chore: import upstream snapshot with attribution

scripts/docker/install-smoke.Dockerfile

@@ -0,0 +1,55 @@
+# Smoke test for install.sh
+# Verifies the installer works in a clean environment.
+#
+# Usage (CI):
+#   docker build -f scripts/docker/install-smoke.Dockerfile .
+#
+# Usage (full E2E — requires a published release):
+#   docker build -f scripts/docker/install-smoke.Dockerfile \
+#     --build-arg OPENFANG_SMOKE_FULL=1 .
+
+FROM debian:bookworm-slim
+
+RUN apt-get update && apt-get install -y \
+    curl \
+    ca-certificates \
+    bash \
+    && rm -rf /var/lib/apt/lists/*
+
+# Create a non-root user (simulates real user install)
+RUN useradd -m -s /bin/bash testuser
+USER testuser
+WORKDIR /home/testuser
+
+# Copy the install script from the build context
+COPY scripts/install.sh /tmp/install.sh
+
+ARG OPENFANG_SMOKE_FULL=0
+RUN if [ "$OPENFANG_SMOKE_FULL" = "1" ]; then \
+        bash /tmp/install.sh; \
+    else \
+        # 1. Syntax check
+        bash -n /tmp/install.sh && \
+        echo "PASS: install.sh syntax is valid" && \
+        # 2. Verify detect_platform works by extracting the function
+        bash -c ' \
+            eval "$(sed -n "/^detect_platform/,/^}/p" /tmp/install.sh)" && \
+            detect_platform && \
+            echo "PASS: platform detected as $PLATFORM" \
+        ' && \
+        # 3. Verify target matches release naming (must contain -unknown-linux-gnu)
+        bash -c ' \
+            eval "$(sed -n "/^detect_platform/,/^}/p" /tmp/install.sh)" && \
+            detect_platform && \
+            echo "$PLATFORM" | grep -q "linux-gnu" && \
+            echo "PASS: target is gnu (matches release.yml)" \
+        '; \
+    fi
+
+# If full install succeeded, verify the binary works
+RUN if [ "$OPENFANG_SMOKE_FULL" = "1" ] && [ -f "$HOME/.openfang/bin/openfang" ]; then \
+        $HOME/.openfang/bin/openfang --version && \
+        echo "PASS: openfang binary works"; \
+    else \
+        echo "SKIP: binary verification (no full install)"; \
+    fi

scripts/install.ps1

@@ -0,0 +1,191 @@
+# OpenFang installer for Windows
+# Usage: iwr -useb https://openfang.sh/install.ps1 | iex
+#   or:  powershell -c "irm https://openfang.sh/install.ps1 | iex"
+#
+# Flags (via environment variables):
+#   $env:OPENFANG_INSTALL_DIR = custom install directory
+#   $env:OPENFANG_VERSION     = specific version tag (e.g. "v0.1.0")
+
+$ErrorActionPreference = 'Stop'
+
+$Repo = "RightNow-AI/openfang"
+$DefaultInstallDir = Join-Path $env:USERPROFILE ".openfang\bin"
+$InstallDir = if ($env:OPENFANG_INSTALL_DIR) { $env:OPENFANG_INSTALL_DIR } else { $DefaultInstallDir }
+
+function Write-Banner {
+    Write-Host ""
+    Write-Host "  OpenFang Installer" -ForegroundColor Cyan
+    Write-Host "  ==================" -ForegroundColor Cyan
+    Write-Host ""
+}
+
+function Get-Architecture {
+    # Try multiple detection methods — piped iex can break some approaches
+    $arch = ""
+
+    # Method 1: .NET RuntimeInformation
+    try {
+        $arch = [System.Runtime.InteropServices.RuntimeInformation]::OSArchitecture.ToString()
+    } catch {}
+
+    # Method 2: PROCESSOR_ARCHITECTURE env var
+    if (-not $arch -or $arch -eq "") {
+        try { $arch = $env:PROCESSOR_ARCHITECTURE } catch {}
+    }
+
+    # Method 3: WMI
+    if (-not $arch -or $arch -eq "") {
+        try {
+            $wmiArch = (Get-CimInstance Win32_Processor).Architecture
+            if ($wmiArch -eq 9) { $arch = "AMD64" }
+            elseif ($wmiArch -eq 12) { $arch = "ARM64" }
+        } catch {}
+    }
+
+    # Method 4: pointer size fallback (64-bit = 8 bytes)
+    if (-not $arch -or $arch -eq "") {
+        if ([IntPtr]::Size -eq 8) { $arch = "X64" }
+    }
+
+    $archUpper = "$arch".ToUpper().Trim()
+    switch ($archUpper) {
+        { $_ -in "X64", "AMD64", "X86_64" }     { return "x86_64" }
+        { $_ -in "ARM64", "AARCH64", "ARM" }     { return "aarch64" }
+        default {
+            Write-Host "  Unsupported architecture: $arch (detection may have failed)" -ForegroundColor Red
+            Write-Host "  Try: cargo install --git https://github.com/RightNow-AI/openfang openfang-cli" -ForegroundColor Yellow
+            exit 1
+        }
+    }
+}
+
+function Get-LatestVersion {
+    if ($env:OPENFANG_VERSION) {
+        return $env:OPENFANG_VERSION
+    }
+
+    Write-Host "  Fetching latest release..."
+    try {
+        $release = Invoke-RestMethod -Uri "https://api.github.com/repos/$Repo/releases/latest"
+        return $release.tag_name
+    }
+    catch {
+        Write-Host "  Could not determine latest version." -ForegroundColor Red
+        Write-Host "  Install from source instead:" -ForegroundColor Yellow
+        Write-Host "    cargo install --git https://github.com/$Repo openfang-cli"
+        exit 1
+    }
+}
+
+function Install-OpenFang {
+    Write-Banner
+
+    $arch = Get-Architecture
+    $version = Get-LatestVersion
+    $target = "${arch}-pc-windows-msvc"
+    $archive = "openfang-${target}.zip"
+    $url = "https://github.com/$Repo/releases/download/$version/$archive"
+    $checksumUrl = "$url.sha256"
+
+    Write-Host "  Installing OpenFang $version for $target..."
+
+    # Create install directory
+    if (-not (Test-Path $InstallDir)) {
+        New-Item -ItemType Directory -Path $InstallDir -Force | Out-Null
+    }
+
+    # Download to temp
+    $tempDir = Join-Path ([System.IO.Path]::GetTempPath()) "openfang-install"
+    if (Test-Path $tempDir) { Remove-Item -Recurse -Force $tempDir }
+    New-Item -ItemType Directory -Path $tempDir -Force | Out-Null
+
+    $archivePath = Join-Path $tempDir $archive
+    $checksumPath = Join-Path $tempDir "$archive.sha256"
+
+    try {
+        Invoke-WebRequest -Uri $url -OutFile $archivePath -UseBasicParsing
+    }
+    catch {
+        Write-Host "  Download failed. The release may not exist for your platform." -ForegroundColor Red
+        Write-Host "  Install from source instead:" -ForegroundColor Yellow
+        Write-Host "    cargo install --git https://github.com/$Repo openfang-cli"
+        Remove-Item -Recurse -Force $tempDir -ErrorAction SilentlyContinue
+        exit 1
+    }
+
+    # Verify checksum if available
+    $checksumDownloaded = $false
+    try {
+        Invoke-WebRequest -Uri $checksumUrl -OutFile $checksumPath -UseBasicParsing
+        $checksumDownloaded = $true
+    }
+    catch {
+        Write-Host "  Checksum file not available, skipping verification." -ForegroundColor Yellow
+    }
+    if ($checksumDownloaded) {
+        $expectedHash = (Get-Content $checksumPath -Raw).Split(" ")[0].Trim().ToLower()
+        $actualHash = (Get-FileHash $archivePath -Algorithm SHA256).Hash.ToLower()
+        if ($expectedHash -ne $actualHash) {
+            Write-Host "  Checksum verification FAILED!" -ForegroundColor Red
+            Write-Host "    Expected: $expectedHash" -ForegroundColor Red
+            Write-Host "    Got:      $actualHash" -ForegroundColor Red
+            Remove-Item -Recurse -Force $tempDir -ErrorAction SilentlyContinue
+            exit 1
+        }
+        Write-Host "  Checksum verified." -ForegroundColor Green
+    }
+
+    # Extract
+    Expand-Archive -Path $archivePath -DestinationPath $tempDir -Force
+    $exePath = Join-Path $tempDir "openfang.exe"
+    if (-not (Test-Path $exePath)) {
+        # May be nested in a directory
+        $found = Get-ChildItem -Path $tempDir -Filter "openfang.exe" -Recurse | Select-Object -First 1
+        if ($found) {
+            $exePath = $found.FullName
+        }
+        else {
+            Write-Host "  Could not find openfang.exe in archive." -ForegroundColor Red
+            Remove-Item -Recurse -Force $tempDir -ErrorAction SilentlyContinue
+            exit 1
+        }
+    }
+
+    # Install
+    Copy-Item -Path $exePath -Destination (Join-Path $InstallDir "openfang.exe") -Force
+
+    # Clean up temp
+    Remove-Item -Recurse -Force $tempDir -ErrorAction SilentlyContinue
+
+    # Add to user PATH if not already present
+    $currentPath = [Environment]::GetEnvironmentVariable("Path", "User")
+    if ($currentPath -notlike "*$InstallDir*") {
+        [Environment]::SetEnvironmentVariable("Path", "$InstallDir;$currentPath", "User")
+        Write-Host "  Added $InstallDir to user PATH." -ForegroundColor Green
+        Write-Host "  Restart your terminal for PATH changes to take effect." -ForegroundColor Yellow
+    }
+
+    # Verify
+    $installedExe = Join-Path $InstallDir "openfang.exe"
+    if (Test-Path $installedExe) {
+        try {
+            $versionOutput = & $installedExe --version 2>&1
+            Write-Host ""
+            Write-Host "  OpenFang installed successfully! ($versionOutput)" -ForegroundColor Green
+        }
+        catch {
+            Write-Host ""
+            Write-Host "  OpenFang binary installed to $installedExe" -ForegroundColor Green
+        }
+    }
+
+    Write-Host ""
+    Write-Host "  Get started:" -ForegroundColor Cyan
+    Write-Host "    openfang init"
+    Write-Host ""
+    Write-Host "  The setup wizard will guide you through provider selection"
+    Write-Host "  and configuration."
+    Write-Host ""
+}
+
+Install-OpenFang

scripts/install.sh

@@ -0,0 +1,236 @@
+#!/usr/bin/env bash
+# OpenFang installer — works on Linux, macOS, WSL
+# Usage: curl -sSf https://openfang.sh | sh
+#
+# Environment variables:
+#   OPENFANG_INSTALL_DIR  — custom install directory (default: ~/.openfang/bin)
+#   OPENFANG_VERSION      — install a specific version tag (default: latest)
+
+set -euo pipefail
+
+REPO="RightNow-AI/openfang"
+INSTALL_DIR="${OPENFANG_INSTALL_DIR:-$HOME/.openfang/bin}"
+
+detect_platform() {
+    OS=$(uname -s | tr '[:upper:]' '[:lower:]')
+    ARCH=$(uname -m)
+    case "$ARCH" in
+        x86_64|amd64) ARCH="x86_64" ;;
+        aarch64|arm64) ARCH="aarch64" ;;
+        *) echo "  Unsupported architecture: $ARCH"; exit 1 ;;
+    esac
+    case "$OS" in
+        linux) PLATFORM="${ARCH}-unknown-linux-gnu" ;;
+        darwin) PLATFORM="${ARCH}-apple-darwin" ;;
+        mingw*|msys*|cygwin*)
+            echo ""
+            echo "  For Windows, use PowerShell instead:"
+            echo "    irm https://openfang.sh/install.ps1 | iex"
+            echo ""
+            echo "  Or download the .msi installer from:"
+            echo "    https://github.com/$REPO/releases/latest"
+            echo ""
+            echo "  Or install via cargo:"
+            echo "    cargo install --git https://github.com/$REPO openfang-cli"
+            exit 1
+            ;;
+        *) echo "  Unsupported OS: $OS"; exit 1 ;;
+    esac
+}
+
+install() {
+    detect_platform
+
+    echo ""
+    echo "  OpenFang Installer"
+    echo "  =================="
+    echo ""
+
+    # Get latest version with binary assets
+    if [ -n "${OPENFANG_VERSION:-}" ]; then
+        VERSION="$OPENFANG_VERSION"
+        echo "  Using specified version: $VERSION"
+    else
+        echo "  Fetching latest release..."
+        # Find the most recent release that has binary assets (skip empty tag-only releases)
+        VERSION=$(curl -fsSL "https://api.github.com/repos/$REPO/releases?per_page=10" | \
+            grep -E '"tag_name"|"assets":\[' | \
+            paste - - | \
+            grep -v '"assets":\[\]' | \
+            head -1 | \
+            sed 's/.*"tag_name": *"//' | sed 's/".*//')
+        # Fallback to /releases/latest if the above fails
+        if [ -z "$VERSION" ]; then
+            VERSION=$(curl -fsSL "https://api.github.com/repos/$REPO/releases/latest" | grep '"tag_name"' | sed 's/.*"tag_name": *"//' | sed 's/".*//')
+        fi
+    fi
+
+    if [ -z "$VERSION" ]; then
+        echo "  Could not determine latest version."
+        echo "  Install from source instead:"
+        echo "    cargo install --git https://github.com/$REPO openfang-cli"
+        exit 1
+    fi
+
+    URL="https://github.com/$REPO/releases/download/$VERSION/openfang-$PLATFORM.tar.gz"
+    CHECKSUM_URL="$URL.sha256"
+
+    echo "  Installing OpenFang $VERSION for $PLATFORM..."
+    mkdir -p "$INSTALL_DIR"
+
+    # Download to temp
+    TMPDIR=$(mktemp -d)
+    ARCHIVE="$TMPDIR/openfang.tar.gz"
+    CHECKSUM_FILE="$TMPDIR/checksum.sha256"
+
+    cleanup() { rm -rf "$TMPDIR"; }
+    trap cleanup EXIT
+
+    if ! curl -fsSL "$URL" -o "$ARCHIVE" 2>/dev/null; then
+        echo "  Download failed. The release may not exist for your platform."
+        echo "  Install from source instead:"
+        echo "    cargo install --git https://github.com/$REPO openfang-cli"
+        exit 1
+    fi
+
+    # Verify checksum if available
+    if curl -fsSL "$CHECKSUM_URL" -o "$CHECKSUM_FILE" 2>/dev/null; then
+        EXPECTED=$(cut -d ' ' -f 1 < "$CHECKSUM_FILE")
+        if command -v sha256sum &>/dev/null; then
+            ACTUAL=$(sha256sum "$ARCHIVE" | cut -d ' ' -f 1)
+        elif command -v shasum &>/dev/null; then
+            ACTUAL=$(shasum -a 256 "$ARCHIVE" | cut -d ' ' -f 1)
+        else
+            ACTUAL=""
+        fi
+        if [ -n "$ACTUAL" ]; then
+            if [ "$EXPECTED" != "$ACTUAL" ]; then
+                echo "  Checksum verification FAILED!"
+                echo "    Expected: $EXPECTED"
+                echo "    Got:      $ACTUAL"
+                exit 1
+            fi
+            echo "  Checksum verified."
+        else
+            echo "  No sha256sum/shasum found, skipping checksum verification."
+        fi
+    fi
+
+    # Extract
+    tar xzf "$ARCHIVE" -C "$INSTALL_DIR"
+    chmod +x "$INSTALL_DIR/openfang"
+
+    # Ad-hoc codesign on macOS (prevents SIGKILL on Apple Silicon)
+    # Must strip extended attributes (com.apple.quarantine) BEFORE signing,
+    # otherwise the signature is computed over the quarantine xattr and macOS
+    # rejects it as "Code Signature Invalid" → SIGKILL.
+    if [ "$OS" = "darwin" ]; then
+        if command -v xattr &>/dev/null; then
+            xattr -cr "$INSTALL_DIR/openfang" 2>/dev/null || true
+        fi
+        if command -v codesign &>/dev/null; then
+            if ! codesign --force --sign - "$INSTALL_DIR/openfang"; then
+                echo ""
+                echo "  Warning: ad-hoc code signing failed."
+                echo "  On Apple Silicon, the binary may be killed (SIGKILL) by Gatekeeper."
+                echo "  Try manually: xattr -cr $INSTALL_DIR/openfang && codesign --force --sign - $INSTALL_DIR/openfang"
+                echo ""
+            fi
+        fi
+    fi
+
+    # Add to PATH — detect the user's login shell
+    USER_SHELL="${SHELL:-}"
+    # Fallback: check /etc/passwd if $SHELL is unset (e.g. minimal containers)
+    if [ -z "$USER_SHELL" ] && command -v getent &>/dev/null; then
+        USER_SHELL=$(getent passwd "$(id -un)" 2>/dev/null | cut -d: -f7)
+    fi
+    if [ -z "$USER_SHELL" ] && [ -f /etc/passwd ]; then
+        USER_SHELL=$(grep "^$(id -un):" /etc/passwd 2>/dev/null | cut -d: -f7)
+    fi
+
+    # Fish shell: write to ~/.config/fish/conf.d/openfang.fish (drop-in dir).
+    # This keeps the user's config.fish completely untouched, so a broken
+    # PATH entry can never wedge the user's main shell config — critical
+    # on Arch/CachyOS where the desktop session sources fish on login.
+    USE_FISH_DROPIN=0
+    case "$USER_SHELL" in
+        */fish) USE_FISH_DROPIN=1 ;;
+    esac
+    # If $USER_SHELL didn't match fish but config.fish exists AND no other
+    # rc files exist, the user is likely a fish user — use the drop-in too.
+    if [ "$USE_FISH_DROPIN" -eq 0 ] \
+        && [ -f "$HOME/.config/fish/config.fish" ] \
+        && [ ! -f "$HOME/.bashrc" ] \
+        && [ ! -f "$HOME/.zshrc" ]; then
+        USE_FISH_DROPIN=1
+    fi
+
+    if [ "$USE_FISH_DROPIN" -eq 1 ]; then
+        FISH_CONF_DIR="$HOME/.config/fish/conf.d"
+        FISH_DROPIN="$FISH_CONF_DIR/openfang.fish"
+        mkdir -p "$FISH_CONF_DIR"
+        if [ ! -f "$FISH_DROPIN" ]; then
+            # Guarded with `test -d` so a missing/broken install dir never
+            # breaks fish startup (which would black-screen Arch/CachyOS
+            # desktop sessions that source fish at login).
+            cat > "$FISH_DROPIN" <<EOF
+# OpenFang PATH — auto-generated by installer
+if test -d "$INSTALL_DIR"
+    fish_add_path -g "$INSTALL_DIR"
+end
+EOF
+            echo "  Added $INSTALL_DIR to PATH via $FISH_DROPIN"
+        fi
+        # Best-effort: clean up legacy bash-syntax export from config.fish
+        # written by older OpenFang installers (<v0.5.0). Harmless if absent.
+        OLD_FISH_RC="$HOME/.config/fish/config.fish"
+        if [ -f "$OLD_FISH_RC" ] && grep -q "openfang/bin" "$OLD_FISH_RC" 2>/dev/null; then
+            # Remove any line containing .openfang/bin (covers both bash
+            # `export PATH=` syntax and old fish `set -gx PATH` lines).
+            TMPFILE=$(mktemp)
+            grep -v "openfang/bin" "$OLD_FISH_RC" > "$TMPFILE" || true
+            mv "$TMPFILE" "$OLD_FISH_RC"
+            echo "  Cleaned legacy openfang PATH entry from $OLD_FISH_RC"
+        fi
+    else
+        SHELL_RC=""
+        case "$USER_SHELL" in
+            */zsh)  SHELL_RC="$HOME/.zshrc" ;;
+            */bash) SHELL_RC="$HOME/.bashrc" ;;
+        esac
+        # Fall back to existing rc files when shell detection failed.
+        if [ -z "$SHELL_RC" ]; then
+            if [ -f "$HOME/.bashrc" ]; then
+                SHELL_RC="$HOME/.bashrc"
+            elif [ -f "$HOME/.zshrc" ]; then
+                SHELL_RC="$HOME/.zshrc"
+            fi
+        fi
+
+        if [ -n "$SHELL_RC" ] && ! grep -q "openfang" "$SHELL_RC" 2>/dev/null; then
+            echo "export PATH=\"$INSTALL_DIR:\$PATH\"" >> "$SHELL_RC"
+            echo "  Added $INSTALL_DIR to PATH in $SHELL_RC"
+        fi
+    fi
+
+    # Verify installation
+    if "$INSTALL_DIR/openfang" --version >/dev/null 2>&1; then
+        INSTALLED_VERSION=$("$INSTALL_DIR/openfang" --version 2>/dev/null || echo "$VERSION")
+        echo ""
+        echo "  OpenFang installed successfully! ($INSTALLED_VERSION)"
+    else
+        echo ""
+        echo "  OpenFang binary installed to $INSTALL_DIR/openfang"
+    fi
+
+    echo ""
+    echo "  Get started:"
+    echo "    openfang init"
+    echo ""
+    echo "  The setup wizard will guide you through provider selection"
+    echo "  and configuration."
+    echo ""
+}
+
+install