blun-king-cli 9.1.0 → 9.1.2

package/LIESMICH.txt

@@ -9,7 +9,7 @@ Installation
 ------------
 Die geprüfte Version exakt global installieren:
 
-  npm install -g blun-king-cli@9.1.0
+  npm install -g blun-king-cli@9.1.1
 
 Start
 -----

package/README.md

@@ -9,7 +9,7 @@ Voraussetzung ist Node.js 24.15 oder neuer. Die geprüfte Version wird exakt
 installiert:
 
 ```powershell
-npm install -g blun-king-cli@9.1.0
+npm install -g blun-king-cli@9.1.1
 ```
 
 ## Reproduzierbares Staging und Packen

package/bin/blun.js

@@ -254,10 +254,24 @@ async function installLeaseIsClear() {
 }
 
 async function main() {
+  const explicitUpdateRequest = process.argv.length === 3
+    && /^(?:update|upgrade)$/iu.test(process.argv[2] || '');
   const result = await acquireNoticeLease();
-  if (!result.acquired) return;
+  if (!result.acquired) {
+    process.stderr.write(explicitUpdateRequest
+      ? 'BLUN laeuft noch. Beende die laufende Konsole und starte das Update erneut.\n'
+      : 'BLUN laeuft bereits in einer anderen Konsole.\n');
+    process.exitCode = 1;
+    return;
+  }
   try {
-    if (!await installLeaseIsClear()) return;
+    if (!await installLeaseIsClear()) {
+      process.stderr.write(explicitUpdateRequest
+        ? 'BLUN laeuft noch. Beende die laufende Konsole und starte das Update erneut.\n'
+        : 'BLUN laeuft bereits in einer anderen Konsole.\n');
+      process.exitCode = 1;
+      return;
+    }
     result.lease.assertOwned();
     const { runLauncher } = require('./launcher-runtime');
     result.lease.assertOwned();

package/bin/core-bootstrap.js

@@ -1,5 +1,6 @@
 'use strict';
 
+const fs = require('node:fs');
 const path = require('node:path');
 const { pathToFileURL } = require('node:url');
 
@@ -41,7 +42,11 @@ async function runCoreBootstrap() {
 
 if (require.main === module) {
   // oxlint-disable-next-line unicorn/prefer-top-level-await -- Worker entry is CommonJS.
-  void runCoreBootstrap().catch(() => process.exit(1));
+  void runCoreBootstrap().catch((error) => {
+    const message = error && error.message ? error.message : String(error);
+    fs.writeSync(process.stderr.fd, `BLUN Start fehlgeschlagen: ${message}\n`);
+    process.exit(1);
+  });
 }
 
 module.exports = { CORE_LOADED_MESSAGE, runCoreBootstrap };

package/bin/king.js

@@ -254,10 +254,24 @@ async function installLeaseIsClear() {
 }
 
 async function main() {
+  const explicitUpdateRequest = process.argv.length === 3
+    && /^(?:update|upgrade)$/iu.test(process.argv[2] || '');
   const result = await acquireNoticeLease();
-  if (!result.acquired) return;
+  if (!result.acquired) {
+    process.stderr.write(explicitUpdateRequest
+      ? 'BLUN laeuft noch. Beende die laufende Konsole und starte das Update erneut.\n'
+      : 'BLUN laeuft bereits in einer anderen Konsole.\n');
+    process.exitCode = 1;
+    return;
+  }
   try {
-    if (!await installLeaseIsClear()) return;
+    if (!await installLeaseIsClear()) {
+      process.stderr.write(explicitUpdateRequest
+        ? 'BLUN laeuft noch. Beende die laufende Konsole und starte das Update erneut.\n'
+        : 'BLUN laeuft bereits in einer anderen Konsole.\n');
+      process.exitCode = 1;
+      return;
+    }
     result.lease.assertOwned();
     const { runLauncher } = require('./launcher-runtime');
     result.lease.assertOwned();

package/bin/launcher-runtime.js

@@ -280,7 +280,7 @@ async function runLauncher(options = {}) {
     env.BLUN_HOME = blunDir;
     env.BLUN_MODEL_MAX_COMPLETION_TOKENS = env.BLUN_MODEL_MAX_COMPLETION_TOKENS || '32768';
     process.exitCode = await superviseProtectedCore(
-      ['--yolo', ...ARGS],
+      ARGS,
       env,
       callerCwd,
       releaseNotice,

package/blun.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// BLUN_BUILD_INPUT_SHA256:77e08de6896f890d2ece095b27978ef8a0c41671818fd4968df22b6237ffaf2b
+// BLUN_BUILD_INPUT_SHA256:6d54e04788e3c465f647fe659f1ddd461d4e661c33aefaaea5550319c0d52dc1
 import { fileURLToPath as __cjsShimFileURLToPath } from 'node:url';
 import { dirname as __cjsShimDirname } from 'node:path';
 const __filename = __cjsShimFileURLToPath(import.meta.url);
@@ -10433,6 +10433,38 @@ function parseAclFlags(flags) {
 	if (parsed.join("") !== flags) throw new Error("Malformed Windows ACL inheritance flags.");
 	return parsed.toSorted();
 }
+function errorDetailAcl(error) {
+	if (error !== null && typeof error === "object" && "stderr" in error) {
+		const stderr = String(error.stderr ?? "").trim();
+		if (stderr.length > 0) return stderr;
+	}
+	if (error instanceof Error && error.message.trim().length > 0) return error.message.trim();
+	return String(error);
+}
+function unexpectedExplicitTrusteesAcl(savedAcl, userSid) {
+	if (savedAcl.length === 0 || savedAcl.length % 2 !== 0) throw new Error("Windows ACL dump has an invalid UTF-16LE byte length.");
+	const hasByteOrderMark = savedAcl[0] === 255 && savedAcl[1] === 254;
+	const daclLines = savedAcl.subarray(hasByteOrderMark ? 2 : 0).toString("utf16le").split(/\r?\n/).filter((line) => line.startsWith("D:"));
+	if (daclLines.length !== 1) throw new Error("Windows ACL dump does not contain exactly one DACL.");
+	const dacl = daclLines[0];
+	const firstAce = dacl.indexOf("(");
+	if (firstAce === -1) return [];
+	const aceText = dacl.slice(firstAce);
+	const aceMatches = [...aceText.matchAll(/\(([^()]*)\)/g)];
+	if (aceMatches.map((match) => match[0]).join("") !== aceText) throw new Error("Windows ACL dump contains malformed access rules.");
+	const expectedTrustees = new Set([userSid.toUpperCase(), WINDOWS_SYSTEM_SID, WINDOWS_ADMINISTRATORS_SID]);
+	const unexpected = new Set();
+	for (const match of aceMatches) {
+		const fields = match[1].split(";");
+		if (fields.length < 6 || !fields[5]) throw new Error("Windows ACL dump contains a malformed access rule.");
+		const flags = parseAclFlags(fields[1]);
+		if (flags.includes("ID")) continue;
+		const rawTrustee = fields[5].toUpperCase();
+		const normalized = normalizeTrustee(rawTrustee);
+		if (!expectedTrustees.has(normalized)) unexpected.add(rawTrustee);
+	}
+	return [...unexpected].toSorted();
+}
 function assertExpectedDacl(savedAcl, userSid, kind) {
 	if (savedAcl.length === 0 || savedAcl.length % 2 !== 0) throw new Error("Windows ACL dump has an invalid UTF-16LE byte length.");
 	const hasByteOrderMark = savedAcl[0] === 255 && savedAcl[1] === 254;
@@ -10478,7 +10510,7 @@ var init_windows_private_acl = __esmMin((() => {
 			try {
 				this.apply(target, kind, userSid);
 			} catch (error) {
-				throw new Error("Windows credential ACL hardening failed.", { cause: error });
+				throw new Error(`Windows credential ACL hardening failed: ${errorDetailAcl(error)}`, { cause: error });
 			}
 			this.verifyWithUserSid(target, kind, userSid);
 		}
@@ -10518,43 +10550,28 @@ var init_windows_private_acl = __esmMin((() => {
 		}
 		apply(target, kind, userSid) {
 			const absoluteTarget = resolve(target);
-			const targetName = basename(absoluteTarget);
-			if (targetName.length === 0 || /[\r\n]/.test(targetName)) throw new Error("Windows credential ACL cannot target a volume root or newline path.");
+			if (basename(absoluteTarget).length === 0 || /[\r\n]/.test(absoluteTarget)) throw new Error("Windows credential ACL cannot target a volume root or newline path.");
+			const unexpectedTrustees = unexpectedExplicitTrusteesAcl(this.save(absoluteTarget), userSid);
+			const grant = kind === "directory" ? "(OI)(CI)F" : "F";
+			this.runCommand(this.executable("icacls.exe"), [absoluteTarget, "/inheritance:r", "/Q"]);
+			if (unexpectedTrustees.length > 0) this.runCommand(this.executable("icacls.exe"), [absoluteTarget, "/remove", ...unexpectedTrustees.map((trustee) => `*${trustee}`), "/Q"]);
+			this.runCommand(this.executable("icacls.exe"), [absoluteTarget, "/remove:d", `*${userSid}`, `*${WINDOWS_SYSTEM_SID}`, `*${WINDOWS_ADMINISTRATORS_SID}`, "/Q"]);
+			this.runCommand(this.executable("icacls.exe"), [absoluteTarget, "/grant:r", `*${userSid}:${grant}`, `*${WINDOWS_SYSTEM_SID}:${grant}`, `*${WINDOWS_ADMINISTRATORS_SID}:${grant}`, "/Q"]);
+		}
+		save(target) {
 			const aclFile = this.transferPath();
-			const acl = `\uFEFF${targetName}\r\n${expectedDacl(userSid, kind)}\r\n`;
-			let created = false;
 			try {
-				writeFileSync(aclFile, acl, {
-					encoding: "utf16le",
-					flag: "wx",
-					mode: 384
-				});
-				created = true;
-				this.runCommand(this.executable("icacls.exe"), [
-					dirname(absoluteTarget),
-					"/restore",
-					aclFile,
-					"/Q"
-				]);
+				this.runCommand(this.executable("icacls.exe"), [target, "/save", aclFile, "/Q"]);
+				return readFileSync(aclFile);
 			} finally {
-				if (created) this.removeTransferFile(aclFile);
+				this.removeTransferFile(aclFile);
 			}
 		}
 		verifyWithUserSid(target, kind, userSid) {
-			const absoluteTarget = resolve(target);
-			const aclFile = this.transferPath();
 			try {
-				this.runCommand(this.executable("icacls.exe"), [
-					absoluteTarget,
-					"/save",
-					aclFile,
-					"/Q"
-				]);
-				assertExpectedDacl(readFileSync(aclFile), userSid, kind);
+				assertExpectedDacl(this.save(resolve(target)), userSid, kind);
 			} catch (error) {
-				throw new Error("Windows credential ACL verification failed.", { cause: error });
-			} finally {
-				this.removeTransferFile(aclFile);
+				throw new Error(`Windows credential ACL verification failed: ${errorDetailAcl(error)}`, { cause: error });
 			}
 		}
 	};
@@ -499190,29 +499207,9 @@ function renderQuotaSegment(window, colors, options) {
 	const reset = options.includeReset ? formatQuotaReset(window.resetAt, options.locale, options.timeZone) : "";
 	return `${label} ${bar} ${percentage}${chalk.hex(colors.textDim)(reset)}`;
 }
-function packQuotaSegments(segments, width) {
-	const lines = [];
-	let current = "";
-	for (const segment of segments) {
-		if (current.length === 0) {
-			current = segment;
-			continue;
-		}
-		const joined = `${current}${QUOTA_SEGMENT_GAP}${segment}`;
-		if (visibleWidth(joined) <= width) current = joined;
-		else {
-			lines.push(current);
-			current = segment;
-		}
-	}
-	if (current.length > 0) lines.push(current);
-	return lines;
-}
-function centerQuotaLines(lines, width) {
-	return lines.map((line) => {
-		const leftPadding = Math.max(0, Math.floor((width - visibleWidth(line)) / 2));
-		return `${" ".repeat(leftPadding)}${line}`;
-	});
+function centerQuotaLine(line, width) {
+	const leftPadding = Math.max(0, Math.floor((width - visibleWidth(line)) / 2));
+	return `${" ".repeat(leftPadding)}${line}`;
 }
 function formatManagedQuotaFooterLines(windows, colors, width, options = {}) {
 	if (windows.length === 0 || width <= 0) return [];
@@ -499236,14 +499233,17 @@ function formatManagedQuotaFooterLines(windows, colors, width, options = {}) {
 		}
 	];
 	for (const variant of variants) {
-		const segments = windows.map((window) => renderQuotaSegment(window, colors, {
+		const line = windows.map((window) => renderQuotaSegment(window, colors, {
 			...variant,
 			locale,
 			timeZone: options.timeZone
-		}));
-		if (segments.every((segment) => visibleWidth(segment) <= width)) return centerQuotaLines(packQuotaSegments(segments, width), width);
+		})).join(QUOTA_SEGMENT_GAP);
+		if (visibleWidth(line) <= width) return [centerQuotaLine(line, width)];
 	}
-	return centerQuotaLines(windows.map((window) => truncateToWidth(quotaWindowLabel(window.id), width, "…")), width);
+	return [centerQuotaLine(truncateToWidth(windows.map((window) => {
+		const percentage = window.unlimited === true ? "∞" : `${String(Math.round(window.fraction * 100))}%`;
+		return `${quotaWindowLabel(window.id)} ${percentage}`;
+	}).join(" · "), width, "…"), width)];
 }
 function renderContextBar(ratio, colors) {
 	const clamped = Math.max(0, Math.min(1, ratio));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blun-king-cli",
-  "version": "9.1.0",
+  "version": "9.1.2",
   "description": "BLUN CLI - your own AI agent with a Telegram channel. Get it done. With BLUN.",
   "license": "MIT",
   "bin": {