@herbertgao/pi-impeccable 0.0.0-stage → 0.0.0

package/skills/impeccable/scripts/engine-checksums.txt

@@ -0,0 +1,9 @@
+# Engine binary digests for the pinned ENGINE_VERSION: <engine-version> <asset> <sha256>.
+# The launchers, the npm shim, `impeccable install` and scripts/fetch-engine.mjs verify
+# every engine download against this file. Written by
+# `node scripts/check-engine-release.mjs --record` after each engine release.
+0.1.18 impeccable-darwin-arm64 543ee2f72036ad185dc9991ac3ba86b74d91f988f3d497776a088b8b65c8a9e1
+0.1.18 impeccable-darwin-x64 1f1eee78c142f7e40e16f481aeeeb1fad1d8515d8a1ef033d7c6d133e52232b3
+0.1.18 impeccable-linux-x64 736ed785e74ae2344d3036127f614ddde5ab520a527d8bc82a891612ef71f648
+0.1.18 impeccable-linux-arm64 317cb18d64b0f7715681dd6e574ad64b2adb5a6caf8e7a1b3b57965f805404be
+0.1.18 impeccable-windows-x64.exe 8f61e96b0c97001546a824d79b44f46b423b560f3eb1a0cc44a8695a1b395d9f

package/skills/impeccable/scripts/impeccable

@@ -0,0 +1,249 @@
+#!/bin/sh
+# Impeccable launcher. Runs the platform binary shipped next to this script:
+#   <this dir>/bin/<os>-<arch>/impeccable
+# Order: $IMPECCABLE_BIN, the sibling binary, ~/.impeccable/bin/impeccable,
+# the version-pinned cache, then `impeccable` on PATH. Never needs Node.
+# The unversioned home binary and the PATH candidate are validated with the
+# engine-probe handshake first: the retired 3.x npm CLI also installed a bin
+# named `impeccable`, and exec'ing it would fail every verb with
+# "Unknown command". Trusted candidates (IMPECCABLE_BIN, the sibling binary,
+# the version-pinned cache) are exec'd without a probe: hooks run them on
+# every edit and must stay fast. The version-pinned cache and the download are
+# verified against engine-checksums.txt (next to this script), never against
+# anything published beside the binary; a <binary>.verified stamp records that
+# a cached binary passed, so only the first run hashes it.
+set -eu
+
+# True when the candidate answers the engine handshake (prints
+# "impeccable-engine <version>", exit 0). Quiet and fast (<100ms).
+# IMPECCABLE_LAUNCHER_PROBE marks the child as a probe: a copy of this
+# launcher reached recursively (e.g. symlinked onto PATH as `impeccable`)
+# then skips its own probes and refuses to download, so probing stays cheap
+# and can never loop.
+probe_ok() {
+  probe_out=$(IMPECCABLE_LAUNCHER_PROBE=1 "$1" engine-probe 2>/dev/null) || return 1
+  case "$probe_out" in
+    impeccable-engine*) return 0 ;;
+  esac
+  return 1
+}
+probing=${IMPECCABLE_LAUNCHER_PROBE:-}
+
+# Prints the digest engine-checksums.txt records for engine version $1 and
+# asset $2 (lines are "<version> <asset> <sha256>"), nothing when there is none.
+# A CR is a separator too (CRLF checkouts), and a last line with no newline
+# still counts.
+manifest_digest() {
+  [ -f "$manifest" ] || return 0
+  while IFS="$(printf ' \t\r')" read -r m_version m_asset m_sum _ || [ -n "$m_version" ]; do
+    case "$m_version" in ''|'#'*) continue ;; esac
+    if [ "$m_version" = "$1" ] && [ "$m_asset" = "$2" ]; then
+      printf '%s' "$m_sum"
+      return 0
+    fi
+  done < "$manifest"
+  return 0
+}
+# Sets $expected (and, on Windows on ARM, which runs x64 binaries,
+# $expected_x64) from engine-checksums.txt. Only called off the stamped fast
+# path: hooks run this launcher on every edit.
+read_expected() {
+  expected=$(manifest_digest "$version" "$asset")
+  expected_x64=""
+  if [ "$os" = windows ] && [ "$arch" = arm64 ]; then
+    expected_x64=$(manifest_digest "$version" impeccable-windows-x64.exe)
+  fi
+}
+# Sets $actual to the sha256 of $1, empty when no hash tool works.
+hash_file() {
+  actual=""
+  if command -v shasum >/dev/null 2>&1; then
+    if digest=$(shasum -a 256 "$1" 2>/dev/null); then actual=${digest%% *}; fi
+  elif command -v sha256sum >/dev/null 2>&1; then
+    if digest=$(sha256sum "$1" 2>/dev/null); then actual=${digest%% *}; fi
+  fi
+}
+
+dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+manifest="$dir/engine-checksums.txt"
+
+# What the binary needs to know about its home: the skill directory (for
+# reference/*.md and command-metadata.json) and how to name itself in the
+# commands it prints. Exported BEFORE any exec below, including the
+# IMPECCABLE_BIN override: an engine binary reached with no IMPECCABLE_SKILL_DIR
+# cannot find reference/*.md (so native platform refs never inline) or read its
+# own version (so UPDATE_AVAILABLE never fires). Setting it here covers every
+# candidate the launcher can exec.
+: "${IMPECCABLE_SKILL_DIR:=$(CDPATH= cd -- "$dir/.." && pwd)}"
+: "${IMPECCABLE_SELF:=$0}"
+export IMPECCABLE_SKILL_DIR IMPECCABLE_SELF
+
+if [ -n "${IMPECCABLE_BIN:-}" ] && [ -x "${IMPECCABLE_BIN}" ]; then
+  exec "${IMPECCABLE_BIN}" "$@"
+fi
+
+case "$(uname -s 2>/dev/null || echo unknown)" in
+  Darwin) os=darwin ;;
+  Linux) os=linux ;;
+  MINGW*|MSYS*|CYGWIN*|Windows_NT) os=windows ;;
+  *) os=unknown ;;
+esac
+case "$(uname -m 2>/dev/null || echo unknown)" in
+  arm64|aarch64) arch=arm64 ;;
+  x86_64|amd64) arch=x64 ;;
+  *) arch=unknown ;;
+esac
+
+bin="$dir/bin/$os-$arch/impeccable"
+[ "$os" = windows ] && bin="$bin.exe"
+
+if [ -x "$bin" ]; then
+  exec "$bin" "$@"
+fi
+if [ -f "$bin" ]; then
+  # Lost the executable bit in transit (zip extraction, some copiers).
+  chmod +x "$bin" 2>/dev/null && exec "$bin" "$@"
+fi
+# On Windows (an MSYS/Git Bash shell) the cached names carry .exe so this
+# launcher and impeccable.cmd share one cache.
+exe=""
+[ "$os" = windows ] && exe=".exe"
+home_bin="${HOME:-/nonexistent}/.impeccable/bin/impeccable$exe"
+if [ -z "$probing" ] && [ -x "$home_bin" ] && probe_ok "$home_bin"; then
+  exec "$home_bin" "$@"
+fi
+# Version-pinned user cache, filled by the download below or by `impeccable update`.
+version=""
+[ -f "$dir/VERSION" ] && version=$(tr -d '[:space:]' < "$dir/VERSION")
+cache_root="${IMPECCABLE_HOME:-${HOME:-/nonexistent}/.impeccable}"
+cached="$cache_root/bin/$version/impeccable$exe"
+asset="impeccable-$os-$arch"
+[ "$os" = windows ] && asset="$asset.exe"
+if [ -n "$version" ] && [ -x "$cached" ]; then
+  if [ -f "$cached.verified" ]; then
+    exec "$cached" "$@"
+  fi
+  read_expected
+  hash_file "$cached"
+  if [ -n "$actual" ] && { [ "$actual" = "$expected" ] || [ "$actual" = "$expected_x64" ]; }; then
+    { echo "$actual" > "$cached.verified"; } 2>/dev/null || :
+    exec "$cached" "$@"
+  fi
+  echo "impeccable: cannot verify the cached engine $cached against $manifest; not using it" >&2
+fi
+if [ -z "$probing" ] && command -v impeccable >/dev/null 2>&1 && probe_ok impeccable; then
+  exec impeccable "$@"
+fi
+
+# Last resort: fetch this version's binary for the current platform from the
+# public release channel into the user cache. Needs network; sandboxes without
+# egress preinstall the binary on PATH instead.
+setup_help() {
+  echo "Engine $version setup needs network access and write permission to $cache_root/bin/$version." >&2
+  echo "Run this launcher ($0) with engine-probe in a terminal that has those permissions, then retry the original command." >&2
+  echo "Alternatively, set IMPECCABLE_HOME to a writable cache location, or IMPECCABLE_BIN to a preinstalled engine binary." >&2
+}
+fetch_url() {
+  if command -v curl >/dev/null 2>&1; then
+    curl -fsSL --retry 2 -o "$tmp" "$1" 2>/dev/null
+  elif command -v wget >/dev/null 2>&1; then
+    wget -q -O "$tmp" "$1" 2>/dev/null
+  else
+    return 1
+  fi
+}
+check_download() {
+  download_file=${1:-$tmp}
+  if [ ! -f "$download_file" ]; then
+    echo "impeccable: download completed but the file was removed before execution: $url; check your antivirus quarantine or logs. Refusing to continue; do not disable protection." >&2
+    exit 127
+  fi
+  if [ ! -s "$download_file" ]; then
+    rm -f "$download_file"
+    echo "impeccable: downloaded file is empty: $url; refusing the unverified download" >&2
+    exit 127
+  fi
+}
+if [ -n "$probing" ]; then
+  # Inside another launcher's probe: no download, fail fast and quiet.
+  exit 127
+fi
+if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
+  base="${IMPECCABLE_DOWNLOAD_BASE:-https://github.com/pbakaus/impeccable/releases/download}"
+  url="$base/engine-v$version/$asset"
+  read_expected
+  # Fail closed before any network traffic or cache write.
+  if [ -z "$expected" ] && [ -z "$expected_x64" ]; then
+    echo "impeccable: no checksum for engine $version ($asset) in $manifest; refusing the unverified download" >&2
+    exit 127
+  fi
+  tmp="$cache_root/bin/$version/.impeccable.part.$$"
+  # An interrupted download (Ctrl-C, a hook timeout) would otherwise leave the
+  # PID-named staging file behind for good. The handlers must exit explicitly.
+  cleanup() { rm -f "$tmp" 2>/dev/null || :; }
+  trap 'cleanup; exit 129' HUP
+  trap 'cleanup; exit 130' INT
+  trap 'cleanup; exit 143' TERM
+  if ! mkdir -p "$cache_root/bin/$version" 2>/dev/null; then
+    echo "impeccable: engine $version is not installed; cannot create cache directory: $cache_root/bin/$version" >&2
+    setup_help
+    exit 127
+  fi
+  # Check the actual staging file, not just directory existence: a cache from
+  # an earlier run can be readable but no longer writable inside a sandbox.
+  if ! (umask 077; : > "$tmp") 2>/dev/null; then
+    echo "impeccable: engine $version is not installed; cannot write to cache directory: $cache_root/bin/$version" >&2
+    setup_help
+    exit 127
+  fi
+  fetched=0
+  if [ -n "$expected" ] && fetch_url "$url"; then
+    fetched=1
+  elif [ -n "$expected_x64" ]; then
+    # Windows on ARM runs x64 binaries; fall back when no arm64 asset exists.
+    url="$base/engine-v$version/impeccable-windows-x64.exe"
+    expected=$expected_x64
+    fetch_url "$url" && fetched=1
+  fi
+  if [ "$fetched" = 1 ]; then
+    check_download
+    # No sha256 tool refuses the download too.
+    hash_file "$tmp"
+    check_download
+    if [ -z "$actual" ]; then
+      rm -f "$tmp"
+      echo "impeccable: cannot verify $url (no sha256 tool, or hashing failed); refusing the unverified download" >&2
+      exit 127
+    fi
+    if [ "$actual" != "$expected" ]; then
+      rm -f "$tmp"
+      echo "impeccable: checksum mismatch downloading $url" >&2
+      exit 127
+    fi
+    check_download
+    if ! chmod +x "$tmp" 2>/dev/null; then
+      check_download
+      rm -f "$tmp"
+      echo "impeccable: could not make the verified download executable: $url" >&2
+      exit 127
+    fi
+    check_download
+    if ! mv -f "$tmp" "$cached" 2>/dev/null; then
+      check_download
+      rm -f "$tmp"
+      echo "impeccable: could not cache the verified download: $url" >&2
+      exit 127
+    fi
+    check_download "$cached"
+    { echo "$actual" > "$cached.verified"; } 2>/dev/null || :
+    exec "$cached" "$@"
+  fi
+  rm -f "$tmp" 2>/dev/null
+  echo "impeccable: could not download engine $version from $url; check network access, the release URL, and curl or wget availability." >&2
+  setup_help
+  exit 127
+fi
+
+echo "impeccable: no engine binary for $os-$arch found (looked in $bin, $cached, PATH)." >&2
+echo "Download impeccable-$os-$arch from https://github.com/pbakaus/impeccable/releases (tag engine-v$version) into $cache_root/bin/$version/impeccable$exe (then chmod +x), or set IMPECCABLE_BIN to a preinstalled engine binary. Docs: https://impeccable.style" >&2
+exit 127

package/skills/impeccable/scripts/impeccable.cmd

@@ -0,0 +1,278 @@
+@echo off
+setlocal
+rem Impeccable launcher (Windows). Runs bin\windows-<arch>\impeccable.exe next
+rem to this file, else a cached or freshly downloaded engine binary.
+rem
+rem Structure notes (this file is exercised by dry parsing and string-level
+rem tests, not yet on a real Windows machine):
+rem - No multi-line parenthesized blocks: cmd expands %var% at block parse
+rem   time, which made the old download path read back empty %url%/%cached%.
+rem   Linear goto flow keeps every expansion on its own line, and avoids
+rem   delayed expansion eating ! characters in user arguments.
+rem - The unversioned user binary and the PATH candidate are validated with
+rem   the engine-probe handshake (see :probe) so the retired 3.x npm CLI,
+rem   whose bin is also named impeccable, is never exec'd. IMPECCABLE_BIN,
+rem   the sibling binary, and the version-pinned cache stay trusted.
+rem - Downloads and the version-pinned cache are verified via certutil
+rem   against engine-checksums.txt next to this file, and fail closed; a
+rem   .verified stamp lets later runs skip hashing the cache. On ARM64 the
+rem   arm64 asset is tried first and the x64 asset is the fallback (Windows on
+rem   ARM runs x64 binaries), each only when the manifest has a line for it.
+if not defined IMPECCABLE_SKILL_DIR set "IMPECCABLE_SKILL_DIR=%~dp0.."
+if not defined IMPECCABLE_SELF set "IMPECCABLE_SELF=%~f0"
+set "arch=x64"
+if /I "%PROCESSOR_ARCHITECTURE%"=="ARM64" set "arch=arm64"
+
+if not defined IMPECCABLE_BIN goto no_env_bin
+if not exist "%IMPECCABLE_BIN%" goto no_env_bin
+set "run=%IMPECCABLE_BIN%"
+goto run
+:no_env_bin
+
+set "bin=%~dp0bin\windows-%arch%\impeccable.exe"
+if not exist "%bin%" goto no_sibling
+set "run=%bin%"
+goto run
+:no_sibling
+
+set "home_bin=%USERPROFILE%\.impeccable\bin\impeccable.exe"
+if not exist "%home_bin%" goto no_home_bin
+if defined IMPECCABLE_LAUNCHER_PROBE goto no_home_bin
+call :probe "%home_bin%"
+if not "%probe_ok%"=="1" goto no_home_bin
+set "run=%home_bin%"
+goto run
+:no_home_bin
+
+set "version="
+if exist "%~dp0VERSION" set /p version=<"%~dp0VERSION"
+if not defined IMPECCABLE_HOME set "IMPECCABLE_HOME=%USERPROFILE%\.impeccable"
+set "cached=%IMPECCABLE_HOME%\bin\%version%\impeccable.exe"
+set "asset=impeccable-windows-%arch%.exe"
+set "manifest=%~dp0engine-checksums.txt"
+if not defined version goto no_cache
+if not exist "%cached%" goto no_cache
+if exist "%cached%.verified" goto cache_trusted
+call :read_expected
+call :sha256 "%cached%" "%TEMP%\impeccable-hash-%RANDOM%%RANDOM%.txt"
+if not defined actual goto cache_unverified
+if /I "%actual%"=="%expected%" goto cache_verified
+if /I "%actual%"=="%expected_x64%" goto cache_verified
+:cache_unverified
+echo impeccable: cannot verify the cached engine "%cached%" against "%manifest%"; not using it 1>&2
+goto no_cache
+:cache_verified
+(>"%cached%.verified" echo %actual%) 2>nul
+:cache_trusted
+set "run=%cached%"
+goto run
+:no_cache
+
+if defined IMPECCABLE_LAUNCHER_PROBE goto download
+where impeccable >nul 2>nul
+if errorlevel 1 goto download
+call :probe impeccable
+if not "%probe_ok%"=="1" goto download
+impeccable %*
+exit /b %errorlevel%
+
+:download
+rem Last resort: fetch this version's binary from the release channel into
+rem the version-pinned user cache, verify it, then run it. Never inside
+rem another launcher's probe: fail fast and quiet instead.
+if defined IMPECCABLE_LAUNCHER_PROBE exit /b 127
+if not defined version goto fail
+call :read_expected
+if not defined expected if not defined expected_x64 goto no_checksum
+where curl.exe >nul 2>nul
+if errorlevel 1 goto curl_missing
+if not defined IMPECCABLE_DOWNLOAD_BASE set "IMPECCABLE_DOWNLOAD_BASE=https://github.com/pbakaus/impeccable/releases/download"
+if exist "%IMPECCABLE_HOME%\bin\%version%\" goto cache_ready
+mkdir "%IMPECCABLE_HOME%\bin\%version%" >nul 2>nul
+if errorlevel 1 goto cache_directory_failed
+:cache_ready
+rem Stage the download in a directory only this run owns, as the sh launcher
+rem does with .impeccable.part.$$: concurrent first runs (parallel hooks, two
+rem agents) must never write, hash or move each other's files. mkdir fails
+rem when the name exists, so it claims the name atomically. RANDOM alone is
+rem not enough because cmd seeds it from the clock in whole seconds; the
+rem timestamp and the retry on collision keep same-second runs apart. A cache
+rem directory that refuses every mkdir is reported as unwritable.
+set "attempt=0"
+:claim_staging
+set /a attempt+=1
+if %attempt% GTR 20 goto cache_write_failed
+set "stamp=%TIME: =0%"
+set "stamp=%stamp::=%"
+set "stamp=%stamp:.=%"
+set "stamp=%stamp:,=%"
+set "staging=%IMPECCABLE_HOME%\bin\%version%\.impeccable.part.%stamp%-%RANDOM%%RANDOM%"
+mkdir "%staging%" >nul 2>nul
+if errorlevel 1 goto claim_staging
+set "part=%staging%\impeccable.exe"
+rem Redirection failures do not reliably update ERRORLEVEL in cmd.exe;
+rem branch on the command's failure directly.
+(type nul >"%part%") 2>nul || goto staging_write_failed
+set "url=%IMPECCABLE_DOWNLOAD_BASE%/engine-v%version%/%asset%"
+if not defined expected goto fetch_x64
+curl.exe -fsSL -o "%part%" "%url%" >nul 2>nul
+if not errorlevel 1 goto verify
+:fetch_x64
+if not defined expected_x64 goto download_failed
+set "asset=impeccable-windows-x64.exe"
+set "expected=%expected_x64%"
+set "url=%IMPECCABLE_DOWNLOAD_BASE%/engine-v%version%/%asset%"
+curl.exe -fsSL -o "%part%" "%url%" >nul 2>nul
+if errorlevel 1 goto download_failed
+
+:verify
+call :check_download
+if errorlevel 1 exit /b 127
+rem Mirrors the sh launcher and fails closed: a freshly downloaded binary
+rem runs only after its hash matches the digest read from engine-checksums.txt.
+rem An empty certutil result refuses the download instead of running an
+rem unverified binary.
+call :sha256 "%part%" "%staging%\hash.txt"
+call :check_download
+if errorlevel 1 exit /b 127
+if not defined actual goto verify_refuse
+if /I "%actual%"=="%expected%" goto place
+call :discard_staging
+echo impeccable: checksum mismatch downloading %url% 1>&2
+exit /b 127
+
+:verify_refuse
+call :check_download
+if errorlevel 1 exit /b 127
+call :discard_staging
+echo impeccable: cannot verify %url% (certutil could not hash it); refusing the unverified download 1>&2
+exit /b 127
+
+:read_expected
+rem Sets expected (and, on ARM64, expected_x64: Windows on ARM runs x64
+rem binaries) from engine-checksums.txt. Only called off the stamped path:
+rem hooks run this launcher on every edit.
+call :manifest_digest "%asset%" expected
+set "expected_x64="
+if "%arch%"=="arm64" call :manifest_digest impeccable-windows-x64.exe expected_x64
+exit /b 0
+
+:manifest_digest
+rem Sets the variable named %2 to the digest the first engine-checksums.txt
+rem line for this version and asset %1 records, empty when there is none.
+set "%~2="
+if not exist "%manifest%" exit /b 0
+for /f "usebackq tokens=1-3" %%a in ("%manifest%") do if "%%a"=="%version%" if /I "%%b"=="%~1" if not defined %~2 set "%~2=%%c"
+exit /b 0
+
+:sha256
+rem Sets actual to the sha256 of %~1, empty when certutil fails. %~2 is the
+rem scratch file for its output. Check certutil's status before parsing: its
+rem error text on stdout is not a digest.
+set "actual="
+certutil -hashfile "%~1" SHA256 >"%~2" 2>nul
+if errorlevel 1 goto sha256_done
+for /f "usebackq skip=1 delims=" %%h in ("%~2") do if not defined actual set "actual=%%h"
+if not defined actual goto sha256_done
+set "actual=%actual: =%"
+:sha256_done
+del "%~2" >nul 2>nul
+exit /b 0
+
+:check_download
+set "download_file=%~1"
+if not defined download_file set "download_file=%part%"
+if not exist "%download_file%" goto download_missing
+for %%f in ("%download_file%") do if %%~zf==0 goto download_empty
+exit /b 0
+
+:download_missing
+call :discard_staging
+echo impeccable: download completed but the file was removed before execution: %url%; check your antivirus quarantine or logs. Refusing to continue; do not disable protection. 1>&2
+exit /b 127
+
+:download_empty
+del "%download_file%" >nul 2>nul
+call :discard_staging
+echo impeccable: downloaded file is empty: %url%; refusing the unverified download 1>&2
+exit /b 127
+
+:discard_staging
+rem Removes this run's staging directory and whatever is left in it. Never
+rem touches another run's staging directory or the cached binary.
+if defined staging rd /s /q "%staging%" >nul 2>nul
+exit /b 0
+
+:place
+call :check_download
+if errorlevel 1 exit /b 127
+move /y "%part%" "%cached%" >nul 2>nul
+if errorlevel 1 goto place_failed
+call :discard_staging
+call :check_download "%cached%"
+if errorlevel 1 exit /b 127
+(>"%cached%.verified" echo %actual%) 2>nul
+set "run=%cached%"
+goto run
+
+:place_failed
+call :check_download
+if errorlevel 1 exit /b 127
+call :discard_staging
+echo impeccable: could not cache the verified download: %url% 1>&2
+exit /b 127
+
+:run
+"%run%" %*
+exit /b %errorlevel%
+
+:probe
+rem Sets probe_ok=1 when %1 answers the engine handshake: prints
+rem "impeccable-engine <version>" and exits 0. The 3.x npm CLI answers any
+rem unknown verb with "Unknown command", exit 1, so it never passes.
+set "probe_ok="
+set "probe_tmp=%TEMP%\impeccable-probe-%RANDOM%%RANDOM%.txt"
+set "IMPECCABLE_LAUNCHER_PROBE=1"
+"%~1" engine-probe >"%probe_tmp%" 2>nul
+set "probe_err=%ERRORLEVEL%"
+set "IMPECCABLE_LAUNCHER_PROBE="
+if not "%probe_err%"=="0" goto probe_done
+findstr /b /c:"impeccable-engine" "%probe_tmp%" >nul 2>nul
+if not errorlevel 1 set "probe_ok=1"
+:probe_done
+del "%probe_tmp%" >nul 2>nul
+exit /b 0
+
+:no_checksum
+echo impeccable: no checksum for engine %version% (%asset%) in "%manifest%"; refusing the unverified download 1>&2
+exit /b 127
+
+:cache_directory_failed
+echo impeccable: engine %version% is not installed; cannot create cache directory: "%IMPECCABLE_HOME%\bin\%version%" 1>&2
+goto setup_failed
+
+:staging_write_failed
+call :discard_staging
+
+:cache_write_failed
+echo impeccable: engine %version% is not installed; cannot write to cache directory: "%IMPECCABLE_HOME%\bin\%version%" 1>&2
+goto setup_failed
+
+:curl_missing
+echo impeccable: cannot download engine %version%; curl.exe is unavailable. 1>&2
+goto setup_failed
+
+:download_failed
+call :discard_staging
+echo impeccable: could not download engine %version% from %url%; check network access and the release URL. 1>&2
+
+:setup_failed
+echo Engine %version% setup needs network access and write permission to "%IMPECCABLE_HOME%\bin\%version%". 1>&2
+echo Run this launcher ("%~f0") with engine-probe in a terminal that has those permissions, then retry the original command. 1>&2
+echo Alternatively, set IMPECCABLE_HOME to a writable cache location, or IMPECCABLE_BIN to a preinstalled engine binary. 1>&2
+exit /b 127
+
+:fail
+echo impeccable: no engine binary found (looked in %bin%, %cached%, PATH). 1>&2
+echo Download impeccable-windows-%arch%.exe from https://github.com/pbakaus/impeccable/releases (tag engine-v%version%) and save it as %cached%, or set IMPECCABLE_BIN to a preinstalled engine binary. Docs: https://impeccable.style 1>&2
+exit /b 127