@amd-gaia/gaia 0.1.0 → 0.2.0

package/dist/logger.js

@@ -0,0 +1,30 @@
+// Copyright(C) 2025-2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: MIT
+/**
+ * Minimal namespaced logger. Debug output is OFF by default and enabled via the
+ * `DEBUG` env var (substring match on `gaia`, or `*`). Everything goes to stderr
+ * so it never corrupts stdout — which the TUI owns once it is exec'd.
+ */
+function debugEnabled() {
+    const d = (typeof process !== "undefined" && process.env?.["DEBUG"]) || "";
+    return d === "*" || d.includes("gaia");
+}
+export function createLogger(namespace) {
+    const tag = `[gaia:${namespace}]`;
+    return {
+        debug(msg, ...rest) {
+            if (debugEnabled())
+                console.error(`${tag} ${msg}`, ...rest);
+        },
+        info(msg, ...rest) {
+            console.error(`${tag} ${msg}`, ...rest);
+        },
+        warn(msg, ...rest) {
+            console.error(`${tag} WARN ${msg}`, ...rest);
+        },
+        error(msg, ...rest) {
+            console.error(`${tag} ERROR ${msg}`, ...rest);
+        },
+    };
+}
+//# sourceMappingURL=logger.js.map

package/dist/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,+BAA+B;AAC/B;;;;GAIG;AAEH,SAAS,YAAY;IACnB,MAAM,CAAC,GAAG,CAAC,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3E,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AASD,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,MAAM,GAAG,GAAG,SAAS,SAAS,GAAG,CAAC;IAClC,OAAO;QACL,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI;YAChB,IAAI,YAAY,EAAE;gBAAE,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;YACf,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;YACf,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,SAAS,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;QAC/C,CAAC;QACD,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI;YAChB,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,UAAU,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/platform.d.ts

@@ -0,0 +1,100 @@
+/**
+ * Platform/arch resolution and binary-lock loading.
+ *
+ * The lock file (`binaries.lock.json`, shipped in the published package) is the
+ * single source of truth for which artifacts to download for the current host
+ * and what their SHA-256 must be. Platform keys are
+ * `${process.platform}-${process.arch}`.
+ *
+ * The lock is keyed by COMPONENT first (`sidecar` and `tui`), because
+ * `npx @amd-gaia/gaia` needs both and they differ in three ways: platform
+ * coverage (the Go TUI cross-compiles to arm64 Linux/Windows, the frozen Python
+ * sidecar does not), version, and — since schemaVersion 3.0 — the hub lane they
+ * are published in.
+ *
+ * The two lanes:
+ *
+ *   sidecar  agents/gaia/<agentVersion>/          built by this package's release
+ *   tui      agents/terminal-hub/<tuiVersion>/    the `terminal-hub` component,
+ *                                                 published by the core release
+ *
+ * The TUI is therefore the SAME binary as `gaia tui` from a core install — this
+ * package consumes it rather than building a second copy, so the two can never
+ * drift in behaviour or version. Each component carries its own `baseUrl`, which
+ * is what schemaVersion 2.0's single top-level `baseUrl` could not express.
+ *
+ * The terminal-hub lane spells its Windows artifacts `win-x64` / `win-arm64`,
+ * while Node's `process.platform` gives `win32`. That difference is carried by
+ * the entry's `filename` (data), never by a code path — see `TUI_ARTIFACT_NAMES`.
+ */
+/** The two binaries `npx @amd-gaia/gaia` needs. */
+export declare const COMPONENTS: readonly ["sidecar", "tui"];
+export type ComponentName = (typeof COMPONENTS)[number];
+/** The lock schema this package reads. Loading any other major fails loudly. */
+export declare const SCHEMA_MAJOR = 3;
+/** One component+platform artifact entry in the lock file. */
+export interface BinaryLockEntry {
+    /** Artifact filename as published under the component's base URL. */
+    filename: string;
+    /** Lowercase hex SHA-256 of the downloaded artifact. */
+    sha256: string;
+    /** Size in bytes (informational; not enforced). */
+    size?: number;
+    /** Basename the executable is written as on disk (with platform ext). */
+    executable: string;
+}
+/** One component's lane: where it is published, at what version, for which platforms. */
+export interface ComponentLock {
+    /** The component's own released version — not necessarily `agentVersion`. */
+    componentVersion: string;
+    /** Download base URL for THIS component. Overridable at fetch time. */
+    baseUrl: string;
+    platforms: Record<string, BinaryLockEntry>;
+}
+/** The whole lock file (`binaries.lock.json`), schemaVersion 3.x. */
+export interface BinaryLock {
+    schemaVersion: string;
+    agentVersion: string;
+    components: Record<string, ComponentLock>;
+}
+/**
+ * Platform keys the sidecar publishes for. PyInstaller freezes on the host it
+ * runs on and there is no arm64 Linux/Windows CI runner for it, so this is a
+ * strict subset of the TUI's coverage.
+ */
+export declare const SUPPORTED_SIDECAR_PLATFORMS: readonly ["win32-x64", "darwin-arm64", "darwin-x64", "linux-x64"];
+/** Platform keys the TUI publishes for (Go cross-compiles all six). */
+export declare const SUPPORTED_TUI_PLATFORMS: readonly ["win32-x64", "win32-arm64", "darwin-arm64", "darwin-x64", "linux-x64", "linux-arm64"];
+/** Every platform key at least one component publishes for. */
+export declare const SUPPORTED_PLATFORMS: readonly ["win32-x64", "win32-arm64", "darwin-arm64", "darwin-x64", "linux-x64", "linux-arm64"];
+/**
+ * npm platform key → the artifact name the terminal-hub lane publishes.
+ *
+ * The mapping exists for exactly one reason: terminal-hub names its Windows
+ * builds `win-x64` / `win-arm64` (Go's GOOS vocabulary), while our keys come
+ * from `process.platform`, which says `win32`. Everything else is identical.
+ * This table is the assertion, not the lookup — the lock's `filename` is what
+ * the fetcher uses, and `test/lock.test.ts` checks the two agree, so a hub-side
+ * rename shows up as a failing test rather than a 404 on a user's first run.
+ */
+export declare const TUI_ARTIFACT_NAMES: Record<string, string>;
+/** Resolve the current host's platform key, e.g. "win32-x64". */
+export declare function currentPlatformKey(platform?: NodeJS.Platform, arch?: string): string;
+/** Locate `binaries.lock.json` (package root, one level up from dist/ or src/). */
+export declare function defaultLockPath(): string;
+/** Load and minimally validate the lock file. */
+export declare function loadLock(lockPath?: string): BinaryLock;
+/** One component's lane, failing loudly when the lock does not declare it. */
+export declare function componentLock(lock: BinaryLock, component: ComponentName): ComponentLock;
+/** The download base URL for one component. */
+export declare function componentBaseUrl(lock: BinaryLock, component: ComponentName): string;
+/** The platform keys a component publishes for, per the lock. */
+export declare function platformsFor(lock: BinaryLock, component: ComponentName): string[];
+/**
+ * Resolve one component's lock entry for a platform key, failing loudly when the
+ * component has no build for it (e.g. the sidecar on linux-arm64).
+ */
+export declare function resolveEntry(lock: BinaryLock, component: ComponentName, platformKey: string): BinaryLockEntry;
+/** True when an entry's sha256 is the not-yet-published placeholder sentinel. */
+export declare function isPlaceholderSha(sha256: string): boolean;
+//# sourceMappingURL=platform.d.ts.map

package/dist/platform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../src/platform.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAQH,mDAAmD;AACnD,eAAO,MAAM,UAAU,6BAA8B,CAAC;AACtD,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAExD,gFAAgF;AAChF,eAAO,MAAM,YAAY,IAAI,CAAC;AAE9B,8DAA8D;AAC9D,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,yFAAyF;AACzF,MAAM,WAAW,aAAa;IAC5B,6EAA6E;IAC7E,gBAAgB,EAAE,MAAM,CAAC;IACzB,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CAC5C;AAED,qEAAqE;AACrE,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CAC3C;AAED;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,mEAK9B,CAAC;AAEX,uEAAuE;AACvE,eAAO,MAAM,uBAAuB,iGAO1B,CAAC;AAEX,+DAA+D;AAC/D,eAAO,MAAM,mBAAmB,iGAA0B,CAAC;AAE3D;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAOrD,CAAC;AAEF,iEAAiE;AACjE,wBAAgB,kBAAkB,CAChC,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,IAAI,GAAE,MAAqB,GAC1B,MAAM,CAER;AAED,mFAAmF;AACnF,wBAAgB,eAAe,IAAI,MAAM,CAGxC;AAED,iDAAiD;AACjD,wBAAgB,QAAQ,CAAC,QAAQ,GAAE,MAA0B,GAAG,UAAU,CA2DzE;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,GAAG,aAAa,CASvF;AAED,+CAA+C;AAC/C,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,GAAG,MAAM,CASnF;AAED,iEAAiE;AACjE,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,GAAG,MAAM,EAAE,CAEjF;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,aAAa,EACxB,WAAW,EAAE,MAAM,GAClB,eAAe,CAqCjB;AAED,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAGxD"}

package/dist/platform.js

@@ -0,0 +1,202 @@
+// Copyright(C) 2025-2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: MIT
+/**
+ * Platform/arch resolution and binary-lock loading.
+ *
+ * The lock file (`binaries.lock.json`, shipped in the published package) is the
+ * single source of truth for which artifacts to download for the current host
+ * and what their SHA-256 must be. Platform keys are
+ * `${process.platform}-${process.arch}`.
+ *
+ * The lock is keyed by COMPONENT first (`sidecar` and `tui`), because
+ * `npx @amd-gaia/gaia` needs both and they differ in three ways: platform
+ * coverage (the Go TUI cross-compiles to arm64 Linux/Windows, the frozen Python
+ * sidecar does not), version, and — since schemaVersion 3.0 — the hub lane they
+ * are published in.
+ *
+ * The two lanes:
+ *
+ *   sidecar  agents/gaia/<agentVersion>/          built by this package's release
+ *   tui      agents/terminal-hub/<tuiVersion>/    the `terminal-hub` component,
+ *                                                 published by the core release
+ *
+ * The TUI is therefore the SAME binary as `gaia tui` from a core install — this
+ * package consumes it rather than building a second copy, so the two can never
+ * drift in behaviour or version. Each component carries its own `baseUrl`, which
+ * is what schemaVersion 2.0's single top-level `baseUrl` could not express.
+ *
+ * The terminal-hub lane spells its Windows artifacts `win-x64` / `win-arm64`,
+ * while Node's `process.platform` gives `win32`. That difference is carried by
+ * the entry's `filename` (data), never by a code path — see `TUI_ARTIFACT_NAMES`.
+ */
+import { fileURLToPath } from "node:url";
+import path from "node:path";
+import fs from "node:fs";
+import { PlatformError } from "./errors.js";
+/** The two binaries `npx @amd-gaia/gaia` needs. */
+export const COMPONENTS = ["sidecar", "tui"];
+/** The lock schema this package reads. Loading any other major fails loudly. */
+export const SCHEMA_MAJOR = 3;
+/**
+ * Platform keys the sidecar publishes for. PyInstaller freezes on the host it
+ * runs on and there is no arm64 Linux/Windows CI runner for it, so this is a
+ * strict subset of the TUI's coverage.
+ */
+export const SUPPORTED_SIDECAR_PLATFORMS = [
+    "win32-x64",
+    "darwin-arm64",
+    "darwin-x64",
+    "linux-x64",
+];
+/** Platform keys the TUI publishes for (Go cross-compiles all six). */
+export const SUPPORTED_TUI_PLATFORMS = [
+    "win32-x64",
+    "win32-arm64",
+    "darwin-arm64",
+    "darwin-x64",
+    "linux-x64",
+    "linux-arm64",
+];
+/** Every platform key at least one component publishes for. */
+export const SUPPORTED_PLATFORMS = SUPPORTED_TUI_PLATFORMS;
+/**
+ * npm platform key → the artifact name the terminal-hub lane publishes.
+ *
+ * The mapping exists for exactly one reason: terminal-hub names its Windows
+ * builds `win-x64` / `win-arm64` (Go's GOOS vocabulary), while our keys come
+ * from `process.platform`, which says `win32`. Everything else is identical.
+ * This table is the assertion, not the lookup — the lock's `filename` is what
+ * the fetcher uses, and `test/lock.test.ts` checks the two agree, so a hub-side
+ * rename shows up as a failing test rather than a 404 on a user's first run.
+ */
+export const TUI_ARTIFACT_NAMES = {
+    "win32-x64": "gaia-win-x64.exe",
+    "win32-arm64": "gaia-win-arm64.exe",
+    "darwin-arm64": "gaia-darwin-arm64",
+    "darwin-x64": "gaia-darwin-x64",
+    "linux-x64": "gaia-linux-x64",
+    "linux-arm64": "gaia-linux-arm64",
+};
+/** Resolve the current host's platform key, e.g. "win32-x64". */
+export function currentPlatformKey(platform = process.platform, arch = process.arch) {
+    return `${platform}-${arch}`;
+}
+/** Locate `binaries.lock.json` (package root, one level up from dist/ or src/). */
+export function defaultLockPath() {
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    return path.resolve(here, "..", "binaries.lock.json");
+}
+/** Load and minimally validate the lock file. */
+export function loadLock(lockPath = defaultLockPath()) {
+    let raw;
+    try {
+        raw = fs.readFileSync(lockPath, "utf8");
+    }
+    catch (e) {
+        throw new PlatformError(`cannot read binaries.lock.json at ${lockPath}: ${e.message}. ` +
+            "This manifest ships with the package; reinstall @amd-gaia/gaia if it is missing.");
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (e) {
+        throw new PlatformError(`binaries.lock.json at ${lockPath} is not valid JSON: ${e.message}`);
+    }
+    const major = Number.parseInt(String(parsed.schemaVersion ?? ""), 10);
+    if (major !== SCHEMA_MAJOR) {
+        throw new PlatformError(`binaries.lock.json at ${lockPath} declares schemaVersion ` +
+            `'${parsed.schemaVersion ?? "(absent)"}', but this package reads ` +
+            `${SCHEMA_MAJOR}.x — where each component carries its own baseUrl ` +
+            "(the sidecar from the gaia lane, the TUI from the terminal-hub lane). " +
+            "Reinstall @amd-gaia/gaia so the lock and the code ship together.");
+    }
+    if (!parsed.components || typeof parsed.components !== "object") {
+        throw new PlatformError(`binaries.lock.json at ${lockPath} is missing a "components" map. ` +
+            `Expected schemaVersion ${SCHEMA_MAJOR}.x with components.sidecar and components.tui.`);
+    }
+    for (const component of COMPONENTS) {
+        const lane = parsed.components[component];
+        if (!lane || typeof lane !== "object") {
+            throw new PlatformError(`binaries.lock.json at ${lockPath} has no "${component}" component. ` +
+                `Both of ${COMPONENTS.join(" and ")} are required — \`gaia\` launches the ` +
+                "TUI against the sidecar and cannot run with only one of them.");
+        }
+        if (!lane.platforms || typeof lane.platforms !== "object") {
+            throw new PlatformError(`binaries.lock.json at ${lockPath}: component "${component}" has no ` +
+                `"platforms" map. Under schemaVersion ${SCHEMA_MAJOR}.x each component is ` +
+                '{ componentVersion, baseUrl, platforms }, not a bare platform map.');
+        }
+        if (typeof lane.baseUrl !== "string" || lane.baseUrl === "") {
+            throw new PlatformError(`binaries.lock.json at ${lockPath}: component "${component}" has no ` +
+                '"baseUrl". Each component is published in its own hub lane at its own ' +
+                "version, so each carries its own download base URL.");
+        }
+    }
+    return parsed;
+}
+/** One component's lane, failing loudly when the lock does not declare it. */
+export function componentLock(lock, component) {
+    const lane = lock.components[component];
+    if (!lane) {
+        throw new PlatformError(`binaries.lock.json has no "${component}" component (components present: ` +
+            `${Object.keys(lock.components).join(", ") || "(none)"}).`);
+    }
+    return lane;
+}
+/** The download base URL for one component. */
+export function componentBaseUrl(lock, component) {
+    const { baseUrl } = componentLock(lock, component);
+    if (!baseUrl) {
+        throw new PlatformError(`binaries.lock.json has no baseUrl for "${component}", so there is nowhere ` +
+            "to download it from. Pass { baseUrl } to point at where the binaries are hosted.");
+    }
+    return baseUrl;
+}
+/** The platform keys a component publishes for, per the lock. */
+export function platformsFor(lock, component) {
+    return Object.keys(lock.components[component]?.platforms ?? {});
+}
+/**
+ * Resolve one component's lock entry for a platform key, failing loudly when the
+ * component has no build for it (e.g. the sidecar on linux-arm64).
+ */
+export function resolveEntry(lock, component, platformKey) {
+    const table = componentLock(lock, component).platforms;
+    const entry = table[platformKey];
+    if (!entry) {
+        const available = Object.keys(table).join(", ") || "(none)";
+        throw new PlatformError(`no '${component}' binary for platform '${platformKey}'. ` +
+            `Published '${component}' platforms: ${available}. ` +
+            (component === "sidecar"
+                ? "The frozen agent sidecar has no arm64 Linux or arm64 Windows build, so " +
+                    "`gaia` cannot run there yet. Run it on one of the platforms above, or " +
+                    "run the agent from source (see hub/agents/gaia/python/) and drive the " +
+                    "TUI against it."
+                : "Run `gaia` on one of the platforms above."));
+    }
+    if (!entry.sha256 || !entry.filename || !entry.executable) {
+        throw new PlatformError(`binaries.lock.json entry for ${component}/'${platformKey}' is incomplete ` +
+            "(needs filename, sha256, executable) — likely a stub entry with no " +
+            "published binary for this platform.");
+    }
+    // The lock is trusted package data, but `lockPath` is caller-overridable — a
+    // name with a separator or `..` would escape the cache dir / the base URL.
+    for (const [field, value] of [
+        ["filename", entry.filename],
+        ["executable", entry.executable],
+    ]) {
+        if (value === "." || value === ".." || /[/\\]/.test(value)) {
+            throw new PlatformError(`binaries.lock.json entry for ${component}/'${platformKey}' has an unsafe ` +
+                `${field} '${value}': it must be a bare filename with no path separators.`);
+        }
+    }
+    return entry;
+}
+/** True when an entry's sha256 is the not-yet-published placeholder sentinel. */
+export function isPlaceholderSha(sha256) {
+    if (!sha256)
+        return false;
+    return /^0+$/.test(sha256) || sha256.toUpperCase().includes("PENDING");
+}
+//# sourceMappingURL=platform.js.map

package/dist/platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../src/platform.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,+BAA+B;AAC/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,mDAAmD;AACnD,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,SAAS,EAAE,KAAK,CAAU,CAAC;AAGtD,gFAAgF;AAChF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC;AA8B9B;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,WAAW;IACX,cAAc;IACd,YAAY;IACZ,WAAW;CACH,CAAC;AAEX,uEAAuE;AACvE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,WAAW;IACX,aAAa;IACb,cAAc;IACd,YAAY;IACZ,WAAW;IACX,aAAa;CACL,CAAC;AAEX,+DAA+D;AAC/D,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAE3D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA2B;IACxD,WAAW,EAAE,kBAAkB;IAC/B,aAAa,EAAE,oBAAoB;IACnC,cAAc,EAAE,mBAAmB;IACnC,YAAY,EAAE,iBAAiB;IAC/B,WAAW,EAAE,gBAAgB;IAC7B,aAAa,EAAE,kBAAkB;CAClC,CAAC;AAEF,iEAAiE;AACjE,MAAM,UAAU,kBAAkB,CAChC,WAA4B,OAAO,CAAC,QAAQ,EAC5C,OAAe,OAAO,CAAC,IAAI;IAE3B,OAAO,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,eAAe;IAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC;AACxD,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,QAAQ,CAAC,WAAmB,eAAe,EAAE;IAC3D,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,aAAa,CACrB,qCAAqC,QAAQ,KAAM,CAAW,CAAC,OAAO,IAAI;YACxE,kFAAkF,CACrF,CAAC;IACJ,CAAC;IACD,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,CAAC;IACzC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,aAAa,CACrB,yBAAyB,QAAQ,uBAAwB,CAAW,CAAC,OAAO,EAAE,CAC/E,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACtE,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;QAC3B,MAAM,IAAI,aAAa,CACrB,yBAAyB,QAAQ,0BAA0B;YACzD,IAAI,MAAM,CAAC,aAAa,IAAI,UAAU,4BAA4B;YAClE,GAAG,YAAY,oDAAoD;YACnE,wEAAwE;YACxE,kEAAkE,CACrE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,aAAa,CACrB,yBAAyB,QAAQ,kCAAkC;YACjE,0BAA0B,YAAY,gDAAgD,CACzF,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,aAAa,CACrB,yBAAyB,QAAQ,YAAY,SAAS,eAAe;gBACnE,WAAW,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,wCAAwC;gBAC3E,+DAA+D,CAClE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC1D,MAAM,IAAI,aAAa,CACrB,yBAAyB,QAAQ,gBAAgB,SAAS,WAAW;gBACnE,wCAAwC,YAAY,uBAAuB;gBAC3E,oEAAoE,CACvE,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;YAC5D,MAAM,IAAI,aAAa,CACrB,yBAAyB,QAAQ,gBAAgB,SAAS,WAAW;gBACnE,wEAAwE;gBACxE,qDAAqD,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,IAAgB,EAAE,SAAwB;IACtE,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,aAAa,CACrB,8BAA8B,SAAS,mCAAmC;YACxE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,IAAI,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,gBAAgB,CAAC,IAAgB,EAAE,SAAwB;IACzE,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,aAAa,CACrB,0CAA0C,SAAS,yBAAyB;YAC1E,kFAAkF,CACrF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,YAAY,CAAC,IAAgB,EAAE,SAAwB;IACrE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAgB,EAChB,SAAwB,EACxB,WAAmB;IAEnB,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,SAAS,CAAC;IACvD,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;QAC5D,MAAM,IAAI,aAAa,CACrB,OAAO,SAAS,0BAA0B,WAAW,KAAK;YACxD,cAAc,SAAS,gBAAgB,SAAS,IAAI;YACpD,CAAC,SAAS,KAAK,SAAS;gBACtB,CAAC,CAAC,yEAAyE;oBACzE,wEAAwE;oBACxE,wEAAwE;oBACxE,iBAAiB;gBACnB,CAAC,CAAC,2CAA2C,CAAC,CACnD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QAC1D,MAAM,IAAI,aAAa,CACrB,gCAAgC,SAAS,KAAK,WAAW,kBAAkB;YACzE,qEAAqE;YACrE,qCAAqC,CACxC,CAAC;IACJ,CAAC;IACD,6EAA6E;IAC7E,2EAA2E;IAC3E,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI;QAC3B,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC;QAC5B,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC;KACxB,EAAE,CAAC;QACX,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,aAAa,CACrB,gCAAgC,SAAS,KAAK,WAAW,kBAAkB;gBACzE,GAAG,KAAK,KAAK,KAAK,wDAAwD,CAC7E,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AACzE,CAAC"}

package/dist/url.d.ts

@@ -0,0 +1,4 @@
+export declare function stripTrailingSlashes(s: string): string;
+export declare function stripLeadingSlashes(s: string): string;
+export declare function joinUrl(base: string, file: string): string;
+//# sourceMappingURL=url.d.ts.map

package/dist/url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.d.ts","sourceRoot":"","sources":["../src/url.ts"],"names":[],"mappings":"AASA,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAItD;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAIrD;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1D"}

package/dist/url.js

@@ -0,0 +1,22 @@
+// Copyright(C) 2025-2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: MIT
+// Linear-time slash trimming. The regex forms (`/\/+$/`, `/^\/+/`) backtrack
+// polynomially on a long run of slashes from an untrusted URL (CodeQL
+// js/polynomial-redos); a char scan is O(n) and allocation-free.
+const SLASH = 47; // '/'
+export function stripTrailingSlashes(s) {
+    let end = s.length;
+    while (end > 0 && s.charCodeAt(end - 1) === SLASH)
+        end -= 1;
+    return s.slice(0, end);
+}
+export function stripLeadingSlashes(s) {
+    let start = 0;
+    while (start < s.length && s.charCodeAt(start) === SLASH)
+        start += 1;
+    return s.slice(start);
+}
+export function joinUrl(base, file) {
+    return `${stripTrailingSlashes(base)}/${stripLeadingSlashes(file)}`;
+}
+//# sourceMappingURL=url.js.map

package/dist/url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.js","sourceRoot":"","sources":["../src/url.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,+BAA+B;AAE/B,6EAA6E;AAC7E,sEAAsE;AACtE,iEAAiE;AAEjE,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,MAAM;AAExB,MAAM,UAAU,oBAAoB,CAAC,CAAS;IAC5C,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,KAAK;QAAE,GAAG,IAAI,CAAC,CAAC;IAC5D,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,CAAS;IAC3C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,KAAK;QAAE,KAAK,IAAI,CAAC,CAAC;IACrE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,IAAY;IAChD,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;AACtE,CAAC"}

package/package.json

@@ -1,15 +1,66 @@
-{
-  "name": "@amd-gaia/gaia",
-  "version": "0.1.0",
-  "description": "Reserves the package so npm trusted publishing (OIDC) can be configured; OIDC cannot create a package. Not the CLI - see 0.1.1 and later.",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/amd/gaia.git",
-    "directory": "hub/agents/gaia/npm"
-  },
-  "homepage": "https://amd-gaia.ai",
-  "publishConfig": {
-    "access": "public"
-  }
-}
+{
+  "name": "@amd-gaia/gaia",
+  "version": "0.2.0",
+  "type": "module",
+  "description": "One command to run GAIA: fetches and SHA-256 verifies the flagship agent sidecar and the terminal UI, then launches them. Runs 100% locally on AMD Ryzen AI.",
+  "author": "AMD AI Group",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/amd/gaia.git",
+    "directory": "hub/agents/gaia/npm"
+  },
+  "homepage": "https://amd-gaia.ai/docs/guides/gaia",
+  "bugs": {
+    "url": "https://github.com/amd/gaia/issues"
+  },
+  "keywords": [
+    "gaia",
+    "amd",
+    "ryzen-ai",
+    "agent",
+    "tui",
+    "local-llm",
+    "privacy",
+    "sidecar"
+  ],
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "bin": {
+    "gaia": "./dist/cli.js"
+  },
+  "files": [
+    "dist/",
+    "binaries.lock.json",
+    "README.md",
+    "CHANGELOG.md",
+    "SPEC.md",
+    "SKILL.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",
+    "prepublishOnly": "npm run clean && npm run build",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "typescript": "^5.7.2",
+    "vitest": "^2.1.8"
+  }
+}