@openagents-org/agent-launcher 0.2.158 → 0.2.159

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openagents-org/agent-launcher",
-  "version": "0.2.158",
+  "version": "0.2.159",
   "description": "OpenAgents Launcher \u2014 install, configure, and run AI coding agents from your terminal",
   "main": "src/index.js",
   "bin": {

package/src/installer.js

@@ -6,6 +6,7 @@ const path = require('path');
 const { execSync, exec } = require('child_process');
 const { whichBinary, getEnhancedEnv, getRuntimePrefix, clearBinaryLookupCache, aiderBinDirs, resolveBinaryInKnownDirs } = require('./paths');
 const { EnvManager } = require('./env');
+const { nodeDistUrls, installRegistry } = require('./mirrors');
 const { readinessReason, REASON } = require('./adapters/health-status');
 
 const STATUS_CACHE_TTL_MS = 10000;
@@ -1013,8 +1014,14 @@ class Installer {
         .split(/\s+/)
         .filter(Boolean);
       // Use --save so npm tracks the package in package.json (prevents pruning
-      // on next install).
-      const npmArgs = ['install', '--loglevel=verbose', '--save', '--prefix', prefixDir, ...pkgArgs];
+      // on next install). --registry is added only when we'd be helping — see
+      // installRegistry(); a user's own registry choice is never overridden.
+      const registry = installRegistry();
+      const npmArgs = [
+        'install', '--loglevel=verbose', '--save', '--prefix', prefixDir,
+        ...(registry ? ['--registry', registry] : []),
+        ...pkgArgs,
+      ];
       displayCmd = `npm ${npmArgs.join(' ')}`;
 
       const direct = this._resolveNodeNpmCli();
@@ -1031,7 +1038,8 @@ class Installer {
         }
       } else {
         // Legacy fallback: quoted prefix inside a shell string.
-        const args = `install --loglevel=verbose --save --prefix "${prefixDir}" ${pkgArgs.join(' ')}`;
+        const registryArg = registry ? `--registry ${registry} ` : '';
+        const args = `install --loglevel=verbose --save --prefix "${prefixDir}" ${registryArg}${pkgArgs.join(' ')}`;
         spawnFile = this._wrapForWindowsShell(this._resolveNpmCommand(args));
         useShell = isWin ? (env.ComSpec || 'C:\\Windows\\System32\\cmd.exe') : true;
         displayCmd = spawnFile;
@@ -1623,11 +1631,13 @@ class Installer {
     if (plat === 'windows') {
       // Download portable zip — no admin required
       const arch = os.arch() === 'x64' ? 'x64' : 'x86';
-      const url = `https://nodejs.org/dist/${nodeVersion}/node-${nodeVersion}-win-${arch}.zip`;
       const zipPath = path.join(os.tmpdir(), `node-${nodeVersion}.zip`);
 
-      if (onData) onData(`Downloading ${url}...\n`);
-      await this._downloadFile(url, zipPath, onData);
+      await this._downloadFirst(
+        nodeDistUrls(`${nodeVersion}/node-${nodeVersion}-win-${arch}.zip`),
+        zipPath,
+        onData
+      );
 
       // Extract to ~/.openagents/nodejs/
       const nodejsDir = path.join(this.configDir, 'nodejs');
@@ -1688,11 +1698,13 @@ class Installer {
       const arch = process.arch === 'arm64' ? 'arm64' : 'x64';
       const ext = plat === 'macos' ? 'tar.gz' : 'tar.xz';
       const platName = plat === 'macos' ? 'darwin' : 'linux';
-      const url = `https://nodejs.org/dist/${nodeVersion}/node-${nodeVersion}-${platName}-${arch}.${ext}`;
       const tarPath = path.join(os.tmpdir(), `node-${nodeVersion}.${ext}`);
 
-      if (onData) onData(`Downloading ${url}...\n`);
-      await this._downloadFile(url, tarPath, onData);
+      await this._downloadFirst(
+        nodeDistUrls(`${nodeVersion}/node-${nodeVersion}-${platName}-${arch}.${ext}`),
+        tarPath,
+        onData
+      );
 
       const nodeDir = path.join(this.configDir, 'nodejs');
       fs.mkdirSync(nodeDir, { recursive: true });
@@ -1725,23 +1737,61 @@ class Installer {
   /**
    * Download a file with progress reporting.
    */
+  /**
+   * Try each candidate URL in order until one delivers the file. Mirrors carry
+   * identical bytes, so a slow or unreachable origin costs one timeout instead
+   * of failing the whole install.
+   */
+  async _downloadFirst(urls, destPath, onData) {
+    let lastErr = null;
+    for (const url of urls) {
+      try {
+        if (onData) onData(`Downloading ${url}...\n`);
+        await this._downloadFile(url, destPath, onData);
+        return url;
+      } catch (err) {
+        lastErr = err;
+        if (onData) onData(`  failed (${err.message}) — trying next source\n`);
+      }
+    }
+    throw lastErr || new Error('Download failed: no sources available');
+  }
+
+  /**
+   * Download a file with progress reporting.
+   *
+   * Writes to `${destPath}.part` and renames on success: a partial file left at
+   * the final path reads as "already installed" on the next run and produces a
+   * corrupt runtime. A stall timeout and a short-read check are what turn a
+   * silently truncated transfer into a retryable error.
+   */
   _downloadFile(url, destPath, onData) {
     const https = require('https');
     const http = require('http');
+    const STALL_TIMEOUT_MS = 30000;
+    const tmpPath = `${destPath}.part`;
+    try { fs.unlinkSync(tmpPath); } catch {}
+
     return new Promise((resolve, reject) => {
       const get = url.startsWith('https') ? https.get : http.get;
-      get(url, (res) => {
+      const fail = (err) => {
+        try { fs.unlinkSync(tmpPath); } catch {}
+        reject(err);
+      };
+      const req = get(url, (res) => {
         if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
-          // Follow redirect
-          return this._downloadFile(res.headers.location, destPath, onData).then(resolve, reject);
+          res.resume();
+          const next = new URL(res.headers.location, url).toString();
+          return this._downloadFile(next, destPath, onData).then(resolve, reject);
         }
         if (res.statusCode !== 200) {
-          return reject(new Error(`Download failed: HTTP ${res.statusCode}`));
+          res.resume();
+          return fail(new Error(`Download failed: HTTP ${res.statusCode}`));
         }
         const totalBytes = parseInt(res.headers['content-length'] || '0', 10);
         let downloaded = 0;
         let lastPercent = -1;
-        const file = fs.createWriteStream(destPath);
+        const file = fs.createWriteStream(tmpPath);
         res.on('data', (chunk) => {
           downloaded += chunk.length;
           if (totalBytes > 0) {
@@ -1752,10 +1802,29 @@ class Installer {
             }
           }
         });
+        res.on('error', fail);
+        file.on('error', fail);
         res.pipe(file);
-        file.on('finish', () => { file.close(); resolve(); });
-        file.on('error', reject);
-      }).on('error', reject);
+        file.on('finish', () => {
+          file.close(() => {
+            if (totalBytes > 0 && downloaded !== totalBytes) {
+              return fail(new Error(`Truncated download: ${downloaded} of ${totalBytes} bytes`));
+            }
+            try {
+              fs.renameSync(tmpPath, destPath);
+            } catch (err) {
+              return fail(err);
+            }
+            resolve();
+          });
+        });
+      });
+      // Guard the connection itself: without this a black-holed origin keeps
+      // the promise pending forever and the install just sits there.
+      req.setTimeout(STALL_TIMEOUT_MS, () => {
+        req.destroy(new Error(`Download timed out after ${STALL_TIMEOUT_MS / 1000}s`));
+      });
+      req.on('error', fail);
     });
   }
 

package/src/mirrors.js

@@ -0,0 +1,119 @@
+'use strict';
+
+/**
+ * Region-aware download origins.
+ *
+ * The core downloads a portable Node.js runtime (nodejs.org) and talks to the
+ * npm registry. Both are slow to unusable from mainland China, which shows up
+ * as an install that appears to hang. Mirrors carry byte-identical copies under
+ * the same path layout, so the only decision is which origin to try first —
+ * every list keeps the official one as the final fallback.
+ *
+ * Where the region comes from, in order:
+ *   1. OPENAGENTS_NODE_MIRRORS / OPENAGENTS_NPM_MIRRORS — explicit, comma
+ *      separated base URLs. The launcher sets these from its own Settings →
+ *      Network preference so the core inherits the user's actual choice
+ *      instead of guessing again in a child process.
+ *   2. OPENAGENTS_DOWNLOAD_REGION = cn | global — explicit override for CLI
+ *      users and support.
+ *   3. Timezone / locale detection (best effort).
+ */
+
+const OFFICIAL_NODE = 'https://nodejs.org/dist';
+const CN_NODE = [
+  'https://cdn.npmmirror.com/binaries/node',
+  'https://mirrors.aliyun.com/nodejs-release',
+  'https://mirrors.huaweicloud.com/nodejs',
+];
+const OFFICIAL_NPM = 'https://registry.npmjs.org';
+const CN_NPM = [
+  'https://registry.npmmirror.com',
+  'https://mirrors.cloud.tencent.com/npm',
+];
+
+function envBases(name) {
+  return (process.env[name] || '')
+    .split(',')
+    .map((s) => s.trim().replace(/\/+$/, ''))
+    .filter((s) => /^https?:\/\//.test(s));
+}
+
+function inChina() {
+  const region = (process.env.OPENAGENTS_DOWNLOAD_REGION || '').toLowerCase();
+  if (region === 'cn') return true;
+  if (region === 'global') return false;
+  try {
+    const tz = Intl.DateTimeFormat().resolvedOptions().timeZone || '';
+    if (/Shanghai|Chongqing|Chungking|Urumqi|Harbin|Kashgar|PRC/i.test(tz)) return true;
+  } catch {}
+  const locale = (process.env.LC_ALL || process.env.LANG || '').toLowerCase();
+  if (locale.startsWith('zh_cn') || locale.startsWith('zh-cn')) return true;
+  return false;
+}
+
+function bases(envName, official, mirrors) {
+  const fromEnv = envBases(envName);
+  if (fromEnv.length) {
+    // Trust the caller's list, but never drop the official origin entirely —
+    // a mirror outage must still degrade to "slow", not "broken".
+    return fromEnv.includes(official) ? fromEnv : [...fromEnv, official];
+  }
+  return inChina() ? [...mirrors, official] : [official];
+}
+
+/** Candidate URLs for a Node dist path, e.g. "v22.22.3/node-v22.22.3-darwin-arm64.tar.gz". */
+function nodeDistUrls(relPath) {
+  return bases('OPENAGENTS_NODE_MIRRORS', OFFICIAL_NODE, CN_NODE).map(
+    (base) => `${base}/${relPath}`
+  );
+}
+
+/** Candidate URLs for an npm registry path, e.g. "@scope/pkg/latest". */
+function npmUrls(relPath) {
+  return bases('OPENAGENTS_NPM_MIRRORS', OFFICIAL_NPM, CN_NPM).map(
+    (base) => `${base}/${relPath}`
+  );
+}
+
+/** Registry base for `npm install --registry`. */
+function npmRegistry() {
+  return process.env.npm_config_registry || npmUrls('').slice(0, 1)[0].replace(/\/$/, '');
+}
+
+/** A registry the user (or the launcher) has already chosen, if any. */
+function userConfiguredRegistry() {
+  if (process.env.npm_config_registry) return process.env.npm_config_registry;
+  try {
+    const fs = require('fs');
+    const os = require('os');
+    const path = require('path');
+    const rc = fs.readFileSync(path.join(os.homedir(), '.npmrc'), 'utf-8');
+    const match = /^\s*registry\s*=\s*(\S+)/m.exec(rc);
+    if (match) return match[1];
+  } catch {}
+  return null;
+}
+
+/**
+ * Registry to force via `--registry` when installing an agent runtime, or null
+ * to leave npm's own resolution alone.
+ *
+ * Agent runtimes are the biggest download of a first run (a CLI plus its whole
+ * dependency tree), and they install through a child npm process where our own
+ * mirror logic can't reach — the flag is the only lever. It stays null unless
+ * we'd actually be helping: an explicit npm_config_registry or a registry in
+ * the user's .npmrc (corporate proxy, private mirror) is honoured as-is.
+ */
+function installRegistry() {
+  if (userConfiguredRegistry()) return null;
+  return inChina() ? CN_NPM[0] : null;
+}
+
+module.exports = {
+  nodeDistUrls,
+  npmUrls,
+  npmRegistry,
+  installRegistry,
+  userConfiguredRegistry,
+  inChina,
+};

package/src/update-check.js

@@ -14,6 +14,7 @@ const os = require('os');
 const path = require('path');
 const readline = require('readline');
 const { execSync, spawnSync } = require('child_process');
+const { npmUrls } = require('./mirrors');
 
 const PKG_NAME = '@openagents-org/agent-launcher';
 const CACHE_FILE = path.join(os.homedir(), '.openagents', '.update-check.json');
@@ -51,10 +52,10 @@ function saveCache(latest) {
   } catch {}
 }
 
-function fetchLatest(timeoutMs = 2500) {
+function fetchLatestFrom(url, timeoutMs) {
   return new Promise((resolve) => {
     const req = https.request(
-      `https://registry.npmjs.org/${PKG_NAME}/latest`,
+      url,
       { method: 'GET', timeout: timeoutMs, headers: { Accept: 'application/json' } },
       (res) => {
         let body = '';
@@ -73,6 +74,21 @@ function fetchLatest(timeoutMs = 2500) {
   });
 }
 
+/**
+ * Ask each registry in turn (mirror first in China) with a per-origin budget,
+ * so the check either answers quickly or gives up quietly — it must never be
+ * what makes the CLI feel slow to start.
+ */
+async function fetchLatest(timeoutMs = 2500) {
+  const urls = npmUrls(`${PKG_NAME}/latest`);
+  const perOrigin = Math.max(1200, Math.floor(timeoutMs / urls.length));
+  for (const url of urls) {
+    const version = await fetchLatestFrom(url, perOrigin);
+    if (version) return version;
+  }
+  return null;
+}
+
 /**
  * Return { current, latest, isNewer } or null if the check failed / offline.
  */