@ciphore/radiocli 0.2.2 → 0.2.4

package/dist/platform/desktop.js

@@ -0,0 +1,36 @@
+import { identifyPlatform } from './runtime.js';
+/** Command plans only. Callers must check the session and observe execution. */
+export function browserCommands(host = identifyPlatform()) {
+    // termux-tools opens one URL through Android's VIEW intent.
+    if (host.id === 'termux')
+        return [{ command: 'termux-open-url', args: [] }];
+    if (host.id === 'darwin')
+        return [{ command: 'open', args: [] }];
+    if (host.id === 'win32')
+        return [{ command: 'explorer', args: [] }];
+    if (['linux', 'freebsd', 'openbsd', 'netbsd'].includes(host.id))
+        return [{ command: 'xdg-open', args: [] }];
+    return [];
+}
+export function clipboardCandidates(host = identifyPlatform()) {
+    // No arguments makes termux-clipboard-set read stdin. Its matching Android
+    // API app and permissions are still required; the caller checks execution.
+    if (host.id === 'termux')
+        return [{ command: 'termux-clipboard-set', args: [] }];
+    if (host.id === 'darwin')
+        return [{ command: 'pbcopy', args: [] }];
+    if (host.id === 'win32')
+        return [{ command: 'clip', args: [] }];
+    if (['linux', 'freebsd', 'openbsd', 'netbsd'].includes(host.id))
+        return [
+            { command: 'wl-copy', args: [] },
+            { command: 'xclip', args: ['-selection', 'clipboard'] },
+            { command: 'xsel', args: ['--clipboard', '--input'] }
+        ];
+    return [];
+}
+export function hasGraphicalSession(host, env = process.env) {
+    if (host.id === 'darwin' || host.id === 'win32' || host.id === 'termux')
+        return !env.SSH_CONNECTION && !env.SSH_TTY;
+    return ['linux', 'freebsd', 'openbsd', 'netbsd'].includes(host.id) && Boolean(env.DISPLAY || env.WAYLAND_DISPLAY);
+}

package/dist/{player/command.js → platform/executables.js}

@@ -1,7 +1,8 @@
 import { spawnSync } from 'node:child_process';
-import { accessSync, constants, existsSync } from 'node:fs';
+import { accessSync, constants, statSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { posix, win32 } from 'node:path';
+import { identifyPlatform } from './runtime.js';
 export function commandExists(command) {
     return resolveCommand(command) !== null;
 }
@@ -12,8 +13,10 @@ export function resolveCommand(command) {
     return resolveCommandDetails(command).path;
 }
 export function resolveCommandDetails(command, overrides) {
+    const variable = overrideVariable(command);
+    const cacheKey = [command, process.env.PATH, process.env.PATHEXT, process.env.PREFIX, process.env.TERMUX_VERSION, variable ? process.env[variable] : undefined].join('\0');
     if (!overrides) {
-        const cached = commandCache.get(command);
+        const cached = commandCache.get(cacheKey);
         if (cached && Date.now() - cached.checkedAt < commandCacheTtlMs)
             return cached.resolution;
     }
@@ -26,11 +29,24 @@ export function resolveCommandDetails(command, overrides) {
         registryPaths: overrides?.registryPaths ?? (name => windowsRegistryPaths(name, platform))
     };
     const resolution = resolveUncached(command, options);
-    if (!overrides)
-        commandCache.set(command, { resolution, checkedAt: Date.now() });
+    if (!overrides) {
+        if (commandCache.size >= 256)
+            commandCache.clear();
+        commandCache.set(cacheKey, { resolution, checkedAt: Date.now() });
+    }
     return resolution;
 }
 function resolveUncached(command, options) {
+    const variable = overrideVariable(command);
+    const configured = variable ? options.env[variable] : undefined;
+    if (configured !== undefined) {
+        const pathApi = options.platform === 'win32' ? win32 : posix;
+        if (!configured || /[\0\r\n]/.test(configured) || !pathApi.isAbsolute(configured) || (options.platform === 'win32' && !/\.(exe|com)$/i.test(configured))) {
+            return { path: null, discovery: 'configured-path', error: `${variable} must be an absolute native executable path, without shell arguments.` };
+        }
+        return options.isRunnable(configured) ? { path: configured, discovery: 'configured-path' }
+            : { path: null, discovery: 'configured-path', error: `${variable} does not name a runnable file.` };
+    }
     const pathMatch = lookupOnPath(command, options);
     if (pathMatch)
         return { path: pathMatch, discovery: 'path' };
@@ -47,6 +63,9 @@ function resolveUncached(command, options) {
     }
     return { path: null, discovery: 'missing' };
 }
+function overrideVariable(command) {
+    return { mpv: 'RADIOCLI_MPV_PATH', ffplay: 'RADIOCLI_FFPLAY_PATH', vlc: 'RADIOCLI_VLC_PATH', cvlc: 'RADIOCLI_VLC_PATH', ffmpeg: 'RADIOCLI_FFMPEG_PATH' }[command];
+}
 function lookupOnPath(command, options) {
     if (command.includes('/') || command.includes('\\'))
         return options.isRunnable(command) ? command : null;
@@ -85,12 +104,11 @@ export function clearCommandCache() {
     commandCache.clear();
 }
 function isRunnable(path, platform) {
-    if (!existsSync(path))
-        return false;
-    if (platform === 'win32')
-        return true;
     try {
-        accessSync(path, constants.X_OK);
+        if (!statSync(path).isFile())
+            return false;
+        if (platform !== 'win32')
+            accessSync(path, constants.X_OK);
         return true;
     }
     catch {
@@ -98,9 +116,25 @@ function isRunnable(path, platform) {
     }
 }
 function knownBinaryDirs({ platform, env, home }) {
+    if (identifyPlatform({ platform, env }).id === 'termux') {
+        // Use the running app's prefix, including alternate Android user installs.
+        // Generic /usr paths can refer to a different libc inside a proot environment.
+        const prefix = env.PREFIX;
+        return prefix && posix.isAbsolute(prefix) && !/[\0\r\n]/.test(prefix) ? [posix.join(prefix, 'bin')] : [];
+    }
     if (platform === 'darwin') {
         return ['/opt/homebrew/bin', '/usr/local/bin', '/usr/bin', '/opt/local/bin', '/sw/bin', posix.join(home, '.local', 'bin')];
     }
+    if (platform === 'freebsd' || platform === 'openbsd')
+        return ['/usr/local/bin', '/usr/bin'];
+    if (platform === 'netbsd')
+        return ['/usr/pkg/bin', '/usr/local/bin', '/usr/bin'];
+    if (platform === 'sunos')
+        return ['/opt/local/bin', '/usr/pkg/bin', '/usr/local/bin', '/usr/bin'];
+    if (platform === 'haiku')
+        return [posix.join(home, 'config', 'non-packaged', 'bin'), posix.join(home, 'config', 'bin'), '/boot/system/non-packaged/bin', '/boot/system/bin'];
+    if (platform === 'aix')
+        return ['/opt/freeware/bin', '/usr/local/bin', '/usr/bin'];
     if (platform === 'win32') {
         const dirs = [];
         if (env.LOCALAPPDATA)

package/dist/platform/ipc.js

@@ -0,0 +1,14 @@
+import { tmpdir } from 'node:os';
+import { posix } from 'node:path';
+import { identifyPlatform, nativeAdapters } from './runtime.js';
+export function mpvIpcPath({ platform = process.platform, directory = tmpdir(), pid = process.pid, timestamp = Date.now() } = {}) {
+    if (nativeAdapters(identifyPlatform({ platform })).ipc === 'named-pipe')
+        return `\\\\.\\pipe\\radiocli-${pid}-${timestamp}`;
+    const path = posix.join(directory, `radiocli-${pid}-${timestamp}.sock`);
+    // BSD/macOS sockaddr_un is smaller than Linux's. Count encoded bytes and
+    // leave room for the terminator; JavaScript string length is not sufficient.
+    if (Buffer.byteLength(path) > 100) {
+        throw new Error('The mpv socket path is too long. Select a shorter private TMPDIR and restart RadioCLI.');
+    }
+    return path;
+}

package/dist/platform/launch-command.js

@@ -0,0 +1,135 @@
+import { pathEnvironmentKeys } from './paths.js';
+import { homedir } from 'node:os';
+import { posix, win32 } from 'node:path';
+const applicationEnvironmentKeys = [
+    'RADIOCLI_MPV_PATH',
+    'RADIOCLI_FFPLAY_PATH',
+    'RADIOCLI_VLC_PATH',
+    'RADIOCLI_FFMPEG_PATH',
+    'RADIOCLI_OFFLINE',
+    'RADIOCLI_LOW_BANDWIDTH'
+];
+const desktopEnvironmentKeys = ['DISPLAY', 'WAYLAND_DISPLAY', 'DBUS_SESSION_BUS_ADDRESS'];
+/** Persist only application settings and the desktop connection a job needs. */
+export function launchEnvironment(env, options = {}) {
+    const result = {};
+    const platform = options.platform ?? process.platform;
+    const path = platform === 'win32' ? win32 : posix;
+    const add = (key, value) => {
+        if (value === undefined)
+            return;
+        if (/[\r\n\0]/.test(value))
+            throw new Error(`${key} cannot contain control characters in a launch environment.`);
+        result[key] = value;
+    };
+    const capturePath = (key, value) => {
+        add(key, value);
+        if (value === undefined)
+            return;
+        // Empty overrides fall back; empty roots select the invoking directory.
+        // Windows rejects an empty USERPROFILE, while HOME is unused there.
+        if (value === '' && (key === 'RADIOCLI_HOME' || key === 'RADIO_ATLAS_HOME' || key === 'USERPROFILE' || key === 'HOME' && platform === 'win32'))
+            return;
+        // Windows root-relative paths also depend on the invoking drive. Fully
+        // qualified values need no cwd lookup (which can fail after cwd removal).
+        const absolute = path.isAbsolute(value) && (platform !== 'win32' || /^(?:[a-z]:[\\/]|[\\/]{2})/i.test(value));
+        if (!absolute)
+            add(key, path.resolve(options.cwd ?? process.cwd(), value));
+    };
+    for (const key of pathEnvironmentKeys)
+        capturePath(key, env[key]);
+    // On Windows, removing USERPROFILE from a child environment does not
+    // reliably erase a differently-cased inherited value. Persist the effective
+    // account home so an absent selector cannot be replaced by the launcher.
+    if (platform === 'win32' && process.platform === 'win32' && env.USERPROFILE === undefined) {
+        capturePath('USERPROFILE', homedir());
+    }
+    for (const key of applicationEnvironmentKeys)
+        add(key, env[key]);
+    if (options.includeDesktop)
+        for (const key of desktopEnvironmentKeys)
+            add(key, env[key]);
+    add('RADIOCLI_ALARM_TERMINAL', options.terminal);
+    return result;
+}
+/** Keep application argv and approved environment out of native shell syntax. */
+export function nodeLaunchCommand(nodePath, args, environment) {
+    if ([nodePath, ...args, ...Object.keys(environment), ...Object.values(environment)].some(value => value.includes('\0'))) {
+        throw new Error('Launch command values cannot contain NUL bytes.');
+    }
+    // This fixed program contains no double quotes, including after expansion.
+    // PowerShell 5 and Task Scheduler only receive this program and encoded data.
+    // A terminal server or scheduler may have unrelated path overrides. Clear the
+    // complete identity before restoring this launch's snapshot, preserving absent
+    // selectors and the path layer's existing empty-value/default semantics.
+    const keys = [...pathEnvironmentKeys, ...applicationEnvironmentKeys, 'RADIOCLI_ALARM_TERMINAL'].map(key => `'${key}'`).join(',');
+    const program = `const p=JSON.parse(Buffer.from(process.argv[1],'base64url').toString('utf8'));const s=new Set([${keys}]);const e=Object.fromEntries(Object.entries(process.env).filter(([k])=>!s.has(process.platform==='win32'?k.toUpperCase():k)));const r=require('node:child_process').spawnSync(process.execPath,p.args,{stdio:'inherit',env:{...e,...p.environment}});if(r.error)console.error(r.error.message);process.exit(r.status??1);`;
+    return [nodePath, '-e', program, Buffer.from(JSON.stringify({ args, environment }), 'utf8').toString('base64url')];
+}
+/** Process acceptance is separate from application/session readiness. */
+export function waitForLaunch(child, options = {}) {
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        let acceptedTimer;
+        let forceTimer;
+        let cleanupTimer;
+        let stopError;
+        const finish = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(startupTimer);
+            if (acceptedTimer)
+                clearTimeout(acceptedTimer);
+            clearTimeout(forceTimer);
+            clearTimeout(cleanupTimer);
+            if (error)
+                reject(error);
+            else
+                resolve();
+        };
+        const signal = (value) => {
+            try {
+                child.kill(value);
+            }
+            catch { /* Retain the launch failure and bounded cleanup. */ }
+        };
+        const stop = (error) => {
+            if (settled || stopError)
+                return;
+            stopError = error;
+            clearTimeout(startupTimer);
+            if (acceptedTimer)
+                clearTimeout(acceptedTimer);
+            forceTimer = setTimeout(() => signal('SIGKILL'), 250);
+            cleanupTimer = setTimeout(() => { child.unref(); finish(error); }, 1_000);
+            signal('SIGTERM');
+        };
+        const startupTimer = setTimeout(() => {
+            const error = new Error('Process launcher did not report process startup.');
+            if (child.pid)
+                stop(error);
+            else
+                finish(error);
+        }, 3_000);
+        // Keep a listener after acceptance: a late native error must not become an
+        // unhandled EventEmitter error in the application that requested the launch.
+        child.on('error', error => {
+            if (!settled && child.pid)
+                stop(error);
+            else
+                finish(error);
+        });
+        child.once('close', (code, signal) => finish(stopError ?? (code === 0 ? undefined : new Error(`Process launcher exited with ${code ?? signal ?? 'unknown status'}.`))));
+        child.once('spawn', () => {
+            if (options.waitForExit) {
+                clearTimeout(startupTimer);
+                acceptedTimer = setTimeout(() => stop(new Error('Launch bootstrap did not complete.')), 10_000);
+            }
+            else {
+                child.unref();
+                acceptedTimer = setTimeout(() => finish(), 100);
+            }
+        });
+    });
+}

package/dist/platform/loopback.js

@@ -0,0 +1,44 @@
+export function isLoopbackHost(value) {
+    return value === '127.0.0.1' || value === '::1';
+}
+/** Bind only literal loopback addresses, including hosts without an IPv4 stack. */
+export async function listenLoopback(server) {
+    try {
+        return await listen(server, '127.0.0.1');
+    }
+    catch (error) {
+        const code = error.code;
+        if (code !== 'EAFNOSUPPORT' && code !== 'EPROTONOSUPPORT' && code !== 'EADDRNOTAVAIL')
+            throw error;
+        return listen(server, '::1');
+    }
+}
+function listen(server, host) {
+    return new Promise((resolve, reject) => {
+        const cleanup = () => {
+            server.removeListener('error', failed);
+            server.removeListener('listening', ready);
+        };
+        const failed = (error) => {
+            cleanup();
+            reject(error);
+        };
+        const ready = () => {
+            cleanup();
+            const address = server.address();
+            if (!address || typeof address === 'string') {
+                reject(new Error('Unable to create a local control endpoint.'));
+                return;
+            }
+            resolve({ host, port: address.port });
+        };
+        server.once('error', failed);
+        server.once('listening', ready);
+        try {
+            server.listen(0, host);
+        }
+        catch (error) {
+            failed(error);
+        }
+    });
+}

package/dist/platform/network.js

@@ -0,0 +1,312 @@
+import { resolve4, resolve6 } from 'node:dns/promises';
+import { request as requestHttps } from 'node:https';
+const maxResolvedResponseBytes = 128 * 1024 * 1024;
+export function networkPolicy(env = process.env) {
+    return { offline: env.RADIOCLI_OFFLINE === '1', lowBandwidth: env.RADIOCLI_LOW_BANDWIDTH === '1' };
+}
+/** A direct connection must never silently bypass an operator-configured proxy. */
+export function allowsDirectDnsFallback(env = process.env, url) {
+    if (url && bypassesProxy(new URL(url), env))
+        return true;
+    return !['http_proxy', 'HTTP_PROXY', 'https_proxy', 'HTTPS_PROXY', 'all_proxy', 'ALL_PROXY']
+        .some(name => Boolean(env[name]?.trim()));
+}
+/** Configuration preflight only: no network request or proxy credentials. */
+export function networkDiagnostic() {
+    const policy = networkPolicy();
+    if (policy.offline)
+        return { ...policy, status: 'offline', message: 'Public directory and update requests are disabled; cached data and direct stream URLs remain usable.' };
+    try {
+        validateProxyConfiguration(new URL('http://example.invalid'));
+        validateProxyConfiguration(new URL('https://example.invalid'));
+        return { ...policy, status: 'configured', message: 'Network configuration accepted; reachability and TLS are checked per request. External player networking is separate.' };
+    }
+    catch (error) {
+        return { ...policy, status: 'unavailable', message: error instanceof Error ? error.message : 'Network configuration is invalid.' };
+    }
+}
+/** Keep the request deadline active through body consumption, including errors. */
+export async function withExternalResponse(url, { timeoutMs, init = {}, fetchImpl = fetch }, consume) {
+    if (networkPolicy().offline)
+        throw new Error('RadioCLI is offline (RADIOCLI_OFFLINE=1).');
+    validateProxyConfiguration(new URL(url));
+    init.signal?.throwIfAborted();
+    const controller = new AbortController();
+    const signal = init.signal ? AbortSignal.any([init.signal, controller.signal]) : controller.signal;
+    let onAbort;
+    const aborted = new Promise((_resolve, reject) => {
+        onAbort = () => reject(signal.reason);
+        signal.addEventListener('abort', onAbort, { once: true });
+    });
+    const timeout = setTimeout(() => controller.abort(new Error(`Network request timed out after ${timeoutMs} ms.`)), timeoutMs);
+    let response;
+    const work = async () => {
+        response = await fetchImpl(url, { ...init, signal });
+        try {
+            // A custom fetch can resolve after the deadline without observing abort.
+            signal.throwIfAborted();
+            return await consume(response);
+        }
+        finally {
+            cancelBody(response);
+        }
+    };
+    try {
+        return await Promise.race([work(), aborted]);
+    }
+    finally {
+        clearTimeout(timeout);
+        signal.removeEventListener('abort', onAbort);
+        controller.abort();
+        if (response)
+            cancelBody(response);
+    }
+}
+/**
+ * HTTPS fetch fallback for systems where libc getaddrinfo() reports EAI_AGAIN
+ * but Node's DNS-protocol resolver can still reach the configured nameserver.
+ * The original hostname remains the HTTP Host and TLS SNI identity, so normal
+ * certificate-chain and hostname verification remain enabled.
+ */
+export async function fetchHttpsWithSystemResolver(input, init = {}, runtime = {}) {
+    const url = new URL(input);
+    if (url.protocol !== 'https:')
+        throw new Error('The DNS fallback only supports HTTPS requests.');
+    if (url.username || url.password)
+        throw new Error('The DNS fallback does not accept URL credentials.');
+    const method = (init.method ?? 'GET').toUpperCase();
+    if (method !== 'GET' && method !== 'HEAD')
+        throw new Error('The DNS fallback only supports GET and HEAD requests.');
+    if (init.body)
+        throw new Error('The DNS fallback does not accept a request body.');
+    init.signal?.throwIfAborted();
+    const addresses = await resolveHttpsAddresses(url.hostname, init.signal, runtime);
+    let lastError = null;
+    for (const address of addresses) {
+        try {
+            return await requestResolvedHttps(url, address, init, runtime, method);
+        }
+        catch (error) {
+            if (init.signal?.aborted)
+                throw init.signal.reason;
+            lastError = error instanceof Error ? error : new Error(String(error));
+        }
+    }
+    throw lastError ?? new Error(`DNS did not return an address for ${url.hostname}.`);
+}
+async function resolveHttpsAddresses(hostname, signal, runtime) {
+    let lastErrors = [];
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+        const results = await raceAbort(Promise.allSettled([
+            (runtime.resolve4 ?? resolve4)(hostname),
+            (runtime.resolve6 ?? resolve6)(hostname)
+        ]), signal);
+        const addresses = [
+            ...(results[0].status === 'fulfilled' ? results[0].value.map(address => ({ address, family: 4 })) : []),
+            ...(results[1].status === 'fulfilled' ? results[1].value.map(address => ({ address, family: 6 })) : [])
+        ];
+        if (addresses.length > 0)
+            return dedupeAddresses(addresses);
+        lastErrors = results.flatMap(result => result.status === 'rejected' ? [result.reason] : []);
+        if (attempt === 1 || !lastErrors.some(isTemporaryDnsError))
+            break;
+        await abortableDelay(100, signal);
+    }
+    const lastError = lastErrors.find(value => value instanceof Error);
+    throw lastError instanceof Error ? lastError : new Error(`DNS did not return an address for ${hostname}.`);
+}
+function requestResolvedHttps(url, address, init, runtime, method) {
+    return new Promise((resolve, reject) => {
+        const headers = new Headers(init.headers);
+        if (!headers.has('host'))
+            headers.set('host', url.host);
+        if (!headers.has('accept-encoding'))
+            headers.set('accept-encoding', 'identity');
+        const request = (runtime.request ?? requestHttps)({
+            hostname: address.address,
+            family: address.family,
+            port: url.port ? Number(url.port) : 443,
+            path: `${url.pathname}${url.search}`,
+            method,
+            headers: Object.fromEntries(headers.entries()),
+            servername: url.hostname,
+            signal: init.signal ?? undefined,
+            ca: runtime.ca,
+            agent: false
+        }, response => {
+            const chunks = [];
+            let bytes = 0;
+            response.on('data', (chunk) => {
+                const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+                bytes += buffer.length;
+                if (bytes > maxResolvedResponseBytes) {
+                    response.destroy(new Error('HTTPS response exceeded the 128 MiB safety limit.'));
+                    return;
+                }
+                chunks.push(buffer);
+            });
+            response.once('error', reject);
+            response.once('aborted', () => reject(new Error('HTTPS response ended before completion.')));
+            response.once('end', () => {
+                const responseHeaders = new Headers();
+                for (const [name, value] of Object.entries(response.headers)) {
+                    if (Array.isArray(value)) {
+                        for (const item of value)
+                            responseHeaders.append(name, item);
+                    }
+                    else if (value !== undefined) {
+                        responseHeaders.set(name, value);
+                    }
+                }
+                const status = response.statusCode ?? 500;
+                const body = method === 'HEAD' || status === 204 || status === 205 || status === 304
+                    ? null
+                    : Buffer.concat(chunks);
+                resolve(new Response(body, {
+                    status,
+                    statusText: response.statusMessage,
+                    headers: responseHeaders
+                }));
+            });
+        });
+        request.once('error', reject);
+        request.end();
+    });
+}
+function dedupeAddresses(addresses) {
+    const seen = new Set();
+    return addresses.filter(({ address, family }) => {
+        const key = `${family}:${address}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+function isTemporaryDnsError(error) {
+    return error instanceof Error && 'code' in error && error.code === 'EAI_AGAIN';
+}
+function raceAbort(promise, signal) {
+    if (!signal)
+        return promise;
+    signal.throwIfAborted();
+    return new Promise((resolve, reject) => {
+        const onAbort = () => reject(signal.reason);
+        signal.addEventListener('abort', onAbort, { once: true });
+        promise.then(resolve, reject).finally(() => signal.removeEventListener('abort', onAbort));
+    });
+}
+function abortableDelay(ms, signal) {
+    if (!signal)
+        return new Promise(resolve => setTimeout(resolve, ms));
+    signal.throwIfAborted();
+    return new Promise((resolve, reject) => {
+        const timeout = setTimeout(done, ms);
+        const onAbort = () => done(signal.reason);
+        signal.addEventListener('abort', onAbort, { once: true });
+        function done(error) {
+            clearTimeout(timeout);
+            signal.removeEventListener('abort', onAbort);
+            if (error)
+                reject(error);
+            else
+                resolve();
+        }
+    });
+}
+function cancelBody(response) {
+    // Cancellation is best-effort and must not extend the request deadline. A
+    // locked native body is interrupted by the request's AbortController instead.
+    if (response.body && !response.body.locked)
+        void response.body.cancel().catch(() => { });
+}
+function validateProxyConfiguration(url) {
+    if (bypassesProxy(url, process.env))
+        return;
+    const http = proxyVariable('http_proxy', 'HTTP_PROXY');
+    const https = proxyVariable('https_proxy', 'HTTPS_PROXY');
+    for (const proxy of [http, https]) {
+        if (!proxy.value)
+            continue;
+        let parsed;
+        try {
+            if (/[\r\n]/.test(proxy.value))
+                throw new Error();
+            parsed = new URL(proxy.value);
+            decodeURIComponent(parsed.username);
+            decodeURIComponent(parsed.password);
+        }
+        catch {
+            // URL parse errors can contain credentials. Do not attach the raw cause.
+            throw new Error(`${proxy.name} contains an invalid proxy URL.`);
+        }
+        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+            throw new Error(`${proxy.name} uses an unsupported proxy protocol. This Node HTTP client supports HTTP(S) proxies; SOCKS proxies are unavailable.`);
+        }
+    }
+    // Native fetch falls back to HTTP_PROXY for HTTPS when HTTPS_PROXY is unset.
+    const selected = url.protocol === 'https:' && https.value ? https : http;
+    if (!selected.value) {
+        const all = proxyVariable('all_proxy', 'ALL_PROXY');
+        if (all.value)
+            throw new Error(`${all.name} is not supported by this Node HTTP client. Configure HTTP_PROXY or HTTPS_PROXY with an HTTP(S) proxy; SOCKS proxies are unavailable.`);
+        return;
+    }
+    const [major = 0, minor = 0] = process.versions.node.split('.').map(Number);
+    if (major < 24 && !(major === 22 && minor >= 21)) {
+        throw new Error('Native HTTP(S) proxy support requires Node 22.21+ or Node 24+.');
+    }
+    let enabled = process.env.NODE_USE_ENV_PROXY === '1';
+    const environmentFlags = (process.env.NODE_OPTIONS ?? '').match(/"[^"]*"|'[^']*'|\S+/g) ?? [];
+    for (const raw of [...environmentFlags, ...process.execArgv]) {
+        const flag = raw.replace(/^["']|["']$/g, '');
+        if (flag === '--use-env-proxy')
+            enabled = true;
+        if (flag === '--no-use-env-proxy')
+            enabled = false;
+    }
+    if (!enabled) {
+        throw new Error(`${selected.name} is configured. Start RadioCLI with NODE_USE_ENV_PROXY=1 to enable the native HTTP(S) proxy.`);
+    }
+    // Node configures its dispatcher at startup. Do not mutate proxy environment
+    // variables or install a global dispatcher here; local IPC has a direct agent.
+}
+function bypassesProxy(url, env) {
+    const value = env.no_proxy !== undefined ? env.no_proxy : env.NO_PROXY;
+    if (!value?.trim())
+        return false;
+    const hostname = url.hostname.replace(/^\[|\]$/g, '').toLowerCase();
+    const port = url.port || (url.protocol === 'https:' ? '443' : url.protocol === 'http:' ? '80' : '');
+    return value.split(',').some(raw => {
+        let entry = raw.trim().toLowerCase();
+        if (!entry)
+            return false;
+        if (entry === '*')
+            return true;
+        let entryPort = '';
+        if (entry.startsWith('[')) {
+            const end = entry.indexOf(']');
+            if (end < 0)
+                return false;
+            entryPort = entry.slice(end + 1).replace(/^:/, '');
+            entry = entry.slice(1, end);
+        }
+        else {
+            const colon = entry.lastIndexOf(':');
+            if (colon > -1 && /^\d+$/.test(entry.slice(colon + 1))) {
+                entryPort = entry.slice(colon + 1);
+                entry = entry.slice(0, colon);
+            }
+        }
+        if (entryPort && entryPort !== port)
+            return false;
+        const suffix = entry.replace(/^\*\./, '.');
+        return suffix.startsWith('.')
+            ? hostname === suffix.slice(1) || hostname.endsWith(suffix)
+            : hostname === suffix;
+    });
+}
+function proxyVariable(lower, upper) {
+    const name = process.env[lower] !== undefined ? lower : upper;
+    return { name, value: process.env[name] };
+}