@agentdocumentformat/cli 0.7.8 → 0.8.1

package/dist/chunks/chunk-KDDVQKCG.mjs

@@ -0,0 +1,65 @@
+import { createRequire as __adfCreateRequire } from 'node:module';
+import { fileURLToPath as __adfFileURLToPath } from 'node:url';
+import { dirname as __adfDirname } from 'node:path';
+const require = __adfCreateRequire(import.meta.url);
+const __filename = __adfFileURLToPath(import.meta.url);
+const __dirname = __adfDirname(__filename);
+import {
+  __commonJS
+} from "./chunk-M2RX3S2T.mjs";
+
+// node_modules/fast-deep-equal/es6/index.js
+var require_es6 = __commonJS({
+  "node_modules/fast-deep-equal/es6/index.js"(exports, module) {
+    "use strict";
+    module.exports = function equal(a, b) {
+      if (a === b) return !0;
+      if (a && b && typeof a == "object" && typeof b == "object") {
+        if (a.constructor !== b.constructor) return !1;
+        var length, i, keys;
+        if (Array.isArray(a)) {
+          if (length = a.length, length != b.length) return !1;
+          for (i = length; i-- !== 0; )
+            if (!equal(a[i], b[i])) return !1;
+          return !0;
+        }
+        if (a instanceof Map && b instanceof Map) {
+          if (a.size !== b.size) return !1;
+          for (i of a.entries())
+            if (!b.has(i[0])) return !1;
+          for (i of a.entries())
+            if (!equal(i[1], b.get(i[0]))) return !1;
+          return !0;
+        }
+        if (a instanceof Set && b instanceof Set) {
+          if (a.size !== b.size) return !1;
+          for (i of a.entries())
+            if (!b.has(i[0])) return !1;
+          return !0;
+        }
+        if (ArrayBuffer.isView(a) && ArrayBuffer.isView(b)) {
+          if (length = a.length, length != b.length) return !1;
+          for (i = length; i-- !== 0; )
+            if (a[i] !== b[i]) return !1;
+          return !0;
+        }
+        if (a.constructor === RegExp) return a.source === b.source && a.flags === b.flags;
+        if (a.valueOf !== Object.prototype.valueOf) return a.valueOf() === b.valueOf();
+        if (a.toString !== Object.prototype.toString) return a.toString() === b.toString();
+        if (keys = Object.keys(a), length = keys.length, length !== Object.keys(b).length) return !1;
+        for (i = length; i-- !== 0; )
+          if (!Object.prototype.hasOwnProperty.call(b, keys[i])) return !1;
+        for (i = length; i-- !== 0; ) {
+          var key = keys[i];
+          if (!equal(a[key], b[key])) return !1;
+        }
+        return !0;
+      }
+      return a !== a && b !== b;
+    };
+  }
+});
+
+export {
+  require_es6
+};

package/dist/chunks/chunk-KRPKWOMB.mjs

@@ -0,0 +1,290 @@
+import { createRequire as __adfCreateRequire } from 'node:module';
+import { fileURLToPath as __adfFileURLToPath } from 'node:url';
+import { dirname as __adfDirname } from 'node:path';
+const require = __adfCreateRequire(import.meta.url);
+const __filename = __adfFileURLToPath(import.meta.url);
+const __dirname = __adfDirname(__filename);
+import {
+  startCallbackServer
+} from "./chunk-2NAP2ZF7.mjs";
+import {
+  createSubscriptionTokenStore
+} from "./chunk-C2S64Y6F.mjs";
+import {
+  __require
+} from "./chunk-M2RX3S2T.mjs";
+
+// src/main/providers/chatgpt-subscription/auth-manager.ts
+import crypto from "crypto";
+
+// src/main/providers/chatgpt-subscription/token-store.ts
+var store = createSubscriptionTokenStore("chatgpt-subscription");
+function readTokens() {
+  return store.readTokens();
+}
+function writeTokens(tokens) {
+  store.writeTokens(tokens);
+}
+function clearTokens() {
+  store.clearTokens();
+}
+function noteSignIn(accountId) {
+  store.signedIn(accountId);
+}
+
+// src/main/providers/chatgpt-subscription/auth-manager.ts
+var CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann", AUTH_URL = "https://auth.openai.com/oauth/authorize", TOKEN_URL = "https://auth.openai.com/oauth/token", SCOPE = "openid profile email offline_access api.connectors.read api.connectors.invoke", REFRESH_BUFFER_MS = 300 * 1e3, RELAY_FLOW_TTL_MS = 600 * 1e3;
+function base64url(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function generateCodeVerifier() {
+  let bytes = crypto.getRandomValues(new Uint8Array(64));
+  return base64url(Buffer.from(bytes));
+}
+function generateCodeChallenge(verifier) {
+  let hash = crypto.createHash("sha256").update(verifier).digest();
+  return base64url(hash);
+}
+function generateState() {
+  return base64url(Buffer.from(crypto.getRandomValues(new Uint8Array(32))));
+}
+function decodeJwtPayload(token) {
+  let parts = token.split(".");
+  if (parts.length < 2) return {};
+  try {
+    let payload = Buffer.from(parts[1], "base64url").toString("utf-8");
+    return JSON.parse(payload);
+  } catch {
+    return {};
+  }
+}
+function chatgptAccountIdFromJwt(token) {
+  if (!token) return "";
+  let claims = decodeJwtPayload(token), auth = claims["https://api.openai.com/auth"], id = (auth && typeof auth == "object" ? auth.chatgpt_account_id : void 0) ?? claims.chatgpt_account_id;
+  return typeof id == "string" ? id : "";
+}
+async function openExternal(url) {
+  try {
+    let electron = __require("electron");
+    if (electron.shell?.openExternal) {
+      await electron.shell.openExternal(url);
+      return;
+    }
+  } catch {
+  }
+  console.log(`[ChatGPT Auth] Open this URL to sign in: ${url}`);
+}
+function assertLoopbackRedirect(redirectUri) {
+  let parsed;
+  try {
+    parsed = new URL(redirectUri);
+  } catch {
+    throw new Error(`Invalid redirectUri: ${redirectUri}`);
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+    throw new Error("redirectUri must be an http(s) URL");
+  if (!["localhost", "127.0.0.1", "[::1]", "::1"].includes(parsed.hostname))
+    throw new Error("redirectUri must target localhost \u2014 the OAuth callback runs on the machine with the browser");
+}
+var ChatGptAuthManager = class {
+  refreshPromise = null;
+  cachedTokens = null;
+  email;
+  activeAuthFlow = null;
+  relayFlows = /* @__PURE__ */ new Map();
+  constructor() {
+    this.syncFromDisk();
+  }
+  /**
+   * Re-read the token file, picking up writes from other processes.
+   *
+   * Each surface has its own file (see subscription-token-store), but several
+   * processes can share one — e.g. an installed and a dev Studio, or a CLI
+   * next to its daemon — and OpenAI rotates the refresh token on every
+   * refresh, so acting on a cached copy can invalidate a sibling's session. Always reading is what prevents that; the file is
+   * well under a kilobyte and this runs once per LLM request.
+   */
+  syncFromDisk() {
+    let tokens = readTokens();
+    return tokens?.access_token !== this.cachedTokens?.access_token && (this.email = void 0), this.cachedTokens = tokens, tokens;
+  }
+  persist(tokens) {
+    writeTokens(tokens), this.cachedTokens = tokens;
+  }
+  async startAuthFlow() {
+    await (await this.startAuthFlowDetached()).completion;
+  }
+  async startAuthFlowDetached() {
+    if (this.activeAuthFlow) return this.activeAuthFlow;
+    let codeVerifier = generateCodeVerifier(), codeChallenge = generateCodeChallenge(codeVerifier), state = generateState(), server = await startCallbackServer(), redirectUri = `http://localhost:${server.port}/auth/callback`, params = new URLSearchParams({
+      client_id: CLIENT_ID,
+      redirect_uri: redirectUri,
+      response_type: "code",
+      code_challenge: codeChallenge,
+      code_challenge_method: "S256",
+      state,
+      scope: SCOPE,
+      id_token_add_organizations: "true",
+      codex_cli_simplified_flow: "true",
+      originator: "adf_studio"
+    }), authUrl = `${AUTH_URL}?${params.toString()}`;
+    await openExternal(authUrl);
+    let completion = (async () => {
+      try {
+        let result = await server.waitForCallback();
+        if (result.state !== state)
+          throw new Error("OAuth state mismatch \u2014 possible CSRF attack");
+        await this.exchangeCode(result.code, codeVerifier, redirectUri);
+      } finally {
+        server.close(), this.activeAuthFlow = null;
+      }
+    })();
+    return this.activeAuthFlow = { authUrl, callbackPort: server.port, completion }, this.activeAuthFlow;
+  }
+  /**
+   * Begin a sign-in whose OAuth callback lands on the *caller's* machine rather
+   * than on this process.
+   *
+   * The loopback flow assumes the browser and the token store share a host.
+   * That breaks for a daemon on a remote box: `http://localhost:1455` in the
+   * user's browser reaches their laptop, not the daemon. Here the daemon keeps
+   * the PKCE verifier, the caller runs its own callback server, and the caller
+   * posts the code back via `completeRelayAuthFlow`.
+   */
+  startRelayAuthFlow(redirectUri) {
+    assertLoopbackRedirect(redirectUri), this.pruneRelayFlows();
+    let codeVerifier = generateCodeVerifier(), state = generateState(), flowId = base64url(Buffer.from(crypto.getRandomValues(new Uint8Array(24)))), expiresAt = Date.now() + RELAY_FLOW_TTL_MS, params = new URLSearchParams({
+      client_id: CLIENT_ID,
+      redirect_uri: redirectUri,
+      response_type: "code",
+      code_challenge: generateCodeChallenge(codeVerifier),
+      code_challenge_method: "S256",
+      state,
+      scope: SCOPE,
+      id_token_add_organizations: "true",
+      codex_cli_simplified_flow: "true",
+      originator: "adf_studio"
+    });
+    return this.relayFlows.set(flowId, { codeVerifier, state, redirectUri, expiresAt }), { flowId, authUrl: `${AUTH_URL}?${params.toString()}`, state, expiresAt };
+  }
+  /** Finish a relay flow with the code the caller's callback server received. */
+  async completeRelayAuthFlow(flowId, code, state) {
+    this.pruneRelayFlows();
+    let flow = this.relayFlows.get(flowId);
+    if (!flow)
+      throw new Error("Unknown or expired auth flow \u2014 start sign-in again");
+    if (this.relayFlows.delete(flowId), state !== flow.state)
+      throw new Error("OAuth state mismatch \u2014 possible CSRF attack");
+    await this.exchangeCode(code, flow.codeVerifier, flow.redirectUri);
+  }
+  pruneRelayFlows() {
+    let now = Date.now();
+    for (let [id, flow] of this.relayFlows)
+      flow.expiresAt <= now && this.relayFlows.delete(id);
+  }
+  /** Trade an authorization code for tokens and persist them. */
+  async exchangeCode(code, codeVerifier, redirectUri) {
+    let tokenResponse = await fetch(TOKEN_URL, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        client_id: CLIENT_ID,
+        code,
+        redirect_uri: redirectUri,
+        code_verifier: codeVerifier
+      }).toString()
+    });
+    if (!tokenResponse.ok) {
+      let body = await tokenResponse.text();
+      throw new Error(`Token exchange failed (${tokenResponse.status}): ${body}`);
+    }
+    let tokenData = await tokenResponse.json();
+    tokenData.id_token && (this.email = decodeJwtPayload(tokenData.id_token).email);
+    let accountId = chatgptAccountIdFromJwt(tokenData.access_token) || chatgptAccountIdFromJwt(tokenData.id_token);
+    console.log(`[ChatGPT Auth] signed in: email=${this.email}, chatgpt_account_id=${accountId || "(missing)"}`), this.persist({
+      access_token: tokenData.access_token,
+      refresh_token: tokenData.refresh_token,
+      expires_at: Date.now() + tokenData.expires_in * 1e3,
+      account_id: accountId
+    }), noteSignIn(accountId);
+  }
+  async getValidAccessToken() {
+    let tokens = this.syncFromDisk();
+    if (!tokens)
+      throw new Error("Not authenticated \u2014 sign in first");
+    return Date.now() + REFRESH_BUFFER_MS < tokens.expires_at ? tokens.access_token : this.refreshPromise ? this.refreshPromise : (this.refreshPromise = this.refreshIfStillNeeded(tokens).finally(() => {
+      this.refreshPromise = null;
+    }), this.refreshPromise);
+  }
+  getAccountId() {
+    let tokens = this.syncFromDisk();
+    return chatgptAccountIdFromJwt(tokens?.access_token) || tokens?.account_id || void 0;
+  }
+  /**
+   * Re-check the file after winning the in-process refresh lock.
+   *
+   * OpenAI rotates the refresh token on every refresh, so if Studio refreshed
+   * while this call queued, our copy is already dead and spending it would both
+   * fail here and be pointless. Adopt the newer set instead.
+   */
+  async refreshIfStillNeeded(tokens) {
+    let fresh = this.syncFromDisk();
+    return fresh && Date.now() + REFRESH_BUFFER_MS < fresh.expires_at ? fresh.access_token : this.refreshTokens(fresh ?? tokens);
+  }
+  async refreshTokens(tokens) {
+    let data, rejected = !1;
+    try {
+      let response = await fetch(TOKEN_URL, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          client_id: CLIENT_ID,
+          grant_type: "refresh_token",
+          refresh_token: tokens.refresh_token
+        })
+      });
+      if (!response.ok)
+        throw rejected = response.status === 400 || response.status === 401, new Error(`Token refresh failed (${response.status})`);
+      data = await response.json();
+    } catch (err) {
+      let fresh = this.syncFromDisk();
+      if (fresh && fresh.refresh_token !== tokens.refresh_token && Date.now() + REFRESH_BUFFER_MS < fresh.expires_at)
+        return fresh.access_token;
+      throw rejected ? (clearTokens(), this.cachedTokens = null, this.email = void 0, new Error("Session expired \u2014 please sign in again")) : new Error(`Could not refresh the session (${err instanceof Error ? err.message : String(err)}) \u2014 still signed in, try again`);
+    }
+    if (data.id_token) {
+      let claims = decodeJwtPayload(data.id_token);
+      this.email = claims.email;
+    }
+    return this.persist({
+      access_token: data.access_token,
+      refresh_token: data.refresh_token,
+      expires_at: Date.now() + data.expires_in * 1e3,
+      account_id: chatgptAccountIdFromJwt(data.access_token) || chatgptAccountIdFromJwt(data.id_token) || tokens.account_id
+    }), data.access_token;
+  }
+  getAuthStatus() {
+    let tokens = this.syncFromDisk();
+    return tokens ? {
+      authenticated: !0,
+      email: this.email,
+      expiresAt: tokens.expires_at
+    } : { authenticated: !1 };
+  }
+  isAuthenticated() {
+    return this.syncFromDisk() !== null;
+  }
+  logout() {
+    clearTokens(), this.cachedTokens = null, this.email = void 0, this.refreshPromise = null, this.relayFlows.clear();
+  }
+}, instance = null;
+function getChatGptAuthManager() {
+  return instance || (instance = new ChatGptAuthManager()), instance;
+}
+
+export {
+  readTokens,
+  chatgptAccountIdFromJwt,
+  getChatGptAuthManager
+};

package/dist/chunks/chunk-LKFHERRV.mjs

@@ -0,0 +1,145 @@
+import { createRequire as __adfCreateRequire } from 'node:module';
+import { fileURLToPath as __adfFileURLToPath } from 'node:url';
+import { dirname as __adfDirname } from 'node:path';
+const require = __adfCreateRequire(import.meta.url);
+const __filename = __adfFileURLToPath(import.meta.url);
+const __dirname = __adfDirname(__filename);
+import {
+  __export
+} from "./chunk-M2RX3S2T.mjs";
+
+// src/shared/utils/file-ref.ts
+var file_ref_exports = {};
+__export(file_ref_exports, {
+  adfFileUrl: () => adfFileUrl,
+  applyFileRefChanges: () => applyFileRefChanges,
+  attachmentMetadata: () => attachmentMetadata,
+  attachmentText: () => attachmentText,
+  attachmentsOf: () => attachmentsOf,
+  deletedFilePlaceholder: () => deletedFilePlaceholder,
+  displayAttachment: () => displayAttachment,
+  fileRefKind: () => fileRefKind,
+  fileRefName: () => fileRefName,
+  fileRefText: () => fileRefText,
+  isAudioInputMime: () => isAudioInputMime,
+  isFileRefBlock: () => isFileRefBlock,
+  isVideoInputMime: () => isVideoInputMime,
+  isVisionMime: () => isVisionMime,
+  mediaKindOfMime: () => mediaKindOfMime,
+  splitLegacyUploads: () => splitLegacyUploads
+});
+var VISION_MIMES = /* @__PURE__ */ new Set(["image/png", "image/jpeg", "image/gif", "image/webp"]), AUDIO_INPUT_MIMES = /* @__PURE__ */ new Set([
+  "audio/wav",
+  "audio/mpeg",
+  "audio/mp3",
+  "audio/aiff",
+  "audio/aac",
+  "audio/ogg",
+  "audio/flac",
+  "audio/x-m4a",
+  "audio/webm"
+]), VIDEO_INPUT_MIMES = /* @__PURE__ */ new Set(["video/mp4", "video/mpeg", "video/quicktime", "video/webm"]);
+function isVisionMime(mime) {
+  return !!mime && VISION_MIMES.has(mime);
+}
+function isAudioInputMime(mime) {
+  return !!mime && AUDIO_INPUT_MIMES.has(mime);
+}
+function isVideoInputMime(mime) {
+  return !!mime && VIDEO_INPUT_MIMES.has(mime);
+}
+function mediaKindOfMime(mime) {
+  if (isVisionMime(mime)) return "image";
+  if (isAudioInputMime(mime)) return "audio";
+  if (isVideoInputMime(mime)) return "video";
+}
+function isFileRefBlock(block) {
+  return block.type === "file_ref" && !!block.file_ref && typeof block.file_ref.path == "string";
+}
+function fileRefKind(ref) {
+  return mediaKindOfMime(ref.mime_type);
+}
+function fileRefName(ref) {
+  let segments = ref.path.split("/");
+  return segments[segments.length - 1] || ref.path;
+}
+function deletedFilePlaceholder(ref) {
+  return `[deleted: ${fileRefName(ref)}]`;
+}
+function adfFileUrl(path) {
+  return `adf-file://${path.split("/").map(encodeURIComponent).join("/")}`;
+}
+function displayAttachment(ref) {
+  let kind = fileRefKind(ref);
+  return {
+    path: ref.path,
+    name: fileRefName(ref),
+    mime_type: ref.mime_type,
+    ...kind ? { kind } : {},
+    ...ref.deleted ? { deleted: !0 } : {}
+  };
+}
+function attachmentsOf(blocks) {
+  let out = [];
+  for (let block of blocks) isFileRefBlock(block) && out.push(displayAttachment(block.file_ref));
+  return out;
+}
+function attachmentMetadata(content, previews = []) {
+  let attachments = attachmentsOf(content);
+  if (!(attachments.length === 0 && previews.length === 0))
+    return { ...previews.length > 0 ? { imagePreviewUrls: previews } : {}, ...attachments.length > 0 ? { attachments } : {} };
+}
+function attachmentText(a) {
+  return a.deleted ? deletedFilePlaceholder(a) : `[${a.kind ?? "file"}: ${a.name}]`;
+}
+var LEGACY_UPLOAD_LINE = /^\[Uploaded file: .+ \(([^,()]+), [^()]+\)\. Use fs_read with path "(.+)" to inspect it\.\]$/;
+function splitLegacyUploads(text) {
+  if (!text.includes("[Uploaded file: ")) return { text, attachments: [] };
+  let attachments = [], kept = [];
+  for (let line of text.split(`
+`)) {
+    let match = LEGACY_UPLOAD_LINE.exec(line.trim());
+    if (!match) {
+      kept.push(line);
+      continue;
+    }
+    let kind = mediaKindOfMime(match[1]);
+    attachments.push({ path: match[2], name: fileRefName({ path: match[2] }), mime_type: match[1], ...kind ? { kind } : {} });
+  }
+  return { text: kept.join(`
+`).trim(), attachments };
+}
+function fileRefText(ref) {
+  return ref.deleted ? deletedFilePlaceholder(ref) : `[${fileRefKind(ref) ?? "file"}: ${ref.path}]`;
+}
+function applyFileRefChanges(blocks, changes) {
+  let out = null;
+  for (let i = 0; i < blocks.length; i++) {
+    let block = blocks[i];
+    if (!isFileRefBlock(block) || block.file_ref.deleted) continue;
+    let ref = block.file_ref;
+    for (let change of changes) {
+      if (ref.deleted) break;
+      change.op === "rename" && ref.path === change.from ? ref = { ...ref, path: change.to } : change.op === "delete" && ref.path === change.path && (ref = { ...ref, deleted: !0 });
+    }
+    ref !== block.file_ref && (out ??= blocks.slice(), out[i] = { ...block, file_ref: ref });
+  }
+  return out ?? blocks;
+}
+
+export {
+  isVisionMime,
+  isAudioInputMime,
+  isVideoInputMime,
+  mediaKindOfMime,
+  isFileRefBlock,
+  fileRefKind,
+  fileRefName,
+  deletedFilePlaceholder,
+  displayAttachment,
+  attachmentsOf,
+  splitLegacyUploads,
+  fileRefText,
+  applyFileRefChanges,
+  file_ref_exports
+};

package/dist/chunks/chunk-LTX74NU6.mjs

@@ -0,0 +1,29 @@
+import { createRequire as __adfCreateRequire } from 'node:module';
+import { fileURLToPath as __adfFileURLToPath } from 'node:url';
+import { dirname as __adfDirname } from 'node:path';
+const require = __adfCreateRequire(import.meta.url);
+const __filename = __adfFileURLToPath(import.meta.url);
+const __dirname = __adfDirname(__filename);
+
+// src/main/utils/secret-file.ts
+import { execFileSync } from "node:child_process";
+import { chmodSync } from "node:fs";
+import { userInfo } from "node:os";
+function restrictToCurrentUserWindows(path, run = (file, args) => {
+  execFileSync(file, args, { windowsHide: !0, stdio: ["ignore", "ignore", "pipe"] });
+}) {
+  let user = process.env.USERDOMAIN && process.env.USERNAME ? `${process.env.USERDOMAIN}\\${process.env.USERNAME}` : userInfo().username;
+  run("icacls", [path, "/inheritance:r", "/grant:r", `${user}:F`]);
+}
+function protectSecretFile(path, opts = {}) {
+  try {
+    return (opts.platform ?? process.platform) === "win32" ? restrictToCurrentUserWindows(path, opts.run) : chmodSync(path, 384), !0;
+  } catch (err) {
+    return console.warn(`[SecretFile] Could not restrict ${path} to the current user: ${err instanceof Error ? err.message : String(err)}`), !1;
+  }
+}
+
+export {
+  restrictToCurrentUserWindows,
+  protectSecretFile
+};