@pentoshi/clai 2.0.28 → 2.0.30

package/dist/tools/nmap-runner.js

@@ -0,0 +1,177 @@
+import { platform } from "node:os";
+import { commandAvailable } from "../os/pkgmgr.js";
+import { spawnArgv } from "./shell.js";
+import { nmapScanNeedsPrivilege, toConnectScanArgv } from "./validate.js";
+/**
+ * Pick the OS-appropriate privilege-escalation prefix for a raw-socket scan.
+ *   - macOS / Linux  → `sudo` (clai forwards stdin so the user types their
+ *     password live; the runner's interactive-stdin path handles the prompt).
+ *   - Windows        → `sudo` on Win11 build 26052+ if present, else `gsudo`
+ *     if installed; otherwise no prefix (the user must run from an elevated
+ *     terminal — nmap SYN scans need Administrator + Npcap there).
+ * Returns the elevation command + leading argv, or undefined when no helper
+ * is available (caller then falls back to an unprivileged connect scan).
+ */
+async function elevationPrefix() {
+    if (process.getuid && process.getuid() === 0) {
+        // Already root — no wrapper needed.
+        return { command: "", argv: [] };
+    }
+    if (platform() === "win32") {
+        if (await commandAvailable("sudo"))
+            return { command: "sudo", argv: [] };
+        if (await commandAvailable("gsudo"))
+            return { command: "gsudo", argv: [] };
+        return undefined;
+    }
+    if (await commandAvailable("sudo")) {
+        // -p sets a clear prompt; clai's interactive-stdin lets the user type it.
+        return { command: "sudo", argv: ["-p", "[clai] sudo password for nmap: "] };
+    }
+    if (await commandAvailable("doas"))
+        return { command: "doas", argv: [] };
+    return undefined;
+}
+/** Heuristic: did an nmap/sudo invocation fail because of missing privileges? */
+function looksLikePrivilegeError(output) {
+    return /(?:requires root privileges|you (?:requested|need) (?:a scan type|root)|operation not permitted|must (?:be|run as) root|raw sockets?|sudo: (?:a (?:password|terminal) is required|no askpass|3 incorrect)|incorrect password|authentication failure|permission denied|requires (?:administrator|elevation))/i.test(output);
+}
+/**
+ * Run an nmap scan, transparently obtaining the privileges a stealth/raw
+ * scan needs and falling back to an unprivileged TCP connect scan when those
+ * privileges can't be obtained (no sudo, password declined, etc.).
+ *
+ * Strategy:
+ *   1. If the scan needs raw sockets and we're not root, wrap it in the
+ *      OS-appropriate elevation helper (sudo / doas / gsudo). stdin is
+ *      inherited so the user can type their password live — exactly the
+ *      pattern documented for shell.exec sudo.
+ *   2. If elevation is unavailable, or the privileged attempt fails in a way
+ *      that looks like a permission/privilege error, retry as `-sT` (TCP
+ *      connect) which works for any user on every OS.
+ * This is the "most general approach first, then fall back" behavior the
+ * scans need so they never dead-end on "you must be root".
+ */
+export async function runNmapScan(argv, options) {
+    const needsPrivilege = nmapScanNeedsPrivilege(argv);
+    const prefix = needsPrivilege ? await elevationPrefix() : undefined;
+    const attempts = [];
+    if (needsPrivilege && prefix) {
+        if (prefix.command === "sudo") {
+            // Authenticate in a short, dedicated process. In the TUI, never inherit
+            // stdin for the long nmap scan: pipe the already-entered password to
+            // sudo so Ink keeps receiving Escape/Ctrl+C while nmap is running.
+            options?.onOutput?.(options?.requestSecret
+                ? "\nAdministrator access is required for a stealth scan. Complete the secure password prompt below.\n"
+                : "\nAdministrator access is required for a stealth scan. Enter your sudo password below; Ctrl+C cancels.\n", "stdout");
+            let auth;
+            let sudoPassword;
+            if (options?.requestSecret) {
+                const password = await options.requestSecret({
+                    title: "Administrator access",
+                    prompt: "Enter your macOS password for sudo. It is sent only to sudo and is never stored.",
+                });
+                if (password === undefined) {
+                    return { ok: false, output: "Administrator authentication cancelled.", exitCode: 130 };
+                }
+                sudoPassword = password;
+                auth = await spawnArgv({
+                    command: "sudo",
+                    argv: ["-S", "-p", "", "-v"],
+                    stdinText: `${password}\n`,
+                    timeoutMs: 30_000,
+                    signal: options.signal,
+                    onOutput: options.onOutput,
+                    noArtifact: true,
+                    interactiveStdin: false,
+                });
+            }
+            else {
+                // Classic REPL: let sudo read directly from its controlling terminal.
+                auth = await spawnArgv({
+                    command: "sudo",
+                    argv: [...prefix.argv, "-v"],
+                    timeoutMs: 120_000,
+                    signal: options?.signal,
+                    onOutput: options?.onOutput,
+                    interactiveStdin: true,
+                    noArtifact: true,
+                });
+            }
+            if (options?.signal?.aborted || auth.exitCode === 130)
+                return auth;
+            if (auth.ok) {
+                attempts.push({
+                    command: "sudo",
+                    argv: options?.requestSecret ? ["-S", "-p", "", "nmap", ...argv] : ["-n", "nmap", ...argv],
+                    stdinText: options?.requestSecret ? `${sudoPassword ?? ""}\n` : undefined,
+                    note: "Administrator access confirmed. Starting stealth scan (ESC cancels).",
+                });
+            }
+            else {
+                options?.onOutput?.("\nSudo authentication was not completed; using an unprivileged TCP connect scan instead.\n", "stderr");
+            }
+        }
+        else if (prefix.command) {
+            attempts.push({
+                command: prefix.command,
+                argv: [...prefix.argv, "nmap", ...argv],
+                interactiveStdin: true,
+                note: `Running a stealth scan with ${prefix.command} (you may be prompted for your password).`,
+            });
+        }
+        else {
+            // Already root.
+            attempts.push({ command: "nmap", argv });
+        }
+        // Fallback: unprivileged connect scan if elevation fails/declines.
+        attempts.push({
+            command: "nmap",
+            argv: toConnectScanArgv(argv),
+            note: "Privileged scan unavailable — falling back to an unprivileged TCP connect scan (-sT).",
+        });
+    }
+    else if (needsPrivilege && !prefix) {
+        // No elevation helper at all — go straight to the connect-scan fallback,
+        // but tell the user why the stealth scan was downgraded.
+        attempts.push({
+            command: "nmap",
+            argv: toConnectScanArgv(argv),
+            note: platform() === "win32"
+                ? "No elevation helper found (sudo/gsudo). Run from an Administrator terminal with Npcap for a SYN scan; using a TCP connect scan (-sT) for now."
+                : "No sudo/doas available for a raw-socket SYN scan — using an unprivileged TCP connect scan (-sT) instead.",
+        });
+    }
+    else {
+        attempts.push({ command: "nmap", argv });
+    }
+    let last;
+    for (let i = 0; i < attempts.length; i += 1) {
+        const attempt = attempts[i];
+        if (options?.signal?.aborted) {
+            return { ok: false, output: "Command aborted.", exitCode: 130 };
+        }
+        if (attempt.note)
+            options?.onOutput?.(`\n${attempt.note}\n`, "stdout");
+        const result = await spawnArgv({
+            command: attempt.command,
+            argv: attempt.argv,
+            stdinText: attempt.stdinText,
+            timeoutMs: 300_000,
+            signal: options?.signal,
+            onOutput: options?.onOutput,
+            ...(attempt.interactiveStdin !== undefined
+                ? { interactiveStdin: attempt.interactiveStdin }
+                : {}),
+        });
+        last = result;
+        // Success, or a non-privilege failure we shouldn't paper over → return.
+        const isLastAttempt = i === attempts.length - 1;
+        if (result.ok || isLastAttempt || !looksLikePrivilegeError(result.output)) {
+            return result;
+        }
+        // Otherwise loop to the next (fallback) attempt.
+    }
+    return last ?? { ok: false, output: "nmap produced no result.", exitCode: 1 };
+}
+//# sourceMappingURL=nmap-runner.js.map

package/dist/tools/nmap-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nmap-runner.js","sourceRoot":"","sources":["../../src/tools/nmap-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAG1E;;;;;;;;;GASG;AACH,KAAK,UAAU,eAAe;IAG5B,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;QAC7C,oCAAoC;QACpC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC3B,IAAI,MAAM,gBAAgB,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACzE,IAAI,MAAM,gBAAgB,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC3E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,0EAA0E;QAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,iCAAiC,CAAC,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,MAAM,gBAAgB,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACzE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,iFAAiF;AACjF,SAAS,uBAAuB,CAAC,MAAc;IAC7C,OAAO,8SAA8S,CAAC,IAAI,CACxT,MAAM,CACP,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAc,EACd,OAAwB;IAExB,MAAM,cAAc,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,MAAM,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAEpE,MAAM,QAAQ,GAMT,EAAE,CAAC;IAER,IAAI,cAAc,IAAI,MAAM,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAC9B,wEAAwE;YACxE,qEAAqE;YACrE,mEAAmE;YACnE,OAAO,EAAE,QAAQ,EAAE,CACjB,OAAO,EAAE,aAAa;gBACpB,CAAC,CAAC,qGAAqG;gBACvG,CAAC,CAAC,0GAA0G,EAC9G,QAAQ,CACT,CAAC;YACF,IAAI,IAAgB,CAAC;YACrB,IAAI,YAAgC,CAAC;YACrC,IAAI,OAAO,EAAE,aAAa,EAAE,CAAC;gBAC3B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC;oBAC3C,KAAK,EAAE,sBAAsB;oBAC7B,MAAM,EAAE,kFAAkF;iBAC3F,CAAC,CAAC;gBACH,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;gBACzF,CAAC;gBACD,YAAY,GAAG,QAAQ,CAAC;gBACxB,IAAI,GAAG,MAAM,SAAS,CAAC;oBACrB,OAAO,EAAE,MAAM;oBACf,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC;oBAC5B,SAAS,EAAE,GAAG,QAAQ,IAAI;oBAC1B,SAAS,EAAE,MAAM;oBACjB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,UAAU,EAAE,IAAI;oBAChB,gBAAgB,EAAE,KAAK;iBACxB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,sEAAsE;gBACtE,IAAI,GAAG,MAAM,SAAS,CAAC;oBACrB,OAAO,EAAE,MAAM;oBACf,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;oBAC5B,SAAS,EAAE,OAAO;oBAClB,MAAM,EAAE,OAAO,EAAE,MAAM;oBACvB,QAAQ,EAAE,OAAO,EAAE,QAAQ;oBAC3B,gBAAgB,EAAE,IAAI;oBACtB,UAAU,EAAE,IAAI;iBACjB,CAAC,CAAC;YACL,CAAC;YACD,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YACnE,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;gBACZ,QAAQ,CAAC,IAAI,CAAC;oBACZ,OAAO,EAAE,MAAM;oBACf,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;oBAC1F,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,YAAY,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS;oBACzE,IAAI,EAAE,sEAAsE;iBAC7E,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,OAAO,EAAE,QAAQ,EAAE,CACjB,4FAA4F,EAC5F,QAAQ,CACT,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;gBACvC,gBAAgB,EAAE,IAAI;gBACtB,IAAI,EAAE,+BAA+B,MAAM,CAAC,OAAO,2CAA2C;aAC/F,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,gBAAgB;YAChB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,mEAAmE;QACnE,QAAQ,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC;YAC7B,IAAI,EAAE,uFAAuF;SAC9F,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,cAAc,IAAI,CAAC,MAAM,EAAE,CAAC;QACrC,yEAAyE;QACzE,yDAAyD;QACzD,QAAQ,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC;YAC7B,IAAI,EACF,QAAQ,EAAE,KAAK,OAAO;gBACpB,CAAC,CAAC,+IAA+I;gBACjJ,CAAC,CAAC,0GAA0G;SACjH,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,IAA4B,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;QAC7B,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;QAClE,CAAC;QACD,IAAI,OAAO,CAAC,IAAI;YAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,IAAI,EAAE,QAAQ,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;YAC7B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,OAAO,EAAE,MAAM;YACvB,QAAQ,EAAE,OAAO,EAAE,QAAQ;YAC3B,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;gBACxC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE;gBAChD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,IAAI,GAAG,MAAM,CAAC;QACd,wEAAwE;QACxE,MAAM,aAAa,GAAG,CAAC,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,EAAE,IAAI,aAAa,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1E,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,iDAAiD;IACnD,CAAC;IACD,OAAO,IAAI,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AAChF,CAAC"}

package/dist/tools/package-binary.d.ts

@@ -0,0 +1 @@
+export declare function packageBinaryName(pkg: string): string;

package/dist/tools/package-binary.js

@@ -0,0 +1,30 @@
+/**
+ * Map a package name to the executable it installs, when they differ. Used
+ * by pkg.install to check whether the tool already exists before installing.
+ * Most packages share their binary name, so this only lists the exceptions.
+ */
+const PACKAGE_BINARY_ALIASES = {
+    ripgrep: "rg",
+    dnsutils: "dig",
+    "bind-utils": "dig",
+    "bind9-dnsutils": "dig",
+    "python3-pip": "pip3",
+    "build-essential": "gcc",
+    nodejs: "node",
+    golang: "go",
+    "g++": "g++",
+    imagemagick: "magick",
+    "netcat-openbsd": "nc",
+    "net-tools": "ifconfig",
+    coreutils: "ls",
+};
+export function packageBinaryName(pkg) {
+    const lower = pkg.toLowerCase();
+    if (PACKAGE_BINARY_ALIASES[lower])
+        return PACKAGE_BINARY_ALIASES[lower];
+    // Strip a tap/cask prefix (homebrew "owner/tap/name" → "name") and any
+    // version suffix (apt "pkg=1.2" → "pkg") so the binary guess is sane.
+    const noTap = pkg.includes("/") ? pkg.slice(pkg.lastIndexOf("/") + 1) : pkg;
+    return noTap.split(/[=@:]/)[0] ?? noTap;
+}
+//# sourceMappingURL=package-binary.js.map

package/dist/tools/package-binary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-binary.js","sourceRoot":"","sources":["../../src/tools/package-binary.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,sBAAsB,GAA2B;IACrD,OAAO,EAAE,IAAI;IACb,QAAQ,EAAE,KAAK;IACf,YAAY,EAAE,KAAK;IACnB,gBAAgB,EAAE,KAAK;IACvB,aAAa,EAAE,MAAM;IACrB,iBAAiB,EAAE,KAAK;IACxB,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,IAAI;IACZ,KAAK,EAAE,KAAK;IACZ,WAAW,EAAE,QAAQ;IACrB,gBAAgB,EAAE,IAAI;IACtB,WAAW,EAAE,UAAU;IACvB,SAAS,EAAE,IAAI;CAChB,CAAC;AAEF,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,IAAI,sBAAsB,CAAC,KAAK,CAAC;QAAE,OAAO,sBAAsB,CAAC,KAAK,CAAE,CAAC;IACzE,uEAAuE;IACvE,sEAAsE;IACtE,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5E,OAAO,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;AAC1C,CAAC"}

package/dist/tools/pdf.js

@@ -90,7 +90,7 @@ export async function pdfRead(args, options = {}) {
             exitCode: 1,
         };
     }
-    // ── Step 1: fast text extraction for born-digital PDFs ────────────────
+    // Step 1: fast text extraction for born-digital PDFs
     let textLayerOutput = "";
     if (await commandAvailable("pdftotext")) {
         const direct = await spawnArgv({
@@ -115,7 +115,7 @@ export async function pdfRead(args, options = {}) {
     if (options.signal?.aborted) {
         return { ok: false, output: "pdf.read aborted.", exitCode: 130 };
     }
-    // ── Step 2: scanned PDF → render pages then OCR each one ──────────────
+    // Step 2: scanned PDF → render pages then OCR each one
     const missing = [];
     if (!(await commandAvailable("pdftoppm")))
         missing.push("pdftoppm (poppler)");

package/dist/tools/pdf.js.map

@@ -1 +1 @@
-{"version":3,"file":"pdf.js","sourceRoot":"","sources":["../../src/tools/pdf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAOvC,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,OAAO,EAAE,CAAC;IACnC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,OAAO,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CACrB,IAA6B,EAC7B,GAAW;IAEX,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,SAAS,cAAc,CACrB,IAA6B,EAC7B,GAAW;IAEX,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC3C,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,uEAAuE;AACvE,yEAAyE;AACzE,0EAA0E;AAC1E,mBAAmB;AACnB,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,IAA6B,EAC7B,UAA6B,EAAE;IAE/B,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,kDAAkD;YAC1D,QAAQ,EAAE,CAAC;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC;IACnD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,6DAA6D;YACrE,QAAQ,EAAE,CAAC;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,GAAG,EAAE,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;QACtD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,iDAAiD;YACzD,QAAQ,EAAE,CAAC;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YACnB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,iCAAiC,IAAI,EAAE;gBAC/C,QAAQ,EAAE,CAAC;aACZ,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,yBAAyB,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YAClG,QAAQ,EAAE,CAAC;SACZ,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,IAAI,eAAe,GAAG,EAAE,CAAC;IACzB,IAAI,MAAM,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;YAC7B,OAAO,EAAE,WAAW;YACpB,IAAI,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC;YAC5B,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,UAAU,EAAE,IAAI;YAChB,aAAa,EAAE,OAAO;SACvB,CAAC,CAAC;QACH,2EAA2E;QAC3E,0EAA0E;QAC1E,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;QACtE,IAAI,mBAAmB,CAAC,eAAe,CAAC,IAAI,oBAAoB,EAAE,CAAC;YACjE,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,eAAe,CAAC,IAAI,EAAE;aAC/B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;IACnE,CAAC;IAED,yEAAyE;IACzE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC9E,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,GACR,eAAe,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAC/B,CAAC,CAAC,uCAAuC,eAAe,CAAC,IAAI,EAAE,EAAE;YACjE,CAAC,CAAC,EAAE,CAAC;QACT,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EACJ,4FAA4F,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBAClH,wFAAwF,IAAI,EAAE;YAChG,QAAQ,EAAE,CAAC;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrC,OAAO,CAAC,QAAQ,EAAE,CAChB,mDAAmD,EACnD,QAAQ,CACT,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;YAC7B,OAAO,EAAE,UAAU;YACnB,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC;YAC/C,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC3C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,wDAAwD,MAAM,CAAC,MAAM,EAAE;gBAC/E,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,CAAC;aAC/B,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;aACrC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;aACrD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACpE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EACJ,6EAA6E;gBAC/E,QAAQ,EAAE,CAAC;aACZ,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;YACnE,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC;YAC7C,OAAO,CAAC,QAAQ,EAAE,CAChB,cAAc,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,EAC1C,QAAQ,CACT,CAAC;YACF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC;gBAC1B,OAAO,EAAE,WAAW;gBACpB,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC;gBACrD,SAAS,EAAE,OAAO;gBAClB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,OAAO;aACvB,CAAC,CAAC;YACH,iEAAiE;YACjE,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACrE,SAAS,CAAC,IAAI,CACZ,cAAc,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,mCAAmC,EAAE,CAC5E,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EACJ,4GAA4G;gBAC9G,QAAQ,EAAE,CAAC;aACZ,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,4CAA4C,OAAO,CAAC,MAAM,gBAAgB,QAAQ,EAAE;SAC7F,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC"}
+{"version":3,"file":"pdf.js","sourceRoot":"","sources":["../../src/tools/pdf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAOvC,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,OAAO,EAAE,CAAC;IACnC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,OAAO,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CACrB,IAA6B,EAC7B,GAAW;IAEX,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,SAAS,cAAc,CACrB,IAA6B,EAC7B,GAAW;IAEX,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC3C,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,uEAAuE;AACvE,yEAAyE;AACzE,0EAA0E;AAC1E,mBAAmB;AACnB,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,IAA6B,EAC7B,UAA6B,EAAE;IAE/B,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,kDAAkD;YAC1D,QAAQ,EAAE,CAAC;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC;IACnD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,6DAA6D;YACrE,QAAQ,EAAE,CAAC;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,GAAG,EAAE,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;QACtD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,iDAAiD;YACzD,QAAQ,EAAE,CAAC;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YACnB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,iCAAiC,IAAI,EAAE;gBAC/C,QAAQ,EAAE,CAAC;aACZ,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,yBAAyB,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YAClG,QAAQ,EAAE,CAAC;SACZ,CAAC;IACJ,CAAC;IAED,qDAAqD;IACrD,IAAI,eAAe,GAAG,EAAE,CAAC;IACzB,IAAI,MAAM,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;YAC7B,OAAO,EAAE,WAAW;YACpB,IAAI,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC;YAC5B,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,UAAU,EAAE,IAAI;YAChB,aAAa,EAAE,OAAO;SACvB,CAAC,CAAC;QACH,2EAA2E;QAC3E,0EAA0E;QAC1E,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;QACtE,IAAI,mBAAmB,CAAC,eAAe,CAAC,IAAI,oBAAoB,EAAE,CAAC;YACjE,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,eAAe,CAAC,IAAI,EAAE;aAC/B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;IACnE,CAAC;IAED,uDAAuD;IACvD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC9E,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,GACR,eAAe,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAC/B,CAAC,CAAC,uCAAuC,eAAe,CAAC,IAAI,EAAE,EAAE;YACjE,CAAC,CAAC,EAAE,CAAC;QACT,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EACJ,4FAA4F,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBAClH,wFAAwF,IAAI,EAAE;YAChG,QAAQ,EAAE,CAAC;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrC,OAAO,CAAC,QAAQ,EAAE,CAChB,mDAAmD,EACnD,QAAQ,CACT,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;YAC7B,OAAO,EAAE,UAAU;YACnB,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC;YAC/C,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC3C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,wDAAwD,MAAM,CAAC,MAAM,EAAE;gBAC/E,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,CAAC;aAC/B,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;aACrC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;aACrD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACpE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EACJ,6EAA6E;gBAC/E,QAAQ,EAAE,CAAC;aACZ,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;YACnE,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC;YAC7C,OAAO,CAAC,QAAQ,EAAE,CAChB,cAAc,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,EAC1C,QAAQ,CACT,CAAC;YACF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC;gBAC1B,OAAO,EAAE,WAAW;gBACpB,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC;gBACrD,SAAS,EAAE,OAAO;gBAClB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,OAAO;aACvB,CAAC,CAAC;YACH,iEAAiE;YACjE,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACrE,SAAS,CAAC,IAAI,CACZ,cAAc,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,mCAAmC,EAAE,CAC5E,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EACJ,4GAA4G;gBAC9G,QAAQ,EAAE,CAAC;aACZ,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,4CAA4C,OAAO,CAAC,MAAM,gBAAgB,QAAQ,EAAE;SAC7F,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC"}

package/dist/tools/registry.d.ts

@@ -1,15 +1,6 @@
 import type { ToolCall, ToolResult } from "../types.js";
-export interface ToolRunOptions {
-    signal?: AbortSignal | undefined;
-    onOutput?: ((chunk: string, stream: "stdout" | "stderr") => void) | undefined;
-    requestSecret?: ((request: {
-        title: string;
-        prompt: string;
-    }) => Promise<string | undefined>) | undefined;
-    confirmed?: boolean | undefined;
-    userPrompt?: string | undefined;
-}
-export type ToolHandler = (args: Record<string, unknown>, options?: ToolRunOptions) => Promise<ToolResult>;
+import { type ToolRunOptions, type ToolHandler } from "./tool-types.js";
+export type { ToolRunOptions, ToolHandler };
 export declare const toolRegistry: Record<string, ToolHandler>;
 export declare function availableToolNames(): string[];
 /**

package/dist/tools/registry.js

@@ -11,13 +11,14 @@ import { webSearch } from "./web/search.js";
 import { RESPONSE_MODES } from "./web/types.js";
 import { classifyToolCall } from "../safety/classifier.js";
 import { loadScope } from "../store/scope.js";
-import { parseHost, parsePortSpec, parseLegacyFlags, profileToNmapArgs, nmapScanNeedsPrivilege, toConnectScanArgv, } from "./validate.js";
-import { platform } from "node:os";
+import { parseHost, parsePortSpec, parseLegacyFlags, profileToNmapArgs, } from "./validate.js";
 import { getNetworkContext } from "./network-context.js";
 import { pingSweep } from "./net-ping-sweep.js";
 import { toolCheckHandler } from "./capabilities.js";
 import { jobManager } from "./jobs.js";
 import { looksLongRunning } from "./command-intent.js";
+import { packageBinaryName } from "./package-binary.js";
+import { runNmapScan } from "./nmap-runner.js";
 function requireString(args, key) {
     const value = args[key];
     if (typeof value !== "string" || value.length === 0) {
@@ -45,207 +46,6 @@ function optionalResponseMode(args, key) {
     }
     return undefined;
 }
-/**
- * Map a package name to the executable it installs, when they differ. Used
- * by pkg.install to check whether the tool already exists before installing.
- * Most packages share their binary name, so this only lists the exceptions.
- */
-const PACKAGE_BINARY_ALIASES = {
-    ripgrep: "rg",
-    dnsutils: "dig",
-    "bind-utils": "dig",
-    "bind9-dnsutils": "dig",
-    "python3-pip": "pip3",
-    "build-essential": "gcc",
-    nodejs: "node",
-    golang: "go",
-    "g++": "g++",
-    imagemagick: "magick",
-    "netcat-openbsd": "nc",
-    "net-tools": "ifconfig",
-    coreutils: "ls",
-};
-function packageBinaryName(pkg) {
-    const lower = pkg.toLowerCase();
-    if (PACKAGE_BINARY_ALIASES[lower])
-        return PACKAGE_BINARY_ALIASES[lower];
-    // Strip a tap/cask prefix (homebrew "owner/tap/name" → "name") and any
-    // version suffix (apt "pkg=1.2" → "pkg") so the binary guess is sane.
-    const noTap = pkg.includes("/") ? pkg.slice(pkg.lastIndexOf("/") + 1) : pkg;
-    return noTap.split(/[=@:]/)[0] ?? noTap;
-}
-/**
- * Pick the OS-appropriate privilege-escalation prefix for a raw-socket scan.
- *   - macOS / Linux  → `sudo` (clai forwards stdin so the user types their
- *     password live; the runner's interactive-stdin path handles the prompt).
- *   - Windows        → `sudo` on Win11 build 26052+ if present, else `gsudo`
- *     if installed; otherwise no prefix (the user must run from an elevated
- *     terminal — nmap SYN scans need Administrator + Npcap there).
- * Returns the elevation command + leading argv, or undefined when no helper
- * is available (caller then falls back to an unprivileged connect scan).
- */
-async function elevationPrefix() {
-    if (process.getuid && process.getuid() === 0) {
-        // Already root — no wrapper needed.
-        return { command: "", argv: [] };
-    }
-    if (platform() === "win32") {
-        if (await commandAvailable("sudo"))
-            return { command: "sudo", argv: [] };
-        if (await commandAvailable("gsudo"))
-            return { command: "gsudo", argv: [] };
-        return undefined;
-    }
-    if (await commandAvailable("sudo")) {
-        // -p sets a clear prompt; clai's interactive-stdin lets the user type it.
-        return { command: "sudo", argv: ["-p", "[clai] sudo password for nmap: "] };
-    }
-    if (await commandAvailable("doas"))
-        return { command: "doas", argv: [] };
-    return undefined;
-}
-/**
- * Run an nmap scan, transparently obtaining the privileges a stealth/raw
- * scan needs and falling back to an unprivileged TCP connect scan when those
- * privileges can't be obtained (no sudo, password declined, etc.).
- *
- * Strategy:
- *   1. If the scan needs raw sockets and we're not root, wrap it in the
- *      OS-appropriate elevation helper (sudo / doas / gsudo). stdin is
- *      inherited so the user can type their password live — exactly the
- *      pattern documented for shell.exec sudo.
- *   2. If elevation is unavailable, or the privileged attempt fails in a way
- *      that looks like a permission/privilege error, retry as `-sT` (TCP
- *      connect) which works for any user on every OS.
- * This is the "most general approach first, then fall back" behavior the
- * scans need so they never dead-end on "you must be root".
- */
-async function runNmapScan(argv, options) {
-    const needsPrivilege = nmapScanNeedsPrivilege(argv);
-    const prefix = needsPrivilege ? await elevationPrefix() : undefined;
-    const attempts = [];
-    if (needsPrivilege && prefix) {
-        if (prefix.command === "sudo") {
-            // Authenticate in a short, dedicated process. In the TUI, never inherit
-            // stdin for the long nmap scan: pipe the already-entered password to
-            // sudo so Ink keeps receiving Escape/Ctrl+C while nmap is running.
-            options?.onOutput?.(options?.requestSecret
-                ? "\nAdministrator access is required for a stealth scan. Complete the secure password prompt below.\n"
-                : "\nAdministrator access is required for a stealth scan. Enter your sudo password below; Ctrl+C cancels.\n", "stdout");
-            let auth;
-            let sudoPassword;
-            if (options?.requestSecret) {
-                const password = await options.requestSecret({
-                    title: "Administrator access",
-                    prompt: "Enter your macOS password for sudo. It is sent only to sudo and is never stored.",
-                });
-                if (password === undefined) {
-                    return { ok: false, output: "Administrator authentication cancelled.", exitCode: 130 };
-                }
-                sudoPassword = password;
-                auth = await spawnArgv({
-                    command: "sudo",
-                    argv: ["-S", "-p", "", "-v"],
-                    stdinText: `${password}\n`,
-                    timeoutMs: 30_000,
-                    signal: options.signal,
-                    onOutput: options.onOutput,
-                    noArtifact: true,
-                    interactiveStdin: false,
-                });
-            }
-            else {
-                // Classic REPL: let sudo read directly from its controlling terminal.
-                auth = await spawnArgv({
-                    command: "sudo",
-                    argv: [...prefix.argv, "-v"],
-                    timeoutMs: 120_000,
-                    signal: options?.signal,
-                    onOutput: options?.onOutput,
-                    interactiveStdin: true,
-                    noArtifact: true,
-                });
-            }
-            if (options?.signal?.aborted || auth.exitCode === 130)
-                return auth;
-            if (auth.ok) {
-                attempts.push({
-                    command: "sudo",
-                    argv: options?.requestSecret ? ["-S", "-p", "", "nmap", ...argv] : ["-n", "nmap", ...argv],
-                    stdinText: options?.requestSecret ? `${sudoPassword ?? ""}\n` : undefined,
-                    note: "Administrator access confirmed. Starting stealth scan (ESC cancels).",
-                });
-            }
-            else {
-                options?.onOutput?.("\nSudo authentication was not completed; using an unprivileged TCP connect scan instead.\n", "stderr");
-            }
-        }
-        else if (prefix.command) {
-            attempts.push({
-                command: prefix.command,
-                argv: [...prefix.argv, "nmap", ...argv],
-                interactiveStdin: true,
-                note: `Running a stealth scan with ${prefix.command} (you may be prompted for your password).`,
-            });
-        }
-        else {
-            // Already root.
-            attempts.push({ command: "nmap", argv });
-        }
-        // Fallback: unprivileged connect scan if elevation fails/declines.
-        attempts.push({
-            command: "nmap",
-            argv: toConnectScanArgv(argv),
-            note: "Privileged scan unavailable — falling back to an unprivileged TCP connect scan (-sT).",
-        });
-    }
-    else if (needsPrivilege && !prefix) {
-        // No elevation helper at all — go straight to the connect-scan fallback,
-        // but tell the user why the stealth scan was downgraded.
-        attempts.push({
-            command: "nmap",
-            argv: toConnectScanArgv(argv),
-            note: platform() === "win32"
-                ? "No elevation helper found (sudo/gsudo). Run from an Administrator terminal with Npcap for a SYN scan; using a TCP connect scan (-sT) for now."
-                : "No sudo/doas available for a raw-socket SYN scan — using an unprivileged TCP connect scan (-sT) instead.",
-        });
-    }
-    else {
-        attempts.push({ command: "nmap", argv });
-    }
-    let last;
-    for (let i = 0; i < attempts.length; i += 1) {
-        const attempt = attempts[i];
-        if (options?.signal?.aborted) {
-            return { ok: false, output: "Command aborted.", exitCode: 130 };
-        }
-        if (attempt.note)
-            options?.onOutput?.(`\n${attempt.note}\n`, "stdout");
-        const result = await spawnArgv({
-            command: attempt.command,
-            argv: attempt.argv,
-            stdinText: attempt.stdinText,
-            timeoutMs: 300_000,
-            signal: options?.signal,
-            onOutput: options?.onOutput,
-            ...(attempt.interactiveStdin !== undefined
-                ? { interactiveStdin: attempt.interactiveStdin }
-                : {}),
-        });
-        last = result;
-        // Success, or a non-privilege failure we shouldn't paper over → return.
-        const isLastAttempt = i === attempts.length - 1;
-        if (result.ok || isLastAttempt || !looksLikePrivilegeError(result.output)) {
-            return result;
-        }
-        // Otherwise loop to the next (fallback) attempt.
-    }
-    return last ?? { ok: false, output: "nmap produced no result.", exitCode: 1 };
-}
-/** Heuristic: did an nmap/sudo invocation fail because of missing privileges? */
-function looksLikePrivilegeError(output) {
-    return /(?:requires root privileges|you (?:requested|need) (?:a scan type|root)|operation not permitted|must (?:be|run as) root|raw sockets?|sudo: (?:a (?:password|terminal) is required|no askpass|3 incorrect)|incorrect password|authentication failure|permission denied|requires (?:administrator|elevation))/i.test(output);
-}
 export const toolRegistry = {
     async "shell.exec"(args, options) {
         const command = requireString(args, "command");