tribunal-kit 4.5.0 → 4.5.1

package/README.md

@@ -10,7 +10,7 @@
 
   [![NPM](https://img.shields.io/npm/v/tribunal-kit?style=for-the-badge&logo=npm&logoColor=white)](https://www.npmjs.com/package/tribunal-kit)
   [![License](https://img.shields.io/badge/License-MIT-8b5cf6?style=for-the-badge)](LICENSE)
-  [![Version](https://img.shields.io/badge/Version-4.5.0_Ultimate-black?style=for-the-badge)](CHANGELOG.md)
+  [![Version](https://img.shields.io/badge/Version-4.5.1_Ultimate-black?style=for-the-badge)](CHANGELOG.md)
   [![MCP](https://img.shields.io/badge/MCP-Ready-00e5ff?style=for-the-badge)](mcp_config.json)
 </div>
 

package/bin/mcp-server.js

@@ -0,0 +1,159 @@
+#!/usr/bin/env node
+
+/**
+ * Tribunal-Kit MCP Server
+ * 
+ * This file exposes tribunal-kit tools via the Model Context Protocol (MCP)
+ * over standard I/O, allowing AI clients (Cursor, Windsurf, Claude) to natively 
+ * invoke tribunal checks.
+ * 
+ * Protocol: MCP 2024-11-05 over JSON-RPC 2.0 / stdio
+ */
+
+const { spawnSync } = require('child_process');
+const path = require('path');
+
+const CLI = path.resolve(__dirname, './tribunal-kit.js');
+const PKG = require(path.resolve(__dirname, '../package.json'));
+
+// Timeout for spawned processes (30 seconds)
+const SPAWN_TIMEOUT_MS = 30000;
+
+// Minimal JSON-RPC 2.0 over stdio
+const readline = require('readline');
+
+const rl = readline.createInterface({
+    input: process.stdin,
+    output: process.stdout,
+    terminal: false
+});
+
+/**
+ * Run a CLI command with timeout protection.
+ * Returns { stdout, stderr, status }.
+ */
+function runCommand(args) {
+    return spawnSync(process.execPath, [CLI, ...args], {
+        encoding: 'utf8',
+        timeout: SPAWN_TIMEOUT_MS,
+    });
+}
+
+function handleRequest(req) {
+    // MCP spec: method names follow path-style convention
+    if (req.method === 'initialize') {
+        return {
+            protocolVersion: "2024-11-05",
+            capabilities: {
+                tools: {}
+            },
+            serverInfo: {
+                name: "tribunal-kit-mcp",
+                version: PKG.version
+            }
+        };
+    }
+    
+    if (req.method === 'tools/list') {
+        return {
+            tools: [
+                {
+                    name: "run_tribunal_audit",
+                    description: "Runs a full anti-hallucination audit across the workspace.",
+                    inputSchema: { type: "object", properties: {}, additionalProperties: false }
+                },
+                {
+                    name: "sync_ide_bridges",
+                    description: "Synchronize IDE bridge files with the current GEMINI.md rules.",
+                    inputSchema: { type: "object", properties: {}, additionalProperties: false }
+                },
+                {
+                    name: "search_case_law",
+                    description: "Search historical code rejections and legal precedent. Use this before writing code to avoid past mistakes.",
+                    inputSchema: {
+                        type: "object",
+                        properties: {
+                            query: { type: "string", description: "Search query (e.g. 'useEffect state')" }
+                        },
+                        required: ["query"],
+                        additionalProperties: false
+                    }
+                }
+            ]
+        };
+    }
+
+    if (req.method === 'tools/call') {
+        const toolName = req.params && req.params.name;
+        if (!toolName) {
+            throw { code: -32602, message: "Missing required parameter: params.name" };
+        }
+        
+        if (toolName === 'run_tribunal_audit') {
+            const result = runCommand(['validate']);
+            return { content: [{ type: "text", text: result.stdout || result.stderr || "No output" }] };
+        }
+        
+        if (toolName === 'sync_ide_bridges') {
+            const result = runCommand(['sync']);
+            return { content: [{ type: "text", text: result.stdout || result.stderr || "No output" }] };
+        }
+        
+        if (toolName === 'search_case_law') {
+            const query = req.params && req.params.arguments && req.params.arguments.query;
+            if (!query || typeof query !== 'string') {
+                throw { code: -32602, message: "Missing or invalid required argument: query (string)" };
+            }
+            const script = path.resolve(__dirname, '../.agent/scripts/case_law_manager.js');
+            // Arguments passed as array — no shell interpolation
+            const result = spawnSync(process.execPath, [script, 'search-cases', '--query', query], {
+                encoding: 'utf8',
+                timeout: SPAWN_TIMEOUT_MS,
+            });
+            return { content: [{ type: "text", text: result.stdout || result.stderr || "No results" }] };
+        }
+        
+        throw { code: -32601, message: `Unknown tool: ${toolName}` };
+    }
+
+    throw { code: -32601, message: `Unknown method: ${req.method}` };
+}
+
+rl.on('line', (line) => {
+    if (!line.trim()) return;
+    
+    let req;
+    try {
+        req = JSON.parse(line);
+    } catch (parseErr) {
+        // Invalid JSON — send a parse error
+        const errorRes = {
+            jsonrpc: "2.0",
+            id: null,
+            error: { code: -32700, message: "Parse error: " + parseErr.message }
+        };
+        console.log(JSON.stringify(errorRes));
+        return;
+    }
+    
+    try {
+        const result = handleRequest(req);
+        const res = { jsonrpc: "2.0", id: req.id, result };
+        console.log(JSON.stringify(res));
+        
+        // After initialize, send the initialized notification per MCP spec
+        if (req.method === 'initialize') {
+            console.log(JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized", params: {} }));
+        }
+    } catch (e) {
+        // Send proper JSON-RPC error response
+        const code = (e && typeof e.code === 'number') ? e.code : -32603;
+        const message = (e && e.message) ? e.message : "Internal server error";
+        const errorRes = {
+            jsonrpc: "2.0",
+            id: req.id || null,
+            error: { code, message }
+        };
+        console.log(JSON.stringify(errorRes));
+    }
+});

package/bin/tribunal-kit.js

@@ -38,6 +38,24 @@ function runShellAsync(command, options) {
     });
 }
 
+/**
+ * Safely run a Node.js script with arguments as an array.
+ * No shell interpolation — immune to injection.
+ */
+function runScriptAsync(scriptPath, args = [], options = {}) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(process.execPath, [scriptPath, ...args], {
+            stdio: 'inherit',
+            ...options,
+        });
+        child.on('close', code => {
+            if (code !== 0) reject(new Error(`Script failed with exit code ${code}`));
+            else resolve();
+        });
+        child.on('error', reject);
+    });
+}
+
 const PKG = require(path.resolve(__dirname, '..', 'package.json'));
 const CURRENT_VERSION = PKG.version;
 
@@ -245,6 +263,7 @@ async function autoUpdateCheck(originalArgs) {
         return false;
     }
 
+    log('  Checking for updates...');
     const latestVersion = await fetchLatestVersion();
 
     if (!latestVersion) {
@@ -385,15 +404,13 @@ async function cmdInit(flags) {
         const backupDir = path.join(agentDest, '.backups', `backup-${Date.now()}`);
         fs.mkdirSync(backupDir, { recursive: true });
 
-        // PRESERVE_DIRS: user-generated content that must survive updates
-        const _PRESERVE_DIRS = ['history', 'patterns', 'mcp_config.json'];
         const subdirs = ['agents', 'workflows', 'skills', 'scripts', '.shared', 'rules'];
         for (const sub of subdirs) {
             const subPath = path.join(agentDest, sub);
             if (fs.existsSync(subPath)) {
                 // Copy to backup dir
                 await copyDir(subPath, path.join(backupDir, sub), false);
-                await fs.promises.rm(subPath, { recursive: true, force: true });
+                // Removed aggressive deletion so user custom files persist
             }
         }
         log(`  ${c('gray', '✦ Backed up existing configurations to .agent/.backups/')}`);
@@ -509,6 +526,8 @@ async function cmdInit(flags) {
             console.log(plainRow('', () => ''));
             console.log(`  ${c('cyan', '╚' + '═'.repeat(W) + '╝')}`);
             console.log();
+            log(`  ${c('gray', '✦ Updating .gitignore...')}`);
+            await updateGitignore(targetDir, dryRun);
             log(`  ${c('gray', '✦ Generating IDE bridge files...')}`);
             await generateIDEBridges(targetDir, agentDest, dryRun);
         }
@@ -520,6 +539,30 @@ async function cmdInit(flags) {
     }
 }
 
+// ── Gitignore Management ──────────────────────────────────
+async function updateGitignore(targetDir, dryRun = false) {
+    if (dryRun) return;
+    const gitignorePath = path.join(targetDir, '.gitignore');
+    const entries = ['.agent/.backups/', '.agent/history/'];
+    let content = '';
+    try {
+        content = await fs.promises.readFile(gitignorePath, 'utf8');
+    } catch (err) {
+        if (err.code !== 'ENOENT') throw err;
+    }
+    let appended = false;
+    for (const entry of entries) {
+        if (!content.includes(entry)) {
+            content += (content.length > 0 && !content.endsWith('\n') ? '\n' : '') + entry + '\n';
+            appended = true;
+        }
+    }
+    if (appended) {
+        await fs.promises.writeFile(gitignorePath, content, 'utf8');
+        dbg('  Updated .gitignore');
+    }
+}
+
 // ── IDE Bridge Files ──────────────────────────────────────
 // Each AI IDE reads rules from a different location.
 // We generate bridge files that point each IDE at .agent/
@@ -532,17 +575,46 @@ async function generateIDEBridges(targetDir, agentDest, dryRun = false) {
         // rules file doesn't exist
     }
 
-    // Helper: write a bridge file only if it doesn't already exist
-    const writeBridge = async (filePath, content, label) => {
+    // Helper: write a bridge file or merge it if it exists
+    const writeBridge = async (filePath, content, label, isJson = false) => {
         if (dryRun) {
-            dbg(`  would create: ${filePath}`);
+            dbg(`  would create/update: ${filePath}`);
             return;
         }
         const dir = path.dirname(filePath);
+        await fs.promises.mkdir(dir, { recursive: true });
+
         try {
-            await fs.promises.mkdir(dir, { recursive: true });
-            await fs.promises.stat(filePath);
-            dbg(`  skip (exists): ${path.basename(filePath)}`);
+            const existingContent = await fs.promises.readFile(filePath, 'utf8');
+            if (isJson) {
+                try {
+                    const existingData = JSON.parse(existingContent);
+                    const newData = JSON.parse(content);
+                    
+                    if (!existingData.rules) existingData.rules = [];
+                    const rulePath = newData.rules[0].path;
+                    const ruleExists = existingData.rules.some(r => r.path === rulePath);
+                    if (!ruleExists) {
+                        existingData.rules.push(newData.rules[0]);
+                    }
+
+                    existingData.agents = { ...existingData.agents, ...newData.agents };
+                    existingData.skills = { ...existingData.skills, ...newData.skills };
+                    existingData.workflows = { ...existingData.workflows, ...newData.workflows };
+
+                    await fs.promises.writeFile(filePath, JSON.stringify(existingData, null, 2) + '\n', 'utf8');
+                    ok(`${label} (merged) → ${c('gray', path.relative(targetDir, filePath))}`);
+                } catch (e) {
+                    warn(`Failed to merge ${label}: ${e.message}`);
+                }
+            } else {
+                if (!existingContent.includes('Tribunal Kit') && (!rulesContent || !existingContent.includes(rulesContent.slice(0, 50)))) {
+                    await fs.promises.appendFile(filePath, '\n' + content, 'utf8');
+                    ok(`${label} (appended) → ${c('gray', path.relative(targetDir, filePath))}`);
+                } else {
+                    dbg(`  skip (rules exist): ${path.basename(filePath)}`);
+                }
+            }
         } catch (err) {
             if (err.code === 'ENOENT') {
                 await fs.promises.writeFile(filePath, content, 'utf8');
@@ -579,7 +651,6 @@ ${rulesContent}
 
     // ── 3. Gemini / Antigravity (.gemini/settings.json) ──
     const geminiSettings = JSON.stringify({
-        "$schema": "https://raw.githubusercontent.com/anthropics/anthropic-cookbook/main/.gemini/settings.schema.json",
         "rules": [
             { "path": "../.agent/rules/GEMINI.md", "trigger": "always_on" }
         ],
@@ -590,7 +661,8 @@ ${rulesContent}
     await writeBridge(
         path.join(targetDir, '.gemini', 'settings.json'),
         geminiSettings,
-        'Gemini/Antigravity'
+        'Gemini/Antigravity',
+        true
     );
 
     // ── Also create .gemini/GEMINI.md as a direct rules file ──
@@ -700,8 +772,9 @@ async function cmdLearn(flags) {
     console.log(`  ${c('cyan', '\u255a' + '\u2550'.repeat(W) + '\u255d')}`);
     console.log();
 
-    const dryRun  = flags.dryRun ? '--dry-run' : '';
-    const useHead = flags.head   ? '--head'    : '';
+    const evoArgs = ['digest'];
+    if (flags.dryRun) evoArgs.push('--dry-run');
+    if (flags.head)   evoArgs.push('--head');
 
 
     // Phase 1: Skill Evolution
@@ -711,8 +784,7 @@ async function cmdLearn(flags) {
         warn('skill_evolution.js not found \u2014 run: npx tribunal-kit update');
     } else {
         try {
-            const cmd = `node "${evoScript}" digest ${dryRun} ${useHead}`.trim();
-            await runShellAsync(cmd, { stdio: 'inherit', cwd: targetDir });
+            await runScriptAsync(evoScript, evoArgs, { cwd: targetDir });
         } catch (e) {
             warn(`Skill Evolution error: ${e.message}`);
         }
@@ -807,8 +879,8 @@ async function cmdCase(flags) {
         process.exit(1);
     }
 
-    const args = process.argv.slice(3).join(' ');
-    if (!args || args === 'help' || args === '--help' || args === '-h') {
+    const args = process.argv.slice(3);
+    if (args.length === 0 || args[0] === 'help' || args[0] === '--help' || args[0] === '-h') {
         banner();
         log(`  ${c('cyan', '\u2554' + '\u2550'.repeat(60) + '\u2557')}`);
         log(`  ${c('cyan', '\u2551')}${c('bold', c('white', '  Tribunal Case Law Engine \u2014 Supreme Court             '))}${c('cyan', '\u2551')}`);
@@ -827,13 +899,13 @@ async function cmdCase(flags) {
 
     const caseLawScript = path.join(agentDest, 'scripts', 'case_law_manager.js');
 
-    // Make shorthand aliases
-    let pyArgs = args;
-    if (pyArgs.startsWith('add')) pyArgs = pyArgs.replace(/^add/, 'add-case');
-    if (pyArgs.startsWith('search')) pyArgs = pyArgs.replace(/^search/, 'search-cases');
+    // Make shorthand aliases for the subcommand (first arg only)
+    const caseArgs = [...args];
+    if (caseArgs[0] === 'add') caseArgs[0] = 'add-case';
+    if (caseArgs[0] === 'search') caseArgs[0] = 'search-cases';
 
     try {
-        await runShellAsync(`node "${caseLawScript}" ${pyArgs}`, { stdio: 'inherit', cwd: targetDir });
+        await runScriptAsync(caseLawScript, caseArgs, { cwd: targetDir });
     } catch {
         process.exit(1); // Script already prints errors
     }
@@ -854,12 +926,17 @@ async function cmdGraph(flags) {
     const htmlFile = path.join(agentDest, 'history', 'architecture-explorer.html');
 
     try {
-        await runShellAsync(`node "${builderScript}"`, { stdio: 'inherit', cwd: targetDir });
-        await runShellAsync(`node "${visualizerScript}"`, { stdio: 'inherit', cwd: targetDir });
+        await runScriptAsync(builderScript, [], { cwd: targetDir });
+        await runScriptAsync(visualizerScript, [], { cwd: targetDir });
         
         log(`  ${c('cyan', '▸')} Opening visualizer in browser...`);
-        const opener = process.platform === 'win32' ? 'start' : process.platform === 'darwin' ? 'open' : 'xdg-open';
-        await runShellAsync(`${opener} "${htmlFile}"`, { stdio: 'ignore' });
+        // Open browser safely without shell interpolation
+        const { opener, openerArgs } = (() => {
+            if (process.platform === 'win32') return { opener: 'cmd', openerArgs: ['/c', 'start', '', htmlFile] };
+            if (process.platform === 'darwin') return { opener: 'open', openerArgs: [htmlFile] };
+            return { opener: 'xdg-open', openerArgs: [htmlFile] };
+        })();
+        spawn(opener, openerArgs, { stdio: 'ignore', detached: true }).unref();
     } catch (e) {
         err(`Graph generation failed: ${e.message}`);
         process.exit(1);
@@ -908,7 +985,7 @@ async function cmdMutate(flags) {
 
     const mutateScript = path.join(agentDest, 'scripts', 'mutation_runner.js');
     try {
-        await runShellAsync(`node "${mutateScript}" ${args.join(' ')}`, { stdio: 'inherit', cwd: targetDir });
+        await runScriptAsync(mutateScript, args, { cwd: targetDir });
     } catch {
         process.exit(1);
     }
@@ -1051,7 +1128,6 @@ async function cmdMarathon(flags) {
     }
 
     const args = process.argv.slice(3);
-    const argsStr = args.join(' ');
     if (args.length === 0 || args[0] === 'help' || args[0] === '--help' || args[0] === '-h') {
         banner();
         log(`  ${c('cyan', '╔' + '═'.repeat(60) + '╗')}`);
@@ -1073,7 +1149,7 @@ async function cmdMarathon(flags) {
 
     const marathonScript = path.join(agentDest, 'scripts', 'marathon_harness.js');
     try {
-        await runShellAsync(`node "${marathonScript}" ${argsStr}`, { stdio: 'inherit', cwd: targetDir });
+        await runScriptAsync(marathonScript, args, { cwd: targetDir });
     } catch {
         process.exit(1);
     }

package/bin/wrapper.js

@@ -21,14 +21,23 @@ const RUST_COMMANDS = new Set(['init', 'validate', 'status']);
 function getBinaryPath() {
     const isWindows = os.platform() === 'win32';
     const ext = isWindows ? '.exe' : '';
+    const platform = os.platform();
+    const arch = os.arch();
     
-    // First, check bin/ directory (postinstall downloaded binary)
-    const binPath = path.resolve(__dirname, `tribunal-core${ext}`);
-    if (fs.existsSync(binPath)) {
-        return binPath;
+    // First, try production resolution (from optionalDependencies)
+    const pkgName = `@tribunal-kit/core-${platform}-${arch}`;
+    try {
+        // Try to resolve the binary from the optional dependency package
+        const pkgPath = require.resolve(`${pkgName}/package.json`);
+        const binPath = path.resolve(path.dirname(pkgPath), `bin/tribunal-core${ext}`);
+        if (fs.existsSync(binPath)) {
+            return binPath;
+        }
+    } catch (e) {
+        // Package not found, ignore and fall back to local dev targets
     }
 
-    // Second, try to find the binary compiled from crates/core/Cargo.toml
+    // Second, try to find the binary compiled from crates/core/Cargo.toml (Local dev)
     const devPath = path.resolve(__dirname, '..', 'target', 'release', `tribunal-core${ext}`);
     if (fs.existsSync(devPath)) {
         return devPath;
@@ -40,13 +49,13 @@ function getBinaryPath() {
         return debugPath;
     }
 
-    // Production resolution (from optionalDependencies) would go here
     return null;
 }
 
 function runRustBinary(binPath, args) {
+    const stdio = ['inherit', process.stdout.isTTY ? 'ignore' : 'inherit', 'inherit'];
     const result = spawnSync(binPath, args, {
-        stdio: 'inherit',
+        stdio: stdio,
         env: process.env
     });
 

package/mcp_config.json

@@ -0,0 +1,11 @@
+{
+  "mcpServers": {
+    "tribunal-kit": {
+      "command": "node",
+      "args": [
+        "bin/mcp-server.js"
+      ],
+      "env": {}
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "tribunal-kit",
-    "version": "4.5.0",
+    "version": "4.5.1",
     "description": "Anti-Hallucination AI Agent Kit — 40 specialist agents, 32 slash commands, 16 parallel Tribunal reviewers, Performance Swarm engine, Supreme Court case law pipeline, and long-running agent harness.",
     "keywords": [
         "ai",
@@ -50,7 +50,8 @@
         "scripts/",
         ".agent/",
         "README.md",
-        "LICENSE"
+        "LICENSE",
+        "mcp_config.json"
     ],
     "engines": {
         "node": ">=18.0.0"
@@ -65,13 +66,20 @@
         "changelog:preview": "node scripts/changelog.js --preview",
         "sync": "node scripts/sync-version.js",
         "validate-payload": "node scripts/validate-payload.js",
-        "postinstall": "node scripts/postinstall.js",
         "build": "echo 'No build step required for this project'"
     },
     "devDependencies": {
-        "jest": "^29.7.0",
-        "typescript": "^5.4.5",
-        "eslint": "^9.1.1"
+        "eslint": "^9.1.1",
+        "jest": "^25.0.0",
+        "typescript": "^5.4.5"
+    },
+    "optionalDependencies": {
+        "@tribunal-kit/core-darwin-arm64": "^4.5.1",
+        "@tribunal-kit/core-darwin-x64": "^4.5.1",
+        "@tribunal-kit/core-linux-arm64": "^4.5.1",
+        "@tribunal-kit/core-linux-x64": "^4.5.1",
+        "@tribunal-kit/core-win32-arm64": "^4.5.1",
+        "@tribunal-kit/core-win32-x64": "^4.5.1"
     },
     "jest": {
         "testMatch": [

package/scripts/changelog.js

@@ -56,13 +56,14 @@ function getLatestTag() {
 
 function getCommits(since) {
     const range = since ? `${since}..HEAD` : 'HEAD';
-    const format = '--format="%H||%s||%an||%ai"';
-    const raw = git(`log ${range} ${format} --no-merges`);
+    const MAX_COMMITS = 500;
+    const format = '--format=%H||%s||%an||%ai';
+    const raw = git(`log ${range} ${format} --no-merges -n ${MAX_COMMITS}`);
     if (!raw) return [];
 
     return raw.split('\n').filter(Boolean).map(line => {
         const [hash, subject, author, date] = line.split('||');
-        return { hash: hash?.slice(0, 7), subject, author, date: date?.slice(0, 10) };
+        return { hash: hash?.replace(/^"/, '').slice(0, 7), subject, author, date: date?.replace(/"$/, '').slice(0, 10) };
     });
 }
 

package/scripts/validate-payload.js

@@ -3,7 +3,12 @@ const path = require('path');
 
 // Simple Markdown frontmatter and Tribunal header validator
 function validateMarkdownFile(filePath) {
-    const content = fs.readFileSync(filePath, 'utf8');
+    let content;
+    try {
+        content = fs.readFileSync(filePath, 'utf8');
+    } catch (e) {
+        return [`Failed to read file: ${e.message}`];
+    }
     let errors = [];
 
     // Check for frontmatter

package/scripts/postinstall.js

@@ -1,127 +0,0 @@
-#!/usr/bin/env node
-/**
- * postinstall.js — Binary Download Script
- * 
- * After `npm install`, this script downloads the pre-compiled Rust binary
- * for the user's platform from the latest GitHub Release.
- * 
- * If the download fails (offline, unsupported platform, etc.), it's a soft failure.
- * The wrapper.js will detect the missing binary and fall back to the JS engine.
- */
-
-const fs = require('fs');
-const path = require('path');
-const https = require('https');
-const os = require('os');
-const crypto = require('crypto');
-
-const PKG = require(path.resolve(__dirname, '..', 'package.json'));
-const VERSION = PKG.version;
-
-const BINARY_DIR = path.resolve(__dirname, '..', 'bin');
-const REPO = 'Harmitx7/tribunal-kit';
-
-function getPlatformBinary() {
-    const platform = os.platform();
-    const arch = os.arch();
-
-    const map = {
-        'win32-x64':    'tribunal-core-win-x64.exe',
-        'win32-arm64':  'tribunal-core-win-arm64.exe',
-        'darwin-x64':   'tribunal-core-darwin-x64',
-        'darwin-arm64': 'tribunal-core-darwin-arm64',
-        'linux-x64':    'tribunal-core-linux-x64',
-        'linux-arm64':  'tribunal-core-linux-arm64',
-    };
-
-    const key = `${platform}-${arch}`;
-    return map[key] || null;
-}
-
-function getLocalBinaryPath() {
-    const isWindows = os.platform() === 'win32';
-    return path.join(BINARY_DIR, `tribunal-core${isWindows ? '.exe' : ''}`);
-}
-
-function download(url) {
-    return new Promise((resolve, reject) => {
-        const request = https.get(url, { headers: { 'User-Agent': `tribunal-kit/${VERSION}` } }, (res) => {
-            // Handle redirects (GitHub sends 302 to the actual download URL)
-            if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
-                download(res.headers.location).then(resolve).catch(reject);
-                return;
-            }
-
-            if (res.statusCode !== 200) {
-                reject(new Error(`HTTP ${res.statusCode}`));
-                return;
-            }
-
-            const chunks = [];
-            res.on('data', (chunk) => chunks.push(chunk));
-            res.on('end', () => resolve(Buffer.concat(chunks)));
-            res.on('error', reject);
-        });
-
-        request.on('error', reject);
-        request.setTimeout(30000, () => { request.destroy(); reject(new Error('Timeout')); });
-    });
-}
-
-async function main() {
-    const binaryName = getPlatformBinary();
-
-    if (!binaryName) {
-        console.log(`[tribunal-kit] No pre-built binary for ${os.platform()}-${os.arch()}. Using JS fallback.`);
-        return;
-    }
-
-    const localPath = getLocalBinaryPath();
-
-    // Skip if binary already exists (e.g. dev environment with cargo build)
-    if (fs.existsSync(localPath)) {
-        return;
-    }
-
-    const url = `https://github.com/${REPO}/releases/download/v${VERSION}/${binaryName}`;
-    const checksumsUrl = `https://github.com/${REPO}/releases/download/v${VERSION}/checksums.txt`;
-    
-    console.log(`[tribunal-kit] Downloading native binary for ${os.platform()}-${os.arch()}...`);
-
-    try {
-        // 1. Download checksums file
-        const checksumsData = await download(checksumsUrl);
-        const checksumsText = checksumsData.toString('utf-8');
-        
-        // 2. Extract expected hash
-        const hashMatch = checksumsText.split('\n').find(line => line.includes(binaryName));
-        if (!hashMatch) {
-            throw new Error(`Checksum for ${binaryName} not found in checksums.txt`);
-        }
-        const expectedHash = hashMatch.split(' ')[0].trim();
-
-        // 3. Download binary
-        const data = await download(url);
-
-        // 4. Verify checksum
-        const actualHash = crypto.createHash('sha256').update(data).digest('hex');
-        if (actualHash !== expectedHash) {
-            throw new Error(`Checksum mismatch! Expected ${expectedHash}, got ${actualHash}. Potential tamper detected.`);
-        }
-
-        // 5. Write to disk
-        fs.writeFileSync(localPath, data);
-
-        // Make executable on Unix
-        if (os.platform() !== 'win32') {
-            fs.chmodSync(localPath, 0o755);
-        }
-
-        console.log(`[tribunal-kit] Native binary installed and verified successfully.`);
-    } catch (e) {
-        // Soft failure — wrapper.js will use the JS engine
-        console.log(`[tribunal-kit] Binary download skipped (${e.message}). Using JS fallback.`);
-    }
-}
-
-main();