@genspark/cli 1.0.20 → 1.0.21

package/dist/mesh/download.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Lazy download + integrity-verified caching of the native gsk-mesh binary.
+ *
+ * Cache layout under ~/.genspark-tool-cli/bin/ :
+ *   gsk-mesh[.exe]        the native binary
+ *   .gsk-mesh-version     the version string the binary was installed at
+ *   .gsk-mesh-sha256      the expected sha256 for that binary
+ *
+ * Security note (per-run integrity check — gen-spark#32059): a cached binary
+ * is exec'd directly on every `gsk mesh ...`, so a local process that can write
+ * to bin/ could otherwise plant code that runs as the user. On every cache hit
+ * we re-hash the file and compare:
+ *   - if it's still at PINNED_VERSION, the expected sha is CHECKSUMS[target],
+ *     which is compiled into the published @genspark/cli (tamper-resistant);
+ *   - otherwise (upgraded past the pin via `gsk mesh upgrade`), we compare
+ *     against the .gsk-mesh-sha256 stamp.
+ * A mismatch re-downloads the pinned version rather than exec'ing a binary we
+ * can't vouch for.
+ */
+/** True if a gsk-mesh binary is already cached for the current target. */
+export declare function isMeshInstalled(): boolean;
+/** The version string the cached binary was installed at, or null. */
+export declare function getInstalledMeshVersion(): string | null;
+/**
+ * Ensure the native gsk-mesh binary is present, current, and intact.
+ * Returns the absolute path to the verified binary.
+ */
+export declare function ensureMeshBinary(): Promise<string>;
+/**
+ * Download a specific version+target from `url`, verify its sha256, install it
+ * atomically, and update the version/sha stamps. Shared by first-run
+ * (`ensureMeshBinary`) and `gsk mesh upgrade` (which passes a newer version).
+ */
+export declare function downloadAndInstall(url: string, expectedSha: string, version: string, target: string): Promise<void>;
+//# sourceMappingURL=download.d.ts.map

package/dist/mesh/download.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"download.d.ts","sourceRoot":"","sources":["../../src/mesh/download.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AA8BH,0EAA0E;AAC1E,wBAAgB,eAAe,IAAI,OAAO,CAMzC;AAED,sEAAsE;AACtE,wBAAgB,uBAAuB,IAAI,MAAM,GAAG,IAAI,CAEvD;AA8BD;;;GAGG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC,CA0CxD;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAQf"}

package/dist/mesh/download.js

@@ -0,0 +1,218 @@
+/**
+ * Lazy download + integrity-verified caching of the native gsk-mesh binary.
+ *
+ * Cache layout under ~/.genspark-tool-cli/bin/ :
+ *   gsk-mesh[.exe]        the native binary
+ *   .gsk-mesh-version     the version string the binary was installed at
+ *   .gsk-mesh-sha256      the expected sha256 for that binary
+ *
+ * Security note (per-run integrity check — gen-spark#32059): a cached binary
+ * is exec'd directly on every `gsk mesh ...`, so a local process that can write
+ * to bin/ could otherwise plant code that runs as the user. On every cache hit
+ * we re-hash the file and compare:
+ *   - if it's still at PINNED_VERSION, the expected sha is CHECKSUMS[target],
+ *     which is compiled into the published @genspark/cli (tamper-resistant);
+ *   - otherwise (upgraded past the pin via `gsk mesh upgrade`), we compare
+ *     against the .gsk-mesh-sha256 stamp.
+ * A mismatch re-downloads the pinned version rather than exec'ing a binary we
+ * can't vouch for.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+import * as crypto from 'crypto';
+import * as https from 'https';
+import { spawn } from 'child_process';
+import { PINNED_VERSION, CHECKSUMS, cdnUrl, binExt, currentTarget, } from './manifest.js';
+import { info, debug } from '../logger.js';
+const BIN_DIR = path.join(os.homedir(), '.genspark-tool-cli', 'bin');
+// Monotonic counter so concurrent downloadAndInstall calls within one process
+// never share a temp path (pid alone isn't enough — same-pid concurrency).
+let _tmpCounter = 0;
+function binPath(target) {
+    return path.join(BIN_DIR, `gsk-mesh${binExt(target)}`);
+}
+const VERSION_STAMP = path.join(BIN_DIR, '.gsk-mesh-version');
+const SHA_STAMP = path.join(BIN_DIR, '.gsk-mesh-sha256');
+/** True if a gsk-mesh binary is already cached for the current target. */
+export function isMeshInstalled() {
+    try {
+        return fs.existsSync(binPath(currentTarget()));
+    }
+    catch {
+        return false;
+    }
+}
+/** The version string the cached binary was installed at, or null. */
+export function getInstalledMeshVersion() {
+    return readStamp(VERSION_STAMP);
+}
+/** sha256 of a file as lowercase hex, or null if it can't be read. */
+function fileSha256(file) {
+    try {
+        const buf = fs.readFileSync(file);
+        return crypto.createHash('sha256').update(buf).digest('hex');
+    }
+    catch {
+        return null;
+    }
+}
+function readStamp(file) {
+    try {
+        return fs.readFileSync(file, 'utf-8').trim();
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The expected sha256 for the currently-cached binary:
+ *   - at PINNED_VERSION → the compiled-in CHECKSUMS value (tamper-resistant);
+ *   - otherwise → the on-disk .gsk-mesh-sha256 stamp.
+ */
+function expectedShaForCached(target, installedVersion) {
+    if (installedVersion === PINNED_VERSION)
+        return CHECKSUMS[target];
+    return readStamp(SHA_STAMP);
+}
+/**
+ * Ensure the native gsk-mesh binary is present, current, and intact.
+ * Returns the absolute path to the verified binary.
+ */
+export async function ensureMeshBinary() {
+    const target = currentTarget();
+    const expectedPinned = CHECKSUMS[target];
+    const localPath = binPath(target);
+    if (fs.existsSync(localPath)) {
+        const installedVersion = readStamp(VERSION_STAMP);
+        if (installedVersion === PINNED_VERSION) {
+            // Same version we ship as the floor: verify integrity every run.
+            const expected = expectedShaForCached(target, installedVersion);
+            const actual = fileSha256(localPath);
+            if (expected && actual === expected) {
+                debug(`gsk-mesh cached + verified at ${localPath} (v${installedVersion})`);
+                return localPath;
+            }
+            info(`gsk-mesh: cached binary failed integrity check (expected ${expected ?? '?'}, ` +
+                `got ${actual ?? '?'}) — re-downloading v${PINNED_VERSION}`);
+        }
+        else if (installedVersion) {
+            // Upgraded past the pin via `gsk mesh upgrade`. Verify against the stamp;
+            // if the stamp is missing/mismatched we can't vouch for it — fall back
+            // to the known-good pinned version.
+            const expected = readStamp(SHA_STAMP);
+            const actual = fileSha256(localPath);
+            if (expected && actual === expected) {
+                debug(`gsk-mesh cached + verified at ${localPath} (v${installedVersion})`);
+                return localPath;
+            }
+            info(`gsk-mesh: cached v${installedVersion} failed integrity check — ` +
+                `re-downloading pinned v${PINNED_VERSION}`);
+        }
+        else {
+            info(`gsk-mesh: cached binary has no version stamp — re-downloading v${PINNED_VERSION}`);
+        }
+    }
+    info(`Downloading gsk-mesh v${PINNED_VERSION} for ${target} …`);
+    await downloadAndInstall(cdnUrl(PINNED_VERSION, target), expectedPinned, PINNED_VERSION, target);
+    info(`gsk-mesh installed at ${localPath}`);
+    return localPath;
+}
+/**
+ * Download a specific version+target from `url`, verify its sha256, install it
+ * atomically, and update the version/sha stamps. Shared by first-run
+ * (`ensureMeshBinary`) and `gsk mesh upgrade` (which passes a newer version).
+ */
+export async function downloadAndInstall(url, expectedSha, version, target) {
+    fs.mkdirSync(BIN_DIR, { recursive: true });
+    const dest = binPath(target);
+    await downloadWithProgress(url, dest, expectedSha);
+    fs.chmodSync(dest, 0o755);
+    await stripQuarantineXattr(dest);
+    fs.writeFileSync(VERSION_STAMP, version);
+    fs.writeFileSync(SHA_STAMP, expectedSha);
+}
+function downloadWithProgress(url, dest, expectedSha, redirectsLeft = 5) {
+    // Temp file + atomic rename so a Ctrl-C mid-download never leaves a partial
+    // binary that the next run would treat as valid. The counter suffix keeps
+    // concurrent installs (e.g. autorun + foreground) off the same temp path.
+    const tmp = `${dest}.tmp.${process.pid}.${_tmpCounter++}`;
+    return new Promise((resolve, reject) => {
+        const req = https.get(url, res => {
+            const status = res.statusCode ?? 0;
+            // Follow CDN redirects (301/302/307/308).
+            if ([301, 302, 307, 308].includes(status) && res.headers.location) {
+                res.resume();
+                if (redirectsLeft <= 0) {
+                    reject(new Error(`Too many redirects fetching gsk-mesh from ${url}`));
+                    return;
+                }
+                const next = new URL(res.headers.location, url).toString();
+                downloadWithProgress(next, dest, expectedSha, redirectsLeft - 1).then(resolve, reject);
+                return;
+            }
+            if (status !== 200) {
+                res.resume();
+                reject(new Error(`CDN returned HTTP ${status} for ${url}`));
+                return;
+            }
+            const total = parseInt(res.headers['content-length'] || '0', 10);
+            let received = 0;
+            let lastPrint = 0;
+            const hasher = crypto.createHash('sha256');
+            const out = fs.createWriteStream(tmp);
+            res.on('data', (chunk) => {
+                received += chunk.length;
+                hasher.update(chunk);
+                const now = Date.now();
+                if (now - lastPrint > 50) {
+                    lastPrint = now;
+                    const pct = total ? Math.round((received / total) * 100) : 0;
+                    const mb = (received / (1024 * 1024)).toFixed(1);
+                    const totalMb = total ? (total / (1024 * 1024)).toFixed(1) : '?';
+                    process.stderr.write(`\r  ${pct}%  ${mb} / ${totalMb} MB`);
+                }
+            });
+            res.pipe(out);
+            out.on('finish', () => {
+                process.stderr.write('\n');
+                const actual = hasher.digest('hex');
+                if (actual !== expectedSha) {
+                    try {
+                        fs.unlinkSync(tmp);
+                    }
+                    catch {
+                        /* best effort */
+                    }
+                    reject(new Error(`sha256 mismatch for gsk-mesh:\n  expected: ${expectedSha}\n  actual:   ${actual}`));
+                    return;
+                }
+                try {
+                    fs.renameSync(tmp, dest);
+                }
+                catch (err) {
+                    reject(err);
+                    return;
+                }
+                resolve();
+            });
+            out.on('error', reject);
+        });
+        req.on('error', reject);
+    });
+}
+/**
+ * Strip macOS's com.apple.quarantine xattr so Gatekeeper doesn't prompt on
+ * first launch. The release binaries are Apple-notarized; the prompt is just
+ * friction. No-op off macOS, and ignores "no such xattr" when absent.
+ */
+function stripQuarantineXattr(file) {
+    if (process.platform !== 'darwin')
+        return Promise.resolve();
+    return new Promise(resolve => {
+        const x = spawn('xattr', ['-d', 'com.apple.quarantine', file], { stdio: 'ignore' });
+        x.on('exit', () => resolve());
+        x.on('error', () => resolve());
+    });
+}
+//# sourceMappingURL=download.js.map

package/dist/mesh/download.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"download.js","sourceRoot":"","sources":["../../src/mesh/download.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAA;AAChC,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAC9B,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAA;AACrC,OAAO,EACL,cAAc,EACd,SAAS,EACT,MAAM,EACN,MAAM,EACN,aAAa,GAEd,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,cAAc,CAAA;AAE1C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,oBAAoB,EAAE,KAAK,CAAC,CAAA;AAEpE,8EAA8E;AAC9E,2EAA2E;AAC3E,IAAI,WAAW,GAAG,CAAC,CAAA;AAEnB,SAAS,OAAO,CAAC,MAAc;IAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AACxD,CAAC;AACD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAA;AAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAA;AAExD,0EAA0E;AAC1E,MAAM,UAAU,eAAe;IAC7B,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAA;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,uBAAuB;IACrC,OAAO,SAAS,CAAC,aAAa,CAAC,CAAA;AACjC,CAAC;AAED,sEAAsE;AACtE,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;QACjC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,MAAkB,EAAE,gBAAwB;IACxE,IAAI,gBAAgB,KAAK,cAAc;QAAE,OAAO,SAAS,CAAC,MAAM,CAAC,CAAA;IACjE,OAAO,SAAS,CAAC,SAAS,CAAC,CAAA;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,MAAM,GAAG,aAAa,EAAE,CAAA;IAC9B,MAAM,cAAc,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;IACxC,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAEjC,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,gBAAgB,GAAG,SAAS,CAAC,aAAa,CAAC,CAAA;QACjD,IAAI,gBAAgB,KAAK,cAAc,EAAE,CAAC;YACxC,iEAAiE;YACjE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;YAC/D,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,CAAA;YACpC,IAAI,QAAQ,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACpC,KAAK,CAAC,iCAAiC,SAAS,MAAM,gBAAgB,GAAG,CAAC,CAAA;gBAC1E,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,IAAI,CACF,4DAA4D,QAAQ,IAAI,GAAG,IAAI;gBAC7E,OAAO,MAAM,IAAI,GAAG,uBAAuB,cAAc,EAAE,CAC9D,CAAA;QACH,CAAC;aAAM,IAAI,gBAAgB,EAAE,CAAC;YAC5B,0EAA0E;YAC1E,uEAAuE;YACvE,oCAAoC;YACpC,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;YACrC,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,CAAA;YACpC,IAAI,QAAQ,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACpC,KAAK,CAAC,iCAAiC,SAAS,MAAM,gBAAgB,GAAG,CAAC,CAAA;gBAC1E,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,IAAI,CACF,qBAAqB,gBAAgB,4BAA4B;gBAC/D,0BAA0B,cAAc,EAAE,CAC7C,CAAA;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,kEAAkE,cAAc,EAAE,CAAC,CAAA;QAC1F,CAAC;IACH,CAAC;IAED,IAAI,CAAC,yBAAyB,cAAc,QAAQ,MAAM,IAAI,CAAC,CAAA;IAC/D,MAAM,kBAAkB,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,CAAC,CAAA;IAChG,IAAI,CAAC,yBAAyB,SAAS,EAAE,CAAC,CAAA;IAC1C,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAW,EACX,WAAmB,EACnB,OAAe,EACf,MAAc;IAEd,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAC5B,MAAM,oBAAoB,CAAC,GAAG,EAAE,IAAI,EAAE,WAAW,CAAC,CAAA;IAClD,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACzB,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAA;IAChC,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IACxC,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;AAC1C,CAAC;AAED,SAAS,oBAAoB,CAC3B,GAAW,EACX,IAAY,EACZ,WAAmB,EACnB,aAAa,GAAG,CAAC;IAEjB,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,IAAI,WAAW,EAAE,EAAE,CAAA;IACzD,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE;YAC/B,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAA;YAElC,0CAA0C;YAC1C,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAClE,GAAG,CAAC,MAAM,EAAE,CAAA;gBACZ,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;oBACvB,MAAM,CAAC,IAAI,KAAK,CAAC,6CAA6C,GAAG,EAAE,CAAC,CAAC,CAAA;oBACrE,OAAM;gBACR,CAAC;gBACD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAA;gBAC1D,oBAAoB,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBACtF,OAAM;YACR,CAAC;YAED,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBACnB,GAAG,CAAC,MAAM,EAAE,CAAA;gBACZ,MAAM,CAAC,IAAI,KAAK,CAAC,qBAAqB,MAAM,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAA;gBAC3D,OAAM;YACR,CAAC;YAED,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAA;YAChE,IAAI,QAAQ,GAAG,CAAC,CAAA;YAChB,IAAI,SAAS,GAAG,CAAC,CAAA;YACjB,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;YAC1C,MAAM,GAAG,GAAG,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAA;YAErC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAC/B,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAA;gBACxB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;gBACpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;gBACtB,IAAI,GAAG,GAAG,SAAS,GAAG,EAAE,EAAE,CAAC;oBACzB,SAAS,GAAG,GAAG,CAAA;oBACf,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;oBAC5D,MAAM,EAAE,GAAG,CAAC,QAAQ,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;oBAChD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;oBAChE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,EAAE,MAAM,OAAO,KAAK,CAAC,CAAA;gBAC5D,CAAC;YACH,CAAC,CAAC,CAAA;YACF,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAEb,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;gBACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;gBACnC,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;oBAC3B,IAAI,CAAC;wBACH,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;oBACpB,CAAC;oBAAC,MAAM,CAAC;wBACP,iBAAiB;oBACnB,CAAC;oBACD,MAAM,CACJ,IAAI,KAAK,CACP,8CAA8C,WAAW,iBAAiB,MAAM,EAAE,CACnF,CACF,CAAA;oBACD,OAAM;gBACR,CAAC;gBACD,IAAI,CAAC;oBACH,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;gBAC1B,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,GAAY,CAAC,CAAA;oBACpB,OAAM;gBACR,CAAC;gBACD,OAAO,EAAE,CAAA;YACX,CAAC,CAAC,CAAA;YACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACzB,CAAC,CAAC,CAAA;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACxC,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;IAC3D,OAAO,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;QACjC,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,sBAAsB,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;QACnF,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;QAC7B,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/mesh/manifest.d.ts

@@ -0,0 +1,45 @@
+/**
+ * gsk-mesh native-binary manifest — pinned version, CDN layout, platform
+ * detection, and the sha256 floor table for first-run downloads.
+ *
+ * ─── CONTRACT (gen-spark#32059) ──────────────────────────────────────────
+ * The platform strings produced by `currentTarget()` (and the keys of
+ * CHECKSUMS) MUST match, byte-for-byte, the platforms registered in the
+ * backend at:
+ *   backend/voice/update_model.py :: APP_REGISTRY["gsk-mesh"].platforms
+ * The backend builds its manifest filename as `{channel}-{platform}.yml` and
+ * looks it up against the CLI-supplied `target` string verbatim, so any drift
+ * (e.g. "mac-arm64" vs "darwin-arm64", or channel "prerelease" vs "beta")
+ * surfaces as a silent 404 / "no update" rather than a typed error.
+ *
+ *   Five targets : darwin-arm64 / darwin-x64 / linux-x64 / linux-arm64 / win-x64
+ *   Channels     : stable / beta  (the CLI `--prerelease` flag maps to `beta`)
+ * ─────────────────────────────────────────────────────────────────────────
+ *
+ * PINNED_VERSION + CHECKSUMS are the FLOOR — the version `gsk mesh` pulls on
+ * first use. Routine version bumps after npm publish are handled at runtime by
+ * `gsk mesh upgrade` (and the autorun check) against the backend endpoint, so
+ * we do NOT re-publish @genspark/cli for every gsk-mesh release.
+ */
+export declare const PINNED_VERSION = "0.1.2";
+export declare const CDN_BASE = "https://cdn1.genspark.ai/user-upload-image/client/gsk-mesh";
+export type MeshTarget = 'darwin-arm64' | 'darwin-x64' | 'linux-x64' | 'linux-arm64' | 'win-x64';
+/**
+ * Map process.platform / process.arch to a gsk-mesh target string.
+ * Throws for any platform/arch combination gsk-mesh does not publish.
+ */
+export declare function currentTarget(): MeshTarget;
+/** `.exe` on Windows, empty elsewhere. */
+export declare function binExt(target: string): string;
+/** Full CDN download URL for a given version + target. */
+export declare function cdnUrl(version: string, target: string): string;
+/**
+ * sha256 of each target's binary at PINNED_VERSION. Populated from the
+ * gsk-mesh release's published `.sha256` sidecars at
+ *   <CDN_BASE>/v<VERSION>/gsk-mesh-<VERSION>-<target>[.exe].sha256
+ * (see cli/scripts/sync-mesh-manifest.cjs — runs at prepublishOnly).
+ *
+ * The KEYS here are the contract surface with the backend (see top-of-file).
+ */
+export declare const CHECKSUMS: Record<MeshTarget, string>;
+//# sourceMappingURL=manifest.d.ts.map

package/dist/mesh/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../src/mesh/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,eAAO,MAAM,cAAc,UAAU,CAAA;AAErC,eAAO,MAAM,QAAQ,+DACyC,CAAA;AAE9D,MAAM,MAAM,UAAU,GAClB,cAAc,GACd,YAAY,GACZ,WAAW,GACX,aAAa,GACb,SAAS,CAAA;AAEb;;;GAGG;AACH,wBAAgB,aAAa,IAAI,UAAU,CA6B1C;AAED,0CAA0C;AAC1C,wBAAgB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED,0DAA0D;AAC1D,wBAAgB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAWhD,CAAA"}

package/dist/mesh/manifest.js

@@ -0,0 +1,76 @@
+/**
+ * gsk-mesh native-binary manifest — pinned version, CDN layout, platform
+ * detection, and the sha256 floor table for first-run downloads.
+ *
+ * ─── CONTRACT (gen-spark#32059) ──────────────────────────────────────────
+ * The platform strings produced by `currentTarget()` (and the keys of
+ * CHECKSUMS) MUST match, byte-for-byte, the platforms registered in the
+ * backend at:
+ *   backend/voice/update_model.py :: APP_REGISTRY["gsk-mesh"].platforms
+ * The backend builds its manifest filename as `{channel}-{platform}.yml` and
+ * looks it up against the CLI-supplied `target` string verbatim, so any drift
+ * (e.g. "mac-arm64" vs "darwin-arm64", or channel "prerelease" vs "beta")
+ * surfaces as a silent 404 / "no update" rather than a typed error.
+ *
+ *   Five targets : darwin-arm64 / darwin-x64 / linux-x64 / linux-arm64 / win-x64
+ *   Channels     : stable / beta  (the CLI `--prerelease` flag maps to `beta`)
+ * ─────────────────────────────────────────────────────────────────────────
+ *
+ * PINNED_VERSION + CHECKSUMS are the FLOOR — the version `gsk mesh` pulls on
+ * first use. Routine version bumps after npm publish are handled at runtime by
+ * `gsk mesh upgrade` (and the autorun check) against the backend endpoint, so
+ * we do NOT re-publish @genspark/cli for every gsk-mesh release.
+ */
+export const PINNED_VERSION = '0.1.2';
+export const CDN_BASE = 'https://cdn1.genspark.ai/user-upload-image/client/gsk-mesh';
+/**
+ * Map process.platform / process.arch to a gsk-mesh target string.
+ * Throws for any platform/arch combination gsk-mesh does not publish.
+ */
+export function currentTarget() {
+    const platform = process.platform === 'darwin'
+        ? 'darwin'
+        : process.platform === 'win32'
+            ? 'win'
+            : process.platform === 'linux'
+                ? 'linux'
+                : null;
+    const arch = process.arch === 'arm64' ? 'arm64' : process.arch === 'x64' ? 'x64' : null;
+    if (!platform || !arch) {
+        throw new Error(`gsk-mesh has no published binary for ${process.platform}/${process.arch}. ` +
+            `Supported: ${Object.keys(CHECKSUMS).join(', ')}.`);
+    }
+    // Windows only ships x64; Windows-on-ARM runs x64 binaries natively via
+    // emulation, so map win/arm64 → win-x64 rather than erroring. darwin/linux
+    // ship both arches.
+    const target = platform === 'win' ? 'win-x64' : `${platform}-${arch}`;
+    if (!(target in CHECKSUMS)) {
+        throw new Error(`gsk-mesh has no published binary for ${target}. ` +
+            `Supported: ${Object.keys(CHECKSUMS).join(', ')}.`);
+    }
+    return target;
+}
+/** `.exe` on Windows, empty elsewhere. */
+export function binExt(target) {
+    return target.startsWith('win-') ? '.exe' : '';
+}
+/** Full CDN download URL for a given version + target. */
+export function cdnUrl(version, target) {
+    return `${CDN_BASE}/v${version}/gsk-mesh-${version}-${target}${binExt(target)}`;
+}
+/**
+ * sha256 of each target's binary at PINNED_VERSION. Populated from the
+ * gsk-mesh release's published `.sha256` sidecars at
+ *   <CDN_BASE>/v<VERSION>/gsk-mesh-<VERSION>-<target>[.exe].sha256
+ * (see cli/scripts/sync-mesh-manifest.cjs — runs at prepublishOnly).
+ *
+ * The KEYS here are the contract surface with the backend (see top-of-file).
+ */
+export const CHECKSUMS = {
+    'darwin-arm64': '8492aaa47d4f513e49fe75ce83c8b46f52f8d70f996cfc1cb007ed4b10362d53',
+    'darwin-x64': '35ddbf4357bdd94d7782c80d0e21288ca6f06fcf79a39303702ae62e06615296',
+    'linux-x64': '40be4437dead5c9be148f3cef626c4c562f92b9949d6be12a86c2da4f92ffccd',
+    'linux-arm64': '6f73cd7aa9c21a82da11724c1099bde109a8b1ed14fe18f4cab6224a9546481f',
+    'win-x64': '254cbfb6bd7b7afcc883ea4b13c824e0906820765156f9d3cdb07b3bf4935ebb',
+};
+//# sourceMappingURL=manifest.js.map

package/dist/mesh/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../src/mesh/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAA;AAErC,MAAM,CAAC,MAAM,QAAQ,GACnB,4DAA4D,CAAA;AAS9D;;;GAGG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAC3B,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO;YAC5B,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO;gBAC5B,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,IAAI,CAAA;IACd,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IAEvF,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,wCAAwC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,IAAI;YAC1E,cAAc,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACrD,CAAA;IACH,CAAC;IAED,wEAAwE;IACxE,2EAA2E;IAC3E,oBAAoB;IACpB,MAAM,MAAM,GAAG,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAA;IACrE,IAAI,CAAC,CAAC,MAAM,IAAI,SAAS,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,wCAAwC,MAAM,IAAI;YAChD,cAAc,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACrD,CAAA;IACH,CAAC;IACD,OAAO,MAAoB,CAAA;AAC7B,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,MAAM,CAAC,MAAc;IACnC,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;AAChD,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,MAAM,CAAC,OAAe,EAAE,MAAc;IACpD,OAAO,GAAG,QAAQ,KAAK,OAAO,aAAa,OAAO,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAA;AACjF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,SAAS,GAA+B;IACnD,cAAc,EACZ,kEAAkE;IACpE,YAAY,EACV,kEAAkE;IACpE,WAAW,EACT,kEAAkE;IACpE,aAAa,EACX,kEAAkE;IACpE,SAAS,EACP,kEAAkE;CACrE,CAAA"}

package/dist/mesh/upgrade.d.ts

@@ -0,0 +1,41 @@
+/**
+ * `gsk mesh upgrade` + the throttled autorun currency check.
+ *
+ * Talks to the backend endpoint added in gen-spark#32059:
+ *   GET {base}/api/gsk-mesh/checkupdate/{target}?channel=stable|beta
+ *       &current_version=<installed>
+ *   → 200 {version, sha256, url, notes}  (update available)
+ *   → 204                                 (already latest / none promoted)
+ *
+ * Contract notes:
+ *   - The CLI `--prerelease` flag maps to channel `beta` (the backend only
+ *     knows stable/beta; `prerelease` would collapse to stable).
+ *   - Auth is optional: the autorun check frequently fires unauthenticated, so
+ *     we send the bearer token when present but never require it.
+ */
+export interface UpgradeOptions {
+    force?: boolean;
+    prerelease?: boolean;
+    /**
+     * Explicit `--base-url` from the command line (already resolved by the
+     * caller). Highest priority — see resolveBaseUrl.
+     */
+    baseUrlOverride?: string;
+}
+export type UpgradeResult = 'updated' | 'up-to-date' | 'error';
+/**
+ * Body of the explicit `gsk mesh upgrade` command.
+ * `--force` ignores the installed version (always pulls the channel's latest).
+ */
+export declare function runUpgrade(opts: UpgradeOptions): Promise<UpgradeResult>;
+/**
+ * Best-effort autorun currency check, invoked (non-awaited) from the `gsk mesh`
+ * passthrough path. Only fires when:
+ *   - autorun isn't disabled (GSK_NO_AUTO_UPDATE / config auto_update:false),
+ *   - a binary is already installed (never triggers a first download here),
+ *   - the shared 4h throttle has elapsed.
+ * A newer release is downloaded in the background so it applies next run; the
+ * current invocation is never blocked or failed by this.
+ */
+export declare function maybeAutoUpgradeMesh(baseUrlOverride?: string): Promise<void>;
+//# sourceMappingURL=upgrade.d.ts.map

package/dist/mesh/upgrade.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrade.d.ts","sourceRoot":"","sources":["../../src/mesh/upgrade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAoBH,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,YAAY,GAAG,OAAO,CAAA;AAwE9D;;;GAGG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAiD7E;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsClF"}

package/dist/mesh/upgrade.js

@@ -0,0 +1,179 @@
+/**
+ * `gsk mesh upgrade` + the throttled autorun currency check.
+ *
+ * Talks to the backend endpoint added in gen-spark#32059:
+ *   GET {base}/api/gsk-mesh/checkupdate/{target}?channel=stable|beta
+ *       &current_version=<installed>
+ *   → 200 {version, sha256, url, notes}  (update available)
+ *   → 204                                 (already latest / none promoted)
+ *
+ * Contract notes:
+ *   - The CLI `--prerelease` flag maps to channel `beta` (the backend only
+ *     knows stable/beta; `prerelease` would collapse to stable).
+ *   - Auth is optional: the autorun check frequently fires unauthenticated, so
+ *     we send the bearer token when present but never require it.
+ */
+import { CDN_BASE, currentTarget, } from './manifest.js';
+import { downloadAndInstall, getInstalledMeshVersion, isMeshInstalled, } from './download.js';
+import { loadUpdateMeta, saveUpdateMeta, CHECK_INTERVAL_MS, } from '../updater.js';
+import { info, debug, error as logError } from '../logger.js';
+import { loadConfigFile } from '../config.js';
+/**
+ * Resolve the backend base URL the gsk-mesh endpoint is served from.
+ *
+ * Priority matches the main CLI's getGlobalOptions (CLI flag > env > config),
+ * then falls back to PROD rather than gsk's localhost dev default — gsk-mesh
+ * binaries + endpoint are production-served.
+ */
+function resolveBaseUrl(override) {
+    const cfg = loadConfigFile();
+    return (override ||
+        process.env.GSK_BASE_URL ||
+        cfg.base_url ||
+        'https://www.genspark.ai').replace(/\/$/, '');
+}
+/** channel string for the request: --prerelease → beta, else stable. */
+function channelFor(opts) {
+    return opts.prerelease ? 'beta' : 'stable';
+}
+/**
+ * Query the backend for the latest gsk-mesh release for this target+channel.
+ * Returns the manifest (200), null (204 / no update), or throws on transport
+ * / HTTP errors.
+ */
+async function fetchCheckUpdate(target, channel, currentVersion, baseUrlOverride) {
+    const base = resolveBaseUrl(baseUrlOverride);
+    const cfg = loadConfigFile();
+    const apiKey = cfg.api_key || process.env.GSK_API_KEY;
+    const params = new URLSearchParams({ channel });
+    if (currentVersion)
+        params.set('current_version', currentVersion);
+    const url = `${base}/api/gsk-mesh/checkupdate/${target}?${params.toString()}`;
+    const headers = {
+        // gsk-mesh/<ver> UA lets the backend gatekeeper treat this as client
+        // traffic for gradual rollout (gk_gsk_mesh_update).
+        'User-Agent': `gsk-mesh/${currentVersion ?? '0.0.0'}`,
+    };
+    if (currentVersion)
+        headers['gs-version'] = currentVersion;
+    if (apiKey)
+        headers['Authorization'] = `Bearer ${apiKey}`;
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 8000);
+    try {
+        const resp = await fetch(url, { headers, signal: controller.signal });
+        if (resp.status === 204)
+            return null;
+        if (!resp.ok) {
+            throw new Error(`checkupdate HTTP ${resp.status}`);
+        }
+        return (await resp.json());
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+/**
+ * Body of the explicit `gsk mesh upgrade` command.
+ * `--force` ignores the installed version (always pulls the channel's latest).
+ */
+export async function runUpgrade(opts) {
+    const target = currentTarget();
+    const channel = channelFor(opts);
+    const installed = getInstalledMeshVersion();
+    // With --force, omit current_version so the backend returns latest
+    // regardless of what we have cached.
+    const currentForQuery = opts.force ? null : installed;
+    let manifest;
+    try {
+        manifest = await fetchCheckUpdate(target, channel, currentForQuery, opts.baseUrlOverride);
+    }
+    catch (err) {
+        logError(`gsk mesh upgrade: ${err.message}`);
+        return 'error';
+    }
+    // Record the check timestamp regardless of outcome (shared throttle file).
+    saveUpdateMeta({
+        last_mesh_check: new Date().toISOString(),
+        latest_mesh_version: manifest?.version || undefined,
+    });
+    if (!manifest) {
+        info(`gsk-mesh is already at the latest ${channel} release${installed ? ` (v${installed})` : ''}.`);
+        return 'up-to-date';
+    }
+    // --force on the same version: re-pull anyway.
+    if (!opts.force && installed && installed === manifest.version) {
+        info(`gsk-mesh is already at v${manifest.version} (latest ${channel}).`);
+        return 'up-to-date';
+    }
+    // Defense in depth: the served URL must live under the trusted CDN base.
+    if (!manifest.url.startsWith(`${CDN_BASE}/`)) {
+        logError(`gsk mesh upgrade: refusing untrusted download URL ${manifest.url}`);
+        return 'error';
+    }
+    info(`gsk-mesh: ${installed ?? '(none)'} → v${manifest.version}`);
+    if (manifest.notes)
+        info(manifest.notes);
+    try {
+        await downloadAndInstall(manifest.url, manifest.sha256, manifest.version, target);
+    }
+    catch (err) {
+        logError(`gsk mesh upgrade: ${err.message}`);
+        return 'error';
+    }
+    info(`gsk-mesh upgraded to v${manifest.version}.`);
+    return 'updated';
+}
+/**
+ * Best-effort autorun currency check, invoked (non-awaited) from the `gsk mesh`
+ * passthrough path. Only fires when:
+ *   - autorun isn't disabled (GSK_NO_AUTO_UPDATE / config auto_update:false),
+ *   - a binary is already installed (never triggers a first download here),
+ *   - the shared 4h throttle has elapsed.
+ * A newer release is downloaded in the background so it applies next run; the
+ * current invocation is never blocked or failed by this.
+ */
+export async function maybeAutoUpgradeMesh(baseUrlOverride) {
+    try {
+        if (process.env.GSK_NO_AUTO_UPDATE === '1')
+            return;
+        // On Windows a running .exe is locked, so an in-the-background install that
+        // renames over the binary just spawned by this same invocation always
+        // fails (and wastes the download). Windows currency comes from an explicit
+        // `gsk mesh upgrade`, which runs standalone without the binary in use.
+        if (process.platform === 'win32')
+            return;
+        const cfg = loadConfigFile();
+        if (cfg.auto_update === false)
+            return;
+        if (!isMeshInstalled())
+            return;
+        const meta = loadUpdateMeta();
+        if (meta?.last_mesh_check) {
+            const elapsed = Date.now() - new Date(meta.last_mesh_check).getTime();
+            if (elapsed < CHECK_INTERVAL_MS) {
+                debug(`gsk-mesh: skipping autorun check (last ${Math.round(elapsed / 60000)}m ago)`);
+                return;
+            }
+        }
+        const target = currentTarget();
+        const installed = getInstalledMeshVersion();
+        const manifest = await fetchCheckUpdate(target, 'stable', installed, baseUrlOverride);
+        saveUpdateMeta({
+            last_mesh_check: new Date().toISOString(),
+            latest_mesh_version: manifest?.version || undefined,
+        });
+        if (!manifest || (installed && manifest.version === installed))
+            return;
+        if (!manifest.url.startsWith(`${CDN_BASE}/`))
+            return;
+        debug(`gsk-mesh: autorun upgrade ${installed ?? '(none)'} → v${manifest.version}`);
+        await downloadAndInstall(manifest.url, manifest.sha256, manifest.version, target);
+        info(`gsk-mesh updated to v${manifest.version} (applies next run).`);
+    }
+    catch (err) {
+        // Never surface autorun failures to the user.
+        debug(`gsk-mesh autorun check failed: ${err.message}`);
+    }
+}
+//# sourceMappingURL=upgrade.js.map

package/dist/mesh/upgrade.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrade.js","sourceRoot":"","sources":["../../src/mesh/upgrade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACL,QAAQ,EACR,aAAa,GAEd,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,eAAe,GAChB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,cAAc,EACd,cAAc,EACd,iBAAiB,GAClB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,QAAQ,EAAE,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAqB7C;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,QAAiB;IACvC,MAAM,GAAG,GAAG,cAAc,EAAE,CAAA;IAC5B,OAAO,CACL,QAAQ;QACR,OAAO,CAAC,GAAG,CAAC,YAAY;QACxB,GAAG,CAAC,QAAQ;QACZ,yBAAyB,CAC1B,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACtB,CAAC;AAED,wEAAwE;AACxE,SAAS,UAAU,CAAC,IAAoB;IACtC,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAA;AAC5C,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAC7B,MAAkB,EAClB,OAA0B,EAC1B,cAA6B,EAC7B,eAAwB;IAExB,MAAM,IAAI,GAAG,cAAc,CAAC,eAAe,CAAC,CAAA;IAC5C,MAAM,GAAG,GAAG,cAAc,EAAE,CAAA;IAC5B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAA;IAErD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IAC/C,IAAI,cAAc;QAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;IACjE,MAAM,GAAG,GAAG,GAAG,IAAI,6BAA6B,MAAM,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;IAE7E,MAAM,OAAO,GAA2B;QACtC,qEAAqE;QACrE,oDAAoD;QACpD,YAAY,EAAE,YAAY,cAAc,IAAI,OAAO,EAAE;KACtD,CAAA;IACD,IAAI,cAAc;QAAE,OAAO,CAAC,YAAY,CAAC,GAAG,cAAc,CAAA;IAC1D,IAAI,MAAM;QAAE,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,MAAM,EAAE,CAAA;IAEzD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAA;IAC1D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;QACrE,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;QACpD,CAAC;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAwB,CAAA;IACnD,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAA;IACvB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAoB;IACnD,MAAM,MAAM,GAAG,aAAa,EAAE,CAAA;IAC9B,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IAChC,MAAM,SAAS,GAAG,uBAAuB,EAAE,CAAA;IAC3C,mEAAmE;IACnE,qCAAqC;IACrC,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;IAErD,IAAI,QAAoC,CAAA;IACxC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,CAAC,CAAA;IAC3F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,qBAAsB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QACvD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,2EAA2E;IAC3E,cAAc,CAAC;QACb,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACzC,mBAAmB,EAAE,QAAQ,EAAE,OAAO,IAAI,SAAS;KACpD,CAAC,CAAA;IAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,IAAI,CAAC,qCAAqC,OAAO,WAAW,SAAS,CAAC,CAAC,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QACnG,OAAO,YAAY,CAAA;IACrB,CAAC;IAED,+CAA+C;IAC/C,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,SAAS,IAAI,SAAS,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC/D,IAAI,CAAC,2BAA2B,QAAQ,CAAC,OAAO,YAAY,OAAO,IAAI,CAAC,CAAA;QACxE,OAAO,YAAY,CAAA;IACrB,CAAC;IAED,yEAAyE;IACzE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;QAC7C,QAAQ,CAAC,qDAAqD,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAA;QAC7E,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,IAAI,CAAC,aAAa,SAAS,IAAI,QAAQ,OAAO,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;IACjE,IAAI,QAAQ,CAAC,KAAK;QAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACxC,IAAI,CAAC;QACH,MAAM,kBAAkB,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACnF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,qBAAsB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QACvD,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,IAAI,CAAC,yBAAyB,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAA;IAClD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,eAAwB;IACjE,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,GAAG;YAAE,OAAM;QAClD,4EAA4E;QAC5E,sEAAsE;QACtE,2EAA2E;QAC3E,uEAAuE;QACvE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAM;QACxC,MAAM,GAAG,GAAG,cAAc,EAAE,CAAA;QAC5B,IAAI,GAAG,CAAC,WAAW,KAAK,KAAK;YAAE,OAAM;QACrC,IAAI,CAAC,eAAe,EAAE;YAAE,OAAM;QAE9B,MAAM,IAAI,GAAG,cAAc,EAAE,CAAA;QAC7B,IAAI,IAAI,EAAE,eAAe,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,CAAA;YACrE,IAAI,OAAO,GAAG,iBAAiB,EAAE,CAAC;gBAChC,KAAK,CAAC,0CAA0C,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAA;gBACpF,OAAM;YACR,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,EAAE,CAAA;QAC9B,MAAM,SAAS,GAAG,uBAAuB,EAAE,CAAA;QAC3C,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,CAAC,CAAA;QACrF,cAAc,CAAC;YACb,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACzC,mBAAmB,EAAE,QAAQ,EAAE,OAAO,IAAI,SAAS;SACpD,CAAC,CAAA;QACF,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,CAAC;YAAE,OAAM;QACtE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC;YAAE,OAAM;QAEpD,KAAK,CAAC,6BAA6B,SAAS,IAAI,QAAQ,OAAO,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;QAClF,MAAM,kBAAkB,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACjF,IAAI,CAAC,wBAAwB,QAAQ,CAAC,OAAO,sBAAsB,CAAC,CAAA;IACtE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,8CAA8C;QAC9C,KAAK,CAAC,kCAAmC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;IACnE,CAAC;AACH,CAAC"}