@metaphi-ai/hum 0.2.40 → 0.2.42

package/dist/cli.mjs

@@ -17,9 +17,9 @@ var __esm = (fn, res) => function __init() {
 var __commonJS = (cb, mod) => function __require2() {
   return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
 };
-var __export = (target, all) => {
+var __export = (target2, all) => {
   for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
+    __defProp(target2, name, { get: all[name], enumerable: true });
 };
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
@@ -29,12 +29,12 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+var __toESM = (mod, isNodeMode, target2) => (target2 = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
   // If the importer is in node compatibility mode or this is not an ESM
   // file that has been converted to a CommonJS file using a Babel-
   // compatible transform (i.e. "__esModule" has not been set), then set
   // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target2, "default", { value: mod, enumerable: true }) : target2,
   mod
 ));
 
@@ -6986,8 +6986,8 @@ var require_react_reconciler_production = __commonJS({
           var lane = concurrentQueues[i];
           concurrentQueues[i++] = null;
           if (null !== queue && null !== update) {
-            var pending = queue.pending;
-            null === pending ? update.next = update : (update.next = pending.next, pending.next = update);
+            var pending2 = queue.pending;
+            null === pending2 ? update.next = update : (update.next = pending2.next, pending2.next = update);
             queue.pending = update;
           }
           0 !== lane && markUpdateLaneFromFiberToRoot(fiber, update, lane);
@@ -7053,8 +7053,8 @@ var require_react_reconciler_production = __commonJS({
         if (null === updateQueue) return null;
         updateQueue = updateQueue.shared;
         if (0 !== (executionContext & 2)) {
-          var pending = updateQueue.pending;
-          null === pending ? update.next = update : (update.next = pending.next, pending.next = update);
+          var pending2 = updateQueue.pending;
+          null === pending2 ? update.next = update : (update.next = pending2.next, pending2.next = update);
           updateQueue.pending = update;
           update = getRootForUpdatedFiber(fiber);
           markUpdateLaneFromFiberToRoot(fiber, null, lane);
@@ -8133,8 +8133,8 @@ var require_react_reconciler_production = __commonJS({
       }
       function enqueueRenderPhaseUpdate(queue, update) {
         didScheduleRenderPhaseUpdateDuringThisPass = didScheduleRenderPhaseUpdate = true;
-        var pending = queue.pending;
-        null === pending ? update.next = update : (update.next = pending.next, pending.next = update);
+        var pending2 = queue.pending;
+        null === pending2 ? update.next = update : (update.next = pending2.next, pending2.next = update);
         queue.pending = update;
       }
       function entangleTransitionUpdate(root, queue, lane) {
@@ -13553,10 +13553,10 @@ var require_react_reconciler_development = __commonJS({
           fiber = fiber.next, id--;
         return fiber;
       }
-      function copyWithSetImpl(obj, path9, index, value) {
-        if (index >= path9.length) return value;
-        var key = path9[index], updated = isArrayImpl(obj) ? obj.slice() : assign({}, obj);
-        updated[key] = copyWithSetImpl(obj[key], path9, index + 1, value);
+      function copyWithSetImpl(obj, path10, index, value) {
+        if (index >= path10.length) return value;
+        var key = path10[index], updated = isArrayImpl(obj) ? obj.slice() : assign({}, obj);
+        updated[key] = copyWithSetImpl(obj[key], path10, index + 1, value);
         return updated;
       }
       function copyWithRename(obj, oldPath, newPath) {
@@ -13583,11 +13583,11 @@ var require_react_reconciler_development = __commonJS({
         );
         return updated;
       }
-      function copyWithDeleteImpl(obj, path9, index) {
-        var key = path9[index], updated = isArrayImpl(obj) ? obj.slice() : assign({}, obj);
-        if (index + 1 === path9.length)
+      function copyWithDeleteImpl(obj, path10, index) {
+        var key = path10[index], updated = isArrayImpl(obj) ? obj.slice() : assign({}, obj);
+        if (index + 1 === path10.length)
           return isArrayImpl(updated) ? updated.splice(key, 1) : delete updated[key], updated;
-        updated[key] = copyWithDeleteImpl(obj[key], path9, index + 1);
+        updated[key] = copyWithDeleteImpl(obj[key], path10, index + 1);
         return updated;
       }
       function shouldSuspendImpl() {
@@ -16899,8 +16899,8 @@ var require_react_reconciler_development = __commonJS({
           var lane = concurrentQueues[i];
           concurrentQueues[i++] = null;
           if (null !== queue && null !== update) {
-            var pending = queue.pending;
-            null === pending ? update.next = update : (update.next = pending.next, pending.next = update);
+            var pending2 = queue.pending;
+            null === pending2 ? update.next = update : (update.next = pending2.next, pending2.next = update);
             queue.pending = update;
           }
           0 !== lane && markUpdateLaneFromFiberToRoot(fiber, update, lane);
@@ -18492,8 +18492,8 @@ var require_react_reconciler_development = __commonJS({
       }
       function enqueueRenderPhaseUpdate(queue, update) {
         didScheduleRenderPhaseUpdateDuringThisPass = didScheduleRenderPhaseUpdate = true;
-        var pending = queue.pending;
-        null === pending ? update.next = update : (update.next = pending.next, pending.next = update);
+        var pending2 = queue.pending;
+        null === pending2 ? update.next = update : (update.next = pending2.next, pending2.next = update);
         queue.pending = update;
       }
       function entangleTransitionUpdate(root, queue, lane) {
@@ -26864,29 +26864,29 @@ var require_react_reconciler_development = __commonJS({
       var didWarnAboutNestedUpdates = false;
       var didWarnAboutFindNodeInStrictMode = {};
       var overrideHookState = null, overrideHookStateDeletePath = null, overrideHookStateRenamePath = null, overrideProps = null, overridePropsDeletePath = null, overridePropsRenamePath = null, scheduleUpdate = null, scheduleRetry = null, setErrorHandler = null, setSuspenseHandler = null;
-      overrideHookState = function(fiber, id, path9, value) {
+      overrideHookState = function(fiber, id, path10, value) {
         id = findHook(fiber, id);
-        null !== id && (path9 = copyWithSetImpl(id.memoizedState, path9, 0, value), id.memoizedState = path9, id.baseState = path9, fiber.memoizedProps = assign({}, fiber.memoizedProps), path9 = enqueueConcurrentRenderForLane(fiber, 2), null !== path9 && scheduleUpdateOnFiber(path9, fiber, 2));
+        null !== id && (path10 = copyWithSetImpl(id.memoizedState, path10, 0, value), id.memoizedState = path10, id.baseState = path10, fiber.memoizedProps = assign({}, fiber.memoizedProps), path10 = enqueueConcurrentRenderForLane(fiber, 2), null !== path10 && scheduleUpdateOnFiber(path10, fiber, 2));
       };
-      overrideHookStateDeletePath = function(fiber, id, path9) {
+      overrideHookStateDeletePath = function(fiber, id, path10) {
         id = findHook(fiber, id);
-        null !== id && (path9 = copyWithDeleteImpl(id.memoizedState, path9, 0), id.memoizedState = path9, id.baseState = path9, fiber.memoizedProps = assign({}, fiber.memoizedProps), path9 = enqueueConcurrentRenderForLane(fiber, 2), null !== path9 && scheduleUpdateOnFiber(path9, fiber, 2));
+        null !== id && (path10 = copyWithDeleteImpl(id.memoizedState, path10, 0), id.memoizedState = path10, id.baseState = path10, fiber.memoizedProps = assign({}, fiber.memoizedProps), path10 = enqueueConcurrentRenderForLane(fiber, 2), null !== path10 && scheduleUpdateOnFiber(path10, fiber, 2));
       };
       overrideHookStateRenamePath = function(fiber, id, oldPath, newPath) {
         id = findHook(fiber, id);
         null !== id && (oldPath = copyWithRename(id.memoizedState, oldPath, newPath), id.memoizedState = oldPath, id.baseState = oldPath, fiber.memoizedProps = assign({}, fiber.memoizedProps), oldPath = enqueueConcurrentRenderForLane(fiber, 2), null !== oldPath && scheduleUpdateOnFiber(oldPath, fiber, 2));
       };
-      overrideProps = function(fiber, path9, value) {
-        fiber.pendingProps = copyWithSetImpl(fiber.memoizedProps, path9, 0, value);
+      overrideProps = function(fiber, path10, value) {
+        fiber.pendingProps = copyWithSetImpl(fiber.memoizedProps, path10, 0, value);
         fiber.alternate && (fiber.alternate.pendingProps = fiber.pendingProps);
-        path9 = enqueueConcurrentRenderForLane(fiber, 2);
-        null !== path9 && scheduleUpdateOnFiber(path9, fiber, 2);
+        path10 = enqueueConcurrentRenderForLane(fiber, 2);
+        null !== path10 && scheduleUpdateOnFiber(path10, fiber, 2);
       };
-      overridePropsDeletePath = function(fiber, path9) {
-        fiber.pendingProps = copyWithDeleteImpl(fiber.memoizedProps, path9, 0);
+      overridePropsDeletePath = function(fiber, path10) {
+        fiber.pendingProps = copyWithDeleteImpl(fiber.memoizedProps, path10, 0);
         fiber.alternate && (fiber.alternate.pendingProps = fiber.pendingProps);
-        path9 = enqueueConcurrentRenderForLane(fiber, 2);
-        null !== path9 && scheduleUpdateOnFiber(path9, fiber, 2);
+        path10 = enqueueConcurrentRenderForLane(fiber, 2);
+        null !== path10 && scheduleUpdateOnFiber(path10, fiber, 2);
       };
       overridePropsRenamePath = function(fiber, oldPath, newPath) {
         fiber.pendingProps = copyWithRename(
@@ -27243,11 +27243,11 @@ var require_react_reconciler_development = __commonJS({
       exports2.observeVisibleRects = function(hostRoot, selectors, callback, options2) {
         function commitHook() {
           var nextInstanceRoots = findAllNodes(hostRoot, selectors);
-          instanceRoots.forEach(function(target) {
-            0 > nextInstanceRoots.indexOf(target) && unobserve(target);
+          instanceRoots.forEach(function(target2) {
+            0 > nextInstanceRoots.indexOf(target2) && unobserve(target2);
           });
-          nextInstanceRoots.forEach(function(target) {
-            0 > instanceRoots.indexOf(target) && observe(target);
+          nextInstanceRoots.forEach(function(target2) {
+            0 > instanceRoots.indexOf(target2) && observe(target2);
           });
         }
         if (!supportsTestSelectors)
@@ -29600,17 +29600,17 @@ var require_buffer_util = __commonJS({
     function concat(list2, totalLength) {
       if (list2.length === 0) return EMPTY_BUFFER;
       if (list2.length === 1) return list2[0];
-      const target = Buffer.allocUnsafe(totalLength);
+      const target2 = Buffer.allocUnsafe(totalLength);
       let offset = 0;
       for (let i = 0; i < list2.length; i++) {
         const buf = list2[i];
-        target.set(buf, offset);
+        target2.set(buf, offset);
         offset += buf.length;
       }
       if (offset < totalLength) {
-        return new FastBuffer(target.buffer, target.byteOffset, offset);
+        return new FastBuffer(target2.buffer, target2.byteOffset, offset);
       }
-      return target;
+      return target2;
     }
     function _mask(source, mask, output, offset, length) {
       for (let i = 0; i < length; i++) {
@@ -31039,29 +31039,29 @@ var require_sender = __commonJS({
           offset += 2;
           payloadLength = 126;
         }
-        const target = Buffer.allocUnsafe(merge ? dataLength + offset : offset);
-        target[0] = options2.fin ? options2.opcode | 128 : options2.opcode;
-        if (options2.rsv1) target[0] |= 64;
-        target[1] = payloadLength;
+        const target2 = Buffer.allocUnsafe(merge ? dataLength + offset : offset);
+        target2[0] = options2.fin ? options2.opcode | 128 : options2.opcode;
+        if (options2.rsv1) target2[0] |= 64;
+        target2[1] = payloadLength;
         if (payloadLength === 126) {
-          target.writeUInt16BE(dataLength, 2);
+          target2.writeUInt16BE(dataLength, 2);
         } else if (payloadLength === 127) {
-          target[2] = target[3] = 0;
-          target.writeUIntBE(dataLength, 4, 6);
-        }
-        if (!options2.mask) return [target, data];
-        target[1] |= 128;
-        target[offset - 4] = mask[0];
-        target[offset - 3] = mask[1];
-        target[offset - 2] = mask[2];
-        target[offset - 1] = mask[3];
-        if (skipMasking) return [target, data];
+          target2[2] = target2[3] = 0;
+          target2.writeUIntBE(dataLength, 4, 6);
+        }
+        if (!options2.mask) return [target2, data];
+        target2[1] |= 128;
+        target2[offset - 4] = mask[0];
+        target2[offset - 3] = mask[1];
+        target2[offset - 2] = mask[2];
+        target2[offset - 1] = mask[3];
+        if (skipMasking) return [target2, data];
         if (merge) {
-          applyMask(data, mask, target, offset, dataLength);
-          return [target];
+          applyMask(data, mask, target2, offset, dataLength);
+          return [target2];
         }
         applyMask(data, mask, data, 0, dataLength);
-        return [target, data];
+        return [target2, data];
       }
       /**
        * Sends a close message to the other peer.
@@ -33379,8 +33379,8 @@ var init_devtools = __esm({
 // node_modules/ink/build/reconciler.js
 import process4 from "node:process";
 async function loadPackageJson() {
-  const fs10 = await import("node:fs");
-  const content = fs10.readFileSync(new URL("../package.json", import.meta.url), "utf8");
+  const fs11 = await import("node:fs");
+  const content = fs11.readFileSync(new URL("../package.json", import.meta.url), "utf8");
   const parsedContent = JSON.parse(content);
   return {
     name: parsedContent?.name,
@@ -35826,26 +35826,26 @@ var init_input_parser = __esm({
       };
     };
     createInputParser = () => {
-      let pending = "";
+      let pending2 = "";
       return {
         push(chunk) {
-          const parsedInput = parseKeypresses(pending + chunk);
-          pending = parsedInput.pending;
+          const parsedInput = parseKeypresses(pending2 + chunk);
+          pending2 = parsedInput.pending;
           return parsedInput.events;
         },
         hasPendingEscape() {
-          return pending.startsWith(escape) && !pending.startsWith(pasteStart) && pending !== "\x1B[200";
+          return pending2.startsWith(escape) && !pending2.startsWith(pasteStart) && pending2 !== "\x1B[200";
         },
         flushPendingEscape() {
-          if (!pending.startsWith(escape)) {
+          if (!pending2.startsWith(escape)) {
             return void 0;
           }
-          const pendingEscape = pending;
-          pending = "";
+          const pendingEscape = pending2;
+          pending2 = "";
           return pendingEscape;
         },
         reset() {
-          pending = "";
+          pending2 = "";
         }
       };
     };
@@ -36552,8 +36552,8 @@ var init_ErrorOverview = __esm({
     init_dist3();
     init_Box();
     init_Text();
-    cleanupPath = (path9) => {
-      return path9?.replace(`file://${cwd()}/`, "");
+    cleanupPath = (path10) => {
+      return path10?.replace(`file://${cwd()}/`, "");
     };
     stackUtils = new import_stack_utils.default({
       cwd: cwd(),
@@ -43370,7 +43370,7 @@ var require_supports_colors = __commonJS({
   "node_modules/@colors/colors/lib/system/supports-colors.js"(exports, module) {
     "use strict";
     init_define_HUM_CORE_SUBS();
-    var os9 = __require("os");
+    var os10 = __require("os");
     var hasFlag2 = require_has_flag();
     var env3 = process.env;
     var forceColor = void 0;
@@ -43408,7 +43408,7 @@ var require_supports_colors = __commonJS({
       }
       var min = forceColor ? 1 : 0;
       if (process.platform === "win32") {
-        var osRelease = os9.release().split(".");
+        var osRelease = os10.release().split(".");
         if (Number(process.versions.node.split(".")[0]) >= 8 && Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) {
           return Number(osRelease[2]) >= 14931 ? 3 : 2;
         }
@@ -87728,15 +87728,15 @@ var require_route = __commonJS({
       };
     }
     function wrapConversion(toModel, graph) {
-      const path9 = [graph[toModel].parent, toModel];
+      const path10 = [graph[toModel].parent, toModel];
       let fn = conversions[graph[toModel].parent][toModel];
       let cur = graph[toModel].parent;
       while (graph[cur].parent) {
-        path9.unshift(graph[cur].parent);
+        path10.unshift(graph[cur].parent);
         fn = link3(conversions[graph[cur].parent][cur], fn);
         cur = graph[cur].parent;
       }
-      fn.conversion = path9;
+      fn.conversion = path10;
       return fn;
     }
     module.exports = function(fromModel) {
@@ -87980,7 +87980,7 @@ var require_supports_color = __commonJS({
   "node_modules/supports-color/index.js"(exports, module) {
     "use strict";
     init_define_HUM_CORE_SUBS();
-    var os9 = __require("os");
+    var os10 = __require("os");
     var tty3 = __require("tty");
     var hasFlag2 = require_has_flag2();
     var { env: env3 } = process;
@@ -88028,7 +88028,7 @@ var require_supports_color = __commonJS({
         return min;
       }
       if (process.platform === "win32") {
-        const osRelease = os9.release().split(".");
+        const osRelease = os10.release().split(".");
         if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) {
           return Number(osRelease[2]) >= 14931 ? 3 : 2;
         }
@@ -89291,6 +89291,38 @@ function trustedPython(env3 = process.env, runImpl = run) {
   const p = r && r.status === 0 ? String(r.stdout).trim().split(/\r?\n/).pop() : "";
   return /^[a-z]:\\.+\\python(w)?\.exe$/i.test(p) ? p : null;
 }
+function signedPython(env3 = process.env, { say = () => {
+}, runImpl = run, platform: platform2 = process.platform } = {}) {
+  if (platform2 !== "win32") return null;
+  const dir = path.join(humHome(env3), "python", SIGNED_PYTHON.version);
+  const python = path.join(dir, "tools", "python.exe");
+  if (fs3.existsSync(python)) return python;
+  say(`fetching Python ${SIGNED_PYTHON.version} from python.org (signed; your machine's policy trusts it) \u2026`);
+  const part = `${dir}.part`, zip = `${dir}.zip`;
+  const q = (s) => `'${s.replace(/'/g, "''")}'`;
+  const script = [
+    "$ErrorActionPreference = 'Stop'",
+    "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12",
+    `(New-Object Net.WebClient).DownloadFile(${q(SIGNED_PYTHON.url)}, ${q(zip)})`,
+    `$f = [IO.File]::OpenRead(${q(zip)}); try { $h = ([BitConverter]::ToString([Security.Cryptography.SHA256]::Create().ComputeHash($f)) -replace '-', '').ToLower() } finally { $f.Dispose() }`,
+    `if ($h -ne ${q(SIGNED_PYTHON.sha256)}) { throw 'checksum mismatch' }`,
+    `if ([IO.Directory]::Exists(${q(part)})) { [IO.Directory]::Delete(${q(part)}, $true) }`,
+    "[void][Reflection.Assembly]::LoadWithPartialName('System.IO.Compression.FileSystem')",
+    `[IO.Compression.ZipFile]::ExtractToDirectory(${q(zip)}, ${q(part)})`,
+    `[IO.Directory]::Move(${q(part)}, ${q(dir)})`
+  ].join("; ");
+  fs3.mkdirSync(path.dirname(dir), { recursive: true });
+  const r = runImpl("powershell", ["-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", script]);
+  try {
+    fs3.unlinkSync(zip);
+  } catch {
+  }
+  if (!(r && r.status === 0) || !fs3.existsSync(python)) {
+    say(`could not fetch it (${String(r && (r.stderr || r.stdout) || "powershell failed").trim().split(/\r?\n/)[0]})`);
+    return null;
+  }
+  return python;
+}
 function sslBlocked(env3 = process.env, version = MINE, runImpl = run) {
   const r = runImpl(corePython(env3, version), ASK_SSL);
   if (r && r.status === 0) return null;
@@ -89331,7 +89363,7 @@ function installCore(version, { env: env3 = process.env, say = (m) => console.lo
       fs3.unlinkSync(stampPath(env3, version));
     } catch {
     }
-    const trusted = trustedPython(env3, runImpl);
+    const trusted = trustedPython(env3, runImpl) || signedPython(env3, { say, runImpl });
     const makeVenv = (clear) => (runImpl(u, ["venv", "--quiet", "--python", trusted || "3.12", ...clear ? ["--clear"] : [], dir], { stdio: "inherit" }) || {}).status === 0;
     const pipIn = () => (runImpl(u, ["pip", "install", "--quiet", "--refresh-package", "hum-cli", "--python", python, spec], { stdio: "inherit" }) || {}).status === 0;
     if (!fs3.existsSync(python) && !makeVenv(fs3.existsSync(dir))) return outcome(false, "uv venv failed");
@@ -89420,6 +89452,23 @@ function prune(env3 = process.env, { keep = MINE, say = () => {
   }
   return gone.sort((a, b) => newer(a, b) ? -1 : newer(b, a) ? 1 : 0);
 }
+function ownInstaller(env3 = process.env, version = MINE, execPath = process.execPath) {
+  if (version === MINE || !/^node(\.exe)?$/i.test(path.basename(execPath))) return null;
+  const p = path.join(pkgDir(env3, version), "dist", "install.mjs");
+  return fs3.existsSync(p) ? p : null;
+}
+function buildCore(version, { env: env3 = process.env, say = (m) => console.log(`hum: ${m}`), runImpl = run, now = Date.now(), execPath = process.execPath } = {}) {
+  const theirs = ownInstaller(env3, version, execPath);
+  if (theirs) {
+    const r = runImpl(execPath, [theirs, "core", version], { stdio: "inherit", env: env3 }) || {};
+    if (r.status !== 0) {
+      const s = readInstallState(env3);
+      return { ok: false, version, error: s && s.wanted === version && s.error || `hum ${version}'s installer did not finish` };
+    }
+    if (installedVersion(env3, version, runImpl) === version) return { ok: true, version, error: null };
+  }
+  return installCore(version, { env: env3, say, runImpl, now });
+}
 function installVersion(version, { env: env3 = process.env, say = (m) => console.log(`hum: ${m}`), runImpl = run, now = Date.now(), retries = 0, every = 90 * 1e3, wait = pause } = {}) {
   if (!isVersion(version)) return { ok: false, error: `not a version: ${version}` };
   try {
@@ -89442,7 +89491,7 @@ function installVersion(version, { env: env3 = process.env, say = (m) => console
       if (!p.ok) return p;
     }
     if (installedVersion(env3, version, runImpl) !== version) {
-      const c = attempt2("the part of hum that does the work", () => installCore(version, { env: env3, say, runImpl, now }));
+      const c = attempt2("the part of hum that does the work", () => buildCore(version, { env: env3, say, runImpl, now }));
       if (!c.ok) return { ok: false, error: c.error };
     }
     fs3.writeFileSync(readyFile(env3, version), `${version}
@@ -89454,12 +89503,12 @@ function installVersion(version, { env: env3 = process.env, say = (m) => console
     return { ok: false, error: e && e.message ? e.message : String(e) };
   }
 }
-var win, MINE, npmFix, NPM_FIX, humHome, versionsDir, versionDir, pkgDir, coreDir, corePython, readyFile, entryFile, stampPath, statePath, isVersion, newer, run, ASK_VERSION, ASK_SSL, sslAdvice, readInstallState, writeInstallState, pause;
+var win, MINE, npmFix, NPM_FIX, humHome, versionsDir, versionDir, pkgDir, coreDir, corePython, readyFile, entryFile, stampPath, statePath, isVersion, newer, run, ASK_VERSION, SIGNED_PYTHON, ASK_SSL, sslAdvice, readInstallState, writeInstallState, pause;
 var init_install = __esm({
   "src/install.js"() {
     init_define_HUM_CORE_SUBS();
     win = process.platform === "win32";
-    MINE = true ? "0.2.40" : "";
+    MINE = true ? "0.2.42" : "";
     npmFix = (version = "") => `npm i -g @metaphi-ai/hum@${version || "latest"} --foreground-scripts`;
     NPM_FIX = npmFix("latest");
     humHome = (env3 = process.env) => env3.HUM_HOME || path.join(os3.homedir(), ".hum");
@@ -89482,8 +89531,13 @@ var init_install = __esm({
     };
     run = (cmd, args2, opts = {}) => spawnSync(cmd, args2, { encoding: "utf8", windowsHide: true, ...opts });
     ASK_VERSION = ["-I", "-c", "import hum; print(hum.__version__)"];
+    SIGNED_PYTHON = {
+      version: "3.12.10",
+      url: "https://api.nuget.org/v3-flatcontainer/python/3.12.10/python.3.12.10.nupkg",
+      sha256: "0eb85c2dfccccf1b17352de4c397f69194035b7d37149eacc16f1147d93de3b8"
+    };
     ASK_SSL = ["-I", "-c", "import ssl"];
-    sslAdvice = (env3, version) => `the machine's application control blocked Python's OpenSSL DLL in ${coreDir(env3, version)}; install Python 3.12 from python.org (Microsoft signs it), then run  ${npmFix(version)}`;
+    sslAdvice = (env3, version) => `the machine's application control blocked Python's OpenSSL DLL in ${coreDir(env3, version)}; install Python 3.12 from python.org (signed by the Python Software Foundation), then run  ${npmFix(version)}`;
     readInstallState = (env3 = process.env) => {
       try {
         return JSON.parse(fs3.readFileSync(statePath(env3), "utf8"));
@@ -89504,6 +89558,10 @@ var init_install = __esm({
       } catch {
       }
     };
+    if (process.argv[1] && /install\.mjs$/.test(process.argv[1]) && process.argv[2] === "core") {
+      const r = installCore(process.argv[3] || "");
+      process.exit(r.ok ? 0 : 1);
+    }
     if (process.argv[1] && /install\.mjs$/.test(process.argv[1]) && process.argv[2] === "install") {
       const log = path.join(humHome(), "update.log");
       const say = (m) => {
@@ -89805,10 +89863,10 @@ function clientEnv() {
     platform: process.platform,
     arch: process.arch,
     terminal: process.env.TERM_PROGRAM || (process.env.WT_SESSION ? "Windows Terminal" : process.env.TERM || ""),
-    tui: true ? "0.2.40" : ""
+    tui: true ? "0.2.42" : ""
   };
 }
-function startFailure(failures, { npm = /^(node|bun)(\.exe)?$/i.test(String(process.execPath).split(/[\\/]/).pop()), platform: platform2 = process.platform, version = true ? "0.2.40" : "" } = {}) {
+function startFailure(failures, { npm = /^(node|bun)(\.exe)?$/i.test(String(process.execPath).split(/[\\/]/).pop()), platform: platform2 = process.platform, version = true ? "0.2.42" : "" } = {}) {
   const refused = failures.find((f) => f.error && f.error.code !== "ENOENT");
   const fix = npm ? npmFix(version) : updateCommand({ kind: "native" }, platform2);
   if (!refused) {
@@ -90356,9 +90414,9 @@ async function diagnose({
       const launcher = isWin(platform2) ? path8.join(env3.LOCALAPPDATA || path8.join(homedir, "AppData", "Local"), "hum", "bin", "hum.cmd") : path8.join(homedir, ".local", "bin", "hum");
       if (!exists2(launcher)) checks.push(check2("warn", `no launcher at ${launcher}`, updateCommand(layout2, platform2)));
       else {
-        const target = isWin(platform2) ? (fs9.readFileSync(launcher, "utf8").match(new RegExp('"([^"]+)"')) || [])[1] || "" : realpath(launcher);
-        const insideVersions = target && realpath(target).startsWith(realpath(layout2.base));
-        checks.push(insideVersions ? check2("ok", `launcher ${launcher} \u2192 ${target}`) : check2("warn", `launcher ${launcher} is not the installer's (it points at ${target || "?"})`, updateCommand(layout2, platform2)));
+        const target2 = isWin(platform2) ? (fs9.readFileSync(launcher, "utf8").match(new RegExp('"([^"]+)"')) || [])[1] || "" : realpath(launcher);
+        const insideVersions = target2 && realpath(target2).startsWith(realpath(layout2.base));
+        checks.push(insideVersions ? check2("ok", `launcher ${launcher} \u2192 ${target2}`) : check2("warn", `launcher ${launcher} is not the installer's (it points at ${target2 || "?"})`, updateCommand(layout2, platform2)));
       }
     }
     const hits = onPath(env3, { platform: platform2 });
@@ -90394,7 +90452,7 @@ async function diagnose({
         checks.push(check2(
           "fail",
           `${running.bin} cannot load OpenSSL (${why}); on a managed Windows machine that is the application control policy refusing the DLL`,
-          isWin(platform2) ? `install Python 3.12 from python.org (Microsoft signs it), then run  ${npmFix2(mine)}` : npmFix2(mine)
+          isWin(platform2) ? `install Python 3.12 from python.org (signed by the Python Software Foundation), then run  ${npmFix2(mine)}` : npmFix2(mine)
         ));
       }
     }
@@ -90517,21 +90575,21 @@ function sandboxCheck(platform2, env3) {
   if (restricted) return check2("warn", "bubblewrap is installed but unprivileged user namespaces are restricted", "sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0");
   return check2("ok", `sandbox: bubblewrap (${bwrap})`);
 }
-function render2(report) {
+function render2(report2) {
   const out = [];
-  for (const s of report.sections) {
+  for (const s of report2.sections) {
     out.push(s.title);
     for (const c of s.checks) out.push(`  ${MARK[c.status]}  ${c.text}${c.fix ? `
           \u2192 ${c.fix}` : ""}`);
     out.push("");
   }
-  out.push(`${report.summary.ok} ok \xB7 ${report.summary.warn} warn \xB7 ${report.summary.fail} fail`);
+  out.push(`${report2.summary.ok} ok \xB7 ${report2.summary.warn} warn \xB7 ${report2.summary.fail} fail`);
   return out.join("\n") + "\n";
 }
 async function doctor({ json = false, mine, write = (t) => process.stdout.write(t), ...opts } = {}) {
-  const report = await diagnose({ mine, ...opts });
-  write(json ? JSON.stringify(report, null, 2) + "\n" : render2(report));
-  return report.summary.fail ? 1 : 0;
+  const report2 = await diagnose({ mine, ...opts });
+  write(json ? JSON.stringify(report2, null, 2) + "\n" : render2(report2));
+  return report2.summary.fail ? 1 : 0;
 }
 var isWin, npmFix2, exists2, realpath, tail, check2, PARSE_CONFIG, MARK;
 var init_doctor = __esm({
@@ -91323,7 +91381,7 @@ var after = (ms, fn) => {
 
 // src/app.jsx
 var import_jsx_runtime3 = __toESM(require_jsx_runtime(), 1);
-var MINE2 = true ? "0.2.40" : "";
+var MINE2 = true ? "0.2.42" : "";
 var fmtDur = (s) => s < 60 ? `${Math.max(1, Math.round(s))}s` : `${Math.floor(s / 60)}m ${Math.round(s % 60)}s`;
 var plural = (n, w) => `${n} ${w}${n === 1 ? "" : "s"}`;
 var shortSession = (name) => (name || "").replace(/\.jsonl$/, "");
@@ -93793,10 +93851,114 @@ ${r.content}`).join("\n\n") };
 init_core();
 init_update();
 init_install();
+
+// src/health.js
+init_define_HUM_CORE_SUBS();
+init_install();
+import crypto2 from "node:crypto";
+import fs10 from "node:fs";
+import os9 from "node:os";
+import path9 from "node:path";
+var RETRY_MS2 = 60 * 60 * 1e3;
+var SEND_TIMEOUT_MS = 5e3;
+var DOCTOR_TIMEOUT_MS = 3e4;
+var readJson = (p) => {
+  try {
+    return JSON.parse(fs10.readFileSync(p, "utf8"));
+  } catch {
+    return null;
+  }
+};
+var writeJson = (p, v) => {
+  try {
+    fs10.mkdirSync(path9.dirname(p), { recursive: true });
+    fs10.writeFileSync(p, JSON.stringify(v));
+  } catch {
+  }
+};
+function installId(env3 = process.env) {
+  const p = path9.join(humHome(env3), "install-id");
+  try {
+    const id2 = fs10.readFileSync(p, "utf8").trim();
+    if (id2) return id2;
+  } catch {
+  }
+  const id = crypto2.randomUUID();
+  try {
+    fs10.mkdirSync(path9.dirname(p), { recursive: true });
+    fs10.writeFileSync(p, `${id}
+`);
+  } catch {
+  }
+  return id;
+}
+function pending(env3 = process.env, { now = Date.now(), start = null } = {}) {
+  const home = humHome(env3);
+  const sent = readJson(path9.join(home, "health.json")) || {};
+  const found = [];
+  const install = readJson(path9.join(home, "core-install.json"));
+  if (install && install.ok === false && install.at) found.push({ kind: "install", at: install.at, error: install.error || "", wanted: install.wanted || install.version || "" });
+  const core2 = readJson(path9.join(home, "failure.json"));
+  if (core2 && core2.at) found.push({ kind: "core", at: core2.at, error: `${core2.code}: ${core2.message}`, command: core2.command || "", core: core2.version || "" });
+  if (start) found.push({ kind: "start", at: now, error: start });
+  return found.filter((f) => {
+    const s = sent[f.kind] || {};
+    return f.at > (s.at || 0) && (!s.tried || now - s.tried >= RETRY_MS2);
+  }).sort((a, b) => a.at - b.at);
+}
+function target(env3) {
+  const cred = readJson(path9.join(humHome(env3), "credentials.json")) || {};
+  const url = (env3.HUM_AUTH_URL || cred.auth_url || "https://hum.metaphi.ai").replace(/\/+$/, "");
+  return { url, token: cred.access_token || "" };
+}
+async function sendPending({
+  env: env3 = process.env,
+  mine = "",
+  start = null,
+  now = Date.now(),
+  fetchImpl = globalThis.fetch,
+  diagnoseImpl = null
+} = {}) {
+  try {
+    const due = pending(env3, { now, start });
+    if (!due.length || typeof fetchImpl !== "function") return 0;
+    const diag = diagnoseImpl || (async (o) => (await Promise.resolve().then(() => (init_doctor(), doctor_exports))).diagnose(o));
+    const doctor2 = await Promise.race([
+      diag({ env: env3, mine }).catch((e) => ({ error: String(e && e.message ? e.message : e) })),
+      new Promise((resolve) => setTimeout(() => resolve({ error: "doctor did not finish in time" }), DOCTOR_TIMEOUT_MS).unref())
+    ]);
+    const { url, token: token2 } = target(env3);
+    const statePath2 = path9.join(humHome(env3), "health.json");
+    const state = readJson(statePath2) || {};
+    let sent = 0;
+    for (const f of due) {
+      const body = { ...f, version: mine, platform: `${process.platform}-${process.arch}`, os: os9.release(), install: installId(env3), doctor: doctor2 };
+      let ok = false;
+      try {
+        const r = await fetchImpl(`${url}/health`, {
+          method: "POST",
+          body: JSON.stringify(body),
+          signal: AbortSignal.timeout(SEND_TIMEOUT_MS),
+          headers: { "Content-Type": "application/json", "X-Hum-Client": `hum-cli/${mine}`, ...token2 ? { Authorization: `Bearer ${token2}` } : {} }
+        });
+        ok = !!(r && r.ok);
+      } catch {
+      }
+      state[f.kind] = ok ? { at: f.at, tried: now } : { ...state[f.kind] || {}, tried: now };
+      if (ok) sent += 1;
+    }
+    writeJson(statePath2, state);
+    return sent;
+  } catch {
+    return 0;
+  }
+}
+
+// src/cli.jsx
 await init_theme();
 var import_jsx_runtime5 = __toESM(require_jsx_runtime(), 1);
 import { spawnSync as spawnSync6 } from "node:child_process";
-var MINE3 = true ? "0.2.40" : "0.0.0";
+var MINE3 = true ? "0.2.42" : "0.0.0";
 var layout = installLayout();
 function completeInstall() {
   if (layout.kind !== "npm" || !needsInstall(MINE3)) return;
@@ -93806,6 +93968,7 @@ function completeInstall() {
   const r = installCore(MINE3, { say });
   if (!r.ok) say(`the update did not finish: ${r.error} \xB7 ${npmFix(MINE3)}`);
 }
+var report = (start = null) => sendPending({ mine: MINE3, start });
 var CORE_COMMANDS = new Set(typeof define_HUM_CORE_SUBS_default === "undefined" ? [] : define_HUM_CORE_SUBS_default);
 var argv0 = process.argv.slice(2);
 if (argv0[0] === "--version" || argv0[0] === "-V") {
@@ -93828,14 +93991,19 @@ if (CORE_COMMANDS.has(argv0[0]) || argv0[0] === "agents" && argv0.includes("--js
   completeInstall();
   const cmd = coreCommand(argv0);
   if (!cmd) {
-    process.stderr.write(startFailure([]) + "\n");
+    const why = startFailure([]);
+    process.stderr.write(why + "\n");
+    await report(why);
     process.exit(1);
   }
   const r = spawnSync6(cmd.bin, cmd.args, { stdio: "inherit", windowsHide: true });
   if (r.error) {
-    process.stderr.write(startFailure([{ bin: cmd.bin, error: r.error }]) + "\n");
+    const why = startFailure([{ bin: cmd.bin, error: r.error }]);
+    process.stderr.write(why + "\n");
+    await report(why);
     process.exit(1);
   }
+  await report();
   process.exit(r.status === null ? 1 : r.status);
 }
 setTheme(await detectTheme());
@@ -93904,6 +94072,7 @@ var startedHere = false;
 try {
   if (!port) {
     completeInstall();
+    await report();
     const rec = await startSession(args.cwd, { task: args.task, images: args.images, resume: args.resume && args.resume !== "pick" ? args.resume : null });
     startedHere = true;
     port = rec.port;
@@ -93912,6 +94081,7 @@ try {
 } catch (exc) {
   if (exc instanceof EngineError) {
     if (exc.message) process.stderr.write(exc.message + "\n");
+    if (exc.exit === 1 || exc.exit === 3) await report(exc.message || "the session did not start");
     process.exit(exc.exit);
   }
   throw exc;

package/dist/install.mjs

@@ -69,6 +69,43 @@ function trustedPython(env = process.env, runImpl = run) {
   const p = r && r.status === 0 ? String(r.stdout).trim().split(/\r?\n/).pop() : "";
   return /^[a-z]:\\.+\\python(w)?\.exe$/i.test(p) ? p : null;
 }
+var SIGNED_PYTHON = {
+  version: "3.12.10",
+  url: "https://api.nuget.org/v3-flatcontainer/python/3.12.10/python.3.12.10.nupkg",
+  sha256: "0eb85c2dfccccf1b17352de4c397f69194035b7d37149eacc16f1147d93de3b8"
+};
+function signedPython(env = process.env, { say = () => {
+}, runImpl = run, platform = process.platform } = {}) {
+  if (platform !== "win32") return null;
+  const dir = path.join(humHome(env), "python", SIGNED_PYTHON.version);
+  const python = path.join(dir, "tools", "python.exe");
+  if (fs.existsSync(python)) return python;
+  say(`fetching Python ${SIGNED_PYTHON.version} from python.org (signed; your machine's policy trusts it) \u2026`);
+  const part = `${dir}.part`, zip = `${dir}.zip`;
+  const q = (s) => `'${s.replace(/'/g, "''")}'`;
+  const script = [
+    "$ErrorActionPreference = 'Stop'",
+    "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12",
+    `(New-Object Net.WebClient).DownloadFile(${q(SIGNED_PYTHON.url)}, ${q(zip)})`,
+    `$f = [IO.File]::OpenRead(${q(zip)}); try { $h = ([BitConverter]::ToString([Security.Cryptography.SHA256]::Create().ComputeHash($f)) -replace '-', '').ToLower() } finally { $f.Dispose() }`,
+    `if ($h -ne ${q(SIGNED_PYTHON.sha256)}) { throw 'checksum mismatch' }`,
+    `if ([IO.Directory]::Exists(${q(part)})) { [IO.Directory]::Delete(${q(part)}, $true) }`,
+    "[void][Reflection.Assembly]::LoadWithPartialName('System.IO.Compression.FileSystem')",
+    `[IO.Compression.ZipFile]::ExtractToDirectory(${q(zip)}, ${q(part)})`,
+    `[IO.Directory]::Move(${q(part)}, ${q(dir)})`
+  ].join("; ");
+  fs.mkdirSync(path.dirname(dir), { recursive: true });
+  const r = runImpl("powershell", ["-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", script]);
+  try {
+    fs.unlinkSync(zip);
+  } catch {
+  }
+  if (!(r && r.status === 0) || !fs.existsSync(python)) {
+    say(`could not fetch it (${String(r && (r.stderr || r.stdout) || "powershell failed").trim().split(/\r?\n/)[0]})`);
+    return null;
+  }
+  return python;
+}
 var ASK_SSL = ["-I", "-c", "import ssl"];
 function sslBlocked(env = process.env, version = MINE, runImpl = run) {
   const r = runImpl(corePython(env, version), ASK_SSL);
@@ -76,7 +113,7 @@ function sslBlocked(env = process.env, version = MINE, runImpl = run) {
   const text = String(r && (r.stderr || r.stdout) || "ssl did not import").trim().split(/\r?\n/).filter(Boolean).pop() || "ssl did not import";
   return text;
 }
-var sslAdvice = (env, version) => `the machine's application control blocked Python's OpenSSL DLL in ${coreDir(env, version)}; install Python 3.12 from python.org (Microsoft signs it), then run  ${npmFix(version)}`;
+var sslAdvice = (env, version) => `the machine's application control blocked Python's OpenSSL DLL in ${coreDir(env, version)}; install Python 3.12 from python.org (signed by the Python Software Foundation), then run  ${npmFix(version)}`;
 var readInstallState = (env = process.env) => {
   try {
     return JSON.parse(fs.readFileSync(statePath(env), "utf8"));
@@ -125,7 +162,7 @@ function installCore(version, { env = process.env, say = (m) => console.log(`hum
       fs.unlinkSync(stampPath(env, version));
     } catch {
     }
-    const trusted = trustedPython(env, runImpl);
+    const trusted = trustedPython(env, runImpl) || signedPython(env, { say, runImpl });
     const makeVenv = (clear) => (runImpl(u, ["venv", "--quiet", "--python", trusted || "3.12", ...clear ? ["--clear"] : [], dir], { stdio: "inherit" }) || {}).status === 0;
     const pipIn = () => (runImpl(u, ["pip", "install", "--quiet", "--refresh-package", "hum-cli", "--python", python, spec], { stdio: "inherit" }) || {}).status === 0;
     if (!fs.existsSync(python) && !makeVenv(fs.existsSync(dir))) return outcome(false, "uv venv failed");
@@ -220,6 +257,23 @@ var pause = (ms) => {
   } catch {
   }
 };
+function ownInstaller(env = process.env, version = MINE, execPath = process.execPath) {
+  if (version === MINE || !/^node(\.exe)?$/i.test(path.basename(execPath))) return null;
+  const p = path.join(pkgDir(env, version), "dist", "install.mjs");
+  return fs.existsSync(p) ? p : null;
+}
+function buildCore(version, { env = process.env, say = (m) => console.log(`hum: ${m}`), runImpl = run, now = Date.now(), execPath = process.execPath } = {}) {
+  const theirs = ownInstaller(env, version, execPath);
+  if (theirs) {
+    const r = runImpl(execPath, [theirs, "core", version], { stdio: "inherit", env }) || {};
+    if (r.status !== 0) {
+      const s = readInstallState(env);
+      return { ok: false, version, error: s && s.wanted === version && s.error || `hum ${version}'s installer did not finish` };
+    }
+    if (installedVersion(env, version, runImpl) === version) return { ok: true, version, error: null };
+  }
+  return installCore(version, { env, say, runImpl, now });
+}
 function installVersion(version, { env = process.env, say = (m) => console.log(`hum: ${m}`), runImpl = run, now = Date.now(), retries = 0, every = 90 * 1e3, wait = pause } = {}) {
   if (!isVersion(version)) return { ok: false, error: `not a version: ${version}` };
   try {
@@ -242,7 +296,7 @@ function installVersion(version, { env = process.env, say = (m) => console.log(`
       if (!p.ok) return p;
     }
     if (installedVersion(env, version, runImpl) !== version) {
-      const c = attempt("the part of hum that does the work", () => installCore(version, { env, say, runImpl, now }));
+      const c = attempt("the part of hum that does the work", () => buildCore(version, { env, say, runImpl, now }));
       if (!c.ok) return { ok: false, error: c.error };
     }
     fs.writeFileSync(readyFile(env, version), `${version}
@@ -254,6 +308,10 @@ function installVersion(version, { env = process.env, say = (m) => console.log(`
     return { ok: false, error: e && e.message ? e.message : String(e) };
   }
 }
+if (process.argv[1] && /install\.mjs$/.test(process.argv[1]) && process.argv[2] === "core") {
+  const r = installCore(process.argv[3] || "");
+  process.exit(r.ok ? 0 : 1);
+}
 if (process.argv[1] && /install\.mjs$/.test(process.argv[1]) && process.argv[2] === "install") {
   const log = path.join(humHome(), "update.log");
   const say = (m) => {
@@ -277,6 +335,8 @@ export {
   ASK_VERSION,
   MINE,
   NPM_FIX,
+  SIGNED_PYTHON,
+  buildCore,
   chosenEntry,
   coreDir,
   corePython,
@@ -290,11 +350,13 @@ export {
   needsInstall,
   newer,
   npmFix,
+  ownInstaller,
   pkgDir,
   prune,
   readInstallState,
   readyFile,
   readyVersions,
+  signedPython,
   sslAdvice,
   sslBlocked,
   trustedPython,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metaphi-ai/hum",
-  "version": "0.2.40",
+  "version": "0.2.42",
   "description": "Hum: a self-improving coding agent for your terminal.",
   "license": "UNLICENSED",
   "type": "module",