@my-life-buddies/cli-windowscompat 0.0.0-stage → 0.29.0-dev.0

package/dist/bin/platform.js

@@ -0,0 +1,543 @@
+// <define:__BUDDY_CLI_LANE_BUILD__>
+var define_BUDDY_CLI_LANE_BUILD_default = { schemaVersion: 1, id: "windowscompat", origin: "https://buddies-windowscompat.devops.sl.sit.xiaohongshu.com", command: "buddy-cli-windowscompat", runtimePackage: "@my-life-buddies/buddy-runtime-windowscompat", runtimeTag: "dev", runtimePrerelease: "dev", sourceVersion: "0.29.0-dev.0", distribution: "npm", packageName: "@my-life-buddies/cli-windowscompat", version: "0.29.0-dev.0", validationScope: "mac-config-only" };
+
+// packages/cli-core/src/build-target.ts
+var LANE_BUILD = typeof define_BUDDY_CLI_LANE_BUILD_default === "undefined" ? void 0 : Object.freeze(define_BUDDY_CLI_LANE_BUILD_default);
+var CLI_COMMAND_NAME = LANE_BUILD?.command ?? "buddy-cli-sit";
+var CLI_PACKAGE_NAME = LANE_BUILD?.packageName ?? "@my-life-buddies/cli";
+var PLATFORM_ORIGIN = LANE_BUILD?.origin ?? "https://buddies.sit.dots.chat";
+var RUNTIME_PACKAGE_NAME = LANE_BUILD?.runtimePackage ?? "@my-life-buddies/buddy-runtime";
+var RUNTIME_DIST_TAG = LANE_BUILD?.runtimeTag ?? "dev";
+var RUNTIME_SOURCE_LABEL = LANE_BUILD ? `${RUNTIME_PACKAGE_NAME} \u7684 npm ${RUNTIME_DIST_TAG}` : "npm dev";
+var CLI_UPDATE_GUIDANCE = LANE_BUILD ? LANE_BUILD.distribution === "npm" ? `\u6CF3\u9053 npm \u6D4B\u8BD5\u5305\u5DF2\u7981\u7528\u81EA\u52A8\u66F4\u65B0\u3001update \u548C setup\u3002\u624B\u52A8\u66F4\u65B0\u8BF7\u5728\u539F\u5B89\u88C5\u76EE\u5F55\u6267\u884C npm install --global --prefix <\u539F\u5B89\u88C5\u524D\u7F00> ${CLI_PACKAGE_NAME}@dev --registry=https://registry.npmjs.org/ --@my-life-buddies:registry=https://registry.npmjs.org/\uFF1B\u4E0D\u4F1A\u5207\u56DE\u539F CLI \u5305\u3002\u5F53\u524D\u4EC5\u652F\u6301 macOS\u3002` : "\u672C\u5730\u6CF3\u9053\u6D4B\u8BD5\u5236\u54C1\u5DF2\u7981\u7528\u81EA\u52A8\u66F4\u65B0\u3001update \u548C setup\uFF1B\u66F4\u6362\u7248\u672C\u987B\u91CD\u65B0\u5B89\u88C5\u540C\u6CF3\u9053\u6D4B\u8BD5\u5236\u54C1\u3002" : "\u6B63\u5E38\u547D\u4EE4\u5148\u8054\u7F51\u81EA\u68C0\uFF0C\u65E7\u7248\u81EA\u52A8\u66F4\u65B0\u540E\u7EE7\u7EED\u6267\u884C\uFF1B\u5931\u8D25\u65F6\u505C\u6B62\u3002\u5E2E\u52A9\u3001--version \u548C dev stop \u79BB\u7EBF\u53EF\u7528\u3002";
+function assertBuildManifest(manifest, platform = process.platform) {
+  if (!LANE_BUILD) {
+    if (manifest.buddyCliLane !== void 0) throw new Error("\u6CF3\u9053\u5236\u54C1\u4E0E\u6267\u884C\u5165\u53E3\u4E0D\u5339\u914D\uFF0C\u8BF7\u91CD\u65B0\u5B89\u88C5\u5B8C\u6574\u6D4B\u8BD5\u5236\u54C1\u3002");
+    return;
+  }
+  const actual = manifest.buddyCliLane;
+  if (!actual || typeof actual !== "object" || Array.isArray(actual) || Object.keys(actual).length !== Object.keys(LANE_BUILD).length || Object.entries(LANE_BUILD).some(([key, value]) => actual[key] !== value) || manifest.name !== CLI_PACKAGE_NAME || manifest.version !== LANE_BUILD.version || (LANE_BUILD.distribution === "local" ? manifest.private !== true : manifest.private !== void 0) || !manifest.bin || typeof manifest.bin !== "object" || Object.keys(manifest.bin).length !== 1 || manifest.bin[LANE_BUILD.command] !== "dist/bin/buddy.js") {
+    throw new Error("\u6CF3\u9053\u5236\u54C1\u6807\u8BC6\u3001\u7248\u672C\u6216\u5165\u53E3\u4E0D\u5339\u914D\uFF0C\u8BF7\u91CD\u65B0\u5B89\u88C5\u5B8C\u6574\u6D4B\u8BD5\u5236\u54C1\uFF1B\u4E0D\u4F1A\u5207\u56DE\u516C\u5171 SIT\u3002");
+  }
+  if (LANE_BUILD.validationScope === "mac-config-only" && platform !== "darwin") {
+    throw new Error("\u6B64\u6CF3\u9053\u5236\u54C1\u4EC5\u652F\u6301 macOS\uFF08mac-config-only\uFF09\uFF1B\u7F3A\u5C11 Windows \u539F\u751F\u5236\u54C1\uFF0C\u5F3A\u5236\u5B89\u88C5\u4E5F\u4E0D\u80FD\u4F5C\u4E3A Windows \u5019\u9009\u8FD0\u884C\u3002");
+  }
+  if (LANE_BUILD.distribution === "npm" && LANE_BUILD.validationScope === "mac-config-only" && JSON.stringify(manifest.os) !== JSON.stringify(["darwin"])) throw new Error("macOS \u6CF3\u9053 npm \u5236\u54C1\u7684 os \u5FC5\u987B\u4EC5\u4E3A darwin\u3002");
+}
+
+// packages/cli-core/src/platform/npm.ts
+import { execFile } from "node:child_process";
+import { readFile, realpath, stat } from "node:fs/promises";
+import { delimiter, dirname, isAbsolute, join, resolve } from "node:path";
+import { promisify } from "node:util";
+
+// packages/cli-core/src/npm-registry.ts
+var REGISTRY = "https://registry.npmjs.org/";
+async function npmPackageManifest(name, selector, options = {}) {
+  options.signal?.throwIfAborted();
+  const timeout = AbortSignal.timeout(options.timeoutMs ?? 1e4);
+  const signal = options.signal ? AbortSignal.any([options.signal, timeout]) : timeout;
+  const response = await (options.fetch ?? globalThis.fetch)(`${REGISTRY}${encodeURIComponent(name)}`, {
+    signal,
+    headers: { Accept: "application/json" },
+    redirect: "error"
+  });
+  if (!response.ok) throw new Error(`npm HTTP ${response.status}`);
+  const text = await response.text();
+  if (text.length > 8 * 1024 * 1024) throw new Error("npm \u5143\u6570\u636E\u8FC7\u5927");
+  const metadata = JSON.parse(text);
+  if (metadata?.name !== name) throw new Error("npm \u8FD4\u56DE\u7684\u5305\u540D\u4E0D\u5339\u914D");
+  const version2 = Object.hasOwn(metadata["dist-tags"] ?? {}, selector) ? metadata["dist-tags"][selector] : selector;
+  const manifest = typeof version2 === "string" && Object.hasOwn(metadata.versions ?? {}, version2) ? metadata.versions[version2] : void 0;
+  if (!manifest || manifest.name !== name || manifest.version !== version2) {
+    throw new Error(`npm ${selector} \u672A\u8FD4\u56DE\u6B64\u5305\u7684\u51C6\u786E\u7248\u672C`);
+  }
+  return manifest;
+}
+
+// packages/cli-core/src/platform/npm.ts
+var execute = promisify(execFile);
+async function resolveNpmEntry(options = {}) {
+  const node = options.execPath ?? process.execPath;
+  const env = options.env ?? process.env;
+  const platform = options.platform ?? process.platform;
+  const realNode = await realpath(node);
+  const candidates = /* @__PURE__ */ new Set();
+  if (env.npm_execpath && env.npm_node_execpath && isAbsolute(env.npm_execpath)) {
+    try {
+      if (await realpath(env.npm_node_execpath) === realNode) {
+        candidates.add(join(dirname(await realpath(env.npm_execpath)), "npm-cli.js"));
+      }
+    } catch {
+    }
+  }
+  for (const bin of /* @__PURE__ */ new Set([dirname(node), dirname(realNode)])) {
+    candidates.add(join(bin, "node_modules", "npm", "bin", "npm-cli.js"));
+    candidates.add(resolve(bin, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js"));
+  }
+  const pathKey = Object.keys(env).find((key) => key.toLowerCase() === "path");
+  const paths = (env[pathKey ?? "PATH"] ?? "").split(platform === "win32" ? ";" : delimiter);
+  for (const directory of paths) {
+    if (!directory || !isAbsolute(directory)) continue;
+    try {
+      if (await realpath(join(directory, platform === "win32" ? "node.exe" : "node")) !== realNode) continue;
+      if (platform === "win32") candidates.add(join(directory, "node_modules", "npm", "bin", "npm-cli.js"));
+      else candidates.add(await realpath(join(directory, "npm")));
+    } catch {
+    }
+  }
+  for (const candidate of candidates) {
+    try {
+      const entry = await realpath(candidate);
+      const root = dirname(dirname(entry));
+      const manifest = JSON.parse(await readFile(join(root, "package.json"), "utf8"));
+      if (manifest.name !== "npm" || manifest.bin?.npm !== "bin/npm-cli.js") continue;
+      if (await realpath(join(root, manifest.bin.npm)) !== entry || !(await stat(entry)).isFile()) continue;
+      return { node, entry };
+    } catch {
+    }
+  }
+  throw new Error("\u627E\u4E0D\u5230\u4E0E\u5F53\u524D Node.js \u5B89\u88C5\u5339\u914D\u7684 npm \u5165\u53E3\u3002\u8BF7\u4FEE\u590D\u6216\u91CD\u65B0\u5B89\u88C5\u5F53\u524D Node.js\uFF0C\u518D\u91CD\u8BD5\uFF1B\u672A\u8C03\u7528\u5176\u4ED6 Node \u7684 npm\u3002");
+}
+async function runNpm(args, options) {
+  options.signal?.throwIfAborted();
+  const npm = await resolveNpmEntry({ env: options.env });
+  return execute(npm.node, [npm.entry, ...args], {
+    ...options,
+    encoding: "utf8",
+    maxBuffer: options.maxBuffer ?? 4 * 1024 * 1024,
+    shell: false,
+    windowsHide: true
+  });
+}
+
+// packages/cli-core/src/platform/support.ts
+import { machine, release, version } from "node:os";
+var UnsupportedDeveloperPlatformError = class extends Error {
+  constructor(platform, message) {
+    super(message ?? `\u642D\u642D CLI \u652F\u6301 macOS\u3001Windows 10 22H2 x64 \u548C Windows 11 x64/ARM64\uFF0C\u5F53\u524D\u7CFB\u7EDF\u662F ${platform}\u3002`);
+    this.platform = platform;
+    this.name = "UnsupportedDeveloperPlatformError";
+  }
+  platform;
+};
+function assertSupportedDeveloperPlatform(platform = process.platform, info = {}) {
+  const arch = info.arch ?? process.arch;
+  if (!["darwin", "win32"].includes(platform)) throw new UnsupportedDeveloperPlatformError(platform);
+  if (!["x64", "arm64"].includes(arch)) {
+    throw new UnsupportedDeveloperPlatformError(platform, `\u642D\u642D CLI \u9700\u8981 x64 \u6216 ARM64 Node.js\uFF0C\u5F53\u524D\u8FDB\u7A0B\u67B6\u6784\u662F ${arch}\u3002`);
+  }
+  const node = info.nodeVersion ?? process.versions.node;
+  if (!/^\d+\./u.test(node) || Number(node.split(".")[0]) < 24) {
+    throw new UnsupportedDeveloperPlatformError(platform, "\u642D\u642D CLI \u9700\u8981 Node.js 24 \u6216\u66F4\u9AD8\u7248\u672C\u3002");
+  }
+  if (platform === "darwin") return;
+  const osRelease = info.osRelease ?? release();
+  const osVersion = info.osVersion ?? version();
+  const [major, minor, build] = osRelease.split(".").map(Number);
+  if (major !== 10 || minor !== 0 || !Number.isSafeInteger(build) || build < 19045 || /Server|LTSC|LTSB/iu.test(osVersion)) {
+    throw new UnsupportedDeveloperPlatformError(platform, `\u642D\u642D CLI \u9700\u8981 Windows 10 22H2\uFF0819045\uFF09\u6216 Windows 11 \u684C\u9762\u7CFB\u7EDF\uFF0C\u5F53\u524D\u7248\u672C\u662F ${osRelease}\u3002`);
+  }
+  const host = (info.hostMachine ?? machine()).toLowerCase();
+  if (arch === "arm64" && build < 22e3 || /^(arm64|aarch64)$/u.test(host) && arch !== "arm64") {
+    throw new UnsupportedDeveloperPlatformError(platform, "Windows ARM64 \u9700\u8981 Windows 11 \u548C\u539F\u751F ARM64 Node.js\uFF0C\u8BF7\u5B89\u88C5\u5339\u914D\u7684 Node.js \u7248\u672C\u3002");
+  }
+}
+
+// packages/cli-core/src/platform/open.ts
+import { spawn as spawn2 } from "node:child_process";
+import { posix, win32 as win322 } from "node:path";
+
+// packages/cli-core/src/platform/windows.ts
+import { spawn } from "node:child_process";
+import { win32 } from "node:path";
+var SCRIPT = String.raw`
+$ErrorActionPreference = 'Stop'
+[Console]::InputEncoding = New-Object System.Text.UTF8Encoding($false)
+[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
+$sid = [Security.Principal.WindowsIdentity]::GetCurrent().User
+function PathAttributes([string]$path) {
+  try { return [IO.File]::GetAttributes($path) }
+  catch [IO.FileNotFoundException] { return $null }
+  catch [IO.DirectoryNotFoundException] { return $null }
+}
+function SafePath([string]$path) {
+  if ($path -notmatch '^[A-Za-z]:[\\/]' -or $path -match '[\x00-\x1f\x7f]' -or $path.Substring(2).Contains(':')) { throw 'INVALID_PATH' }
+  $full = [IO.Path]::GetFullPath($path)
+  $drive = New-Object IO.DriveInfo([IO.Path]::GetPathRoot($full))
+  if ($drive.DriveType -eq [IO.DriveType]::Network) { throw 'NETWORK_PATH' }
+  $part = $full
+  while ($part) {
+    $attributes = PathAttributes $part
+    if ($null -ne $attributes -and ($attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'LINK_PATH' }
+    if ($part -eq [IO.Path]::GetPathRoot($part)) { break }
+    $parent = [IO.Path]::GetDirectoryName($part.TrimEnd('\'))
+    if ($parent -eq $part) { break }; $part = $parent
+  }
+  return $full
+}
+function PrivateAcl([bool]$directory) {
+  if ($directory) { $acl = New-Object Security.AccessControl.DirectorySecurity }
+  else { $acl = New-Object Security.AccessControl.FileSecurity }
+  $acl.SetOwner($sid); $acl.SetAccessRuleProtection($true, $false)
+  if ($directory) {
+    $rule = New-Object Security.AccessControl.FileSystemAccessRule($sid, 'FullControl', 'ContainerInherit,ObjectInherit', 'None', 'Allow')
+  } else { $rule = New-Object Security.AccessControl.FileSystemAccessRule($sid, 'FullControl', 'Allow') }
+  $acl.AddAccessRule($rule); return $acl
+}
+function CheckOwner([string]$path) {
+  $acl = Get-Acl -LiteralPath $path
+  if ($acl.GetOwner([Security.Principal.SecurityIdentifier]).Value -ne $sid.Value) { throw 'FOREIGN_OWNER' }
+  return $acl
+}
+function CheckFileLinks([string]$path) {
+  $attributes = PathAttributes $path
+  if ($null -eq $attributes -or ($attributes -band [IO.FileAttributes]::Directory) -ne 0) { return }
+  if (!('BuddyPrivateFileInfo' -as [type])) {
+    Add-Type -TypeDefinition @'
+using System;
+using System.IO;
+using System.Runtime.InteropServices;
+using Microsoft.Win32.SafeHandles;
+public static class BuddyPrivateFileInfo {
+  [StructLayout(LayoutKind.Sequential)]
+  private struct Info {
+    public uint Attributes;
+    public System.Runtime.InteropServices.ComTypes.FILETIME Created, Accessed, Written;
+    public uint Volume, SizeHigh, SizeLow, Links, IndexHigh, IndexLow;
+  }
+  [DllImport("kernel32.dll", SetLastError = true)]
+  private static extern bool GetFileInformationByHandle(SafeFileHandle file, out Info info);
+  public static uint Links(string path) {
+    using (var file = new FileStream(path, FileMode.Open, FileAccess.Read, FileShare.ReadWrite | FileShare.Delete)) {
+      Info info;
+      if (!GetFileInformationByHandle(file.SafeFileHandle, out info)) throw new IOException("FILE_INFO_FAILED");
+      return info.Links;
+    }
+  }
+}
+'@
+  }
+  if ([BuddyPrivateFileInfo]::Links($path) -ne 1) { throw 'LINK_PATH' }
+}
+function CheckPrivate([string]$path) {
+  $path = SafePath $path
+  if ($null -eq (PathAttributes $path)) { throw 'ENOENT' }
+  CheckFileLinks $path
+  $acl = CheckOwner $path
+  if (!$acl.AreAccessRulesProtected) { throw 'UNSAFE_ACL' }
+  $allowed = $false
+  foreach ($rule in $acl.GetAccessRules($true, $true, [Security.Principal.SecurityIdentifier])) {
+    if ($rule.AccessControlType -eq 'Allow') {
+      if ($rule.IdentityReference.Value -ne $sid.Value) { throw 'UNSAFE_ACL' }
+      if (($rule.FileSystemRights -band [Security.AccessControl.FileSystemRights]::FullControl) -eq [Security.AccessControl.FileSystemRights]::FullControl) { $allowed = $true }
+    }
+  }
+  if (!$allowed) { throw 'UNSAFE_ACL' }
+}
+function PrivateDirectory([string]$path) {
+  $path = SafePath $path
+  $attributes = PathAttributes $path
+  if ($null -ne $attributes) {
+    if (($attributes -band [IO.FileAttributes]::Directory) -eq 0) { throw 'INVALID_PATH' }
+    $null = CheckOwner $path
+    [IO.Directory]::SetAccessControl($path, (PrivateAcl $true))
+  } else {
+    $parent = [IO.Path]::GetDirectoryName($path)
+    if ($null -eq (PathAttributes $parent)) { PrivateDirectory $parent }
+    $null = [IO.Directory]::CreateDirectory($path, (PrivateAcl $true))
+  }
+  CheckPrivate $path
+}
+function AtomicPrivateWrite([string]$path, [byte[]]$bytes) {
+  $path = SafePath $path
+  $attributes = PathAttributes $path
+  if ($null -ne $attributes) {
+    if (($attributes -band [IO.FileAttributes]::Directory) -ne 0) { throw 'INVALID_PATH' }
+    $null = CheckOwner $path; CheckFileLinks $path
+  }
+  $temporary = $path + '.' + [Guid]::NewGuid().ToString('N') + '.tmp'
+  $stream = $null
+  try {
+    $stream = New-Object IO.FileStream($temporary, [IO.FileMode]::CreateNew, [Security.AccessControl.FileSystemRights]::Write, [IO.FileShare]::None, 4096, [IO.FileOptions]::WriteThrough, (PrivateAcl $false))
+    $stream.Write($bytes, 0, $bytes.Length); $stream.Flush($true); $stream.Dispose(); $stream = $null
+    $null = SafePath $path
+    if ($null -ne (PathAttributes $path)) {
+      $null = CheckOwner $path; CheckFileLinks $path
+      # Replace preserves the destination ACL, so secure it before replacement.
+      [IO.File]::SetAccessControl($path, (PrivateAcl $false))
+      [IO.File]::Replace($temporary, $path, $null)
+    } else { [IO.File]::Move($temporary, $path) }
+    CheckPrivate $path
+  } finally {
+    if ($stream) { $stream.Dispose() }
+    [IO.File]::Delete($temporary)
+  }
+}
+function Credential($request) {
+  if ([string]$request.scope -cnotmatch '^[a-f0-9]{64}$') { throw 'INVALID_SCOPE' }
+  $directory = SafePath $request.directory
+  $application = [IO.Path]::GetDirectoryName($directory)
+  $path = Join-Path $directory ($request.scope + '.json')
+  $null = SafePath $path
+  if ($request.operation -eq 'credential-save') { PrivateDirectory $application; PrivateDirectory $directory }
+  elseif ($null -eq (PathAttributes $directory)) { return $null }
+  if (((PathAttributes $directory) -band [IO.FileAttributes]::Directory) -eq 0) { throw 'INVALID_PATH' }
+  CheckPrivate $directory
+  CheckPrivate $application
+  $attributes = PathAttributes $path
+  if ($null -ne $attributes -and ($attributes -band [IO.FileAttributes]::Directory) -ne 0) { throw 'INVALID_PATH' }
+  if ($request.operation -eq 'credential-clear') {
+    if ($null -ne $attributes) { CheckPrivate $path; [IO.File]::Delete($path) }
+    return $null
+  }
+  Add-Type -AssemblyName System.Security
+  $entropy = [Convert]::FromBase64String($request.entropy)
+  if ($request.operation -eq 'credential-save') {
+    $plain = [Convert]::FromBase64String($request.data)
+    if ($plain.Length -eq 0 -or $plain.Length -gt 32768) { throw 'CREDENTIAL_CORRUPT' }
+    $encrypted = [Security.Cryptography.ProtectedData]::Protect($plain, $entropy, [Security.Cryptography.DataProtectionScope]::CurrentUser)
+    $record = @{version=1; scope=$request.scope; ciphertext=[Convert]::ToBase64String($encrypted)} | ConvertTo-Json -Compress
+    AtomicPrivateWrite $path ([Text.Encoding]::UTF8.GetBytes($record))
+    return $null
+  }
+  if ($null -eq $attributes) { return $null }
+  CheckPrivate $path
+  if ((Get-Item -LiteralPath $path).Length -gt 65536) { throw 'CREDENTIAL_CORRUPT' }
+  try {
+    $record = (New-Object Text.UTF8Encoding($false, $true)).GetString([IO.File]::ReadAllBytes($path)) | ConvertFrom-Json
+    if ($record.version -ne 1 -or $record.scope -cne $request.scope -or !($record.ciphertext -is [string])) { throw 'CREDENTIAL_CORRUPT' }
+    $plain = [Security.Cryptography.ProtectedData]::Unprotect([Convert]::FromBase64String($record.ciphertext), $entropy, [Security.Cryptography.DataProtectionScope]::CurrentUser)
+    if ($plain.Length -eq 0 -or $plain.Length -gt 32768) { throw 'CREDENTIAL_CORRUPT' }
+    return [Convert]::ToBase64String($plain)
+  } catch { throw 'CREDENTIAL_CORRUPT' }
+}
+function PrependUserPath([string]$old, [string]$path) {
+  $target = $path.TrimEnd('\')
+  $entries = @($old -split ';' | Where-Object { $_ -and $_.Trim().Trim('"').TrimEnd('\', '/').Replace('/', '\') -ine $target })
+  return ((@($path) + $entries) -join ';')
+}
+try {
+  $request = [Console]::In.ReadToEnd() | ConvertFrom-Json
+  $value = $null
+  switch ($request.operation) {
+    'private-directory' { PrivateDirectory $request.path }
+    'private-check' { CheckPrivate $request.path }
+    'safe-path' { $null = SafePath $request.path }
+    'private-write' { AtomicPrivateWrite $request.path ([Convert]::FromBase64String($request.data)) }
+    'credential-save' { $value = Credential $request }
+    'credential-load' { $value = Credential $request }
+    'credential-clear' { $value = Credential $request }
+    'open' {
+      $start = New-Object Diagnostics.ProcessStartInfo
+      $start.FileName = [string]$request.target; $start.UseShellExecute = $true
+      $null = [Diagnostics.Process]::Start($start)
+    }
+    'user-path' {
+      $path = SafePath $request.path
+      if ($path.Contains(';')) { throw 'INVALID_PATH' }
+      $old = [Environment]::GetEnvironmentVariable('Path', 'User')
+      [Environment]::SetEnvironmentVariable('Path', (PrependUserPath $old $path), 'User')
+      try {
+        Add-Type -TypeDefinition @'
+using System;
+using System.Runtime.InteropServices;
+public static class BuddyEnvironmentNotify {
+  [DllImport("user32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+  public static extern IntPtr SendMessageTimeout(IntPtr window, uint message, UIntPtr wParam, string lParam, uint flags, uint timeout, out UIntPtr result);
+}
+'@
+        $broadcastResult = [UIntPtr]::Zero
+        $notified = [BuddyEnvironmentNotify]::SendMessageTimeout([IntPtr]65535, 26, [UIntPtr]::Zero, 'Environment', 34, 1000, [ref]$broadcastResult)
+        if ($notified -eq [IntPtr]::Zero) { throw 'ENVIRONMENT_BROADCAST_FAILED' }
+      } catch { throw 'ENVIRONMENT_BROADCAST_FAILED' }
+    }
+    default { throw 'INVALID_OPERATION' }
+  }
+  [Console]::Out.Write((@{ok=$true; value=$value} | ConvertTo-Json -Compress))
+} catch {
+  $code = if ($_.Exception.Message -eq 'ENOENT') { 'ENOENT' } elseif ($_.Exception.Message -eq 'CREDENTIAL_CORRUPT') { 'EBADMSG' } elseif ($_.Exception.Message -eq 'ENVIRONMENT_BROADCAST_FAILED') { 'ERELOGIN' } else { 'EPERM' }
+  # Exception text can contain input. Never send it to logs or the terminal.
+  [Console]::Out.Write((@{ok=$false; code=$code} | ConvertTo-Json -Compress)); exit 1
+}
+`;
+function windowsCommand(request, env = process.env) {
+  if (request.operation === "user-path" && (typeof request.path !== "string" || request.path.includes(";"))) {
+    throw new Error("Windows PATH \u76EE\u5F55\u4E0D\u80FD\u5305\u542B\u5206\u53F7\uFF0C\u8BF7\u9009\u62E9\u6709\u6548\u7684\u672C\u5730\u5B89\u88C5\u76EE\u5F55\u3002");
+  }
+  const systemRoot = env.SystemRoot ?? env.SYSTEMROOT;
+  if (!systemRoot || !/^[A-Za-z]:[\\/]/u.test(systemRoot)) throw new Error("\u65E0\u6CD5\u5B9A\u4F4D Windows PowerShell\uFF0C\u8BF7\u68C0\u67E5 SystemRoot\u3002");
+  const command = {
+    command: win32.join(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe"),
+    args: ["-NoLogo", "-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(SCRIPT, "utf16le").toString("base64")],
+    input: JSON.stringify(request)
+  };
+  const commandLineBound = 1 + [command.command, ...command.args].reduce((size, part) => size + part.length + (part.match(/[\\"]/gu)?.length ?? 0) + 3, 0);
+  if (commandLineBound > 3e4) throw new Error("Windows \u7CFB\u7EDF\u64CD\u4F5C\u547D\u4EE4\u8D85\u51FA\u5B89\u5168\u957F\u5EA6\uFF0C\u8BF7\u66F4\u65B0\u6216\u4FEE\u590D CLI \u5B89\u88C5\u3002");
+  return command;
+}
+async function runWindowsCommand(command) {
+  return await new Promise((resolve2, reject) => {
+    const child = spawn(command.command, [...command.args], { shell: false, windowsHide: true, stdio: ["pipe", "pipe", "pipe"] });
+    const output = [];
+    let size = 0;
+    let failure;
+    const timer = setTimeout(() => {
+      failure = new Error("Windows \u7CFB\u7EDF\u64CD\u4F5C\u8D85\u65F6\uFF0C\u8BF7\u68C0\u67E5 PowerShell \u662F\u5426\u88AB\u7CFB\u7EDF\u7B56\u7565\u963B\u6B62\u3002");
+      child.kill();
+    }, 15e3);
+    child.stdout.on("data", (chunk) => {
+      size += chunk.length;
+      if (size > 2 * 1024 * 1024) {
+        failure = new Error("Windows \u7CFB\u7EDF\u64CD\u4F5C\u8FD4\u56DE\u8FC7\u591A\u6570\u636E\u3002");
+        child.kill();
+      } else output.push(chunk);
+    });
+    child.stderr.resume();
+    child.stdin.on("error", () => void 0);
+    child.once("error", () => {
+      clearTimeout(timer);
+      reject(new Error("\u65E0\u6CD5\u8FD0\u884C Windows PowerShell\uFF0C\u8BF7\u68C0\u67E5\u7CFB\u7EDF\u7B56\u7565\u3002"));
+    });
+    child.once("close", (code) => {
+      clearTimeout(timer);
+      if (failure) reject(failure);
+      else resolve2({ code: code ?? 1, stdout: Buffer.concat(output).toString("utf8"), stderr: "" });
+    });
+    child.stdin.end(command.input, "utf8");
+  });
+}
+async function windowsOperation(request, options = {}) {
+  const command = windowsCommand(request, options.env);
+  let result;
+  try {
+    result = await (options.runner ?? runWindowsCommand)(command);
+  } catch (cause) {
+    if (request.operation === "user-path") throw new Error("\u65E0\u6CD5\u786E\u8BA4\u7528\u6237 PATH \u66F4\u65B0\u4E0E\u684C\u9762\u901A\u77E5\u662F\u5426\u5B8C\u6210\uFF1B\u8BF7\u91CD\u65B0\u767B\u5F55 Windows \u540E\u68C0\u67E5 CLI\uFF0C\u4ECD\u4E0D\u53EF\u7528\u65F6\u91CD\u65B0\u8FD0\u884C setup\u3002");
+    throw cause;
+  }
+  let response;
+  try {
+    response = JSON.parse(result.stdout.replace(/^\uFEFF/u, ""));
+  } catch {
+    response = {};
+  }
+  if (result.code !== 0 || response.ok !== true) {
+    if (response.code === "ERELOGIN") throw Object.assign(new Error("\u7528\u6237 PATH \u5DF2\u4FDD\u5B58\uFF0C\u4F46\u672A\u80FD\u901A\u77E5 Windows \u684C\u9762\uFF1B\u8BF7\u91CD\u65B0\u767B\u5F55 Windows \u540E\u4F7F\u7528 CLI\u3002"), { code: "ERELOGIN" });
+    throw Object.assign(new Error("Windows \u5B89\u5168\u64CD\u4F5C\u5931\u8D25\uFF0C\u8BF7\u68C0\u67E5\u5F53\u524D\u7528\u6237\u7684\u6587\u4EF6\u6743\u9650\u548C PowerShell \u7CFB\u7EDF\u7B56\u7565\u3002"), { code: response.code === "ENOENT" || response.code === "EBADMSG" ? response.code : "EPERM" });
+  }
+  return response.value;
+}
+
+// packages/cli-core/src/platform/open.ts
+function externalTarget(target, platform) {
+  const value = target instanceof URL ? target.href : target;
+  if (!value || /[\u0000-\u001f\u007f]/u.test(value)) throw new TypeError("\u53EA\u80FD\u6253\u5F00 HTTP(S) \u5730\u5740\u6216\u672C\u5730\u6587\u4EF6\u7684\u7EDD\u5BF9\u8DEF\u5F84\u3002");
+  if (platform === "win32" ? /^[A-Za-z]:[\\/]/u.test(value) && win322.isAbsolute(value) : value.startsWith("/") && !value.startsWith("//") && posix.isAbsolute(value)) return value;
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new TypeError("\u53EA\u80FD\u6253\u5F00 HTTP(S) \u5730\u5740\u6216\u672C\u5730\u6587\u4EF6\u7684\u7EDD\u5BF9\u8DEF\u5F84\u3002");
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") throw new TypeError("\u53EA\u80FD\u6253\u5F00 HTTP(S) \u5730\u5740\u6216\u672C\u5730\u6587\u4EF6\u7684\u7EDD\u5BF9\u8DEF\u5F84\u3002");
+  return url.href;
+}
+async function runMacOpen(command) {
+  return await new Promise((resolve2, reject) => {
+    const child = spawn2(command.command, [...command.args], { shell: false, stdio: "ignore" });
+    child.once("error", reject);
+    child.once("close", (code) => resolve2({ code: code ?? 1, stdout: "", stderr: "" }));
+  });
+}
+async function openExternalTarget(target, options = {}) {
+  const platform = options.platform ?? process.platform;
+  if (platform !== "darwin" && platform !== "win32") throw new Error("\u6253\u5F00\u6D4F\u89C8\u5668\u6216\u6587\u4EF6\u4EC5\u652F\u6301 macOS \u548C Windows\u3002");
+  const value = externalTarget(target, platform);
+  if (platform === "win32") {
+    await windowsOperation({ operation: "open", target: value }, { runner: options.runner, env: options.env });
+    return;
+  }
+  const result = await (options.runner ?? runMacOpen)({ command: "open", args: [value] });
+  if (result.code !== 0) throw new Error("\u65E0\u6CD5\u6253\u5F00\u6D4F\u89C8\u5668\u6216\u6587\u4EF6\uFF0C\u8BF7\u624B\u52A8\u6253\u5F00\u7EC8\u7AEF\u4E2D\u663E\u793A\u7684\u5730\u5740\u6216\u8DEF\u5F84\u3002");
+}
+
+// packages/cli-core/src/platform/private-files.ts
+import { constants } from "node:fs";
+import { chmod, lstat, mkdir, open, rename, unlink } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { isAbsolute as isAbsolute2 } from "node:path";
+async function assertUnlinkedPath(path) {
+  if (!isAbsolute2(path)) throw new Error("\u79C1\u5BC6\u6587\u4EF6\u5FC5\u987B\u4F7F\u7528\u7EDD\u5BF9\u8DEF\u5F84\u3002");
+  if (process.platform === "win32") await windowsOperation({ operation: "safe-path", path });
+  const stat2 = await lstat(path).catch((cause) => {
+    if (cause.code !== "ENOENT") throw cause;
+    return void 0;
+  });
+  if (stat2 && (stat2.isSymbolicLink() || stat2.isFile() && stat2.nlink !== 1)) throw new Error("\u79C1\u5BC6\u6587\u4EF6\u4E0D\u80FD\u4F7F\u7528\u7B26\u53F7\u94FE\u63A5\u3001\u76EE\u5F55\u8054\u63A5\u6216\u786C\u94FE\u63A5\u3002");
+}
+async function assertPrivatePath(path) {
+  await assertUnlinkedPath(path);
+  const stat2 = await lstat(path);
+  if (!stat2.isFile() && !stat2.isDirectory()) throw new Error("\u79C1\u5BC6\u8DEF\u5F84\u5FC5\u987B\u662F\u666E\u901A\u6587\u4EF6\u6216\u76EE\u5F55\u3002");
+  if (process.platform === "win32") await windowsOperation({ operation: "private-check", path });
+  else if (stat2.uid !== process.getuid?.() || (stat2.mode & 63) !== 0) throw new Error("\u79C1\u5BC6\u8DEF\u5F84\u5FC5\u987B\u5F52\u5F53\u524D\u7528\u6237\u6240\u6709\uFF0C\u4E14\u4EC5\u5F53\u524D\u7528\u6237\u53EF\u8BBF\u95EE\u3002");
+}
+async function ensurePrivateDirectory(path) {
+  await assertUnlinkedPath(path);
+  if (process.platform === "win32") await windowsOperation({ operation: "private-directory", path });
+  else {
+    await mkdir(path, { recursive: true, mode: 448 });
+    const stat2 = await lstat(path);
+    if (!stat2.isDirectory() || stat2.uid !== process.getuid?.()) throw new Error("\u79C1\u5BC6\u76EE\u5F55\u4E0D\u5C5E\u4E8E\u5F53\u524D\u7528\u6237\u3002");
+    await chmod(path, 448);
+  }
+  await assertPrivatePath(path);
+}
+async function writePrivateFile(path, data) {
+  await assertUnlinkedPath(path);
+  if (process.platform === "win32") {
+    await windowsOperation({ operation: "private-write", path, data: Buffer.from(data).toString("base64") });
+  } else {
+    const temporary = `${path}.${randomUUID()}.tmp`;
+    let file;
+    try {
+      file = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 384);
+      await file.writeFile(data);
+      await file.sync();
+      await file.close();
+      file = void 0;
+      await assertUnlinkedPath(path);
+      await rename(temporary, path);
+    } finally {
+      await file?.close();
+      await unlink(temporary).catch((cause) => {
+        if (cause.code !== "ENOENT") throw cause;
+      });
+    }
+  }
+  await assertPrivatePath(path);
+}
+export {
+  CLI_COMMAND_NAME,
+  CLI_PACKAGE_NAME,
+  CLI_UPDATE_GUIDANCE,
+  LANE_BUILD,
+  PLATFORM_ORIGIN,
+  RUNTIME_DIST_TAG,
+  RUNTIME_PACKAGE_NAME,
+  RUNTIME_SOURCE_LABEL,
+  UnsupportedDeveloperPlatformError,
+  assertBuildManifest,
+  assertPrivatePath,
+  assertSupportedDeveloperPlatform,
+  assertUnlinkedPath,
+  ensurePrivateDirectory,
+  npmPackageManifest,
+  openExternalTarget,
+  resolveNpmEntry,
+  runNpm,
+  windowsOperation,
+  writePrivateFile
+};
+//# sourceMappingURL=platform.js.map