wrosecode 0.0.0-stage → 1.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 WROSECODE contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,233 @@
-# Temporary Holding Version
+<p align="center">
+  <img src="docs/assets/wrosecode-logo.webp" alt="WROSECODE neon rose terminal logo" width="160">
+</p>
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+<h1 align="center">WROSECODE</h1>
+
+<p align="center">
+  <strong>A native Rust AI coding agent for your terminal.</strong><br>
+  <em>Build software. Explore code. Solve authorized CTF labs. Document security findings.</em>
+</p>
+
+<p align="center">
+  <a href="https://github.com/whiterose717/WROSECODE-CLI/actions/workflows/ci.yml"><img src="https://github.com/whiterose717/WROSECODE-CLI/actions/workflows/ci.yml/badge.svg" alt="GitHub Actions CI status"></a>
+  <a href="https://www.npmjs.com/package/wrosecode"><img src="https://img.shields.io/npm/v/wrosecode?logo=npm&amp;label=npm" alt="Published npm version"></a>
+  <a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-16a34a.svg" alt="MIT license"></a>
+  <a href="https://www.rust-lang.org/"><img src="https://img.shields.io/badge/Built%20with-Rust-orange?logo=rust" alt="Built with Rust"></a>
+  <img src="https://img.shields.io/badge/platforms-Linux%20%7C%20macOS%20%7C%20Windows-4063d8" alt="Linux, macOS and Windows">
+</p>
+
+<p align="center">
+  <a href="#installation"><strong>Get started</strong></a> ·
+  <a href="#screenshots">Screenshots</a> ·
+  <a href="#features">Features</a> ·
+  <a href="#security-research-workflows">CTF &amp; VAPT</a> ·
+  <a href="#documentation">Documentation</a>
+</p>
+
+---
+
+WROSECODE combines a streaming, keyboard-driven **terminal UI** with repository-aware tools, configurable AI providers, persistent sessions, optional MCP integrations, built-in checks, and controlled execution. It is designed for everyday development and for **permissioned** CTF, VAPT, and bug-bounty workflows.
+
+> [!NOTE]
+> The `main` branch contains the v1.0.1 source update. The public npm version is shown by the npm badge above and may be older until the corresponding native GitHub Release is published.
+
+## Screenshots
+
+### Native Rust terminal UI
+
+Real screenshots captured from the WROSECODE executable using an isolated demo workspace, without account credentials or real target data.
+
+<div align="center">
+  <a href="docs/assets/terminal-start.png"><img src="docs/assets/terminal-start.png" alt="Native WROSECODE terminal start screen with cyan wordmark and status footer" width="900"></a>
+  <sub>Start screen · provider and mode overview · compact status footer</sub>
+</div>
+
+<br>
+
+<div align="center">
+  <a href="docs/assets/terminal-commands.png"><img src="docs/assets/terminal-commands.png" alt="Native WROSECODE CLI displaying the built-in slash command help" width="900"></a>
+  <sub>Built-in command help and keyboard-first navigation</sub>
+</div>
+
+### Optional companion Web Console
+
+These are previews of the **separate companion Web Console**, not the native CLI window. Connecting a device and configuring a backend may be required to use them.
+
+| Web chat | CTF workbench |
+|:--:|:--:|
+| <a href="docs/assets/web-console-chat.png"><img src="docs/assets/web-console-chat.png" alt="WROSECODE companion Web Console chat with device pairing and agent mode selection" width="460"></a> | <a href="docs/assets/web-console-ctf.png"><img src="docs/assets/web-console-ctf.png" alt="WROSECODE companion Web Console CTF challenge configuration and flag results panel" width="460"></a> |
+| Paired-device chat and agent mode selection | Local challenge input, analysis workflow and results panel |
+
+## Installation
+
+### Option 1 — npm (recommended for end users)
+
+Requires **Node.js 18+** and network access on the first installation/run to download the native executable.
+
+```bash
+npm install -g wrosecode
+wrosecode --version
+wrosecode
+```
+
+Run without a permanent installation:
+
+```bash
+npx wrosecode
+```
+
+Update or uninstall:
+
+```bash
+npm install -g wrosecode@latest
+npm uninstall -g wrosecode
+```
+
+The npm package is a small JavaScript launcher, not a bundled Rust binary. It downloads the **matching native release asset** from [GitHub Releases](https://github.com/whiterose717/WROSECODE-CLI/releases) and verifies its **SHA-256 checksum**. If your npm version disables lifecycle scripts by default, the launcher downloads the verified binary when first run.
+
+Supported native release targets: **Linux x86_64 / ARM64**, **macOS x86_64 / Apple Silicon**, and **Windows x86_64 / ARM64**. Availability depends on the corresponding GitHub Release assets.
+
+> Installing a version before its matching GitHub Release exists will not work. If `npm install -g` encounters a permission conflict with an older system-wide binary, use a user-owned npm prefix or back up the old binary first; do not weaken system directory permissions.
+
+### Option 2 — build from Rust source
+
+Install a supported Rust toolchain and Cargo, then:
+
+```bash
+git clone https://github.com/whiterose717/WROSECODE-CLI.git
+cd WROSECODE-CLI
+cargo build --release --locked
+./target/release/wrosecode --version
+./target/release/wrosecode
+```
+
+You can also install the checked-out source using `cargo install --path . --locked`.
+
+## Quick start
+
+Open the CLI from the repository you want to work in:
+
+```bash
+cd /path/to/your/project
+wrosecode
+```
+
+Try a one-shot development task:
+
+```bash
+wrosecode --mode build "Review this repository and suggest a small, testable improvement."
+```
+
+Inside the interactive UI:
+
+```text
+/help        Show available commands
+/providers   Configure, authenticate, or test model connections
+/ctf         Open the CTF workflow
+/bugbounty   Arm a scoped security assessment
+/resume      Continue a saved session
+Ctrl+T       Change thinking level
+Ctrl+D       Open the dashboard
+```
+
+For provider setup, use `/providers` or the supported environment variables. **Never put API keys in Git commits, README examples, or issue screenshots.**
+
+## Features
+
+| Capability | What it provides |
+|---|---|
+| **Native Rust TUI** | Responsive, streaming, keyboard-first interface with compact resource and progress information |
+| **Multiple AI backends** | Provider profiles, compatible APIs and configurable model/thinking choices |
+| **Repository awareness** | File context, project instructions, repository maps, code editing and local test workflows |
+| **Tool integration** | Shell tools, optional MCP providers and developer workflows with permission controls |
+| **Persistent sessions** | Resumable conversations, checkpoints, exports and session diagnostics |
+| **Headless execution** | CLI automation, machine-readable events, budgets and bounded run limits |
+| **CTF mode** | Challenge analysis, local solver development and evidence-based flag verification |
+| **VAPT / Bug Bounty** | Program allowlists, OWASP-oriented checklists, controlled authorization testing and evidence-backed reports |
+
+Features requiring a provider account, an external app, MCP server or other optional service are **not** enabled automatically.
+
+## Security research workflows
+
+WROSECODE supports **authorized research only**. Set an explicit target scope and follow the program's testing rules. Do not use production customer data, attack out-of-scope infrastructure or assume automated findings are verified.
+
+### CTF labs
+
+Use the interactive `/ctf` workflow or a task with CTF mode:
+
+```bash
+wrosecode --mode ctf
+```
+
+Analyze challenge material you are allowed to test, build a reproducible solver, and confirm the result with tool output. A model-generated flag alone is **not** proof of a solved challenge.
+
+### VAPT and bug bounty
+
+Example syntax using a **placeholder domain**; replace it with the exact host authorized by your program:
+
+```bash
+wrosecode bugbounty https://app.example.test \
+  --scope app.example.test \
+  --program "Authorized Assessment"
+```
+
+The engagement workflow can create `.bugbounty/VAPT_ASSESSMENT.md`, containing an offline **OWASP WSTG / ASVS** checklist and an **API BOLA/IDOR role-object matrix** for researcher-owned test accounts. Scope guardrails, bounded HTTP behavior, response/evidence checks, and report verification support low-impact testing; they do not substitute for explicit authorization.
+
+Findings follow an evidence-gated process:
+
+```text
+Potential → Investigating → Reproduced → Verified → Reported
+```
+
+Verified reports can include analyst-supplied **CWE, WSTG, ASVS, CVSS vector, severity rationale**, reproduction steps and remediation. Unconfirmed scanner hits should not be presented as confirmed vulnerabilities.
+
+## Permissions and responsible use
+
+- Start with interactive approval (`ask`) or the appropriate bounded permission mode. Do not use broad `yolo` permissions on untrusted code or systems.
+- Keep test data synthetic, honor target exclusions and rate limits, and stop testing when the program or service blocks requests.
+- Keep credentials, CTF flags, raw request/response captures and personal data out of public issues and screenshots.
+- See [sandbox implementation details](docs/CLI_REFERENCE.md#shell-sandbox) and [contribution guidance](CONTRIBUTING.md).
+
+## Development and quality checks
+
+The release workflow uses Rust and Node.js checks. From a source checkout:
+
+```bash
+npm ci --ignore-scripts
+npm run check
+cargo fmt --check
+cargo clippy --all-targets -- -D warnings
+cargo test --all-targets
+cargo build --release --locked
+```
+
+CI runs on **Linux, macOS and Windows**. The CI badge reports the current public workflow status; it is not a guarantee that every optional external provider is available.
+
+## Documentation
+
+| Resource | Description |
+|---|---|
+| [Full CLI reference](docs/CLI_REFERENCE.md) | Original detailed README content, including TUI controls, providers and advanced workflows |
+| [Architecture](ARCHITECTURE.md) | Internal design and components |
+| [Feature reference](docs/features.md) | Detailed capabilities |
+| [Agent API](API.md) | Local API and integration notes |
+| [Benchmarks](BENCHMARKS.md) | Benchmark notes and methodology |
+| [Contributing](CONTRIBUTING.md) | Development and testing expectations |
+| [GitHub releases](https://github.com/whiterose717/WROSECODE-CLI/releases) | Native releases, versioned binaries and checksums |
+
+## License
+
+WROSECODE is open source under the **MIT License**.
+
+See the complete [LICENSE](LICENSE) file for legal terms and copyright information. The existing license text and attribution are preserved.
+
+---
+
+<div align="center">
+
+**Built for the terminal. Grounded in reproducible work.**
+
+[GitHub](https://github.com/whiterose717/WROSECODE-CLI) · [npm](https://www.npmjs.com/package/wrosecode) · [Releases](https://github.com/whiterose717/WROSECODE-CLI/releases) · [Issues](https://github.com/whiterose717/WROSECODE-CLI/issues)
+
+</div>

package/npm/check-publish.js

@@ -0,0 +1,164 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const pkg = require('../package.json');
+const lock = require('../package-lock.json');
+const cargoToml = fs.readFileSync(path.resolve(__dirname, '../Cargo.toml'), 'utf8');
+const installer = require('./install.js');
+
+const root = path.resolve(__dirname, '..');
+const errors = [];
+const expectedRepo = 'https://github.com/whiterose717/WROSECODE-CLI.git';
+const expectedHomepage = 'https://github.com/whiterose717/WROSECODE-CLI#readme';
+const expectedBugs = 'https://github.com/whiterose717/WROSECODE-CLI/issues';
+const expectedFiles = [
+  'npm/wrosecode.js',
+  'npm/install.js',
+  'npm/check-publish.js',
+  'LICENSE',
+  'README.md'
+];
+const requiredAssets = [
+  ['linux', 'x64', 'wrosecode-linux-x86_64'],
+  ['linux', 'arm64', 'wrosecode-linux-aarch64'],
+  ['darwin', 'x64', 'wrosecode-darwin-x86_64'],
+  ['darwin', 'arm64', 'wrosecode-darwin-aarch64'],
+  ['win32', 'x64', 'wrosecode-windows-x86_64.exe'],
+  ['win32', 'arm64', 'wrosecode-windows-aarch64.exe']
+];
+
+function requireCondition(condition, message) {
+  if (!condition) errors.push(message);
+}
+
+requireCondition(pkg.name === 'wrosecode', 'package name must be "wrosecode".');
+requireCondition(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(pkg.version || ''), 'package version must use semantic versioning.');
+requireCondition(pkg.version === lock.version && lock.packages?.['']?.version === pkg.version, 'package-lock.json version does not match package.json.');
+requireCondition(new RegExp(`^version\\s*=\\s*"${pkg.version.replaceAll('.', '\\.')}"$`, 'm').test(cargoToml), 'Cargo.toml version does not match package.json.');
+requireCondition(typeof pkg.description === 'string' && pkg.description.trim().length > 0, 'package description is required.');
+requireCondition(pkg.license === 'MIT', 'package license must be MIT.');
+requireCondition(fs.existsSync(path.join(root, 'LICENSE')) && fs.readFileSync(path.join(root, 'LICENSE'), 'utf8').startsWith('MIT License'), 'MIT LICENSE file is missing or invalid.');
+requireCondition(Array.isArray(pkg.keywords) && pkg.keywords.length > 0, 'at least one package keyword is required.');
+requireCondition(pkg.engines?.node === '>=18', 'Node.js engine must be >=18.');
+requireCondition(pkg.bin?.wrosecode === 'npm/wrosecode.js', 'wrosecode bin must point to npm/wrosecode.js.');
+requireCondition(pkg.repository?.type === 'git' && pkg.repository?.url === expectedRepo, `repository.url must be ${expectedRepo}.`);
+requireCondition(pkg.homepage === expectedHomepage, `homepage must be ${expectedHomepage}.`);
+requireCondition(pkg.bugs?.url === expectedBugs, `bugs.url must be ${expectedBugs}.`);
+requireCondition(JSON.stringify(pkg.files) === JSON.stringify(expectedFiles), 'package files allowlist must contain only the five approved npm distribution files.');
+
+for (const relativePath of expectedFiles) {
+  const file = path.join(root, relativePath);
+  requireCondition(fs.existsSync(file) && fs.statSync(file).isFile(), `required package file is missing: ${relativePath}`);
+}
+
+const launcherPath = path.join(root, 'npm/wrosecode.js');
+if (fs.existsSync(launcherPath)) {
+  const launcher = fs.readFileSync(launcherPath, 'utf8');
+  requireCondition(launcher.startsWith('#!/usr/bin/env node\n'), 'npm/wrosecode.js must have the Node.js executable shebang.');
+}
+
+const installerPath = path.join(root, 'npm/install.js');
+let installerSource = '';
+if (fs.existsSync(installerPath)) {
+  installerSource = fs.readFileSync(installerPath, 'utf8');
+  for (const [platform, arch, expectedAsset] of requiredAssets) {
+    requireCondition(installer.assetName(platform, arch) === expectedAsset, `installer asset mapping is incorrect for ${platform}/${arch}.`);
+  }
+  const previousOverride = process.env.WROSECODE_RELEASE_BASE;
+  delete process.env.WROSECODE_RELEASE_BASE;
+  try {
+    requireCondition(installer.releaseBase(pkg) === `https://github.com/whiterose717/WROSECODE-CLI/releases/download/v${pkg.version}`, 'installer release URL must resolve from repository metadata and package version.');
+  } catch (error) {
+    errors.push(`installer cannot derive the release URL: ${error.message}`);
+  } finally {
+    if (previousOverride === undefined) delete process.env.WROSECODE_RELEASE_BASE;
+    else process.env.WROSECODE_RELEASE_BASE = previousOverride;
+  }
+  requireCondition(installerSource.includes("protocol !== 'https:'") && installerSource.includes("createHash('sha256')") && installerSource.includes('actual !== expected'), 'installer must enforce HTTPS and SHA-256 verification.');
+  requireCondition(!/(?:YOUR_GITHUB|YOUR_REPOSITORY|example\.com|placeholder|TODO_RELEASE_URL)/i.test(installerSource), 'installer contains a placeholder release URL or TODO.');
+}
+
+const readmePath = path.join(root, 'README.md');
+if (fs.existsSync(readmePath)) {
+  const readme = fs.readFileSync(readmePath, 'utf8');
+  requireCondition(readme.includes(expectedRepo.replace(/\.git$/, '')), 'README must link to the actual GitHub repository.');
+  requireCondition(!/(?:<YOUR_GITHUB_REPOSITORY_URL>|github\.com\/(?:example|your-org|your-user)\/)/i.test(readme), 'README contains a placeholder repository URL.');
+  for (const command of [
+    'npm install -g wrosecode',
+    'wrosecode',
+    'npx wrosecode',
+    'npm install -g wrosecode@latest',
+    'npm uninstall -g wrosecode'
+  ]) requireCondition(readme.includes(command), `README is missing the npm command: ${command}`);
+}
+
+// Scan only files that npm is explicitly permitted to publish. Never emit a
+// matching line or credential value in diagnostics.
+const credentialPatterns = [
+  /-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----/,
+  /\b(?:gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{40,}|npm_[A-Za-z0-9]{30,}|AKIA[0-9A-Z]{16})\b/,
+  /\bsk-(?:ant|proj|live|svc)?-[A-Za-z0-9_-]{32,}\b/i,
+  /\b(?:ANTHROPIC_API_KEY|OPENAI_API_KEY|NPM_TOKEN|GITHUB_TOKEN|CTFD_TOKEN)\s*[:=]\s*["']?([^\s"'#]{24,})/i
+];
+for (const relativePath of expectedFiles) {
+  const file = path.join(root, relativePath);
+  if (!fs.existsSync(file) || !fs.statSync(file).isFile()) continue;
+  const content = fs.readFileSync(file, 'utf8');
+  if (credentialPatterns.some((pattern) => pattern.test(content))) {
+    errors.push(`possible hard-coded credential detected in npm package file: ${relativePath}`);
+  }
+}
+
+async function verifyPublishedRelease() {
+  const endpoint = `https://api.github.com/repos/whiterose717/WROSECODE-CLI/releases/tags/v${pkg.version}`;
+  let response;
+  try {
+    response = await fetch(endpoint, {
+      headers: {
+        accept: 'application/vnd.github+json',
+        'x-github-api-version': '2022-11-28',
+        'user-agent': 'wrosecode-npm-publish-check'
+      },
+      signal: AbortSignal.timeout(20_000)
+    });
+  } catch (error) {
+    errors.push(`could not verify GitHub Release v${pkg.version}: ${error.message}`);
+    return;
+  }
+  if (!response.ok) {
+    errors.push(`GitHub Release v${pkg.version} is not publicly available (HTTP ${response.status}); push the matching tag and wait for the release workflow before publishing.`);
+    return;
+  }
+
+  let release;
+  try {
+    release = await response.json();
+  } catch {
+    errors.push('GitHub returned invalid release metadata; cannot verify native download assets.');
+    return;
+  }
+  requireCondition(release.tag_name === `v${pkg.version}` && !release.draft && !release.prerelease, `GitHub Release v${pkg.version} must be published (not draft or prerelease).`);
+  const availableAssets = new Set((release.assets || []).map((asset) => asset.name));
+  const missingAssets = requiredAssets.flatMap(([, , asset]) => [asset, `${asset}.sha256`]).filter((asset) => !availableAssets.has(asset));
+  requireCondition(missingAssets.length === 0, `GitHub Release v${pkg.version} is missing assets: ${missingAssets.join(', ')}.`);
+}
+
+if (errors.length) {
+  console.error('npm publish preflight failed:');
+  for (const error of errors) console.error(`- ${error}`);
+  process.exit(1);
+}
+
+verifyPublishedRelease().then(() => {
+  if (errors.length) {
+    console.error('npm publish preflight failed:');
+    for (const error of errors) console.error(`- ${error}`);
+    process.exitCode = 1;
+    return;
+  }
+  console.log(`npm publish preflight passed for ${pkg.name}@${pkg.version}; matching public release assets are present.`);
+}).catch((error) => {
+  console.error(`npm publish preflight failed: ${error.message}`);
+  process.exitCode = 1;
+});

package/npm/install.js

@@ -0,0 +1,142 @@
+'use strict';
+
+const crypto = require('node:crypto');
+const fs = require('node:fs/promises');
+const os = require('node:os');
+const path = require('node:path');
+
+const MAX_BINARY_BYTES = 300 * 1024 * 1024;
+const PLATFORM_ASSETS = {
+  'linux:x64': 'wrosecode-linux-x86_64',
+  'linux:arm64': 'wrosecode-linux-aarch64',
+  'darwin:x64': 'wrosecode-darwin-x86_64',
+  'darwin:arm64': 'wrosecode-darwin-aarch64',
+  'win32:x64': 'wrosecode-windows-x86_64.exe',
+  'win32:arm64': 'wrosecode-windows-aarch64.exe'
+};
+
+function assetName(platform = process.platform, arch = process.arch) {
+  const name = PLATFORM_ASSETS[`${platform}:${arch}`];
+  if (!name) {
+    throw new Error(`Unsupported platform ${platform}/${arch}. Supported targets: Linux, macOS, and Windows on x86_64 or aarch64.`);
+  }
+  return name;
+}
+
+function releaseBase(pkg) {
+  if (process.env.WROSECODE_RELEASE_BASE) return process.env.WROSECODE_RELEASE_BASE.replace(/\/+$/, '');
+
+  const configured = pkg.repository?.url;
+  if (typeof configured !== 'string') throw new Error('package.json is missing repository.url; cannot locate the native release.');
+  const normalized = configured.replace(/^git\+/, '').replace(/\.git$/, '');
+  let repository;
+  try {
+    repository = new URL(normalized);
+  } catch {
+    throw new Error('package.json repository.url is not a valid HTTPS GitHub URL.');
+  }
+  if (repository.protocol !== 'https:' || repository.hostname.toLowerCase() !== 'github.com' || repository.pathname.toLowerCase() !== '/whiterose717/wrosecode-cli') {
+    throw new Error('package.json repository.url must identify https://github.com/whiterose717/WROSECODE-CLI.git.');
+  }
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(pkg.version)) throw new Error(`Invalid package version: ${pkg.version}`);
+  return `${repository.origin}${repository.pathname}/releases/download/v${pkg.version}`;
+}
+
+function userCacheBinaryPath(version, platform = process.platform) {
+  const binaryName = platform === 'win32' ? 'wrosecode.exe' : 'wrosecode';
+  if (platform === 'win32') {
+    const localAppData = process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local');
+    return path.join(localAppData, 'WROSECODE', version, binaryName);
+  }
+  const cacheHome = process.env.XDG_CACHE_HOME || path.join(os.homedir(), '.cache');
+  return path.join(cacheHome, 'wrosecode', version, binaryName);
+}
+
+async function fetchHttps(url) {
+  const parsed = new URL(url);
+  if (parsed.protocol !== 'https:') throw new Error('Release downloads must use HTTPS.');
+  const response = await fetch(parsed, { signal: AbortSignal.timeout(120_000), redirect: 'follow' });
+  if (!response.ok) throw new Error(`Download failed (${response.status} ${response.statusText}): ${parsed}`);
+  if (new URL(response.url).protocol !== 'https:') throw new Error('Release download redirected to a non-HTTPS URL.');
+  return response;
+}
+
+async function readLimited(response, limit) {
+  if (!response.body) throw new Error('Release server returned an empty response body.');
+  const reader = response.body.getReader();
+  const chunks = [];
+  let size = 0;
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    size += value.byteLength;
+    if (size > limit) {
+      await reader.cancel();
+      throw new Error('Downloaded release asset exceeds the allowed size.');
+    }
+    chunks.push(Buffer.from(value));
+  }
+  return Buffer.concat(chunks, size);
+}
+
+async function installBinary() {
+  // Explicit override is intended for local builds and pack/install smoke tests.
+  if (process.env.WROSECODE_BINARY) return;
+
+  const pkg = require('../package.json');
+  const base = releaseBase(pkg);
+  const name = assetName();
+  const assetUrl = `${base}/${name}`;
+
+  const binary = await readLimited(await fetchHttps(assetUrl), MAX_BINARY_BYTES);
+  if (binary.length === 0) throw new Error(`Release asset is empty: ${name}`);
+
+  const checksumBytes = await readLimited(await fetchHttps(`${assetUrl}.sha256`), 1024);
+  const checksumText = checksumBytes.toString('utf8').trim();
+  const checksumMatch = /^([a-fA-F0-9]{64})(?:\s+\*?([^\s]+))?$/.exec(checksumText);
+  if (!checksumMatch || (checksumMatch[2] && path.basename(checksumMatch[2]) !== name)) {
+    throw new Error(`Invalid SHA-256 sidecar for ${name}.`);
+  }
+  const expected = checksumMatch[1].toLowerCase();
+  const actual = crypto.createHash('sha256').update(binary).digest('hex');
+  if (actual !== expected) throw new Error(`SHA-256 verification failed for ${name}.`);
+
+  const binDir = path.join(__dirname, 'bin');
+  const destination = path.join(binDir, process.platform === 'win32' ? 'wrosecode.exe' : 'wrosecode');
+  try {
+    await writeBinary(destination, binary);
+  } catch (error) {
+    // Global installs may be root-owned while npm lifecycle scripts are
+    // disabled. Keep the executable in the user's cache in that case.
+    if (!['EACCES', 'EPERM', 'EROFS'].includes(error.code)) throw error;
+    await writeBinary(userCacheBinaryPath(pkg.version), binary);
+  }
+}
+
+async function writeBinary(destination, binary) {
+  const destinationDir = path.dirname(destination);
+  const temporary = `${destination}.tmp-${process.pid}`;
+  await fs.mkdir(destinationDir, { recursive: true, mode: 0o700 });
+  try {
+    await fs.writeFile(temporary, binary, { mode: 0o755, flag: 'wx' });
+    if (process.platform !== 'win32') await fs.chmod(temporary, 0o755);
+    try {
+      await fs.rename(temporary, destination);
+    } catch (error) {
+      if (process.platform !== 'win32' || !['EEXIST', 'EPERM', 'ENOTEMPTY'].includes(error.code)) throw error;
+      await fs.rm(destination, { force: true });
+      await fs.rename(temporary, destination);
+    }
+  } finally {
+    await fs.rm(temporary, { force: true });
+  }
+}
+
+if (require.main === module) {
+  installBinary().catch((error) => {
+    console.error(`wrosecode: native binary installation failed: ${error.message}`);
+    process.exitCode = 1;
+  });
+}
+
+module.exports = { assetName, releaseBase, userCacheBinaryPath };

package/npm/wrosecode.js

@@ -0,0 +1,69 @@
+#!/usr/bin/env node
+'use strict';
+
+const { spawn, spawnSync } = require('node:child_process');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const pkg = require('../package.json');
+const { userCacheBinaryPath } = require('./install.js');
+const packagedBinary = path.join(__dirname, 'bin', process.platform === 'win32' ? 'wrosecode.exe' : 'wrosecode');
+const cachedBinary = userCacheBinaryPath(pkg.version);
+let binary = process.env.WROSECODE_BINARY || [packagedBinary, cachedBinary].find((candidate) => fs.existsSync(candidate)) || null;
+
+if (!binary) {
+  // npm can be configured to skip lifecycle scripts. Install lazily on first run
+  // in that case, but fail instead of launching without a native executable.
+  const installer = spawnSync(process.execPath, [path.join(__dirname, 'install.js')], { stdio: 'inherit' });
+  if (installer.error) {
+    console.error(`wrosecode: could not run native installer: ${installer.error.message}`);
+    process.exit(1);
+  }
+  if (installer.status !== 0) process.exit(installer.status ?? 1);
+  binary = [packagedBinary, cachedBinary].find((candidate) => fs.existsSync(candidate)) || null;
+}
+
+if (!binary) {
+  console.error('wrosecode: native executable is missing after installation. Reinstall the package or set WROSECODE_BINARY to an executable path.');
+  process.exit(1);
+}
+
+const child = spawn(binary, process.argv.slice(2), {
+  stdio: 'inherit',
+  windowsHide: true
+});
+
+let signalForwarded = false;
+const signalsToForward = process.stdin.isTTY && process.stdout.isTTY ? ['SIGTERM'] : ['SIGINT', 'SIGTERM'];
+for (const signal of signalsToForward) {
+  process.on(signal, () => {
+    if (signalForwarded || child.exitCode !== null || child.signalCode !== null || child.pid === undefined) return;
+    signalForwarded = true;
+    try {
+      child.kill(signal);
+    } catch (error) {
+      if (error.code !== 'ESRCH') {
+        console.error(`wrosecode: could not forward ${signal} to native process: ${error.message}`);
+      }
+    }
+  });
+}
+
+let spawnFailed = false;
+child.once('error', (error) => {
+  spawnFailed = true;
+  console.error(`wrosecode: could not start native executable: ${error.message}`);
+  process.exitCode = 1;
+});
+
+child.once('close', (code, signal) => {
+  if (spawnFailed) return;
+  if (code !== null) {
+    process.exitCode = code;
+  } else if (signal) {
+    process.exitCode = 128 + (os.constants.signals[signal] || 1);
+  } else if (process.exitCode === undefined) {
+    process.exitCode = 1;
+  }
+});

package/package.json

@@ -1,6 +1,41 @@
 {
   "name": "wrosecode",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.1",
+  "description": "A terminal coding agent written in Rust",
+  "license": "MIT",
+  "keywords": [
+    "cli",
+    "coding-agent",
+    "developer-tools",
+    "terminal",
+    "rust"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/whiterose717/WROSECODE-CLI.git"
+  },
+  "homepage": "https://github.com/whiterose717/WROSECODE-CLI#readme",
+  "bugs": {
+    "url": "https://github.com/whiterose717/WROSECODE-CLI/issues"
+  },
+  "bin": {
+    "wrosecode": "npm/wrosecode.js"
+  },
+  "files": [
+    "npm/wrosecode.js",
+    "npm/install.js",
+    "npm/check-publish.js",
+    "LICENSE",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "cargo build --release --locked",
+    "check": "node --check npm/wrosecode.js && node --check npm/install.js && node --check npm/check-publish.js",
+    "postinstall": "node npm/install.js",
+    "prepack": "npm run check",
+    "prepublishOnly": "npm run check && node npm/check-publish.js"
+  }
+}