@metaphi-ai/hum 0.2.40 → 0.2.41

package/dist/cli.mjs

@@ -89291,6 +89291,38 @@ function trustedPython(env3 = process.env, runImpl = run) {
   const p = r && r.status === 0 ? String(r.stdout).trim().split(/\r?\n/).pop() : "";
   return /^[a-z]:\\.+\\python(w)?\.exe$/i.test(p) ? p : null;
 }
+function signedPython(env3 = process.env, { say = () => {
+}, runImpl = run, platform: platform2 = process.platform } = {}) {
+  if (platform2 !== "win32") return null;
+  const dir = path.join(humHome(env3), "python", SIGNED_PYTHON.version);
+  const python = path.join(dir, "tools", "python.exe");
+  if (fs3.existsSync(python)) return python;
+  say(`fetching Python ${SIGNED_PYTHON.version} from python.org (signed; your machine's policy trusts it) \u2026`);
+  const part = `${dir}.part`, zip = `${dir}.zip`;
+  const q = (s) => `'${s.replace(/'/g, "''")}'`;
+  const script = [
+    "$ErrorActionPreference = 'Stop'",
+    "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12",
+    `(New-Object Net.WebClient).DownloadFile(${q(SIGNED_PYTHON.url)}, ${q(zip)})`,
+    `$f = [IO.File]::OpenRead(${q(zip)}); try { $h = ([BitConverter]::ToString([Security.Cryptography.SHA256]::Create().ComputeHash($f)) -replace '-', '').ToLower() } finally { $f.Dispose() }`,
+    `if ($h -ne ${q(SIGNED_PYTHON.sha256)}) { throw 'checksum mismatch' }`,
+    `if ([IO.Directory]::Exists(${q(part)})) { [IO.Directory]::Delete(${q(part)}, $true) }`,
+    "[void][Reflection.Assembly]::LoadWithPartialName('System.IO.Compression.FileSystem')",
+    `[IO.Compression.ZipFile]::ExtractToDirectory(${q(zip)}, ${q(part)})`,
+    `[IO.Directory]::Move(${q(part)}, ${q(dir)})`
+  ].join("; ");
+  fs3.mkdirSync(path.dirname(dir), { recursive: true });
+  const r = runImpl("powershell", ["-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", script]);
+  try {
+    fs3.unlinkSync(zip);
+  } catch {
+  }
+  if (!(r && r.status === 0) || !fs3.existsSync(python)) {
+    say(`could not fetch it (${String(r && (r.stderr || r.stdout) || "powershell failed").trim().split(/\r?\n/)[0]})`);
+    return null;
+  }
+  return python;
+}
 function sslBlocked(env3 = process.env, version = MINE, runImpl = run) {
   const r = runImpl(corePython(env3, version), ASK_SSL);
   if (r && r.status === 0) return null;
@@ -89331,7 +89363,7 @@ function installCore(version, { env: env3 = process.env, say = (m) => console.lo
       fs3.unlinkSync(stampPath(env3, version));
     } catch {
     }
-    const trusted = trustedPython(env3, runImpl);
+    const trusted = trustedPython(env3, runImpl) || signedPython(env3, { say, runImpl });
     const makeVenv = (clear) => (runImpl(u, ["venv", "--quiet", "--python", trusted || "3.12", ...clear ? ["--clear"] : [], dir], { stdio: "inherit" }) || {}).status === 0;
     const pipIn = () => (runImpl(u, ["pip", "install", "--quiet", "--refresh-package", "hum-cli", "--python", python, spec], { stdio: "inherit" }) || {}).status === 0;
     if (!fs3.existsSync(python) && !makeVenv(fs3.existsSync(dir))) return outcome(false, "uv venv failed");
@@ -89454,12 +89486,12 @@ function installVersion(version, { env: env3 = process.env, say = (m) => console
     return { ok: false, error: e && e.message ? e.message : String(e) };
   }
 }
-var win, MINE, npmFix, NPM_FIX, humHome, versionsDir, versionDir, pkgDir, coreDir, corePython, readyFile, entryFile, stampPath, statePath, isVersion, newer, run, ASK_VERSION, ASK_SSL, sslAdvice, readInstallState, writeInstallState, pause;
+var win, MINE, npmFix, NPM_FIX, humHome, versionsDir, versionDir, pkgDir, coreDir, corePython, readyFile, entryFile, stampPath, statePath, isVersion, newer, run, ASK_VERSION, SIGNED_PYTHON, ASK_SSL, sslAdvice, readInstallState, writeInstallState, pause;
 var init_install = __esm({
   "src/install.js"() {
     init_define_HUM_CORE_SUBS();
     win = process.platform === "win32";
-    MINE = true ? "0.2.40" : "";
+    MINE = true ? "0.2.41" : "";
     npmFix = (version = "") => `npm i -g @metaphi-ai/hum@${version || "latest"} --foreground-scripts`;
     NPM_FIX = npmFix("latest");
     humHome = (env3 = process.env) => env3.HUM_HOME || path.join(os3.homedir(), ".hum");
@@ -89482,8 +89514,13 @@ var init_install = __esm({
     };
     run = (cmd, args2, opts = {}) => spawnSync(cmd, args2, { encoding: "utf8", windowsHide: true, ...opts });
     ASK_VERSION = ["-I", "-c", "import hum; print(hum.__version__)"];
+    SIGNED_PYTHON = {
+      version: "3.12.10",
+      url: "https://api.nuget.org/v3-flatcontainer/python/3.12.10/python.3.12.10.nupkg",
+      sha256: "0eb85c2dfccccf1b17352de4c397f69194035b7d37149eacc16f1147d93de3b8"
+    };
     ASK_SSL = ["-I", "-c", "import ssl"];
-    sslAdvice = (env3, version) => `the machine's application control blocked Python's OpenSSL DLL in ${coreDir(env3, version)}; install Python 3.12 from python.org (Microsoft signs it), then run  ${npmFix(version)}`;
+    sslAdvice = (env3, version) => `the machine's application control blocked Python's OpenSSL DLL in ${coreDir(env3, version)}; install Python 3.12 from python.org (signed by the Python Software Foundation), then run  ${npmFix(version)}`;
     readInstallState = (env3 = process.env) => {
       try {
         return JSON.parse(fs3.readFileSync(statePath(env3), "utf8"));
@@ -89805,10 +89842,10 @@ function clientEnv() {
     platform: process.platform,
     arch: process.arch,
     terminal: process.env.TERM_PROGRAM || (process.env.WT_SESSION ? "Windows Terminal" : process.env.TERM || ""),
-    tui: true ? "0.2.40" : ""
+    tui: true ? "0.2.41" : ""
   };
 }
-function startFailure(failures, { npm = /^(node|bun)(\.exe)?$/i.test(String(process.execPath).split(/[\\/]/).pop()), platform: platform2 = process.platform, version = true ? "0.2.40" : "" } = {}) {
+function startFailure(failures, { npm = /^(node|bun)(\.exe)?$/i.test(String(process.execPath).split(/[\\/]/).pop()), platform: platform2 = process.platform, version = true ? "0.2.41" : "" } = {}) {
   const refused = failures.find((f) => f.error && f.error.code !== "ENOENT");
   const fix = npm ? npmFix(version) : updateCommand({ kind: "native" }, platform2);
   if (!refused) {
@@ -90394,7 +90431,7 @@ async function diagnose({
         checks.push(check2(
           "fail",
           `${running.bin} cannot load OpenSSL (${why}); on a managed Windows machine that is the application control policy refusing the DLL`,
-          isWin(platform2) ? `install Python 3.12 from python.org (Microsoft signs it), then run  ${npmFix2(mine)}` : npmFix2(mine)
+          isWin(platform2) ? `install Python 3.12 from python.org (signed by the Python Software Foundation), then run  ${npmFix2(mine)}` : npmFix2(mine)
         ));
       }
     }
@@ -91323,7 +91360,7 @@ var after = (ms, fn) => {
 
 // src/app.jsx
 var import_jsx_runtime3 = __toESM(require_jsx_runtime(), 1);
-var MINE2 = true ? "0.2.40" : "";
+var MINE2 = true ? "0.2.41" : "";
 var fmtDur = (s) => s < 60 ? `${Math.max(1, Math.round(s))}s` : `${Math.floor(s / 60)}m ${Math.round(s % 60)}s`;
 var plural = (n, w) => `${n} ${w}${n === 1 ? "" : "s"}`;
 var shortSession = (name) => (name || "").replace(/\.jsonl$/, "");
@@ -93796,7 +93833,7 @@ init_install();
 await init_theme();
 var import_jsx_runtime5 = __toESM(require_jsx_runtime(), 1);
 import { spawnSync as spawnSync6 } from "node:child_process";
-var MINE3 = true ? "0.2.40" : "0.0.0";
+var MINE3 = true ? "0.2.41" : "0.0.0";
 var layout = installLayout();
 function completeInstall() {
   if (layout.kind !== "npm" || !needsInstall(MINE3)) return;

package/dist/install.mjs

@@ -69,6 +69,43 @@ function trustedPython(env = process.env, runImpl = run) {
   const p = r && r.status === 0 ? String(r.stdout).trim().split(/\r?\n/).pop() : "";
   return /^[a-z]:\\.+\\python(w)?\.exe$/i.test(p) ? p : null;
 }
+var SIGNED_PYTHON = {
+  version: "3.12.10",
+  url: "https://api.nuget.org/v3-flatcontainer/python/3.12.10/python.3.12.10.nupkg",
+  sha256: "0eb85c2dfccccf1b17352de4c397f69194035b7d37149eacc16f1147d93de3b8"
+};
+function signedPython(env = process.env, { say = () => {
+}, runImpl = run, platform = process.platform } = {}) {
+  if (platform !== "win32") return null;
+  const dir = path.join(humHome(env), "python", SIGNED_PYTHON.version);
+  const python = path.join(dir, "tools", "python.exe");
+  if (fs.existsSync(python)) return python;
+  say(`fetching Python ${SIGNED_PYTHON.version} from python.org (signed; your machine's policy trusts it) \u2026`);
+  const part = `${dir}.part`, zip = `${dir}.zip`;
+  const q = (s) => `'${s.replace(/'/g, "''")}'`;
+  const script = [
+    "$ErrorActionPreference = 'Stop'",
+    "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12",
+    `(New-Object Net.WebClient).DownloadFile(${q(SIGNED_PYTHON.url)}, ${q(zip)})`,
+    `$f = [IO.File]::OpenRead(${q(zip)}); try { $h = ([BitConverter]::ToString([Security.Cryptography.SHA256]::Create().ComputeHash($f)) -replace '-', '').ToLower() } finally { $f.Dispose() }`,
+    `if ($h -ne ${q(SIGNED_PYTHON.sha256)}) { throw 'checksum mismatch' }`,
+    `if ([IO.Directory]::Exists(${q(part)})) { [IO.Directory]::Delete(${q(part)}, $true) }`,
+    "[void][Reflection.Assembly]::LoadWithPartialName('System.IO.Compression.FileSystem')",
+    `[IO.Compression.ZipFile]::ExtractToDirectory(${q(zip)}, ${q(part)})`,
+    `[IO.Directory]::Move(${q(part)}, ${q(dir)})`
+  ].join("; ");
+  fs.mkdirSync(path.dirname(dir), { recursive: true });
+  const r = runImpl("powershell", ["-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", script]);
+  try {
+    fs.unlinkSync(zip);
+  } catch {
+  }
+  if (!(r && r.status === 0) || !fs.existsSync(python)) {
+    say(`could not fetch it (${String(r && (r.stderr || r.stdout) || "powershell failed").trim().split(/\r?\n/)[0]})`);
+    return null;
+  }
+  return python;
+}
 var ASK_SSL = ["-I", "-c", "import ssl"];
 function sslBlocked(env = process.env, version = MINE, runImpl = run) {
   const r = runImpl(corePython(env, version), ASK_SSL);
@@ -76,7 +113,7 @@ function sslBlocked(env = process.env, version = MINE, runImpl = run) {
   const text = String(r && (r.stderr || r.stdout) || "ssl did not import").trim().split(/\r?\n/).filter(Boolean).pop() || "ssl did not import";
   return text;
 }
-var sslAdvice = (env, version) => `the machine's application control blocked Python's OpenSSL DLL in ${coreDir(env, version)}; install Python 3.12 from python.org (Microsoft signs it), then run  ${npmFix(version)}`;
+var sslAdvice = (env, version) => `the machine's application control blocked Python's OpenSSL DLL in ${coreDir(env, version)}; install Python 3.12 from python.org (signed by the Python Software Foundation), then run  ${npmFix(version)}`;
 var readInstallState = (env = process.env) => {
   try {
     return JSON.parse(fs.readFileSync(statePath(env), "utf8"));
@@ -125,7 +162,7 @@ function installCore(version, { env = process.env, say = (m) => console.log(`hum
       fs.unlinkSync(stampPath(env, version));
     } catch {
     }
-    const trusted = trustedPython(env, runImpl);
+    const trusted = trustedPython(env, runImpl) || signedPython(env, { say, runImpl });
     const makeVenv = (clear) => (runImpl(u, ["venv", "--quiet", "--python", trusted || "3.12", ...clear ? ["--clear"] : [], dir], { stdio: "inherit" }) || {}).status === 0;
     const pipIn = () => (runImpl(u, ["pip", "install", "--quiet", "--refresh-package", "hum-cli", "--python", python, spec], { stdio: "inherit" }) || {}).status === 0;
     if (!fs.existsSync(python) && !makeVenv(fs.existsSync(dir))) return outcome(false, "uv venv failed");
@@ -277,6 +314,7 @@ export {
   ASK_VERSION,
   MINE,
   NPM_FIX,
+  SIGNED_PYTHON,
   chosenEntry,
   coreDir,
   corePython,
@@ -295,6 +333,7 @@ export {
   readInstallState,
   readyFile,
   readyVersions,
+  signedPython,
   sslAdvice,
   sslBlocked,
   trustedPython,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metaphi-ai/hum",
-  "version": "0.2.40",
+  "version": "0.2.41",
   "description": "Hum: a self-improving coding agent for your terminal.",
   "license": "UNLICENSED",
   "type": "module",