overhand 0.0.0-stage → 0.0.2

package/LICENSE.md

@@ -0,0 +1,105 @@
+# Functional Source License, Version 1.1, ALv2 Future License
+
+## Abbreviation
+
+FSL-1.1-ALv2
+
+## Notice
+
+Copyright 2026 Craftly Oy
+
+## Terms and Conditions
+
+### Licensor ("We")
+
+The party offering the Software under these Terms and Conditions.
+
+### The Software
+
+The "Software" is each version of the software that we make available under
+these Terms and Conditions, as indicated by our inclusion of these Terms and
+Conditions with the Software.
+
+### License Grant
+
+Subject to your compliance with this License Grant and the Patents,
+Redistribution and Trademark clauses below, we hereby grant you the right to
+use, copy, modify, create derivative works, publicly perform, publicly display
+and redistribute the Software for any Permitted Purpose identified below.
+
+### Permitted Purpose
+
+A Permitted Purpose is any purpose other than a Competing Use. A Competing Use
+means making the Software available to others in a commercial product or
+service that:
+
+1. substitutes for the Software;
+
+2. substitutes for any other product or service we offer using the Software
+   that exists as of the date we make the Software available; or
+
+3. offers the same or substantially similar functionality as the Software.
+
+Permitted Purposes specifically include using the Software:
+
+1. for your internal use and access;
+
+2. for non-commercial education;
+
+3. for non-commercial research; and
+
+4. in connection with professional services that you provide to a licensee
+   using the Software in accordance with these Terms and Conditions.
+
+### Patents
+
+To the extent your use for a Permitted Purpose would necessarily infringe our
+patents, the license grant above includes a license under our patents. If you
+make a claim against any party that the Software infringes or contributes to
+the infringement of any patent, then your patent license to the Software ends
+immediately.
+
+### Redistribution
+
+The Terms and Conditions apply to all copies, modifications and derivatives of
+the Software.
+
+If you redistribute any copies, modifications or derivatives of the Software,
+you must include a copy of or a link to these Terms and Conditions and not
+remove any copyright notices provided in or with the Software.
+
+### Disclaimer
+
+THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR
+PURPOSE, MERCHANTABILITY, TITLE OR NON-INFRINGEMENT.
+
+IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE
+SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES,
+EVEN IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+
+### Trademarks
+
+Except for displaying the License Details and identifying us as the origin of
+the Software, you have no right under these Terms and Conditions to use our
+trademarks, trade names, service marks or product names.
+
+## Grant of Future License
+
+We hereby irrevocably grant you an additional license to use the Software under
+the Apache License, Version 2.0 that is effective on the second anniversary of
+the date we make the Software available. On or after that date, you may use the
+Software under the Apache License, Version 2.0, in which case the following
+will apply:
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use
+this file except in compliance with the License.
+
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software distributed
+under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+CONDITIONS OF ANY KIND, either express or implied. See the License for the
+specific language governing permissions and limitations under the License.

package/README.md

@@ -1,3 +1,13 @@
-# Temporary Holding Version
+# overhand
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Mission control for your AI coding agents, on your own machine.
+
+```sh
+npx overhand start    # or: bunx overhand start
+```
+
+The first run downloads the Overhand release package for your machine from GitHub, checks its SHA-256 and keeps it in
+`~/.overhand/npm/<version>`; every run after that starts it directly. Other ways to install, and the full docs:
+<https://github.com/craftly-io/overhand>.
+
+This package is only the launcher; the version on npm matches the GitHub release it runs.

package/bin/overhand.js

@@ -0,0 +1,69 @@
+#!/usr/bin/env node
+// `npx overhand` / `bunx overhand`: on first run downloads this version's release package for the machine (the same file
+// the curl installer gets), checks its SHA-256 against the release's SHA256SUMS, unpacks it into
+// ~/.overhand/npm/<version>, then runs it with the given arguments. It downloads here rather than in a postinstall
+// script because bunx skips those. OVERHAND_DOWNLOAD points at another copy of the release files.
+// ~/.overhand/npm/current links to the newest version fetched; the login service runs it from there.
+// ponytail: older versions stay in ~/.overhand/npm; prune if anyone asks.
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, readlinkSync, renameSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+const { version } = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+const os = { darwin: "darwin", linux: "linux" }[process.platform];
+const arch = { arm64: "arm64", x64: "x64" }[process.arch];
+const home = join(homedir(), ".overhand");
+const dir = join(home, "npm", version);
+const bin = join(dir, "overhand");
+
+/** Prints why and exits non-zero. */
+function fail(message) {
+  console.error(`overhand: ${message}`);
+  process.exit(1);
+}
+
+/** Fetches one release file, failing with its URL when it doesn't answer 200. */
+async function get(url) {
+  const r = await fetch(url).catch(() => undefined);
+  if (!r?.ok) fail(`download failed: ${url}${r ? ` (${r.status})` : ""}`);
+  return Buffer.from(await r.arrayBuffer());
+}
+
+if (!os || !arch) fail(`there's no Overhand build for ${process.platform}/${process.arch}; it runs on macOS and Linux.`);
+if (!existsSync(bin)) {
+  const pkg = `overhand-${os}-${arch}.tar.gz`;
+  const base = process.env.OVERHAND_DOWNLOAD ?? `https://get.overhand.dev/download/v${version}`;
+  console.error(`overhand: downloading ${pkg} (v${version}), once`);
+  const [tar, sums] = await Promise.all([get(`${base}/${pkg}`), get(`${base}/SHA256SUMS`)]);
+  const want = sums
+    .toString()
+    .split("\n")
+    .find((l) => l.endsWith(`  ${pkg}`))
+    ?.split(" ")[0];
+  if (!want || want !== createHash("sha256").update(tar).digest("hex")) fail(`checksum mismatch for ${pkg}; not installing.`);
+  // unpack beside the target and rename, so a half-written folder never looks installed
+  const tmp = `${dir}.${process.pid}`;
+  mkdirSync(tmp, { recursive: true });
+  writeFileSync(join(tmp, pkg), tar);
+  const x = spawnSync("tar", ["-xzf", pkg], { cwd: tmp, stdio: "inherit" });
+  rmSync(join(tmp, pkg));
+  if (x.status !== 0) fail("couldn't unpack the package (is tar installed?)");
+  if (existsSync(bin)) rmSync(tmp, { recursive: true });
+  else renameSync(tmp, dir);
+}
+// the login service runs npm/current/overhand, so it moves on to the newest version any run fetched (and never back
+// to an older one run by name); the daemon notices and restarts on it
+const current = join(home, "npm", "current");
+let at = "";
+try {
+  at = readlinkSync(current);
+} catch {}
+if (!at || version.localeCompare(at, undefined, { numeric: true }) > 0) {
+  const link = `${current}.${process.pid}`;
+  symlinkSync(version, link);
+  renameSync(link, current); // replaces the old link in one step
+}
+const run = spawnSync(bin, process.argv.slice(2), { stdio: "inherit" });
+process.exit(run.status ?? 1);

package/package.json

@@ -1,6 +1,30 @@
 {
   "name": "overhand",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.0.2",
+  "description": "Mission control for your AI coding agents, on your own machine",
+  "license": "FSL-1.1-ALv2",
+  "homepage": "https://overhand.dev",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/craftly-io/overhand.git",
+    "directory": "release/npm"
+  },
+  "type": "module",
+  "bin": {
+    "overhand": "bin/overhand.js"
+  },
+  "files": [
+    "bin"
+  ],
+  "os": [
+    "darwin",
+    "linux"
+  ],
+  "cpu": [
+    "arm64",
+    "x64"
+  ],
+  "engines": {
+    "node": ">=18"
+  }
+}