@langgexyz/anycode 0.0.0-stage → 0.4.9

package/npm/dist/cli.mjs

@@ -0,0 +1,1353 @@
+#!/usr/bin/env node
+import { createRequire } from "node:module";
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
+
+// src/cli.ts
+import { createHash as createHash5 } from "node:crypto";
+import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname as dirname4, join as join4 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { spawnSync } from "node:child_process";
+
+// ../runtime/harness-context/src/entry-module.ts
+import { realpathSync } from "node:fs";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+function isEntryModule(moduleUrl, invokedFile, isRuntimeMain = false, runtimeExecutable) {
+  if (isRuntimeMain)
+    return true;
+  if (invokedFile === undefined)
+    return false;
+  if (runtimeExecutable !== undefined && resolve(invokedFile) === resolve(runtimeExecutable))
+    return true;
+  try {
+    return realpathSync(resolve(invokedFile)) === realpathSync(resolve(fileURLToPath(moduleUrl)));
+  } catch {
+    return false;
+  }
+}
+
+// ../runtime/archive/src/index.ts
+import { gunzipSync, gzipSync } from "node:zlib";
+import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
+import { dirname, join, posix, relative, resolve as resolve2 } from "node:path";
+function readTarGzip(archive) {
+  const bytes = gunzipSync(readFileSync(archive));
+  const entries = [];
+  let offset = 0;
+  let pendingPath = "";
+  let pendingPax = {};
+  while (offset + 512 <= bytes.length) {
+    const header = bytes.subarray(offset, offset + 512);
+    offset += 512;
+    if (header.every((value) => value === 0))
+      break;
+    verifyChecksum(header);
+    const typeFlag = text(header, 156, 1) || "0";
+    const size = octal(header, 124, 12);
+    const bodySize = Math.ceil(size / 512) * 512;
+    if (offset + bodySize > bytes.length)
+      throw new Error("archive entry exceeds archive size");
+    const body = bytes.subarray(offset, offset + size);
+    offset += bodySize;
+    if (typeFlag === "x" || typeFlag === "g") {
+      pendingPax = typeFlag === "x" ? parsePax(body) : pendingPax;
+      continue;
+    }
+    if (typeFlag === "L") {
+      pendingPath = body.toString("utf8").replace(/\0+$/u, "").replace(/\n+$/u, "");
+      continue;
+    }
+    const path = pendingPax["path"] || pendingPath || join(text(header, 345, 155), text(header, 0, 100));
+    pendingPath = "";
+    pendingPax = {};
+    if (!path)
+      throw new Error("archive entry path is empty");
+    const mode = pendingNumber(header, 100, 8, "mode");
+    const type = typeFlag === "0" || typeFlag === "" ? "file" : typeFlag === "5" ? "directory" : "unsupported";
+    entries.push({ path, type, mode, data: Buffer.from(body) });
+  }
+  return entries;
+}
+function extractTarGzip(archive, destination) {
+  const entries = readTarGzip(archive);
+  const seen = new Set;
+  for (const entry of entries) {
+    const path = safeArchivePath(destination, entry.path);
+    const normalized = normalizeArchivePath(entry.path);
+    if (seen.has(normalized))
+      throw new Error(`archive contains duplicate member: ${entry.path}`);
+    seen.add(normalized);
+    if (entry.type === "unsupported")
+      throw new Error("package contains unsupported archive member type");
+    if (entry.type === "directory") {
+      mkdirSync(path, { recursive: true });
+      continue;
+    }
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, entry.data, { mode: entry.mode || 420 });
+    chmodSync(path, entry.mode & 4095 || 420);
+  }
+  return entries;
+}
+function parsePax(body) {
+  const result = {};
+  let offset = 0;
+  while (offset < body.length) {
+    const space = body.indexOf(32, offset);
+    if (space < 0)
+      throw new Error("invalid archive PAX header");
+    const length = Number(body.subarray(offset, space).toString("ascii"));
+    if (!Number.isInteger(length) || length <= 0 || offset + length > body.length)
+      throw new Error("invalid archive PAX length");
+    const record = body.subarray(space + 1, offset + length - 1).toString("utf8");
+    const equal = record.indexOf("=");
+    if (equal <= 0)
+      throw new Error("invalid archive PAX record");
+    result[record.slice(0, equal)] = record.slice(equal + 1);
+    offset += length;
+  }
+  return result;
+}
+function safeArchivePath(root, value) {
+  const normalized = normalizeArchivePath(value);
+  const path = resolve2(root, normalized);
+  const relativePath = relative(resolve2(root), path);
+  if (!relativePath || relativePath === ".." || relativePath.startsWith(`..${"/"}`) || relativePath.startsWith("/"))
+    throw new Error(`package contains unsafe path: ${value}`);
+  return path;
+}
+function normalizeArchivePath(value) {
+  const normalized = posix.normalize(value.replaceAll("\\", "/")).replace(/^\.\//u, "");
+  if (!normalized || normalized === "." || normalized.startsWith("..") || normalized.includes("/../") || normalized.startsWith("/"))
+    throw new Error(`package contains unsafe path: ${value}`);
+  return normalized;
+}
+function verifyChecksum(header) {
+  const expected = octal(header, 148, 8);
+  const copy = Buffer.from(header);
+  copy.fill(32, 148, 156);
+  const actual = [...copy].reduce((sum, value) => sum + value, 0);
+  if (expected !== actual)
+    throw new Error("archive header checksum mismatch");
+}
+function text(buffer, offset, length) {
+  return buffer.subarray(offset, offset + length).toString("utf8").replace(/\0+$/u, "").trim();
+}
+function octal(buffer, offset, length) {
+  const value = text(buffer, offset, length).replace(/\0/g, "").trim();
+  return value ? Number.parseInt(value, 8) : 0;
+}
+function pendingNumber(buffer, offset, length, field) {
+  const value = octal(buffer, offset, length);
+  if (!Number.isSafeInteger(value) || value < 0)
+    throw new Error(`archive ${field} is invalid`);
+  return value;
+}
+
+// ../runtime/core/src/connector.ts
+class ConnectorRegistry {
+  connectors = new Map;
+  capabilityOwners = new Map;
+  capabilitySetups = new Map;
+  constructor(connectors = [], setups = []) {
+    for (const setup of setups)
+      this.registerSetup(setup);
+    for (const connector of connectors)
+      this.register(connector);
+  }
+  register(connector) {
+    validateConnector(connector);
+    if (this.connectors.has(connector.id))
+      throw new Error(`duplicate connector: ${connector.id}`);
+    for (const capability of connector.capabilities) {
+      const setup = connector.setup?.[capability];
+      if (setup !== undefined) {
+        validateSetup(setup);
+        if (setup.connectorId !== connector.id || setup.capability !== capability) {
+          throw new Error(`Connector setup identity does not match its owner: ${connector.id}/${capability}`);
+        }
+        if (this.capabilitySetups.has(setupKey(connector.id, capability)))
+          throw new Error(`capability setup already registered: ${capability}`);
+      }
+    }
+    this.connectors.set(connector.id, connector);
+    for (const capability of connector.capabilities) {
+      const owners = this.capabilityOwners.get(capability) ?? [];
+      owners.push(connector);
+      this.capabilityOwners.set(capability, owners);
+      const setup = connector.setup?.[capability];
+      if (setup !== undefined)
+        this.capabilitySetups.set(setupKey(connector.id, capability), setup);
+    }
+  }
+  registerSetup(setup) {
+    validateSetup(setup);
+    const key = setupKey(setup.connectorId, setup.capability);
+    if (this.capabilitySetups.has(key))
+      throw new Error(`capability setup already registered: ${setup.capability}`);
+    this.capabilitySetups.set(key, setup);
+  }
+  resolve(capabilityId, connectorId) {
+    const owners = this.capabilityOwners.get(capabilityId) ?? [];
+    if (connectorId !== undefined)
+      return owners.find((connector) => connector.id === connectorId);
+    return owners.length === 1 ? owners[0] : undefined;
+  }
+  all() {
+    return [...this.connectors.values()];
+  }
+  declaredCapabilities() {
+    return [...new Set([...this.capabilityOwners.keys(), ...[...this.capabilitySetups.values()].map((setup) => setup.capability)])];
+  }
+  async execute(request, connectorId) {
+    validateCapabilityRequest(request);
+    const owners = this.capabilityOwners.get(request.capabilityId) ?? [];
+    if (connectorId !== undefined && !owners.some((connector2) => connector2.id === connectorId)) {
+      return unavailable(request, this.capabilitySetups.get(setupKey(connectorId, request.capabilityId)));
+    }
+    if (connectorId === undefined && owners.length > 1) {
+      return failed(request, `multiple Connectors implement ${request.capabilityId}; select one in the project binding`, "connector_binding_required");
+    }
+    const connector = connectorId === undefined ? owners[0] : this.resolve(request.capabilityId, connectorId);
+    if (!connector) {
+      const setups = [...this.capabilitySetups.values()].filter((setup) => setup.capability === request.capabilityId);
+      return unavailable(request, connectorId === undefined && setups.length === 1 ? setups[0] : undefined);
+    }
+    try {
+      const result = await connector.execute(request);
+      validateCapabilityResult(result);
+      if (result.capability !== request.capabilityId || result.runId !== request.runId)
+        return failed(request, "connector result identity does not match capability request", "connector_identity_mismatch");
+      return result;
+    } catch (error) {
+      return failed(request, error instanceof Error ? error.message : String(error), "connector_execution_failed");
+    }
+  }
+}
+function setupKey(connectorId, capability) {
+  return `${connectorId}\x00${capability}`;
+}
+function validateSetup(setup) {
+  if (!setup.connectorId.trim() || !setup.capability.trim())
+    throw new Error("Connector setup requires connectorId and capability");
+}
+function validateConnector(connector) {
+  if (!connector.id.trim())
+    throw new Error("connector id must not be empty");
+  if (connector.capabilities.length === 0)
+    throw new Error(`connector requires capabilities: ${connector.id}`);
+  const unique = new Set;
+  for (const capability of connector.capabilities) {
+    if (!/^[a-z0-9][a-z0-9-]*\.[a-z0-9][a-z0-9-]*$/u.test(capability))
+      throw new Error(`connector capability must use domain.name form: ${capability}`);
+    if (unique.has(capability))
+      throw new Error(`connector declares duplicate capability: ${capability}`);
+    unique.add(capability);
+  }
+}
+function unavailable(request, setup) {
+  return {
+    capability: request.capabilityId,
+    runId: request.runId,
+    status: "blocked",
+    inputs: request.inputs,
+    outputs: {},
+    evidence: [],
+    reason: `connector unavailable for capability: ${request.capabilityId}`,
+    certainty: "confirmed",
+    sideEffect: "none",
+    errorCode: "connector_unavailable",
+    declaration: "real",
+    recovery: {
+      action: "configure_connector",
+      capability: request.capabilityId,
+      target: request.trace.target,
+      idempotencyKey: request.idempotencyKey,
+      ...setup === undefined ? {} : { setup }
+    }
+  };
+}
+function failed(request, reason, errorCode) {
+  return {
+    capability: request.capabilityId,
+    runId: request.runId,
+    status: "failed",
+    inputs: request.inputs,
+    outputs: {},
+    evidence: [],
+    reason,
+    certainty: "unknown",
+    sideEffect: "possible",
+    errorCode,
+    declaration: "real",
+    recovery: {
+      action: "probe_connector",
+      capability: request.capabilityId,
+      target: request.trace.target,
+      idempotencyKey: request.idempotencyKey
+    }
+  };
+}
+// ../runtime/core/src/protection.ts
+var LOCAL_CAPABILITY_DOMAINS = new Set(["change", "project", "verification", "git"]);
+var TARGETS = new Set(["workstation", "test", "beta", "prod", "external"]);
+// ../runtime/core/src/index.ts
+class CapabilityRegistry {
+  specs = new Map;
+  constructor(specs = []) {
+    for (const spec of specs)
+      this.register(spec);
+  }
+  register(spec) {
+    if (this.specs.has(spec.capabilityId))
+      throw new Error(`duplicate capability: ${spec.capabilityId}`);
+    this.specs.set(spec.capabilityId, spec);
+  }
+  resolve(capabilityId) {
+    const spec = this.specs.get(capabilityId);
+    if (!spec)
+      throw new Error(`capability is not registered: ${capabilityId}`);
+    return spec;
+  }
+  all() {
+    return [...this.specs.values()];
+  }
+}
+function validateCapabilityResult(result) {
+  if (!result.capability.trim() || !result.runId.trim())
+    throw new Error("capability and runId must not be empty");
+  if (result.declaration !== "real" && result.declaration !== "probe")
+    throw new Error("declaration must be real or probe");
+  if (result.status === "pass" && result.evidence.length === 0)
+    throw new Error("pass result must include evidence");
+  if (result.status !== "pass" && !result.reason.trim())
+    throw new Error(`${result.status} result must include reason`);
+  if (result.recovery?.retryAfterMs !== undefined && (!Number.isFinite(result.recovery.retryAfterMs) || result.recovery.retryAfterMs < 0))
+    throw new Error("recovery retryAfterMs must be a non-negative finite number");
+}
+function validateCapabilityRequest(request) {
+  if (!request.capabilityId.trim() || !request.runId.trim())
+    throw new Error("capabilityId and runId must not be empty");
+  if (!request.trace.traceId.trim() || !request.trace.requestId.trim() || !request.trace.sessionId.trim()) {
+    throw new Error("trace requires traceId, requestId and sessionId");
+  }
+  if (request.timeoutMs !== undefined && (!Number.isInteger(request.timeoutMs) || request.timeoutMs <= 0)) {
+    throw new Error("timeoutMs must be a positive integer");
+  }
+}
+
+// ../runtime/providers/src/installation/package-build.ts
+var LAUNCHER = `#!/bin/sh
+` + `script="$0"
+` + `while [ -L "$script" ]; do
+` + `  target="$(readlink "$script")"
+` + `  case "$target" in
+` + `    /*) script="$target" ;;
+` + `    *) script="$(dirname "$script")/$target" ;;
+` + `  esac
+` + `done
+` + `root="$(CDPATH= cd -- "$(dirname -- "$script")/.." && pwd)"
+` + `if [ "$1" = "claude-hook" ]; then
+` + '  exec "${ANYCODE_NODE:-node}" "$root/runtime/claude/dist/cli.mjs" "$@"\n' + `fi
+` + 'exec "${ANYCODE_NODE:-node}" "$root/runtime/providers/dist/cli.mjs" "$@"\n';
+var WINDOWS_LAUNCHER = `@echo off\r
+` + `set "script=%~dp0"\r
+` + `set "root=%script%.."\r
+` + `if "%ANYCODE_NODE%"=="" set "ANYCODE_NODE=node"\r
+` + `if "%~1"=="claude-hook" (\r
+` + `  "%ANYCODE_NODE%" "%root%\\runtime\\claude\\dist\\cli.mjs" %*\r
+` + `  exit /b %ERRORLEVEL%\r
+` + `)\r
+` + `"%ANYCODE_NODE%" "%root%\\runtime\\providers\\dist\\cli.mjs" %*\r
+`;
+// ../runtime/providers/src/installation/package-installed.ts
+import { createHash } from "node:crypto";
+import { existsSync as existsSync2, lstatSync as lstatSync2, readFileSync as readFileSync2, readdirSync as readdirSync2, readlinkSync } from "node:fs";
+import { join as join2, posix as posix2, relative as relative2, sep } from "node:path";
+var PACKAGE_SCHEMA = "anycode.package.v1";
+var FULL_REVISION = /^[0-9a-f]{40}$/u;
+function validateExistingInstall(root) {
+  let stat;
+  try {
+    stat = lstatSync2(root);
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return;
+    throw error;
+  }
+  if (!stat.isDirectory() || stat.isSymbolicLink())
+    throw new Error(`AnyCode install path must be a directory: ${root}`);
+  const names = readdirSync2(root);
+  if (!names.length)
+    return;
+  if (isLegacyVersionedInstall(root, names))
+    return;
+  const manifestPath = join2(root, "package-manifest.json");
+  if (!names.includes("package-manifest.json"))
+    throw new Error(`AnyCode install directory contains unrecognized files: ${root}`);
+  try {
+    JSON.parse(readFileSync2(manifestPath, "utf8"));
+  } catch {
+    throw new Error(`\u65e7\u7248\u6241\u5e73\u5b89\u88c5\u6e05\u5355\u89e3\u6790\u5931\u8d25\uff1a${manifestPath}`);
+  }
+  verifyInstalledPackage(root);
+}
+function isLegacyVersionedInstall(root, names) {
+  if (!names.includes("current") || names.some((name) => name !== "current" && !/^v\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u.test(name)))
+    return false;
+  try {
+    const currentPath = join2(root, "current");
+    if (!lstatSync2(currentPath).isSymbolicLink())
+      return false;
+    const target = readlinkSync(currentPath);
+    if (target.includes("\\") || target.startsWith("/") || target.includes("..") || !names.includes(target))
+      return false;
+    for (const name of names) {
+      if (name === "current")
+        continue;
+      const versionRoot = join2(root, name);
+      if (!lstatSync2(versionRoot).isDirectory())
+        return false;
+      const manifest = verifyInstalledPackage(versionRoot);
+      if (name !== `v${manifest.version}`)
+        return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+function verifyInstalledPackage(root) {
+  if (!existsSync2(root) || !lstatSync2(root).isDirectory())
+    throw new Error(`installed package does not exist: ${root}`);
+  const manifestPath = join2(root, "package-manifest.json");
+  if (!existsSync2(manifestPath) || !lstatSync2(manifestPath).isFile())
+    throw new Error(`installed package is missing manifest: ${manifestPath}`);
+  const value = JSON.parse(readFileSync2(manifestPath, "utf8"));
+  if (!isRecord(value))
+    throw new Error("installed package manifest is invalid");
+  if (value["schema"] !== PACKAGE_SCHEMA || value["name"] !== "anycode")
+    throw new Error("installed package manifest identity is invalid");
+  if (typeof value["version"] !== "string" || !value["version"])
+    throw new Error("installed package version is invalid");
+  if (typeof value["source_revision"] !== "string" || !FULL_REVISION.test(value["source_revision"]))
+    throw new Error("installed package source_revision is invalid");
+  if (!isRecord(value["files"]) || Object.keys(value["files"]).length === 0)
+    throw new Error("installed package files are invalid");
+  if (!Object.hasOwn(value["files"], "bin/anycode") && !Object.hasOwn(value["files"], "bin/anycode.exe"))
+    throw new Error("installed package is missing launcher: bin/anycode");
+  const files = {};
+  for (const [name, digest] of Object.entries(value["files"])) {
+    const relative3 = normalizeMember(name);
+    if (typeof digest !== "string" || !/^sha256:[0-9a-f]{64}$/u.test(digest))
+      throw new Error(`installed package file digest is invalid: ${name}`);
+    files[relative3] = digest;
+    const path = join2(root, ...relative3.split("/"));
+    if (!existsSync2(path) || !lstatSync2(path).isFile() || lstatSync2(path).isSymbolicLink())
+      throw new Error(`installed package verification failed: ${relative3}`);
+    if (fileDigest(path) !== digest)
+      throw new Error(`installed package verification failed: ${relative3}`);
+  }
+  if (typeof value["payload_digest"] !== "string" || value["payload_digest"] !== payloadDigest(files))
+    throw new Error("installed package payload digest is invalid");
+  const extras = installedFiles(root).filter((name) => !(name in files) && name !== "package-manifest.json");
+  if (extras.length > 0)
+    throw new Error(`installed package contains untracked files: ${extras.slice(0, 10).join(", ")}`);
+  return { schema: value["schema"], name: value["name"], version: value["version"], source_revision: value["source_revision"], files, payload_digest: value["payload_digest"] };
+}
+function installedFiles(root) {
+  const result = [];
+  const walk = (path) => {
+    for (const name of readdirSync2(path).sort()) {
+      const child = join2(path, name);
+      if (lstatSync2(child).isSymbolicLink())
+        throw new Error(`installed package contains unsupported symlink: ${child}`);
+      if (lstatSync2(child).isFile())
+        result.push(relative2(root, child).split(sep).join("/"));
+      else if (lstatSync2(child).isDirectory())
+        walk(child);
+    }
+  };
+  walk(root);
+  return result;
+}
+function normalizeMember(value) {
+  const normalized = posix2.normalize(value.replace(/^\.\//u, ""));
+  if (!value || value.includes("\\") || normalized === "." || normalized === ".." || normalized.startsWith("../") || value.startsWith("/"))
+    throw new Error(`installed package contains unsafe path: ${value}`);
+  return normalized;
+}
+function payloadDigest(files) {
+  const ordered = Object.fromEntries(Object.entries(files).sort(([left], [right]) => left.localeCompare(right)));
+  return digestText(JSON.stringify(ordered));
+}
+function fileDigest(path) {
+  return digestBytes(readFileSync2(path));
+}
+function digestText(value) {
+  return digestBytes(new TextEncoder().encode(value));
+}
+function digestBytes(value) {
+  return `sha256:${createHash("sha256").update(value).digest("hex")}`;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// ../runtime/providers/src/installation/activation.ts
+import { copyFileSync, existsSync as existsSync3, lstatSync as lstatSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync4, readlinkSync as readlinkSync2, renameSync as renameSync2, rmSync, statSync as statSync2, symlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname3, join as join3, relative as relative3, resolve as resolve3 } from "node:path";
+// ../runtime/providers/src/infrastructure/command-runner.ts
+var SAFE_ENVIRONMENT_KEYS = new Set([
+  "PATH",
+  "HOME",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "TZ",
+  "TMPDIR",
+  "HTTP_PROXY",
+  "HTTPS_PROXY",
+  "ALL_PROXY",
+  "NO_PROXY",
+  "http_proxy",
+  "https_proxy",
+  "all_proxy",
+  "no_proxy"
+]);
+var PROXY_KEYS = new Set(["HTTP_PROXY", "HTTPS_PROXY", "ALL_PROXY", "http_proxy", "https_proxy", "all_proxy"]);
+// ../runtime/credentials/src/memory.ts
+import { createHash as createHash2 } from "node:crypto";
+
+// ../runtime/credentials/src/validation.ts
+function validateCredentialRef(ref) {
+  for (const [name, value] of Object.entries(ref)) {
+    if (!value.trim())
+      throw new Error(`credential ${name} must not be empty`);
+    if (!/^[A-Za-z0-9._:/-]+$/u.test(value))
+      throw new Error(`credential ${name} contains unsupported characters`);
+  }
+}
+function credentialKey(ref) {
+  validateCredentialRef(ref);
+  return JSON.stringify([ref.scope, ref.field]);
+}
+
+// ../runtime/credentials/src/secret-lease.ts
+var leaseStates = new WeakMap;
+function createSecretLease(ref, secret) {
+  const secretForms = [
+    secret,
+    encodeURIComponent(secret),
+    Buffer.from(secret, "utf8").toString("base64"),
+    Buffer.from(secret, "utf8").toString("base64url"),
+    Buffer.from(secret, "utf8").toString("hex")
+  ].filter((form) => form.length > 0);
+  const state = { active: true, secret };
+  const lease = Object.freeze({
+    ref: Object.freeze({ ...ref }),
+    use(consumer) {
+      if (!state.active)
+        throw new Error("credential lease is no longer active");
+      let result;
+      try {
+        result = consumer(state.secret);
+      } catch (error) {
+        throw sanitizedError(error, secretForms);
+      }
+      return guardResult(result, secretForms);
+    }
+  });
+  leaseStates.set(lease, state);
+  return lease;
+}
+function guardResult(result, secretForms) {
+  let promiseLike;
+  try {
+    promiseLike = isPromiseLike(result);
+  } catch (error) {
+    throw sanitizedError(error, secretForms);
+  }
+  if (promiseLike) {
+    return Promise.resolve(result).then((value) => guardValue(value, secretForms), (error) => {
+      throw sanitizedError(error, secretForms);
+    });
+  }
+  return guardValue(result, secretForms);
+}
+function guardValue(value, secretForms) {
+  if (containsSecret(value, secretForms, new WeakSet)) {
+    throw new Error("Connector result must not contain a credential value");
+  }
+  return value;
+}
+function containsSecret(value, secretForms, visited) {
+  if (typeof value === "string")
+    return secretForms.some((form) => value.includes(form));
+  if (typeof value === "function")
+    return true;
+  if (value === null || typeof value !== "object")
+    return false;
+  if (visited.has(value))
+    return false;
+  visited.add(value);
+  if (value instanceof Uint8Array)
+    return secretForms.some((form) => includesBytes(value, new TextEncoder().encode(form)));
+  if (value instanceof Map)
+    return [...value].some(([key, entry]) => containsSecret(key, secretForms, visited) || containsSecret(entry, secretForms, visited));
+  if (value instanceof Set)
+    return [...value].some((entry) => containsSecret(entry, secretForms, visited));
+  try {
+    const prototype = Object.getPrototypeOf(value);
+    if (!Array.isArray(value) && prototype !== Object.prototype && prototype !== null)
+      return true;
+    if (Reflect.ownKeys(value).some((key) => typeof key === "string" ? secretForms.some((form) => key.includes(form)) : secretForms.some((form) => String(key).includes(form))))
+      return true;
+    for (const descriptor of Object.values(Object.getOwnPropertyDescriptors(value))) {
+      if (!("value" in descriptor))
+        return true;
+      if (containsSecret(descriptor.value, secretForms, visited))
+        return true;
+    }
+  } catch {
+    return true;
+  }
+  return false;
+}
+function includesBytes(bytes, needle) {
+  if (needle.length === 0)
+    return false;
+  outer:
+    for (let start = 0;start <= bytes.length - needle.length; start += 1) {
+      for (let offset = 0;offset < needle.length; offset += 1) {
+        if (bytes[start + offset] !== needle[offset])
+          continue outer;
+      }
+      return true;
+    }
+  return false;
+}
+function sanitizedError(error, secretForms) {
+  let message;
+  try {
+    message = error instanceof Error ? error.message : String(error);
+  } catch {
+    message = "Connector operation failed";
+  }
+  const sanitized = secretForms.some((form) => message.includes(form)) ? "Connector operation failed; error details contained a credential value" : message;
+  const result = new Error(sanitized);
+  if (error instanceof Error)
+    result.name = error.name;
+  return result;
+}
+function isPromiseLike(value) {
+  return (typeof value === "object" || typeof value === "function") && value !== null && "then" in value && typeof value.then === "function";
+}
+
+// ../runtime/credentials/src/memory.ts
+class MemoryCredentialStorage {
+  id = "memory";
+  strategyId = this.id;
+  entries = new Map;
+  inspect(ref) {
+    validateCredentialRef(ref);
+    const entry = this.entries.get(credentialKey(ref));
+    return entry ? metadata(entry) : { ref, present: false };
+  }
+  list() {
+    return [...this.entries.values()].map(metadata);
+  }
+  write(ref, input) {
+    validateCredentialRef(ref);
+    if (!input.value)
+      throw new Error("credential value must not be empty");
+    const entry = { ref, value: input.value, updatedAt: new Date().toISOString() };
+    this.entries.set(credentialKey(ref), entry);
+    return metadata(entry);
+  }
+  fingerprint(ref) {
+    const entry = this.require(ref);
+    return { ...metadata(entry), fingerprint: fingerprint(entry.value) };
+  }
+  remove(ref) {
+    validateCredentialRef(ref);
+    return this.entries.delete(credentialKey(ref));
+  }
+  useSecret(ref, consumer) {
+    const entry = this.require(ref);
+    return createSecretLease(entry.ref, entry.value).use(consumer);
+  }
+  require(ref) {
+    validateCredentialRef(ref);
+    const entry = this.entries.get(credentialKey(ref));
+    if (!entry)
+      throw new Error(`credential is unavailable: ${credentialKey(ref)}`);
+    return entry;
+  }
+}
+function metadata(entry) {
+  return { ref: entry.ref, present: true, updatedAt: entry.updatedAt };
+}
+function fingerprint(value) {
+  return `sha256:${createHash2("sha256").update(value).digest("hex")}`;
+}
+// ../runtime/credentials/src/encrypted-file.ts
+import { createCipheriv, createDecipheriv, createHash as createHash3, randomBytes } from "node:crypto";
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, renameSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname2 } from "node:path";
+class EncryptedFileCredentialStorage {
+  filePath;
+  keyProvider;
+  id = "encrypted-file";
+  strategyId = this.id;
+  constructor(filePath, keyProvider) {
+    this.filePath = filePath;
+    this.keyProvider = keyProvider;
+  }
+  inspect(ref) {
+    const entry = this.entries().get(credentialKey(ref));
+    return entry ? metadata2(entry) : { ref, present: false };
+  }
+  list() {
+    return [...this.entries().values()].map(metadata2);
+  }
+  write(ref, input) {
+    validateCredentialRef(ref);
+    if (!input.value)
+      throw new Error("credential value must not be empty");
+    const entries = this.entries();
+    const entry = { ref, value: input.value, updatedAt: new Date().toISOString() };
+    entries.set(credentialKey(ref), entry);
+    this.save(entries);
+    return metadata2(entry);
+  }
+  fingerprint(ref) {
+    const entry = this.require(ref);
+    return { ...metadata2(entry), fingerprint: fingerprint2(entry.value) };
+  }
+  remove(ref) {
+    const entries = this.entries();
+    const removed = entries.delete(credentialKey(ref));
+    if (removed)
+      this.save(entries);
+    return removed;
+  }
+  useSecret(ref, consumer) {
+    const entry = this.require(ref);
+    return createSecretLease(entry.ref, entry.value).use(consumer);
+  }
+  require(ref) {
+    const entry = this.entries().get(credentialKey(ref));
+    if (!entry)
+      throw new Error(`credential is unavailable: ${credentialKey(ref)}`);
+    return entry;
+  }
+  entries() {
+    try {
+      const envelope = JSON.parse(readFileSync3(this.filePath, "utf8"));
+      return decode(envelope, this.keyProvider.key());
+    } catch (error) {
+      if (isMissingFile(error))
+        return new Map;
+      throw new Error(`credential store cannot be opened: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  save(entries) {
+    const directory = dirname2(this.filePath);
+    mkdirSync2(directory, { recursive: true, mode: 448 });
+    const temporary = `${this.filePath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+    writeFileSync2(temporary, JSON.stringify(encode(entries, this.keyProvider.key())) + `
+`, { mode: 384 });
+    chmodSync2(temporary, 384);
+    renameSync(temporary, this.filePath);
+    chmodSync2(this.filePath, 384);
+  }
+}
+function encode(entries, key) {
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const plaintext = JSON.stringify([...entries.values()]);
+  const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  return { version: 1, iv: iv.toString("base64url"), tag: cipher.getAuthTag().toString("base64url"), ciphertext: ciphertext.toString("base64url") };
+}
+function decode(envelope, key) {
+  if (envelope.version !== 1)
+    throw new Error("unsupported credential store version");
+  const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(envelope.iv, "base64url"));
+  decipher.setAuthTag(Buffer.from(envelope.tag, "base64url"));
+  const plaintext = Buffer.concat([decipher.update(Buffer.from(envelope.ciphertext, "base64url")), decipher.final()]).toString("utf8");
+  const values = JSON.parse(plaintext);
+  const entries = new Map;
+  for (const entry of values) {
+    validateCredentialRef(entry.ref);
+    entries.set(credentialKey(entry.ref), entry);
+  }
+  return entries;
+}
+function metadata2(entry) {
+  return { ref: entry.ref, present: true, updatedAt: entry.updatedAt };
+}
+function fingerprint2(value) {
+  return `sha256:${createHash3("sha256").update(value).digest("hex")}`;
+}
+function isMissingFile(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+// ../runtime/credentials/src/registry.ts
+class CredentialStorageRegistry {
+  strategies = new Map;
+  constructor(strategies = []) {
+    for (const strategy of strategies)
+      this.register(strategy);
+  }
+  register(strategy) {
+    if (this.strategies.has(strategy.id))
+      throw new Error(`duplicate credential storage strategy: ${strategy.id}`);
+    this.strategies.set(strategy.id, strategy);
+  }
+  resolve(policy) {
+    const id = policy.kind === "external" ? policy.provider : policy.kind;
+    if (!id)
+      throw new Error("external credential storage requires a provider");
+    const strategy = this.strategies.get(id);
+    if (!strategy)
+      throw new Error(`credential storage strategy is unavailable: ${id}`);
+    return strategy;
+  }
+}
+// ../runtime/providers/src/infrastructure/authenticated-transport.ts
+var MAX_REQUEST_BYTES = 1024 * 1024;
+var MAX_RESPONSE_BYTES = 4 * 1024 * 1024;
+var REQUEST_HEADERS = new Set(["accept", "content-type", "user-agent"]);
+// ../runtime/providers/src/infrastructure/sensitive-key.ts
+var SECRET_NOUNS = ["authorization", "credentials", "credential", "password", "passwd", "secret", "token"];
+var KEY_QUALIFIERS = ["access", "api", "private", "secret"];
+var nounPattern = SECRET_NOUNS.join("|");
+var qualifierPattern = `(?:${KEY_QUALIFIERS.join("|")})[_-]?key`;
+var SENSITIVE_KEY_PATTERN = `[\\p{L}\\p{N}_-]*(?:${nounPattern}|${qualifierPattern})(?![\\p{L}\\p{N}_])`;
+
+// ../runtime/providers/src/infrastructure/redaction-rules.ts
+var REDACTION_RULES = [
+  {
+    id: "private-key",
+    pattern: /-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?-----END [^-]*PRIVATE KEY-----/gu,
+    replacement: "[REDACTED:private-key]"
+  },
+  {
+    id: "bearer",
+    pattern: /\bBearer\s+(?!\[REDACTED:)[^\s,;}\]]+/giu,
+    replacement: "Bearer [REDACTED:bearer]"
+  },
+  {
+    id: "authorization",
+    pattern: /(?<authorizationQuote>["']?)(?<authorizationKey>authorization)\k<authorizationQuote>(?<authorizationSeparator>\s*[:=]\s*)(?!\s*\[REDACTED:)(?:(?<authorizationValueQuote>["'])(?:[\s\S]*?)\k<authorizationValueQuote>|[^\r\n"']+)/giu,
+    replacement: "$<authorizationQuote>$<authorizationKey>$<authorizationQuote>$<authorizationSeparator>$<authorizationValueQuote>[REDACTED:authorization]$<authorizationValueQuote>"
+  },
+  {
+    id: "assignment",
+    pattern: new RegExp(`(?<assignmentQuote>["']?)(?<assignmentKey>${SENSITIVE_KEY_PATTERN})\\k<assignmentQuote>(?<assignmentSeparator>\\s*[:=]\\s*)(?!\\s*\\[REDACTED:)(?:(?<assignmentValueQuote>["'])(?:[\\s\\S]*?)\\k<assignmentValueQuote>|[^\\s,;}\\]"']+)`, "giu"),
+    replacement: "$<assignmentQuote>$<assignmentKey>$<assignmentQuote>$<assignmentSeparator>$<assignmentValueQuote>[REDACTED:assignment]$<assignmentValueQuote>"
+  },
+  {
+    id: "url-userinfo",
+    pattern: /(?<urlScheme>\b[a-z][a-z0-9+.-]*:\/\/[^\s:@\/?#]*:)(?!\[REDACTED:)[^\s@\/?#]+(?=@)/giu,
+    replacement: "$<urlScheme>[REDACTED:url-password]"
+  }
+];
+
+// ../runtime/providers/src/infrastructure/redaction.ts
+var COMBINED_RULES = new RegExp(REDACTION_RULES.map((rule, index) => `(?<r${index}>${rule.pattern.source})`).join("|"), "giu");
+// ../runtime/providers/src/infrastructure/transaction.ts
+function rethrowAfterUndo(original, steps) {
+  const failures = [];
+  for (const undo of steps)
+    try {
+      undo();
+    } catch (error) {
+      failures.push(error);
+    }
+  if (failures.length === 0)
+    throw original;
+  throw new AggregateError([original, ...failures], `${original instanceof Error ? original.message : String(original)}; rollback had ${failures.length} failure(s)`, { cause: original });
+}
+// ../runtime/providers/src/installation/activation.ts
+function activatePackage(stagedPackage, installRoot, launcherPath, options = {}) {
+  const platform = options.platform ?? process.platform;
+  const executable = options.executable ?? (platform === "win32" ? "anycode.exe" : "anycode");
+  mkdirSync3(dirname3(installRoot), { recursive: true });
+  const releaseLock = acquireActivationLock(installRoot, platform);
+  const previous = `${installRoot}.previous`;
+  let movedCurrent = false;
+  let installedNew = false;
+  try {
+    reconcileActivation(installRoot, previous, launcherPath, executable, platform);
+    const manifest = verifyInstalledPackage(stagedPackage);
+    validateExistingInstall(installRoot);
+    validateLauncherOwnership(launcherPath, installRoot, stagedPackage, executable, platform);
+    if (existsSync3(installRoot)) {
+      rmSync(previous, { recursive: true, force: true });
+      renameSync2(installRoot, previous);
+      movedCurrent = true;
+    }
+    renameSync2(stagedPackage, installRoot);
+    installedNew = true;
+    const installed = verifyInstalledPackage(installRoot);
+    if (installed.version !== manifest.version || installed.payload_digest !== manifest.payload_digest)
+      throw new Error("\u5b89\u88c5\u540e\u7684 AnyCode \u5305\u6821\u9a8c\u5931\u8d25");
+    linkLauncher(join3(installRoot, "bin", executable), launcherPath, platform);
+    try {
+      removeActivationPath(previous);
+    } catch {}
+    return installRoot;
+  } catch (error) {
+    rethrowAfterUndo(error, [
+      () => {
+        if (installedNew && existsSync3(installRoot))
+          rmSync(installRoot, { recursive: true, force: true });
+      },
+      () => {
+        if (movedCurrent && existsSync3(previous) && !existsSync3(installRoot))
+          renameSync2(previous, installRoot);
+      }
+    ]);
+  } finally {
+    releaseLock();
+  }
+}
+function acquireActivationLock(installRoot, platform) {
+  const lock = `${installRoot}.activation-lock`;
+  const deadline = Date.now() + 30000;
+  const token = `${process.pid}:${Date.now()}:${Math.random().toString(16).slice(2)}`;
+  while (true) {
+    try {
+      if (platform === "win32") {
+        mkdirSync3(lock);
+        try {
+          writeFileSync3(join3(lock, "owner"), token, { flag: "wx", mode: 384 });
+        } catch (error) {
+          rethrowAfterUndo(error, [() => rmSync(lock, { recursive: true, force: true })]);
+        }
+      } else {
+        symlinkSync(token, lock);
+      }
+      return () => {
+        for (let attempt = 0;attempt < 2; attempt += 1) {
+          try {
+            const owner = platform === "win32" ? readFileSync4(join3(lock, "owner"), "utf8") : readlinkSync2(lock);
+            if (owner === token)
+              rmSync(lock, { recursive: true, force: true });
+            return;
+          } catch {}
+        }
+      };
+    } catch (error) {
+      if (error.code !== "EEXIST")
+        throw error;
+      let stale = false;
+      try {
+        const metadata3 = lstatSync3(lock);
+        const owner = metadata3.isSymbolicLink() ? readlinkSync2(lock) : readFileSync4(join3(lock, "owner"), "utf8");
+        const pid = Number(owner.split(":", 1)[0]);
+        if (Number.isSafeInteger(pid) && pid > 0) {
+          try {
+            process.kill(pid, 0);
+          } catch (probeError) {
+            stale = probeError.code === "ESRCH";
+          }
+        }
+      } catch {
+        try {
+          stale = Date.now() - statSync2(lock).mtimeMs > 30000;
+        } catch {
+          stale = true;
+        }
+      }
+      if (stale) {
+        rmSync(lock, { recursive: true, force: true });
+        continue;
+      }
+      if (Date.now() >= deadline)
+        throw new Error(`timed out waiting for AnyCode activation lock: ${lock}`);
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 50);
+    }
+  }
+}
+function removeActivationPath(path) {
+  try {
+    rmSync(path, { recursive: true, force: true });
+  } catch (first) {
+    try {
+      rmSync(path, { recursive: true, force: true });
+    } catch (second) {
+      throw new AggregateError([first, second], `could not remove activation recovery path: ${path}`, { cause: first });
+    }
+  }
+}
+function reconcileActivation(installRoot, previous, launcherPath, executable, platform) {
+  if (!existsSync3(installRoot)) {
+    if (!existsSync3(previous))
+      return;
+    validateExistingInstall(previous);
+    renameSync2(previous, installRoot);
+    return;
+  }
+  if (!existsSync3(previous))
+    return;
+  try {
+    verifyInstalledPackage(installRoot);
+  } catch {
+    return;
+  }
+  validateLauncherOwnership(launcherPath, installRoot, installRoot, executable, platform);
+  linkLauncher(join3(installRoot, "bin", executable), launcherPath, platform);
+  try {
+    rmSync(previous, { recursive: true, force: true });
+  } catch {}
+}
+function validateLauncherOwnership(launcher, root, staged, executable, platform) {
+  let existing;
+  try {
+    existing = lstatSync3(launcher);
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return;
+    throw error;
+  }
+  if (existing.isSymbolicLink()) {
+    const target = resolve3(dirname3(launcher), readlinkSync2(launcher));
+    const path = relative3(resolve3(root), target).replaceAll("\\", "/");
+    if (path === `bin/${executable}` || !path.startsWith("../") && path !== ".." && path.endsWith(`/bin/${executable}`))
+      return;
+  } else if (platform === "win32" && existing.isFile()) {
+    const bytes = readFileSync4(launcher);
+    for (const candidate of [join3(staged, "bin", executable), join3(root, "bin", executable)]) {
+      if (existsSync3(candidate) && bytes.equals(readFileSync4(candidate)))
+        return;
+    }
+  }
+  throw new Error(`refusing to replace an unmanaged anycode launcher: ${launcher}`);
+}
+function linkLauncher(source, launcherPath, platform) {
+  mkdirSync3(dirname3(launcherPath), { recursive: true });
+  const next = `${launcherPath}.next`;
+  rmSync(next, { force: true });
+  if (platform === "win32")
+    copyFileSync(source, next);
+  else
+    symlinkSync(source, next);
+  try {
+    renameSync2(next, launcherPath);
+  } catch (error) {
+    try {
+      rmSync(next, { force: true });
+    } catch {}
+    throw error;
+  }
+}
+// ../runtime/providers/src/installation/release-trust.ts
+import { verify } from "node:crypto";
+import { basename } from "node:path";
+
+// ../runtime/providers/src/installation/release-key.generated.ts
+var RELEASE_PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEA/hfqP5bUwAMqzY3QS+j9GIGjbYpyrtcheixQGJt93zo=
+-----END PUBLIC KEY-----
+`;
+
+// ../runtime/providers/src/installation/release-trust.ts
+function verifyReleaseChecksums(sums, encodedSignature, publicKey = RELEASE_PUBLIC_KEY_PEM) {
+  const encoded = encodedSignature.trim();
+  const signature = Buffer.from(encoded, "base64");
+  if (signature.toString("base64") !== encoded || signature.byteLength !== 64)
+    throw new Error("AnyCode SHA256SUMS \u7b7e\u540d\u683c\u5f0f\u65e0\u6548");
+  if (!verify(null, sums, publicKey, signature))
+    throw new Error("AnyCode SHA256SUMS Ed25519 \u7b7e\u540d\u9a8c\u8bc1\u5931\u8d25");
+  return parseReleaseChecksums(Buffer.from(sums).toString("utf8"));
+}
+function parseReleaseChecksums(value) {
+  const result = new Map;
+  for (const line of value.split(/\r?\n/u)) {
+    if (!line.trim())
+      continue;
+    const match = /^([a-f0-9]{64})\s+[* ]?([^\s]+)$/u.exec(line.trim());
+    if (!match || basename(match[2]) !== match[2] || result.has(match[2]))
+      throw new Error("\u5df2\u7b7e\u540d SHA256SUMS \u683c\u5f0f\u65e0\u6548");
+    result.set(match[2], match[1]);
+  }
+  if (!result.size)
+    throw new Error("\u5df2\u7b7e\u540d SHA256SUMS \u4e0d\u80fd\u4e3a\u7a7a");
+  return result;
+}
+
+// ../runtime/providers/src/installation/update.ts
+import { createHash as createHash4, createPublicKey } from "node:crypto";
+var PLATFORM = new Map([
+  ["darwin-arm64", "darwin-arm64"],
+  ["darwin-x64", "darwin-x64"],
+  ["linux-arm64", "linux-arm64"],
+  ["linux-x64", "linux-x64"],
+  ["win32-arm64", "windows-arm64"],
+  ["win32-x64", "windows-x64"]
+]);
+var RELEASE_PUBLIC_KEY_DER_SHA256 = createHash4("sha256").update(createPublicKey(RELEASE_PUBLIC_KEY_PEM).export({ type: "spki", format: "der" })).digest("hex");
+// src/cli.ts
+var HARNESS_IDS = ["opencode-v1", "opencode-v2", "claude", "pi"];
+var HARNESS_ENTRYPOINTS = {
+  "opencode-v1": "bin/harness/opencode-1.x.js",
+  "opencode-v2": "bin/harness/opencode-2.x.js",
+  claude: "bin/harness/claude.js",
+  pi: "bin/harness/pi.js"
+};
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parsePackageMetadata(value) {
+  if (!isRecord2(value) || typeof value["version"] !== "string" || !value["version"].trim()) {
+    throw new Error("package.json must contain a non-empty version");
+  }
+  return { version: value["version"] };
+}
+var metadata3 = parsePackageMetadata(JSON.parse(await readFile(new URL("../../package.json", import.meta.url), "utf8")));
+var PACKAGE_VERSION = metadata3.version;
+var RELEASE_BASE_URL = (process.env["ANYCODE_RELEASE_BASE_URL"] ?? "https://anycode.me").replace(/\/$/u, "");
+var homeDirectory = homedir();
+var INSTALL_ROOT = join4(process.env["ANYCODE_INSTALL_ROOT"] ?? join4(homeDirectory, ".local", "share", "anycode"));
+var BIN_DIR = process.env["ANYCODE_BIN_DIR"] ?? join4(homeDirectory, ".local", "bin");
+var NODE_MINIMUM_MAJOR = 20;
+var DOWNLOAD_TIMEOUT_MS = 60000;
+function usage() {
+  console.log(`AnyCode ${PACKAGE_VERSION}
+
+Usage:
+  curl -fsSL https://anycode.me/install.sh | sh
+  curl -fsSL https://anycode.me/install.sh | ANYCODE_VERSION=<version> sh
+
+After installation:
+  anycode doctor
+  anycode help [topic] [--json]
+  anycode <native-anycode-command> [...args]
+
+Install downloads and verifies the immutable GitHub release. Other commands are
+forwarded to the activated native AnyCode runtime.
+
+Node.js ${NODE_MINIMUM_MAJOR} or newer is required. Git and a Harness (OpenCode,
+Claude Code, or Pi) are separate optional integrations.
+Supported Harness adapters: opencode-v1, opencode-v2, claude, pi.`);
+}
+function normalizedVersion(value) {
+  const version = value.startsWith("v") ? value.slice(1) : value;
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.test(version)) {
+    throw new Error(`invalid AnyCode version: ${value}`);
+  }
+  return version;
+}
+function option(args, name, fallback) {
+  const index = args.indexOf(name);
+  if (index < 0)
+    return fallback;
+  const value = args[index + 1];
+  if (!value || value.startsWith("--"))
+    throw new Error(`${name} requires a value`);
+  return value;
+}
+function ensureNodeVersion() {
+  const major = Number.parseInt(process.versions.node.split(".")[0] ?? "0", 10);
+  if (!Number.isInteger(major) || major < NODE_MINIMUM_MAJOR) {
+    throw new Error(`AnyCode requires Node.js >= ${NODE_MINIMUM_MAJOR}; detected ${process.versions.node}. Install or upgrade Node.js before continuing.`);
+  }
+}
+async function verifyArtifact(artifact, checksumFile) {
+  const expected = (await readFile(checksumFile, "utf8")).trim().split(/\s+/).at(-1);
+  const actual = createHash5("sha256").update(await readFile(artifact)).digest("hex");
+  const normalized = expected?.replace(/^sha256:/, "");
+  if (!normalized || normalized !== actual) {
+    throw new Error("release artifact sha256 does not match its checksum");
+  }
+}
+async function verifySignedRelease(version, target, artifact, options = {}) {
+  const root = `${(options.baseUrl ?? RELEASE_BASE_URL).replace(/\/$/u, "")}/releases/v${version}`;
+  if (!root.startsWith("https://"))
+    throw new Error("AnyCode release base URL must use HTTPS");
+  const fetcher = options.fetcher ?? fetch;
+  const [manifestResponse, sumsResponse, signatureResponse] = await Promise.all([
+    fetcher(`${root}/latest.json`, { signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS) }),
+    fetcher(`${root}/SHA256SUMS`, { signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS) }),
+    fetcher(`${root}/SHA256SUMS.sig`, { signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS) })
+  ]);
+  if (!manifestResponse.ok || !sumsResponse.ok || !signatureResponse.ok)
+    throw new Error("AnyCode release trust metadata is unavailable");
+  const manifest = await manifestResponse.json();
+  if (manifest.version !== version)
+    throw new Error("AnyCode release manifest version does not match the requested version");
+  const platform = `${target.os}-${target.arch}`;
+  const name = `anycode-${version}-${platform}.tar.gz`;
+  const file = manifest.files?.find((candidate) => candidate.platform === platform && candidate.name === name);
+  if (!file || typeof file.sha256 !== "string")
+    throw new Error("AnyCode release manifest has no unique platform asset");
+  const sums = await sumsResponse.text();
+  const signedHash = verifyReleaseChecksums(Buffer.from(sums), await signatureResponse.text(), options.publicKeyPem ?? RELEASE_PUBLIC_KEY_PEM).get(name);
+  if (signedHash !== file.sha256)
+    throw new Error("AnyCode manifest does not match signed SHA256SUMS");
+  const actual = createHash5("sha256").update(await readFile(artifact)).digest("hex");
+  if (actual !== signedHash)
+    throw new Error("AnyCode release artifact does not match signed SHA256SUMS");
+}
+var RELEASE_TARGETS = {
+  "linux-x64": { os: "linux", arch: "x64", executable: "anycode" },
+  "linux-arm64": { os: "linux", arch: "arm64", executable: "anycode" },
+  "darwin-x64": { os: "darwin", arch: "x64", executable: "anycode" },
+  "darwin-arm64": { os: "darwin", arch: "arm64", executable: "anycode" },
+  "win32-x64": { os: "windows", arch: "x64", executable: "anycode.exe" }
+};
+function releaseTarget() {
+  const target = RELEASE_TARGETS[`${process.platform}-${process.arch}`];
+  if (target === undefined)
+    throw new Error(`AnyCode has no native release for ${process.platform}-${process.arch}`);
+  return target;
+}
+function harnessOption(args) {
+  const value = option(args, "--harness", "");
+  if (!value)
+    return;
+  if (!HARNESS_IDS.includes(value))
+    throw new Error(`unsupported Harness: ${value}; choose ${HARNESS_IDS.join(", ")}`);
+  return value;
+}
+async function install(version, harness, options = {}) {
+  ensureNodeVersion();
+  const target = options.target ?? releaseTarget();
+  const installRoot = options.installRoot ?? INSTALL_ROOT;
+  const binDirectory = options.binDirectory ?? BIN_DIR;
+  const baseUrl = (options.baseUrl ?? RELEASE_BASE_URL).replace(/\/$/u, "");
+  if (!baseUrl.startsWith("https://"))
+    throw new Error("AnyCode release base URL must use HTTPS");
+  const fetcher = options.fetcher ?? fetch;
+  const requestOptions = { redirect: "follow", signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS) };
+  await mkdir(dirname4(installRoot), { recursive: true });
+  const temporary = await mkdtemp(join4(dirname4(installRoot), ".anycode-npm-"));
+  const artifact = join4(temporary, `anycode-${version}-${target.os}-${target.arch}.tar.gz`);
+  const checksum = `${artifact}.sha256`;
+  const source = join4(temporary, "source");
+  try {
+    await downloadWith(fetcher, `${baseUrl}/releases/v${version}/anycode-${version}-${target.os}-${target.arch}.tar.gz`, artifact, requestOptions);
+    await downloadWith(fetcher, `${baseUrl}/releases/v${version}/anycode-${version}-${target.os}-${target.arch}.tar.gz.sha256`, checksum, requestOptions);
+    await verifyArtifact(artifact, checksum);
+    await verifySignedRelease(version, target, artifact, options);
+    await mkdir(source, { recursive: true });
+    extractTarGzip(artifact, source);
+    const manifest = verifyInstalledPackage(source);
+    if (manifest.files[`bin/${target.executable}`] === undefined)
+      throw new Error(`release package is missing native executable bin/${target.executable}`);
+    if (harness !== undefined && manifest.files[HARNESS_ENTRYPOINTS[harness]] === undefined) {
+      throw new Error(`release package does not contain the requested Harness adapter: ${harness}`);
+    }
+    activatePackage(source, installRoot, join4(binDirectory, target.executable), {
+      executable: target.executable,
+      ...options.platform === undefined ? {} : { platform: options.platform }
+    });
+    console.log(`AnyCode ${version} installed at ${installRoot}`);
+    if (harness !== undefined)
+      console.log(`Register only ${HARNESS_ENTRYPOINTS[harness]} in the native ${harness} configuration.`);
+    if (!pathContains(binDirectory))
+      console.log(`Add ${binDirectory} to PATH before using the anycode command in a new shell.`);
+  } finally {
+    await rm(temporary, { recursive: true, force: true });
+  }
+}
+async function downloadWith(fetcher, url, destination, requestOptions) {
+  const response = await fetcher(url, requestOptions);
+  if (!response.ok)
+    throw new Error(`download failed: ${response.status} ${response.statusText}`);
+  await writeFile(destination, Buffer.from(await response.arrayBuffer()));
+}
+function pathContains(directory) {
+  const separator = process.platform === "win32" ? ";" : ":";
+  return (process.env["PATH"] ?? "").split(separator).includes(directory);
+}
+function compareVersions(left, right) {
+  const parse = (value) => {
+    const [base, suffix] = value.split("-", 2);
+    return { core: base.split(".").map(Number), suffix: suffix?.split(".") };
+  };
+  const a = parse(left);
+  const b = parse(right);
+  for (let index = 0;index < 3; index += 1) {
+    const difference = (a.core[index] ?? 0) - (b.core[index] ?? 0);
+    if (difference)
+      return Math.sign(difference);
+  }
+  if (!a.suffix && !b.suffix)
+    return 0;
+  if (!a.suffix)
+    return 1;
+  if (!b.suffix)
+    return -1;
+  for (let index = 0;index < Math.max(a.suffix.length, b.suffix.length); index += 1) {
+    const x = a.suffix[index];
+    const y = b.suffix[index];
+    if (x === undefined)
+      return -1;
+    if (y === undefined)
+      return 1;
+    if (x === y)
+      continue;
+    const nx = /^\d+$/u.test(x);
+    const ny = /^\d+$/u.test(y);
+    if (nx && ny)
+      return Number(x) < Number(y) ? -1 : 1;
+    if (nx !== ny)
+      return nx ? -1 : 1;
+    return x.localeCompare(y);
+  }
+  return 0;
+}
+function newerNativeExecutable() {
+  const path = join4(INSTALL_ROOT, "bin", releaseTarget().executable);
+  const probe = spawnSync(path, ["version", "--json"], { encoding: "utf8", timeout: 5000 });
+  if (probe.status !== 0)
+    return;
+  try {
+    const value = JSON.parse(probe.stdout);
+    if (!isRecord2(value) || typeof value["version"] !== "string" || compareVersions(value["version"], PACKAGE_VERSION) <= 0)
+      return;
+    return { path, version: value["version"] };
+  } catch {
+    return;
+  }
+}
+async function main(args) {
+  if (args.length === 0 || args[0] === "--help" || args[0] === "-h" || args[0] === "install" && (args.includes("--help") || args.includes("-h"))) {
+    usage();
+    return 0;
+  }
+  if (args.includes("--version") && args.length === 1) {
+    const native = newerNativeExecutable();
+    console.log(native ? `${native.version} (${native.path})` : `${PACKAGE_VERSION} (${fileURLToPath2(import.meta.url)})`);
+    return 0;
+  }
+  if (args[0] === "install") {
+    const version = normalizedVersion(option(args, "--version", PACKAGE_VERSION));
+    await install(version, harnessOption(args));
+    return 0;
+  }
+  const executable = newerNativeExecutable()?.path ?? join4(INSTALL_ROOT, "bin", releaseTarget().executable);
+  const result = spawnSync(executable, args, { stdio: "inherit" });
+  if (result.error) {
+    throw new Error(`AnyCode is not installed at ${INSTALL_ROOT}; run: curl -fsSL https://anycode.me/install.sh | sh`);
+  }
+  return result.status ?? 1;
+}
+if (isEntryModule(import.meta.url, process.argv[1], process.versions["bun"] !== undefined && __require.main == __require.module === true)) {
+  main(process.argv.slice(2)).then((code) => {
+    process.exitCode = code;
+  }).catch((error) => {
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(`anycode: ${message}`);
+    process.exitCode = 1;
+  });
+}
+export {
+  install
+};