agentlab 0.1.5 → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 AgentLab contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,43 +1,19 @@
-# agentlab
+# AgentLab
 
-## Description
-
-`agentlab` is a terminal AI coding agent for real project work. It chats, runs tools, edits files, and keeps multi-step coding sessions in one CLI flow.
-
-## Supports
-
-- Providers:
-  - OpenAI Codex
-  - GitHub Copilot
-  - Claude (subscription login via Claude Code, not API key mode)
-- Core capabilities:
-  - Provider/model switching from inside the CLI
-  - Interactive login and auth status checks per provider
-  - Session history save/resume
-
-## Install
-
-Install globally from npm:
-
-```bash
-npm install -g agentlab
-```
-
-Then run:
+One captain for all your coding agents in a fast local terminal UI.
 
 ```bash
+npm install --global agentlab
 agentlab
 ```
 
-## Local development
-
-```bash
-bun install
-bun run build
-bun run index.tsx
-```
+The npm launcher downloads the matching AgentLab executable on first use, verifies its
+package-pinned size and SHA-256 digest, and caches it by version. It rechecks the cached digest
+before execution. Linux x64 with glibc and Apple-silicon macOS are supported. AgentLab requires
+`tmux` and at least one authenticated provider CLI: Codex, Claude Code, or OpenCode.
 
-## Project story
+Use `agentlab update` for an explicit update or `agentlab update --check` to check without changing
+the installation. Normal cached startup performs no update request.
 
-This project started in a normal way, with direct manual coding.
-Then it grew by using itself: agentlab was used to extend and refine agentlab.
+See [the AgentLab repository](https://github.com/RiadMefti/agentlab) for usage, release checksums,
+SBOMs, and build provenance.

package/dist/agentlab.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import { runLauncher } from "./cli.js";
+try {
+    process.exitCode = await runLauncher(process.argv.slice(2));
+}
+catch (error) {
+    const message = error instanceof Error ? error.message : "Unexpected launcher failure.";
+    process.stderr.write(`agentlab: ${message}\n`);
+    process.exitCode = 1;
+}

package/dist/cache.js

@@ -0,0 +1,141 @@
+import { createHash, randomUUID } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { chmod, lstat, mkdir, open, rename, rm } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+import { releaseDownloadUrl } from "./manifest.js";
+const DOWNLOAD_TIMEOUT_MILLISECONDS = 120_000;
+const MAXIMUM_PATH_LENGTH = 4096;
+const TRUSTED_DOWNLOAD_HOSTS = new Set(["github.com"]);
+export function resolveCacheRoot(environment = process.env, homeDirectory = homedir()) {
+    const override = environment.AGENTLAB_CACHE_PATH;
+    if (override !== undefined)
+        return validateAbsolutePath(override, "AGENTLAB_CACHE_PATH");
+    const xdgCache = environment.XDG_CACHE_HOME;
+    if (xdgCache !== undefined) {
+        return resolve(validateAbsolutePath(xdgCache, "XDG_CACHE_HOME"), "agentlab");
+    }
+    return resolve(homeDirectory, ".cache", "agentlab");
+}
+export function cachedBinaryPath(cacheRoot, manifest, key) {
+    return join(cacheRoot, "releases", manifest.version, key, "agentlab");
+}
+export async function ensureCachedBinary(manifest, key, options = {}) {
+    const cacheRoot = options.cacheRoot ?? resolveCacheRoot();
+    const binaryPath = cachedBinaryPath(cacheRoot, manifest, key);
+    const target = manifest.targets[key];
+    if (await isUsableCachedBinary(binaryPath, target.size, target.sha256))
+        return binaryPath;
+    await mkdir(dirname(binaryPath), { mode: 0o700, recursive: true });
+    await rm(binaryPath, { force: true });
+    const temporaryPath = `${binaryPath}.${String(process.pid)}.${randomUUID()}.tmp`;
+    const fetchImplementation = options.fetch ?? globalThis.fetch;
+    const downloadUrl = releaseDownloadUrl(manifest, key);
+    try {
+        const response = await fetchImplementation(downloadUrl, {
+            redirect: "follow",
+            signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MILLISECONDS)
+        });
+        if (!response.ok) {
+            throw new Error(`AgentLab download failed with HTTP ${String(response.status)}.`);
+        }
+        assertTrustedDownloadUrl(response.url || downloadUrl);
+        if (response.body === null)
+            throw new Error("AgentLab download returned an empty body.");
+        const declaredLength = response.headers.get("content-length");
+        if (declaredLength !== null && Number(declaredLength) !== target.size) {
+            throw new Error("AgentLab download size does not match the signed release manifest.");
+        }
+        const file = await open(temporaryPath, "wx", 0o600);
+        const hash = createHash("sha256");
+        let size = 0;
+        try {
+            const reader = response.body.getReader();
+            for (;;) {
+                const readResult = await reader.read();
+                const chunk = readDownloadChunk(readResult);
+                if (chunk === undefined)
+                    break;
+                size += chunk.byteLength;
+                if (size > target.size) {
+                    throw new Error("AgentLab download exceeded the signed release size.");
+                }
+                hash.update(chunk);
+                await writeAll(file, chunk);
+            }
+            await file.sync();
+        }
+        finally {
+            await file.close();
+        }
+        if (size !== target.size || hash.digest("hex") !== target.sha256) {
+            throw new Error("AgentLab download failed checksum verification.");
+        }
+        await chmod(temporaryPath, 0o755);
+        await rename(temporaryPath, binaryPath);
+        return binaryPath;
+    }
+    finally {
+        await rm(temporaryPath, { force: true });
+    }
+}
+async function isUsableCachedBinary(path, expectedSize, expectedChecksum) {
+    try {
+        const details = await lstat(path);
+        if (!details.isFile() || details.size !== expectedSize || (details.mode & 0o111) === 0) {
+            return false;
+        }
+        const hash = createHash("sha256");
+        for await (const rawChunk of createReadStream(path)) {
+            const chunk = rawChunk;
+            if (!(chunk instanceof Uint8Array)) {
+                throw new Error("AgentLab cached binary returned an invalid file chunk.");
+            }
+            hash.update(chunk);
+        }
+        return hash.digest("hex") === expectedChecksum;
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ENOENT" || code === "ENOTDIR")
+            return false;
+        throw error;
+    }
+}
+function assertTrustedDownloadUrl(value) {
+    const url = new URL(value);
+    const trusted = url.protocol === "https:" &&
+        (TRUSTED_DOWNLOAD_HOSTS.has(url.hostname) || url.hostname.endsWith(".githubusercontent.com"));
+    if (!trusted)
+        throw new Error("AgentLab download redirected to an untrusted host.");
+}
+function validateAbsolutePath(value, label) {
+    if (value.length === 0 ||
+        value.length > MAXIMUM_PATH_LENGTH ||
+        !isAbsolute(value) ||
+        dirname(resolve(value)) === resolve(value)) {
+        throw new Error(`${label} must be a non-empty absolute path.`);
+    }
+    return value;
+}
+async function writeAll(file, chunk) {
+    let offset = 0;
+    while (offset < chunk.byteLength) {
+        const { bytesWritten } = await file.write(chunk, offset, chunk.byteLength - offset);
+        if (bytesWritten <= 0)
+            throw new Error("AgentLab download could not be written to disk.");
+        offset += bytesWritten;
+    }
+}
+function readDownloadChunk(value) {
+    if (typeof value !== "object" || value === null || !("done" in value)) {
+        throw new Error("AgentLab download returned an invalid stream result.");
+    }
+    const result = value;
+    if (result.done === true)
+        return undefined;
+    if (result.done !== false || !(result.value instanceof Uint8Array)) {
+        throw new Error("AgentLab download returned an invalid stream chunk.");
+    }
+    return result.value;
+}