@agentdocumentformat/cli 0.7.8 → 0.8.1

package/dist/chunks/chunk-BS3USVEA.mjs

@@ -0,0 +1,301 @@
+import { createRequire as __adfCreateRequire } from 'node:module';
+import { fileURLToPath as __adfFileURLToPath } from 'node:url';
+import { dirname as __adfDirname } from 'node:path';
+const require = __adfCreateRequire(import.meta.url);
+const __filename = __adfFileURLToPath(import.meta.url);
+const __dirname = __adfDirname(__filename);
+import {
+  tokensEqual
+} from "./chunk-WJGPNHGX.mjs";
+import {
+  restrictToCurrentUserWindows
+} from "./chunk-LTX74NU6.mjs";
+
+// src/main/daemon/local-access.ts
+import { chmodSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { randomBytes } from "node:crypto";
+var LOCAL_PROOF_FILENAME = "daemon-local-proof", LOCAL_PROOF_HEADER = "x-adf-local-proof", BEHIND_PROXY_ENV = "ADF_DAEMON_BEHIND_PROXY", PROXY_HEADERS = ["forwarded", "x-forwarded-for", "x-forwarded-host", "x-forwarded-proto", "x-real-ip", "via"];
+function isLoopbackAddress(address) {
+  return address ? address === "::1" || address.startsWith("127.") || address.startsWith("::ffff:127.") : !1;
+}
+function hasProxyHeaders(headers) {
+  return PROXY_HEADERS.some((name) => headers[name] !== void 0);
+}
+function behindProxyFromEnv(env = process.env) {
+  return /^(1|true|yes|on)$/i.test((env[BEHIND_PROXY_ENV] ?? "").trim());
+}
+var DEFAULT_PORT = 7385;
+function localProofPath(settingsDir, port = DEFAULT_PORT) {
+  return join(settingsDir, port === DEFAULT_PORT ? LOCAL_PROOF_FILENAME : `${LOCAL_PROOF_FILENAME}-${port}`);
+}
+function mintLocalProof(settingsDir, port = DEFAULT_PORT, platform = process.platform) {
+  mkdirSync(settingsDir, { recursive: !0 });
+  let proof = randomBytes(32).toString("base64url"), path = localProofPath(settingsDir, port);
+  if (platform === "win32") {
+    writeFileSync(path, "");
+    try {
+      restrictToCurrentUserWindows(path);
+    } catch (err) {
+      try {
+        unlinkSync(path);
+      } catch {
+      }
+      throw new Error(`Could not restrict ${path} to the current user (icacls): ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return writeFileSync(path, `${proof}
+`), { proof, path };
+  }
+  return writeFileSync(path, `${proof}
+`, { mode: 384 }), chmodSync(path, 384), { proof, path };
+}
+var proofProblem = null;
+function noteLocalProofProblem(problem) {
+  proofProblem = problem;
+}
+function localProofProblem() {
+  return proofProblem;
+}
+function readLocalProof(settingsDir, port = DEFAULT_PORT) {
+  try {
+    let proof = readFileSync(localProofPath(settingsDir, port), "utf-8").trim();
+    return /^[A-Za-z0-9_-]{32,}$/.test(proof) ? proof : null;
+  } catch {
+    return null;
+  }
+}
+function isLocalOnlyRoute(path) {
+  let p = path.split("?")[0];
+  return p === "/daemon/shutdown" || p === "/client/reload-credentials" || p === "/client/sessions" || /^\/client\/sessions\/[^/]+\/exit-when-closed$/.test(p) || /^\/client\/sessions\/[^/]+\/quit$/.test(p) || /^\/identity\/(create|restore|import|unlock|lock|confirm-backup|trust-daemon|untrust-daemon)$/.test(p) || /^\/agents\/[^/]+\/identity\/reveal$/.test(p) || p === "/files/agent/identity/reveal" || p === "/settings/providers/keys/reveal" || p === "/remote-access" || p.startsWith("/remote-access/") || p === "/network/peers";
+}
+function isDeviceRefusedRoute(method, path) {
+  let p = path.split("?")[0];
+  return !(!isLocalOnlyRoute(p) || method === "POST" && p === "/client/sessions" || /^\/client\/sessions\/[^/]+\/(quit|exit-when-closed)$/.test(p));
+}
+function localAccessRefusal(request, opts) {
+  if (!isLoopbackAddress(request.remoteAddress)) return "the request did not come from this machine";
+  if (hasProxyHeaders(request.headers)) return "the request came through a proxy (forwarded headers)";
+  if (opts.behindProxy) {
+    let raw = request.headers[LOCAL_PROOF_HEADER], presented = (Array.isArray(raw) ? raw[0] : raw)?.trim();
+    if (!presented || !opts.localProof || !tokensEqual(presented, opts.localProof))
+      return `the daemon runs behind a proxy (${BEHIND_PROXY_ENV}) and the request lacks this machine's local proof`;
+  }
+  return null;
+}
+
+// src/main/utils/test-seams.ts
+import { basename } from "path";
+import { fileURLToPath } from "url";
+var TEST_SEAMS_ENV = "ADF_TEST_SEAMS";
+function isPackagedModulePath(modulePath) {
+  if (modulePath.includes("app.asar")) return !0;
+  let segments = modulePath.split(/[\\/]/).map((s) => s.toLowerCase());
+  return segments.includes("node_modules") || segments.includes("registry.npmjs.org") ? !0 : segments.some((s, i) => s === "deno" && segments[i + 1] === "npm");
+}
+function isPackagedRuntime(proc = process) {
+  return proc.versions.electron && !/[\\/]node_modules[\\/]electron[\\/]/.test(proc.execPath) ? !0 : isPackagedExecutable(proc.execPath, proc.argv[1] ?? "");
+}
+function isPackagedExecutable(execPath, entry) {
+  let exe = basename(execPath).toLowerCase().replace(/\.exe$/, "");
+  return exe !== "node" && exe !== "electron" ? !0 : /[\\/]app\.asar([\\/]|$)/i.test(entry);
+}
+function currentModulePath() {
+  try {
+    return fileURLToPath(import.meta.url);
+  } catch {
+    return null;
+  }
+}
+function testSeamsAllowed(input = {}) {
+  if ((input.env ?? process.env)[TEST_SEAMS_ENV] !== "1") return !1;
+  let modulePath = input.modulePath === void 0 ? currentModulePath() : input.modulePath;
+  return !modulePath || isPackagedModulePath(modulePath) ? !1 : !(input.isPackagedRuntime ?? isPackagedRuntime)();
+}
+
+// src/main/services/owner-secret-store.ts
+import { createCipheriv, createDecipheriv, randomBytes as randomBytes2, scryptSync, timingSafeEqual } from "crypto";
+import { chmodSync as chmodSync2, existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, writeFileSync as writeFileSync2 } from "fs";
+import { dirname } from "path";
+import { createRequire } from "module";
+var KEYCHAIN_SERVICE = "ADF", OWNER_MNEMONIC_ACCOUNT = "owner-mnemonic", WrongPassphraseError = class extends Error {
+  constructor() {
+    super("Wrong passphrase"), this.name = "WrongPassphraseError";
+  }
+}, SecretStoreLockedError = class extends Error {
+  constructor(message = "The owner secret file is locked \u2014 unlock it with its passphrase first") {
+    super(message), this.name = "SecretStoreLockedError";
+  }
+}, keyringCtor;
+function loadKeyring() {
+  if (keyringCtor !== void 0) return keyringCtor;
+  try {
+    keyringCtor = createRequire(import.meta.url)("@napi-rs/keyring").Entry;
+  } catch {
+    keyringCtor = null;
+  }
+  return keyringCtor;
+}
+var KeychainSecretBackend = class {
+  constructor(Entry, service = KEYCHAIN_SERVICE) {
+    this.Entry = Entry;
+    this.service = service;
+  }
+  Entry;
+  service;
+  kind = "keychain";
+  entry(account) {
+    return new this.Entry(this.service, account, { linux: { store: "secret-service" } });
+  }
+  isUnlocked() {
+    return !0;
+  }
+  get(account) {
+    let read = prereadValue(this.service, account);
+    return read !== void 0 ? read : this.entry(account).getPassword() ?? null;
+  }
+  set(account, value) {
+    this.entry(account).setPassword(value), preread?.service === this.service && preread.values.set(account, value);
+  }
+  delete(account) {
+    try {
+      this.entry(account).deleteCredential();
+    } catch {
+    }
+    preread?.service === this.service && preread.values.delete(account);
+  }
+}, PREREAD_TTL_MS = 6e4, preread = null;
+function prereadValue(service, account) {
+  if (!(!preread || preread.service !== service)) {
+    if (Date.now() - preread.at > PREREAD_TTL_MS) {
+      preread = null;
+      return;
+    }
+    return preread.values.get(account);
+  }
+}
+function openKeychainBackend() {
+  if (process.env.ADF_KEYCHAIN === "0" || process.env.ADF_KEYCHAIN === "off") return null;
+  let Entry = loadKeyring();
+  if (!Entry) return null;
+  try {
+    let backend = new KeychainSecretBackend(Entry);
+    return backend.get(OWNER_MNEMONIC_ACCOUNT), backend;
+  } catch {
+    return null;
+  }
+}
+function probeKeychain() {
+  if (process.env.ADF_KEYCHAIN === "0" || process.env.ADF_KEYCHAIN === "off") return { backend: null, present: !1, error: null };
+  let Entry = loadKeyring();
+  if (!Entry) return { backend: null, present: !1, error: null };
+  try {
+    let backend = new KeychainSecretBackend(Entry);
+    return backend.get(OWNER_MNEMONIC_ACCOUNT), { backend, present: !0, error: null };
+  } catch (err) {
+    return { backend: null, present: !0, error: err instanceof Error ? err.message : String(err) };
+  }
+}
+var SCRYPT = { N: 32768, r: 8, p: 1, maxmem: 64 * 1024 * 1024 }, CHECK_VALUE = "adf-owner-secrets-v1";
+function seal(key, plaintext) {
+  let iv = randomBytes2(12), cipher = createCipheriv("aes-256-gcm", key, iv), ct = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
+  return { iv: iv.toString("base64"), tag: cipher.getAuthTag().toString("base64"), ct: ct.toString("base64") };
+}
+function open(key, sealed) {
+  let decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(sealed.iv, "base64"));
+  return decipher.setAuthTag(Buffer.from(sealed.tag, "base64")), Buffer.concat([decipher.update(Buffer.from(sealed.ct, "base64")), decipher.final()]).toString("utf-8");
+}
+var MIN_PASSPHRASE_LENGTH = 8, FileSecretBackend = class {
+  constructor(filePath) {
+    this.filePath = filePath;
+  }
+  filePath;
+  kind = "file";
+  key = null;
+  salt = null;
+  values = {};
+  exists() {
+    return existsSync(this.filePath);
+  }
+  isUnlocked() {
+    return this.key !== null;
+  }
+  /**
+   * Unlock an existing file, or create an empty one sealed with `passphrase`
+   * when none exists yet. Throws WrongPassphraseError on a mismatch.
+   */
+  unlock(passphrase) {
+    if (!this.exists()) {
+      if (passphrase.length < MIN_PASSPHRASE_LENGTH)
+        throw new Error(`Passphrase must be at least ${MIN_PASSPHRASE_LENGTH} characters`);
+      this.salt = randomBytes2(16), this.key = scryptSync(passphrase, this.salt, 32, SCRYPT), this.values = {}, this.persist();
+      return;
+    }
+    let parsed = JSON.parse(readFileSync2(this.filePath, "utf-8"));
+    if (parsed?.v !== 1 || parsed.kdf?.name !== "scrypt") throw new Error(`Unsupported secret file format: ${this.filePath}`);
+    let salt = Buffer.from(parsed.kdf.salt, "base64"), key = scryptSync(passphrase, salt, 32, { N: parsed.kdf.N, r: parsed.kdf.r, p: parsed.kdf.p, maxmem: SCRYPT.maxmem }), check;
+    try {
+      check = open(key, parsed.check);
+    } catch {
+      throw new WrongPassphraseError();
+    }
+    let checkBuf = Buffer.from(check), expected = Buffer.from(CHECK_VALUE);
+    if (checkBuf.length !== expected.length || !timingSafeEqual(checkBuf, expected)) throw new WrongPassphraseError();
+    this.values = JSON.parse(open(key, parsed.data)), this.key = key, this.salt = salt;
+    try {
+      chmodSync2(this.filePath, 384);
+    } catch {
+    }
+  }
+  lock() {
+    this.key?.fill(0), this.key = null, this.values = {};
+  }
+  get(account) {
+    return this.key ? this.values[account] ?? null : null;
+  }
+  set(account, value) {
+    if (!this.key) throw new SecretStoreLockedError();
+    this.values[account] = value, this.persist();
+  }
+  delete(account) {
+    !this.key || !(account in this.values) || (delete this.values[account], this.persist());
+  }
+  persist() {
+    if (!this.key || !this.salt) throw new SecretStoreLockedError();
+    let record = {
+      v: 1,
+      kdf: { name: "scrypt", N: SCRYPT.N, r: SCRYPT.r, p: SCRYPT.p, salt: this.salt.toString("base64") },
+      check: seal(this.key, CHECK_VALUE),
+      data: seal(this.key, JSON.stringify(this.values))
+    };
+    mkdirSync2(dirname(this.filePath), { recursive: !0 });
+    let tmp = `${this.filePath}.tmp`;
+    writeFileSync2(tmp, JSON.stringify(record, null, 2) + `
+`, { mode: 384 }), renameSync(tmp, this.filePath);
+    try {
+      chmodSync2(this.filePath, 384);
+    } catch {
+    }
+  }
+};
+
+export {
+  LOCAL_PROOF_HEADER,
+  BEHIND_PROXY_ENV,
+  isLoopbackAddress,
+  hasProxyHeaders,
+  behindProxyFromEnv,
+  mintLocalProof,
+  noteLocalProofProblem,
+  localProofProblem,
+  readLocalProof,
+  isLocalOnlyRoute,
+  isDeviceRefusedRoute,
+  localAccessRefusal,
+  OWNER_MNEMONIC_ACCOUNT,
+  WrongPassphraseError,
+  openKeychainBackend,
+  probeKeychain,
+  MIN_PASSPHRASE_LENGTH,
+  FileSecretBackend,
+  testSeamsAllowed
+};

package/dist/chunks/chunk-C2S64Y6F.mjs

@@ -0,0 +1,203 @@
+import { createRequire as __adfCreateRequire } from 'node:module';
+import { fileURLToPath as __adfFileURLToPath } from 'node:url';
+import { dirname as __adfDirname } from 'node:path';
+const require = __adfCreateRequire(import.meta.url);
+const __filename = __adfFileURLToPath(import.meta.url);
+const __dirname = __adfDirname(__filename);
+import {
+  getUserDataPath
+} from "./chunk-PAK5JCO2.mjs";
+import {
+  protectSecretFile
+} from "./chunk-LTX74NU6.mjs";
+import {
+  __require
+} from "./chunk-M2RX3S2T.mjs";
+
+// src/main/providers/subscription-token-store.ts
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, unlinkSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readdirSync } from "fs";
+import { join as join2 } from "path";
+
+// src/main/utils/credential-cipher.ts
+import { randomBytes, createCipheriv, createDecipheriv } from "crypto";
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
+import { join } from "path";
+var AES_GCM_PREFIX = "aesgcm:", SAFE_STORAGE_PREFIX = "safe:", KEY_FILE_NAME = "credential.key", KEY_BYTES = 32, IV_BYTES = 12, TAG_BYTES = 16, cachedKey = null, cachedKeyPath = null;
+function getSafeStorage() {
+  try {
+    return __require("electron").safeStorage ?? null;
+  } catch {
+    return null;
+  }
+}
+function credentialKeyPath() {
+  let dir = getUserDataPath();
+  return existsSync(dir) || mkdirSync(dir, { recursive: !0 }), join(dir, KEY_FILE_NAME);
+}
+function readKeyFile(path) {
+  try {
+    let key = Buffer.from(readFileSync(path, "utf-8").trim(), "base64");
+    return key.length === KEY_BYTES ? key : null;
+  } catch {
+    return null;
+  }
+}
+function getCredentialKey() {
+  let path = credentialKeyPath();
+  if (cachedKey && cachedKeyPath === path) return cachedKey;
+  let key = existsSync(path) ? readKeyFile(path) : null;
+  if (key && protectSecretFile(path), !key && existsSync(path) && console.warn(`[Credentials] Key file at ${path} is unreadable \u2014 regenerating. Stored credentials will need re-authentication.`), !key) {
+    let generated = randomBytes(KEY_BYTES);
+    try {
+      writeFileSync(path, generated.toString("base64"), { mode: 384, flag: "wx" }), protectSecretFile(path), key = generated;
+    } catch (err) {
+      if (err.code === "EEXIST")
+        key = readKeyFile(path), key || (writeFileSync(path, generated.toString("base64"), { mode: 384 }), protectSecretFile(path), key = generated);
+      else
+        throw err;
+    }
+  }
+  return cachedKey = key, cachedKeyPath = path, key;
+}
+function encryptCredential(value) {
+  let iv = randomBytes(IV_BYTES), cipher = createCipheriv("aes-256-gcm", getCredentialKey(), iv), ciphertext = Buffer.concat([cipher.update(value, "utf-8"), cipher.final()]), tag = cipher.getAuthTag();
+  return `${AES_GCM_PREFIX}${iv.toString("base64")}.${tag.toString("base64")}.${ciphertext.toString("base64")}`;
+}
+function decryptAesGcm(raw, logPrefix) {
+  let parts = raw.slice(AES_GCM_PREFIX.length).split(".");
+  if (parts.length !== 3)
+    return console.warn(`${logPrefix} Malformed encrypted credential payload`), null;
+  try {
+    let iv = Buffer.from(parts[0], "base64"), tag = Buffer.from(parts[1], "base64");
+    if (iv.length !== IV_BYTES || tag.length !== TAG_BYTES)
+      return console.warn(`${logPrefix} Malformed encrypted credential payload`), null;
+    let decipher = createDecipheriv("aes-256-gcm", getCredentialKey(), iv);
+    return decipher.setAuthTag(tag), Buffer.concat([
+      decipher.update(Buffer.from(parts[2], "base64")),
+      decipher.final()
+    ]).toString("utf-8");
+  } catch {
+    return console.warn(`${logPrefix} Could not decrypt credential \u2014 the key file may have been regenerated. Sign in again.`), null;
+  }
+}
+function decryptCredential(raw, logPrefix = "[Credentials]") {
+  if (raw.startsWith(AES_GCM_PREFIX))
+    return decryptAesGcm(raw, logPrefix);
+  if (raw.startsWith(SAFE_STORAGE_PREFIX)) {
+    let safeStorage = getSafeStorage();
+    if (!safeStorage?.isEncryptionAvailable())
+      return console.warn(`${logPrefix} Credential is safeStorage-encrypted and this process has no Electron keychain access. Start ADF Studio once to migrate it, or sign in here.`), null;
+    try {
+      return safeStorage.decryptString(Buffer.from(raw.slice(SAFE_STORAGE_PREFIX.length), "base64"));
+    } catch (err) {
+      return console.warn(`${logPrefix} Failed to decrypt safeStorage credential:`, err), null;
+    }
+  }
+  return raw;
+}
+
+// src/main/providers/subscription-token-store.ts
+var STUDIO_FILE = "auth.json", DAEMON_FILE = "auth.daemon.json", REPLACED_FILE_PATTERN = /^auth\.replaced(\.[\w-]+)?\.json$/;
+function getSafeStorage2() {
+  try {
+    return __require("electron").safeStorage ?? null;
+  } catch {
+    return null;
+  }
+}
+function isElectronSurface() {
+  return getSafeStorage2() !== null;
+}
+function createSubscriptionTokenStore(dirName) {
+  let logTag = `[${dirName} Auth]`;
+  function getDir() {
+    let dir = join2(getUserDataPath(), dirName);
+    return existsSync2(dir) || mkdirSync2(dir, { recursive: !0 }), dir;
+  }
+  function getStorePath() {
+    return join2(getDir(), isElectronSurface() ? STUDIO_FILE : DAEMON_FILE);
+  }
+  function encryptValue(value) {
+    let safeStorage = getSafeStorage2();
+    if (safeStorage?.isEncryptionAvailable()) {
+      let encrypted = safeStorage.encryptString(value);
+      return SAFE_STORAGE_PREFIX + encrypted.toString("base64");
+    }
+    return safeStorage && console.warn(`${logTag} safeStorage unavailable \u2014 falling back to key-file encryption`), encryptCredential(value);
+  }
+  function decryptValue(raw) {
+    return decryptCredential(raw, logTag);
+  }
+  function adoptLegacyFile(ownPath) {
+    let legacyPath = join2(getDir(), STUDIO_FILE);
+    if (existsSync2(legacyPath))
+      try {
+        let raw = readFileSync2(legacyPath, "utf-8");
+        if (raw.startsWith(SAFE_STORAGE_PREFIX)) {
+          console.warn(
+            `${logTag} ${STUDIO_FILE} is encrypted by ADF Studio and cannot be used here \u2014 log in from this surface to create its own session`
+          );
+          return;
+        }
+        writeFileSync2(ownPath, raw, { mode: 384 }), console.log(`${logTag} Adopted legacy shared token file into ${DAEMON_FILE}`);
+      } catch (err) {
+        console.warn(`${logTag} Failed to adopt legacy token file:`, err);
+      }
+  }
+  function readTokens() {
+    let path = getStorePath();
+    if (!existsSync2(path) && !isElectronSurface() && adoptLegacyFile(path), !existsSync2(path)) return null;
+    try {
+      let raw = readFileSync2(path, "utf-8"), decrypted = decryptValue(raw);
+      return decrypted ? JSON.parse(decrypted) : null;
+    } catch (err) {
+      return console.warn(`${logTag} Failed to read tokens:`, err), null;
+    }
+  }
+  function writeTokens(tokens) {
+    let path = getStorePath(), value = encryptValue(JSON.stringify(tokens));
+    if (!value.startsWith(SAFE_STORAGE_PREFIX) && existsSync2(path)) {
+      let existing = null;
+      try {
+        existing = readFileSync2(path, "utf-8");
+      } catch {
+      }
+      if (existing?.startsWith(SAFE_STORAGE_PREFIX))
+        throw new Error(
+          `${logTag} refusing to overwrite a keychain-encrypted session with weaker key-file encryption. Log out (clearing the stored session) and log in again from this surface.`
+        );
+    }
+    writeFileSync2(path, value, { mode: 384 });
+  }
+  function clearTokens() {
+    let path = getStorePath();
+    if (existsSync2(path))
+      try {
+        unlinkSync(path);
+      } catch {
+      }
+  }
+  function signedIn(accountId) {
+    if (!accountId) return;
+    let names;
+    try {
+      names = readdirSync(getDir()).filter((name) => REPLACED_FILE_PATTERN.test(name));
+    } catch (err) {
+      console.warn(`${logTag} Could not list the sessions set aside after the sign-in:`, err instanceof Error ? err.message : err);
+      return;
+    }
+    for (let name of names)
+      try {
+        let path = join2(getDir(), name);
+        if (JSON.parse(decryptValue(readFileSync2(path, "utf-8")) ?? "null")?.account_id !== accountId) continue;
+        unlinkSync(path), console.log(`${logTag} Deleted ${name}: ${accountId} signed in again, so the session set aside for it is no longer needed`);
+      } catch (err) {
+        console.warn(`${logTag} Could not check ${name} after the sign-in:`, err instanceof Error ? err.message : err);
+      }
+  }
+  return { readTokens, writeTokens, clearTokens, signedIn };
+}
+
+export {
+  createSubscriptionTokenStore
+};