@agentdocumentformat/cli 0.7.7 → 0.8.0

package/dist/chunks/chunk-V3MM6PCH.mjs

@@ -0,0 +1,366 @@
+import { createRequire as __adfCreateRequire } from 'node:module';
+import { fileURLToPath as __adfFileURLToPath } from 'node:url';
+import { dirname as __adfDirname } from 'node:path';
+const require = __adfCreateRequire(import.meta.url);
+const __filename = __adfFileURLToPath(import.meta.url);
+const __dirname = __adfDirname(__filename);
+
+// src/main/daemon/remote-access/network-category.ts
+import { execFile } from "node:child_process";
+import { createSocket } from "node:dgram";
+import { readFile } from "node:fs/promises";
+var defaultExec = (file, args, opts = {}) => new Promise((resolve, reject) => {
+  execFile(file, args, { windowsHide: !0, timeout: opts.timeoutMs ?? 5e3, maxBuffer: 4 * 1024 * 1024 }, (err, stdout) => {
+    err ? reject(err) : resolve(String(stdout));
+  });
+}), DARWIN_TOOLS = {
+  netstat: "/usr/sbin/netstat",
+  arp: "/usr/sbin/arp",
+  ipconfig: "/usr/sbin/ipconfig"
+};
+async function execDarwinTool(exec, tool, args, opts) {
+  try {
+    return await exec(DARWIN_TOOLS[tool], args, opts);
+  } catch (err) {
+    if (err?.code !== "ENOENT") throw err;
+    return exec(tool, args, opts);
+  }
+}
+function errorDetail(what, err) {
+  let text = err instanceof Error ? err.message : String(err);
+  return `${what}: ${text.split(/\r?\n/)[0]}`.slice(0, 200);
+}
+function parseWindowsProfiles(json) {
+  let out = /* @__PURE__ */ new Map(), text = json.trim();
+  if (!text) return out;
+  let parsed = JSON.parse(text), rows = Array.isArray(parsed) ? parsed : [parsed];
+  for (let row of rows) {
+    if (!row || typeof row != "object") continue;
+    let alias = row.InterfaceAlias, category = row.NetworkCategory;
+    if (typeof alias != "string") continue;
+    let isPrivate = category === 1 || category === 2 || category === "Private" || category === "DomainAuthenticated";
+    out.get(alias) !== "public" && out.set(alias, isPrivate ? "private" : "public");
+  }
+  return out;
+}
+var WINDOWS_PROFILE_COMMAND = "Get-NetConnectionProfile | Select-Object InterfaceAlias,NetworkCategory | ConvertTo-Json -Compress";
+function parseDarwinDefaultRoutes(text) {
+  let out = /* @__PURE__ */ new Map();
+  for (let line of text.split(/\r?\n/)) {
+    let cols = line.trim().split(/\s+/);
+    if (cols[0] !== "default" || cols.length < 4) continue;
+    let gateway = cols[1], iface = cols.slice(3).find((c) => !/^\d+$/.test(c));
+    !iface || !/^\d{1,3}(\.\d{1,3}){3}$/.test(gateway) || out.has(iface) || out.set(iface, gateway);
+  }
+  return out;
+}
+function parseDarwinArp(text) {
+  let out = /* @__PURE__ */ new Map();
+  for (let line of text.split(/\r?\n/)) {
+    let match = /\((\d{1,3}(?:\.\d{1,3}){3})\) at ([0-9a-f:]+) on (\S+)/i.exec(line);
+    match && out.set(`${match[3]}|${match[1]}`, normalizeMac(match[2]));
+  }
+  return out;
+}
+function parseLinuxRoutes(text) {
+  let out = /* @__PURE__ */ new Map();
+  for (let line of text.split(/\r?\n/).slice(1)) {
+    let cols = line.trim().split(/\s+/);
+    if (cols.length < 3 || cols[1] !== "00000000" || cols[2] === "00000000") continue;
+    let hex = cols[2];
+    if (!/^[0-9A-Fa-f]{8}$/.test(hex)) continue;
+    let bytes = [hex.slice(6, 8), hex.slice(4, 6), hex.slice(2, 4), hex.slice(0, 2)].map((h) => Number.parseInt(h, 16));
+    out.has(cols[0]) || out.set(cols[0], bytes.join("."));
+  }
+  return out;
+}
+function parseLinuxArp(text) {
+  let out = /* @__PURE__ */ new Map();
+  for (let line of text.split(/\r?\n/).slice(1)) {
+    let cols = line.trim().split(/\s+/);
+    cols.length < 6 || cols[3] === "00:00:00:00:00:00" || out.set(`${cols[5]}|${cols[0]}`, normalizeMac(cols[3]));
+  }
+  return out;
+}
+function normalizeMac(mac) {
+  return mac.toLowerCase().split(":").map((part) => part.padStart(2, "0")).join(":");
+}
+function parseWindowsRoutes(text) {
+  let out = /* @__PURE__ */ new Map(), ipv4 = /^\d{1,3}(\.\d{1,3}){3}$/;
+  for (let line of text.split(/\r?\n/)) {
+    let cols = line.trim().split(/\s+/);
+    cols.length < 5 || cols[0] !== "0.0.0.0" || cols[1] !== "0.0.0.0" || !ipv4.test(cols[2]) || !ipv4.test(cols[3]) || out.has(cols[3]) || out.set(cols[3], cols[2]);
+  }
+  return out;
+}
+function parseWindowsArp(text) {
+  let out = /* @__PURE__ */ new Map(), iface = null;
+  for (let line of text.split(/\r?\n/)) {
+    let head = /^Interface:\s+(\d{1,3}(?:\.\d{1,3}){3})\b/.exec(line.trim());
+    if (head) {
+      iface = head[1];
+      continue;
+    }
+    let row = /^(\d{1,3}(?:\.\d{1,3}){3})\s+([0-9a-f]{2}(?:-[0-9a-f]{2}){5})\s/i.exec(line.trim() + " ");
+    row && iface && out.set(`${iface}|${row[1]}`, row[2].toLowerCase().replace(/-/g, ":"));
+  }
+  return out;
+}
+async function readGatewayReadings(ifaces, interfaces, deps = {}) {
+  let platform = deps.platform ?? process.platform, exec = deps.exec ?? defaultExec, readText = deps.readText ?? ((path) => readFile(path, "utf-8")), probe = deps.probe ?? udpProbe, sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms))), out = /* @__PURE__ */ new Map();
+  if (ifaces.length === 0) return out;
+  let routeTool = platform === "win32" ? "route print -4 0.0.0.0" : platform === "darwin" ? "netstat -rn -f inet" : "/proc/net/route", routes;
+  try {
+    routes = platform === "win32" ? parseWindowsRoutes(await exec("route", ["print", "-4", "0.0.0.0"])) : platform === "darwin" ? parseDarwinDefaultRoutes(await execDarwinTool(exec, "netstat", ["-rn", "-f", "inet"])) : parseLinuxRoutes(await readText("/proc/net/route"));
+  } catch (err) {
+    let problem = { step: "route_read", detail: errorDetail(routeTool, err) };
+    for (let iface of ifaces) out.set(iface, { gateway: null, mac: null, problem });
+    return out;
+  }
+  let targets = [], ipv4 = (iface) => (interfaces[iface] ?? []).find((i) => !i.internal && (i.family === "IPv4" || i.family === 4))?.address ?? null;
+  for (let iface of ifaces) {
+    let target = null;
+    if (platform === "win32")
+      for (let info of interfaces[iface] ?? []) {
+        let gateway = routes.get(info.address);
+        if (gateway) {
+          target = { iface, gateway, from: info.address, arpKey: `${info.address}|${gateway}` };
+          break;
+        }
+      }
+    else {
+      let gateway = routes.get(iface);
+      gateway && (target = { iface, gateway, from: ipv4(iface), arpKey: `${iface}|${gateway}` });
+    }
+    target ? targets.push(target) : out.set(iface, { gateway: null, mac: null, problem: { step: "no_gateway", detail: `no default route on ${iface} (${routeTool})` } });
+  }
+  let arpTool = platform === "win32" ? "arp -a" : platform === "darwin" ? "arp -an" : "/proc/net/arp", readArp = async () => platform === "win32" ? parseWindowsArp(await exec("arp", ["-a"])) : platform === "darwin" ? parseDarwinArp(await execDarwinTool(exec, "arp", ["-an"])) : parseLinuxArp(await readText("/proc/net/arp")), probeErrors = /* @__PURE__ */ new Map(), pending = targets;
+  for (let attempt = 0; attempt < ARP_PROBE_TRIES && pending.length > 0; attempt++) {
+    attempt > 0 && await sleep(ARP_PROBE_WAIT_MS), await Promise.all(pending.map(async (t) => {
+      let error = await probe(t.gateway, t.from).catch((err) => err instanceof Error ? err.message : String(err));
+      typeof error == "string" && error && probeErrors.set(t.iface, error);
+    }));
+    let arp;
+    try {
+      arp = await readArp();
+    } catch (err) {
+      let problem = { step: "arp_read", detail: errorDetail(arpTool, err) };
+      for (let t of pending) out.set(t.iface, { gateway: t.gateway, mac: null, problem });
+      return out;
+    }
+    let missing = [];
+    for (let t of pending) {
+      let mac = arp.get(t.arpKey) ?? null, probeError = probeErrors.get(t.iface);
+      out.set(t.iface, {
+        gateway: t.gateway,
+        mac,
+        problem: mac ? null : { step: "no_answer", detail: `no ARP entry for ${t.gateway} on ${t.iface} after ${attempt + 1} probe(s)${probeError ? ` (probe: ${probeError})` : ""}` }
+      }), mac || missing.push(t);
+    }
+    pending = missing;
+  }
+  return out;
+}
+var ARP_PROBE_TRIES = 3, ARP_PROBE_WAIT_MS = 200;
+async function udpProbe(gateway, from) {
+  let first = await sendOnce(gateway, from);
+  if (!first?.startsWith("bind: ")) return first;
+  let second = await sendOnce(gateway, null);
+  return second ? `${first}; unbound: ${second}` : null;
+}
+function sendOnce(gateway, bindTo) {
+  return new Promise((resolve) => {
+    let done = !1, bound = !bindTo, socket = createSocket("udp4"), finish = (error) => {
+      if (!done) {
+        done = !0;
+        try {
+          socket.close();
+        } catch {
+        }
+        resolve(error);
+      }
+    };
+    socket.on("error", (err) => finish(`${bound ? "" : "bind: "}${err.message}`));
+    let send = () => {
+      bound = !0;
+      try {
+        socket.send(Buffer.from([0]), 9, gateway, (err) => finish(err ? err.message : null));
+      } catch (err) {
+        finish(err instanceof Error ? err.message : String(err));
+      }
+    };
+    try {
+      bindTo ? socket.bind({ address: bindTo, port: 0, exclusive: !0 }, send) : send();
+    } catch (err) {
+      finish(`${bindTo ? "bind: " : ""}${err instanceof Error ? err.message : String(err)}`);
+    }
+    setTimeout(() => finish(null), 500).unref?.();
+  });
+}
+async function readOsCategories(ifaces, deps = {}) {
+  let platform = deps.platform ?? process.platform, exec = deps.exec ?? defaultExec;
+  if (platform !== "win32" || ifaces.length === 0) return /* @__PURE__ */ new Map();
+  try {
+    let profiles = parseWindowsProfiles(await exec("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", WINDOWS_PROFILE_COMMAND], { timeoutMs: 1e4 }));
+    return new Map(ifaces.filter((i) => profiles.has(i)).map((i) => [i, profiles.get(i)]));
+  } catch {
+    return /* @__PURE__ */ new Map();
+  }
+}
+async function readWifiNames(ifaces, deps = {}) {
+  let platform = deps.platform ?? process.platform, exec = deps.exec ?? defaultExec, out = /* @__PURE__ */ new Map();
+  if (platform !== "linux" && platform !== "darwin") return out;
+  for (let iface of ifaces)
+    try {
+      let ssid = platform === "linux" ? (await exec("iwgetid", [iface, "-r"], { timeoutMs: 2e3 })).trim() : parseDarwinSummarySsid(await execDarwinTool(exec, "ipconfig", ["getsummary", iface], { timeoutMs: 2e3 }));
+      ssid && out.set(iface, ssid);
+    } catch {
+    }
+  return out;
+}
+function parseDarwinSummarySsid(text) {
+  let match = /^\s*SSID\s*:\s*(.+?)\s*$/m.exec(text);
+  return !match || match[1] === "<redacted>" ? null : match[1];
+}
+
+// src/main/daemon/remote-access/tailscale.ts
+var CANDIDATES = process.platform === "win32" ? ["tailscale", "C:\\Program Files\\Tailscale\\tailscale.exe"] : ["tailscale", "/opt/homebrew/bin/tailscale", "/usr/local/bin/tailscale", "/Applications/Tailscale.app/Contents/MacOS/Tailscale"], ABSENT_RECHECK_MS = 5 * 6e4;
+function tailnetNameOf(self) {
+  if (self.state !== "running") return null;
+  if (self.tailnet) return self.tailnet;
+  let dns = self.dnsName?.toLowerCase() ?? "";
+  return dns.includes(".") ? dns.slice(dns.indexOf(".") + 1) : null;
+}
+function parseTailscaleStatus(json) {
+  let status = JSON.parse(json), running = status.BackendState === "Running", ips = Array.isArray(status.Self?.TailscaleIPs) ? status.Self.TailscaleIPs.filter((ip) => typeof ip == "string").map((ip) => ip.toLowerCase()) : [], dns = typeof status.Self?.DNSName == "string" ? status.Self.DNSName.replace(/\.$/, "") : "", name = [status.CurrentTailnet?.Name, status.CurrentTailnet?.MagicDNSSuffix, status.MagicDNSSuffix].find((v) => typeof v == "string" && v.length > 0);
+  return { state: running ? "running" : "stopped", ips: running ? ips : [], dnsName: running && dns ? dns : null, tailnet: running && name ? name.replace(/\.$/, "").toLowerCase() : null };
+}
+function parseServeStatus(json, port) {
+  let text = json.trim();
+  if (!text || text === "{}" || text === "null") return { serve: "off", httpsUrl: null };
+  let status = JSON.parse(text);
+  for (let [hostPort, web] of Object.entries(status.Web ?? {}))
+    for (let handler of Object.values(web.Handlers ?? {})) {
+      let proxy = typeof handler.Proxy == "string" ? handler.Proxy : "";
+      if (new RegExp(`^(https?://)?(127\\.0\\.0\\.1|localhost):${port}/?$`).test(proxy)) {
+        let [host, p] = [hostPort.slice(0, hostPort.lastIndexOf(":")), hostPort.slice(hostPort.lastIndexOf(":") + 1)];
+        return { serve: "on", httpsUrl: p === "443" ? `https://${host}` : `https://${host}:${p}` };
+      }
+    }
+  return { serve: "off", httpsUrl: null };
+}
+var NO_TAILNET = { running: !1, suffix: null, peerIps: /* @__PURE__ */ new Set(), peerNames: /* @__PURE__ */ new Set() };
+function parseTailnetView(json) {
+  let status = JSON.parse(json);
+  if (status.BackendState !== "Running") return NO_TAILNET;
+  let clean = (v) => typeof v == "string" && v ? v.replace(/\.$/, "").toLowerCase() : null, selfName = clean(status.Self?.DNSName), suffix = clean(status.MagicDNSSuffix) ?? clean(status.CurrentTailnet?.MagicDNSSuffix) ?? (selfName && selfName.includes(".") ? selfName.slice(selfName.indexOf(".") + 1) : null), peerIps = /* @__PURE__ */ new Set(), peerNames = /* @__PURE__ */ new Set();
+  for (let p of Object.values(status.Peer ?? {})) {
+    for (let ip of Array.isArray(p.TailscaleIPs) ? p.TailscaleIPs : []) typeof ip == "string" && peerIps.add(ip.toLowerCase());
+    let name = clean(p.DNSName);
+    name && peerNames.add(name);
+  }
+  return { running: !0, suffix, peerIps, peerNames };
+}
+function tailnetUrlAllowed(raw, view) {
+  if (!view.running) return !1;
+  let u;
+  try {
+    u = new URL(raw);
+  } catch {
+    return !1;
+  }
+  if (u.username || u.password) return !1;
+  let host = u.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  return u.protocol === "http:" ? view.peerIps.has(host) : u.protocol !== "https:" ? !1 : view.peerNames.has(host) || !!view.suffix && /\.ts\.net$/.test(view.suffix) && host.endsWith(`.${view.suffix}`);
+}
+var TailscaleClient = class {
+  constructor(exec = defaultExec, now = Date.now) {
+    this.exec = exec;
+    this.now = now;
+  }
+  exec;
+  now;
+  bin;
+  absentUntil = 0;
+  async run(args, timeoutMs = 5e3) {
+    if (this.bin === null && this.now() < this.absentUntil) return null;
+    if (this.bin) return await this.exec(this.bin, args, { timeoutMs });
+    for (let candidate of CANDIDATES)
+      try {
+        let out = await this.exec(candidate, args, { timeoutMs });
+        return this.bin = candidate, out;
+      } catch (err) {
+        if (err?.code !== "ENOENT")
+          throw this.bin = candidate, err;
+      }
+    return this.bin = null, this.absentUntil = this.now() + ABSENT_RECHECK_MS, null;
+  }
+  get command() {
+    return this.bin ?? null;
+  }
+  async self() {
+    try {
+      let out = await this.run(["status", "--json"]);
+      return out === null ? { state: "absent", ips: [], dnsName: null } : parseTailscaleStatus(out);
+    } catch {
+      return { state: "stopped", ips: [], dnsName: null };
+    }
+  }
+  async serveStatus(port) {
+    try {
+      let out = await this.run(["serve", "status", "--json"]);
+      return out === null ? { serve: "unknown", httpsUrl: null } : parseServeStatus(out, port);
+    } catch {
+      return { serve: "unknown", httpsUrl: null };
+    }
+  }
+  serveCommand(port, enabled) {
+    return enabled ? ["serve", "--bg", String(port)] : ["serve", "--https=443", "off"];
+  }
+  /** Run `tailscale serve` (on) or remove the https:443 entry when it forwards to this daemon (off). Returns the command's output; throws with it. */
+  async setServe(port, enabled) {
+    if (!enabled) {
+      let current = await this.serveStatus(port);
+      if (current.serve !== "on") return "tailscale serve does not forward to this daemon; nothing changed.";
+      if (current.httpsUrl && /:\d+$/.test(current.httpsUrl.replace(/^https:\/\//, "")))
+        throw new Error(`tailscale serve forwards ${current.httpsUrl} to this daemon on a port other than 443; remove it with the tailscale CLI.`);
+    }
+    let out = await this.run(this.serveCommand(port, enabled), 2e4);
+    if (out === null) throw new Error("Tailscale is not installed on this computer.");
+    return out.trim();
+  }
+  /** This computer's tailnet: suffix and peers (NO_TAILNET without a running Tailscale). */
+  async tailnetView() {
+    try {
+      let out = await this.run(["status", "--json"]);
+      return out === null ? NO_TAILNET : parseTailnetView(out);
+    } catch {
+      return NO_TAILNET;
+    }
+  }
+  /** The Tailscale login of a tailnet peer, or null. */
+  async whois(address) {
+    try {
+      let out = await this.run(["whois", "--json", address]);
+      if (!out) return null;
+      let parsed = JSON.parse(out);
+      return typeof parsed.UserProfile?.LoginName == "string" ? parsed.UserProfile.LoginName : null;
+    } catch {
+      return null;
+    }
+  }
+};
+
+export {
+  defaultExec,
+  readGatewayReadings,
+  readOsCategories,
+  readWifiNames,
+  tailnetNameOf,
+  parseTailscaleStatus,
+  parseServeStatus,
+  NO_TAILNET,
+  parseTailnetView,
+  tailnetUrlAllowed,
+  TailscaleClient
+};

package/dist/chunks/chunk-WJGPNHGX.mjs

@@ -0,0 +1,67 @@
+import { createRequire as __adfCreateRequire } from 'node:module';
+import { fileURLToPath as __adfFileURLToPath } from 'node:url';
+import { dirname as __adfDirname } from 'node:path';
+const require = __adfCreateRequire(import.meta.url);
+const __filename = __adfFileURLToPath(import.meta.url);
+const __dirname = __adfDirname(__filename);
+import {
+  defaultUserDataPath
+} from "./chunk-PAK5JCO2.mjs";
+import {
+  protectSecretFile
+} from "./chunk-LTX74NU6.mjs";
+
+// src/main/daemon/daemon-token.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+var DAEMON_TOKEN_FILENAME = "daemon-token", MIN_TOKEN_LENGTH = 32;
+function daemonTokenPath(settingsDir) {
+  return join(settingsDir, DAEMON_TOKEN_FILENAME);
+}
+function daemonSettingsDir(env = process.env) {
+  let settingsFile = env.ADF_DAEMON_SETTINGS ?? join(defaultUserDataPath({ quiet: !0 }), "adf-settings.json");
+  return dirname(settingsFile);
+}
+function validToken(raw) {
+  let token = raw.trim();
+  return token.length >= MIN_TOKEN_LENGTH && /^[A-Za-z0-9_-]+$/.test(token) ? token : null;
+}
+function readDaemonToken(settingsDir) {
+  try {
+    return validToken(readFileSync(daemonTokenPath(settingsDir), "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function ensureDaemonToken(settingsDir) {
+  let path = daemonTokenPath(settingsDir), existing = readDaemonToken(settingsDir);
+  if (existing)
+    return protectSecretFile(path), { token: existing, path, created: !1 };
+  mkdirSync(settingsDir, { recursive: !0 });
+  let token = randomBytes(32).toString("base64url");
+  if (!existsSync(path))
+    try {
+      return writeFileSync(path, `${token}
+`, { mode: 384, flag: "wx" }), protectSecretFile(path), { token, path, created: !0 };
+    } catch (err) {
+      if (err?.code !== "EEXIST") throw err;
+      let raced = readDaemonToken(settingsDir);
+      if (raced) return { token: raced, path, created: !1 };
+    }
+  return writeFileSync(path, `${token}
+`, { mode: 384 }), protectSecretFile(path), { token, path, created: !0 };
+}
+function tokensEqual(presented, expected) {
+  let a = createHash("sha256").update(presented, "utf-8").digest(), b = createHash("sha256").update(expected, "utf-8").digest();
+  return timingSafeEqual(a, b);
+}
+
+export {
+  DAEMON_TOKEN_FILENAME,
+  daemonTokenPath,
+  daemonSettingsDir,
+  readDaemonToken,
+  ensureDaemonToken,
+  tokensEqual
+};