open-plan-annotator 1.0.9 → 1.0.12

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "Interactive plan annotation plugin for Claude Code",
-    "version": "1.0.0"
+    "version": "1.0.12"
   },
   "plugins": [
     {
       "name": "open-plan-annotator",
       "source": "./",
       "description": "Interactive plan annotation UI: review, strikethrough, and comment on Claude's plans before approving. Fully local, no external services.",
-      "version": "1.0.9",
+      "version": "1.0.12",
       "author": {
         "name": "ndom91"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "open-plan-annotator",
   "description": "Interactive plan annotation UI: review, strikethrough, and comment on Claude's plans before approving. Fully local, no external services.",
-  "version": "1.0.9",
+  "version": "1.0.12",
   "author": {
     "name": "ndom91"
   },

package/README.md

@@ -117,6 +117,12 @@ bun run lint:fix    # auto-fix
 bun run format      # format
 ```
 
+## Maintainer Docs
+
+- Architecture: [`docs/architecture.md`](docs/architecture.md)
+- Operations: [`docs/operations.md`](docs/operations.md)
+- Release process: [`docs/release.md`](docs/release.md)
+
 ## License
 
 MIT

package/bin/{open-plan-annotator.cjs → open-plan-annotator.mjs}

@@ -1,12 +1,14 @@
 #!/usr/bin/env node
 
-const { execFileSync, spawn } = require("child_process");
-const path = require("path");
-const fs = require("fs");
+import { execFileSync, spawn } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
 
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const binaryPath = path.join(__dirname, "open-plan-annotator-binary");
-const installScript = path.join(__dirname, "..", "install.cjs");
-const VERSION = require("../package.json").version;
+const installScript = path.join(__dirname, "..", "install.mjs");
+const VERSION = JSON.parse(fs.readFileSync(path.join(__dirname, "..", "package.json"), "utf8")).version;
 
 const arg = process.argv[2];
 

package/install.mjs

@@ -0,0 +1,218 @@
+#!/usr/bin/env node
+
+import crypto from "node:crypto";
+import fs from "node:fs";
+import https from "node:https";
+import path from "node:path";
+import {
+  PLATFORM_ASSET_BASENAME_MAP,
+  REPO,
+  getPlatformAssetArchiveName,
+  getPlatformKey,
+  parseChecksumManifest,
+  selectChecksumAsset,
+} from "./shared/releaseAssets.mjs";
+import { fileURLToPath } from "node:url";
+import zlib from "node:zlib";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const VERSION = JSON.parse(fs.readFileSync(new URL("./package.json", import.meta.url), "utf8")).version;
+
+function getReleaseApiUrl() {
+  return `https://api.github.com/repos/${REPO}/releases/tags/v${VERSION}`;
+}
+
+function fetch(url, redirects) {
+  if (redirects === undefined) redirects = 5;
+  return new Promise((resolve, reject) => {
+    https
+      .get(url, { headers: { "User-Agent": "open-plan-annotator-install" } }, (res) => {
+        if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+          if (redirects <= 0) return reject(new Error("Too many redirects"));
+          return fetch(res.headers.location, redirects - 1).then(resolve, reject);
+        }
+        if (res.statusCode < 200 || res.statusCode >= 300) {
+          return reject(new Error(`HTTP ${res.statusCode} from ${url}`));
+        }
+        const chunks = [];
+        res.on("data", (c) => chunks.push(c));
+        res.on("end", () => resolve(Buffer.concat(chunks)));
+      })
+      .on("error", reject);
+  });
+}
+
+async function fetchJson(url) {
+  const buffer = await fetch(url);
+  return JSON.parse(buffer.toString("utf8"));
+}
+
+function sha256Hex(buffer) {
+  return crypto.createHash("sha256").update(buffer).digest("hex");
+}
+
+async function resolveReleaseAssetAndChecksum(options) {
+  const opts = options || {};
+  const fetchJsonImpl = opts.fetchJson || fetchJson;
+  const fetchBuffer = opts.fetch || fetch;
+  const releaseApiUrl = opts.releaseApiUrl || getReleaseApiUrl();
+  const version = opts.version || VERSION;
+
+  const release = await fetchJsonImpl(releaseApiUrl);
+  const releaseAssets = Array.isArray(release.assets) ? release.assets : [];
+  const key = opts.platformKey || getPlatformKey();
+  const assetName = getPlatformAssetArchiveName(key);
+  if (!assetName) {
+    throw new Error(`Unsupported platform ${key}`);
+  }
+
+  const asset = releaseAssets.find((entry) => entry.name === assetName);
+  if (!asset) {
+    throw new Error(`Release v${version} is missing asset ${assetName}`);
+  }
+
+  const checksumAsset = selectChecksumAsset(releaseAssets);
+  if (!checksumAsset) {
+    throw new Error(`Release v${version} does not contain a checksum manifest asset`);
+  }
+
+  const checksumManifest = (await fetchBuffer(checksumAsset.browser_download_url)).toString("utf8");
+  const checksums = parseChecksumManifest(checksumManifest);
+  const expectedSha256 = checksums.get(assetName);
+  if (!expectedSha256) {
+    throw new Error(`Checksum manifest does not contain ${assetName}`);
+  }
+
+  return {
+    assetName,
+    assetUrl: asset.browser_download_url,
+    expectedSha256,
+  };
+}
+
+function errorMessage(err) {
+  return err && err.message ? err.message : String(err);
+}
+
+async function downloadVerifiedArchive(options) {
+  const opts = options || {};
+  const resolveRelease = opts.resolveReleaseAssetAndChecksum || resolveReleaseAssetAndChecksum;
+  const fetchBuffer = opts.fetch || fetch;
+  const checksumRequirement =
+    "open-plan-annotator requires release checksum/sha256sum availability and will not install without verification.";
+
+  let releaseInfo;
+
+  try {
+    releaseInfo = await resolveRelease();
+  } catch (err) {
+    throw new Error(`Unable to verify release checksums: ${errorMessage(err)} ${checksumRequirement}`);
+  }
+
+  const { assetName, assetUrl, expectedSha256 } = releaseInfo;
+  const archiveBuffer = await fetchBuffer(assetUrl);
+  const actualSha256 = sha256Hex(archiveBuffer);
+
+  if (actualSha256 !== expectedSha256) {
+    throw new Error(
+      `Checksum verification failed for ${assetName} (expected ${expectedSha256}, got ${actualSha256}). ${checksumRequirement}`,
+    );
+  }
+
+  return archiveBuffer;
+}
+
+function extractBinaryFromTarGz(buffer) {
+  const tarBuffer = zlib.gunzipSync(buffer);
+  let offset = 0;
+
+  while (offset < tarBuffer.length) {
+    const header = tarBuffer.subarray(offset, offset + 512);
+    offset += 512;
+
+    const name = header.toString("utf-8", 0, 100).replace(/\0.*/g, "");
+    const sizeStr = header.toString("utf-8", 124, 136).replace(/\0.*/g, "").trim();
+    const size = parseInt(sizeStr, 8);
+
+    if (!name || isNaN(size)) break;
+
+    if (name === "open-plan-annotator" || name.endsWith("/open-plan-annotator")) {
+      return tarBuffer.subarray(offset, offset + size);
+    }
+
+    offset += Math.ceil(size / 512) * 512;
+  }
+
+  throw new Error("Binary 'open-plan-annotator' not found in archive");
+}
+
+async function main() {
+  const destDir = path.join(__dirname, "bin");
+  const destPath = path.join(destDir, "open-plan-annotator-binary");
+  const tempPath = `${destPath}.tmp-${process.pid}-${Date.now()}`;
+
+  // Skip if binary already exists
+  if (fs.existsSync(destPath)) {
+    return;
+  }
+
+  console.error(`Downloading open-plan-annotator for ${getPlatformKey()}...`);
+  const archiveBuffer = await downloadVerifiedArchive();
+
+  try {
+    const binaryBuffer = extractBinaryFromTarGz(archiveBuffer);
+
+    if (!fs.existsSync(destDir)) {
+      fs.mkdirSync(destDir, { recursive: true });
+    }
+
+    fs.writeFileSync(tempPath, binaryBuffer, { mode: 0o755 });
+    fs.renameSync(tempPath, destPath);
+    fs.chmodSync(destPath, 0o755);
+    console.error(`Installed open-plan-annotator to ${destPath}`);
+  } catch (err) {
+    try {
+      fs.unlinkSync(tempPath);
+    } catch {
+      // Temp file may not exist
+    }
+    throw err;
+  }
+}
+
+function shouldSkipInstall() {
+  return Boolean(process.env.OPEN_PLAN_ANNOTATOR_SKIP_INSTALL || process.env.npm_config_dev);
+}
+
+function runCli() {
+  if (shouldSkipInstall()) {
+    process.exit(0);
+  }
+
+  main().catch((err) => {
+    console.error("Failed to install open-plan-annotator binary:", err.message);
+    console.error("You can try manually running: node", path.join(__dirname, "install.mjs"));
+    process.exit(1);
+  });
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  runCli();
+}
+
+export {
+  VERSION,
+  PLATFORM_ASSET_BASENAME_MAP as PLATFORM_MAP,
+  getPlatformKey,
+  getReleaseApiUrl,
+  fetch,
+  fetchJson,
+  sha256Hex,
+  parseChecksumManifest,
+  selectChecksumAsset,
+  resolveReleaseAssetAndChecksum,
+  extractBinaryFromTarGz,
+  downloadVerifiedArchive,
+  shouldSkipInstall,
+  main,
+};

package/opencode/bridge.js

@@ -6,7 +6,7 @@ import { fileURLToPath } from "node:url";
 
 const PKG_ROOT = fileURLToPath(new URL("..", import.meta.url));
 const LOCAL_BINARY_PATH = join(PKG_ROOT, "bin", "open-plan-annotator-binary");
-const INSTALL_SCRIPT = join(PKG_ROOT, "install.cjs");
+const INSTALL_SCRIPT = join(PKG_ROOT, "install.mjs");
 
 /** Resolved path to the binary (may differ from LOCAL_BINARY_PATH if found on PATH). */
 let BINARY_PATH = LOCAL_BINARY_PATH;

package/opencode/index.js

@@ -4,15 +4,44 @@ import { resolveImplementationHandoff } from "./config.js";
 
 const PLAN_REVIEW_INSTRUCTIONS = `## Plan Review Workflow
 
-For non-trivial implementation work, create a plan first and call the \`submit_plan\` tool.
-The user will review the plan in a browser UI and either approve it or request changes.
-
-- If the tool returns that the plan was **approved**: immediately begin writing code. Do NOT call \`submit_plan\` again — the plan phase is complete.
-- If the tool returns **revision feedback**: revise the plan based on the feedback, then call \`submit_plan\` again with the updated plan.
-
-Only call \`submit_plan\` once per plan version. After approval, your sole job is to implement what was approved.`;
-
-const IMPLEMENTATION_PROMPT = "The plan has been approved by the user. Begin implementing it now — write code, create files, and make changes as described in the plan. Do not re-submit or re-review the plan.";
+Track planning/execution using this state enum:
+- \`DISCOVERY\`, \`PLAN_DRAFT\`, \`AWAITING_PLAN_DECISION\`, \`EXECUTION\`, \`DONE\`
+
+State transitions:
+- Start in \`DISCOVERY\`.
+- Move to \`PLAN_DRAFT\` only when a plan is required.
+- From \`PLAN_DRAFT\`, call \`submit_plan\` exactly once, then move to \`AWAITING_PLAN_DECISION\`.
+- If user approves plan, set \`plan_status=approved\` and move to \`EXECUTION\`.
+- If user rejects or requests plan changes, set \`plan_status=rejected\` and return to \`PLAN_DRAFT\`.
+- When work is complete, move to \`DONE\`.
+
+Required flags:
+- \`plan_status\` in \`{none, submitted, approved, rejected}\`
+- \`explicit_replan\` in \`{true,false}\` (default \`false\`)
+- Set \`explicit_replan=true\` only when user clearly asks to replan (for example: revise/change/new/update plan).
+
+Hard rules:
+1) \`submit_plan\` is allowed only in \`PLAN_DRAFT\`.
+2) If \`plan_status=approved\`, \`submit_plan\` is forbidden unless \`explicit_replan=true\`.
+3) Call \`submit_plan\` at most once per plan draft/version. If rejected, revise and submit once for the new draft.
+4) After approval, treat follow-up user messages as execution refinements by default, not planning triggers.
+5) On conflict, prioritize the approved plan and execute immediately.
+6) Do not ask permission to proceed after approval; execute and report progress/results.
+7) When delegating to subagents, always pass current \`plan_status\` and \`explicit_replan\` values.
+8) If \`plan_status=approved\` and \`explicit_replan=false\`, subagents must execute and must not call \`submit_plan\`.
+
+Tool guard before calling \`submit_plan\`:
+- assert \`state == PLAN_DRAFT\`
+- assert \`plan_status != approved || explicit_replan == true\`
+- if an assertion fails, continue execution without submitting a new plan.`;
+
+const IMPLEMENTATION_PROMPT = [
+  "Plan review status: plan_status=approved.",
+  "State transition: next_state=EXECUTION.",
+  "Replan intent: explicit_replan=false unless the user explicitly asks to revise the plan.",
+  "Execute the approved plan directly now — write code, create files, and make changes.",
+  "Do not call `submit_plan` again unless the user explicitly requests re-planning.",
+].join(" ");
 
 function getErrorMessage(error) {
   if (error instanceof Error && error.message) {
@@ -133,7 +162,7 @@ export const OpenPlanAnnotatorPlugin = async (ctx) => {
     tool: {
       submit_plan: tool({
         description:
-          "Submit a markdown plan for interactive user review. Returns approval status or structured revision feedback.",
+          "Submit a markdown plan for interactive user review. Returns a structured result with plan_status, next_state, approved, and feedback fields.",
 
         args: {
           plan: tool.schema.string().describe("The complete implementation plan in markdown format"),
@@ -147,6 +176,13 @@ export const OpenPlanAnnotatorPlugin = async (ctx) => {
             cwd: ctx.directory,
           });
 
+          const basePayload = {
+            plan_status: result.approved ? "approved" : "rejected",
+            next_state: result.approved ? "EXECUTION" : "PLAN_DRAFT",
+            approved: result.approved,
+            feedback: result.approved ? null : (result.feedback ?? "Plan changes requested."),
+          };
+
           if (result.approved) {
             const lines = [
               "Plan approved by the user.",
@@ -167,18 +203,24 @@ export const OpenPlanAnnotatorPlugin = async (ctx) => {
             }
 
             lines.push("Begin implementing the approved plan now — write code and make changes.");
-            return lines.join("\n\n");
+            return {
+              ...basePayload,
+              guidance: lines.join("\n\n"),
+            };
           }
 
-          return [
-            "Plan needs revision.",
-            "",
-            "## User feedback",
-            "",
-            result.feedback ?? "Plan changes requested.",
-            "",
-            "Revise the plan using this feedback, then call `submit_plan` again.",
-          ].join("\n");
+          return {
+            ...basePayload,
+            guidance: [
+              "Plan needs revision.",
+              "",
+              "## User feedback",
+              "",
+              basePayload.feedback,
+              "",
+              "Revise the plan using this feedback, then submit the revised draft once via `submit_plan`.",
+            ].join("\n"),
+          };
         },
       }),
     },

package/opencode/index.test.ts

@@ -0,0 +1,56 @@
+import { afterEach, describe, expect, mock, test } from "bun:test";
+
+afterEach(() => {
+  mock.restore();
+});
+
+function createPluginContext() {
+  return {
+    directory: process.cwd(),
+    client: {
+      session: {
+        messages: async () => ({ data: [] }),
+        prompt: async () => ({ data: null }),
+      },
+      app: {
+        agents: async () => ({ data: [] }),
+      },
+    },
+  };
+}
+
+describe("submit_plan return schema contract", () => {
+  test("approved decision maps to approved execution payload", async () => {
+    mock.module("./bridge.js", () => ({
+      runPlanReview: async () => ({ approved: true }),
+    }));
+
+    const { OpenPlanAnnotatorPlugin } = await import(`./index.js?approved-${Date.now()}`);
+    const plugin = await OpenPlanAnnotatorPlugin(createPluginContext());
+
+    const result = await plugin.tool.submit_plan.execute({ plan: "# Plan" }, { sessionID: "session-1" });
+
+    expect(result.plan_status).toBe("approved");
+    expect(result.next_state).toBe("EXECUTION");
+    expect(result.approved).toBe(true);
+    expect(result.feedback).toBeNull();
+  });
+
+  test("rejected decision maps to plan redraft payload with bridge feedback", async () => {
+    const bridgeFeedback = "Need to add rollback steps.";
+
+    mock.module("./bridge.js", () => ({
+      runPlanReview: async () => ({ approved: false, feedback: bridgeFeedback }),
+    }));
+
+    const { OpenPlanAnnotatorPlugin } = await import(`./index.js?rejected-${Date.now()}`);
+    const plugin = await OpenPlanAnnotatorPlugin(createPluginContext());
+
+    const result = await plugin.tool.submit_plan.execute({ plan: "# Plan" }, { sessionID: "session-2" });
+
+    expect(result.plan_status).toBe("rejected");
+    expect(result.next_state).toBe("PLAN_DRAFT");
+    expect(result.approved).toBe(false);
+    expect(result.feedback).toBe(bridgeFeedback);
+  });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "open-plan-annotator",
-  "version": "1.0.9",
+  "version": "1.0.12",
   "type": "module",
   "description": "Fully local plugin for interactive plan annotation from your Agentic assistants",
   "author": "ndom91",
@@ -19,11 +19,12 @@
   ],
   "main": "opencode/index.js",
   "bin": {
-    "open-plan-annotator": "bin/open-plan-annotator.cjs"
+    "open-plan-annotator": "bin/open-plan-annotator.mjs"
   },
   "files": [
-    "bin/open-plan-annotator.cjs",
-    "install.cjs",
+    "bin/open-plan-annotator.mjs",
+    "install.mjs",
+    "shared/",
     ".claude-plugin/",
     "opencode/",
     "hooks/",
@@ -31,14 +32,15 @@
     "README.md"
   ],
   "scripts": {
-    "postinstall": "node install.cjs",
+    "postinstall": "node install.mjs",
     "test": "bun test",
     "typecheck": "tsgo --noEmit --project ui/tsconfig.json && tsgo --noEmit --project server/tsconfig.json",
     "build:ui": "cd ui && bun run vite build",
-    "build:platforms": "node scripts/build-platforms.cjs",
-    "build": "bun run build:ui && node scripts/build-platforms.cjs",
-    "tarball": "node scripts/tarball.cjs",
-    "release": "bun run build && node scripts/tarball.cjs",
+    "build:platforms": "node scripts/build-platforms.mjs",
+    "build": "bun run build:ui && node scripts/build-platforms.mjs",
+    "tarball": "node scripts/tarball.mjs",
+    "release": "bun run build && node scripts/tarball.mjs",
+    "pack:check": "node scripts/check-package-files.mjs",
     "dev:ui": "cd ui && bun run vite --port 5173",
     "dev:server": "NODE_ENV=development bun run server/index.ts",
     "dev": "NODE_ENV=development bun run server/index.ts & cd ui && bun run vite --port 5173",
@@ -46,16 +48,16 @@
     "lint:fix": "biome check --write .",
     "format": "biome format --write .",
     "do-release": "./scripts/release.sh",
-    "prepack": "mv CLAUDE.md CLAUDE.dev.md.bak && cp CLAUDE.plugin.md CLAUDE.md",
-    "postpack": "mv CLAUDE.dev.md.bak CLAUDE.md"
+    "prepack": "node scripts/claude-pack-docs.mjs prepack",
+    "postpack": "node scripts/claude-pack-docs.mjs postpack"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.4.4",
+    "@types/node": "^25.3.0",
     "@types/bun": "^1.3.9",
     "@typescript/native-preview": "^7.0.0-dev.20260224.1"
   },
   "dependencies": {
-    "@opencode-ai/plugin": "^1.2.14",
-    "@types/node": "^25.3.0"
+    "@opencode-ai/plugin": "^1.2.14"
   }
 }

package/shared/releaseAssets.d.ts

@@ -0,0 +1,12 @@
+export interface ReleaseAsset {
+  name: string;
+  browser_download_url: string;
+}
+
+export declare const REPO: string;
+export declare const PLATFORM_ASSET_BASENAME_MAP: Record<string, string>;
+
+export declare function getPlatformKey(platform?: string, arch?: string): string;
+export declare function getPlatformAssetArchiveName(platformKey?: string): string | null;
+export declare function parseChecksumManifest(manifestText: string): Map<string, string>;
+export declare function selectChecksumAsset(assets: ReleaseAsset[]): ReleaseAsset | null;

package/shared/releaseAssets.mjs

@@ -0,0 +1,65 @@
+const REPO = "ndom91/open-plan-annotator";
+
+const PLATFORM_ASSET_BASENAME_MAP = {
+  "darwin-arm64": "open-plan-annotator-darwin-arm64",
+  "darwin-x64": "open-plan-annotator-darwin-x64",
+  "linux-x64": "open-plan-annotator-linux-x64",
+  "linux-arm64": "open-plan-annotator-linux-arm64",
+};
+
+function getPlatformKey(platform = process.platform, arch = process.arch) {
+  return `${platform}-${arch}`;
+}
+
+function getPlatformAssetArchiveName(platformKey = getPlatformKey()) {
+  const assetBaseName = PLATFORM_ASSET_BASENAME_MAP[platformKey];
+  if (!assetBaseName) {
+    return null;
+  }
+  return `${assetBaseName}.tar.gz`;
+}
+
+function parseChecksumManifest(manifestText) {
+  const checksums = new Map();
+
+  for (const rawLine of manifestText.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#")) continue;
+
+    const bsdStyle = line.match(/^SHA256\s*\(([^)]+)\)\s*=\s*([a-fA-F0-9]{64})$/);
+    if (bsdStyle) {
+      checksums.set(bsdStyle[1].trim(), bsdStyle[2].toLowerCase());
+      continue;
+    }
+
+    const gnuStyle = line.match(/^([a-fA-F0-9]{64})\s+[* ]?(.+)$/);
+    if (gnuStyle) {
+      checksums.set(gnuStyle[2].trim(), gnuStyle[1].toLowerCase());
+    }
+  }
+
+  return checksums;
+}
+
+function selectChecksumAsset(assets) {
+  const checksumAssets = assets
+    .filter((asset) => {
+      const lower = asset.name.toLowerCase();
+      return (
+        (lower.includes("sha256") || lower.includes("checksum")) &&
+        (lower.endsWith(".txt") || lower.endsWith(".sha256") || lower.endsWith(".sha256sum") || lower.endsWith(".sha256sums"))
+      );
+    })
+    .sort((a, b) => a.name.localeCompare(b.name));
+
+  return checksumAssets[0] ?? null;
+}
+
+export {
+  REPO,
+  PLATFORM_ASSET_BASENAME_MAP,
+  getPlatformKey,
+  getPlatformAssetArchiveName,
+  parseChecksumManifest,
+  selectChecksumAsset,
+};

package/install.cjs

@@ -1,231 +0,0 @@
-#!/usr/bin/env node
-
-// Skip postinstall during local development
-if (process.env.OPEN_PLAN_ANNOTATOR_SKIP_INSTALL || process.env.npm_config_dev) {
-  process.exit(0);
-}
-
-const fs = require("fs");
-const path = require("path");
-const zlib = require("zlib");
-const https = require("https");
-const crypto = require("crypto");
-
-const VERSION = require("./package.json").version;
-const REPO = "ndom91/open-plan-annotator";
-
-const PLATFORM_MAP = {
-  "darwin-arm64": "open-plan-annotator-darwin-arm64",
-  "darwin-x64": "open-plan-annotator-darwin-x64",
-  "linux-x64": "open-plan-annotator-linux-x64",
-  "linux-arm64": "open-plan-annotator-linux-arm64",
-};
-
-function getPlatformKey() {
-  return `${process.platform}-${process.arch}`;
-}
-
-function getDownloadUrl() {
-  const key = getPlatformKey();
-  const asset = PLATFORM_MAP[key];
-  if (!asset) {
-    console.error(`open-plan-annotator: unsupported platform ${key}`);
-    console.error(`Supported: ${Object.keys(PLATFORM_MAP).join(", ")}`);
-    process.exit(1);
-  }
-  return `https://github.com/${REPO}/releases/download/v${VERSION}/${asset}.tar.gz`;
-}
-
-function getReleaseApiUrl() {
-  return `https://api.github.com/repos/${REPO}/releases/tags/v${VERSION}`;
-}
-
-function fetch(url, redirects) {
-  if (redirects === undefined) redirects = 5;
-  return new Promise((resolve, reject) => {
-    https
-      .get(url, { headers: { "User-Agent": "open-plan-annotator-install" } }, (res) => {
-        if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
-          if (redirects <= 0) return reject(new Error("Too many redirects"));
-          return fetch(res.headers.location, redirects - 1).then(resolve, reject);
-        }
-        if (res.statusCode < 200 || res.statusCode >= 300) {
-          return reject(new Error(`HTTP ${res.statusCode} from ${url}`));
-        }
-        const chunks = [];
-        res.on("data", (c) => chunks.push(c));
-        res.on("end", () => resolve(Buffer.concat(chunks)));
-      })
-      .on("error", reject);
-  });
-}
-
-async function fetchJson(url) {
-  const buffer = await fetch(url);
-  return JSON.parse(buffer.toString("utf8"));
-}
-
-function sha256Hex(buffer) {
-  return crypto.createHash("sha256").update(buffer).digest("hex");
-}
-
-function parseChecksumManifest(manifestText) {
-  const checksums = new Map();
-
-  for (const rawLine of manifestText.split(/\r?\n/)) {
-    const line = rawLine.trim();
-    if (!line || line.startsWith("#")) continue;
-
-    const bsdStyle = line.match(/^SHA256\s*\(([^)]+)\)\s*=\s*([a-fA-F0-9]{64})$/);
-    if (bsdStyle) {
-      checksums.set(bsdStyle[1].trim(), bsdStyle[2].toLowerCase());
-      continue;
-    }
-
-    const gnuStyle = line.match(/^([a-fA-F0-9]{64})\s+[* ]?(.+)$/);
-    if (gnuStyle) {
-      checksums.set(gnuStyle[2].trim(), gnuStyle[1].toLowerCase());
-    }
-  }
-
-  return checksums;
-}
-
-function selectChecksumAsset(assets) {
-  const checksumAssets = assets
-    .filter((asset) => {
-      const lower = asset.name.toLowerCase();
-      return (
-        (lower.includes("sha256") || lower.includes("checksum")) &&
-        (lower.endsWith(".txt") || lower.endsWith(".sha256") || lower.endsWith(".sha256sum") || lower.endsWith(".sha256sums"))
-      );
-    })
-    .sort((a, b) => a.name.localeCompare(b.name));
-
-  return checksumAssets[0] || null;
-}
-
-async function resolveReleaseAssetAndChecksum() {
-  const release = await fetchJson(getReleaseApiUrl());
-  const releaseAssets = Array.isArray(release.assets) ? release.assets : [];
-  const key = getPlatformKey();
-  const assetBaseName = PLATFORM_MAP[key];
-  if (!assetBaseName) {
-    throw new Error(`Unsupported platform ${key}`);
-  }
-
-  const assetName = `${assetBaseName}.tar.gz`;
-  const asset = releaseAssets.find((entry) => entry.name === assetName);
-  if (!asset) {
-    throw new Error(`Release v${VERSION} is missing asset ${assetName}`);
-  }
-
-  const checksumAsset = selectChecksumAsset(releaseAssets);
-  if (!checksumAsset) {
-    throw new Error(`Release v${VERSION} does not contain a checksum manifest asset`);
-  }
-
-  const checksumManifest = (await fetch(checksumAsset.browser_download_url)).toString("utf8");
-  const checksums = parseChecksumManifest(checksumManifest);
-  const expectedSha256 = checksums.get(assetName);
-  if (!expectedSha256) {
-    throw new Error(`Checksum manifest does not contain ${assetName}`);
-  }
-
-  return {
-    assetName,
-    assetUrl: asset.browser_download_url,
-    expectedSha256,
-  };
-}
-
-function extractBinaryFromTarGz(buffer) {
-  const tarBuffer = zlib.gunzipSync(buffer);
-  let offset = 0;
-
-  while (offset < tarBuffer.length) {
-    const header = tarBuffer.subarray(offset, offset + 512);
-    offset += 512;
-
-    const name = header.toString("utf-8", 0, 100).replace(/\0.*/g, "");
-    const sizeStr = header.toString("utf-8", 124, 136).replace(/\0.*/g, "").trim();
-    const size = parseInt(sizeStr, 8);
-
-    if (!name || isNaN(size)) break;
-
-    if (name === "open-plan-annotator" || name.endsWith("/open-plan-annotator")) {
-      return tarBuffer.subarray(offset, offset + size);
-    }
-
-    offset += Math.ceil(size / 512) * 512;
-  }
-
-  throw new Error("Binary 'open-plan-annotator' not found in archive");
-}
-
-async function main() {
-  const destDir = path.join(__dirname, "bin");
-  const destPath = path.join(destDir, "open-plan-annotator-binary");
-  const tempPath = `${destPath}.tmp-${process.pid}-${Date.now()}`;
-
-  // Skip if binary already exists
-  if (fs.existsSync(destPath)) {
-    return;
-  }
-
-  const fallbackUrl = getDownloadUrl();
-  console.error(`Downloading open-plan-annotator for ${getPlatformKey()}...`);
-
-  let archiveBuffer;
-
-  // Try checksum-verified download via GitHub API first, fall back to direct URL
-  try {
-    const { assetName, assetUrl, expectedSha256 } = await resolveReleaseAssetAndChecksum();
-    archiveBuffer = await fetch(assetUrl);
-    const actualSha256 = sha256Hex(archiveBuffer);
-
-    if (actualSha256 !== expectedSha256) {
-      throw new Error(
-        `Checksum verification failed for ${assetName} (expected ${expectedSha256}, got ${actualSha256})`,
-      );
-    }
-  } catch (verifiedErr) {
-    const message = verifiedErr && verifiedErr.message ? verifiedErr.message : String(verifiedErr);
-    console.error(`open-plan-annotator: checksum-verified install failed: ${message}`);
-    console.error(`Falling back to direct download (without checksum verification)...`);
-
-    try {
-      archiveBuffer = await fetch(fallbackUrl);
-    } catch (fallbackErr) {
-      const fbMsg = fallbackErr && fallbackErr.message ? fallbackErr.message : String(fallbackErr);
-      console.error(`open-plan-annotator: fallback download also failed: ${fbMsg}`);
-      throw verifiedErr;
-    }
-  }
-
-  try {
-    const binaryBuffer = extractBinaryFromTarGz(archiveBuffer);
-
-    if (!fs.existsSync(destDir)) {
-      fs.mkdirSync(destDir, { recursive: true });
-    }
-
-    fs.writeFileSync(tempPath, binaryBuffer, { mode: 0o755 });
-    fs.renameSync(tempPath, destPath);
-    fs.chmodSync(destPath, 0o755);
-    console.error(`Installed open-plan-annotator to ${destPath}`);
-  } catch (err) {
-    try {
-      fs.unlinkSync(tempPath);
-    } catch {
-      // Temp file may not exist
-    }
-    throw err;
-  }
-}
-
-main().catch((err) => {
-  console.error("Failed to install open-plan-annotator binary:", err.message);
-  console.error("You can try manually running: node", path.join(__dirname, "install.cjs"));
-  process.exit(1);
-});