dsh-cliworker-now 0.0.0-stage → 0.7.7

package/lib/types/host/hermes-renewal.js

@@ -0,0 +1,292 @@
+import { createHash } from 'node:crypto';
+import { lstat } from 'node:fs/promises';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { validateHermesHomeDirectory } from "./hermes-adapter.js";
+import { hermesAccountEnvironment } from "./hermes-account-context.js";
+import { assertHermesOwnAccounts, hermesPoolEntryUnavailable, readHermesAccountMaterial, } from "./hermes-models.js";
+import { hermesNativeCommand } from "./hermes-installation.js";
+import { HermesNousError, hermesNousMinimumTtl, selectHermesNousSource, } from "./hermes-nous.js";
+import { projectHermesUnsuppressedAuth, hermesUnsuppressedEnvironment } from "./hermes-suppression.js";
+import { ProcessCleanupUnconfirmedError } from "./process.js";
+const messages = {
+    relogin: 'Hermes 登录已失效，请重新登录',
+    unavailable: 'Hermes 登录暂时无法续期，请稍后刷新',
+    changed: 'Hermes 账号来源已变化，请刷新后重试',
+    unsupported: '当前 Hermes 安装不支持安全续期，请更新原生 CLI 后重试',
+    busy: 'Hermes 账号终端正在运行，请关闭后刷新',
+};
+export class HermesRenewalError extends HermesNousError {
+    state;
+    constructor(state) {
+        super(messages[state]);
+        this.state = state;
+    }
+}
+const homes = new Map();
+function homeKey(home) {
+    const canonical = validateHermesHomeDirectory(home);
+    return { home: canonical, key: process.platform === 'win32' ? canonical.toLowerCase() : canonical };
+}
+function retire(key, state) {
+    if (!state.flight && !state.reserved && !state.poisoned && homes.get(key) === state)
+        homes.delete(key);
+}
+function available(state) {
+    if (state.poisoned)
+        throw new ProcessCleanupUnconfirmedError();
+    if (state.reserved)
+        throw new HermesRenewalError('busy');
+}
+/** No bearer, refresh token or email enters the command line or public result. */
+export function hermesNousPrincipalDigest(source) {
+    const p = source.principal;
+    return createHash('sha256')
+        .update(JSON.stringify([
+        'hermes-nous-v1',
+        p.subject,
+        p.organization,
+        p.issuer,
+        p.clientId ?? '',
+        source.route.portal,
+        source.route.inference,
+    ]))
+        .digest('hex');
+}
+async function snapshot(home, signal) {
+    try {
+        await lstat(join(home, 'config.yaml'));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return;
+        throw error;
+    }
+    const selected = await readHermesAccountMaterial(home, signal);
+    if (selected.config.model?.provider !== 'nous' || selected.auth.active_provider !== 'nous')
+        return;
+    const raw = await assertHermesOwnAccounts(home, signal);
+    if (raw.config.model?.provider !== 'nous' || raw.auth.active_provider !== 'nous')
+        return;
+    const material = {
+        ...raw,
+        auth: projectHermesUnsuppressedAuth(raw.auth),
+        env: hermesUnsuppressedEnvironment(raw.auth, raw.env, 'nous'),
+    };
+    // Suppressed/deleted credentials never become a renewal source.
+    if (!material.auth.providers?.nous)
+        return;
+    const source = selectHermesNousSource(material, { allowExpired: true });
+    const ttl = hermesNousMinimumTtl(material.env);
+    const state = material.auth.providers.nous;
+    return {
+        material,
+        source,
+        ttl,
+        state,
+        digest: hermesNousPrincipalDigest(source),
+        identity: JSON.stringify([
+            hermesNousPrincipalDigest(source),
+            state.client_id || 'hermes-cli',
+            source.route,
+        ]),
+    };
+}
+async function capture(input, home, digest, ttl, signal) {
+    if (!input.backend)
+        throw new HermesRenewalError('unsupported');
+    const executable = input.executable ?? (await input.resolveExecutable?.(signal));
+    if (!executable)
+        throw new HermesRenewalError('unsupported');
+    const argv = await hermesNativeCommand(executable, ['--cliworker-nous-refresh', digest], signal);
+    // Unknown standalone launchers must not receive our private protocol as a CLI command.
+    if (argv[2] !== fileURLToPath(new URL('./hermes-native-entry.py', import.meta.url)))
+        throw new HermesRenewalError('unsupported');
+    signal.throwIfAborted();
+    // Once rotation starts, cancellation waits for the bounded native transaction to
+    // persist its new refresh token. Killing it on UI cancellation could spend the
+    // old single-use grant without saving the replacement (especially Windows Job).
+    const deadline = AbortSignal.timeout(8000);
+    const child = input.backend.spawn({
+        argv: [process.execPath, fileURLToPath(new URL('./private-launch.mjs', import.meta.url)), ...argv],
+        cwd: home,
+        env: {
+            ...hermesAccountEnvironment(home),
+            HERMES_SHARED_AUTH_DIR: join(home, 'shared'),
+            HERMES_NOUS_MIN_KEY_TTL_SECONDS: String(ttl),
+            PYTHONDONTWRITEBYTECODE: '1',
+            ELECTRON_RUN_AS_NODE: '1',
+        },
+        stdio: { stdin: 'ignore', stdout: 'pipe', stderr: 'pipe' },
+        graceMs: input.graceMs ?? 5000,
+        signal: deadline,
+    });
+    void child.done.catch(() => undefined);
+    let output = '', bytes = 0;
+    const read = async (stream, keep) => {
+        if (stream)
+            for await (const chunk of stream) {
+                bytes += Buffer.byteLength(chunk);
+                if (bytes > 8192)
+                    throw new HermesRenewalError('unavailable');
+                if (keep)
+                    output += String(chunk);
+                if (output.length > 512)
+                    throw new HermesRenewalError('unavailable');
+            }
+    };
+    const readers = [read(child.stdout, true), read(child.stderr, false)];
+    try {
+        await Promise.all(readers);
+        const result = await child.done;
+        if (deadline.aborted || result.exitCode !== 0)
+            throw new HermesRenewalError('unavailable');
+        let receipt;
+        try {
+            receipt = JSON.parse(output);
+        }
+        catch {
+            throw new HermesRenewalError('unavailable');
+        }
+        if (!receipt ||
+            receipt.version !== 1 ||
+            Object.keys(receipt).sort().join(',') !== 'state,version' ||
+            !['ready', 'relogin', 'unavailable', 'changed', 'unsupported'].includes(receipt.state))
+            throw new HermesRenewalError('unavailable');
+        if (receipt.state !== 'ready')
+            throw new HermesRenewalError(receipt.state);
+    }
+    finally {
+        output = '';
+        let exited = false;
+        try {
+            child.terminate();
+            exited = await child.waitForExit();
+        }
+        catch {
+            /* fail closed below */
+        }
+        if (!exited)
+            throw new ProcessCleanupUnconfirmedError();
+        await Promise.allSettled([...readers, child.done]);
+    }
+}
+async function renew(input, home, signal) {
+    signal.throwIfAborted();
+    const before = await snapshot(home, signal);
+    if (!before || before.source.expires > Date.now() + before.ttl * 1000)
+        return;
+    if (typeof before.state.refresh_token !== 'string' ||
+        !before.state.refresh_token.trim() ||
+        before.state.refresh_token.length > 32768 ||
+        /[\x00-\x20\x7f]/.test(before.state.refresh_token))
+        throw new HermesRenewalError('relogin');
+    if (before.material.auth.credential_pool.nous.some((row) => hermesPoolEntryUnavailable(row, before.material.config.model?.default)))
+        throw new HermesRenewalError('unavailable');
+    await capture(input, home, before.digest, before.ttl, signal);
+    // Always reread even if all subscribers left while the native transaction ran.
+    const after = await snapshot(home, new AbortController().signal);
+    if (!after || after.identity !== before.identity)
+        throw new HermesRenewalError('changed');
+    if (after.source.expires <= Date.now() + after.ttl * 1000)
+        throw new HermesRenewalError('unavailable');
+}
+function abortable(operation, signal) {
+    signal.throwIfAborted();
+    return new Promise((resolve, reject) => {
+        const abort = () => reject(signal.reason);
+        signal.addEventListener('abort', abort, { once: true });
+        operation
+            .then(resolve, reject)
+            .finally(() => signal.removeEventListener('abort', abort))
+            .catch(() => { });
+    });
+}
+/** Share only an in-flight renewal, never a completed authorization decision. */
+export async function ensureHermesNousFresh(input) {
+    input.signal.throwIfAborted();
+    const { home, key } = homeKey(input.home);
+    const state = homes.get(key) ?? {};
+    homes.set(key, state);
+    available(state);
+    let flight = state.flight;
+    if (flight?.readers.size && [...flight.readers].every((reader) => reader.signal.aborted))
+        flight.controller.abort();
+    if (flight?.controller.signal.aborted) {
+        await abortable(flight.operation.catch(() => { }), input.signal);
+        return ensureHermesNousFresh(input);
+    }
+    if (!flight) {
+        const controller = new AbortController();
+        flight = { controller, operation: Promise.resolve(), readers: new Set(), settled: false };
+        state.flight = flight;
+        const current = flight;
+        current.operation = Promise.resolve()
+            .then(() => renew(input, home, controller.signal))
+            .catch((error) => {
+            if (error instanceof ProcessCleanupUnconfirmedError)
+                state.poisoned = true;
+            if (error instanceof HermesNousError || error instanceof ProcessCleanupUnconfirmedError)
+                throw error;
+            controller.signal.throwIfAborted();
+            throw new HermesRenewalError('unavailable');
+        })
+            .finally(() => {
+            current.settled = true;
+            if (state.flight === current)
+                state.flight = undefined;
+            retire(key, state);
+        });
+        void current.operation.catch(() => { });
+    }
+    const reader = { signal: input.signal };
+    flight.readers.add(reader);
+    try {
+        await abortable(flight.operation, input.signal);
+        input.signal.throwIfAborted();
+        available(state);
+    }
+    finally {
+        flight.readers.delete(reader);
+        if (!flight.readers.size && !flight.settled) {
+            flight.controller.abort();
+            await flight.operation.catch((error) => {
+                if (error instanceof ProcessCleanupUnconfirmedError)
+                    throw error;
+            });
+        }
+    }
+}
+/** Hold until the account terminal's entire managed range has exited. */
+export async function reserveHermesAccount(home, signal) {
+    signal.throwIfAborted();
+    const { key } = homeKey(home);
+    const state = homes.get(key) ?? {};
+    homes.set(key, state);
+    available(state);
+    const owner = Symbol();
+    state.reserved = owner;
+    const release = () => {
+        if (state.reserved === owner)
+            state.reserved = undefined;
+        retire(key, state);
+    };
+    try {
+        if (state.flight) {
+            state.flight.controller.abort();
+            await state.flight.operation.catch((error) => {
+                if (error instanceof ProcessCleanupUnconfirmedError)
+                    throw error;
+            });
+        }
+        signal.throwIfAborted();
+        if (state.poisoned)
+            throw new ProcessCleanupUnconfirmedError();
+        return release;
+    }
+    catch (error) {
+        release();
+        throw error;
+    }
+}
+//# sourceMappingURL=hermes-renewal.js.map

package/lib/types/host/hermes-renewal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hermes-renewal.js","sourceRoot":"","sources":["../../../src/host/hermes-renewal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAA;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AACtE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,yBAAyB,GAC1B,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAC9D,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,sBAAsB,GAEvB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,6BAA6B,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAA;AACtG,OAAO,EAAE,8BAA8B,EAAuB,MAAM,cAAc,CAAA;AAGlF,MAAM,QAAQ,GAA4B;IACxC,OAAO,EAAE,oBAAoB;IAC7B,WAAW,EAAE,uBAAuB;IACpC,OAAO,EAAE,uBAAuB;IAChC,WAAW,EAAE,mCAAmC;IAChD,IAAI,EAAE,wBAAwB;CAC/B,CAAA;AACD,MAAM,OAAO,kBAAmB,SAAQ,eAAe;IAChC;IAArB,YAAqB,KAAc;QACjC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;QADH,UAAK,GAAL,KAAK,CAAS;IAEnC,CAAC;CACF;AAyBD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAA;AAC1C,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,SAAS,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAA;IACnD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAA;AACrG,CAAC;AACD,SAAS,MAAM,CAAC,GAAW,EAAE,KAAgB;IAC3C,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK;QAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AACxG,CAAC;AACD,SAAS,SAAS,CAAC,KAAgB;IACjC,IAAI,KAAK,CAAC,QAAQ;QAAE,MAAM,IAAI,8BAA8B,EAAE,CAAA;IAC9D,IAAI,KAAK,CAAC,QAAQ;QAAE,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAA;AAC1D,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,yBAAyB,CAAC,MAAwB;IAChE,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,CAAA;IAC1B,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CACL,IAAI,CAAC,SAAS,CAAC;QACb,gBAAgB;QAChB,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,QAAQ,IAAI,EAAE;QAChB,MAAM,CAAC,KAAK,CAAC,MAAM;QACnB,MAAM,CAAC,KAAK,CAAC,SAAS;KACvB,CAAC,CACH;SACA,MAAM,CAAC,KAAK,CAAC,CAAA;AAClB,CAAC;AACD,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,MAAmB;IACvD,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAA;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAM;QAC9D,MAAM,KAAK,CAAA;IACb,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC9D,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,eAAe,KAAK,MAAM;QAAE,OAAM;IAClG,MAAM,GAAG,GAAG,MAAM,uBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACvD,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,KAAK,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,MAAM;QAAE,OAAM;IACxF,MAAM,QAAQ,GAAG;QACf,GAAG,GAAG;QACN,IAAI,EAAE,6BAA6B,CAAC,GAAG,CAAC,IAAI,CAAC;QAC7C,GAAG,EAAE,6BAA6B,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC;KAC9D,CAAA;IACD,gEAAgE;IAChE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI;QAAE,OAAM;IAC1C,MAAM,MAAM,GAAG,sBAAsB,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAA;IACvE,MAAM,GAAG,GAAG,oBAAoB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAA;IAC1C,OAAO;QACL,QAAQ;QACR,MAAM;QACN,GAAG;QACH,KAAK;QACL,MAAM,EAAE,yBAAyB,CAAC,MAAM,CAAC;QACzC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC;YACvB,yBAAyB,CAAC,MAAM,CAAC;YACjC,KAAK,CAAC,SAAS,IAAI,YAAY;YAC/B,MAAM,CAAC,KAAK;SACb,CAAC;KACH,CAAA;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,KAAyB,EACzB,IAAY,EACZ,MAAc,EACd,GAAW,EACX,MAAmB;IAEnB,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,MAAM,IAAI,kBAAkB,CAAC,aAAa,CAAC,CAAA;IAC/D,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,CAAC,MAAM,KAAK,CAAC,iBAAiB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;IAChF,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,kBAAkB,CAAC,aAAa,CAAC,CAAA;IAC5D,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,UAAU,EAAE,CAAC,0BAA0B,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAA;IAChG,uFAAuF;IACvF,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,IAAI,GAAG,CAAC,0BAA0B,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjF,MAAM,IAAI,kBAAkB,CAAC,aAAa,CAAC,CAAA;IAC7C,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,iFAAiF;IACjF,+EAA+E;IAC/E,gFAAgF;IAChF,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAChC,IAAI,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,IAAI,GAAG,CAAC,sBAAsB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC;QAClG,GAAG,EAAE,IAAI;QACT,GAAG,EAAE;YACH,GAAG,wBAAwB,CAAC,IAAI,CAAC;YACjC,sBAAsB,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;YAC5C,+BAA+B,EAAE,MAAM,CAAC,GAAG,CAAC;YAC5C,uBAAuB,EAAE,GAAG;YAC5B,oBAAoB,EAAE,GAAG;SAC1B;QACD,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;QAC1D,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;QAC9B,MAAM,EAAE,QAAQ;KACjB,CAAC,CAAA;IACF,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IACtC,IAAI,MAAM,GAAG,EAAE,EACb,KAAK,GAAG,CAAC,CAAA;IACX,MAAM,IAAI,GAAG,KAAK,EAAE,MAA2B,EAAE,IAAa,EAAE,EAAE;QAChE,IAAI,MAAM;YACR,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBACjC,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;gBACjC,IAAI,KAAK,GAAG,IAAI;oBAAE,MAAM,IAAI,kBAAkB,CAAC,aAAa,CAAC,CAAA;gBAC7D,IAAI,IAAI;oBAAE,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAA;gBACjC,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG;oBAAE,MAAM,IAAI,kBAAkB,CAAC,aAAa,CAAC,CAAA;YACtE,CAAC;IACL,CAAC,CAAA;IACD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;IACrE,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC1B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAA;QAC/B,IAAI,QAAQ,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,MAAM,IAAI,kBAAkB,CAAC,aAAa,CAAC,CAAA;QAC1F,IAAI,OAAO,CAAA;QACX,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,kBAAkB,CAAC,aAAa,CAAC,CAAA;QAC7C,CAAC;QACD,IACE,CAAC,OAAO;YACR,OAAO,CAAC,OAAO,KAAK,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,eAAe;YACzD,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC;YAEtF,MAAM,IAAI,kBAAkB,CAAC,aAAa,CAAC,CAAA;QAC7C,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO;YAAE,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAC5E,CAAC;YAAS,CAAC;QACT,MAAM,GAAG,EAAE,CAAA;QACX,IAAI,MAAM,GAAG,KAAK,CAAA;QAClB,IAAI,CAAC;YACH,KAAK,CAAC,SAAS,EAAE,CAAA;YACjB,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE,CAAA;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,8BAA8B,EAAE,CAAA;QACvD,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;IACpD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,KAAyB,EAAE,IAAY,EAAE,MAAmB;IAC/E,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC3C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,GAAG,IAAI;QAAE,OAAM;IAC7E,IACE,OAAO,MAAM,CAAC,KAAK,CAAC,aAAa,KAAK,QAAQ;QAC9C,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE;QAClC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,KAAK;QACzC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC;QAElD,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAA;IACzC,IACE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAQ,EAAE,EAAE,CAC1D,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CACvE;QAED,MAAM,IAAI,kBAAkB,CAAC,aAAa,CAAC,CAAA;IAC7C,MAAM,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC7D,+EAA+E;IAC/E,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC,CAAA;IAChE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;QAAE,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAA;IACzF,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,GAAG,IAAI;QAAE,MAAM,IAAI,kBAAkB,CAAC,aAAa,CAAC,CAAA;AACxG,CAAC;AAED,SAAS,SAAS,CAAI,SAAqB,EAAE,MAAmB;IAC9D,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACzC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACvD,SAAS;aACN,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC;aACrB,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;aACzD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACpB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAAyB;IACnE,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAA;IAC7B,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACzC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;IAClC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACrB,SAAS,CAAC,KAAK,CAAC,CAAA;IAChB,IAAI,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;IACzB,IAAI,MAAM,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QACtF,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CAAA;IAC3B,IAAI,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,SAAS,CACb,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,EAChC,KAAK,CAAC,MAAM,CACb,CAAA;QACD,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAA;IACrC,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;QACzF,KAAK,CAAC,MAAM,GAAG,MAAM,CAAA;QACrB,MAAM,OAAO,GAAG,MAAM,CAAA;QACtB,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE;aAClC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;aACjD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,KAAK,YAAY,8BAA8B;gBAAE,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAA;YAC1E,IAAI,KAAK,YAAY,eAAe,IAAI,KAAK,YAAY,8BAA8B;gBAAE,MAAM,KAAK,CAAA;YACpG,UAAU,CAAC,MAAM,CAAC,cAAc,EAAE,CAAA;YAClC,MAAM,IAAI,kBAAkB,CAAC,aAAa,CAAC,CAAA;QAC7C,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,OAAO,CAAC,OAAO,GAAG,IAAI,CAAA;YACtB,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO;gBAAE,KAAK,CAAC,MAAM,GAAG,SAAS,CAAA;YACtD,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACpB,CAAC,CAAC,CAAA;QACJ,KAAK,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACxC,CAAC;IACD,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAA;IACvC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAC1B,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;QAC/C,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAA;QAC7B,SAAS,CAAC,KAAK,CAAC,CAAA;IAClB,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC7B,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC5C,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CAAA;YACzB,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACrC,IAAI,KAAK,YAAY,8BAA8B;oBAAE,MAAM,KAAK,CAAA;YAClE,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAY,EAAE,MAAmB;IAC1E,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;IAClC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACrB,SAAS,CAAC,KAAK,CAAC,CAAA;IAChB,MAAM,KAAK,GAAG,MAAM,EAAE,CAAA;IACtB,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAA;IACtB,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK;YAAE,KAAK,CAAC,QAAQ,GAAG,SAAS,CAAA;QACxD,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACpB,CAAC,CAAA;IACD,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CAAA;YAC/B,MAAM,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC3C,IAAI,KAAK,YAAY,8BAA8B;oBAAE,MAAM,KAAK,CAAA;YAClE,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,CAAC,cAAc,EAAE,CAAA;QACvB,IAAI,KAAK,CAAC,QAAQ;YAAE,MAAM,IAAI,8BAA8B,EAAE,CAAA;QAC9D,OAAO,OAAO,CAAA;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,CAAA;QACT,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC"}

package/lib/types/host/hermes-suppression.d.ts

@@ -0,0 +1,7 @@
+/** Native auth.py is_source_suppressed accepts provider-scoped lists and legacy
+ * dict keys. Removal retains config values; match the exact native source only. */
+export declare function hermesSourceSuppressed(auth: unknown, provider: string, source: string): boolean;
+/** Safe in-memory view only. Never rewrites native auth, config or environment. */
+export declare function projectHermesUnsuppressedAuth(auth: unknown): Record<string, any>;
+/** Only the selected provider's env:<NAME> record controls that provider's key. */
+export declare function hermesUnsuppressedEnvironment(auth: unknown, env: Record<string, string>, provider: string): Record<string, string>;

package/lib/types/host/hermes-suppression.js

@@ -0,0 +1,69 @@
+const record = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+const invalid = () => new Error('Hermes 账号退出记录无法确认，请检查原生账号设置');
+/** Native auth.py is_source_suppressed accepts provider-scoped lists and legacy
+ * dict keys. Removal retains config values; match the exact native source only. */
+export function hermesSourceSuppressed(auth, provider, source) {
+    if (!record(auth))
+        throw invalid();
+    const suppressed = auth.suppressed_sources;
+    if (suppressed === undefined)
+        return false;
+    if (!record(suppressed))
+        throw invalid();
+    const sources = suppressed[provider];
+    if (sources === undefined)
+        return false;
+    if (Array.isArray(sources)) {
+        if (sources.some((item) => typeof item !== 'string'))
+            throw invalid();
+        return sources.includes(source);
+    }
+    if (record(sources))
+        return Object.hasOwn(sources, source);
+    throw invalid();
+}
+/** Safe in-memory view only. Never rewrites native auth, config or environment. */
+export function projectHermesUnsuppressedAuth(auth) {
+    if (!record(auth))
+        throw invalid();
+    if (auth.suppressed_sources !== undefined) {
+        if (!record(auth.suppressed_sources))
+            throw invalid();
+        for (const provider of Object.keys(auth.suppressed_sources))
+            hermesSourceSuppressed(auth, provider, '');
+    }
+    const providers = { ...(record(auth.providers) ? auth.providers : {}) };
+    // Exact seed keys in native credential_pool._seed_from_singletons.
+    for (const [provider, source] of [
+        ['nous', 'device_code'],
+        ['openai-codex', 'device_code'],
+        ['xai-oauth', 'device_code'],
+        ['minimax-oauth', 'oauth'],
+    ])
+        if (hermesSourceSuppressed(auth, provider, source))
+            delete providers[provider];
+    const pool = auth.credential_pool;
+    if (pool !== undefined && !record(pool))
+        throw invalid();
+    return {
+        ...auth,
+        providers,
+        ...(pool === undefined
+            ? {}
+            : {
+                credential_pool: Object.fromEntries(Object.entries(pool).map(([provider, entries]) => {
+                    if (!Array.isArray(entries))
+                        throw invalid();
+                    return [
+                        provider,
+                        entries.filter((entry) => !record(entry) || !hermesSourceSuppressed(auth, provider, entry.source ?? 'manual')),
+                    ];
+                })),
+            }),
+    };
+}
+/** Only the selected provider's env:<NAME> record controls that provider's key. */
+export function hermesUnsuppressedEnvironment(auth, env, provider) {
+    return Object.fromEntries(Object.entries(env).filter(([name]) => !hermesSourceSuppressed(auth, provider, `env:${name}`)));
+}
+//# sourceMappingURL=hermes-suppression.js.map

package/lib/types/host/hermes-suppression.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hermes-suppression.js","sourceRoot":"","sources":["../../../src/host/hermes-suppression.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,GAAG,CAAC,KAAc,EAAgC,EAAE,CAC9D,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AACtE,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;AAE9D;mFACmF;AACnF,MAAM,UAAU,sBAAsB,CAAC,IAAa,EAAE,QAAgB,EAAE,MAAc;IACpF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,MAAM,OAAO,EAAE,CAAA;IAClC,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAA;IAC1C,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IAC1C,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;QAAE,MAAM,OAAO,EAAE,CAAA;IACxC,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;IACpC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IACvC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;YAAE,MAAM,OAAO,EAAE,CAAA;QACrE,OAAO,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACjC,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC1D,MAAM,OAAO,EAAE,CAAA;AACjB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,6BAA6B,CAAC,IAAa;IACzD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,MAAM,OAAO,EAAE,CAAA;IAClC,IAAI,IAAI,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC;YAAE,MAAM,OAAO,EAAE,CAAA;QACrD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC;YAAE,sBAAsB,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAA;IACzG,CAAC;IACD,MAAM,SAAS,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;IACvE,mEAAmE;IACnE,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI;QAC/B,CAAC,MAAM,EAAE,aAAa,CAAC;QACvB,CAAC,cAAc,EAAE,aAAa,CAAC;QAC/B,CAAC,WAAW,EAAE,aAAa,CAAC;QAC5B,CAAC,eAAe,EAAE,OAAO,CAAC;KAClB;QACR,IAAI,sBAAsB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC,QAAQ,CAAC,CAAA;IAChF,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAA;IACjC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,MAAM,OAAO,EAAE,CAAA;IACxD,OAAO;QACL,GAAG,IAAI;QACP,SAAS;QACT,GAAG,CAAC,IAAI,KAAK,SAAS;YACpB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,eAAe,EAAE,MAAM,CAAC,WAAW,CACjC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE;oBAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;wBAAE,MAAM,OAAO,EAAE,CAAA;oBAC5C,OAAO;wBACL,QAAQ;wBACR,OAAO,CAAC,MAAM,CACZ,CAAC,KAAK,EAAE,EAAE,CACR,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,CACtF;qBACF,CAAA;gBACH,CAAC,CAAC,CACH;aACF,CAAC;KACP,CAAA;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,6BAA6B,CAC3C,IAAa,EACb,GAA2B,EAC3B,QAAgB;IAEhB,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAC/F,CAAA;AACH,CAAC"}

package/lib/types/host/hermes-windows-installation.d.ts

@@ -0,0 +1,5 @@
+/** Read only the single stored __main__.py member emitted by distlib. No ZIP
+ * extraction, Python evaluation, installer invocation, or account lookup. */
+export declare function hermesDistlibSource(bytes: Buffer): string | undefined;
+export declare function hermesLauncherCheckout(source: string): string | undefined;
+export declare function windowsHermesCheckout(executable: string, command: string[], signal?: AbortSignal): Promise<string | undefined>;

package/lib/types/host/hermes-windows-installation.js

@@ -0,0 +1,91 @@
+import { constants } from 'node:fs';
+import { open, realpath } from 'node:fs/promises';
+import { basename, isAbsolute } from 'node:path';
+/** Read only the single stored __main__.py member emitted by distlib. No ZIP
+ * extraction, Python evaluation, installer invocation, or account lookup. */
+export function hermesDistlibSource(bytes) {
+    if (bytes.length < 128 || bytes.toString('ascii', 0, 2) !== 'MZ')
+        return;
+    const end = bytes.length - 22;
+    if (bytes.readUInt32LE(end) !== 0x06054b50)
+        return;
+    if (bytes.readUInt16LE(end + 4) !== 0 ||
+        bytes.readUInt16LE(end + 6) !== 0 ||
+        bytes.readUInt16LE(end + 8) !== 1 ||
+        bytes.readUInt16LE(end + 10) !== 1 ||
+        bytes.readUInt16LE(end + 20) !== 0)
+        throw new Error('Unsupported Hermes launcher archive');
+    const centralSize = bytes.readUInt32LE(end + 12);
+    const central = end - centralSize;
+    if (central < 64 || centralSize < 46 || bytes.readUInt32LE(central) !== 0x02014b50)
+        throw new Error('Invalid Hermes launcher directory');
+    const nameSize = bytes.readUInt16LE(central + 28);
+    const size = bytes.readUInt32LE(central + 24);
+    const local = central - bytes.readUInt32LE(end + 16) + bytes.readUInt32LE(central + 42);
+    if (centralSize !== 46 + nameSize ||
+        bytes.subarray(central + 46, end).toString('utf8') !== '__main__.py' ||
+        bytes.readUInt16LE(central + 8) !== 0 ||
+        bytes.readUInt16LE(central + 10) !== 0 ||
+        bytes.readUInt32LE(central + 20) !== size ||
+        size > 128 * 1024 ||
+        local < 64 ||
+        local + 30 > central ||
+        bytes.readUInt32LE(local) !== 0x04034b50 ||
+        bytes.readUInt16LE(local + 6) !== 0 ||
+        bytes.readUInt16LE(local + 8) !== 0 ||
+        bytes.readUInt32LE(local + 18) !== size ||
+        bytes.readUInt32LE(local + 22) !== size ||
+        bytes.readUInt16LE(local + 26) !== nameSize ||
+        bytes.readUInt16LE(local + 28) !== 0 ||
+        local + 30 + nameSize + size !== central ||
+        bytes.subarray(local + 30, local + 30 + nameSize).toString('utf8') !== '__main__.py')
+        throw new Error('Invalid Hermes launcher member');
+    return bytes.subarray(local + 30 + nameSize, central).toString('utf8');
+}
+export function hermesLauncherCheckout(source) {
+    if (!source.startsWith('import os, re, sys\n') ||
+        !source.includes('sys._hermes_pin_default_home = True\n') ||
+        !source.includes('import hermes_bootstrap') ||
+        !source.includes('from hermes_cli.main import main'))
+        return;
+    // Python's repr(path) uses only literal escaped backslashes/quotes here.
+    // Do not evaluate the launcher, interpolate its statements, or accept expressions.
+    const roots = [
+        ...source.matchAll(/^sys\.path\.insert\(0, ('(?:[^'\\\r\n]|\\[\\'])+'|"(?:[^"\\\r\n]|\\[\\"])+")\)\r?$/gm),
+    ];
+    if (roots.length !== 1)
+        throw new Error('Ambiguous Hermes checkout');
+    const path = roots[0][1].slice(1, -1).replace(/\\([\\'"])/g, '$1');
+    if (!isAbsolute(path) || path.includes('\0'))
+        throw new Error('Invalid Hermes checkout');
+    return path;
+}
+export async function windowsHermesCheckout(executable, command, signal) {
+    let source;
+    if (basename(executable).toLowerCase() === 'hermes.exe') {
+        const file = await open(executable, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        try {
+            const info = await file.stat();
+            if (!info.isFile() || info.nlink !== 1 || info.size > 1024 * 1024)
+                throw new Error('Unsafe Hermes launcher');
+            source = hermesDistlibSource(await file.readFile());
+        }
+        finally {
+            await file.close();
+        }
+    }
+    else if (command[1] === '-I' && command[2] === '-c') {
+        const encoded = /^import base64; exec\(base64\.b64decode\('([A-Za-z0-9+/]+={0,2})'\)\)$/.exec(command[3] ?? '');
+        if (encoded)
+            source = Buffer.from(encoded[1], 'base64').toString('utf8');
+    }
+    signal?.throwIfAborted();
+    if (source === undefined)
+        return;
+    const checkout = hermesLauncherCheckout(source);
+    if (!checkout)
+        return;
+    // Canonical spelling is part of the native install_key hash.
+    return realpath(checkout);
+}
+//# sourceMappingURL=hermes-windows-installation.js.map

package/lib/types/host/hermes-windows-installation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hermes-windows-installation.js","sourceRoot":"","sources":["../../../src/host/hermes-windows-installation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAEhD;6EAC6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI;QAAE,OAAM;IACxE,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,GAAG,EAAE,CAAA;IAC7B,IAAI,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,UAAU;QAAE,OAAM;IAClD,IACE,KAAK,CAAC,YAAY,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC;QACjC,KAAK,CAAC,YAAY,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC;QACjC,KAAK,CAAC,YAAY,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC;QACjC,KAAK,CAAC,YAAY,CAAC,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC;QAClC,KAAK,CAAC,YAAY,CAAC,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC;QAElC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACxD,MAAM,WAAW,GAAG,KAAK,CAAC,YAAY,CAAC,GAAG,GAAG,EAAE,CAAC,CAAA;IAChD,MAAM,OAAO,GAAG,GAAG,GAAG,WAAW,CAAA;IACjC,IAAI,OAAO,GAAG,EAAE,IAAI,WAAW,GAAG,EAAE,IAAI,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,UAAU;QAChF,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;IACtD,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,CAAC,OAAO,GAAG,EAAE,CAAC,CAAA;IACjD,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,CAAC,OAAO,GAAG,EAAE,CAAC,CAAA;IAC7C,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC,OAAO,GAAG,EAAE,CAAC,CAAA;IACvF,IACE,WAAW,KAAK,EAAE,GAAG,QAAQ;QAC7B,KAAK,CAAC,QAAQ,CAAC,OAAO,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,aAAa;QACpE,KAAK,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC;QACrC,KAAK,CAAC,YAAY,CAAC,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC;QACtC,KAAK,CAAC,YAAY,CAAC,OAAO,GAAG,EAAE,CAAC,KAAK,IAAI;QACzC,IAAI,GAAG,GAAG,GAAG,IAAI;QACjB,KAAK,GAAG,EAAE;QACV,KAAK,GAAG,EAAE,GAAG,OAAO;QACpB,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,UAAU;QACxC,KAAK,CAAC,YAAY,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;QACnC,KAAK,CAAC,YAAY,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;QACnC,KAAK,CAAC,YAAY,CAAC,KAAK,GAAG,EAAE,CAAC,KAAK,IAAI;QACvC,KAAK,CAAC,YAAY,CAAC,KAAK,GAAG,EAAE,CAAC,KAAK,IAAI;QACvC,KAAK,CAAC,YAAY,CAAC,KAAK,GAAG,EAAE,CAAC,KAAK,QAAQ;QAC3C,KAAK,CAAC,YAAY,CAAC,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC;QACpC,KAAK,GAAG,EAAE,GAAG,QAAQ,GAAG,IAAI,KAAK,OAAO;QACxC,KAAK,CAAC,QAAQ,CAAC,KAAK,GAAG,EAAE,EAAE,KAAK,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,aAAa;QAEpF,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;IACnD,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,GAAG,EAAE,GAAG,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AACxE,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,IACE,CAAC,MAAM,CAAC,UAAU,CAAC,sBAAsB,CAAC;QAC1C,CAAC,MAAM,CAAC,QAAQ,CAAC,uCAAuC,CAAC;QACzD,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QAC3C,CAAC,MAAM,CAAC,QAAQ,CAAC,kCAAkC,CAAC;QAEpD,OAAM;IACR,yEAAyE;IACzE,mFAAmF;IACnF,MAAM,KAAK,GAAG;QACZ,GAAG,MAAM,CAAC,QAAQ,CAChB,sFAAsF,CACvF;KACF,CAAA;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;IACpE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;IACpE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;IACxF,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,UAAkB,EAClB,OAAiB,EACjB,MAAoB;IAEpB,IAAI,MAA0B,CAAA;IAC9B,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,KAAK,YAAY,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;QACrG,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;YAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI;gBAC/D,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;YAC3C,MAAM,GAAG,mBAAmB,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;QACrD,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;QACpB,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtD,MAAM,OAAO,GAAG,wEAAwE,CAAC,IAAI,CAC3F,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CACjB,CAAA;QACD,IAAI,OAAO;YAAE,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC3E,CAAC;IACD,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,IAAI,MAAM,KAAK,SAAS;QAAE,OAAM;IAChC,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAA;IAC/C,IAAI,CAAC,QAAQ;QAAE,OAAM;IACrB,6DAA6D;IAC7D,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAA;AAC3B,CAAC"}

package/lib/types/host/index.d.ts

@@ -0,0 +1,140 @@
+import { Context } from '@deepseek-ai/cordis';
+import z from '@deepseek-ai/schemastery';
+import { TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
+export type { Preference, Worker, WorkerSnapshot, ModelChoice, TimelineItem, TaskMode, Effort, WorkerStatus, RolePreset, RoleSnapshot, } from '../shared/types.ts';
+/** Deployment settings; all values are resolved by the plugin schema. */
+export interface Config {
+    /** CLI binary or absolute path (default agy). */
+    executable?: string;
+    /** Codex CLI executable. */
+    codexExecutable?: string;
+    /** Claude Code executable. */
+    claudeExecutable?: string;
+    /** Kimi Code executable. */
+    kimiExecutable?: string;
+    /** Official Xiaomi MiMo Code executable. */
+    mimoExecutable?: string;
+    zcodeExecutable?: string;
+    grokExecutable?: string;
+    ompExecutable?: string;
+    piExecutable?: string;
+    hermesExecutable?: string;
+    hermesHome?: string;
+    opencodeExecutable?: string;
+    zcodeAuthDirectory?: string;
+    zcodeBuiltinConfig?: string;
+    /** @deprecated Accepted for old deployments only; never read or forwarded. */
+    zaiCredentialRef?: string;
+    /** Optional private state directory; defaults to DSH_HOME/cliworker-now. */
+    stateDirectory?: string;
+    /** Maximum concurrent processes (default 2). */
+    maxConcurrent?: number;
+    /** Maximum turn duration in milliseconds (default 1800000). */
+    timeoutMs?: number;
+    /** Process termination grace in milliseconds (default 5000). */
+    graceMs?: number;
+    /** Maximum NDJSON line bytes (default 1048576). */
+    maxLineBytes?: number;
+    /** Maximum output bytes per run (default 16777216). */
+    maxRunBytes?: number;
+    /** Maximum logical timeline rows in one live view (default 1000). */
+    maxTimelineItems?: number;
+}
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        /** CLI worker lifecycle and browser API. */ cliworker: CliWorkerService;
+    }
+}
+declare module '@deepseek-ai/dsh-jobs' {
+    interface JobKindMap {
+        cliworker: 'cliworker';
+    }
+}
+declare module '@deepseek-ai/dsh-typert-protocol' {
+    interface RemoteErrorDetailsMap {
+        /** CLI worker operation could not proceed. */ 'cliworker/unavailable': {
+            reason: string;
+        };
+    }
+}
+/** Host owner of CLI conversations, model tools and Remote streams. */
+export declare class CliWorkerService extends TypertRemoteService {
+    static inject: string[];
+    static Config: z<Config>;
+    private runtime;
+    private accounts;
+    private accountParents;
+    private options;
+    private backend;
+    private pending;
+    private dispatchWaits;
+    private selectionBindings;
+    private selectionProjects;
+    private displayedBindings;
+    private disposed;
+    /** @param ctx - Harness services. @param config - Validated deployment options. */
+    constructor(ctx: Context, config: Config);
+    private parent;
+    private project;
+    private assertExecution;
+    private queryCatalog;
+    private querySelection;
+    /** Serialize only this conversation's selection; a cancelled waiter never owns the question. */
+    private chooseDispatch;
+    private launch;
+    private registerTools;
+    /** @param parentSessionId - Owning Harness session. @param workerId - Selected worker or empty string. @param signal - Stream lifetime. @returns JSON snapshots, initially and after changes. */
+    watch(parentSessionId: string, workerId: string, signal: AbortSignal): AsyncIterable<string>;
+    /** @param parentSessionId - Owning parent session. @param workerId - Worker identity. @param anchor - Stable logical row ID, excluded from the result. @param direction - before or after. @returns JSON historical page, at most 200 rows. */
+    history(parentSessionId: string, workerId: string, anchor: string, direction: string): Promise<string>;
+    /** @param parentSessionId - Owning Harness session. @param signal - Query lifetime. @returns Profile-wide CLI enablement JSON. */
+    cliSettings(parentSessionId: string, signal: AbortSignal): Promise<string>;
+    /** @param parentSessionId - Active parent. @param signal - Query lifetime. @returns JSON role preset library. */
+    rolePresets(parentSessionId: string, signal: AbortSignal): Promise<string>;
+    /** @param parentSessionId - Active parent. @param requestJSON - Preset fields, optional existing id. @param signal - Mutation lifetime. @returns Saved preset JSON. */
+    saveRolePreset(parentSessionId: string, requestJSON: string, signal: AbortSignal): Promise<string>;
+    /** @param parentSessionId - Active parent. @param presetId - Preset to delete. @param signal - Mutation lifetime. @returns Completion. */
+    deleteRolePreset(parentSessionId: string, presetId: string, signal: AbortSignal): Promise<void>;
+    /** @param parentSessionId - Owning parent. @param workerId - Worker identity. @param name - Unique readable name. @param signal - Mutation lifetime. @returns Completion. */
+    renameWorker(parentSessionId: string, workerId: string, name: string, signal: AbortSignal): Promise<void>;
+    /** @param parentSessionId - Owning parent. @param workerId - Worker identity. @param title - Single-line chat title, at most 160 characters. @param signal - Mutation lifetime. @returns Completion. */
+    renameWorkerTitle(parentSessionId: string, workerId: string, title: string, signal: AbortSignal): Promise<void>;
+    /** @param parentSessionId - Owning parent. @param workerId - Idle Worker to hide. @param signal - Mutation lifetime. @returns Completion without deleting native data. */
+    deleteWorker(parentSessionId: string, workerId: string, signal: AbortSignal): Promise<void>;
+    /** @param parentSessionId - Owning parent. @param workerId - Deleted Worker identity. @param signal - Mutation lifetime. @returns Completion with the original ID and history. */
+    restoreWorker(parentSessionId: string, workerId: string, signal: AbortSignal): Promise<void>;
+    /** @param parentSessionId - Owning session. @param cli - Selected CLI. @param enabled - Allow new CLI operations. @param signal - Mutation admission lifetime. @returns Updated profile-wide CLI enablement JSON. */
+    setCliEnabled(parentSessionId: string, cli: string, enabled: boolean, signal: AbortSignal): Promise<string>;
+    /** @param parentSessionId - Owning session. @param cli - Selected CLI. @param signal - Query lifetime. @returns Safe account status JSON. */
+    accountStatus(parentSessionId: string, cli: string, signal: AbortSignal): Promise<string>;
+    /** @param parentSessionId - Owning session. @param cli - Selected CLI. @param action - Explicit human action. @param signal - Startup lifetime. @returns Managed account terminal identity and instruction JSON. */
+    accountStart(parentSessionId: string, cli: string, action: string, signal: AbortSignal): Promise<string>;
+    /** @param source - One current CLI-native source, never a filesystem path. */
+    accountStartForSource(parentSessionId: string, cli: string, action: string, source: string, signal: AbortSignal): Promise<string>;
+    /** @param provider - Explicit ZCode native login provider, never a URL or logout source. */
+    accountStartForProvider(parentSessionId: string, cli: string, action: string, provider: string, signal: AbortSignal): Promise<string>;
+    private startAccount;
+    /** @param parentSessionId - Owning session. @param accountId - Account terminal identity. @param signal - Stream lifetime. @returns Ephemeral terminal frame JSON. */
+    accountWatch(parentSessionId: string, accountId: string, signal: AbortSignal): AsyncIterable<string>;
+    /** @param parentSessionId - Owning session. @param accountId - Account terminal identity. @param data - Human keyboard input. @returns Input accepted. */
+    accountWrite(parentSessionId: string, accountId: string, data: string): Promise<boolean>;
+    /** @param parentSessionId - Owning session. @param accountId - Account terminal identity. @param cols - Visible columns. @param rows - Visible rows. @returns Resize accepted. */
+    accountResize(parentSessionId: string, accountId: string, cols: number, rows: number): Promise<boolean>;
+    /** @param parentSessionId - Owning session. @param accountId - Account terminal identity. @returns Process cleanup completed. */
+    accountStop(parentSessionId: string, accountId: string): Promise<boolean>;
+    /** @param parentSessionId - Parent session identity. @param signal - Caller lifetime. @returns JSON model catalog and project preference. */
+    catalog(parentSessionId: string, signal: AbortSignal): Promise<string>;
+    /** @param parentSessionId - Parent session identity. @param cli - Selected CLI. @param signal - Caller lifetime. @returns CLI catalog and saved project preference. */
+    catalogForCli(parentSessionId: string, cli: string, signal: AbortSignal): Promise<string>;
+    /** @param parentSessionId - Parent session identity. @param selection - JSON model and effort. @param signal - Caller lifetime. @returns Saved JSON preference. */
+    configure(parentSessionId: string, selection: string, signal: AbortSignal): Promise<string>;
+    /** @param parentSessionId - Owning session. @param workerId - Idle worker. @param selection - JSON preference. @param signal - Caller lifetime. @returns Saved worker configuration. */
+    configureWorker(parentSessionId: string, workerId: string, selection: string, signal: AbortSignal): Promise<string>;
+    /** @param parentSessionId - Parent session identity. @param workerId - Worker to continue. @param prompt - New task. @param signal - Admission lifetime. @returns Published background receipt. */
+    followup(parentSessionId: string, workerId: string, prompt: string, signal: AbortSignal): Promise<string>;
+    /** @param parentSessionId - Owning parent. @param workerId - Idle legacy history without an account binding. @param prompt - Explicit new-dialog task. @param signal - Admission lifetime. @returns JSON background receipt for a fresh Worker. */
+    restartWorker(parentSessionId: string, workerId: string, prompt: string, signal: AbortSignal): Promise<string>;
+    /** @param parentSessionId - Owning Harness session. @param workerId - Worker to stop. @returns Final worker state after cleanup. */
+    stop(parentSessionId: string, workerId: string): Promise<string>;
+}
+export default CliWorkerService;