@agentdocumentformat/cli 0.8.3 → 0.8.5

package/dist/chunks/{chunk-F3WSCAJD.mjs → chunk-XP4U4A2W.mjs}

@@ -21,7 +21,7 @@ import {
   getCommand,
   notifyToolCallObservers,
   shellReadFile
-} from "./chunk-LVF2DRBR.mjs";
+} from "./chunk-TBMQOM7Y.mjs";
 
 // src/main/tools/shell/executor/pipeline-executor.ts
 function vfsPath(p) {

package/dist/chunks/chunk-XS46KYYY.mjs

@@ -0,0 +1,31 @@
+import { createRequire as __adfCreateRequire } from 'node:module';
+import { fileURLToPath as __adfFileURLToPath } from 'node:url';
+import { dirname as __adfDirname } from 'node:path';
+const require = __adfCreateRequire(import.meta.url);
+const __filename = __adfFileURLToPath(import.meta.url);
+const __dirname = __adfDirname(__filename);
+import {
+  __export
+} from "./chunk-M2RX3S2T.mjs";
+
+// src/shared/types/resource-revision.types.ts
+var resource_revision_types_exports = {};
+__export(resource_revision_types_exports, {
+  describeWriter: () => describeWriter
+});
+function describeWriter(writer) {
+  if (!writer) return "someone else";
+  switch (writer.kind) {
+    case "agent":
+      return "the agent";
+    case "cli":
+      return "the CLI or another API client";
+    case "client":
+      return writer.client === "studio" ? "another Studio window" : writer.client === "tui" ? "the terminal app" : `another client (${writer.client})`;
+  }
+}
+
+export {
+  describeWriter,
+  resource_revision_types_exports
+};

package/dist/chunks/{chunk-HBOFZRUS.mjs → chunk-XZQVDY3U.mjs}

@@ -4,6 +4,11 @@ import { dirname as __adfDirname } from 'node:path';
 const require = __adfCreateRequire(import.meta.url);
 const __filename = __adfFileURLToPath(import.meta.url);
 const __dirname = __adfDirname(__filename);
+import {
+  assertSafeBrotliRuntime,
+  brotliRuntimeVerdict,
+  refusalMessage
+} from "./chunk-ZECGH3LT.mjs";
 import {
   external_exports
 } from "./chunk-ZJKXHM4Q.mjs";
@@ -388,6 +393,7 @@ function pinnedRequest(url, method, headers, body, signal, guard) {
 }
 function pinnedFetch(guard, opts = {}) {
   return (async (input, init) => {
+    assertSafeBrotliRuntime();
     let policy = typeof guard == "function" ? guard() : guard, request = new Request(input, init?.body != null ? { ...init, duplex: "half" } : init), signal = request.signal, stopIfAborted = () => {
       if (signal.aborted) throw abortReason(signal);
     };
@@ -459,7 +465,9 @@ async function readCapped(response, maxBytes) {
   return Buffer.concat(chunks);
 }
 async function guardedFetch(url, options) {
-  let { maxBytes, timeoutMs } = options, maxRedirects = options.maxRedirects ?? MAX_FETCH_REDIRECTS, daemonPort = daemonGuardPort(), current;
+  let { maxBytes, timeoutMs } = options, maxRedirects = options.maxRedirects ?? MAX_FETCH_REDIRECTS, runtime = brotliRuntimeVerdict();
+  if (!runtime.safe) return { error: refusalMessage(runtime) };
+  let daemonPort = daemonGuardPort(), current;
   try {
     current = new URL(url).toString();
   } catch {

package/dist/chunks/chunk-ZECGH3LT.mjs

@@ -0,0 +1,88 @@
+import { createRequire as __adfCreateRequire } from 'node:module';
+import { fileURLToPath as __adfFileURLToPath } from 'node:url';
+import { dirname as __adfDirname } from 'node:path';
+const require = __adfCreateRequire(import.meta.url);
+const __filename = __adfFileURLToPath(import.meta.url);
+const __dirname = __adfDirname(__filename);
+import {
+  compareVersions
+} from "./chunk-26RK7T5L.mjs";
+import {
+  __require
+} from "./chunk-M2RX3S2T.mjs";
+
+// src/main/utils/brotli-runtime-guard.ts
+import { constants as zlibConstants } from "node:zlib";
+var SAFE_NODE_RANGE = "^22.23.4 || ^24.22.1 || ^26.12.1", NODE_FLOORS = {
+  22: "22.23.4",
+  24: "24.22.1",
+  26: "26.12.1"
+}, LAST_TESTED_NODE_MAJOR = 26, ELECTRON_FLOOR = "42.0.0", CHROMIUM_FLOOR = "148.0.7751.0", BLOCK_SWITCH_ERRNO = -17, NODE_REMEDY = `Install Node.js 22.23.4+, 24.22.1+ or 26.12.1+ (${SAFE_NODE_RANGE}) from https://nodejs.org and run adf again.`, ELECTRON_REMEDY = "Update ADF Studio to the latest release; from source, run `npm ci` so node_modules has the locked Electron.";
+function parseVersion(text) {
+  let m = /^v?((\d+)\.\d+\.\d+)(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$/.exec(text ?? "");
+  return m ? { v: m[1], major: Number(m[2]), pre: m[3] !== void 0 } : null;
+}
+function atLeast(a, floor) {
+  let d = compareVersions(a.v, floor);
+  return d > 0 || d === 0 && !a.pre;
+}
+function chromiumAtLeastFloor(text) {
+  return /^\d+\.\d+\.\d+\.\d+$/.test(text ?? "") && compareVersions(text, CHROMIUM_FLOOR) >= 0;
+}
+function evaluateBrotliRuntime(facts) {
+  let { versions } = facts;
+  if (versions.electron !== void 0) {
+    let runtime2 = `Electron ${versions.electron} (Chromium ${versions.chrome ?? "unknown"})`, electron = parseVersion(versions.electron);
+    return !electron || electron.pre || !atLeast(electron, ELECTRON_FLOOR) || !chromiumAtLeastFloor(versions.chrome) ? { safe: !1, runtime: runtime2, reason: `its Chromium Brotli decoder is not one verified to have the CVE-2026-111497 fix (needs a stable Electron ${ELECTRON_FLOOR}+ on Chromium ${CHROMIUM_FLOOR}+)`, remedy: ELECTRON_REMEDY } : { safe: !0, runtime: runtime2 };
+  }
+  if (versions.bun !== void 0 || versions.deno !== void 0)
+    return { safe: !1, runtime: versions.bun !== void 0 ? `Bun ${versions.bun}` : `Deno ${versions.deno}`, reason: "its Brotli decoder has not been verified against CVE-2026-111497", remedy: NODE_REMEDY };
+  let runtime = `Node.js ${versions.node ?? "unknown"}`, node = parseVersion(versions.node);
+  if (!node) return { safe: !1, runtime, reason: "its version could not be read", remedy: NODE_REMEDY };
+  if (node.pre) return { safe: !1, runtime, reason: "it is a prerelease build, which is not verified against CVE-2026-111497", remedy: NODE_REMEDY };
+  let { major } = node;
+  if (major > LAST_TESTED_NODE_MAJOR)
+    return { safe: !1, runtime, reason: `ADF is not tested on Node.js ${major}.x yet`, remedy: NODE_REMEDY };
+  let floor = NODE_FLOORS[major];
+  if (!floor || !atLeast(node, floor)) {
+    let why = floor ? `the Brotli decoder in Node.js ${major}.x is fixed from ${floor} on` : `Node.js ${major}.x never received the fix`;
+    return { safe: !1, runtime, reason: `it is vulnerable to CVE-2026-111497 (Brotli decoder out-of-bounds write): ${why}`, remedy: NODE_REMEDY };
+  }
+  return facts.blockSwitchErrno !== BLOCK_SWITCH_ERRNO ? { safe: !1, runtime, reason: "its zlib lacks the fixed Brotli decoder (no BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH), so it is not an official fixed build", remedy: NODE_REMEDY } : { safe: !0, runtime };
+}
+function currentFacts() {
+  let constants = zlibConstants;
+  return { versions: process.versions, blockSwitchErrno: constants.BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH };
+}
+function refusalMessage(verdict) {
+  return `ADF refuses to run on ${verdict.runtime}: ${verdict.reason}. ${verdict.remedy}`;
+}
+var UnsafeBrotliRuntimeError = class extends Error {
+  code = "ADF_UNSAFE_BROTLI_RUNTIME";
+}, cached;
+function brotliRuntimeVerdict() {
+  return cached ??= evaluateBrotliRuntime(currentFacts());
+}
+function assertSafeBrotliRuntime() {
+  let verdict = brotliRuntimeVerdict();
+  if (!verdict.safe) throw new UnsafeBrotliRuntimeError(refusalMessage(verdict));
+}
+function exitIfUnsafeBrotliRuntime() {
+  let verdict = brotliRuntimeVerdict();
+  if (verdict.safe) return;
+  let message = refusalMessage(verdict);
+  if (process.stderr.write(`${message}
+`), process.versions.electron !== void 0 && process.type === "browser")
+    try {
+      __require("electron").dialog?.showErrorBox("ADF Studio cannot start", message);
+    } catch {
+    }
+  process.exit(1);
+}
+
+export {
+  refusalMessage,
+  brotliRuntimeVerdict,
+  assertSafeBrotliRuntime,
+  exitIfUnsafeBrotliRuntime
+};

package/dist/chunks/{claude-subscription-EB4LAAVV.mjs → claude-subscription-X5EVR3Q4.mjs}

@@ -8,15 +8,16 @@ import {
   CLAUDE_SUBSCRIPTION_MODELS,
   createClaudeSubscriptionProvider,
   listClaudeSubscriptionModels
-} from "./chunk-KCIRFUZH.mjs";
-import "./chunk-E7LC6SHP.mjs";
+} from "./chunk-IHARCBZH.mjs";
+import "./chunk-RIAB37IS.mjs";
 import "./chunk-NZ7JTHEO.mjs";
 import "./chunk-JZFONJSL.mjs";
 import "./chunk-TKXIH27X.mjs";
 import "./chunk-LKFHERRV.mjs";
 import {
   getClaudeAuthManager
-} from "./chunk-MZRXFWPQ.mjs";
+} from "./chunk-AN6USKYQ.mjs";
+import "./chunk-26RK7T5L.mjs";
 import "./chunk-BR3AD5QZ.mjs";
 import "./chunk-ZJKXHM4Q.mjs";
 import "./chunk-RIX34QHC.mjs";

package/dist/chunks/{cli-UVIJAGRZ.mjs → cli-JPRYEY4J.mjs}

@@ -12,7 +12,7 @@ import {
   normalizeAuthProvider,
   openBrowser,
   submitClaudeCode
-} from "./chunk-BHY7QDCM.mjs";
+} from "./chunk-UBWWGUMU.mjs";
 import {
   MdnsService
 } from "./chunk-DDTTSKGG.mjs";
@@ -33,8 +33,8 @@ import {
 } from "./chunk-M2F7C2UJ.mjs";
 import {
   daemonPaths
-} from "./chunk-RHBGCOS3.mjs";
-import "./chunk-D7A77SNL.mjs";
+} from "./chunk-22ZGZFOV.mjs";
+import "./chunk-3FWPIWYM.mjs";
 import {
   DEFAULT_DAEMON_PORT,
   DEFAULT_DAEMON_URL,
@@ -58,8 +58,8 @@ import {
   storeRemoteToken,
   tunnelTokenHint,
   updateRemotes
-} from "./chunk-AEAJDCVK.mjs";
-import "./chunk-BS3USVEA.mjs";
+} from "./chunk-IM5JKLXO.mjs";
+import "./chunk-P4G5ZEBI.mjs";
 import "./chunk-WJGPNHGX.mjs";
 import "./chunk-PAK5JCO2.mjs";
 import "./chunk-ZPB3HYM7.mjs";
@@ -531,7 +531,7 @@ function tuiInvocation(argv) {
   return argv.filter((a) => a !== "--json");
 }
 async function defaultLaunchTui(argv) {
-  let { runTui } = await import("./tui-ZEI2NAQV.mjs");
+  let { runTui } = await import("./tui-NJKGFAKU.mjs");
   return await runTui(argv);
 }
 function urlFromArgv(argv, env) {
@@ -561,6 +561,10 @@ async function pinnedRemoteOk(io, url, explicitToken) {
 `), refusal === null;
 }
 async function runCli(argv = process.argv.slice(2), io = defaultIo) {
+  if (argv[0] === "web") {
+    let { runWebCommand } = await import("./web-F4XHDGUX.mjs");
+    return runWebCommand(argv.slice(1), io);
+  }
   let tuiArgv = tuiInvocation(argv);
   if (tuiArgv) {
     let wantsHelp = tuiArgv.includes("--help") || tuiArgv.includes("-h"), tuiUrl = "";
@@ -591,7 +595,17 @@ async function runCli(argv = process.argv.slice(2), io = defaultIo) {
 ${usage()}
 `), 2;
   }
-  let { command, args } = parsed, talksToDaemon = !["help", "--help", "-h", "pair", "remotes"].includes(command), options;
+  let { command, args } = parsed;
+  if (command === "web") {
+    let { runWebCommand } = await import("./web-F4XHDGUX.mjs");
+    return runWebCommand([
+      ...args,
+      ...parsed.explicitUrl ? ["--url", parsed.explicitUrl] : [],
+      ...parsed.options.token ? ["--token", parsed.options.token] : [],
+      ...parsed.options.json ? ["--json"] : []
+    ], io);
+  }
+  let talksToDaemon = !["help", "--help", "-h", "pair", "remotes"].includes(command), options;
   try {
     let env = io.env ?? process.env;
     options = { ...parsed.options, env, daemonUrl: talksToDaemon ? resolveDaemonUrl(parsed.explicitUrl ?? void 0, env) : "" };
@@ -1684,6 +1698,7 @@ that off). Quitting leaves it running. Another local port, such as an SSH
 tunnel, is never auto-started and needs --token.
 
 Commands:
+  web [--port <n>]                Open Browser Studio already signed in (no desktop app needed)
   tui                            The terminal app (the default)
   agents                         List loaded agents
   status <agent>                 Show runtime status

package/dist/chunks/{commands-KOMPXJZS.mjs → commands-TZW2FSXG.mjs}

@@ -9,10 +9,13 @@ import {
   getCommand,
   hasCommand,
   registry
-} from "./chunk-LVF2DRBR.mjs";
-import "./chunk-E7LC6SHP.mjs";
+} from "./chunk-TBMQOM7Y.mjs";
+import "./chunk-4T745GJA.mjs";
+import "./chunk-RIAB37IS.mjs";
 import "./chunk-3GNIDM53.mjs";
 import "./chunk-LKFHERRV.mjs";
+import "./chunk-ZECGH3LT.mjs";
+import "./chunk-26RK7T5L.mjs";
 import "./chunk-BR3AD5QZ.mjs";
 import "./chunk-M2RX3S2T.mjs";
 export {