repopilot 0.6.0

package/LICENSE

@@ -0,0 +1,186 @@
+RepoPilot is licensed under either of:
+
+- MIT License
+- Apache License, Version 2.0
+
+at your option.
+
+MIT License
+
+Copyright (c) 2026 RepoPilot contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+Apache License
+Version 2.0, January 2004
+http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction, and
+distribution as defined by Sections 1 through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by the copyright
+owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all other entities
+that control, are controlled by, or are under common control with that entity.
+For the purposes of this definition, "control" means (i) the power, direct or
+indirect, to cause the direction or management of such entity, whether by
+contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the
+outstanding shares, or (iii) beneficial ownership of such entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity exercising
+permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications, including
+but not limited to software source code, documentation source, and configuration
+files.
+
+"Object" form shall mean any form resulting from mechanical transformation or
+translation of a Source form, including but not limited to compiled object code,
+generated documentation, and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or Object form,
+made available under the License, as indicated by a copyright notice that is
+included in or attached to the work.
+
+"Derivative Works" shall mean any work, whether in Source or Object form, that
+is based on (or derived from) the Work and for which the editorial revisions,
+annotations, elaborations, or other modifications represent, as a whole, an
+original work of authorship. For the purposes of this License, Derivative Works
+shall not include works that remain separable from, or merely link (or bind by
+name) to the interfaces of, the Work and Derivative Works thereof.
+
+"Contribution" shall mean any work of authorship, including the original
+version of the Work and any modifications or additions to that Work or
+Derivative Works thereof, that is intentionally submitted to Licensor for
+inclusion in the Work by the copyright owner or by an individual or Legal Entity
+authorized to submit on behalf of the copyright owner. For the purposes of this
+definition, "submitted" means any form of electronic, verbal, or written
+communication sent to the Licensor or its representatives, including but not
+limited to communication on electronic mailing lists, source code control
+systems, and issue tracking systems that are managed by, or on behalf of, the
+Licensor for the purpose of discussing and improving the Work, but excluding
+communication that is conspicuously marked or otherwise designated in writing by
+the copyright owner as "Not a Contribution."
+
+"Contributor" shall mean Licensor and any individual or Legal Entity on behalf
+of whom a Contribution has been received by Licensor and subsequently
+incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of this
+License, each Contributor hereby grants to You a perpetual, worldwide,
+non-exclusive, no-charge, royalty-free, irrevocable copyright license to
+reproduce, prepare Derivative Works of, publicly display, publicly perform,
+sublicense, and distribute the Work and such Derivative Works in Source or
+Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of this License,
+each Contributor hereby grants to You a perpetual, worldwide, non-exclusive,
+no-charge, royalty-free, irrevocable patent license to make, have made, use,
+offer to sell, sell, import, and otherwise transfer the Work, where such license
+applies only to those patent claims licensable by such Contributor that are
+necessarily infringed by their Contribution alone or by combination of their
+Contribution with the Work to which such Contribution was submitted. If You
+institute patent litigation against any entity alleging that the Work or a
+Contribution incorporated within the Work constitutes direct or contributory
+patent infringement, then any patent licenses granted to You under this License
+for that Work shall terminate as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the Work or
+Derivative Works thereof in any medium, with or without modifications, and in
+Source or Object form, provided that You meet the following conditions:
+
+(a) You must give any other recipients of the Work or Derivative Works a copy of
+this License; and
+
+(b) You must cause any modified files to carry prominent notices stating that
+You changed the files; and
+
+(c) You must retain, in the Source form of any Derivative Works that You
+distribute, all copyright, patent, trademark, and attribution notices from the
+Source form of the Work, excluding those notices that do not pertain to any part
+of the Derivative Works; and
+
+(d) If the Work includes a "NOTICE" text file as part of its distribution, then
+any Derivative Works that You distribute must include a readable copy of the
+attribution notices contained within such NOTICE file, excluding those notices
+that do not pertain to any part of the Derivative Works, in at least one of the
+following places: within a NOTICE text file distributed as part of the
+Derivative Works; within the Source form or documentation, if provided along
+with the Derivative Works; or, within a display generated by the Derivative
+Works, if and wherever such third-party notices normally appear. The contents of
+the NOTICE file are for informational purposes only and do not modify the
+License. You may add Your own attribution notices within Derivative Works that
+You distribute, alongside or as an addendum to the NOTICE text from the Work,
+provided that such additional attribution notices cannot be construed as
+modifying the License.
+
+You may add Your own copyright statement to Your modifications and may provide
+additional or different license terms and conditions for use, reproduction, or
+distribution of Your modifications, or for any such Derivative Works as a whole,
+provided Your use, reproduction, and distribution of the Work otherwise complies
+with the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise, any
+Contribution intentionally submitted for inclusion in the Work by You to the
+Licensor shall be under the terms and conditions of this License, without any
+additional terms or conditions. Notwithstanding the above, nothing herein shall
+supersede or modify the terms of any separate license agreement you may have
+executed with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade names,
+trademarks, service marks, or product names of the Licensor, except as required
+for reasonable and customary use in describing the origin of the Work and
+reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or agreed to in
+writing, Licensor provides the Work on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+CONDITIONS OF ANY KIND, either express or implied, including, without
+limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT,
+MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely
+responsible for determining the appropriateness of using or redistributing the
+Work and assume any risks associated with Your exercise of permissions under
+this License.
+
+8. Limitation of Liability. In no event and under no legal theory, whether in
+tort (including negligence), contract, or otherwise, unless required by
+applicable law (such as deliberate and grossly negligent acts) or agreed to in
+writing, shall any Contributor be liable to You for damages, including any
+direct, indirect, special, incidental, or consequential damages of any character
+arising as a result of this License or out of the use or inability to use the
+Work (including but not limited to damages for loss of goodwill, work stoppage,
+computer failure or malfunction, or any and all other commercial damages or
+losses), even if such Contributor has been advised of the possibility of such
+damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing the Work or
+Derivative Works thereof, You may choose to offer, and charge a fee for,
+acceptance of support, warranty, indemnity, or other liability obligations
+and/or rights consistent with this License. However, in accepting such
+obligations, You may act only on Your own behalf and on Your sole
+responsibility, not on behalf of any other Contributor, and only if You agree to
+indemnify, defend, and hold each Contributor harmless for any liability incurred
+by, or claims asserted against, such Contributor by reason of your accepting any
+such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS

package/README.md

@@ -0,0 +1,314 @@
+# RepoPilot
+
+[![Crates.io](https://img.shields.io/crates/v/repopilot.svg)](https://crates.io/crates/repopilot)
+[![npm](https://img.shields.io/npm/v/repopilot.svg)](https://www.npmjs.com/package/repopilot)
+[![Docs.rs](https://docs.rs/repopilot/badge.svg)](https://docs.rs/repopilot)
+[![CI](https://github.com/MykytaStel/repopilot/actions/workflows/ci.yaml/badge.svg)](https://github.com/MykytaStel/repopilot/actions)
+[![GitHub Release](https://img.shields.io/github/v/release/MykytaStel/repopilot)](https://github.com/MykytaStel/repopilot/releases)
+[![License](https://img.shields.io/crates/l/repopilot.svg)](LICENSE)
+
+Local-first CLI for repository audit, architecture risk detection, baseline tracking, and CI-friendly code review.
+
+RepoPilot runs on your machine and does not upload your repository. It helps developers understand what changed, what became riskier, and where to review first.
+
+## Why RepoPilot?
+
+Modern developers ship more code than they can carefully review, especially with AI-assisted workflows.
+
+RepoPilot helps you understand:
+
+- what changed;
+- what became riskier;
+- which findings are new;
+- which findings already existed;
+- where to review first.
+
+RepoPilot runs locally and does not upload your repository.
+
+## Features
+
+- Repository scanning for projects, folders, and individual files
+- Gitignore-aware walking with built-in ignores for common build and service directories
+- Architecture findings: oversized files, deep nesting, too many modules per directory
+- Coupling analysis: excessive fan-out, high-instability hubs, circular dependencies
+- Code quality findings: cyclomatic complexity density, long functions, TODO/FIXME/HACK markers
+- Security findings: hardcoded secret candidates, committed private keys, committed `.env` files
+- Testing findings: missing test folder, source files without test counterparts
+- Framework findings for JavaScript, React, React Native, and Expo projects
+- React Native architecture profile: project kind, New Architecture, Hermes, Codegen, platform mismatch, and package manager signals
+- Workspace framework detection through `package.json` workspaces
+- Evidence-backed findings with stable rule IDs, severity, file paths, line numbers, and snippets
+- `repopilot.toml` configuration generated by `repopilot init`
+- Baseline workflow for accepting existing findings in legacy repositories
+- CI-friendly failure thresholds with `--fail-on`
+- Git diff-aware review mode for prioritizing findings introduced by changed lines
+- Console, JSON, Markdown, HTML, and SARIF scan output
+- Compare mode for diffing two JSON scan reports
+
+See [docs/rulesets.md](docs/rulesets.md) for the implemented rules and severity levels.
+
+## Installation
+
+```bash
+cargo install repopilot
+```
+
+Install with npm:
+
+```bash
+npm install -g repopilot
+```
+
+Upgrade:
+
+```bash
+cargo install repopilot --force
+npm update -g repopilot
+```
+
+Build from source:
+
+```bash
+git clone https://github.com/MykytaStel/repopilot.git
+cd repopilot
+cargo build --release
+```
+
+## Quick Start
+
+```bash
+repopilot init
+repopilot scan .
+```
+
+React Native quick scan:
+
+```bash
+repopilot scan . --format markdown --output repopilot-report.md
+repopilot review . --base origin/main --baseline .repopilot/baseline.json --fail-on new-high
+```
+
+## Commands
+
+| Command | Alias | Description |
+|---------|-------|-------------|
+| `repopilot scan <path>` | `s` | Scan a project, folder, or file for findings |
+| `repopilot review [path]` | `r` | Review findings that touch changed Git diff lines |
+| `repopilot compare <before> <after>` | `cmp` | Compare two JSON scan reports and show what changed |
+| `repopilot baseline create <path>` | `bl` | Scan a path and store current findings as accepted debt |
+| `repopilot init` | — | Generate a default `repopilot.toml` configuration file |
+
+Use `--help` on any command for the full description and examples:
+
+```bash
+repopilot --help
+repopilot scan --help
+repopilot review --help
+repopilot baseline create --help
+```
+
+## Configuration
+
+RepoPilot automatically reads `repopilot.toml` from the current working directory when running `scan`.
+
+Configuration precedence:
+
+```text
+CLI args > repopilot.toml > built-in defaults
+```
+
+Generate a default config:
+
+```bash
+repopilot init
+repopilot init --force
+repopilot init --path ./repopilot.toml
+```
+
+Use an explicit config path:
+
+```bash
+repopilot scan . --config repopilot.toml
+```
+
+Example `repopilot.toml`:
+
+```toml
+[scan]
+ignore = [
+  ".git",
+  ".github",
+  ".repopilot",
+  "target",
+  "node_modules",
+  "dist",
+  "build",
+  ".next",
+  "coverage"
+]
+max_file_bytes = 2097152
+
+[architecture]
+max_file_lines = 300
+huge_file_lines = 1000
+max_directory_modules = 20
+max_directory_depth = 5
+max_function_lines = 50
+max_fan_out = 15
+instability_hub_min_fan_in = 5
+instability_hub_min_instability_pct = 75
+
+[testing]
+detect_missing_tests = true
+
+[security]
+detect_secret_like_names = true
+
+[output]
+default_format = "console"
+```
+
+CLI threshold overrides:
+
+```bash
+repopilot scan . --max-file-loc 500
+repopilot scan . --max-directory-modules 25
+repopilot scan . --max-directory-depth 6
+```
+
+## Baseline Workflow
+
+Existing repositories often have findings that cannot all be fixed before adopting a new audit tool. A baseline stores accepted existing findings so future scans can distinguish new findings from existing ones.
+
+```bash
+repopilot baseline create .
+repopilot scan . --baseline .repopilot/baseline.json
+repopilot scan . --baseline .repopilot/baseline.json --fail-on new-high
+```
+
+By default, `baseline create` writes `.repopilot/baseline.json` and creates the `.repopilot/` directory if needed. Use `--output ./baseline.json` for a custom path. Existing baseline files are not overwritten unless you pass `--force`.
+
+Baseline files store accepted existing findings. Future scans can mark findings as `new` or `existing`, which is useful for legacy repositories and CI. Do not refresh a baseline blindly unless the team accepts those findings as technical debt.
+
+## Review Workflow
+
+Use `review` when you want RepoPilot to focus on findings that touch changed Git diff lines.
+
+```bash
+repopilot review .
+repopilot review . --format json --output review.json
+repopilot review . --baseline .repopilot/baseline.json --fail-on new-high
+```
+
+By default, `review` compares the working tree against `HEAD`, including staged, unstaged, and untracked files. For branch or CI review, pass a base ref:
+
+```bash
+repopilot review . --base origin/main
+repopilot review . --base origin/main --head HEAD --format markdown
+```
+
+Review mode still scans the repository with the normal rules, but separates findings into in-diff and out-of-diff groups. When import coupling data is available, it also shows blast radius: files that import changed files and may need extra review. When `--fail-on` is used, the CI gate evaluates only in-diff findings.
+
+## Output Formats
+
+```bash
+repopilot scan . --format console
+repopilot scan . --format json --output report.json
+repopilot scan . --format markdown --output report.md
+repopilot scan . --format html --output report.html
+repopilot scan . --format sarif --output repopilot.sarif
+```
+
+### SARIF output
+
+```bash
+repopilot scan . --format sarif --output repopilot.sarif
+```
+
+If your installed RepoPilot version does not support `--output`, redirect stdout instead:
+
+```bash
+repopilot scan . --format sarif > repopilot.sarif
+```
+
+Use JSON when custom scripts need to parse RepoPilot results. Use Markdown for human-readable reports. Use SARIF for CI and code scanning integrations, including GitHub Code Scanning.
+
+See [docs/integrations/github-code-scanning.md](docs/integrations/github-code-scanning.md) for a copy-paste GitHub Actions workflow, required permissions, and local validation commands.
+
+Compare two JSON reports:
+
+```bash
+repopilot scan . --format json --output before.json
+repopilot scan . --format json --output after.json
+repopilot compare before.json after.json
+repopilot compare before.json after.json --format markdown
+repopilot compare before.json after.json --format json --output diff.json
+```
+
+## CI Usage
+
+Use `--fail-on new-high` to fail CI only when new high or critical findings are introduced. Supported new-finding thresholds are `new-low`, `new-medium`, `new-high`, and `new-critical`.
+
+When `--fail-on new-*` is used without `--baseline`, RepoPilot treats all current findings as new. For baseline-based adoption, commit an accepted baseline and scan against it in CI.
+
+To upload RepoPilot findings to GitHub Code Scanning, generate SARIF and use `github/codeql-action/upload-sarif`. The workflow must include `security-events: write`.
+
+```yaml
+name: RepoPilot
+
+on:
+  pull_request:
+
+jobs:
+  repopilot:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install RepoPilot
+        run: cargo install repopilot
+
+      - name: Run RepoPilot
+        run: repopilot scan . --baseline .repopilot/baseline.json --fail-on new-high
+
+      - name: Run RepoPilot (SARIF)
+        run: repopilot scan . --format sarif --output repopilot.sarif
+
+      - name: Upload to GitHub Code Scanning
+        uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: repopilot.sarif
+```
+
+## Roadmap
+
+These are planned ideas, not current features:
+
+- Change Risk Map
+- AI-ready review context export
+- Better architecture drift detection
+- First-party GitHub Action integration
+- Deeper React Native dependency health analysis
+
+## Documentation
+
+| Document | Description |
+|---|---|
+| [docs/cli.md](docs/cli.md) | Complete CLI reference — all commands, flags, and exit codes |
+| [docs/commands.md](docs/commands.md) | Task-oriented command guide and common patterns |
+| [docs/rulesets.md](docs/rulesets.md) | Implemented audit rules, categories, and severity levels |
+| [docs/react-native.md](docs/react-native.md) | React Native and Expo detection, findings, and limitations |
+| [docs/integrations/github-code-scanning.md](docs/integrations/github-code-scanning.md) | GitHub Code Scanning SARIF workflow |
+| [docs/release.md](docs/release.md) | Manual release process |
+| [docs/distribution.md](docs/distribution.md) | Distribution channels |
+| [docs/github-ruleset.md](docs/github-ruleset.md) | GitHub branch ruleset configuration |
+| [CHANGELOG.md](CHANGELOG.md) | Version history |
+
+## License
+
+RepoPilot is licensed under MIT OR Apache-2.0.

package/bin/repopilot.js

@@ -0,0 +1,61 @@
+#!/usr/bin/env node
+
+const fs = require("node:fs");
+const path = require("node:path");
+const { spawn } = require("node:child_process");
+
+function binaryName() {
+  return process.platform === "win32" ? "repopilot.exe" : "repopilot";
+}
+
+function bundledBinaryPath() {
+  return path.join(__dirname, "..", "vendor", binaryName());
+}
+
+function resolveBinaryPath() {
+  if (process.env.REPOPILOT_BINARY_PATH) {
+    return process.env.REPOPILOT_BINARY_PATH;
+  }
+  return bundledBinaryPath();
+}
+
+function main() {
+  const binary = resolveBinaryPath();
+  if (!fs.existsSync(binary)) {
+    console.error(
+      [
+        "RepoPilot binary was not found.",
+        `Expected: ${binary}`,
+        "Run npm install again, install with cargo, or set REPOPILOT_BINARY_PATH to an existing repopilot binary.",
+      ].join("\n")
+    );
+    process.exit(1);
+  }
+
+  const child = spawn(binary, process.argv.slice(2), {
+    stdio: "inherit",
+    windowsHide: false,
+  });
+
+  child.on("error", (error) => {
+    console.error(`Failed to launch RepoPilot: ${error.message}`);
+    process.exit(1);
+  });
+  child.on("exit", (code, signal) => {
+    if (signal) {
+      process.kill(process.pid, signal);
+      return;
+    }
+    process.exit(code ?? 1);
+  });
+}
+
+if (require.main === module) {
+  main();
+}
+
+module.exports = {
+  binaryName,
+  bundledBinaryPath,
+  resolveBinaryPath,
+};

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "repopilot",
+  "version": "0.6.0",
+  "description": "Local-first CLI for repository audit, architecture risk detection, baseline tracking, and CI-friendly code review.",
+  "license": "MIT OR Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/MykytaStel/repopilot.git"
+  },
+  "homepage": "https://github.com/MykytaStel/repopilot#readme",
+  "bugs": {
+    "url": "https://github.com/MykytaStel/repopilot/issues"
+  },
+  "bin": {
+    "repopilot": "bin/repopilot.js"
+  },
+  "scripts": {
+    "postinstall": "node scripts/install.js",
+    "test:npm": "node --test tests/npm_wrapper.test.js"
+  },
+  "files": [
+    "bin",
+    "scripts",
+    "README.md",
+    "LICENSE"
+  ],
+  "keywords": [
+    "cli",
+    "audit",
+    "code-review",
+    "static-analysis",
+    "architecture",
+    "react-native"
+  ],
+  "engines": {
+    "node": ">=18"
+  }
+}

package/scripts/install.js

@@ -0,0 +1,141 @@
+#!/usr/bin/env node
+
+const crypto = require("node:crypto");
+const fs = require("node:fs");
+const https = require("node:https");
+const os = require("node:os");
+const path = require("node:path");
+const { spawnSync } = require("node:child_process");
+
+const ROOT = path.join(__dirname, "..");
+const VENDOR_DIR = path.join(ROOT, "vendor");
+const PACKAGE_JSON = require(path.join(ROOT, "package.json"));
+
+function targetTriple(platform = process.platform, arch = process.arch) {
+  if (platform === "darwin" && arch === "x64") return "x86_64-apple-darwin";
+  if (platform === "darwin" && arch === "arm64") return "aarch64-apple-darwin";
+  if (platform === "linux" && arch === "x64") return "x86_64-unknown-linux-gnu";
+  if (platform === "linux" && arch === "arm64") return "aarch64-unknown-linux-gnu";
+  if (platform === "win32" && arch === "x64") return "x86_64-pc-windows-msvc";
+  throw new Error(`Unsupported platform: ${platform}/${arch}`);
+}
+
+function archiveExt(target) {
+  return target.endsWith("windows-msvc") ? "zip" : "tar.gz";
+}
+
+function assetName(version, target) {
+  return `repopilot-v${version}-${target}.${archiveExt(target)}`;
+}
+
+function releaseUrl(version, file) {
+  return `https://github.com/MykytaStel/repopilot/releases/download/v${version}/${file}`;
+}
+
+function download(url, destination) {
+  return new Promise((resolve, reject) => {
+    const file = fs.createWriteStream(destination);
+    https
+      .get(url, (response) => {
+        if (response.statusCode >= 300 && response.statusCode < 400 && response.headers.location) {
+          file.close();
+          fs.rmSync(destination, { force: true });
+          download(response.headers.location, destination).then(resolve, reject);
+          return;
+        }
+        if (response.statusCode !== 200) {
+          file.close();
+          fs.rmSync(destination, { force: true });
+          reject(new Error(`Download failed (${response.statusCode}): ${url}`));
+          return;
+        }
+        response.pipe(file);
+        file.on("finish", () => file.close(resolve));
+      })
+      .on("error", (error) => {
+        file.close();
+        fs.rmSync(destination, { force: true });
+        reject(error);
+      });
+  });
+}
+
+function sha256(file) {
+  const hash = crypto.createHash("sha256");
+  hash.update(fs.readFileSync(file));
+  return hash.digest("hex");
+}
+
+function expectedChecksum(checksumText) {
+  const first = checksumText.trim().split(/\s+/)[0];
+  if (!/^[a-fA-F0-9]{64}$/.test(first)) {
+    throw new Error("Invalid checksum file format");
+  }
+  return first.toLowerCase();
+}
+
+function verifyChecksum(archivePath, checksumText) {
+  const expected = expectedChecksum(checksumText);
+  const actual = sha256(archivePath);
+  if (actual !== expected) {
+    throw new Error(`Checksum mismatch for ${path.basename(archivePath)}: expected ${expected}, got ${actual}`);
+  }
+}
+
+function extractArchive(archivePath, destination, target) {
+  fs.rmSync(destination, { recursive: true, force: true });
+  fs.mkdirSync(destination, { recursive: true });
+
+  const result = target.endsWith("windows-msvc")
+    ? spawnSync("powershell", ["-NoProfile", "-Command", `Expand-Archive -Force '${archivePath}' '${destination}'`], { stdio: "inherit" })
+    : spawnSync("tar", ["-xzf", archivePath, "-C", destination], { stdio: "inherit" });
+
+  if (result.status !== 0) {
+    throw new Error(`Failed to extract ${archivePath}`);
+  }
+}
+
+async function install() {
+  if (process.env.REPOPILOT_SKIP_DOWNLOAD === "1" || process.env.REPOPILOT_SKIP_DOWNLOAD === "true") {
+    console.log("Skipping RepoPilot binary download because REPOPILOT_SKIP_DOWNLOAD is set.");
+    return;
+  }
+
+  const target = targetTriple();
+  const version = PACKAGE_JSON.version;
+  const archive = assetName(version, target);
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "repopilot-"));
+  const archivePath = path.join(tmp, archive);
+  const checksumPath = `${archivePath}.sha256`;
+  const extractDir = path.join(tmp, "extract");
+  const binaryName = target.endsWith("windows-msvc") ? "repopilot.exe" : "repopilot";
+
+  try {
+    await download(releaseUrl(version, archive), archivePath);
+    await download(releaseUrl(version, `${archive}.sha256`), checksumPath);
+    verifyChecksum(archivePath, fs.readFileSync(checksumPath, "utf8"));
+    extractArchive(archivePath, extractDir, target);
+
+    fs.mkdirSync(VENDOR_DIR, { recursive: true });
+    fs.copyFileSync(path.join(extractDir, binaryName), path.join(VENDOR_DIR, binaryName));
+    fs.chmodSync(path.join(VENDOR_DIR, binaryName), 0o755);
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+}
+
+if (require.main === module) {
+  install().catch((error) => {
+    console.error(`Failed to install RepoPilot binary: ${error.message}`);
+    console.error("Set REPOPILOT_SKIP_DOWNLOAD=1 to skip download or REPOPILOT_BINARY_PATH to use an existing binary.");
+    process.exit(1);
+  });
+}
+
+module.exports = {
+  archiveExt,
+  assetName,
+  expectedChecksum,
+  targetTriple,
+  verifyChecksum,
+};