proofbridge-cli 1.0.2

package/LICENSE

@@ -0,0 +1,48 @@
+# AGPL-3.0 - GNU Affero General Public License v3.0
+
+## English
+
+This software is licensed under the AGPL-3.0 license, which means:
+
+- **Attribution Required**: You must give appropriate credit, provide a link to the license, and indicate if changes were made. When using Claude Code Bridge (CCB), please credit the original project.
+
+- **Open Source Required**: If you modify this software and distribute it or run it as a service, you must release your source code under AGPL-3.0.
+
+- **Network Use (Copyleft)**: If you run this software as a network service (e.g., SaaS), users interacting with it over the network must be able to receive the source code.
+
+- **No Closed-Source Use**: You cannot use this software in proprietary/closed-source projects unless you open-source the entire project under AGPL-3.0.
+
+**In short**: You can use Claude Code Bridge for free, but if you build upon it, your code must also be open-sourced under AGPL-3.0 with attribution to this project. Closed-source commercial use requires a separate license.
+
+For commercial licensing inquiries (closed-source use), please contact the maintainer.
+
+---
+
+## 中文
+
+本软件采用 AGPL-3.0 许可协议，这意味着：
+
+- **署名要求**：您必须注明出处，提供许可协议链接，并说明是否进行了修改。使用 Claude Code Bridge (CCB) 时，请注明项目来源。
+
+- **开源要求**：如果您修改此软件并将其分发或作为服务运行，则必须根据 AGPL-3.0 发布您的源代码。
+
+- **网络使用（Copyleft）**：如果您将此软件作为网络服务（例如 SaaS）运行，则通过网络与其交互的用户必须能够接收源代码。
+
+- **禁止闭源使用**：您不能在专有/闭源项目中使用此软件，除非您将整个项目根据 AGPL-3.0 开源。
+
+**简单来说**：您可以免费使用 Claude Code Bridge，但如果您基于它进行开发，您的代码也必须根据 AGPL-3.0 开源，并注明本项目。闭源商业用途需要单独的许可证。
+
+对于商业许可咨询（闭源使用），请联系维护者。
+
+---
+
+## Full License Text
+
+GNU AFFERO GENERAL PUBLIC LICENSE
+Version 3, 19 November 2007
+
+Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+
+Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.
+
+For the complete license text, see: https://www.gnu.org/licenses/agpl-3.0.txt

package/README.md

@@ -0,0 +1,89 @@
+# ProofBridge
+
+在一个终端工作区里使用 Claude Code、Codex、Gemini 等 AI 编程助手，用网页管理项目配置，让多个助手分工协作。
+
+- **统一工作区**：在同一项目中启动和切换多个助手。
+- **网页配置**：添加助手、选择平台，在中央画布中安排窗口与分屏。
+- **一步完成设置**：自动检查、保存并应用配置，明确提示结果和必要的重启操作。
+- **协作与记忆**：助手之间可以传递任务，项目记忆保存在 `.pb/pb_memory.md`。
+
+## 安装
+
+通过 npm 全局安装：
+
+```bash
+npm install -g proofbridge-cli
+pb --print-version
+```
+
+包内包含桌面运行文件，无需 Rust；支持 macOS x64/arm64，以及 Linux x64（glibc 2.35+，不含 Alpine）。仍需 Node.js 18+、Python 3.10+、tmux 和已登录的 AI 编程 CLI，首次启动会联网准备 Python 依赖。
+
+以下为 macOS / Linux 源码安装方式。需要 Git、Python 3.10+、tmux、Rust 工具链（`cargo`、`rustc`）及本机编译工具（macOS Command Line Tools / Linux C/C++ 编译器与链接器），以及至少一个已经安装并完成登录的 AI 编程 CLI。
+
+源码安装会在有 Go 1.26.6+、Node.js 20.19+ 时一并构建用量页和采集器；缺少它们时，助手和配置功能仍可使用。
+
+```bash
+git clone https://github.com/Atingaii/proofBridgeCli.git
+cd proofBridgeCli
+bash ./install.sh install
+pb --print-version
+```
+
+仓库为私有时，请先配置 GitHub 访问凭据。安装器会准备 Python 依赖，并将命令放入 `~/.local/bin`；如果找不到 `pb`，请把该目录加入 `PATH`：
+
+```bash
+export PATH="$HOME/.local/bin:$PATH"
+```
+
+源码安装会引用这个目录，请保留它。Windows x64 用户可在仓库目录运行 `.\install.ps1 install -Yes`，需预先准备 Python 3.10+、WezTerm、Git Bash 和 Herdr 0.8.0+。
+
+## 开始使用
+
+进入你要工作的项目目录，启动 ProofBridge：
+
+```bash
+cd /path/to/your-project
+mkdir -p .pb
+pb
+```
+
+首次启动会选择本机可用的助手；也可以先打开配置页，自行选择：
+
+```bash
+pb config ui
+```
+
+在助手的终端中直接输入任务。需要协作时，可使用 `/ask <助手名称> <任务>`，例如 `/ask reviewer 检查当前改动`；接收方须已在项目中配置。
+
+## 网页配置
+
+在项目目录运行 `pb config ui` 后，按终端提示打开本地页面：
+
+1. 添加助手，设置名称并选择 Codex、Claude Code 等平台。
+2. 在中央画布中拖动分屏、调整比例，或添加窗口。
+3. 点击 **完成设置**，页面会检查、保存并显示实际应用状态。
+
+配置保存在 `.pb/pb.config`。模型、思考强度、Base URL 和 API Key 由原生客户端或 CC Switch 管理；切换后需结束当前 PB 工作区，再重新启动以读取新配置。退出工作区使用 `pb kill`；下次运行 `pb` 时会尝试恢复已有会话。
+
+配置页的 **用量** 入口自动发现本机可读目录中的 Codex、Claude Code 和 PB/CCB 日志，包含独立客户端的记录，并按会话启动目录归类。可按时间、项目和模型筛选，查看明细并导出 CSV；费用按随程序提供的 API 价格估算，并非实际账单。其他平台没有可解析日志时不会显示虚构用量。
+
+## 常用命令
+
+| 命令 | 用途 |
+| --- | --- |
+| `pb` | 启动当前项目工作区 |
+| `pb config ui` | 打开网页配置 |
+| `pb config validate` | 检查当前项目配置 |
+| `pb --help` | 查看命令帮助 |
+| `pb --print-version` | 查看本地版本 |
+
+npm 安装的用户使用 `npm install -g proofbridge-cli@latest` 更新。
+
+更新源码安装时，在 `proofBridgeCli` 目录执行：
+
+```bash
+git pull --ff-only
+bash ./install.sh install
+```
+
+[许可证](LICENSE) · [项目来源](UPSTREAM.md)

package/UPSTREAM.md

@@ -0,0 +1,7 @@
+# 项目来源
+
+ProofBridge 基于 [Claude Code Bridge](https://github.com/SeemSeam/claude_codex_bridge) 开发，原作者为 SeemSeam 及其贡献者。
+
+本项目调整了品牌、命令与配置命名，并重新设计 Web 配置界面。
+
+原始 [LICENSE](LICENSE) 保持不变；各组件的第三方声明与许可证继续保留。

package/VERSION

@@ -0,0 +1 @@
+1.0.2

package/assets/brand/README.md

@@ -0,0 +1,9 @@
+# ProofBridge icon
+
+Created for this project with the built-in ImageGen tool on 2026-09-25. The approved working asset is `proofbridge-icon.png` (1024 px), with 256 px and 64 px web derivatives. Android and iOS assets are resized from the same source without changing their existing platform filenames or dimensions.
+
+## Generation prompt
+
+Create one polished production app icon for ProofBridge, a multi-agent command-line developer workspace. A minimal geometric bridge formed by two strong vertical piers and one connecting arch, with square negative-space details suggesting terminal windows. Use vivid mint/teal on very dark blue-slate, centered, generous safe padding, crisp and readable at 24 pixels. A single flat graphic, no text, no mockup, no perspective, no watermark.
+
+The product icon is original generated artwork. UI component glyphs have separate upstream notices in the configuration UI design documentation.

package/bin/ask.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+"use strict";
+
+require("./pb-npm-runner").run("ask");

package/bin/autonew.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+"use strict";
+
+require("./pb-npm-runner").run("autonew");

package/bin/ctx-transfer.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+"use strict";
+
+require("./pb-npm-runner").run("ctx-transfer");

package/bin/pb-npm-install.js

@@ -0,0 +1,347 @@
+#!/usr/bin/env node
+"use strict";
+
+const childProcess = require("child_process");
+const crypto = require("crypto");
+const fs = require("fs");
+const path = require("path");
+
+const root = path.resolve(__dirname, "..");
+const manifest = require(path.join(root, "package.json"));
+const version = manifest.version;
+const vendorRoot = path.join(root, ".pb-release");
+const installLock = path.join(root, ".pb-install.lock");
+const runtimeProbe = [
+  "import sys",
+  "if sys.version_info < (3, 10):",
+  "    raise SystemExit(1)",
+  "try:",
+  "    import tomllib",
+  "except ModuleNotFoundError:",
+  "    import tomli",
+  "import aiohttp",
+  "from cryptography.hazmat.primitives.asymmetric import ed25519, x25519",
+  "from cryptography.hazmat.primitives.ciphers.aead import ChaCha20Poly1305",
+].join("\n");
+
+function artifactForHost(platform = process.platform, arch = process.arch) {
+  if (platform === "darwin" && ["x64", "arm64"].includes(arch)) {
+    return {
+      directory: "pb-macos-universal",
+      file: "pb-macos-universal.tar.gz",
+    };
+  }
+  if (platform === "linux" && arch === "x64") {
+    return {
+      directory: "pb-linux-x86_64",
+      file: "pb-linux-x86_64.tar.gz",
+    };
+  }
+  throw new Error(
+    `Unsupported platform for proofbridge-cli: ${platform}/${arch}. ` +
+      "Supported hosts: Linux x64, macOS x64, and macOS arm64."
+  );
+}
+
+function assertLinuxRuntime(glibcVersion) {
+  const match = typeof glibcVersion === "string" && glibcVersion.match(/^(\d+)\.(\d+)/);
+  if (!match) {
+    throw new Error("ProofBridge's Linux x64 bundle requires glibc 2.35 or newer. Alpine/musl is not supported; use a glibc-based distribution such as Ubuntu 22.04 or newer.");
+  }
+  const major = Number(match[1]);
+  const minor = Number(match[2]);
+  if (major < 2 || (major === 2 && minor < 35)) {
+    throw new Error(`ProofBridge's Linux x64 bundle requires glibc 2.35 or newer (detected ${glibcVersion}). Upgrade your Linux distribution before installing.`);
+  }
+}
+
+function installDir(info) {
+  return path.join(vendorRoot, info.directory);
+}
+
+function executablePath(command = "pb") {
+  const info = artifactForHost();
+  const base = installDir(info);
+  return command === "pb" ? path.join(base, "pb") : path.join(base, "bin", command);
+}
+
+function runtimePythonPath(info) {
+  return path.join(installDir(info), ".venv", "bin", "python");
+}
+
+function isReleaseInstalled(info) {
+  const dir = installDir(info);
+  const versionFile = path.join(dir, "VERSION");
+  const pbPath = path.join(dir, "pb");
+  if (!fs.existsSync(versionFile) || !fs.existsSync(pbPath)) {
+    return false;
+  }
+  try {
+    const payload = JSON.parse(fs.readFileSync(path.join(dir, ".npm-payload.json"), "utf8"));
+    if (payload.version !== version || !payload.files || !payload.files.pb) return false;
+    for (const [name, expected] of Object.entries(payload.files)) {
+      const target = path.join(dir, name);
+      const stat = fs.lstatSync(target);
+      if (!stat.isFile() || stat.size !== expected.size) return false;
+      if (expected.executable) fs.accessSync(target, fs.constants.X_OK);
+    }
+    fs.accessSync(pbPath, fs.constants.X_OK);
+    return fs.readFileSync(versionFile, "utf8").trim() === version;
+  } catch (_error) {
+    return false;
+  }
+}
+
+function isRuntimeReady(info) {
+  const pythonPath = runtimePythonPath(info);
+  if (!fs.existsSync(pythonPath)) {
+    return false;
+  }
+  const completed = childProcess.spawnSync(pythonPath, ["-c", runtimeProbe], {
+    stdio: "ignore",
+    timeout: 15000,
+  });
+  return !completed.error && completed.status === 0;
+}
+
+function isInstalled(info) {
+  return isReleaseInstalled(info) && isRuntimeReady(info);
+}
+
+function parseSha256Sums(text) {
+  const checksums = new Map();
+  for (const line of text.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed) {
+      continue;
+    }
+    const match = trimmed.match(/^([a-fA-F0-9]{64})\s+\*?(.+)$/);
+    if (match) {
+      if (checksums.has(match[2])) {
+        throw new Error(`Duplicate checksum for ${match[2]}`);
+      }
+      checksums.set(match[2], match[1].toLowerCase());
+    }
+  }
+  return checksums;
+}
+
+function sha256File(filePath) {
+  const hash = crypto.createHash("sha256");
+  hash.update(fs.readFileSync(filePath));
+  return hash.digest("hex");
+}
+
+function run(command, args, options = {}) {
+  const completed = childProcess.spawnSync(command, args, {
+    stdio: "inherit",
+    ...options,
+  });
+  if (completed.error) {
+    throw completed.error;
+  }
+  if (completed.status !== 0) {
+    const reason = completed.signal ? `signal ${completed.signal}` : `exit ${completed.status}`;
+    throw new Error(`${command} ${args.join(" ")} failed with ${reason}`);
+  }
+}
+
+function bootstrapRuntime(info) {
+  const dir = installDir(info);
+  const installerPath = path.join(dir, "install.sh");
+  if (!isReleaseInstalled(info)) {
+    throw new Error(`Cannot bootstrap an incomplete PB release at ${dir}`);
+  }
+  if (!fs.existsSync(installerPath)) {
+    throw new Error(`PB runtime bootstrap installer not found at ${installerPath}`);
+  }
+
+  const env = {
+    ...process.env,
+    PB_INSTALL_PREFIX: dir,
+    PB_BIN_DIR: path.join(dir, ".npm-runtime-bin"),
+    PB_SOURCE_KIND: "release",
+    PB_USE_MANAGED_VENV: "1",
+    PB_INSTALL_TOMLI: "1",
+    PB_INSTALL_MOBILE_RELAY_DEPS: "1",
+    PB_INSTALL_ROLES: "0",
+    PB_INSTALL_NEOVIM: "0",
+  };
+  run("bash", [installerPath, "runtime-bootstrap"], { env });
+  if (!isRuntimeReady(info)) {
+    throw new Error(`PB managed Python runtime is not usable at ${runtimePythonPath(info)}`);
+  }
+}
+
+function sleep(milliseconds) {
+  return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+
+function processIsAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) {
+    return false;
+  }
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error && error.code === "EPERM";
+  }
+}
+
+function readLockOwner() {
+  try {
+    return JSON.parse(fs.readFileSync(path.join(installLock, "owner.json"), "utf8"));
+  } catch (_error) {
+    return null;
+  }
+}
+
+function reclaimStaleInstallLock() {
+  const owner = readLockOwner();
+  if (owner && processIsAlive(Number(owner.pid))) {
+    return false;
+  }
+  try {
+    const ageMs = Date.now() - fs.statSync(installLock).mtimeMs;
+    if (!owner && ageMs < 30000) {
+      return false;
+    }
+    fs.rmSync(installLock, { recursive: true, force: true });
+    return true;
+  } catch (_error) {
+    return false;
+  }
+}
+
+async function acquireInstallLock() {
+  const configuredTimeout = Number(process.env.PB_NPM_INSTALL_LOCK_TIMEOUT_MS);
+  const timeoutMs =
+    Number.isFinite(configuredTimeout) && configuredTimeout > 0
+      ? configuredTimeout
+      : 15 * 60 * 1000;
+  const deadline = Date.now() + timeoutMs;
+  const token = crypto.randomBytes(16).toString("hex");
+
+  while (true) {
+    try {
+      fs.mkdirSync(installLock);
+    } catch (error) {
+      if (!error || error.code !== "EEXIST") {
+        throw error;
+      }
+      if (reclaimStaleInstallLock()) {
+        continue;
+      }
+      if (Date.now() >= deadline) {
+        throw new Error(`Timed out waiting for PB npm install lock: ${installLock}`);
+      }
+      await sleep(200);
+      continue;
+    }
+
+    try {
+      fs.writeFileSync(
+        path.join(installLock, "owner.json"),
+        JSON.stringify({ pid: process.pid, token, createdAt: new Date().toISOString() })
+      );
+    } catch (error) {
+      fs.rmSync(installLock, { recursive: true, force: true });
+      throw error;
+    }
+    return () => {
+      const owner = readLockOwner();
+      if (owner && owner.token === token) {
+        fs.rmSync(installLock, { recursive: true, force: true });
+      }
+    };
+  }
+}
+
+function payloadPython() {
+  const candidates = process.env.PB_PYTHON_BIN
+    ? [process.env.PB_PYTHON_BIN]
+    : ["python3", "python3.14", "python3.13", "python3.12", "python3.11", "python3.10", "python"];
+  for (const candidate of candidates) {
+    const probe = childProcess.spawnSync(candidate, ["-c", "import sys; sys.exit(sys.version_info < (3, 10))"], {
+      stdio: "ignore", timeout: 15000,
+    });
+    if (!probe.error && probe.status === 0) return candidate;
+  }
+  throw new Error("ProofBridge requires Python 3.10+ to install its bundled runtime. Install Python and retry, or set PB_PYTHON_BIN to its executable.");
+}
+
+function checkPayload() {
+  run(payloadPython(), [path.join(__dirname, "pb-npm-payload.py"), "validate-all", root]);
+  console.error(`Verified both bundled ProofBridge v${version} releases.`);
+}
+
+function installBundledRelease(info) {
+  const bundles = path.join(root, "npm-bundles");
+  const archivePath = path.join(bundles, info.file);
+  const sumsPath = path.join(bundles, "SHA256SUMS");
+  if (!fs.existsSync(archivePath) || !fs.existsSync(sumsPath)) {
+    throw new Error(`ProofBridge npm package is incomplete: missing bundled ${info.file} or SHA256SUMS. Reinstall proofbridge-cli from npm.`);
+  }
+  const checksums = parseSha256Sums(fs.readFileSync(sumsPath, "utf8"));
+  const expected = checksums.get(info.file);
+  if (!expected || sha256File(archivePath) !== expected) {
+    throw new Error(`Checksum mismatch or missing checksum for bundled ${info.file}. Reinstall proofbridge-cli from npm.`);
+  }
+  fs.mkdirSync(vendorRoot, { recursive: true });
+  const staging = fs.mkdtempSync(path.join(vendorRoot, ".staging-"));
+  try {
+    run(payloadPython(), [path.join(__dirname, "pb-npm-payload.py"), "extract", archivePath, version, staging]);
+    fs.rmSync(installDir(info), { recursive: true, force: true });
+    fs.renameSync(path.join(staging, info.directory), installDir(info));
+    console.log(`Installed ProofBridge v${version} from bundled ${info.file}.`);
+  } finally {
+    fs.rmSync(staging, { recursive: true, force: true });
+  }
+}
+
+async function install() {
+  const info = artifactForHost();
+  if (process.platform === "linux") {
+    assertLinuxRuntime(process.report.getReport().header.glibcVersionRuntime);
+  }
+  if (isInstalled(info)) {
+    return;
+  }
+
+  const releaseLock = await acquireInstallLock();
+  try {
+    if (isInstalled(info)) {
+      return;
+    }
+    if (!isReleaseInstalled(info)) {
+      installBundledRelease(info);
+    }
+    if (!isRuntimeReady(info)) {
+      bootstrapRuntime(info);
+    }
+  } finally {
+    releaseLock();
+  }
+}
+
+if (require.main === module) {
+  Promise.resolve().then(() => process.argv.includes("--check-payload") ? checkPayload() : install()).catch((error) => {
+    console.error(error.message || error);
+    process.exit(1);
+  });
+}
+
+module.exports = {
+  artifactForHost,
+  assertLinuxRuntime,
+  bootstrapRuntime,
+  checkPayload,
+  executablePath,
+  install,
+  installDir,
+  isInstalled,
+  isReleaseInstalled,
+  isRuntimeReady,
+  runtimePythonPath,
+};

package/bin/pb-npm-payload.py

@@ -0,0 +1,338 @@
+#!/usr/bin/env python3
+"""Validate bundled releases before publication and extract only validated files."""
+from __future__ import annotations
+
+import hashlib
+from html.parser import HTMLParser
+import json
+from pathlib import Path, PurePosixPath
+import re
+import struct
+import sys
+import tarfile
+from urllib.parse import unquote, urlsplit
+
+ARTIFACTS = {
+    "pb-macos-universal.tar.gz": ("macos", "universal"),
+    "pb-linux-x86_64.tar.gz": ("linux", "x86_64"),
+}
+EXECUTABLES = ("pb", "install.sh", "bin/_pb-python", "bin/ask", "bin/autonew", "bin/ctx-transfer")
+BINARIES = ("bin/pb-agent-sidebar", "bin/pb-rs-helper", "bin/pb-runtime-accelerator", "bin/pb-usage")
+REQUIRED = EXECUTABLES + BINARIES + (
+    "VERSION", "BUILD_INFO.json", "pb.py", "LICENSE", "UPSTREAM.md",
+    "assets/config_ui/index.html", "lib/cli/services/config_ui.py",
+    "assets/usage_ui/index.html",
+    "deploy/mobile-relay/requirements.txt",
+)
+FORBIDDEN = {".git", ".trellis", ".codex", ".agents", ".venv", "__pycache__", "node_modules", "npm-bundles", ".pb-release", "test", "tests", ".github", ".pytest_cache", ".mypy_cache"}
+
+
+class _UsageResources(HTMLParser):
+    def __init__(self) -> None:
+        super().__init__()
+        self.references: list[tuple[str, str]] = []
+
+    def handle_starttag(self, tag: str, attrs) -> None:
+        values = dict(attrs)
+        if tag == "script" and values.get("src"):
+            self.references.append((tag, values["src"]))
+        if tag == "link" and values.get("href") and set(str(values.get("rel", "")).split()).intersection(
+            {"stylesheet", "modulepreload", "icon", "preload"}
+        ):
+            self.references.append((tag, values["href"]))
+
+
+def _javascript_tokens(source: str):
+    """Read literal module references without treating comments/strings as code.
+
+    This is a lexer for built Vite output, not a JavaScript executor. Regex
+    literals and template strings are skipped as units; constant templates are
+    usable specifiers, while computed imports remain the bundler's responsibility.
+    """
+    index = 0
+    previous = None
+    while index < len(source):
+        char = source[index]
+        if char.isspace():
+            index += 1
+            continue
+        if source.startswith("//", index):
+            end = source.find("\n", index + 2)
+            index = len(source) if end < 0 else end + 1
+            continue
+        if source.startswith("/*", index):
+            end = source.find("*/", index + 2)
+            index = len(source) if end < 0 else end + 2
+            continue
+        if char in "\"'`":
+            quote, start = char, index + 1
+            index += 1
+            while index < len(source):
+                if source[index] == "\\":
+                    index += 2
+                elif source[index] == quote:
+                    break
+                else:
+                    index += 1
+            raw = source[start:index]
+            index += 1
+            token = ("template" if quote == "`" and "${" in raw else "string", _decode_js_literal(raw))
+        elif char == "/" and previous in {None, "=", "(", "[", "{", ",", ":", ";", "!", "?", "return", "case", ">", "&", "|"}:
+            index += 1
+            in_class = False
+            while index < len(source):
+                value = source[index]
+                if value == "\\":
+                    index += 2
+                    continue
+                if value == "[":
+                    in_class = True
+                elif value == "]":
+                    in_class = False
+                elif value == "/" and not in_class:
+                    index += 1
+                    break
+                index += 1
+            token = ("regex", "regex")
+        elif char.isalpha() or char in "_$":
+            start = index
+            while index < len(source) and (source[index].isalnum() or source[index] in "_$"):
+                index += 1
+            token = ("word", source[start:index])
+        else:
+            index += 1
+            token = ("punctuation", char)
+        previous = token[1]
+        yield token
+
+
+def _decode_js_literal(value: str) -> str:
+    def decode(match):
+        escape = match.group(1)
+        if escape.startswith("u{"):
+            return chr(int(escape[2:-1], 16))
+        if escape.startswith(("u", "x")) and len(escape) > 1:
+            return chr(int(escape[1:], 16))
+        return {"n": "\n", "r": "\r", "t": "\t", "\n": "", "\r\n": ""}.get(escape, escape)
+    return re.sub(r"\\(u\{[0-9a-fA-F]+\}|u[0-9a-fA-F]{4}|x[0-9a-fA-F]{2}|\r\n|[\s\S])", decode, value)
+
+
+def _javascript_dependencies(source: str):
+    tokens = list(_javascript_tokens(source))
+    for index, (kind, value) in enumerate(tokens):
+        if kind != "word":
+            continue
+        if value in {"import", "from"} and index + 1 < len(tokens) and tokens[index + 1][0] == "string":
+            yield tokens[index + 1][1]
+        if (value == "import" and index + 3 < len(tokens)
+                and tokens[index + 1][1] == "(" and tokens[index + 2][0] == "string"
+                and tokens[index + 3][1] in {")", ","}):
+            yield tokens[index + 2][1]
+        # Vite records lazy JS/CSS preload dependencies in this generated table.
+        if value == "__vite__mapDeps" and index + 1 < len(tokens) and tokens[index + 1][1] == "=":
+            for table_kind, table_value in tokens[index + 2:]:
+                if table_value == ";":
+                    break
+                if table_kind == "string" and table_value.startswith("assets/"):
+                    yield "/usage/" + table_value
+
+
+def _css_dependencies(source: str):
+    source = re.sub(r"/\*[\s\S]*?\*/", "", source)
+    literals = re.compile(r'''url\(\s*(?:"((?:\\.|[^"\\])*)"|'((?:\\.|[^'\\])*)'|([^)]*?))\s*\)|@import\s+(?:"((?:\\.|[^"\\])*)"|'((?:\\.|[^'\\])*)')''', re.IGNORECASE)
+    for match in literals.finditer(source):
+        value = next(group for group in match.groups() if group is not None).strip()
+        # CSS hex escapes may encode dots, slashes or spaces in resource URLs.
+        value = re.sub(r"\\([0-9a-fA-F]{1,6})\s?", lambda item: chr(int(item[1], 16)), value)
+        value = re.sub(r"\\([^\n\r])", r"\1", value)
+        if value.startswith(("data:", "#")):
+            continue
+        yield value
+
+
+def _usage_resource_path(reference: str, *, source: str) -> str:
+    url = urlsplit(reference)
+    path = unquote(url.path)
+    if url.scheme or url.netloc or "\\" in path or any(ord(char) < 32 for char in path):
+        raise ValueError(f"Usage page requires a non-local resource: {reference}")
+    root = PurePosixPath("assets/usage_ui")
+    if path.startswith("/usage/"):
+        relative = PurePosixPath(path.removeprefix("/usage/"))
+        name = root / relative
+    else:
+        relative = PurePosixPath(path)
+        name = PurePosixPath(source).parent / relative
+    if relative.is_absolute() or ".." in relative.parts or not relative.parts:
+        raise ValueError(f"Invalid Usage resource path from {source}: {reference}")
+    allowed = name == root / "favicon.svg" or name.is_relative_to(root / "assets")
+    if not allowed:
+        raise ValueError(f"Usage resource must be served under /usage/assets/: {reference}")
+    return str(name)
+
+
+def usage_asset_names(files, read) -> tuple[str, ...]:
+    parser = _UsageResources()
+    parser.feed(read("assets/usage_ui/index.html").decode("utf-8"))
+    scripts = 0
+    pending = []
+    for tag, reference in parser.references:
+        if reference.startswith("data:") and tag == "link":
+            continue
+        name = _usage_resource_path(reference, source="assets/usage_ui/index.html")
+        pending.append(name)
+        if tag == "script" and PurePosixPath(name).suffix == ".js":
+            scripts += 1
+    if not scripts:
+        raise ValueError("Usage page is missing its built JavaScript entry")
+    checked = set()
+    while pending:
+        name = pending.pop()
+        if name in checked:
+            continue
+        if name not in files or files[name].size == 0:
+            raise ValueError(f"Release missing Usage resource: {name}")
+        checked.add(name)
+        suffix = PurePosixPath(name).suffix
+        if suffix not in {".js", ".mjs", ".css"}:
+            continue
+        content = read(name).decode("utf-8")
+        references = _css_dependencies(content) if suffix == ".css" else _javascript_dependencies(content)
+        for reference in references:
+            if suffix != ".css" and not reference.startswith((".", "/")):
+                raise ValueError(f"Unbundled Usage module reference from {name}: {reference}")
+            pending.append(_usage_resource_path(reference, source=name))
+    names = tuple(sorted(name for name in files if name.startswith("assets/usage_ui/")))
+    if any(files[name].size == 0 for name in names):
+        raise ValueError("Release contains an empty Usage asset")
+    return names
+
+
+def check_binary(data: bytes, platform: str, name: str) -> None:
+    if platform == "linux":
+        valid = (len(data) >= 64 and data[:6] == b"\x7fELF\x02\x01"
+                 and struct.unpack_from("<H", data, 18)[0] == 62)
+    else:
+        valid = False
+        if len(data) >= 48 and data[:4] in (b"\xca\xfe\xba\xbe", b"\xca\xfe\xba\xbf"):
+            count = struct.unpack_from(">I", data, 4)[0]
+            stride = 32 if data[:4] == b"\xca\xfe\xba\xbf" else 20
+            if 1 <= count <= 16 and len(data) >= 8 + count * stride:
+                cpus = {struct.unpack_from(">I", data, 8 + i * stride)[0] for i in range(count)}
+                valid = {0x01000007, 0x0100000C}.issubset(cpus)
+    if not valid:
+        raise ValueError(f"Invalid {platform} native binary: {name}")
+
+
+def inspect_archive(archive: Path, version: str, destination: Path | None = None) -> dict:
+    if archive.name not in ARTIFACTS:
+        raise ValueError(f"Unsupported release archive: {archive.name}")
+    platform, arch = ARTIFACTS[archive.name]
+    root = archive.name.removesuffix(".tar.gz")
+    with tarfile.open(archive, "r:gz") as tar:
+        members = []
+        files = {}
+        total = 0
+        seen = set()
+        for member in tar:
+            if member.name == archive.name and member.issym() and member.linkname == root:
+                continue  # Historical top-level convenience alias; never extract it.
+            name = PurePosixPath(member.name)
+            if (name.is_absolute() or ".." in name.parts or "\\" in member.name
+                    or not name.parts or name.parts[0] != root):
+                raise ValueError(f"Unsafe archive path: {member.name}")
+            if any(part in FORBIDDEN for part in name.parts):
+                raise ValueError(f"Development-only content in release: {member.name}")
+            if str(name) in seen:
+                raise ValueError(f"Duplicate archive path: {member.name}")
+            seen.add(str(name))
+            if not (member.isfile() or member.isdir()):
+                raise ValueError(f"Unsupported archive entry: {member.name}")
+            if member.mode & 0o7000:
+                raise ValueError(f"Unsafe archive permissions: {member.name}")
+            total += member.size
+            if total > 1024 * 1024 * 1024 or len(seen) > 50000:
+                raise ValueError("Release archive exceeds extraction limits")
+            members.append(member)
+            if member.isfile():
+                files[str(name.relative_to(root))] = member
+        for required in REQUIRED:
+            if required not in files or files[required].size == 0:
+                raise ValueError(f"Release missing required file: {required}")
+        for executable in EXECUTABLES + BINARIES:
+            if not files[executable].mode & 0o111:
+                raise ValueError(f"Release file is not executable: {executable}")
+        def read(name: str) -> bytes:
+            source = tar.extractfile(files[name])
+            assert source is not None
+            return source.read()
+        if read("VERSION").decode().strip() != version:
+            raise ValueError(f"Release VERSION does not match npm version {version}")
+        metadata = json.loads(read("BUILD_INFO.json"))
+        for key, expected in (("version", version), ("platform", platform), ("arch", arch)):
+            if metadata.get(key) != expected:
+                raise ValueError(f"Release BUILD_INFO {key} must equal {expected}")
+        for binary in BINARIES:
+            source = tar.extractfile(files[binary])
+            assert source is not None
+            check_binary(source.read(520), platform, binary)
+        checked_files = tuple(dict.fromkeys((*REQUIRED, *usage_asset_names(files, read))))
+        if destination is not None:
+            if destination.exists() and any(destination.iterdir()):
+                raise ValueError(f"Extraction destination must be empty: {destination}")
+            destination.mkdir(parents=True, exist_ok=True)
+            # Entries were restricted to regular files/directories within one root.
+            # No symlink, hardlink or special file can redirect extraction.
+            tar.extractall(destination, members=members)
+            (destination / root / ".npm-payload.json").write_text(json.dumps({
+                "version": version,
+                "files": {name: {"size": files[name].size, "executable": name in EXECUTABLES + BINARIES}
+                          for name in checked_files},
+            }))
+        return metadata
+
+
+def validate_all(root: Path) -> None:
+    version = json.loads((root / "package.json").read_text())["version"]
+    if (root / "VERSION").read_text().strip() != version:
+        raise ValueError("Package VERSION differs from package.json")
+    bundles = root / "npm-bundles"
+    checksums = {}
+    for line in (bundles / "SHA256SUMS").read_text().splitlines():
+        if not line.strip():
+            continue
+        match = re.fullmatch(r"([a-fA-F0-9]{64})\s+\*?([^/\\\s]+)", line.strip())
+        if not match or match[2] not in ARTIFACTS or match[2] in checksums:
+            raise ValueError("Invalid or duplicate entry in npm-bundles/SHA256SUMS")
+        checksums[match[2]] = match[1].lower()
+    commits = set()
+    for filename in ARTIFACTS:
+        archive = bundles / filename
+        actual = hashlib.sha256(archive.read_bytes()).hexdigest()
+        if checksums.get(filename) != actual:
+            raise ValueError(f"Checksum mismatch or missing checksum for {filename}")
+        metadata = inspect_archive(archive, version)
+        if not metadata.get("commit"):
+            raise ValueError(f"Missing build commit for {filename}")
+        commits.add(metadata["commit"])
+    if len(commits) != 1:
+        raise ValueError("Bundled platform releases were built from different commits")
+
+
+def main() -> None:
+    mode, *args = sys.argv[1:]
+    if mode == "validate-all" and len(args) == 1:
+        validate_all(Path(args[0]))
+    elif mode == "validate" and len(args) == 2:
+        inspect_archive(Path(args[0]), args[1])
+    elif mode == "extract" and len(args) == 3:
+        inspect_archive(Path(args[0]), args[1], Path(args[2]))
+    else:
+        raise ValueError("Usage: pb-npm-payload.py validate ARCHIVE VERSION | extract ARCHIVE VERSION DESTINATION | validate-all PACKAGE_ROOT")
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except (OSError, ValueError, tarfile.TarError) as error:
+        print(f"PB payload validation failed: {error}", file=sys.stderr)
+        raise SystemExit(1)

package/bin/pb-npm-runner.js

@@ -0,0 +1,49 @@
+"use strict";
+
+const childProcess = require("child_process");
+const { executablePath, install } = require("./pb-npm-install");
+const path = require("path");
+
+const packageRoot = path.resolve(__dirname, "..");
+const manifest = require(path.join(packageRoot, "package.json"));
+
+function npmManagedEnvironment(baseEnv = process.env) {
+  return {
+    ...baseEnv,
+    PB_INSTALL_KIND: "npm",
+    PB_NPM_PACKAGE_NAME: manifest.name,
+    PB_NPM_PACKAGE_ROOT: packageRoot,
+    PB_NPM_PACKAGE_VERSION: manifest.version,
+  };
+}
+
+async function run(command) {
+  try {
+    await install();
+  } catch (error) {
+    console.error(`ProofBridge could not prepare its runtime: ${error.message || error}`);
+    process.exitCode = 1;
+    return;
+  }
+  const target = executablePath(command);
+  const child = childProcess.spawn(target, process.argv.slice(2), {
+    stdio: "inherit",
+    env: npmManagedEnvironment(),
+  });
+  child.on("error", (error) => {
+    console.error(error.message || error);
+    process.exit(1);
+  });
+  child.on("exit", (code, signal) => {
+    if (signal) {
+      process.kill(process.pid, signal);
+      return;
+    }
+    process.exit(code === null ? 1 : code);
+  });
+}
+
+module.exports = {
+  npmManagedEnvironment,
+  run,
+};

package/bin/pb.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+"use strict";
+
+require("./pb-npm-runner").run("pb");

package/npm-bundles/SHA256SUMS

@@ -0,0 +1,2 @@
+2466349184a9ab4fa224dbeaba652c21c080ac8415cc74473b3d80ebdc2f16a6  pb-linux-x86_64.tar.gz
+358f39c6d81d54342f07d34e08358125d7c1ef7c237792586e76d3e8654bc95c  pb-macos-universal.tar.gz

package/package.json

@@ -0,0 +1,77 @@
+{
+  "name": "proofbridge-cli",
+  "version": "1.0.2",
+  "description": "ProofBridge: a multi-agent CLI workspace and cross-provider collaboration layer.",
+  "license": "AGPL-3.0-only",
+  "homepage": "https://github.com/Atingaii/proofBridgeCli#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Atingaii/proofBridgeCli.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Atingaii/proofBridgeCli/issues"
+  },
+  "keywords": [
+    "pb",
+    "multi-agent",
+    "codex",
+    "claude",
+    "gemini",
+    "grok",
+    "kimi",
+    "deepseek",
+    "mimo",
+    "qwen",
+    "cursor",
+    "copilot",
+    "crush",
+    "kiro",
+    "pi",
+    "zai",
+    "opencode",
+    "tmux",
+    "cli"
+  ],
+  "bin": {
+    "pb": "bin/pb.js",
+    "ask": "bin/ask.js",
+    "autonew": "bin/autonew.js",
+    "ctx-transfer": "bin/ctx-transfer.js"
+  },
+  "files": [
+    "bin/pb.js",
+    "bin/ask.js",
+    "bin/autonew.js",
+    "bin/ctx-transfer.js",
+    "bin/pb-npm-install.js",
+    "bin/pb-npm-runner.js",
+    "README.md",
+    "LICENSE",
+    "UPSTREAM.md",
+    "VERSION",
+    "assets/brand/",
+    "bin/pb-npm-payload.py",
+    "npm-bundles/pb-macos-universal.tar.gz",
+    "npm-bundles/pb-linux-x86_64.tar.gz",
+    "npm-bundles/SHA256SUMS"
+  ],
+  "scripts": {
+    "postinstall": "node bin/pb-npm-install.js",
+    "pack:check": "npm pack --dry-run",
+    "prepack": "node bin/pb-npm-install.js --check-payload"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "os": [
+    "linux",
+    "darwin"
+  ],
+  "cpu": [
+    "x64",
+    "arm64"
+  ],
+  "publishConfig": {
+    "access": "public"
+  }
+}