@langgexyz/anycode 0.4.6 → 0.4.9

package/npm/dist/cli.mjs

@@ -1,17 +1,37 @@
 #!/usr/bin/env node
+import { createRequire } from "node:module";
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
-// npm/src/cli.ts
-import { createHash as createHash3 } from "node:crypto";
+// src/cli.ts
+import { createHash as createHash5 } from "node:crypto";
 import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
-import { dirname as dirname3, join as join4 } from "node:path";
-import { fileURLToPath } from "node:url";
+import { dirname as dirname4, join as join4 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { spawnSync } from "node:child_process";
 
-// runtime/archive/src/index.ts
+// ../runtime/harness-context/src/entry-module.ts
+import { realpathSync } from "node:fs";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+function isEntryModule(moduleUrl, invokedFile, isRuntimeMain = false, runtimeExecutable) {
+  if (isRuntimeMain)
+    return true;
+  if (invokedFile === undefined)
+    return false;
+  if (runtimeExecutable !== undefined && resolve(invokedFile) === resolve(runtimeExecutable))
+    return true;
+  try {
+    return realpathSync(resolve(invokedFile)) === realpathSync(resolve(fileURLToPath(moduleUrl)));
+  } catch {
+    return false;
+  }
+}
+
+// ../runtime/archive/src/index.ts
 import { gunzipSync, gzipSync } from "node:zlib";
 import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
-import { dirname, join, posix, relative, resolve } from "node:path";
+import { dirname, join, posix, relative, resolve as resolve2 } from "node:path";
 function readTarGzip(archive) {
   const bytes = gunzipSync(readFileSync(archive));
   const entries = [];
@@ -92,8 +112,8 @@ function parsePax(body) {
 }
 function safeArchivePath(root, value) {
   const normalized = normalizeArchivePath(value);
-  const path = resolve(root, normalized);
-  const relativePath = relative(resolve(root), path);
+  const path = resolve2(root, normalized);
+  const relativePath = relative(resolve2(root), path);
   if (!relativePath || relativePath === ".." || relativePath.startsWith(`..${"/"}`) || relativePath.startsWith("/"))
     throw new Error(`package contains unsafe path: ${value}`);
   return path;
@@ -126,7 +146,7 @@ function pendingNumber(buffer, offset, length, field) {
   return value;
 }
 
-// runtime/core/src/connector.ts
+// ../runtime/core/src/connector.ts
 class ConnectorRegistry {
   connectors = new Map;
   capabilityOwners = new Map;
@@ -270,10 +290,10 @@ function failed(request, reason, errorCode) {
     }
   };
 }
-// runtime/core/src/protection.ts
+// ../runtime/core/src/protection.ts
 var LOCAL_CAPABILITY_DOMAINS = new Set(["change", "project", "verification", "git"]);
 var TARGETS = new Set(["workstation", "test", "beta", "prod", "external"]);
-// runtime/core/src/index.ts
+// ../runtime/core/src/index.ts
 class CapabilityRegistry {
   specs = new Map;
   constructor(specs = []) {
@@ -318,7 +338,7 @@ function validateCapabilityRequest(request) {
   }
 }
 
-// runtime/providers/src/installation/package-build.ts
+// ../runtime/providers/src/installation/package-build.ts
 var LAUNCHER = `#!/bin/sh
 ` + `script="$0"
 ` + `while [ -L "$script" ]; do
@@ -342,7 +362,7 @@ var WINDOWS_LAUNCHER = `@echo off\r
 ` + `)\r
 ` + `"%ANYCODE_NODE%" "%root%\\runtime\\providers\\dist\\cli.mjs" %*\r
 `;
-// runtime/providers/src/installation/package-installed.ts
+// ../runtime/providers/src/installation/package-installed.ts
 import { createHash } from "node:crypto";
 import { existsSync as existsSync2, lstatSync as lstatSync2, readFileSync as readFileSync2, readdirSync as readdirSync2, readlinkSync } from "node:fs";
 import { join as join2, posix as posix2, relative as relative2, sep } from "node:path";
@@ -370,7 +390,7 @@ function validateExistingInstall(root) {
   try {
     JSON.parse(readFileSync2(manifestPath, "utf8"));
   } catch {
-    throw new Error(`旧版扁平安装清单解析失败：${manifestPath}`);
+    throw new Error(`\u65e7\u7248\u6241\u5e73\u5b89\u88c5\u6e05\u5355\u89e3\u6790\u5931\u8d25\uff1a${manifestPath}`);
   }
   verifyInstalledPackage(root);
 }
@@ -476,66 +496,459 @@ function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
-// runtime/providers/src/installation/activation.ts
-import { copyFileSync, existsSync as existsSync3, lstatSync as lstatSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, readlinkSync as readlinkSync2, realpathSync, renameSync, rmSync, statSync as statSync2, symlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname2, join as join3, relative as relative3, resolve as resolve2 } from "node:path";
+// ../runtime/providers/src/installation/activation.ts
+import { copyFileSync, existsSync as existsSync3, lstatSync as lstatSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync4, readlinkSync as readlinkSync2, renameSync as renameSync2, rmSync, statSync as statSync2, symlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname3, join as join3, relative as relative3, resolve as resolve3 } from "node:path";
+// ../runtime/providers/src/infrastructure/command-runner.ts
+var SAFE_ENVIRONMENT_KEYS = new Set([
+  "PATH",
+  "HOME",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "TZ",
+  "TMPDIR",
+  "HTTP_PROXY",
+  "HTTPS_PROXY",
+  "ALL_PROXY",
+  "NO_PROXY",
+  "http_proxy",
+  "https_proxy",
+  "all_proxy",
+  "no_proxy"
+]);
+var PROXY_KEYS = new Set(["HTTP_PROXY", "HTTPS_PROXY", "ALL_PROXY", "http_proxy", "https_proxy", "all_proxy"]);
+// ../runtime/credentials/src/memory.ts
+import { createHash as createHash2 } from "node:crypto";
+
+// ../runtime/credentials/src/validation.ts
+function validateCredentialRef(ref) {
+  for (const [name, value] of Object.entries(ref)) {
+    if (!value.trim())
+      throw new Error(`credential ${name} must not be empty`);
+    if (!/^[A-Za-z0-9._:/-]+$/u.test(value))
+      throw new Error(`credential ${name} contains unsupported characters`);
+  }
+}
+function credentialKey(ref) {
+  validateCredentialRef(ref);
+  return JSON.stringify([ref.scope, ref.field]);
+}
+
+// ../runtime/credentials/src/secret-lease.ts
+var leaseStates = new WeakMap;
+function createSecretLease(ref, secret) {
+  const secretForms = [
+    secret,
+    encodeURIComponent(secret),
+    Buffer.from(secret, "utf8").toString("base64"),
+    Buffer.from(secret, "utf8").toString("base64url"),
+    Buffer.from(secret, "utf8").toString("hex")
+  ].filter((form) => form.length > 0);
+  const state = { active: true, secret };
+  const lease = Object.freeze({
+    ref: Object.freeze({ ...ref }),
+    use(consumer) {
+      if (!state.active)
+        throw new Error("credential lease is no longer active");
+      let result;
+      try {
+        result = consumer(state.secret);
+      } catch (error) {
+        throw sanitizedError(error, secretForms);
+      }
+      return guardResult(result, secretForms);
+    }
+  });
+  leaseStates.set(lease, state);
+  return lease;
+}
+function guardResult(result, secretForms) {
+  let promiseLike;
+  try {
+    promiseLike = isPromiseLike(result);
+  } catch (error) {
+    throw sanitizedError(error, secretForms);
+  }
+  if (promiseLike) {
+    return Promise.resolve(result).then((value) => guardValue(value, secretForms), (error) => {
+      throw sanitizedError(error, secretForms);
+    });
+  }
+  return guardValue(result, secretForms);
+}
+function guardValue(value, secretForms) {
+  if (containsSecret(value, secretForms, new WeakSet)) {
+    throw new Error("Connector result must not contain a credential value");
+  }
+  return value;
+}
+function containsSecret(value, secretForms, visited) {
+  if (typeof value === "string")
+    return secretForms.some((form) => value.includes(form));
+  if (typeof value === "function")
+    return true;
+  if (value === null || typeof value !== "object")
+    return false;
+  if (visited.has(value))
+    return false;
+  visited.add(value);
+  if (value instanceof Uint8Array)
+    return secretForms.some((form) => includesBytes(value, new TextEncoder().encode(form)));
+  if (value instanceof Map)
+    return [...value].some(([key, entry]) => containsSecret(key, secretForms, visited) || containsSecret(entry, secretForms, visited));
+  if (value instanceof Set)
+    return [...value].some((entry) => containsSecret(entry, secretForms, visited));
+  try {
+    const prototype = Object.getPrototypeOf(value);
+    if (!Array.isArray(value) && prototype !== Object.prototype && prototype !== null)
+      return true;
+    if (Reflect.ownKeys(value).some((key) => typeof key === "string" ? secretForms.some((form) => key.includes(form)) : secretForms.some((form) => String(key).includes(form))))
+      return true;
+    for (const descriptor of Object.values(Object.getOwnPropertyDescriptors(value))) {
+      if (!("value" in descriptor))
+        return true;
+      if (containsSecret(descriptor.value, secretForms, visited))
+        return true;
+    }
+  } catch {
+    return true;
+  }
+  return false;
+}
+function includesBytes(bytes, needle) {
+  if (needle.length === 0)
+    return false;
+  outer:
+    for (let start = 0;start <= bytes.length - needle.length; start += 1) {
+      for (let offset = 0;offset < needle.length; offset += 1) {
+        if (bytes[start + offset] !== needle[offset])
+          continue outer;
+      }
+      return true;
+    }
+  return false;
+}
+function sanitizedError(error, secretForms) {
+  let message;
+  try {
+    message = error instanceof Error ? error.message : String(error);
+  } catch {
+    message = "Connector operation failed";
+  }
+  const sanitized = secretForms.some((form) => message.includes(form)) ? "Connector operation failed; error details contained a credential value" : message;
+  const result = new Error(sanitized);
+  if (error instanceof Error)
+    result.name = error.name;
+  return result;
+}
+function isPromiseLike(value) {
+  return (typeof value === "object" || typeof value === "function") && value !== null && "then" in value && typeof value.then === "function";
+}
+
+// ../runtime/credentials/src/memory.ts
+class MemoryCredentialStorage {
+  id = "memory";
+  strategyId = this.id;
+  entries = new Map;
+  inspect(ref) {
+    validateCredentialRef(ref);
+    const entry = this.entries.get(credentialKey(ref));
+    return entry ? metadata(entry) : { ref, present: false };
+  }
+  list() {
+    return [...this.entries.values()].map(metadata);
+  }
+  write(ref, input) {
+    validateCredentialRef(ref);
+    if (!input.value)
+      throw new Error("credential value must not be empty");
+    const entry = { ref, value: input.value, updatedAt: new Date().toISOString() };
+    this.entries.set(credentialKey(ref), entry);
+    return metadata(entry);
+  }
+  fingerprint(ref) {
+    const entry = this.require(ref);
+    return { ...metadata(entry), fingerprint: fingerprint(entry.value) };
+  }
+  remove(ref) {
+    validateCredentialRef(ref);
+    return this.entries.delete(credentialKey(ref));
+  }
+  useSecret(ref, consumer) {
+    const entry = this.require(ref);
+    return createSecretLease(entry.ref, entry.value).use(consumer);
+  }
+  require(ref) {
+    validateCredentialRef(ref);
+    const entry = this.entries.get(credentialKey(ref));
+    if (!entry)
+      throw new Error(`credential is unavailable: ${credentialKey(ref)}`);
+    return entry;
+  }
+}
+function metadata(entry) {
+  return { ref: entry.ref, present: true, updatedAt: entry.updatedAt };
+}
+function fingerprint(value) {
+  return `sha256:${createHash2("sha256").update(value).digest("hex")}`;
+}
+// ../runtime/credentials/src/encrypted-file.ts
+import { createCipheriv, createDecipheriv, createHash as createHash3, randomBytes } from "node:crypto";
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, renameSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname2 } from "node:path";
+class EncryptedFileCredentialStorage {
+  filePath;
+  keyProvider;
+  id = "encrypted-file";
+  strategyId = this.id;
+  constructor(filePath, keyProvider) {
+    this.filePath = filePath;
+    this.keyProvider = keyProvider;
+  }
+  inspect(ref) {
+    const entry = this.entries().get(credentialKey(ref));
+    return entry ? metadata2(entry) : { ref, present: false };
+  }
+  list() {
+    return [...this.entries().values()].map(metadata2);
+  }
+  write(ref, input) {
+    validateCredentialRef(ref);
+    if (!input.value)
+      throw new Error("credential value must not be empty");
+    const entries = this.entries();
+    const entry = { ref, value: input.value, updatedAt: new Date().toISOString() };
+    entries.set(credentialKey(ref), entry);
+    this.save(entries);
+    return metadata2(entry);
+  }
+  fingerprint(ref) {
+    const entry = this.require(ref);
+    return { ...metadata2(entry), fingerprint: fingerprint2(entry.value) };
+  }
+  remove(ref) {
+    const entries = this.entries();
+    const removed = entries.delete(credentialKey(ref));
+    if (removed)
+      this.save(entries);
+    return removed;
+  }
+  useSecret(ref, consumer) {
+    const entry = this.require(ref);
+    return createSecretLease(entry.ref, entry.value).use(consumer);
+  }
+  require(ref) {
+    const entry = this.entries().get(credentialKey(ref));
+    if (!entry)
+      throw new Error(`credential is unavailable: ${credentialKey(ref)}`);
+    return entry;
+  }
+  entries() {
+    try {
+      const envelope = JSON.parse(readFileSync3(this.filePath, "utf8"));
+      return decode(envelope, this.keyProvider.key());
+    } catch (error) {
+      if (isMissingFile(error))
+        return new Map;
+      throw new Error(`credential store cannot be opened: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  save(entries) {
+    const directory = dirname2(this.filePath);
+    mkdirSync2(directory, { recursive: true, mode: 448 });
+    const temporary = `${this.filePath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+    writeFileSync2(temporary, JSON.stringify(encode(entries, this.keyProvider.key())) + `
+`, { mode: 384 });
+    chmodSync2(temporary, 384);
+    renameSync(temporary, this.filePath);
+    chmodSync2(this.filePath, 384);
+  }
+}
+function encode(entries, key) {
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const plaintext = JSON.stringify([...entries.values()]);
+  const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  return { version: 1, iv: iv.toString("base64url"), tag: cipher.getAuthTag().toString("base64url"), ciphertext: ciphertext.toString("base64url") };
+}
+function decode(envelope, key) {
+  if (envelope.version !== 1)
+    throw new Error("unsupported credential store version");
+  const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(envelope.iv, "base64url"));
+  decipher.setAuthTag(Buffer.from(envelope.tag, "base64url"));
+  const plaintext = Buffer.concat([decipher.update(Buffer.from(envelope.ciphertext, "base64url")), decipher.final()]).toString("utf8");
+  const values = JSON.parse(plaintext);
+  const entries = new Map;
+  for (const entry of values) {
+    validateCredentialRef(entry.ref);
+    entries.set(credentialKey(entry.ref), entry);
+  }
+  return entries;
+}
+function metadata2(entry) {
+  return { ref: entry.ref, present: true, updatedAt: entry.updatedAt };
+}
+function fingerprint2(value) {
+  return `sha256:${createHash3("sha256").update(value).digest("hex")}`;
+}
+function isMissingFile(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+// ../runtime/credentials/src/registry.ts
+class CredentialStorageRegistry {
+  strategies = new Map;
+  constructor(strategies = []) {
+    for (const strategy of strategies)
+      this.register(strategy);
+  }
+  register(strategy) {
+    if (this.strategies.has(strategy.id))
+      throw new Error(`duplicate credential storage strategy: ${strategy.id}`);
+    this.strategies.set(strategy.id, strategy);
+  }
+  resolve(policy) {
+    const id = policy.kind === "external" ? policy.provider : policy.kind;
+    if (!id)
+      throw new Error("external credential storage requires a provider");
+    const strategy = this.strategies.get(id);
+    if (!strategy)
+      throw new Error(`credential storage strategy is unavailable: ${id}`);
+    return strategy;
+  }
+}
+// ../runtime/providers/src/infrastructure/authenticated-transport.ts
+var MAX_REQUEST_BYTES = 1024 * 1024;
+var MAX_RESPONSE_BYTES = 4 * 1024 * 1024;
+var REQUEST_HEADERS = new Set(["accept", "content-type", "user-agent"]);
+// ../runtime/providers/src/infrastructure/sensitive-key.ts
+var SECRET_NOUNS = ["authorization", "credentials", "credential", "password", "passwd", "secret", "token"];
+var KEY_QUALIFIERS = ["access", "api", "private", "secret"];
+var nounPattern = SECRET_NOUNS.join("|");
+var qualifierPattern = `(?:${KEY_QUALIFIERS.join("|")})[_-]?key`;
+var SENSITIVE_KEY_PATTERN = `[\\p{L}\\p{N}_-]*(?:${nounPattern}|${qualifierPattern})(?![\\p{L}\\p{N}_])`;
+
+// ../runtime/providers/src/infrastructure/redaction-rules.ts
+var REDACTION_RULES = [
+  {
+    id: "private-key",
+    pattern: /-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?-----END [^-]*PRIVATE KEY-----/gu,
+    replacement: "[REDACTED:private-key]"
+  },
+  {
+    id: "bearer",
+    pattern: /\bBearer\s+(?!\[REDACTED:)[^\s,;}\]]+/giu,
+    replacement: "Bearer [REDACTED:bearer]"
+  },
+  {
+    id: "authorization",
+    pattern: /(?<authorizationQuote>["']?)(?<authorizationKey>authorization)\k<authorizationQuote>(?<authorizationSeparator>\s*[:=]\s*)(?!\s*\[REDACTED:)(?:(?<authorizationValueQuote>["'])(?:[\s\S]*?)\k<authorizationValueQuote>|[^\r\n"']+)/giu,
+    replacement: "$<authorizationQuote>$<authorizationKey>$<authorizationQuote>$<authorizationSeparator>$<authorizationValueQuote>[REDACTED:authorization]$<authorizationValueQuote>"
+  },
+  {
+    id: "assignment",
+    pattern: new RegExp(`(?<assignmentQuote>["']?)(?<assignmentKey>${SENSITIVE_KEY_PATTERN})\\k<assignmentQuote>(?<assignmentSeparator>\\s*[:=]\\s*)(?!\\s*\\[REDACTED:)(?:(?<assignmentValueQuote>["'])(?:[\\s\\S]*?)\\k<assignmentValueQuote>|[^\\s,;}\\]"']+)`, "giu"),
+    replacement: "$<assignmentQuote>$<assignmentKey>$<assignmentQuote>$<assignmentSeparator>$<assignmentValueQuote>[REDACTED:assignment]$<assignmentValueQuote>"
+  },
+  {
+    id: "url-userinfo",
+    pattern: /(?<urlScheme>\b[a-z][a-z0-9+.-]*:\/\/[^\s:@\/?#]*:)(?!\[REDACTED:)[^\s@\/?#]+(?=@)/giu,
+    replacement: "$<urlScheme>[REDACTED:url-password]"
+  }
+];
+
+// ../runtime/providers/src/infrastructure/redaction.ts
+var COMBINED_RULES = new RegExp(REDACTION_RULES.map((rule, index) => `(?<r${index}>${rule.pattern.source})`).join("|"), "giu");
+// ../runtime/providers/src/infrastructure/transaction.ts
+function rethrowAfterUndo(original, steps) {
+  const failures = [];
+  for (const undo of steps)
+    try {
+      undo();
+    } catch (error) {
+      failures.push(error);
+    }
+  if (failures.length === 0)
+    throw original;
+  throw new AggregateError([original, ...failures], `${original instanceof Error ? original.message : String(original)}; rollback had ${failures.length} failure(s)`, { cause: original });
+}
+// ../runtime/providers/src/installation/activation.ts
 function activatePackage(stagedPackage, installRoot, launcherPath, options = {}) {
   const platform = options.platform ?? process.platform;
   const executable = options.executable ?? (platform === "win32" ? "anycode.exe" : "anycode");
-  mkdirSync2(dirname2(installRoot), { recursive: true });
-  const releaseLock = acquireActivationLock(installRoot);
+  mkdirSync3(dirname3(installRoot), { recursive: true });
+  const releaseLock = acquireActivationLock(installRoot, platform);
   const previous = `${installRoot}.previous`;
   let movedCurrent = false;
   let installedNew = false;
   try {
-    recoverInterruptedActivation(installRoot, previous);
+    reconcileActivation(installRoot, previous, launcherPath, executable, platform);
     const manifest = verifyInstalledPackage(stagedPackage);
     validateExistingInstall(installRoot);
     validateLauncherOwnership(launcherPath, installRoot, stagedPackage, executable, platform);
     if (existsSync3(installRoot)) {
       rmSync(previous, { recursive: true, force: true });
-      renameSync(installRoot, previous);
+      renameSync2(installRoot, previous);
       movedCurrent = true;
     }
-    renameSync(stagedPackage, installRoot);
+    renameSync2(stagedPackage, installRoot);
     installedNew = true;
     const installed = verifyInstalledPackage(installRoot);
     if (installed.version !== manifest.version || installed.payload_digest !== manifest.payload_digest)
-      throw new Error("安装后的 AnyCode 包校验失败");
+      throw new Error("\u5b89\u88c5\u540e\u7684 AnyCode \u5305\u6821\u9a8c\u5931\u8d25");
     linkLauncher(join3(installRoot, "bin", executable), launcherPath, platform);
+    try {
+      removeActivationPath(previous);
+    } catch {}
     return installRoot;
   } catch (error) {
-    if (installedNew && existsSync3(installRoot)) {
-      rmSync(installRoot, { recursive: true, force: true });
-    }
-    if (movedCurrent && existsSync3(previous) && !existsSync3(installRoot))
-      renameSync(previous, installRoot);
-    throw error;
+    rethrowAfterUndo(error, [
+      () => {
+        if (installedNew && existsSync3(installRoot))
+          rmSync(installRoot, { recursive: true, force: true });
+      },
+      () => {
+        if (movedCurrent && existsSync3(previous) && !existsSync3(installRoot))
+          renameSync2(previous, installRoot);
+      }
+    ]);
   } finally {
     releaseLock();
   }
 }
-function acquireActivationLock(installRoot) {
+function acquireActivationLock(installRoot, platform) {
   const lock = `${installRoot}.activation-lock`;
   const deadline = Date.now() + 30000;
   const token = `${process.pid}:${Date.now()}:${Math.random().toString(16).slice(2)}`;
   while (true) {
     try {
-      mkdirSync2(lock);
-      writeFileSync2(join3(lock, "owner"), token, { flag: "wx", mode: 384 });
-      return () => {
+      if (platform === "win32") {
+        mkdirSync3(lock);
         try {
-          if (readFileSync3(join3(lock, "owner"), "utf8") === token)
-            rmSync(lock, { recursive: true, force: true });
-        } catch {}
+          writeFileSync3(join3(lock, "owner"), token, { flag: "wx", mode: 384 });
+        } catch (error) {
+          rethrowAfterUndo(error, [() => rmSync(lock, { recursive: true, force: true })]);
+        }
+      } else {
+        symlinkSync(token, lock);
+      }
+      return () => {
+        for (let attempt = 0;attempt < 2; attempt += 1) {
+          try {
+            const owner = platform === "win32" ? readFileSync4(join3(lock, "owner"), "utf8") : readlinkSync2(lock);
+            if (owner === token)
+              rmSync(lock, { recursive: true, force: true });
+            return;
+          } catch {}
+        }
       };
     } catch (error) {
       if (error.code !== "EEXIST")
         throw error;
-      const ownerPath = join3(lock, "owner");
       let stale = false;
       try {
-        const owner = readFileSync3(ownerPath, "utf8");
+        const metadata3 = lstatSync3(lock);
+        const owner = metadata3.isSymbolicLink() ? readlinkSync2(lock) : readFileSync4(join3(lock, "owner"), "utf8");
         const pid = Number(owner.split(":", 1)[0]);
         if (Number.isSafeInteger(pid) && pid > 0) {
           try {
@@ -561,13 +974,37 @@ function acquireActivationLock(installRoot) {
     }
   }
 }
-function recoverInterruptedActivation(installRoot, previous) {
-  if (existsSync3(installRoot))
+function removeActivationPath(path) {
+  try {
+    rmSync(path, { recursive: true, force: true });
+  } catch (first) {
+    try {
+      rmSync(path, { recursive: true, force: true });
+    } catch (second) {
+      throw new AggregateError([first, second], `could not remove activation recovery path: ${path}`, { cause: first });
+    }
+  }
+}
+function reconcileActivation(installRoot, previous, launcherPath, executable, platform) {
+  if (!existsSync3(installRoot)) {
+    if (!existsSync3(previous))
+      return;
+    validateExistingInstall(previous);
+    renameSync2(previous, installRoot);
     return;
+  }
   if (!existsSync3(previous))
     return;
-  validateExistingInstall(previous);
-  renameSync(previous, installRoot);
+  try {
+    verifyInstalledPackage(installRoot);
+  } catch {
+    return;
+  }
+  validateLauncherOwnership(launcherPath, installRoot, installRoot, executable, platform);
+  linkLauncher(join3(installRoot, "bin", executable), launcherPath, platform);
+  try {
+    rmSync(previous, { recursive: true, force: true });
+  } catch {}
 }
 function validateLauncherOwnership(launcher, root, staged, executable, platform) {
   let existing;
@@ -579,52 +1016,54 @@ function validateLauncherOwnership(launcher, root, staged, executable, platform)
     throw error;
   }
   if (existing.isSymbolicLink()) {
-    const target = resolve2(dirname2(launcher), readlinkSync2(launcher));
-    const path = relative3(resolve2(root), target).replaceAll("\\", "/");
-    if (path === `bin/${executable}`)
+    const target = resolve3(dirname3(launcher), readlinkSync2(launcher));
+    const path = relative3(resolve3(root), target).replaceAll("\\", "/");
+    if (path === `bin/${executable}` || !path.startsWith("../") && path !== ".." && path.endsWith(`/bin/${executable}`))
       return;
-    try {
-      validateExistingInstall(root);
-      if (path === `current/bin/${executable}` && realpathSync(target) === realpathSync(join3(root, "current", "bin", executable)))
-        return;
-    } catch {}
   } else if (platform === "win32" && existing.isFile()) {
-    const bytes = readFileSync3(launcher);
+    const bytes = readFileSync4(launcher);
     for (const candidate of [join3(staged, "bin", executable), join3(root, "bin", executable)]) {
-      if (existsSync3(candidate) && bytes.equals(readFileSync3(candidate)))
+      if (existsSync3(candidate) && bytes.equals(readFileSync4(candidate)))
         return;
     }
   }
   throw new Error(`refusing to replace an unmanaged anycode launcher: ${launcher}`);
 }
 function linkLauncher(source, launcherPath, platform) {
-  mkdirSync2(dirname2(launcherPath), { recursive: true });
-  const next = `${launcherPath}.${process.pid}.next`;
+  mkdirSync3(dirname3(launcherPath), { recursive: true });
+  const next = `${launcherPath}.next`;
   rmSync(next, { force: true });
   if (platform === "win32")
     copyFileSync(source, next);
   else
     symlinkSync(source, next);
-  renameSync(next, launcherPath);
+  try {
+    renameSync2(next, launcherPath);
+  } catch (error) {
+    try {
+      rmSync(next, { force: true });
+    } catch {}
+    throw error;
+  }
 }
-// runtime/providers/src/installation/release-trust.ts
+// ../runtime/providers/src/installation/release-trust.ts
 import { verify } from "node:crypto";
 import { basename } from "node:path";
 
-// runtime/providers/src/installation/release-key.generated.ts
+// ../runtime/providers/src/installation/release-key.generated.ts
 var RELEASE_PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
 MCowBQYDK2VwAyEA/hfqP5bUwAMqzY3QS+j9GIGjbYpyrtcheixQGJt93zo=
 -----END PUBLIC KEY-----
 `;
 
-// runtime/providers/src/installation/release-trust.ts
+// ../runtime/providers/src/installation/release-trust.ts
 function verifyReleaseChecksums(sums, encodedSignature, publicKey = RELEASE_PUBLIC_KEY_PEM) {
   const encoded = encodedSignature.trim();
   const signature = Buffer.from(encoded, "base64");
   if (signature.toString("base64") !== encoded || signature.byteLength !== 64)
-    throw new Error("AnyCode SHA256SUMS 签名格式无效");
+    throw new Error("AnyCode SHA256SUMS \u7b7e\u540d\u683c\u5f0f\u65e0\u6548");
   if (!verify(null, sums, publicKey, signature))
-    throw new Error("AnyCode SHA256SUMS Ed25519 签名验证失败");
+    throw new Error("AnyCode SHA256SUMS Ed25519 \u7b7e\u540d\u9a8c\u8bc1\u5931\u8d25");
   return parseReleaseChecksums(Buffer.from(sums).toString("utf8"));
 }
 function parseReleaseChecksums(value) {
@@ -634,16 +1073,16 @@ function parseReleaseChecksums(value) {
       continue;
     const match = /^([a-f0-9]{64})\s+[* ]?([^\s]+)$/u.exec(line.trim());
     if (!match || basename(match[2]) !== match[2] || result.has(match[2]))
-      throw new Error("已签名 SHA256SUMS 格式无效");
+      throw new Error("\u5df2\u7b7e\u540d SHA256SUMS \u683c\u5f0f\u65e0\u6548");
     result.set(match[2], match[1]);
   }
   if (!result.size)
-    throw new Error("已签名 SHA256SUMS 不能为空");
+    throw new Error("\u5df2\u7b7e\u540d SHA256SUMS \u4e0d\u80fd\u4e3a\u7a7a");
   return result;
 }
 
-// runtime/providers/src/installation/update.ts
-import { createHash as createHash2, createPublicKey } from "node:crypto";
+// ../runtime/providers/src/installation/update.ts
+import { createHash as createHash4, createPublicKey } from "node:crypto";
 var PLATFORM = new Map([
   ["darwin-arm64", "darwin-arm64"],
   ["darwin-x64", "darwin-x64"],
@@ -652,8 +1091,8 @@ var PLATFORM = new Map([
   ["win32-arm64", "windows-arm64"],
   ["win32-x64", "windows-x64"]
 ]);
-var RELEASE_PUBLIC_KEY_DER_SHA256 = createHash2("sha256").update(createPublicKey(RELEASE_PUBLIC_KEY_PEM).export({ type: "spki", format: "der" })).digest("hex");
-// npm/src/cli.ts
+var RELEASE_PUBLIC_KEY_DER_SHA256 = createHash4("sha256").update(createPublicKey(RELEASE_PUBLIC_KEY_PEM).export({ type: "spki", format: "der" })).digest("hex");
+// src/cli.ts
 var HARNESS_IDS = ["opencode-v1", "opencode-v2", "claude", "pi"];
 var HARNESS_ENTRYPOINTS = {
   "opencode-v1": "bin/harness/opencode-1.x.js",
@@ -670,8 +1109,8 @@ function parsePackageMetadata(value) {
   }
   return { version: value["version"] };
 }
-var metadata = parsePackageMetadata(JSON.parse(await readFile(new URL("../../package.json", import.meta.url), "utf8")));
-var PACKAGE_VERSION = metadata.version;
+var metadata3 = parsePackageMetadata(JSON.parse(await readFile(new URL("../../package.json", import.meta.url), "utf8")));
+var PACKAGE_VERSION = metadata3.version;
 var RELEASE_BASE_URL = (process.env["ANYCODE_RELEASE_BASE_URL"] ?? "https://anycode.me").replace(/\/$/u, "");
 var homeDirectory = homedir();
 var INSTALL_ROOT = join4(process.env["ANYCODE_INSTALL_ROOT"] ?? join4(homeDirectory, ".local", "share", "anycode"));
@@ -721,7 +1160,7 @@ function ensureNodeVersion() {
 }
 async function verifyArtifact(artifact, checksumFile) {
   const expected = (await readFile(checksumFile, "utf8")).trim().split(/\s+/).at(-1);
-  const actual = createHash3("sha256").update(await readFile(artifact)).digest("hex");
+  const actual = createHash5("sha256").update(await readFile(artifact)).digest("hex");
   const normalized = expected?.replace(/^sha256:/, "");
   if (!normalized || normalized !== actual) {
     throw new Error("release artifact sha256 does not match its checksum");
@@ -751,7 +1190,7 @@ async function verifySignedRelease(version, target, artifact, options = {}) {
   const signedHash = verifyReleaseChecksums(Buffer.from(sums), await signatureResponse.text(), options.publicKeyPem ?? RELEASE_PUBLIC_KEY_PEM).get(name);
   if (signedHash !== file.sha256)
     throw new Error("AnyCode manifest does not match signed SHA256SUMS");
-  const actual = createHash3("sha256").update(await readFile(artifact)).digest("hex");
+  const actual = createHash5("sha256").update(await readFile(artifact)).digest("hex");
   if (actual !== signedHash)
     throw new Error("AnyCode release artifact does not match signed SHA256SUMS");
 }
@@ -786,8 +1225,8 @@ async function install(version, harness, options = {}) {
     throw new Error("AnyCode release base URL must use HTTPS");
   const fetcher = options.fetcher ?? fetch;
   const requestOptions = { redirect: "follow", signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS) };
-  await mkdir(dirname3(installRoot), { recursive: true });
-  const temporary = await mkdtemp(join4(dirname3(installRoot), ".anycode-npm-"));
+  await mkdir(dirname4(installRoot), { recursive: true });
+  const temporary = await mkdtemp(join4(dirname4(installRoot), ".anycode-npm-"));
   const artifact = join4(temporary, `anycode-${version}-${target.os}-${target.arch}.tar.gz`);
   const checksum = `${artifact}.sha256`;
   const source = join4(temporary, "source");
@@ -885,7 +1324,7 @@ async function main(args) {
   }
   if (args.includes("--version") && args.length === 1) {
     const native = newerNativeExecutable();
-    console.log(native ? `${native.version} (${native.path})` : `${PACKAGE_VERSION} (${fileURLToPath(import.meta.url)})`);
+    console.log(native ? `${native.version} (${native.path})` : `${PACKAGE_VERSION} (${fileURLToPath2(import.meta.url)})`);
     return 0;
   }
   if (args[0] === "install") {
@@ -900,7 +1339,7 @@ async function main(args) {
   }
   return result.status ?? 1;
 }
-if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {
+if (isEntryModule(import.meta.url, process.argv[1], process.versions["bun"] !== undefined && __require.main == __require.module === true)) {
   main(process.argv.slice(2)).then((code) => {
     process.exitCode = code;
   }).catch((error) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@langgexyz/anycode",
-  "version": "0.4.6",
+  "version": "0.4.9",
   "description": "AnyCode distribution bootstrap for the native runtime",
   "type": "module",
   "bin": {
@@ -23,7 +23,7 @@
     "typescript": "7.0.2"
   },
   "scripts": {
-    "build": "bun scripts/generate-release-key.ts --check && bun build npm/src/cli.ts --outfile npm/dist/cli.mjs --target node",
+    "build": "bun scripts/generate-release-key.ts --check && bun scripts/provider-bundle.ts --bundle npm --outfile npm/dist/cli.mjs",
     "build:binary": "bun scripts/build-binary.ts",
     "build:binary-package": "bun scripts/build-binary-package.ts",
     "build:git-gate": "bun build scripts/git-gate.ts --outfile scripts/git-gate.mjs --target node",