@ai-agent-forge/agent-forge 0.85.0

package/dist/utils/tools-manager.js

@@ -0,0 +1,437 @@
+import { spawnSync } from "child_process";
+import { createHash } from "crypto";
+import { chmodSync, createWriteStream, existsSync, mkdirSync, readdirSync, renameSync, rmSync } from "fs";
+import { arch, platform } from "os";
+import { join } from "path";
+import { Readable, Transform } from "stream";
+import { pipeline } from "stream/promises";
+import { APP_NAME, getBinDir } from "../config.js";
+import { fetchWithRetry } from "./management-http.js";
+const TOOLS_DIR = getBinDir();
+const NETWORK_TIMEOUT_MS = 10_000;
+const DOWNLOAD_TIMEOUT_MS = 120_000;
+function isOfflineModeEnabled() {
+    const value = process.env.AGENT_FORGE_OFFLINE;
+    if (!value)
+        return false;
+    return value === "1" || value.toLowerCase() === "true" || value.toLowerCase() === "yes";
+}
+const TOOLS = {
+    fd: {
+        name: "fd",
+        repo: "sharkdp/fd",
+        binaryName: "fd",
+        systemBinaryNames: ["fd", "fdfind"],
+        tagPrefix: "v",
+        // fd publishes no per-asset checksum (probed: asset and .sha256 companions
+        // are absent), so the release is pinned in-repo and each asset's digest is
+        // committed here. Upgrades adopt a new release by bumping pinnedVersion
+        // and refreshing the digests from the official release assets.
+        pinnedVersion: "10.5.0",
+        digests: {
+            "fd-v10.5.0-x86_64-apple-darwin.tar.gz": "7e31028c62c6955877735d0406807aa484c2a5e6f86235a59e26c29c301da590",
+            "fd-v10.5.0-aarch64-apple-darwin.tar.gz": "b67e1836c468e42e411984b56e52fa7abec08c2bd22c867398e7cc134aac5e12",
+            "fd-v10.5.0-x86_64-unknown-linux-musl.tar.gz": "761c72dc8e120d85b22292063be8a796e2eeb20eb3e4f38b8fa2343ccf3514a7",
+            "fd-v10.5.0-aarch64-unknown-linux-musl.tar.gz": "d76c4317f7d5dba69f8a2a15856c90c777e7f0dd4e85f0de8c76de6992c374d4",
+            "fd-v10.5.0-x86_64-pc-windows-msvc.zip": "a227701b8551c35a9931d9f6da75503cf86d88e182d71fb849a70864c5d57cd7",
+            "fd-v10.5.0-aarch64-pc-windows-msvc.zip": "a2bcddcfd259b05357a77bbc6cd671fdb30f63fd266a0e748305890a8c5ceaa6",
+        },
+        getAssetName: (version, plat, architecture) => {
+            if (plat === "darwin") {
+                const archStr = architecture === "arm64" ? "aarch64" : "x86_64";
+                return `fd-v${version}-${archStr}-apple-darwin.tar.gz`;
+            }
+            else if (plat === "linux") {
+                const archStr = architecture === "arm64" ? "aarch64" : "x86_64";
+                return `fd-v${version}-${archStr}-unknown-linux-musl.tar.gz`;
+            }
+            else if (plat === "win32") {
+                const archStr = architecture === "arm64" ? "aarch64" : "x86_64";
+                return `fd-v${version}-${archStr}-pc-windows-msvc.zip`;
+            }
+            return null;
+        },
+    },
+    rg: {
+        name: "ripgrep",
+        repo: "BurntSushi/ripgrep",
+        binaryName: "rg",
+        tagPrefix: "",
+        // Every ripgrep release asset ships a sha256sum-format companion file.
+        checksumSuffix: ".sha256",
+        getAssetName: (version, plat, architecture) => {
+            if (plat === "darwin") {
+                const archStr = architecture === "arm64" ? "aarch64" : "x86_64";
+                return `ripgrep-${version}-${archStr}-apple-darwin.tar.gz`;
+            }
+            else if (plat === "linux") {
+                const archStr = architecture === "arm64" ? "aarch64" : "x86_64";
+                return `ripgrep-${version}-${archStr}-unknown-linux-musl.tar.gz`;
+            }
+            else if (plat === "win32") {
+                const archStr = architecture === "arm64" ? "aarch64" : "x86_64";
+                return `ripgrep-${version}-${archStr}-pc-windows-msvc.zip`;
+            }
+            return null;
+        },
+    },
+};
+// Check if a command exists in PATH by trying to run it
+function commandExists(cmd) {
+    try {
+        const result = spawnSync(cmd, ["--version"], { stdio: "pipe" });
+        // Check for ENOENT error (command not found)
+        return result.error === undefined || result.error === null;
+    }
+    catch {
+        return false;
+    }
+}
+// Get the path to a tool (system-wide or in our tools dir)
+export function getToolPath(tool) {
+    const config = TOOLS[tool];
+    if (!config)
+        return null;
+    // Check our tools directory first
+    const localPath = join(TOOLS_DIR, config.binaryName + (platform() === "win32" ? ".exe" : ""));
+    if (existsSync(localPath)) {
+        return localPath;
+    }
+    // Check system PATH - if found, just return the command name (it's in PATH)
+    const systemBinaryNames = config.systemBinaryNames ?? [config.binaryName];
+    for (const systemBinaryName of systemBinaryNames) {
+        if (commandExists(systemBinaryName)) {
+            return systemBinaryName;
+        }
+    }
+    return null;
+}
+// Resolve the latest release version from the release page redirect.
+// The api.github.com releases endpoint counts against the anonymous API
+// quota (60 requests/hour per IP), which is permanently exhausted behind
+// shared egress IPs such as corporate proxies and CI runners. The web
+// endpoint answers with a redirect to the tagged release at no quota cost
+// and lives on the same origin as the binary download itself.
+export async function getLatestVersion(repo) {
+    const response = await fetchWithRetry(`https://github.com/${repo}/releases/latest`, {
+        headers: { "User-Agent": `${APP_NAME}-agent-forge` },
+        redirect: "manual",
+    }, { timeoutMs: NETWORK_TIMEOUT_MS });
+    // Only the status and headers matter here. Discard the body so the
+    // connection can be reused.
+    try {
+        await response.body?.cancel();
+    }
+    catch {
+        // Discarding the body is best-effort.
+    }
+    const location = response.status >= 300 && response.status < 400 ? response.headers.get("location") : null;
+    if (!location) {
+        throw new Error(`Failed to resolve latest ${repo} release: HTTP ${response.status} without redirect`);
+    }
+    const tag = new URL(location, "https://github.com").pathname.split("/").pop();
+    if (!tag || !location.includes("/releases/tag/")) {
+        throw new Error(`Failed to resolve latest ${repo} release: unexpected redirect to ${location}`);
+    }
+    return decodeURIComponent(tag).replace(/^v/, "");
+}
+/**
+ * Integrity failure for a verified download. Carries both digests so callers
+ * (and tests) can inspect the mismatch structurally instead of parsing the
+ * message.
+ */
+export class DownloadIntegrityError extends Error {
+    expectedSha256;
+    actualSha256;
+    constructor(url, expectedSha256, actualSha256) {
+        super(`Download integrity check failed for ${url}: expected sha256 ${expectedSha256}, got ${actualSha256}`);
+        this.name = "DownloadIntegrityError";
+        this.expectedSha256 = expectedSha256;
+        this.actualSha256 = actualSha256;
+    }
+}
+// Download a file from URL. When `expectedSha256` is provided, the response
+// stream is hashed while it is written; a mismatch deletes the partial file
+// and rejects with a DownloadIntegrityError. Without it, behavior is
+// unchanged (unverified write).
+export async function downloadFile(url, dest, expectedSha256) {
+    const response = await fetchWithRetry(url, undefined, { timeoutMs: DOWNLOAD_TIMEOUT_MS });
+    if (!response.ok) {
+        throw new Error(`Download failed with HTTP ${response.status}: ${url}`);
+    }
+    if (!response.body) {
+        throw new Error("No response body");
+    }
+    const hash = createHash("sha256");
+    const digestTap = new Transform({
+        transform(chunk, _encoding, callback) {
+            hash.update(chunk);
+            callback(null, chunk);
+        },
+    });
+    const fileStream = createWriteStream(dest);
+    await pipeline(Readable.fromWeb(response.body), digestTap, fileStream);
+    if (expectedSha256 === undefined)
+        return;
+    const actual = hash.digest("hex");
+    const expected = expectedSha256.trim().toLowerCase();
+    if (actual !== expected) {
+        rmSync(dest, { force: true });
+        throw new DownloadIntegrityError(url, expected, actual);
+    }
+}
+const SHA256_HEX_PATTERN = /^[0-9a-f]{64}$/;
+// Resolve the expected sha256 for an asset from the tool's trusted checksum
+// source: the repo-committed digest map when present, otherwise the release's
+// per-asset companion checksum file. Undefined means no trusted source exists
+// for the channel and the download runs unverified.
+async function resolveExpectedSha256(config, downloadUrl, assetName) {
+    const digests = config.digests;
+    if (digests) {
+        const digest = digests[assetName];
+        if (digest === undefined) {
+            throw new Error(`No committed sha256 for ${config.name} asset ${assetName}; refresh the pin and its digests`);
+        }
+        return digest;
+    }
+    if (config.checksumSuffix !== undefined) {
+        return fetchReleaseSha256(`${downloadUrl}${config.checksumSuffix}`);
+    }
+    return undefined;
+}
+// Fetch a release's per-asset checksum companion file (sha256sum format:
+// "<hex>  <asset name>") and return the lowercase hex digest.
+async function fetchReleaseSha256(checksumUrl) {
+    const response = await fetchWithRetry(checksumUrl, undefined, { timeoutMs: NETWORK_TIMEOUT_MS });
+    if (!response.ok) {
+        throw new Error(`Failed to fetch release checksum: HTTP ${response.status}: ${checksumUrl}`);
+    }
+    const digest = (await response.text()).trim().split(/\s+/)[0]?.toLowerCase() ?? "";
+    if (!SHA256_HEX_PATTERN.test(digest)) {
+        throw new Error(`Release checksum has an unexpected format: ${checksumUrl}`);
+    }
+    return digest;
+}
+function findBinaryRecursively(rootDir, binaryFileName) {
+    const stack = [rootDir];
+    while (stack.length > 0) {
+        // v8 ignore next -- 循环条件保证栈非空，pop() 不会返回 undefined
+        const currentDir = stack.pop();
+        if (!currentDir)
+            continue;
+        const entries = readdirSync(currentDir, { withFileTypes: true });
+        for (const entry of entries) {
+            const fullPath = join(currentDir, entry.name);
+            if (entry.isFile() && entry.name === binaryFileName) {
+                return fullPath;
+            }
+            if (entry.isDirectory()) {
+                stack.push(fullPath);
+            }
+        }
+    }
+    return null;
+}
+function formatSpawnFailure(result) {
+    if (result.error?.message) {
+        return result.error.message;
+    }
+    const stderr = result.stderr?.toString().trim();
+    if (stderr) {
+        return stderr;
+    }
+    const stdout = result.stdout?.toString().trim();
+    if (stdout) {
+        return stdout;
+    }
+    return `exit status ${result.status ?? "unknown"}`;
+}
+function runExtractionCommand(command, args) {
+    const result = spawnSync(command, args, { stdio: "pipe" });
+    if (!result.error && result.status === 0) {
+        return null;
+    }
+    return `${command}: ${formatSpawnFailure(result)}`;
+}
+function extractTarGzArchive(archivePath, extractDir, assetName) {
+    const failure = runExtractionCommand("tar", ["xzf", archivePath, "-C", extractDir]);
+    if (failure) {
+        throw new Error(`Failed to extract ${assetName}: ${failure}`);
+    }
+}
+function getWindowsTarCommand() {
+    const systemRoot = process.env.SystemRoot ?? process.env.WINDIR;
+    if (systemRoot) {
+        const systemTar = join(systemRoot, "System32", "tar.exe");
+        if (existsSync(systemTar)) {
+            return systemTar;
+        }
+    }
+    return "tar.exe";
+}
+function extractZipArchive(archivePath, extractDir, assetName) {
+    const failures = [];
+    // v8 ignore next -- getAssetName 仅在 win32 产出 .zip 资产，非 win32 不会进入 zip 解包分支
+    if (platform() === "win32") {
+        // Windows ships bsdtar as tar.exe, which supports zip files. Prefer the
+        // System32 binary over Git Bash's GNU tar, which does not handle zip archives.
+        const tarFailure = runExtractionCommand(getWindowsTarCommand(), ["xf", archivePath, "-C", extractDir]);
+        if (!tarFailure)
+            return;
+        failures.push(tarFailure);
+        const script = "& { param($archive, $destination) $ErrorActionPreference = 'Stop'; Expand-Archive -LiteralPath $archive -DestinationPath $destination -Force }";
+        const powershellFailure = runExtractionCommand("powershell.exe", [
+            "-NoLogo",
+            "-NoProfile",
+            "-NonInteractive",
+            "-ExecutionPolicy",
+            "Bypass",
+            "-Command",
+            script,
+            archivePath,
+            extractDir,
+        ]);
+        if (!powershellFailure)
+            return;
+        failures.push(powershellFailure);
+    }
+    else {
+        // v8 ignore start -- fd/rg 在非 Windows 平台的资产恒为 .tar.gz，unzip 分支不可达
+        const unzipFailure = runExtractionCommand("unzip", ["-q", archivePath, "-d", extractDir]);
+        if (!unzipFailure)
+            return;
+        failures.push(unzipFailure);
+        const tarFailure = runExtractionCommand("tar", ["xf", archivePath, "-C", extractDir]);
+        if (!tarFailure)
+            return;
+        failures.push(tarFailure);
+        // v8 ignore stop
+    }
+    throw new Error(`Failed to extract ${assetName}: ${failures.join("; ")}`);
+}
+// Download and install a tool
+async function downloadTool(tool) {
+    const config = TOOLS[tool];
+    // v8 ignore next -- ensureTool 已做同样检查，此兜底经公共 API 不可达
+    if (!config)
+        throw new Error(`Unknown tool: ${tool}`);
+    const plat = platform();
+    const architecture = arch();
+    // Pinned releases (fd) skip the version lookup entirely: the digest map only
+    // covers the pinned release, so tracking latest would break verification.
+    const version = config.pinnedVersion ?? (await getLatestVersion(config.repo));
+    // Get asset name for this platform
+    const assetName = config.getAssetName(version, plat, architecture);
+    if (!assetName) {
+        throw new Error(`Unsupported platform: ${plat}/${architecture}`);
+    }
+    // Create tools directory
+    mkdirSync(TOOLS_DIR, { recursive: true });
+    const downloadUrl = `https://github.com/${config.repo}/releases/download/${config.tagPrefix}${version}/${assetName}`;
+    // The expected digest comes from whichever trusted source the channel has:
+    // a repo-committed per-asset digest (fd) or an upstream companion checksum
+    // file (rg). A digest that cannot be obtained or matched fails the install
+    // visibly (ensureTool surfaces it as a warning); it is never silently skipped.
+    const expectedSha256 = await resolveExpectedSha256(config, downloadUrl, assetName);
+    const archivePath = join(TOOLS_DIR, assetName);
+    const binaryExt = plat === "win32" ? ".exe" : "";
+    const binaryPath = join(TOOLS_DIR, config.binaryName + binaryExt);
+    // Download
+    await downloadFile(downloadUrl, archivePath, expectedSha256);
+    // Extract into a unique temp directory. fd and rg downloads can run concurrently
+    // during startup, so sharing a fixed directory causes races.
+    const extractDir = join(TOOLS_DIR, `extract_tmp_${config.binaryName}_${process.pid}_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`);
+    mkdirSync(extractDir, { recursive: true });
+    try {
+        if (assetName.endsWith(".tar.gz")) {
+            extractTarGzArchive(archivePath, extractDir, assetName);
+        }
+        else if (assetName.endsWith(".zip")) {
+            extractZipArchive(archivePath, extractDir, assetName);
+        }
+        else {
+            // v8 ignore next -- getAssetName 产出的资产名恒为 .tar.gz 或 .zip，此兜底不可达
+            throw new Error(`Unsupported archive format: ${assetName}`);
+        }
+        // Find the binary in extracted files. Some archives contain files directly
+        // at root, others nest under a versioned subdirectory.
+        const binaryFileName = config.binaryName + binaryExt;
+        const extractedDir = join(extractDir, assetName.replace(/\.(tar\.gz|zip)$/, ""));
+        const extractedBinaryCandidates = [join(extractedDir, binaryFileName), join(extractDir, binaryFileName)];
+        let extractedBinary = extractedBinaryCandidates.find((candidate) => existsSync(candidate));
+        if (!extractedBinary) {
+            extractedBinary = findBinaryRecursively(extractDir, binaryFileName) ?? undefined;
+        }
+        if (extractedBinary) {
+            renameSync(extractedBinary, binaryPath);
+        }
+        else {
+            throw new Error(`Binary not found in archive: expected ${binaryFileName} under ${extractDir}`);
+        }
+        // Make executable (Unix only)
+        if (plat !== "win32") {
+            chmodSync(binaryPath, 0o755);
+        }
+    }
+    finally {
+        // Cleanup
+        rmSync(archivePath, { force: true });
+        rmSync(extractDir, { recursive: true, force: true });
+    }
+    return binaryPath;
+}
+// Termux package names for tools
+const TERMUX_PACKAGES = {
+    fd: "fd",
+    rg: "ripgrep",
+};
+/**
+ * Ensure a tool is available, downloading if necessary.
+ * Reports progress through `onStatus`; status messages are otherwise silent.
+ * Returns the tool path, or undefined if unavailable.
+ */
+export async function ensureTool(tool, onStatus) {
+    const existingPath = getToolPath(tool);
+    if (existingPath) {
+        return existingPath;
+    }
+    const config = TOOLS[tool];
+    if (!config)
+        return undefined;
+    if (isOfflineModeEnabled()) {
+        onStatus?.({ type: "warning", message: `${config.name} not found. Offline mode enabled, skipping download.` });
+        return undefined;
+    }
+    // On Android/Termux, Linux binaries don't work due to Bionic libc incompatibility.
+    // Users must install via pkg.
+    if (platform() === "android") {
+        // v8 ignore next -- TERMUX_PACKAGES 覆盖全部受支持工具，?? 回退不可达
+        const pkgName = TERMUX_PACKAGES[tool] ?? tool;
+        onStatus?.({ type: "warning", message: `${config.name} not found. Install with: pkg install ${pkgName}` });
+        return undefined;
+    }
+    // Tool not found - download it
+    onStatus?.({ type: "info", message: `${config.name} not found. Downloading...` });
+    try {
+        const path = await downloadTool(tool);
+        onStatus?.({ type: "info", message: `${config.name} installed to ${path}` });
+        return path;
+    }
+    catch (e) {
+        // Include the error cause chain: fetch failures surface as a bare
+        // "fetch failed" TypeError with the actionable detail (DNS, TLS,
+        // timeout) hidden in the cause. Depth-capped to guard against
+        // circular cause chains.
+        const messages = [];
+        for (let current = e, depth = 0; current instanceof Error && depth < 5; current = current.cause, depth++) {
+            if (!messages.includes(current.message))
+                messages.push(current.message);
+        }
+        onStatus?.({
+            type: "warning",
+            message: `Failed to download ${config.name}: ${messages.length > 0 ? messages.join(": ") : String(e)}`,
+        });
+        return undefined;
+    }
+}
+//# sourceMappingURL=tools-manager.js.map

package/dist/utils/tools-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools-manager.js","sourceRoot":"","sources":["../../src/utils/tools-manager.ts"],"names":[],"mappings":"AACA,OAAO,EAAyB,SAAS,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC1G,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,SAAS,GAAG,SAAS,EAAE,CAAC;AAC9B,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAEpC,SAAS,oBAAoB,GAAY;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC;AAAA,CACxF;AAiCD,MAAM,KAAK,GAA+B;IACzC,EAAE,EAAE;QACH,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,YAAY;QAClB,UAAU,EAAE,IAAI;QAChB,iBAAiB,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC;QACnC,SAAS,EAAE,GAAG;QACd,2EAA2E;QAC3E,2EAA2E;QAC3E,wEAAwE;QACxE,+DAA+D;QAC/D,aAAa,EAAE,QAAQ;QACvB,OAAO,EAAE;YACR,uCAAuC,EAAE,kEAAkE;YAC3G,wCAAwC,EAAE,kEAAkE;YAC5G,6CAA6C,EAC5C,kEAAkE;YACnE,8CAA8C,EAC7C,kEAAkE;YACnE,uCAAuC,EAAE,kEAAkE;YAC3G,wCAAwC,EAAE,kEAAkE;SAC5G;QACD,YAAY,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC;YAC9C,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvB,MAAM,OAAO,GAAG,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAChE,OAAO,OAAO,OAAO,IAAI,OAAO,sBAAsB,CAAC;YACxD,CAAC;iBAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAG,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAChE,OAAO,OAAO,OAAO,IAAI,OAAO,4BAA4B,CAAC;YAC9D,CAAC;iBAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAG,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAChE,OAAO,OAAO,OAAO,IAAI,OAAO,sBAAsB,CAAC;YACxD,CAAC;YACD,OAAO,IAAI,CAAC;QAAA,CACZ;KACD;IACD,EAAE,EAAE;QACH,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,oBAAoB;QAC1B,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,EAAE;QACb,uEAAuE;QACvE,cAAc,EAAE,SAAS;QACzB,YAAY,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC;YAC9C,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvB,MAAM,OAAO,GAAG,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAChE,OAAO,WAAW,OAAO,IAAI,OAAO,sBAAsB,CAAC;YAC5D,CAAC;iBAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAG,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAChE,OAAO,WAAW,OAAO,IAAI,OAAO,4BAA4B,CAAC;YAClE,CAAC;iBAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAG,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAChE,OAAO,WAAW,OAAO,IAAI,OAAO,sBAAsB,CAAC;YAC5D,CAAC;YACD,OAAO,IAAI,CAAC;QAAA,CACZ;KACD;CACD,CAAC;AAEF,wDAAwD;AACxD,SAAS,aAAa,CAAC,GAAW,EAAW;IAC5C,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAChE,6CAA6C;QAC7C,OAAO,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AAAA,CACD;AAED,2DAA2D;AAC3D,MAAM,UAAU,WAAW,CAAC,IAAiB,EAAiB;IAC7D,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,kCAAkC;IAClC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,GAAG,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9F,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,4EAA4E;IAC5E,MAAM,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1E,KAAK,MAAM,gBAAgB,IAAI,iBAAiB,EAAE,CAAC;QAClD,IAAI,aAAa,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACrC,OAAO,gBAAgB,CAAC;QACzB,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AAAA,CACZ;AAED,qEAAqE;AACrE,wEAAwE;AACxE,yEAAyE;AACzE,sEAAsE;AACtE,0EAA0E;AAC1E,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAmB;IACrE,MAAM,QAAQ,GAAG,MAAM,cAAc,CACpC,sBAAsB,IAAI,kBAAkB,EAC5C;QACC,OAAO,EAAE,EAAE,YAAY,EAAE,GAAG,QAAQ,cAAc,EAAE;QACpD,QAAQ,EAAE,QAAQ;KAClB,EACD,EAAE,SAAS,EAAE,kBAAkB,EAAE,CACjC,CAAC;IAEF,mEAAmE;IACnE,4BAA4B;IAC5B,IAAI,CAAC;QACJ,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACR,sCAAsC;IACvC,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3G,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,kBAAkB,QAAQ,CAAC,MAAM,mBAAmB,CAAC,CAAC;IACvG,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IAC9E,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,oCAAoC,QAAQ,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAAA,CACjD;AAED;;;;GAIG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACvC,cAAc,CAAS;IACvB,YAAY,CAAS;IAE9B,YAAY,GAAW,EAAE,cAAsB,EAAE,YAAoB,EAAE;QACtE,KAAK,CAAC,uCAAuC,GAAG,qBAAqB,cAAc,SAAS,YAAY,EAAE,CAAC,CAAC;QAC5G,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IAAA,CACjC;CACD;AAED,4EAA4E;AAC5E,4EAA4E;AAC5E,qEAAqE;AACrE,gCAAgC;AAChC,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,IAAY,EAAE,cAAkC,EAAiB;IAChH,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAE1F,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC;QAC/B,SAAS,CACR,KAAa,EACb,SAAyB,EACzB,QAAuD,EAChD;YACP,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnB,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAAA,CACtB;KACD,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,IAA6B,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IAEhG,IAAI,cAAc,KAAK,SAAS;QAAE,OAAO;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9B,MAAM,IAAI,sBAAsB,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;AAAA,CACD;AAED,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAE5C,4EAA4E;AAC5E,8EAA8E;AAC9E,8EAA8E;AAC9E,oDAAoD;AACpD,KAAK,UAAU,qBAAqB,CACnC,MAAkB,EAClB,WAAmB,EACnB,SAAiB,EACa;IAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,IAAI,OAAO,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,CAAC,IAAI,UAAU,SAAS,mCAAmC,CAAC,CAAC;QAC/G,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,kBAAkB,CAAC,GAAG,WAAW,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,yEAAyE;AACzE,8DAA8D;AAC9D,KAAK,UAAU,kBAAkB,CAAC,WAAmB,EAAmB;IACvE,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACjG,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACnF,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,8CAA8C,WAAW,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,MAAM,CAAC;AAAA,CACd;AAED,SAAS,qBAAqB,CAAC,OAAe,EAAE,cAAsB,EAAiB;IACtF,MAAM,KAAK,GAAa,CAAC,OAAO,CAAC,CAAC;IAElC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,+EAAmD;QACnD,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QAC/B,IAAI,CAAC,UAAU;YAAE,SAAS;QAE1B,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBACrD,OAAO,QAAQ,CAAC;YACjB,CAAC;YACD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtB,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AAAA,CACZ;AAED,SAAS,kBAAkB,CAAC,MAAgC,EAAU;IACrE,IAAI,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;IAC7B,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;IAChD,IAAI,MAAM,EAAE,CAAC;QACZ,OAAO,MAAM,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;IAChD,IAAI,MAAM,EAAE,CAAC;QACZ,OAAO,MAAM,CAAC;IACf,CAAC;IACD,OAAO,eAAe,MAAM,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;AAAA,CACnD;AAED,SAAS,oBAAoB,CAAC,OAAe,EAAE,IAAc,EAAiB;IAC7E,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,GAAG,OAAO,KAAK,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;AAAA,CACnD;AAED,SAAS,mBAAmB,CAAC,WAAmB,EAAE,UAAkB,EAAE,SAAiB,EAAQ;IAC9F,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;IACpF,IAAI,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,qBAAqB,SAAS,KAAK,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC;AAAA,CACD;AAED,SAAS,oBAAoB,GAAW;IACvC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;IAChE,IAAI,UAAU,EAAE,CAAC;QAChB,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QAC1D,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,SAAS,iBAAiB,CAAC,WAAmB,EAAE,UAAkB,EAAE,SAAiB,EAAQ;IAC5F,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,2GAA2E;IAC3E,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC5B,wEAAwE;QACxE,+EAA+E;QAC/E,MAAM,UAAU,GAAG,oBAAoB,CAAC,oBAAoB,EAAE,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;QACvG,IAAI,CAAC,UAAU;YAAE,OAAO;QACxB,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAE1B,MAAM,MAAM,GACX,gJAAgJ,CAAC;QAClJ,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,gBAAgB,EAAE;YAChE,SAAS;YACT,YAAY;YACZ,iBAAiB;YACjB,kBAAkB;YAClB,QAAQ;YACR,UAAU;YACV,MAAM;YACN,WAAW;YACX,UAAU;SACV,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB;YAAE,OAAO;QAC/B,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAClC,CAAC;SAAM,CAAC;QACP,gGAAkE;QAClE,MAAM,YAAY,GAAG,oBAAoB,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;QAC1F,IAAI,CAAC,YAAY;YAAE,OAAO;QAC1B,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAE5B,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,UAAU;YAAE,OAAO;QACxB,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1B,iBAAiB;IAClB,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,qBAAqB,SAAS,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAAA,CAC1E;AAED,8BAA8B;AAC9B,KAAK,UAAU,YAAY,CAAC,IAAiB,EAAmB;IAC/D,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,qFAAqD;IACrD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IAEtD,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;IACxB,MAAM,YAAY,GAAG,IAAI,EAAE,CAAC;IAE5B,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAE9E,mCAAmC;IACnC,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IACnE,IAAI,CAAC,SAAS,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,IAAI,YAAY,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,yBAAyB;IACzB,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1C,MAAM,WAAW,GAAG,sBAAsB,MAAM,CAAC,IAAI,sBAAsB,MAAM,CAAC,SAAS,GAAG,OAAO,IAAI,SAAS,EAAE,CAAC;IACrH,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,+EAA+E;IAC/E,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IACnF,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IAElE,WAAW;IACX,MAAM,YAAY,CAAC,WAAW,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;IAE7D,iFAAiF;IACjF,6DAA6D;IAC7D,MAAM,UAAU,GAAG,IAAI,CACtB,SAAS,EACT,eAAe,MAAM,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAC1G,CAAC;IACF,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE3C,IAAI,CAAC;QACJ,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,mBAAmB,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QACzD,CAAC;aAAM,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,iBAAiB,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACP,gGAAgE;YAChE,MAAM,IAAI,KAAK,CAAC,+BAA+B,SAAS,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,2EAA2E;QAC3E,uDAAuD;QACvD,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC;QACrD,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,CAAC;QACjF,MAAM,yBAAyB,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;QACzG,IAAI,eAAe,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QAE3F,IAAI,CAAC,eAAe,EAAE,CAAC;YACtB,eAAe,GAAG,qBAAqB,CAAC,UAAU,EAAE,cAAc,CAAC,IAAI,SAAS,CAAC;QAClF,CAAC;QAED,IAAI,eAAe,EAAE,CAAC;YACrB,UAAU,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACzC,CAAC;aAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,yCAAyC,cAAc,UAAU,UAAU,EAAE,CAAC,CAAC;QAChG,CAAC;QAED,8BAA8B;QAC9B,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACtB,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;IACF,CAAC;YAAS,CAAC;QACV,UAAU;QACV,MAAM,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,UAAU,CAAC;AAAA,CAClB;AAED,iCAAiC;AACjC,MAAM,eAAe,GAA2B;IAC/C,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,SAAS;CACb,CAAC;AAOF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC/B,IAAiB,EACjB,QAAuC,EACT;IAC9B,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,YAAY,EAAE,CAAC;QAClB,OAAO,YAAY,CAAC;IACrB,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,IAAI,oBAAoB,EAAE,EAAE,CAAC;QAC5B,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,sDAAsD,EAAE,CAAC,CAAC;QAC/G,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,mFAAmF;IACnF,8BAA8B;IAC9B,IAAI,QAAQ,EAAE,KAAK,SAAS,EAAE,CAAC;QAC9B,qFAAuD;QACvD,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QAC9C,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,yCAAyC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC3G,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,+BAA+B;IAC/B,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,4BAA4B,EAAE,CAAC,CAAC;IAElF,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;QACtC,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,iBAAiB,IAAI,EAAE,EAAE,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACZ,kEAAkE;QAClE,iEAAiE;QACjE,8DAA8D;QAC9D,yBAAyB;QACzB,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KACC,IAAI,OAAO,GAAY,CAAC,EAAE,KAAK,GAAG,CAAC,EACnC,OAAO,YAAY,KAAK,IAAI,KAAK,GAAG,CAAC,EACrC,OAAO,GAAG,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,EAC/B,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACzE,CAAC;QACD,QAAQ,EAAE,CAAC;YACV,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,sBAAsB,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;SACtG,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IAClB,CAAC;AAAA,CACD","sourcesContent":["import type { ReadableStream as NodeWebReadableStream } from \"node:stream/web\";\nimport { type SpawnSyncReturns, spawnSync } from \"child_process\";\nimport { createHash } from \"crypto\";\nimport { chmodSync, createWriteStream, existsSync, mkdirSync, readdirSync, renameSync, rmSync } from \"fs\";\nimport { arch, platform } from \"os\";\nimport { join } from \"path\";\nimport { Readable, Transform } from \"stream\";\nimport { pipeline } from \"stream/promises\";\nimport { APP_NAME, getBinDir } from \"../config.ts\";\nimport { fetchWithRetry } from \"./management-http.ts\";\n\nconst TOOLS_DIR = getBinDir();\nconst NETWORK_TIMEOUT_MS = 10_000;\nconst DOWNLOAD_TIMEOUT_MS = 120_000;\n\nfunction isOfflineModeEnabled(): boolean {\n\tconst value = process.env.AGENT_FORGE_OFFLINE;\n\tif (!value) return false;\n\treturn value === \"1\" || value.toLowerCase() === \"true\" || value.toLowerCase() === \"yes\";\n}\n\ninterface ToolConfig {\n\tname: string;\n\trepo: string; // GitHub repo (e.g., \"sharkdp/fd\")\n\tbinaryName: string; // Name of the binary inside the archive\n\tsystemBinaryNames?: string[]; // Alternative system command names to try before downloading\n\ttagPrefix: string; // Prefix for tags (e.g., \"v\" for v1.0.0, \"\" for 1.0.0)\n\tgetAssetName: (version: string, plat: string, architecture: string) => string | null;\n\t/**\n\t * Suffix appended to the asset download URL to locate the release's\n\t * per-asset checksum companion file (e.g., \".sha256\"). When present, the\n\t * download is verified against it; when absent, no trusted automatic\n\t * checksum source exists for that release channel and the download runs\n\t * unverified.\n\t */\n\tchecksumSuffix?: string;\n\t/**\n\t * Release version pinned in-repo, used instead of the latest-release\n\t * redirect. Always paired with `digests`: the release channel publishes no\n\t * trustworthy automatic checksum, so the repo commits one digest per asset\n\t * (computed from the official release download) and upgrades adopt a new\n\t * release by bumping the pin and refreshing the digests.\n\t */\n\tpinnedVersion?: string;\n\t/**\n\t * Repo-committed sha256 digest per asset name for `pinnedVersion`. A\n\t * missing entry fails the install visibly — it is never silently skipped\n\t * into an unverified download.\n\t */\n\tdigests?: Record<string, string>;\n}\n\nconst TOOLS: Record<string, ToolConfig> = {\n\tfd: {\n\t\tname: \"fd\",\n\t\trepo: \"sharkdp/fd\",\n\t\tbinaryName: \"fd\",\n\t\tsystemBinaryNames: [\"fd\", \"fdfind\"],\n\t\ttagPrefix: \"v\",\n\t\t// fd publishes no per-asset checksum (probed: asset and .sha256 companions\n\t\t// are absent), so the release is pinned in-repo and each asset's digest is\n\t\t// committed here. Upgrades adopt a new release by bumping pinnedVersion\n\t\t// and refreshing the digests from the official release assets.\n\t\tpinnedVersion: \"10.5.0\",\n\t\tdigests: {\n\t\t\t\"fd-v10.5.0-x86_64-apple-darwin.tar.gz\": \"7e31028c62c6955877735d0406807aa484c2a5e6f86235a59e26c29c301da590\",\n\t\t\t\"fd-v10.5.0-aarch64-apple-darwin.tar.gz\": \"b67e1836c468e42e411984b56e52fa7abec08c2bd22c867398e7cc134aac5e12\",\n\t\t\t\"fd-v10.5.0-x86_64-unknown-linux-musl.tar.gz\":\n\t\t\t\t\"761c72dc8e120d85b22292063be8a796e2eeb20eb3e4f38b8fa2343ccf3514a7\",\n\t\t\t\"fd-v10.5.0-aarch64-unknown-linux-musl.tar.gz\":\n\t\t\t\t\"d76c4317f7d5dba69f8a2a15856c90c777e7f0dd4e85f0de8c76de6992c374d4\",\n\t\t\t\"fd-v10.5.0-x86_64-pc-windows-msvc.zip\": \"a227701b8551c35a9931d9f6da75503cf86d88e182d71fb849a70864c5d57cd7\",\n\t\t\t\"fd-v10.5.0-aarch64-pc-windows-msvc.zip\": \"a2bcddcfd259b05357a77bbc6cd671fdb30f63fd266a0e748305890a8c5ceaa6\",\n\t\t},\n\t\tgetAssetName: (version, plat, architecture) => {\n\t\t\tif (plat === \"darwin\") {\n\t\t\t\tconst archStr = architecture === \"arm64\" ? \"aarch64\" : \"x86_64\";\n\t\t\t\treturn `fd-v${version}-${archStr}-apple-darwin.tar.gz`;\n\t\t\t} else if (plat === \"linux\") {\n\t\t\t\tconst archStr = architecture === \"arm64\" ? \"aarch64\" : \"x86_64\";\n\t\t\t\treturn `fd-v${version}-${archStr}-unknown-linux-musl.tar.gz`;\n\t\t\t} else if (plat === \"win32\") {\n\t\t\t\tconst archStr = architecture === \"arm64\" ? \"aarch64\" : \"x86_64\";\n\t\t\t\treturn `fd-v${version}-${archStr}-pc-windows-msvc.zip`;\n\t\t\t}\n\t\t\treturn null;\n\t\t},\n\t},\n\trg: {\n\t\tname: \"ripgrep\",\n\t\trepo: \"BurntSushi/ripgrep\",\n\t\tbinaryName: \"rg\",\n\t\ttagPrefix: \"\",\n\t\t// Every ripgrep release asset ships a sha256sum-format companion file.\n\t\tchecksumSuffix: \".sha256\",\n\t\tgetAssetName: (version, plat, architecture) => {\n\t\t\tif (plat === \"darwin\") {\n\t\t\t\tconst archStr = architecture === \"arm64\" ? \"aarch64\" : \"x86_64\";\n\t\t\t\treturn `ripgrep-${version}-${archStr}-apple-darwin.tar.gz`;\n\t\t\t} else if (plat === \"linux\") {\n\t\t\t\tconst archStr = architecture === \"arm64\" ? \"aarch64\" : \"x86_64\";\n\t\t\t\treturn `ripgrep-${version}-${archStr}-unknown-linux-musl.tar.gz`;\n\t\t\t} else if (plat === \"win32\") {\n\t\t\t\tconst archStr = architecture === \"arm64\" ? \"aarch64\" : \"x86_64\";\n\t\t\t\treturn `ripgrep-${version}-${archStr}-pc-windows-msvc.zip`;\n\t\t\t}\n\t\t\treturn null;\n\t\t},\n\t},\n};\n\n// Check if a command exists in PATH by trying to run it\nfunction commandExists(cmd: string): boolean {\n\ttry {\n\t\tconst result = spawnSync(cmd, [\"--version\"], { stdio: \"pipe\" });\n\t\t// Check for ENOENT error (command not found)\n\t\treturn result.error === undefined || result.error === null;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\n// Get the path to a tool (system-wide or in our tools dir)\nexport function getToolPath(tool: \"fd\" | \"rg\"): string | null {\n\tconst config = TOOLS[tool];\n\tif (!config) return null;\n\n\t// Check our tools directory first\n\tconst localPath = join(TOOLS_DIR, config.binaryName + (platform() === \"win32\" ? \".exe\" : \"\"));\n\tif (existsSync(localPath)) {\n\t\treturn localPath;\n\t}\n\n\t// Check system PATH - if found, just return the command name (it's in PATH)\n\tconst systemBinaryNames = config.systemBinaryNames ?? [config.binaryName];\n\tfor (const systemBinaryName of systemBinaryNames) {\n\t\tif (commandExists(systemBinaryName)) {\n\t\t\treturn systemBinaryName;\n\t\t}\n\t}\n\n\treturn null;\n}\n\n// Resolve the latest release version from the release page redirect.\n// The api.github.com releases endpoint counts against the anonymous API\n// quota (60 requests/hour per IP), which is permanently exhausted behind\n// shared egress IPs such as corporate proxies and CI runners. The web\n// endpoint answers with a redirect to the tagged release at no quota cost\n// and lives on the same origin as the binary download itself.\nexport async function getLatestVersion(repo: string): Promise<string> {\n\tconst response = await fetchWithRetry(\n\t\t`https://github.com/${repo}/releases/latest`,\n\t\t{\n\t\t\theaders: { \"User-Agent\": `${APP_NAME}-agent-forge` },\n\t\t\tredirect: \"manual\",\n\t\t},\n\t\t{ timeoutMs: NETWORK_TIMEOUT_MS },\n\t);\n\n\t// Only the status and headers matter here. Discard the body so the\n\t// connection can be reused.\n\ttry {\n\t\tawait response.body?.cancel();\n\t} catch {\n\t\t// Discarding the body is best-effort.\n\t}\n\n\tconst location = response.status >= 300 && response.status < 400 ? response.headers.get(\"location\") : null;\n\tif (!location) {\n\t\tthrow new Error(`Failed to resolve latest ${repo} release: HTTP ${response.status} without redirect`);\n\t}\n\n\tconst tag = new URL(location, \"https://github.com\").pathname.split(\"/\").pop();\n\tif (!tag || !location.includes(\"/releases/tag/\")) {\n\t\tthrow new Error(`Failed to resolve latest ${repo} release: unexpected redirect to ${location}`);\n\t}\n\treturn decodeURIComponent(tag).replace(/^v/, \"\");\n}\n\n/**\n * Integrity failure for a verified download. Carries both digests so callers\n * (and tests) can inspect the mismatch structurally instead of parsing the\n * message.\n */\nexport class DownloadIntegrityError extends Error {\n\treadonly expectedSha256: string;\n\treadonly actualSha256: string;\n\n\tconstructor(url: string, expectedSha256: string, actualSha256: string) {\n\t\tsuper(`Download integrity check failed for ${url}: expected sha256 ${expectedSha256}, got ${actualSha256}`);\n\t\tthis.name = \"DownloadIntegrityError\";\n\t\tthis.expectedSha256 = expectedSha256;\n\t\tthis.actualSha256 = actualSha256;\n\t}\n}\n\n// Download a file from URL. When `expectedSha256` is provided, the response\n// stream is hashed while it is written; a mismatch deletes the partial file\n// and rejects with a DownloadIntegrityError. Without it, behavior is\n// unchanged (unverified write).\nexport async function downloadFile(url: string, dest: string, expectedSha256: string | undefined): Promise<void> {\n\tconst response = await fetchWithRetry(url, undefined, { timeoutMs: DOWNLOAD_TIMEOUT_MS });\n\n\tif (!response.ok) {\n\t\tthrow new Error(`Download failed with HTTP ${response.status}: ${url}`);\n\t}\n\n\tif (!response.body) {\n\t\tthrow new Error(\"No response body\");\n\t}\n\n\tconst hash = createHash(\"sha256\");\n\tconst digestTap = new Transform({\n\t\ttransform(\n\t\t\tchunk: Buffer,\n\t\t\t_encoding: BufferEncoding,\n\t\t\tcallback: (error?: Error | null, data?: Buffer) => void,\n\t\t): void {\n\t\t\thash.update(chunk);\n\t\t\tcallback(null, chunk);\n\t\t},\n\t});\n\tconst fileStream = createWriteStream(dest);\n\tawait pipeline(Readable.fromWeb(response.body as NodeWebReadableStream), digestTap, fileStream);\n\n\tif (expectedSha256 === undefined) return;\n\tconst actual = hash.digest(\"hex\");\n\tconst expected = expectedSha256.trim().toLowerCase();\n\tif (actual !== expected) {\n\t\trmSync(dest, { force: true });\n\t\tthrow new DownloadIntegrityError(url, expected, actual);\n\t}\n}\n\nconst SHA256_HEX_PATTERN = /^[0-9a-f]{64}$/;\n\n// Resolve the expected sha256 for an asset from the tool's trusted checksum\n// source: the repo-committed digest map when present, otherwise the release's\n// per-asset companion checksum file. Undefined means no trusted source exists\n// for the channel and the download runs unverified.\nasync function resolveExpectedSha256(\n\tconfig: ToolConfig,\n\tdownloadUrl: string,\n\tassetName: string,\n): Promise<string | undefined> {\n\tconst digests = config.digests;\n\tif (digests) {\n\t\tconst digest = digests[assetName];\n\t\tif (digest === undefined) {\n\t\t\tthrow new Error(`No committed sha256 for ${config.name} asset ${assetName}; refresh the pin and its digests`);\n\t\t}\n\t\treturn digest;\n\t}\n\tif (config.checksumSuffix !== undefined) {\n\t\treturn fetchReleaseSha256(`${downloadUrl}${config.checksumSuffix}`);\n\t}\n\treturn undefined;\n}\n\n// Fetch a release's per-asset checksum companion file (sha256sum format:\n// \"<hex>  <asset name>\") and return the lowercase hex digest.\nasync function fetchReleaseSha256(checksumUrl: string): Promise<string> {\n\tconst response = await fetchWithRetry(checksumUrl, undefined, { timeoutMs: NETWORK_TIMEOUT_MS });\n\tif (!response.ok) {\n\t\tthrow new Error(`Failed to fetch release checksum: HTTP ${response.status}: ${checksumUrl}`);\n\t}\n\tconst digest = (await response.text()).trim().split(/\\s+/)[0]?.toLowerCase() ?? \"\";\n\tif (!SHA256_HEX_PATTERN.test(digest)) {\n\t\tthrow new Error(`Release checksum has an unexpected format: ${checksumUrl}`);\n\t}\n\treturn digest;\n}\n\nfunction findBinaryRecursively(rootDir: string, binaryFileName: string): string | null {\n\tconst stack: string[] = [rootDir];\n\n\twhile (stack.length > 0) {\n\t\t// v8 ignore next -- 循环条件保证栈非空，pop() 不会返回 undefined\n\t\tconst currentDir = stack.pop();\n\t\tif (!currentDir) continue;\n\n\t\tconst entries = readdirSync(currentDir, { withFileTypes: true });\n\t\tfor (const entry of entries) {\n\t\t\tconst fullPath = join(currentDir, entry.name);\n\t\t\tif (entry.isFile() && entry.name === binaryFileName) {\n\t\t\t\treturn fullPath;\n\t\t\t}\n\t\t\tif (entry.isDirectory()) {\n\t\t\t\tstack.push(fullPath);\n\t\t\t}\n\t\t}\n\t}\n\n\treturn null;\n}\n\nfunction formatSpawnFailure(result: SpawnSyncReturns<Buffer>): string {\n\tif (result.error?.message) {\n\t\treturn result.error.message;\n\t}\n\tconst stderr = result.stderr?.toString().trim();\n\tif (stderr) {\n\t\treturn stderr;\n\t}\n\tconst stdout = result.stdout?.toString().trim();\n\tif (stdout) {\n\t\treturn stdout;\n\t}\n\treturn `exit status ${result.status ?? \"unknown\"}`;\n}\n\nfunction runExtractionCommand(command: string, args: string[]): string | null {\n\tconst result = spawnSync(command, args, { stdio: \"pipe\" });\n\tif (!result.error && result.status === 0) {\n\t\treturn null;\n\t}\n\treturn `${command}: ${formatSpawnFailure(result)}`;\n}\n\nfunction extractTarGzArchive(archivePath: string, extractDir: string, assetName: string): void {\n\tconst failure = runExtractionCommand(\"tar\", [\"xzf\", archivePath, \"-C\", extractDir]);\n\tif (failure) {\n\t\tthrow new Error(`Failed to extract ${assetName}: ${failure}`);\n\t}\n}\n\nfunction getWindowsTarCommand(): string {\n\tconst systemRoot = process.env.SystemRoot ?? process.env.WINDIR;\n\tif (systemRoot) {\n\t\tconst systemTar = join(systemRoot, \"System32\", \"tar.exe\");\n\t\tif (existsSync(systemTar)) {\n\t\t\treturn systemTar;\n\t\t}\n\t}\n\treturn \"tar.exe\";\n}\n\nfunction extractZipArchive(archivePath: string, extractDir: string, assetName: string): void {\n\tconst failures: string[] = [];\n\n\t// v8 ignore next -- getAssetName 仅在 win32 产出 .zip 资产，非 win32 不会进入 zip 解包分支\n\tif (platform() === \"win32\") {\n\t\t// Windows ships bsdtar as tar.exe, which supports zip files. Prefer the\n\t\t// System32 binary over Git Bash's GNU tar, which does not handle zip archives.\n\t\tconst tarFailure = runExtractionCommand(getWindowsTarCommand(), [\"xf\", archivePath, \"-C\", extractDir]);\n\t\tif (!tarFailure) return;\n\t\tfailures.push(tarFailure);\n\n\t\tconst script =\n\t\t\t\"& { param($archive, $destination) $ErrorActionPreference = 'Stop'; Expand-Archive -LiteralPath $archive -DestinationPath $destination -Force }\";\n\t\tconst powershellFailure = runExtractionCommand(\"powershell.exe\", [\n\t\t\t\"-NoLogo\",\n\t\t\t\"-NoProfile\",\n\t\t\t\"-NonInteractive\",\n\t\t\t\"-ExecutionPolicy\",\n\t\t\t\"Bypass\",\n\t\t\t\"-Command\",\n\t\t\tscript,\n\t\t\tarchivePath,\n\t\t\textractDir,\n\t\t]);\n\t\tif (!powershellFailure) return;\n\t\tfailures.push(powershellFailure);\n\t} else {\n\t\t// v8 ignore start -- fd/rg 在非 Windows 平台的资产恒为 .tar.gz，unzip 分支不可达\n\t\tconst unzipFailure = runExtractionCommand(\"unzip\", [\"-q\", archivePath, \"-d\", extractDir]);\n\t\tif (!unzipFailure) return;\n\t\tfailures.push(unzipFailure);\n\n\t\tconst tarFailure = runExtractionCommand(\"tar\", [\"xf\", archivePath, \"-C\", extractDir]);\n\t\tif (!tarFailure) return;\n\t\tfailures.push(tarFailure);\n\t\t// v8 ignore stop\n\t}\n\n\tthrow new Error(`Failed to extract ${assetName}: ${failures.join(\"; \")}`);\n}\n\n// Download and install a tool\nasync function downloadTool(tool: \"fd\" | \"rg\"): Promise<string> {\n\tconst config = TOOLS[tool];\n\t// v8 ignore next -- ensureTool 已做同样检查，此兜底经公共 API 不可达\n\tif (!config) throw new Error(`Unknown tool: ${tool}`);\n\n\tconst plat = platform();\n\tconst architecture = arch();\n\n\t// Pinned releases (fd) skip the version lookup entirely: the digest map only\n\t// covers the pinned release, so tracking latest would break verification.\n\tconst version = config.pinnedVersion ?? (await getLatestVersion(config.repo));\n\n\t// Get asset name for this platform\n\tconst assetName = config.getAssetName(version, plat, architecture);\n\tif (!assetName) {\n\t\tthrow new Error(`Unsupported platform: ${plat}/${architecture}`);\n\t}\n\n\t// Create tools directory\n\tmkdirSync(TOOLS_DIR, { recursive: true });\n\n\tconst downloadUrl = `https://github.com/${config.repo}/releases/download/${config.tagPrefix}${version}/${assetName}`;\n\t// The expected digest comes from whichever trusted source the channel has:\n\t// a repo-committed per-asset digest (fd) or an upstream companion checksum\n\t// file (rg). A digest that cannot be obtained or matched fails the install\n\t// visibly (ensureTool surfaces it as a warning); it is never silently skipped.\n\tconst expectedSha256 = await resolveExpectedSha256(config, downloadUrl, assetName);\n\tconst archivePath = join(TOOLS_DIR, assetName);\n\tconst binaryExt = plat === \"win32\" ? \".exe\" : \"\";\n\tconst binaryPath = join(TOOLS_DIR, config.binaryName + binaryExt);\n\n\t// Download\n\tawait downloadFile(downloadUrl, archivePath, expectedSha256);\n\n\t// Extract into a unique temp directory. fd and rg downloads can run concurrently\n\t// during startup, so sharing a fixed directory causes races.\n\tconst extractDir = join(\n\t\tTOOLS_DIR,\n\t\t`extract_tmp_${config.binaryName}_${process.pid}_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`,\n\t);\n\tmkdirSync(extractDir, { recursive: true });\n\n\ttry {\n\t\tif (assetName.endsWith(\".tar.gz\")) {\n\t\t\textractTarGzArchive(archivePath, extractDir, assetName);\n\t\t} else if (assetName.endsWith(\".zip\")) {\n\t\t\textractZipArchive(archivePath, extractDir, assetName);\n\t\t} else {\n\t\t\t// v8 ignore next -- getAssetName 产出的资产名恒为 .tar.gz 或 .zip，此兜底不可达\n\t\t\tthrow new Error(`Unsupported archive format: ${assetName}`);\n\t\t}\n\n\t\t// Find the binary in extracted files. Some archives contain files directly\n\t\t// at root, others nest under a versioned subdirectory.\n\t\tconst binaryFileName = config.binaryName + binaryExt;\n\t\tconst extractedDir = join(extractDir, assetName.replace(/\\.(tar\\.gz|zip)$/, \"\"));\n\t\tconst extractedBinaryCandidates = [join(extractedDir, binaryFileName), join(extractDir, binaryFileName)];\n\t\tlet extractedBinary = extractedBinaryCandidates.find((candidate) => existsSync(candidate));\n\n\t\tif (!extractedBinary) {\n\t\t\textractedBinary = findBinaryRecursively(extractDir, binaryFileName) ?? undefined;\n\t\t}\n\n\t\tif (extractedBinary) {\n\t\t\trenameSync(extractedBinary, binaryPath);\n\t\t} else {\n\t\t\tthrow new Error(`Binary not found in archive: expected ${binaryFileName} under ${extractDir}`);\n\t\t}\n\n\t\t// Make executable (Unix only)\n\t\tif (plat !== \"win32\") {\n\t\t\tchmodSync(binaryPath, 0o755);\n\t\t}\n\t} finally {\n\t\t// Cleanup\n\t\trmSync(archivePath, { force: true });\n\t\trmSync(extractDir, { recursive: true, force: true });\n\t}\n\n\treturn binaryPath;\n}\n\n// Termux package names for tools\nconst TERMUX_PACKAGES: Record<string, string> = {\n\tfd: \"fd\",\n\trg: \"ripgrep\",\n};\n\nexport interface ToolStatus {\n\ttype: \"info\" | \"warning\";\n\tmessage: string;\n}\n\n/**\n * Ensure a tool is available, downloading if necessary.\n * Reports progress through `onStatus`; status messages are otherwise silent.\n * Returns the tool path, or undefined if unavailable.\n */\nexport async function ensureTool(\n\ttool: \"fd\" | \"rg\",\n\tonStatus?: (status: ToolStatus) => void,\n): Promise<string | undefined> {\n\tconst existingPath = getToolPath(tool);\n\tif (existingPath) {\n\t\treturn existingPath;\n\t}\n\n\tconst config = TOOLS[tool];\n\tif (!config) return undefined;\n\n\tif (isOfflineModeEnabled()) {\n\t\tonStatus?.({ type: \"warning\", message: `${config.name} not found. Offline mode enabled, skipping download.` });\n\t\treturn undefined;\n\t}\n\n\t// On Android/Termux, Linux binaries don't work due to Bionic libc incompatibility.\n\t// Users must install via pkg.\n\tif (platform() === \"android\") {\n\t\t// v8 ignore next -- TERMUX_PACKAGES 覆盖全部受支持工具，?? 回退不可达\n\t\tconst pkgName = TERMUX_PACKAGES[tool] ?? tool;\n\t\tonStatus?.({ type: \"warning\", message: `${config.name} not found. Install with: pkg install ${pkgName}` });\n\t\treturn undefined;\n\t}\n\n\t// Tool not found - download it\n\tonStatus?.({ type: \"info\", message: `${config.name} not found. Downloading...` });\n\n\ttry {\n\t\tconst path = await downloadTool(tool);\n\t\tonStatus?.({ type: \"info\", message: `${config.name} installed to ${path}` });\n\t\treturn path;\n\t} catch (e) {\n\t\t// Include the error cause chain: fetch failures surface as a bare\n\t\t// \"fetch failed\" TypeError with the actionable detail (DNS, TLS,\n\t\t// timeout) hidden in the cause. Depth-capped to guard against\n\t\t// circular cause chains.\n\t\tconst messages: string[] = [];\n\t\tfor (\n\t\t\tlet current: unknown = e, depth = 0;\n\t\t\tcurrent instanceof Error && depth < 5;\n\t\t\tcurrent = current.cause, depth++\n\t\t) {\n\t\t\tif (!messages.includes(current.message)) messages.push(current.message);\n\t\t}\n\t\tonStatus?.({\n\t\t\ttype: \"warning\",\n\t\t\tmessage: `Failed to download ${config.name}: ${messages.length > 0 ? messages.join(\": \") : String(e)}`,\n\t\t});\n\t\treturn undefined;\n\t}\n}\n"]}

package/dist/utils/version-check.d.ts

@@ -0,0 +1,21 @@
+/** Published npm name of the framework (D-075: workspace name differs from the publish name). */
+export declare const EXPECTED_PACKAGE_NAME = "@ai-agent-forge/agent-forge";
+export interface LatestRelease {
+    version: string;
+    packageName?: string;
+    note?: string;
+}
+/** Include useful errno details hidden behind Node's generic "fetch failed" error. */
+export declare function formatVersionCheckError(error: unknown): string;
+export declare function comparePackageVersions(leftVersion: string, rightVersion: string): number | undefined;
+export declare function isNewerPackageVersion(candidateVersion: string, currentVersion: string): boolean;
+export declare function getLatestRelease(currentVersion: string, options?: {
+    timeoutMs?: number;
+    retry?: boolean;
+}): Promise<LatestRelease | undefined>;
+export declare function getLatestVersion(currentVersion: string, options?: {
+    timeoutMs?: number;
+    retry?: boolean;
+}): Promise<string | undefined>;
+export declare function checkForNewVersion(currentVersion: string): Promise<LatestRelease | undefined>;
+//# sourceMappingURL=version-check.d.ts.map

package/dist/utils/version-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-check.d.ts","sourceRoot":"","sources":["../../src/utils/version-check.ts"],"names":[],"mappings":"AAKA,iGAAiG;AACjG,eAAO,MAAM,qBAAqB,gCAAgC,CAAC;AAEnE,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;CACd;AAED,sFAAsF;AACtF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAiB9D;AAED,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAOpG;AAED,wBAAgB,qBAAqB,CAAC,gBAAgB,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAM/F;AAED,wBAAsB,gBAAgB,CACrC,cAAc,EAAE,MAAM,EACtB,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GACnD,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAyCpC;AAED,wBAAsB,gBAAgB,CACrC,cAAc,EAAE,MAAM,EACtB,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GACnD,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAE7B;AAED,wBAAsB,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAYnG","sourcesContent":["import { compare, valid } from \"semver\";\nimport { getAgentForgeUserAgent } from \"./agent-forge-user-agent.ts\";\nimport { fetchWithRetry } from \"./management-http.ts\";\n\nconst DEFAULT_VERSION_CHECK_TIMEOUT_MS = 10000;\n/** Published npm name of the framework (D-075: workspace name differs from the publish name). */\nexport const EXPECTED_PACKAGE_NAME = \"@ai-agent-forge/agent-forge\";\n\nexport interface LatestRelease {\n\tversion: string;\n\tpackageName?: string;\n\tnote?: string;\n}\n\n/** Include useful errno details hidden behind Node's generic \"fetch failed\" error. */\nexport function formatVersionCheckError(error: unknown): string {\n\tconst rootMessage = error instanceof Error && error.message ? error.message : String(error);\n\tconst cause = error instanceof Error ? error.cause : undefined;\n\tconst causes = cause instanceof AggregateError ? cause.errors : cause === undefined ? [] : [cause];\n\tconst codes = causes\n\t\t.map((value) =>\n\t\t\ttypeof value === \"object\" && value !== null && \"code\" in value && typeof value.code === \"string\"\n\t\t\t\t? value.code\n\t\t\t\t: undefined,\n\t\t)\n\t\t.filter((code): code is string => code !== undefined);\n\n\tif (codes.length > 0) return `${rootMessage} (${[...new Set(codes)].join(\", \")})`;\n\tconst causeMessage = causes.find(\n\t\t(value): value is Error => value instanceof Error && Boolean(value.message),\n\t)?.message;\n\treturn causeMessage ? `${rootMessage} (cause: ${causeMessage})` : rootMessage;\n}\n\nexport function comparePackageVersions(leftVersion: string, rightVersion: string): number | undefined {\n\tconst left = valid(leftVersion.trim());\n\tconst right = valid(rightVersion.trim());\n\tif (!left || !right) {\n\t\treturn undefined;\n\t}\n\treturn compare(left, right);\n}\n\nexport function isNewerPackageVersion(candidateVersion: string, currentVersion: string): boolean {\n\tconst comparison = comparePackageVersions(candidateVersion, currentVersion);\n\tif (comparison !== undefined) {\n\t\treturn comparison > 0;\n\t}\n\treturn candidateVersion.trim() !== currentVersion.trim();\n}\n\nexport async function getLatestRelease(\n\tcurrentVersion: string,\n\toptions: { timeoutMs?: number; retry?: boolean } = {},\n): Promise<LatestRelease | undefined> {\n\tif (process.env.AGENT_FORGE_OFFLINE) return undefined;\n\tconst versionCheckUrl = process.env.AGENT_FORGE_VERSION_CHECK_URL?.trim();\n\tif (!versionCheckUrl) return undefined;\n\n\tconst response = await fetchWithRetry(\n\t\tversionCheckUrl,\n\t\t{\n\t\t\theaders: {\n\t\t\t\t\"User-Agent\": getAgentForgeUserAgent(currentVersion),\n\t\t\t\taccept: \"application/json\",\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\tmaxRetries: options.retry ? 2 : 0,\n\t\t\ttimeoutMs: options.timeoutMs ?? DEFAULT_VERSION_CHECK_TIMEOUT_MS,\n\t\t},\n\t);\n\tif (!response.ok) return undefined;\n\n\tconst data = (await response.json()) as {\n\t\tpackageName?: unknown;\n\t\tversion?: unknown;\n\t\tnote?: unknown;\n\t};\n\tif (typeof data.version !== \"string\" || !data.version.trim()) {\n\t\treturn undefined;\n\t}\n\tconst packageName =\n\t\ttypeof data.packageName === \"string\" && data.packageName.trim() ? data.packageName.trim() : undefined;\n\tif (packageName !== undefined && packageName !== EXPECTED_PACKAGE_NAME) {\n\t\tthrow new Error(\n\t\t\t`Version service returned an unexpected package name: ${packageName}. Expected ${EXPECTED_PACKAGE_NAME}.`,\n\t\t);\n\t}\n\tconst note = typeof data.note === \"string\" && data.note.trim() ? data.note.trim() : undefined;\n\treturn {\n\t\tversion: data.version.trim(),\n\t\tpackageName,\n\t\t...(note ? { note } : {}),\n\t};\n}\n\nexport async function getLatestVersion(\n\tcurrentVersion: string,\n\toptions: { timeoutMs?: number; retry?: boolean } = {},\n): Promise<string | undefined> {\n\treturn (await getLatestRelease(currentVersion, options))?.version;\n}\n\nexport async function checkForNewVersion(currentVersion: string): Promise<LatestRelease | undefined> {\n\tif (process.env.AGENT_FORGE_SKIP_VERSION_CHECK) return undefined;\n\n\ttry {\n\t\tconst latestRelease = await getLatestRelease(currentVersion);\n\t\tif (latestRelease && isNewerPackageVersion(latestRelease.version, currentVersion)) {\n\t\t\treturn latestRelease;\n\t\t}\n\t\treturn undefined;\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n"]}

package/dist/utils/version-check.js

@@ -0,0 +1,86 @@
+import { compare, valid } from "semver";
+import { getAgentForgeUserAgent } from "./agent-forge-user-agent.js";
+import { fetchWithRetry } from "./management-http.js";
+const DEFAULT_VERSION_CHECK_TIMEOUT_MS = 10000;
+/** Published npm name of the framework (D-075: workspace name differs from the publish name). */
+export const EXPECTED_PACKAGE_NAME = "@ai-agent-forge/agent-forge";
+/** Include useful errno details hidden behind Node's generic "fetch failed" error. */
+export function formatVersionCheckError(error) {
+    const rootMessage = error instanceof Error && error.message ? error.message : String(error);
+    const cause = error instanceof Error ? error.cause : undefined;
+    const causes = cause instanceof AggregateError ? cause.errors : cause === undefined ? [] : [cause];
+    const codes = causes
+        .map((value) => typeof value === "object" && value !== null && "code" in value && typeof value.code === "string"
+        ? value.code
+        : undefined)
+        .filter((code) => code !== undefined);
+    if (codes.length > 0)
+        return `${rootMessage} (${[...new Set(codes)].join(", ")})`;
+    const causeMessage = causes.find((value) => value instanceof Error && Boolean(value.message))?.message;
+    return causeMessage ? `${rootMessage} (cause: ${causeMessage})` : rootMessage;
+}
+export function comparePackageVersions(leftVersion, rightVersion) {
+    const left = valid(leftVersion.trim());
+    const right = valid(rightVersion.trim());
+    if (!left || !right) {
+        return undefined;
+    }
+    return compare(left, right);
+}
+export function isNewerPackageVersion(candidateVersion, currentVersion) {
+    const comparison = comparePackageVersions(candidateVersion, currentVersion);
+    if (comparison !== undefined) {
+        return comparison > 0;
+    }
+    return candidateVersion.trim() !== currentVersion.trim();
+}
+export async function getLatestRelease(currentVersion, options = {}) {
+    if (process.env.AGENT_FORGE_OFFLINE)
+        return undefined;
+    const versionCheckUrl = process.env.AGENT_FORGE_VERSION_CHECK_URL?.trim();
+    if (!versionCheckUrl)
+        return undefined;
+    const response = await fetchWithRetry(versionCheckUrl, {
+        headers: {
+            "User-Agent": getAgentForgeUserAgent(currentVersion),
+            accept: "application/json",
+        },
+    }, {
+        maxRetries: options.retry ? 2 : 0,
+        timeoutMs: options.timeoutMs ?? DEFAULT_VERSION_CHECK_TIMEOUT_MS,
+    });
+    if (!response.ok)
+        return undefined;
+    const data = (await response.json());
+    if (typeof data.version !== "string" || !data.version.trim()) {
+        return undefined;
+    }
+    const packageName = typeof data.packageName === "string" && data.packageName.trim() ? data.packageName.trim() : undefined;
+    if (packageName !== undefined && packageName !== EXPECTED_PACKAGE_NAME) {
+        throw new Error(`Version service returned an unexpected package name: ${packageName}. Expected ${EXPECTED_PACKAGE_NAME}.`);
+    }
+    const note = typeof data.note === "string" && data.note.trim() ? data.note.trim() : undefined;
+    return {
+        version: data.version.trim(),
+        packageName,
+        ...(note ? { note } : {}),
+    };
+}
+export async function getLatestVersion(currentVersion, options = {}) {
+    return (await getLatestRelease(currentVersion, options))?.version;
+}
+export async function checkForNewVersion(currentVersion) {
+    if (process.env.AGENT_FORGE_SKIP_VERSION_CHECK)
+        return undefined;
+    try {
+        const latestRelease = await getLatestRelease(currentVersion);
+        if (latestRelease && isNewerPackageVersion(latestRelease.version, currentVersion)) {
+            return latestRelease;
+        }
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=version-check.js.map