@nanhara/hara 0.121.1 → 0.122.1

package/dist/tools/web.js

@@ -1,42 +1,148 @@
 // web_fetch — fetch an http(s) URL and return readable text (HTML reduced to text). Read-only.
-// Uses Node's global fetch (Node >=20). NOT sandboxed (network egress is in-process, not via bash) —
-// so it carries an SSRF guard: private/loopback/link-local targets are refused, re-checked on every
-// redirect hop, and the body is read under a hard byte ceiling.
+// NOT sandboxed (network egress is in-process, not via bash) — so it carries an SSRF guard: private/
+// loopback/link-local targets are refused, the verified DNS address is pinned to the actual socket on
+// every redirect hop (DNS-rebinding safe), and the body is read under a hard byte ceiling.
 import { registerTool } from "./registry.js";
 import { lookup } from "node:dns/promises";
 import { isIP } from "node:net";
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
 import { wrapUntrusted } from "../security/external-content.js";
 const MAX = 60_000;
 const SEARCH_ATTEMPT_MS = 8_000;
 const SEARCH_UA = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Chrome/124.0 Safari/537.36";
+function ipv6Words(input) {
+    let value = input.toLowerCase();
+    const dotted = value.lastIndexOf(":") >= 0 ? value.slice(value.lastIndexOf(":") + 1) : "";
+    if (dotted.includes(".")) {
+        const octets = dotted.split(".").map(Number);
+        if (octets.length !== 4 || octets.some((n) => !Number.isInteger(n) || n < 0 || n > 255))
+            return null;
+        value = `${value.slice(0, value.lastIndexOf(":") + 1)}${((octets[0] << 8) | octets[1]).toString(16)}:${((octets[2] << 8) | octets[3]).toString(16)}`;
+    }
+    const halves = value.split("::");
+    if (halves.length > 2)
+        return null;
+    const parse = (part) => {
+        if (!part)
+            return [];
+        const pieces = part.split(":");
+        if (pieces.some((piece) => !/^[0-9a-f]{1,4}$/.test(piece)))
+            return null;
+        return pieces.map((piece) => Number.parseInt(piece, 16));
+    };
+    const left = parse(halves[0]);
+    const right = parse(halves[1] ?? "");
+    if (!left || !right)
+        return null;
+    if (halves.length === 1)
+        return left.length === 8 ? left : null;
+    const zeros = 8 - left.length - right.length;
+    return zeros > 0 ? [...left, ...Array(zeros).fill(0), ...right] : null;
+}
 /** True for loopback / private / link-local / ULA / CGNAT addresses we must not let web_fetch reach. */
 export function isPrivateIp(ip) {
     const host = ip.replace(/^\[|\]$/g, "");
     if (isIP(host) === 4) {
         const p = host.split(".").map(Number);
-        return p[0] === 0 || p[0] === 10 || p[0] === 127 || (p[0] === 172 && p[1] >= 16 && p[1] <= 31) || (p[0] === 192 && p[1] === 168) || (p[0] === 169 && p[1] === 254) || (p[0] === 100 && p[1] >= 64 && p[1] <= 127);
+        return (p[0] === 0 || p[0] === 10 || p[0] === 127 ||
+            (p[0] === 100 && p[1] >= 64 && p[1] <= 127) ||
+            (p[0] === 169 && p[1] === 254) ||
+            (p[0] === 172 && p[1] >= 16 && p[1] <= 31) ||
+            (p[0] === 192 && p[1] === 0 && p[2] === 0 && p[3] !== 9 && p[3] !== 10) ||
+            (p[0] === 192 && p[1] === 0 && p[2] === 2) ||
+            (p[0] === 192 && p[1] === 88 && p[2] === 99) ||
+            (p[0] === 192 && p[1] === 168) ||
+            (p[0] === 198 && (p[1] === 18 || p[1] === 19)) ||
+            (p[0] === 198 && p[1] === 51 && p[2] === 100) ||
+            (p[0] === 203 && p[1] === 0 && p[2] === 113) ||
+            p[0] >= 224 // multicast + reserved/broadcast space is not a public unicast web destination
+        );
     }
     const l = host.toLowerCase();
-    if (l === "::1" || l === "::")
+    const words = ipv6Words(l);
+    if (!words)
+        return false;
+    if (words.every((word) => word === 0) || words.slice(0, 7).every((word) => word === 0) && words[7] === 1)
         return true;
-    if (l.startsWith("fe80") || l.startsWith("fc") || l.startsWith("fd"))
-        return true; // link-local + unique-local
-    const m = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(l); // IPv4-mapped IPv6
-    return m ? isPrivateIp(m[1]) : false;
+    if ((words[0] & 0xffc0) === 0xfe80)
+        return true; // fe80::/10 link-local (fe80..febf)
+    if ((words[0] & 0xfe00) === 0xfc00)
+        return true; // fc00::/7 unique-local
+    if ((words[0] & 0xffc0) === 0xfec0)
+        return true; // fec0::/10 deprecated site-local, still internal
+    // IPv4-mapped/compatible spellings are normalized by URL to hexadecimal (for example
+    // ::ffff:127.0.0.1 → ::ffff:7f00:1), so classify the embedded address from parsed words.
+    const mapped = words.slice(0, 5).every((word) => word === 0) && words[5] === 0xffff;
+    const compatible = words.slice(0, 6).every((word) => word === 0);
+    if (mapped || compatible) {
+        const v4 = `${words[6] >>> 8}.${words[6] & 0xff}.${words[7] >>> 8}.${words[7] & 0xff}`;
+        return isPrivateIp(v4);
+    }
+    // Native public IPv6 is global-unicast 2000::/3. Also reject special-use ranges that sit inside it:
+    // Teredo, benchmarking/ORCHID/documentation, and deprecated 6to4 transition addresses.
+    if ((words[0] & 0xe000) !== 0x2000)
+        return true;
+    if (words[0] === 0x2002)
+        return true; // 6to4 can tunnel an embedded non-public IPv4 target
+    if (words[0] === 0x2001) {
+        if (words[1] === 0x0000 || words[1] === 0x0002 || words[1] === 0x0db8)
+            return true;
+        if ((words[1] & 0xfff0) === 0x0010 || (words[1] & 0xfff0) === 0x0020)
+            return true;
+    }
+    return words[0] === 0x3fff && (words[1] & 0xf000) === 0x0000; // 3fff::/20 documentation
 }
-/** Refuse to fetch a host that is (or resolves to) a private/internal address — defeats metadata-endpoint
- *  / localhost SSRF. Throws (caught by the caller) on a blocked or unresolvable host. */
-async function assertPublicHost(hostname) {
+/** Resolve once, reject the hostname if ANY answer is internal, then return the exact public address the
+ * socket must use. Rejecting mixed public/private answers prevents round-robin records from becoming a
+ * probabilistic bypass. The optional resolver keeps the policy directly testable. */
+export async function resolvePublicHost(hostname, resolver = lookup) {
     const host = hostname.replace(/^\[|\]$/g, "");
     if (isIP(host)) {
         if (isPrivateIp(host))
             throw new Error(`refusing to fetch ${host} (private/loopback address)`);
-        return;
+        return { address: host, family: isIP(host) };
     }
-    const addrs = await lookup(host, { all: true });
-    for (const a of addrs)
+    const addrs = await resolver(host, { all: true });
+    if (!addrs.length)
+        throw new Error(`could not resolve ${host}`);
+    for (const a of addrs) {
+        const family = isIP(a.address);
+        if (!family || family !== a.family)
+            throw new Error(`resolver returned an invalid address for ${host}`);
         if (isPrivateIp(a.address))
             throw new Error(`refusing to fetch ${host} — resolves to a private/internal address (${a.address})`);
+    }
+    const chosen = addrs[0];
+    return { address: chosen.address, family: chosen.family };
+}
+/** One HTTP hop whose TCP socket is pinned to the address approved above. `Host` and TLS SNI retain the
+ * original hostname, so virtual hosting/certificate checks work without a second DNS lookup. */
+async function requestPinned(url, pinned, signal) {
+    return new Promise((resolve, reject) => {
+        const request = (url.protocol === "https:" ? httpsRequest : httpRequest)({
+            protocol: url.protocol,
+            hostname: pinned.address,
+            family: pinned.family,
+            port: url.port || undefined,
+            path: `${url.pathname}${url.search}`,
+            method: "GET",
+            signal,
+            servername: url.hostname.replace(/^\[|\]$/g, ""),
+            headers: {
+                host: url.host,
+                "user-agent": "hara-cli",
+                accept: "text/html,text/plain,application/json,*/*",
+            },
+        }, (body) => {
+            const headers = new Headers();
+            for (let i = 0; i < body.rawHeaders.length; i += 2)
+                headers.append(body.rawHeaders[i], body.rawHeaders[i + 1]);
+            resolve({ status: body.statusCode ?? 0, headers, body });
+        });
+        request.once("error", reject);
+        request.end();
+    });
 }
 /** Read a fetch Response body up to `maxBytes`, then stop (avoids materializing a huge / bomb body). */
 async function readCapped(res, maxBytes) {
@@ -65,6 +171,25 @@ async function readCapped(res, maxBytes) {
     }
     return Buffer.concat(chunks).toString("utf8");
 }
+async function readPinnedCapped(res, maxBytes) {
+    const chunks = [];
+    let total = 0;
+    for await (const value of res) {
+        const chunk = Buffer.isBuffer(value) ? value : Buffer.from(value);
+        const remaining = maxBytes - total;
+        if (remaining <= 0) {
+            res.destroy();
+            break;
+        }
+        chunks.push(chunk.length > remaining ? chunk.subarray(0, remaining) : chunk);
+        total += Math.min(chunk.length, remaining);
+        if (chunk.length >= remaining) {
+            res.destroy();
+            break;
+        }
+    }
+    return Buffer.concat(chunks).toString("utf8");
+}
 /** Strip HTML to a readable-ish plain-text approximation (no dependency). */
 export function htmlToText(html) {
     return html
@@ -228,34 +353,22 @@ async function searchFetch(url, init) {
     return fetch(url, { ...init, signal: AbortSignal.timeout(SEARCH_ATTEMPT_MS) });
 }
 async function firstSuccessfulSearch(attempts, failures) {
-    if (!attempts.length)
-        return null;
-    return new Promise((resolve) => {
-        let remaining = attempts.length;
-        let settled = false;
-        for (const attempt of attempts) {
-            void attempt
-                .run()
-                .then((results) => {
-                if (results.length && !settled) {
-                    settled = true;
-                    resolve(results);
-                }
-                else if (!results.length) {
-                    failures.push(`${attempt.name} no results`);
-                }
-            })
-                .catch((e) => {
-                const reason = e?.name === "TimeoutError" || e?.name === "AbortError" ? "timeout" : (e?.message ?? String(e));
-                failures.push(`${attempt.name} ${reason}`);
-            })
-                .finally(() => {
-                remaining--;
-                if (remaining === 0 && !settled)
-                    resolve(null);
-            });
+    // Try one provider at a time. Search terms can be sensitive; a successful request must not be mirrored
+    // to unrelated providers merely to save a few seconds, and sequential fallback also avoids leaving
+    // losing requests running after the tool has already returned.
+    for (const attempt of attempts) {
+        try {
+            const results = await attempt.run();
+            if (results.length)
+                return results;
+            failures.push(`${attempt.name} no results`);
         }
-    });
+        catch (e) {
+            const reason = e?.name === "TimeoutError" || e?.name === "AbortError" ? "timeout" : (e?.message ?? String(e));
+            failures.push(`${attempt.name} ${reason}`);
+        }
+    }
+    return null;
 }
 registerTool({
     name: "web_search",
@@ -278,8 +391,8 @@ registerTool({
         const limit = Math.min(Math.max(1, Number(input.limit) || 6), 10);
         const fmt = (rs) => rs.map((r, n) => `${n + 1}. ${r.title}\n   ${r.url}${r.snippet ? `\n   ${r.snippet}` : ""}`).join("\n\n");
         const failures = [];
-        // Race the configured agent-search API against a mainland-accessible HTML source. A blocked Tavily
-        // endpoint no longer adds an 8-second penalty before Hara starts the domestic fallback.
+        // Prefer the explicitly configured agent-search API. Only disclose the query to another provider if
+        // that request fails or returns no results; without a key, start with mainland-accessible Bing CN.
         const key = process.env.HARA_SEARCH_API_KEY || process.env.TAVILY_API_KEY;
         const primaryAttempts = [];
         if (key) {
@@ -314,8 +427,8 @@ registerTool({
         const primary = await firstSuccessfulSearch(primaryAttempts, failures);
         if (primary)
             return wrapUntrusted(fmt(primary), `web_search: ${q}`);
-        // Secondary sources run concurrently, keeping total failure latency bounded. Google is included as a
-        // user-friendly fallback where it is reachable, but is never the sole path (mainland often gets a shell).
+        // Secondary sources are ordered fallbacks. Google is included where reachable, but is never the sole
+        // path because mainland networks commonly receive a challenge or JavaScript shell.
         const secondary = await firstSuccessfulSearch([
             {
                 name: "Baidu",
@@ -394,22 +507,23 @@ registerTool({
             let current = url;
             let res;
             for (let hop = 0;; hop++) {
-                await assertPublicHost(current.hostname);
-                res = await fetch(current, {
-                    signal: ctrl.signal,
-                    redirect: "manual",
-                    headers: { "user-agent": "hara-cli", accept: "text/html,text/plain,application/json,*/*" },
-                });
+                const pinned = await resolvePublicHost(current.hostname);
+                res = await requestPinned(current, pinned, ctrl.signal);
                 const loc = res.status >= 300 && res.status < 400 ? res.headers.get("location") : null;
                 if (!loc || hop >= 5)
                     break;
                 const next = new URL(loc, current);
-                if (next.protocol !== "http:" && next.protocol !== "https:")
+                if (next.protocol !== "http:" && next.protocol !== "https:") {
+                    res.body.destroy();
                     return "Error: redirect to a non-http(s) URL was blocked.";
+                }
+                // We never consume redirect bodies. Destroy the socket before following the next pinned hop so a
+                // server cannot accumulate idle response streams across a redirect chain.
+                res.body.destroy();
                 current = next;
             }
             const ct = res.headers.get("content-type") ?? "";
-            const raw = await readCapped(res, cap * 4); // byte ceiling (HTML→text shrinks; cap*4 leaves headroom)
+            const raw = await readPinnedCapped(res.body, cap * 4); // byte ceiling (HTML→text shrinks; cap*4 leaves headroom)
             let text = /html/i.test(ct) ? htmlToText(raw) : raw;
             if (text.length > cap)
                 text = text.slice(0, cap) + `\n…[truncated ${text.length - cap} chars]`;

package/dist/undo.js

@@ -1,7 +1,11 @@
 // In-session undo stack for file changes. Each edit tool records the prior state of the files it
 // touched; `/undo` pops the last group and restores it. Process-scoped (one REPL session).
-import { unlink } from "node:fs/promises";
-import { atomicWriteText } from "./fs-write.js";
+import { randomUUID } from "node:crypto";
+import { dirname, join } from "node:path";
+import { linkSync, lstatSync, readlinkSync, symlinkSync } from "node:fs";
+import { rename, symlink, unlink } from "node:fs/promises";
+import { atomicWriteText, discardClaimedPath, FileChangedError, removeCreatedDirectories } from "./fs-write.js";
+import { readRegularFileSnapshotNoFollow } from "./fs-read.js";
 import { invalidateFileCandidates } from "./context/mentions.js";
 const stack = [];
 const MAX = 50;
@@ -16,27 +20,99 @@ export function recordEdit(group) {
 export function undoDepth() {
     return stack.length;
 }
+async function restoreMovedFile(quarantine, target) {
+    const info = lstatSync(quarantine);
+    // link(2) may follow a symlink source on some platforms. Recreate its topology explicitly while retaining
+    // create-if-absent semantics; a regular inode can still use an atomic hard link.
+    const linkTarget = info.isSymbolicLink() ? readlinkSync(quarantine) : undefined;
+    if (linkTarget !== undefined)
+        symlinkSync(linkTarget, target);
+    else
+        linkSync(quarantine, target);
+    discardClaimedPath(quarantine, {
+        dev: info.dev,
+        ino: info.ino,
+        mode: info.mode & 0o777,
+        nlink: info.nlink + (linkTarget === undefined ? 1 : 0),
+        linkTarget,
+    });
+}
+/** Undo an update/create only if the path still names the exact inode and bytes written by that tool. */
+async function undoCommitted(s) {
+    if (!s.committed || s.after === undefined)
+        throw new Error(`missing committed snapshot for ${s.path}`);
+    const target = s.committed.target;
+    const quarantine = join(dirname(target), `.hara-undo-${process.pid}-${randomUUID()}.tmp`);
+    await rename(target, quarantine);
+    try {
+        // O_NOFOLLOW + same-fd fstat/read rejects a path replaced with a symlink to the committed inode.
+        const current = await readRegularFileSnapshotNoFollow(quarantine);
+        if (current.dev !== s.committed.dev ||
+            current.ino !== s.committed.ino ||
+            current.mode !== s.committed.mode ||
+            current.nlink !== s.committed.nlink ||
+            current.text !== s.after) {
+            await restoreMovedFile(quarantine, target);
+            throw new FileChangedError(s.path);
+        }
+        if (s.before === null) {
+            discardClaimedPath(quarantine, s.committed);
+            await removeCreatedDirectories(s.committed.createdDirs);
+            return;
+        }
+        await atomicWriteText(target, s.before, { expected: null, mode: s.beforeMode });
+        discardClaimedPath(quarantine, s.committed);
+    }
+    catch (error) {
+        // If restoration failed after the owned inode was moved, put it back only when the destination is still
+        // absent. link(2) never overwrites a concurrent file; leave quarantine for recovery if another appeared.
+        try {
+            await restoreMovedFile(quarantine, target);
+        }
+        catch {
+            /* the original error remains the useful user-facing failure */
+        }
+        throw error;
+    }
+}
 /** Restore the most recent edit group. Returns the files reverted, or an error. */
 export async function undoLast() {
     const group = stack.pop();
     if (!group)
         return { error: "nothing to undo" };
     const files = [];
+    const failures = [];
     for (const s of group) {
         try {
-            if (s.before === null) {
-                await unlink(s.absPath).catch(() => { }); // was newly created → remove
+            if (s.committed && s.after !== undefined) {
+                await undoCommitted(s);
+            }
+            else if (s.before === null) {
+                try {
+                    await unlink(s.absPath); // legacy snapshot: was newly created → remove
+                }
+                catch (error) {
+                    if (error?.code !== "ENOENT")
+                        throw error;
+                }
+            }
+            else if (s.linkTarget !== undefined) {
+                await symlink(s.linkTarget, s.absPath); // atomic create-if-absent; never clobbers a newer path
             }
             else {
-                await atomicWriteText(s.absPath, s.before);
+                await atomicWriteText(s.absPath, s.before, { expected: s.removed ? null : undefined, mode: s.beforeMode });
             }
             files.push(s.path);
         }
-        catch {
-            /* skip a file we can't restore */
+        catch (error) {
+            failures.push(`${s.path}: ${error?.message ?? String(error)}`);
         }
     }
     if (files.length)
         invalidateFileCandidates();
+    if (failures.length) {
+        const prefix = files.length ? `partially reverted ${files.join(", ")}; ` : "";
+        return { error: `${prefix}could not safely undo ${failures.join("; ")}` };
+    }
     return { files };
 }

package/package.json

@@ -1,14 +1,15 @@
 {
   "name": "@nanhara/hara",
-  "version": "0.121.1",
+  "version": "0.122.1",
   "description": "hara — a coding agent CLI that runs like an engineering org.",
   "bin": {
-    "hara": "dist/index.js"
+    "hara": "runtime-bootstrap.cjs"
   },
   "type": "module",
   "files": [
     "dist",
     "!dist/bin",
+    "runtime-bootstrap.cjs",
     "README.md",
     "CHANGELOG.md",
     "SECURITY.md",
@@ -35,16 +36,16 @@
     "url": "git+https://github.com/hara-cli/hara.git"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=22.12.0"
   },
   "scripts": {
-    "build": "tsc",
-    "prepare": "tsc",
-    "dev": "tsx src/index.ts",
-    "start": "node dist/index.js",
-    "test": "tsc && node --test test/*.test.mjs",
-    "build:binary": "tsc && bun scripts/build-binary.ts dist/bin/hara",
-    "build:binaries": "tsc && bun scripts/build-binary.ts dist/bin/hara-darwin-arm64 bun-darwin-arm64 && bun scripts/build-binary.ts dist/bin/hara-darwin-x64 bun-darwin-x64 && bun scripts/build-binary.ts dist/bin/hara-linux-x64 bun-linux-x64 && bun scripts/build-binary.ts dist/bin/hara-linux-arm64 bun-linux-arm64"
+    "build": "tsc && node scripts/normalize-dist-modes.mjs",
+    "prepare": "npm run build",
+    "dev": "tsx src/cli.ts",
+    "start": "node runtime-bootstrap.cjs",
+    "test": "npm run build && node --test test/*.test.mjs",
+    "build:binary": "npm run build && bun scripts/build-binary.ts dist/bin/hara",
+    "build:binaries": "npm run build && bun scripts/build-binary.ts dist/bin/hara-darwin-arm64 bun-darwin-arm64 && bun scripts/build-binary.ts dist/bin/hara-darwin-x64 bun-darwin-x64 && bun scripts/build-binary.ts dist/bin/hara-linux-x64 bun-linux-x64 && bun scripts/build-binary.ts dist/bin/hara-linux-arm64 bun-linux-arm64"
   },
   "publishConfig": {
     "access": "public"

package/runtime-bootstrap.cjs

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+"use strict";
+
+// This file is the npm/Docker entry point. Keep it dependency-free and parseable by old Node releases so
+// users get an upgrade instruction instead of a SyntaxError from Hara's ESM output or its dependencies.
+var MIN_NODE_MAJOR = 22;
+var MIN_NODE_VERSION = "22.12.0";
+
+function supportedNodeVersion(version) {
+  var match = /^(\d+)\.(\d+)\.(\d+)$/.exec(version);
+  if (!match) return false;
+  var current = [Number(match[1]), Number(match[2]), Number(match[3])];
+  var minimum = MIN_NODE_VERSION.split(".").map(Number);
+  for (var index = 0; index < minimum.length; index += 1) {
+    if (current[index] > minimum[index]) return true;
+    if (current[index] < minimum[index]) return false;
+  }
+  return true;
+}
+
+function unsupportedNodeMessage(versions) {
+  versions = versions || process.versions;
+  if (versions.bun) return null;
+
+  var version = String(versions.node || "unknown");
+  if (supportedNodeVersion(version)) return null;
+  var major = Number.parseInt(version, 10);
+  var detail = major === MIN_NODE_MAJOR
+    ? "This Node.js 22 release is below Hara's supported " + MIN_NODE_VERSION + " floor."
+    : "This Node.js release is below Hara's supported " + MIN_NODE_VERSION + " floor.";
+  return [
+    "Hara requires Node.js " + MIN_NODE_VERSION + " or newer (detected " + version + ").",
+    detail,
+    "Upgrade with: nvm install " + MIN_NODE_MAJOR + " && nvm use " + MIN_NODE_MAJOR,
+    "Or install the standalone Hara binary, which does not require Node.js:",
+    "  curl -fsSL https://raw.githubusercontent.com/hara-cli/hara/main/install.sh | sh",
+  ].join("\n");
+}
+
+function failStart(error) {
+  var message = error && error.message ? error.message : String(error);
+  process.stderr.write("hara: failed to start: " + message + "\n");
+  process.exitCode = 1;
+}
+
+function main() {
+  var runtimeError = unsupportedNodeMessage(process.versions);
+  if (runtimeError) {
+    process.stderr.write(runtimeError + "\n");
+    process.exitCode = 1;
+    return;
+  }
+
+  try {
+    // Keeping import() inside a string prevents legacy parsers from seeing unsupported ESM syntax. This
+    // branch is reached only on the supported Node floor (or Bun when used as a script runtime).
+    var load = Function("specifier", "return import(specifier)");
+    var entry = require("url").pathToFileURL(require("path").join(__dirname, "dist", "index.js")).href;
+    load(entry).catch(failStart);
+  } catch (error) {
+    failStart(error);
+  }
+}
+
+module.exports = {
+  MIN_NODE_MAJOR: MIN_NODE_MAJOR,
+  MIN_NODE_VERSION: MIN_NODE_VERSION,
+  supportedNodeVersion: supportedNodeVersion,
+  unsupportedNodeMessage: unsupportedNodeMessage,
+};
+
+if (require.main === module) main();