEM text, or null when
+ * there are none. User files may also hold private keys (combined cert+key
+ * PEMs) or other sections, which must never be copied into the managed
+ * bundle. Files that contain nothing but certificates pass through verbatim
+ * so unchanged bundles keep hash-skipping the rewrite.
+ */
+function sanitizePem(text) {
+	const blocks = text.match(CERT_BLOCK) ?? [];
+	if (blocks.length === 0) {
+		return null;
+	}
+	const rest = text.replace(CERT_BLOCK, "");
+	if (/^\s*$/.test(rest)) {
+		return text;
+	}
+	return `${blocks.join("\n")}\n`;
+}
+
+/**
+ * Returns OS-trusted certificates as PEM strings, or [] when unavailable.
+ * tls.getCACertificates("system") requires Node >= 22.
+ */
+function harvestSystemCerts(tlsModule) {
+	try {
+		const tls = tlsModule || require("node:tls");
+		if (typeof tls.getCACertificates !== "function") {
+			return [];
+		}
+		const certs = tls.getCACertificates("system");
+		if (!Array.isArray(certs)) {
+			return [];
+		}
+		return certs.filter(
+			(cert) => typeof cert === "string" && cert.includes(PEM_MARKER),
+		);
+	} catch {
+		return [];
+	}
+}
+
+/**
+ * Returns the file's certificate blocks as PEM text, or null when missing,
+ * unreadable, or holding no complete certificate block.
+ */
+function readUserBundle(fsModule, userPath) {
+	if (!userPath) {
+		return null;
+	}
+	try {
+		const fs = fsModule || require("node:fs");
+		const stat = fs.statSync(userPath, { throwIfNoEntry: false });
+		if (!stat || !stat.isFile()) {
+			return null;
+		}
+		// Binary DER would not have loaded in the runtime either; require PEM.
+		return sanitizePem(fs.readFileSync(userPath, "utf8"));
+	} catch {
+		return null;
+	}
+}
+
+/**
+ * Reads the user's NODE_EXTRA_CA_CERTS value into PEM strings. Node treats the
+ * value as a single file, but some users set an OS-path-delimited list; the
+ * whole value is tried as one file first, then split.
+ * The managed bundle is excluded so reading it back never re-appends its certs.
+ */
+function readUserCerts(fsModule, pathModule, value, managedPath) {
+	if (!value) {
+		return [];
+	}
+	const fs = fsModule || require("node:fs");
+	const path = pathModule || require("node:path");
+	const candidates = [];
+	const whole = readUserBundle(fs, value);
+	if (whole) {
+		candidates.push({ filePath: value, pem: whole });
+	} else if (value.includes(path.delimiter)) {
+		for (const segment of value.split(path.delimiter)) {
+			const trimmed = segment.trim();
+			if (!trimmed) {
+				continue;
+			}
+			const pem = readUserBundle(fs, trimmed);
+			if (pem) {
+				candidates.push({ filePath: trimmed, pem });
+			}
+		}
+	}
+	const pems = [];
+	for (const candidate of candidates) {
+		const isManaged =
+			managedPath &&
+			path.resolve(candidate.filePath) === path.resolve(managedPath);
+		if (!isManaged) {
+			pems.push(candidate.pem);
+		}
+	}
+	return pems;
+}
+
+/**
+ * Concatenates the user PEMs (if any) and the system certificates into one
+ * bundle. A separating newline is inserted between parts so adjacent END/BEGIN
+ * markers cannot fuse into one invalid line.
+ */
+function buildBundle({ systemCerts, userPems }) {
+	const parts = [...(userPems ?? []), ...systemCerts];
+	return parts
+		.map((part) => (part.endsWith("\n") ? part : `${part}\n`))
+		.join("");
+}
+
+/** Counts individual PEM certificates across the given bundle strings. */
+function countCerts(pems) {
+	let count = 0;
+	for (const pem of pems) {
+		count += pem.split(PEM_MARKER).length - 1;
+	}
+	return count;
+}
+
+function readFileIfExists(fs, filePath) {
+	try {
+		return fs.readFileSync(filePath, "utf8");
+	} catch {
+		return null;
+	}
+}
+
+function resolveOmarionSekDir(env, os, path) {
+	return env.OMARION_SEK_DIR?.trim() || path.join(os.homedir(), ".omarion-sek");
+}
+
+/**
+ * True when the api-unavailable warning should print. Stamped per Node version
+ * in the omarion-sek dir so the nudge shows once rather than on every command; a
+ * version change (upgrade that still falls short, or downgrade) re-arms it.
+ * When the stamp cannot be read or written, warn — bookkeeping failures must
+ * never suppress a real diagnostic.
+ */
+function shouldWarnApiUnavailable(env, deps = {}) {
+	const fs = deps.fs || require("node:fs");
+	const os = deps.os || require("node:os");
+	const path = deps.path || require("node:path");
+	const version = deps.nodeVersion || process.versions.node;
+	const dir = resolveOmarionSekDir(env, os, path);
+	const stamp = path.join(dir, `.ca-api-warned-${version}`);
+	try {
+		if (fs.existsSync(stamp)) {
+			return false;
+		}
+		fs.mkdirSync(dir, { recursive: true });
+		fs.writeFileSync(stamp, "", { mode: 0o600 });
+		return true;
+	} catch {
+		return true;
+	}
+}
+
+/** Atomically writes [content] to [target]; returns true on success. */
+function writeBundle(fs, dir, target, content) {
+	const tmp = `${target}.${process.pid}.${Date.now()}.tmp`;
+	try {
+		fs.mkdirSync(dir, { recursive: true });
+		// Owner read/write: the bundle holds public CA material, not secrets,
+		// but there is no reason to make it world-writable.
+		fs.writeFileSync(tmp, content, { mode: 0o600 });
+		try {
+			fs.renameSync(tmp, target);
+		} catch {
+			// Windows can reject rename over a file a concurrent child holds open.
+			fs.rmSync(target, { force: true });
+			fs.renameSync(tmp, target);
+		}
+		return true;
+	} catch {
+		// Never leave a partial temp file behind (e.g. ENOSPC mid-write).
+		try {
+			fs.rmSync(tmp, { force: true });
+		} catch {
+			// Ignore: best-effort cleanup.
+		}
+		return false;
+	}
+}
+
+/**
+ * Harvests OS trust anchors, merges them with any user NODE_EXTRA_CA_CERTS, and
+ * points env.NODE_EXTRA_CA_CERTS at a single managed PEM bundle. Mutates `env`
+ * in place. Returns an outcome the caller can log; `action` is one of
+ * "unchanged" | "written" | "write-failed-reused" | "write-failed" |
+ * "no-system-certs" | "api-unavailable".
+ */
+function configureNodeExtraCaCerts(env, deps = {}) {
+	const fs = deps.fs || require("node:fs");
+	const os = deps.os || require("node:os");
+	const path = deps.path || require("node:path");
+	const tls = deps.tls || require("node:tls");
+
+	// tls.getCACertificates("system") needs Node >= 22.15; on older Nodes the
+	// harvest cannot run at all, which the caller should surface to the user.
+	if (typeof tls.getCACertificates !== "function") {
+		return {
+			action: "api-unavailable",
+			path: null,
+			systemCertCount: 0,
+			userCertCount: 0,
+		};
+	}
+
+	const systemCerts = harvestSystemCerts(tls);
+	if (systemCerts.length === 0) {
+		// Nothing to add: leave any user-provided NODE_EXTRA_CA_CERTS untouched
+		// and let the runtime fall back to its bundled CAs.
+		return {
+			action: "no-system-certs",
+			path: null,
+			systemCertCount: 0,
+			userCertCount: 0,
+		};
+	}
+
+	const managedDir = resolveOmarionSekDir(env, os, path);
+	const managedPath = path.join(managedDir, "cli-node-extra-ca-certs.pem");
+	const userValue = (env.NODE_EXTRA_CA_CERTS || "").trim() || null;
+	const userPems = readUserCerts(fs, path, userValue, managedPath);
+	const bundle = buildBundle({ systemCerts, userPems });
+	const base = {
+		path: managedPath,
+		systemCertCount: systemCerts.length,
+		userCertCount: countCerts(userPems),
+	};
+
+	// Skip the rewrite when the bundle is already current. Avoids per-launch I/O
+	// and the concurrent-rename race in the steady state.
+	if (readFileIfExists(fs, managedPath) === bundle) {
+		env.NODE_EXTRA_CA_CERTS = managedPath;
+		return { ...base, action: "unchanged" };
+	}
+
+	if (writeBundle(fs, managedDir, managedPath, bundle)) {
+		env.NODE_EXTRA_CA_CERTS = managedPath;
+		return { ...base, action: "written" };
+	}
+
+	// Write failed: fall back to a previously-written bundle if one exists.
+	if (readFileIfExists(fs, managedPath)) {
+		env.NODE_EXTRA_CA_CERTS = managedPath;
+		return { ...base, action: "write-failed-reused" };
+	}
+	return { ...base, path: null, action: "write-failed" };
+}
+
+module.exports = {
+	harvestSystemCerts,
+	sanitizePem,
+	readUserBundle,
+	readUserCerts,
+	buildBundle,
+	countCerts,
+	configureNodeExtraCaCerts,
+	shouldWarnApiUnavailable,
+};

package/bin/omarion-sek

@@ -0,0 +1,190 @@
+#!/usr/bin/env node
+
+// Binary resolver for OmarionSek CLI.
+//
+// This script runs with Node.js (available everywhere npm is) and finds the
+// correct platform-specific compiled binary to execute. The compiled binary
+// has Bun embedded, so users don't need Bun installed.
+//
+// Resolution order:
+// 1. OMARION_SEK_BIN_PATH env var override
+// 2. Cached binary at bin/.omarion-sek (created by postinstall)
+// 3. Walk up node_modules to find the platform-specific package
+
+const childProcess = require("child_process");
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+
+const scriptPath = fs.realpathSync(__filename);
+const scriptDir = path.dirname(scriptPath);
+const childEnv = {
+	...process.env,
+	OMARION_SEK_WRAPPER_PATH: scriptPath,
+};
+
+// Auto-discover OS trust anchors and pass them to the Bun child via
+// NODE_EXTRA_CA_CERTS. The Bun runtime does not read the OS store on its own,
+// so corporate/self-signed CAs would otherwise fail. This wrapper runs on
+// Node, which can read the full store here.
+try {
+	const caCerts = require("./ca-certs.cjs");
+	const outcome = caCerts.configureNodeExtraCaCerts(childEnv);
+	const debug =
+		process.env.OMARION_SEK_DEBUG === "1" || process.env.OMARION_SEK_DEBUG === "true";
+	// Not debug-gated: on old Nodes the harvest silently doing nothing is
+	// indistinguishable from a broken corporate proxy. Stamped per Node
+	// version so the nudge shows once, not on every command.
+	if (
+		outcome &&
+		outcome.action === "api-unavailable" &&
+		!childEnv.NODE_EXTRA_CA_CERTS &&
+		caCerts.shouldWarnApiUnavailable(childEnv)
+	) {
+		console.warn(
+			`[omarion-sek] Node ${process.versions.node} cannot read the OS trust store (needs >= 22.15); ` +
+				"corporate or self-signed CAs may fail TLS. Upgrade Node or set NODE_EXTRA_CA_CERTS.",
+		);
+	}
+	if (debug && outcome) {
+		if (outcome.action === "no-system-certs") {
+			console.warn(
+				"[omarion-sek] No OS trust anchors found; relying on the runtime's bundled CAs.",
+			);
+		} else if (outcome.action === "write-failed") {
+			console.warn(
+				"[omarion-sek] Could not write the managed CA bundle; relying on the runtime's bundled CAs.",
+			);
+		} else {
+			console.warn(
+				`[omarion-sek] Trust: ${outcome.systemCertCount} OS + ${outcome.userCertCount} user CAs (${outcome.action}) -> ${outcome.path}`,
+			);
+		}
+	}
+} catch {
+	// Best effort: fall back to the runtime's default trust on any failure.
+}
+
+function run(target) {
+	const result = childProcess.spawnSync(target, process.argv.slice(2), {
+		stdio: "inherit",
+		env: childEnv,
+	});
+	if (result.error) {
+		console.error(result.error.message);
+		// Windows application control (Smart App Control, WDAC, AppLocker)
+		// blocks the child exe at launch, which Node surfaces only as an
+		// opaque "spawnSync ... UNKNOWN" error. Point users at the real cause.
+		const code = result.error.code;
+		if (
+			os.platform() === "win32" &&
+			(code === "UNKNOWN" || code === "EACCES" || code === "EPERM")
+		) {
+			console.error(
+				"\nWindows refused to start the OmarionSek binary:\n  " +
+					target +
+					"\n\n" +
+					"This usually means an application control policy (Smart App Control,\n" +
+					"WDAC, or AppLocker) or antivirus blocked the executable. To confirm,\n" +
+					"run the path above directly in a terminal and check the error Windows\n" +
+					"reports, or inspect its signature with:\n\n" +
+					'  Get-AuthenticodeSignature "' +
+					target +
+					'"\n\n' +
+					"If it was blocked by policy, allow the file or ask your administrator\n" +
+					"to trust it. See https://github.com/omarion-sek/omarion-sek/issues for known issues.",
+			);
+		}
+		process.exit(1);
+	}
+	if (typeof result.status === "number") {
+		process.exit(result.status);
+	}
+	if (result.signal) {
+		process.kill(process.pid, result.signal);
+		process.exit(128);
+	}
+	process.exit(1);
+}
+
+// 1. Check env var override
+const envPath = process.env.OMARION_SEK_BIN_PATH;
+if (envPath) {
+	run(envPath);
+}
+
+// 2. Check cached binary
+const cached = path.join(scriptDir, ".omarion-sek");
+if (fs.existsSync(cached)) {
+	run(cached);
+}
+
+// 3. Detect platform and architecture
+const platformMap = {
+	darwin: "darwin",
+	linux: "linux",
+	win32: "windows",
+};
+const archMap = {
+	x64: "x64",
+	arm64: "arm64",
+};
+
+let platform = platformMap[os.platform()];
+if (!platform) {
+	platform = os.platform();
+}
+let arch = archMap[os.arch()];
+if (!arch) {
+	arch = os.arch();
+}
+
+const base = "omarion-sek-" + platform + "-" + arch;
+const binary = platform === "windows" ? "omarion-sek.exe" : "omarion-sek";
+
+// Build fallback chain of package names to try. The legacy scoped names are
+// kept as a fallback so existing installs keep resolving during a rename.
+const names = [base, "@omarion-sek/cli-" + platform + "-" + arch];
+
+function findBinary(startDir) {
+	let current = startDir;
+	for (;;) {
+		const modules = path.join(current, "node_modules");
+		if (fs.existsSync(modules)) {
+			for (const name of names) {
+				// Unscoped package: omarion-sek-linux-x64 lives at
+				// node_modules/omarion-sek-linux-x64. Scoped packages
+				// (@omarion-sek/cli-*) attach the scope as a subdirectory,
+				// which path.join handles identically.
+				const candidate = path.join(modules, name, "bin", binary);
+				if (fs.existsSync(candidate)) return candidate;
+			}
+		}
+		const parent = path.dirname(current);
+		if (parent === current) {
+			return undefined;
+		}
+		current = parent;
+	}
+}
+
+const resolved = findBinary(scriptDir);
+if (!resolved) {
+	console.error(
+		"Could not find the OmarionSek CLI binary for your platform.\n" +
+			"Your platform: " +
+			os.platform() +
+			" " +
+			os.arch() +
+			"\n" +
+			"Looked for: " +
+			names.map(function (n) {
+				return '"' + n + '"';
+			}).join(" or ") +
+			"\n\n" +
+			"Try reinstalling: npm install -g omarion-sek",
+	);
+	process.exit(1);
+}
+
+run(resolved);

package/package.json

@@ -1,6 +1,49 @@
 {
   "name": "omarion-sek",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "3.0.71",
+  "description": "Autonomous coding agent CLI - capable of creating/editing files, running commands, using the browser, and more",
+  "license": "Apache-2.0",
+  "keywords": [
+    "omarion-sek",
+    "claude",
+    "dev",
+    "mcp",
+    "openrouter",
+    "coding",
+    "agent",
+    "autonomous",
+    "chatgpt",
+    "sonnet",
+    "ai",
+    "llama",
+    "cli"
+  ],
+  "author": {
+    "name": "Омарион СЕК"
+  },
+  "homepage": "https://omarion-sek",
+  "bugs": {
+    "url": "https://github.com/omarion-sek/omarion-sek/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/omarion-sek/omarion-sek.git",
+    "directory": "apps/cli"
+  },
+  "bin": {
+    "omarion-sek": "./bin/omarion-sek",
+    "omarionSek": "./bin/omarion-sek"
+  },
+  "scripts": {
+    "postinstall": "node ./postinstall.mjs || true"
+  },
+  "dependencies": {},
+  "optionalDependencies": {
+    "omarion-sek-linux-x64": "3.0.71",
+    "omarion-sek-darwin-x64": "3.0.71",
+    "omarion-sek-windows-arm64": "3.0.71",
+    "omarion-sek-darwin-arm64": "3.0.71",
+    "omarion-sek-linux-arm64": "3.0.71",
+    "omarion-sek-windows-x64": "3.0.71"
+  }
+}

package/postinstall.mjs

@@ -0,0 +1,126 @@
+#!/usr/bin/env node
+
+// Post-install script for OmarionSek CLI.
+//
+// Creates a hard link (or copy fallback) from the platform-specific binary
+// to bin/.omarion-sek for fast startup on subsequent runs.
+//
+// This script must use only Node.js APIs (no Bun) since it runs via
+// "node script/postinstall.mjs" in the npm lifecycle.
+
+import fs from "node:fs";
+import { createRequire } from "node:module";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const require = createRequire(import.meta.url);
+
+// CLI versions <= 3.0.54 restart the hub daemon after a background
+// auto-update even while it is serving live sessions, killing those sessions
+// mid-turn — and their build-fingerprint check then rejects every replacement
+// hub, bricking the running TUI. That restart code is the *old* version's, so
+// it cannot be patched here; but it bails out harmlessly when no hub
+// discovery record exists, and it runs only after this install (and this
+// script) completes. Setting the record aside protects any attached clients:
+// a running hub keeps serving its established connections, clients that share
+// its build fingerprint rebuild the record from a port probe, and the next
+// fresh launch retires stale hubs regardless of the record.
+function shieldRunningHubDiscovery() {
+	const explicitPath = process.env.OMARION_SEK_HUB_DISCOVERY_PATH?.trim();
+	const dataDir =
+		process.env.OMARION_SEK_DATA_DIR?.trim() ||
+		path.join(
+			process.env.OMARION_SEK_DIR?.trim() || path.join(os.homedir(), ".omarion-sek"),
+			"data",
+		);
+	const recordPath =
+		explicitPath || path.join(dataDir, "locks", "hub", "production.json");
+	if (!fs.existsSync(recordPath)) {
+		return;
+	}
+	const asidePath = `${recordPath}.superseded`;
+	fs.rmSync(asidePath, { force: true });
+	fs.renameSync(recordPath, asidePath);
+	console.log("Set aside hub discovery record for the updated CLI");
+}
+
+function main() {
+	if (os.platform() === "win32") {
+		// On Windows, npm creates .cmd shims from the bin field.
+		// The resolver script handles binary lookup at runtime.
+		console.log("Windows detected: skipping binary cache setup");
+		return;
+	}
+
+	const platformMap = {
+		darwin: "darwin",
+		linux: "linux",
+	};
+	const platform = platformMap[os.platform()] || os.platform();
+	const arch = os.arch();
+	const packageName = `omarion-sek-${platform}-${arch}`;
+	const binaryName = "omarion-sek";
+
+	let binaryPath;
+	try {
+		const packageJsonPath = require.resolve(`${packageName}/package.json`);
+		const packageDir = path.dirname(packageJsonPath);
+		binaryPath = path.join(packageDir, "bin", binaryName);
+
+		if (!fs.existsSync(binaryPath)) {
+			throw new Error(`Binary not found at ${binaryPath}`);
+		}
+	} catch (_error) {
+		// Platform package not available. The resolver script will find
+		// it at runtime by walking node_modules. This is expected on
+		// platforms we don't ship binaries for.
+		console.log(`Note: ${packageName} not found, skipping binary cache`);
+		return;
+	}
+
+	const binDir =
+		path.basename(__dirname) === "script"
+			? path.join(__dirname, "..", "bin")
+			: path.join(__dirname, "bin");
+	const target = path.join(binDir, ".omarion-sek");
+
+	// Ensure bin directory exists
+	if (!fs.existsSync(binDir)) {
+		fs.mkdirSync(binDir, { recursive: true });
+	}
+
+	// Remove existing cached binary
+	if (fs.existsSync(target)) {
+		fs.unlinkSync(target);
+	}
+
+	// Hard link preferred (shares disk space), copy as fallback
+	// (hard links fail on some filesystems like NFS or cross-device)
+	try {
+		fs.linkSync(binaryPath, target);
+	} catch {
+		fs.copyFileSync(binaryPath, target);
+	}
+
+	fs.chmodSync(target, 0o755);
+	console.log(`Cached omarion-sek binary at ${target}`);
+}
+
+try {
+	shieldRunningHubDiscovery();
+} catch (error) {
+	// Best-effort: without the shield the worst case is the pre-3.0.55
+	// restart-while-busy behavior, never a broken install.
+	console.error(`postinstall: hub discovery shield skipped: ${error.message}`);
+}
+
+try {
+	main();
+} catch (error) {
+	// postinstall failures should never block npm install.
+	// The resolver script will find the binary at runtime.
+	console.error(`postinstall: ${error.message}`);
+	process.exit(0);
+}