dsh-cliworker-now 0.7.6 → 0.7.8

package/lib/types/host/hermes-renewal.js

@@ -0,0 +1,292 @@
+import { createHash } from 'node:crypto';
+import { lstat } from 'node:fs/promises';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { validateHermesHomeDirectory } from "./hermes-adapter.js";
+import { hermesAccountEnvironment } from "./hermes-account-context.js";
+import { assertHermesOwnAccounts, hermesPoolEntryUnavailable, readHermesAccountMaterial, } from "./hermes-models.js";
+import { hermesNativeCommand } from "./hermes-installation.js";
+import { HermesNousError, hermesNousMinimumTtl, selectHermesNousSource, } from "./hermes-nous.js";
+import { projectHermesUnsuppressedAuth, hermesUnsuppressedEnvironment } from "./hermes-suppression.js";
+import { ProcessCleanupUnconfirmedError } from "./process.js";
+const messages = {
+    relogin: 'Hermes 登录已失效，请重新登录',
+    unavailable: 'Hermes 登录暂时无法续期，请稍后刷新',
+    changed: 'Hermes 账号来源已变化，请刷新后重试',
+    unsupported: '当前 Hermes 安装不支持安全续期，请更新原生 CLI 后重试',
+    busy: 'Hermes 账号终端正在运行，请关闭后刷新',
+};
+export class HermesRenewalError extends HermesNousError {
+    state;
+    constructor(state) {
+        super(messages[state]);
+        this.state = state;
+    }
+}
+const homes = new Map();
+function homeKey(home) {
+    const canonical = validateHermesHomeDirectory(home);
+    return { home: canonical, key: process.platform === 'win32' ? canonical.toLowerCase() : canonical };
+}
+function retire(key, state) {
+    if (!state.flight && !state.reserved && !state.poisoned && homes.get(key) === state)
+        homes.delete(key);
+}
+function available(state) {
+    if (state.poisoned)
+        throw new ProcessCleanupUnconfirmedError();
+    if (state.reserved)
+        throw new HermesRenewalError('busy');
+}
+/** No bearer, refresh token or email enters the command line or public result. */
+export function hermesNousPrincipalDigest(source) {
+    const p = source.principal;
+    return createHash('sha256')
+        .update(JSON.stringify([
+        'hermes-nous-v1',
+        p.subject,
+        p.organization,
+        p.issuer,
+        p.clientId ?? '',
+        source.route.portal,
+        source.route.inference,
+    ]))
+        .digest('hex');
+}
+async function snapshot(home, signal) {
+    try {
+        await lstat(join(home, 'config.yaml'));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return;
+        throw error;
+    }
+    const selected = await readHermesAccountMaterial(home, signal);
+    if (selected.config.model?.provider !== 'nous' || selected.auth.active_provider !== 'nous')
+        return;
+    const raw = await assertHermesOwnAccounts(home, signal);
+    if (raw.config.model?.provider !== 'nous' || raw.auth.active_provider !== 'nous')
+        return;
+    const material = {
+        ...raw,
+        auth: projectHermesUnsuppressedAuth(raw.auth),
+        env: hermesUnsuppressedEnvironment(raw.auth, raw.env, 'nous'),
+    };
+    // Suppressed/deleted credentials never become a renewal source.
+    if (!material.auth.providers?.nous)
+        return;
+    const source = selectHermesNousSource(material, { allowExpired: true });
+    const ttl = hermesNousMinimumTtl(material.env);
+    const state = material.auth.providers.nous;
+    return {
+        material,
+        source,
+        ttl,
+        state,
+        digest: hermesNousPrincipalDigest(source),
+        identity: JSON.stringify([
+            hermesNousPrincipalDigest(source),
+            state.client_id || 'hermes-cli',
+            source.route,
+        ]),
+    };
+}
+async function capture(input, home, digest, ttl, signal) {
+    if (!input.backend)
+        throw new HermesRenewalError('unsupported');
+    const executable = input.executable ?? (await input.resolveExecutable?.(signal));
+    if (!executable)
+        throw new HermesRenewalError('unsupported');
+    const argv = await hermesNativeCommand(executable, ['--cliworker-nous-refresh', digest], signal);
+    // Unknown standalone launchers must not receive our private protocol as a CLI command.
+    if (argv[2] !== fileURLToPath(new URL('./hermes-native-entry.py', import.meta.url)))
+        throw new HermesRenewalError('unsupported');
+    signal.throwIfAborted();
+    // Once rotation starts, cancellation waits for the bounded native transaction to
+    // persist its new refresh token. Killing it on UI cancellation could spend the
+    // old single-use grant without saving the replacement (especially Windows Job).
+    const deadline = AbortSignal.timeout(8000);
+    const child = input.backend.spawn({
+        argv: [process.execPath, fileURLToPath(new URL('./private-launch.mjs', import.meta.url)), ...argv],
+        cwd: home,
+        env: {
+            ...hermesAccountEnvironment(home),
+            HERMES_SHARED_AUTH_DIR: join(home, 'shared'),
+            HERMES_NOUS_MIN_KEY_TTL_SECONDS: String(ttl),
+            PYTHONDONTWRITEBYTECODE: '1',
+            ELECTRON_RUN_AS_NODE: '1',
+        },
+        stdio: { stdin: 'ignore', stdout: 'pipe', stderr: 'pipe' },
+        graceMs: input.graceMs ?? 5000,
+        signal: deadline,
+    });
+    void child.done.catch(() => undefined);
+    let output = '', bytes = 0;
+    const read = async (stream, keep) => {
+        if (stream)
+            for await (const chunk of stream) {
+                bytes += Buffer.byteLength(chunk);
+                if (bytes > 8192)
+                    throw new HermesRenewalError('unavailable');
+                if (keep)
+                    output += String(chunk);
+                if (output.length > 512)
+                    throw new HermesRenewalError('unavailable');
+            }
+    };
+    const readers = [read(child.stdout, true), read(child.stderr, false)];
+    try {
+        await Promise.all(readers);
+        const result = await child.done;
+        if (deadline.aborted || result.exitCode !== 0)
+            throw new HermesRenewalError('unavailable');
+        let receipt;
+        try {
+            receipt = JSON.parse(output);
+        }
+        catch {
+            throw new HermesRenewalError('unavailable');
+        }
+        if (!receipt ||
+            receipt.version !== 1 ||
+            Object.keys(receipt).sort().join(',') !== 'state,version' ||
+            !['ready', 'relogin', 'unavailable', 'changed', 'unsupported'].includes(receipt.state))
+            throw new HermesRenewalError('unavailable');
+        if (receipt.state !== 'ready')
+            throw new HermesRenewalError(receipt.state);
+    }
+    finally {
+        output = '';
+        let exited = false;
+        try {
+            child.terminate();
+            exited = await child.waitForExit();
+        }
+        catch {
+            /* fail closed below */
+        }
+        if (!exited)
+            throw new ProcessCleanupUnconfirmedError();
+        await Promise.allSettled([...readers, child.done]);
+    }
+}
+async function renew(input, home, signal) {
+    signal.throwIfAborted();
+    const before = await snapshot(home, signal);
+    if (!before || before.source.expires > Date.now() + before.ttl * 1000)
+        return;
+    if (typeof before.state.refresh_token !== 'string' ||
+        !before.state.refresh_token.trim() ||
+        before.state.refresh_token.length > 32768 ||
+        /[\x00-\x20\x7f]/.test(before.state.refresh_token))
+        throw new HermesRenewalError('relogin');
+    if (before.material.auth.credential_pool.nous.some((row) => hermesPoolEntryUnavailable(row, before.material.config.model?.default)))
+        throw new HermesRenewalError('unavailable');
+    await capture(input, home, before.digest, before.ttl, signal);
+    // Always reread even if all subscribers left while the native transaction ran.
+    const after = await snapshot(home, new AbortController().signal);
+    if (!after || after.identity !== before.identity)
+        throw new HermesRenewalError('changed');
+    if (after.source.expires <= Date.now() + after.ttl * 1000)
+        throw new HermesRenewalError('unavailable');
+}
+function abortable(operation, signal) {
+    signal.throwIfAborted();
+    return new Promise((resolve, reject) => {
+        const abort = () => reject(signal.reason);
+        signal.addEventListener('abort', abort, { once: true });
+        operation
+            .then(resolve, reject)
+            .finally(() => signal.removeEventListener('abort', abort))
+            .catch(() => { });
+    });
+}
+/** Share only an in-flight renewal, never a completed authorization decision. */
+export async function ensureHermesNousFresh(input) {
+    input.signal.throwIfAborted();
+    const { home, key } = homeKey(input.home);
+    const state = homes.get(key) ?? {};
+    homes.set(key, state);
+    available(state);
+    let flight = state.flight;
+    if (flight?.readers.size && [...flight.readers].every((reader) => reader.signal.aborted))
+        flight.controller.abort();
+    if (flight?.controller.signal.aborted) {
+        await abortable(flight.operation.catch(() => { }), input.signal);
+        return ensureHermesNousFresh(input);
+    }
+    if (!flight) {
+        const controller = new AbortController();
+        flight = { controller, operation: Promise.resolve(), readers: new Set(), settled: false };
+        state.flight = flight;
+        const current = flight;
+        current.operation = Promise.resolve()
+            .then(() => renew(input, home, controller.signal))
+            .catch((error) => {
+            if (error instanceof ProcessCleanupUnconfirmedError)
+                state.poisoned = true;
+            if (error instanceof HermesNousError || error instanceof ProcessCleanupUnconfirmedError)
+                throw error;
+            controller.signal.throwIfAborted();
+            throw new HermesRenewalError('unavailable');
+        })
+            .finally(() => {
+            current.settled = true;
+            if (state.flight === current)
+                state.flight = undefined;
+            retire(key, state);
+        });
+        void current.operation.catch(() => { });
+    }
+    const reader = { signal: input.signal };
+    flight.readers.add(reader);
+    try {
+        await abortable(flight.operation, input.signal);
+        input.signal.throwIfAborted();
+        available(state);
+    }
+    finally {
+        flight.readers.delete(reader);
+        if (!flight.readers.size && !flight.settled) {
+            flight.controller.abort();
+            await flight.operation.catch((error) => {
+                if (error instanceof ProcessCleanupUnconfirmedError)
+                    throw error;
+            });
+        }
+    }
+}
+/** Hold until the account terminal's entire managed range has exited. */
+export async function reserveHermesAccount(home, signal) {
+    signal.throwIfAborted();
+    const { key } = homeKey(home);
+    const state = homes.get(key) ?? {};
+    homes.set(key, state);
+    available(state);
+    const owner = Symbol();
+    state.reserved = owner;
+    const release = () => {
+        if (state.reserved === owner)
+            state.reserved = undefined;
+        retire(key, state);
+    };
+    try {
+        if (state.flight) {
+            state.flight.controller.abort();
+            await state.flight.operation.catch((error) => {
+                if (error instanceof ProcessCleanupUnconfirmedError)
+                    throw error;
+            });
+        }
+        signal.throwIfAborted();
+        if (state.poisoned)
+            throw new ProcessCleanupUnconfirmedError();
+        return release;
+    }
+    catch (error) {
+        release();
+        throw error;
+    }
+}
+//# sourceMappingURL=hermes-renewal.js.map

package/lib/types/host/hermes-renewal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hermes-renewal.js","sourceRoot":"","sources":["../../../src/host/hermes-renewal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAA;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AACtE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,yBAAyB,GAC1B,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAC9D,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,sBAAsB,GAEvB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,6BAA6B,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAA;AACtG,OAAO,EAAE,8BAA8B,EAAuB,MAAM,cAAc,CAAA;AAGlF,MAAM,QAAQ,GAA4B;IACxC,OAAO,EAAE,oBAAoB;IAC7B,WAAW,EAAE,uBAAuB;IACpC,OAAO,EAAE,uBAAuB;IAChC,WAAW,EAAE,mCAAmC;IAChD,IAAI,EAAE,wBAAwB;CAC/B,CAAA;AACD,MAAM,OAAO,kBAAmB,SAAQ,eAAe;IAChC;IAArB,YAAqB,KAAc;QACjC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;QADH,UAAK,GAAL,KAAK,CAAS;IAEnC,CAAC;CACF;AAyBD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAA;AAC1C,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,SAAS,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAA;IACnD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAA;AACrG,CAAC;AACD,SAAS,MAAM,CAAC,GAAW,EAAE,KAAgB;IAC3C,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK;QAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AACxG,CAAC;AACD,SAAS,SAAS,CAAC,KAAgB;IACjC,IAAI,KAAK,CAAC,QAAQ;QAAE,MAAM,IAAI,8BAA8B,EAAE,CAAA;IAC9D,IAAI,KAAK,CAAC,QAAQ;QAAE,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAA;AAC1D,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,yBAAyB,CAAC,MAAwB;IAChE,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,CAAA;IAC1B,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CACL,IAAI,CAAC,SAAS,CAAC;QACb,gBAAgB;QAChB,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,QAAQ,IAAI,EAAE;QAChB,MAAM,CAAC,KAAK,CAAC,MAAM;QACnB,MAAM,CAAC,KAAK,CAAC,SAAS;KACvB,CAAC,CACH;SACA,MAAM,CAAC,KAAK,CAAC,CAAA;AAClB,CAAC;AACD,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,MAAmB;IACvD,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAA;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAM;QAC9D,MAAM,KAAK,CAAA;IACb,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC9D,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,eAAe,KAAK,MAAM;QAAE,OAAM;IAClG,MAAM,GAAG,GAAG,MAAM,uBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACvD,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,KAAK,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,MAAM;QAAE,OAAM;IACxF,MAAM,QAAQ,GAAG;QACf,GAAG,GAAG;QACN,IAAI,EAAE,6BAA6B,CAAC,GAAG,CAAC,IAAI,CAAC;QAC7C,GAAG,EAAE,6BAA6B,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC;KAC9D,CAAA;IACD,gEAAgE;IAChE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI;QAAE,OAAM;IAC1C,MAAM,MAAM,GAAG,sBAAsB,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAA;IACvE,MAAM,GAAG,GAAG,oBAAoB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAA;IAC1C,OAAO;QACL,QAAQ;QACR,MAAM;QACN,GAAG;QACH,KAAK;QACL,MAAM,EAAE,yBAAyB,CAAC,MAAM,CAAC;QACzC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC;YACvB,yBAAyB,CAAC,MAAM,CAAC;YACjC,KAAK,CAAC,SAAS,IAAI,YAAY;YAC/B,MAAM,CAAC,KAAK;SACb,CAAC;KACH,CAAA;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,KAAyB,EACzB,IAAY,EACZ,MAAc,EACd,GAAW,EACX,MAAmB;IAEnB,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,MAAM,IAAI,kBAAkB,CAAC,aAAa,CAAC,CAAA;IAC/D,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,CAAC,MAAM,KAAK,CAAC,iBAAiB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;IAChF,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,kBAAkB,CAAC,aAAa,CAAC,CAAA;IAC5D,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,UAAU,EAAE,CAAC,0BAA0B,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAA;IAChG,uFAAuF;IACvF,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,IAAI,GAAG,CAAC,0BAA0B,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjF,MAAM,IAAI,kBAAkB,CAAC,aAAa,CAAC,CAAA;IAC7C,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,iFAAiF;IACjF,+EAA+E;IAC/E,gFAAgF;IAChF,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAChC,IAAI,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,IAAI,GAAG,CAAC,sBAAsB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC;QAClG,GAAG,EAAE,IAAI;QACT,GAAG,EAAE;YACH,GAAG,wBAAwB,CAAC,IAAI,CAAC;YACjC,sBAAsB,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;YAC5C,+BAA+B,EAAE,MAAM,CAAC,GAAG,CAAC;YAC5C,uBAAuB,EAAE,GAAG;YAC5B,oBAAoB,EAAE,GAAG;SAC1B;QACD,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;QAC1D,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;QAC9B,MAAM,EAAE,QAAQ;KACjB,CAAC,CAAA;IACF,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IACtC,IAAI,MAAM,GAAG,EAAE,EACb,KAAK,GAAG,CAAC,CAAA;IACX,MAAM,IAAI,GAAG,KAAK,EAAE,MAA2B,EAAE,IAAa,EAAE,EAAE;QAChE,IAAI,MAAM;YACR,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBACjC,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;gBACjC,IAAI,KAAK,GAAG,IAAI;oBAAE,MAAM,IAAI,kBAAkB,CAAC,aAAa,CAAC,CAAA;gBAC7D,IAAI,IAAI;oBAAE,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAA;gBACjC,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG;oBAAE,MAAM,IAAI,kBAAkB,CAAC,aAAa,CAAC,CAAA;YACtE,CAAC;IACL,CAAC,CAAA;IACD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;IACrE,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC1B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAA;QAC/B,IAAI,QAAQ,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,MAAM,IAAI,kBAAkB,CAAC,aAAa,CAAC,CAAA;QAC1F,IAAI,OAAO,CAAA;QACX,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,kBAAkB,CAAC,aAAa,CAAC,CAAA;QAC7C,CAAC;QACD,IACE,CAAC,OAAO;YACR,OAAO,CAAC,OAAO,KAAK,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,eAAe;YACzD,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC;YAEtF,MAAM,IAAI,kBAAkB,CAAC,aAAa,CAAC,CAAA;QAC7C,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO;YAAE,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAC5E,CAAC;YAAS,CAAC;QACT,MAAM,GAAG,EAAE,CAAA;QACX,IAAI,MAAM,GAAG,KAAK,CAAA;QAClB,IAAI,CAAC;YACH,KAAK,CAAC,SAAS,EAAE,CAAA;YACjB,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE,CAAA;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,8BAA8B,EAAE,CAAA;QACvD,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;IACpD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,KAAyB,EAAE,IAAY,EAAE,MAAmB;IAC/E,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC3C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,GAAG,IAAI;QAAE,OAAM;IAC7E,IACE,OAAO,MAAM,CAAC,KAAK,CAAC,aAAa,KAAK,QAAQ;QAC9C,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE;QAClC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,KAAK;QACzC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC;QAElD,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAA;IACzC,IACE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAQ,EAAE,EAAE,CAC1D,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CACvE;QAED,MAAM,IAAI,kBAAkB,CAAC,aAAa,CAAC,CAAA;IAC7C,MAAM,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC7D,+EAA+E;IAC/E,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC,CAAA;IAChE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;QAAE,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAA;IACzF,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,GAAG,IAAI;QAAE,MAAM,IAAI,kBAAkB,CAAC,aAAa,CAAC,CAAA;AACxG,CAAC;AAED,SAAS,SAAS,CAAI,SAAqB,EAAE,MAAmB;IAC9D,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACzC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACvD,SAAS;aACN,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC;aACrB,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;aACzD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACpB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAAyB;IACnE,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAA;IAC7B,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACzC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;IAClC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACrB,SAAS,CAAC,KAAK,CAAC,CAAA;IAChB,IAAI,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;IACzB,IAAI,MAAM,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QACtF,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CAAA;IAC3B,IAAI,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,SAAS,CACb,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,EAChC,KAAK,CAAC,MAAM,CACb,CAAA;QACD,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAA;IACrC,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;QACzF,KAAK,CAAC,MAAM,GAAG,MAAM,CAAA;QACrB,MAAM,OAAO,GAAG,MAAM,CAAA;QACtB,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE;aAClC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;aACjD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,KAAK,YAAY,8BAA8B;gBAAE,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAA;YAC1E,IAAI,KAAK,YAAY,eAAe,IAAI,KAAK,YAAY,8BAA8B;gBAAE,MAAM,KAAK,CAAA;YACpG,UAAU,CAAC,MAAM,CAAC,cAAc,EAAE,CAAA;YAClC,MAAM,IAAI,kBAAkB,CAAC,aAAa,CAAC,CAAA;QAC7C,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,OAAO,CAAC,OAAO,GAAG,IAAI,CAAA;YACtB,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO;gBAAE,KAAK,CAAC,MAAM,GAAG,SAAS,CAAA;YACtD,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACpB,CAAC,CAAC,CAAA;QACJ,KAAK,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACxC,CAAC;IACD,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAA;IACvC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAC1B,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;QAC/C,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAA;QAC7B,SAAS,CAAC,KAAK,CAAC,CAAA;IAClB,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC7B,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC5C,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CAAA;YACzB,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACrC,IAAI,KAAK,YAAY,8BAA8B;oBAAE,MAAM,KAAK,CAAA;YAClE,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAY,EAAE,MAAmB;IAC1E,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;IAClC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACrB,SAAS,CAAC,KAAK,CAAC,CAAA;IAChB,MAAM,KAAK,GAAG,MAAM,EAAE,CAAA;IACtB,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAA;IACtB,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK;YAAE,KAAK,CAAC,QAAQ,GAAG,SAAS,CAAA;QACxD,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACpB,CAAC,CAAA;IACD,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CAAA;YAC/B,MAAM,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC3C,IAAI,KAAK,YAAY,8BAA8B;oBAAE,MAAM,KAAK,CAAA;YAClE,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,CAAC,cAAc,EAAE,CAAA;QACvB,IAAI,KAAK,CAAC,QAAQ;YAAE,MAAM,IAAI,8BAA8B,EAAE,CAAA;QAC9D,OAAO,OAAO,CAAA;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,CAAA;QACT,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC"}

package/lib/types/host/hermes-windows-installation.d.ts

@@ -0,0 +1,5 @@
+/** Read only the single stored __main__.py member emitted by distlib. No ZIP
+ * extraction, Python evaluation, installer invocation, or account lookup. */
+export declare function hermesDistlibSource(bytes: Buffer): string | undefined;
+export declare function hermesLauncherCheckout(source: string): string | undefined;
+export declare function windowsHermesCheckout(executable: string, command: string[], signal?: AbortSignal): Promise<string | undefined>;

package/lib/types/host/hermes-windows-installation.js

@@ -0,0 +1,91 @@
+import { constants } from 'node:fs';
+import { open, realpath } from 'node:fs/promises';
+import { basename, isAbsolute } from 'node:path';
+/** Read only the single stored __main__.py member emitted by distlib. No ZIP
+ * extraction, Python evaluation, installer invocation, or account lookup. */
+export function hermesDistlibSource(bytes) {
+    if (bytes.length < 128 || bytes.toString('ascii', 0, 2) !== 'MZ')
+        return;
+    const end = bytes.length - 22;
+    if (bytes.readUInt32LE(end) !== 0x06054b50)
+        return;
+    if (bytes.readUInt16LE(end + 4) !== 0 ||
+        bytes.readUInt16LE(end + 6) !== 0 ||
+        bytes.readUInt16LE(end + 8) !== 1 ||
+        bytes.readUInt16LE(end + 10) !== 1 ||
+        bytes.readUInt16LE(end + 20) !== 0)
+        throw new Error('Unsupported Hermes launcher archive');
+    const centralSize = bytes.readUInt32LE(end + 12);
+    const central = end - centralSize;
+    if (central < 64 || centralSize < 46 || bytes.readUInt32LE(central) !== 0x02014b50)
+        throw new Error('Invalid Hermes launcher directory');
+    const nameSize = bytes.readUInt16LE(central + 28);
+    const size = bytes.readUInt32LE(central + 24);
+    const local = central - bytes.readUInt32LE(end + 16) + bytes.readUInt32LE(central + 42);
+    if (centralSize !== 46 + nameSize ||
+        bytes.subarray(central + 46, end).toString('utf8') !== '__main__.py' ||
+        bytes.readUInt16LE(central + 8) !== 0 ||
+        bytes.readUInt16LE(central + 10) !== 0 ||
+        bytes.readUInt32LE(central + 20) !== size ||
+        size > 128 * 1024 ||
+        local < 64 ||
+        local + 30 > central ||
+        bytes.readUInt32LE(local) !== 0x04034b50 ||
+        bytes.readUInt16LE(local + 6) !== 0 ||
+        bytes.readUInt16LE(local + 8) !== 0 ||
+        bytes.readUInt32LE(local + 18) !== size ||
+        bytes.readUInt32LE(local + 22) !== size ||
+        bytes.readUInt16LE(local + 26) !== nameSize ||
+        bytes.readUInt16LE(local + 28) !== 0 ||
+        local + 30 + nameSize + size !== central ||
+        bytes.subarray(local + 30, local + 30 + nameSize).toString('utf8') !== '__main__.py')
+        throw new Error('Invalid Hermes launcher member');
+    return bytes.subarray(local + 30 + nameSize, central).toString('utf8');
+}
+export function hermesLauncherCheckout(source) {
+    if (!source.startsWith('import os, re, sys\n') ||
+        !source.includes('sys._hermes_pin_default_home = True\n') ||
+        !source.includes('import hermes_bootstrap') ||
+        !source.includes('from hermes_cli.main import main'))
+        return;
+    // Python's repr(path) uses only literal escaped backslashes/quotes here.
+    // Do not evaluate the launcher, interpolate its statements, or accept expressions.
+    const roots = [
+        ...source.matchAll(/^sys\.path\.insert\(0, ('(?:[^'\\\r\n]|\\[\\'])+'|"(?:[^"\\\r\n]|\\[\\"])+")\)\r?$/gm),
+    ];
+    if (roots.length !== 1)
+        throw new Error('Ambiguous Hermes checkout');
+    const path = roots[0][1].slice(1, -1).replace(/\\([\\'"])/g, '$1');
+    if (!isAbsolute(path) || path.includes('\0'))
+        throw new Error('Invalid Hermes checkout');
+    return path;
+}
+export async function windowsHermesCheckout(executable, command, signal) {
+    let source;
+    if (basename(executable).toLowerCase() === 'hermes.exe') {
+        const file = await open(executable, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        try {
+            const info = await file.stat();
+            if (!info.isFile() || info.nlink !== 1 || info.size > 1024 * 1024)
+                throw new Error('Unsafe Hermes launcher');
+            source = hermesDistlibSource(await file.readFile());
+        }
+        finally {
+            await file.close();
+        }
+    }
+    else if (command[1] === '-I' && command[2] === '-c') {
+        const encoded = /^import base64; exec\(base64\.b64decode\('([A-Za-z0-9+/]+={0,2})'\)\)$/.exec(command[3] ?? '');
+        if (encoded)
+            source = Buffer.from(encoded[1], 'base64').toString('utf8');
+    }
+    signal?.throwIfAborted();
+    if (source === undefined)
+        return;
+    const checkout = hermesLauncherCheckout(source);
+    if (!checkout)
+        return;
+    // Canonical spelling is part of the native install_key hash.
+    return realpath(checkout);
+}
+//# sourceMappingURL=hermes-windows-installation.js.map

package/lib/types/host/hermes-windows-installation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hermes-windows-installation.js","sourceRoot":"","sources":["../../../src/host/hermes-windows-installation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAEhD;6EAC6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI;QAAE,OAAM;IACxE,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,GAAG,EAAE,CAAA;IAC7B,IAAI,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,UAAU;QAAE,OAAM;IAClD,IACE,KAAK,CAAC,YAAY,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC;QACjC,KAAK,CAAC,YAAY,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC;QACjC,KAAK,CAAC,YAAY,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC;QACjC,KAAK,CAAC,YAAY,CAAC,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC;QAClC,KAAK,CAAC,YAAY,CAAC,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC;QAElC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACxD,MAAM,WAAW,GAAG,KAAK,CAAC,YAAY,CAAC,GAAG,GAAG,EAAE,CAAC,CAAA;IAChD,MAAM,OAAO,GAAG,GAAG,GAAG,WAAW,CAAA;IACjC,IAAI,OAAO,GAAG,EAAE,IAAI,WAAW,GAAG,EAAE,IAAI,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,UAAU;QAChF,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;IACtD,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,CAAC,OAAO,GAAG,EAAE,CAAC,CAAA;IACjD,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,CAAC,OAAO,GAAG,EAAE,CAAC,CAAA;IAC7C,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC,OAAO,GAAG,EAAE,CAAC,CAAA;IACvF,IACE,WAAW,KAAK,EAAE,GAAG,QAAQ;QAC7B,KAAK,CAAC,QAAQ,CAAC,OAAO,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,aAAa;QACpE,KAAK,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC;QACrC,KAAK,CAAC,YAAY,CAAC,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC;QACtC,KAAK,CAAC,YAAY,CAAC,OAAO,GAAG,EAAE,CAAC,KAAK,IAAI;QACzC,IAAI,GAAG,GAAG,GAAG,IAAI;QACjB,KAAK,GAAG,EAAE;QACV,KAAK,GAAG,EAAE,GAAG,OAAO;QACpB,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,UAAU;QACxC,KAAK,CAAC,YAAY,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;QACnC,KAAK,CAAC,YAAY,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;QACnC,KAAK,CAAC,YAAY,CAAC,KAAK,GAAG,EAAE,CAAC,KAAK,IAAI;QACvC,KAAK,CAAC,YAAY,CAAC,KAAK,GAAG,EAAE,CAAC,KAAK,IAAI;QACvC,KAAK,CAAC,YAAY,CAAC,KAAK,GAAG,EAAE,CAAC,KAAK,QAAQ;QAC3C,KAAK,CAAC,YAAY,CAAC,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC;QACpC,KAAK,GAAG,EAAE,GAAG,QAAQ,GAAG,IAAI,KAAK,OAAO;QACxC,KAAK,CAAC,QAAQ,CAAC,KAAK,GAAG,EAAE,EAAE,KAAK,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,aAAa;QAEpF,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;IACnD,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,GAAG,EAAE,GAAG,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AACxE,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,IACE,CAAC,MAAM,CAAC,UAAU,CAAC,sBAAsB,CAAC;QAC1C,CAAC,MAAM,CAAC,QAAQ,CAAC,uCAAuC,CAAC;QACzD,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QAC3C,CAAC,MAAM,CAAC,QAAQ,CAAC,kCAAkC,CAAC;QAEpD,OAAM;IACR,yEAAyE;IACzE,mFAAmF;IACnF,MAAM,KAAK,GAAG;QACZ,GAAG,MAAM,CAAC,QAAQ,CAChB,sFAAsF,CACvF;KACF,CAAA;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;IACpE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;IACpE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;IACxF,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,UAAkB,EAClB,OAAiB,EACjB,MAAoB;IAEpB,IAAI,MAA0B,CAAA;IAC9B,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,KAAK,YAAY,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;QACrG,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;YAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI;gBAC/D,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;YAC3C,MAAM,GAAG,mBAAmB,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;QACrD,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;QACpB,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtD,MAAM,OAAO,GAAG,wEAAwE,CAAC,IAAI,CAC3F,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CACjB,CAAA;QACD,IAAI,OAAO;YAAE,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC3E,CAAC;IACD,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,IAAI,MAAM,KAAK,SAAS;QAAE,OAAM;IAChC,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAA;IAC/C,IAAI,CAAC,QAAQ;QAAE,OAAM;IACrB,6DAA6D;IAC7D,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAA;AAC3B,CAAC"}

package/lib/types/host/index.d.ts

@@ -71,6 +71,7 @@ export declare class CliWorkerService extends TypertRemoteService {
     private selectionBindings;
     private selectionProjects;
     private displayedBindings;
+    private settingsCatalogs?;
     private disposed;
     /** @param ctx - Harness services. @param config - Validated deployment options. */
     constructor(ctx: Context, config: Config);
@@ -107,10 +108,18 @@ export declare class CliWorkerService extends TypertRemoteService {
     setCliEnabled(parentSessionId: string, cli: string, enabled: boolean, signal: AbortSignal): Promise<string>;
     /** @param parentSessionId - Owning session. @param cli - Selected CLI. @param signal - Query lifetime. @returns Safe account status JSON. */
     accountStatus(parentSessionId: string, cli: string, signal: AbortSignal): Promise<string>;
+    private executablePathSnapshot;
+    private probeExecutablePath;
+    /** @param parentSessionId - Owning session. @param cli - Selected CLI. @param signal - Query lifetime. @returns Machine-local executable path and availability JSON. */
+    cliExecutablePath(parentSessionId: string, cli: string, signal: AbortSignal): Promise<string>;
+    /** @param parentSessionId - Owning session. @param cli - Selected CLI. @param path - Full file path for manual selection. @param action - manual, refresh or auto. @param signal - Mutation/query lifetime. @returns Saved machine-local path and fresh availability JSON. */
+    refreshCliExecutablePath(parentSessionId: string, cli: string, path: string, action: string, signal: AbortSignal): Promise<string>;
     /** @param parentSessionId - Owning session. @param cli - Selected CLI. @param action - Explicit human action. @param signal - Startup lifetime. @returns Managed account terminal identity and instruction JSON. */
     accountStart(parentSessionId: string, cli: string, action: string, signal: AbortSignal): Promise<string>;
     /** @param source - One current CLI-native source, never a filesystem path. */
     accountStartForSource(parentSessionId: string, cli: string, action: string, source: string, signal: AbortSignal): Promise<string>;
+    /** @param provider - Explicit ZCode native login provider, never a URL or logout source. */
+    accountStartForProvider(parentSessionId: string, cli: string, action: string, provider: string, signal: AbortSignal): Promise<string>;
     private startAccount;
     /** @param parentSessionId - Owning session. @param accountId - Account terminal identity. @param signal - Stream lifetime. @returns Ephemeral terminal frame JSON. */
     accountWatch(parentSessionId: string, accountId: string, signal: AbortSignal): AsyncIterable<string>;
@@ -124,6 +133,9 @@ export declare class CliWorkerService extends TypertRemoteService {
     catalog(parentSessionId: string, signal: AbortSignal): Promise<string>;
     /** @param parentSessionId - Parent session identity. @param cli - Selected CLI. @param signal - Caller lifetime. @returns CLI catalog and saved project preference. */
     catalogForCli(parentSessionId: string, cli: string, signal: AbortSignal): Promise<string>;
+    /** @param parentSessionId - Parent session identity. @param cli - Selected CLI. @param signal - Caller lifetime. @returns Fresh model catalog and saved project preference. */
+    refreshCatalogForCli(parentSessionId: string, cli: string, signal: AbortSignal): Promise<string>;
+    private settingsCatalog;
     /** @param parentSessionId - Parent session identity. @param selection - JSON model and effort. @param signal - Caller lifetime. @returns Saved JSON preference. */
     configure(parentSessionId: string, selection: string, signal: AbortSignal): Promise<string>;
     /** @param parentSessionId - Owning session. @param workerId - Idle worker. @param selection - JSON preference. @param signal - Caller lifetime. @returns Saved worker configuration. */