git0 0.3.66 → 0.3.68

package/dist/cli.js

@@ -23602,7 +23602,7 @@ var chalkStderr = createChalk({ level: stderrColor ? stderrColor.level : 0 });
 var source_default = chalk;
 
 // src/cli.ts
-import path6 from "path";
+import path10 from "path";
 
 // node_modules/grab-api.js/dist/grab-api.es.js
 function log(message = "", options = {}) {
@@ -27915,12 +27915,1020 @@ function parseArgs(argv) {
       flags.historyOnly = true;
     else if (name === "mirror")
       flags.mirror = true;
+    else if (name === "service" && ["", "run", "install", "uninstall", "status"].includes(value)) {
+      flags.service = value || "run";
+    } else if (name === "port" && /^\d+$/.test(value))
+      flags.port = Number(value);
     else
       console.log(source_default.yellow(`Ignoring unknown flag: ${arg}`));
   }
   return { positional, flags };
 }
 
+// src/service/index.ts
+import fs10 from "fs";
+import path9 from "path";
+
+// src/service/assets.ts
+var NOT_INSTALLABLE = /(\.(sha\d*|sha256sum|md5|sig|asc|pem|crt|txt|json|ya?ml|blockmap|sbom|spdx|intoto\.jsonl|zsync|sym|pdb|dSYM\.zip)$)|checksum|sha256sums|(^|[-_.])src([-_.]|$)|source/i;
+function tokens(name) {
+  return new Set(name.toLowerCase().split(/[^a-z0-9]+/).filter(Boolean));
+}
+function assetOs(name) {
+  const lower = name.toLowerCase();
+  const t = tokens(name);
+  const has = (...words) => words.some((w2) => t.has(w2));
+  const hits = [];
+  if (has("win", "windows", "win32", "win64", "msvc", "mingw") || /\.(exe|msi|msix|appx)$/.test(lower)) {
+    hits.push("windows");
+  }
+  if (has("mac", "macos", "darwin", "osx", "apple", "macosx") || /\.(dmg|pkg)$/.test(lower)) {
+    hits.push("macos");
+  }
+  if (has("linux", "ubuntu", "debian", "fedora", "musl", "gnu") || /\.(deb|rpm|appimage|snap|flatpak)$/.test(lower)) {
+    hits.push("linux");
+  }
+  if (hits.length === 1)
+    return hits[0];
+  return hits.length === 0 ? "any" : "ambiguous";
+}
+function assetArch(name) {
+  const n = name.toLowerCase();
+  if (/universal/.test(n))
+    return "universal";
+  if (/aarch64|arm64/.test(n))
+    return "arm64";
+  if (/armv[67]|armhf|armel|(^|[^a-z])arm([^a-z0-9]|$)/.test(n))
+    return "arm";
+  if (/x86[_-]64|amd64|x64|win64/.test(n))
+    return "x86_64";
+  if (/i[36]86|x86[_-]32|ia32|win32|(^|[^a-z0-9])386([^0-9]|$)|(^|[^a-z0-9])x86([^_0-9-]|$)/.test(n))
+    return "i386";
+  return "unknown";
+}
+function installKind(name) {
+  const n = name.toLowerCase();
+  if (n.endsWith(".appimage"))
+    return "appimage";
+  if (n.endsWith(".deb"))
+    return "deb";
+  if (n.endsWith(".rpm"))
+    return "rpm";
+  if (n.endsWith(".dmg"))
+    return "dmg";
+  if (n.endsWith(".pkg"))
+    return "pkg";
+  if (n.endsWith(".exe"))
+    return "exe";
+  if (n.endsWith(".msi"))
+    return "msi";
+  if (/\.(zip|tar\.gz|tgz|tar\.xz|txz|tar\.bz2|tbz2?|tar\.zst|tar)$/.test(n))
+    return "archive";
+  if (!/\.[a-z][a-z0-9]{0,4}$/.test(n))
+    return "binary";
+  return null;
+}
+var KIND_SCORE = {
+  linux: { appimage: 40, deb: 30, rpm: 25, archive: 20, binary: 15 },
+  macos: { dmg: 40, pkg: 35, archive: 25, binary: 15 },
+  windows: { exe: 40, msi: 35, archive: 20 }
+};
+function scoreAsset(name, platform) {
+  if (NOT_INSTALLABLE.test(name))
+    return null;
+  const kind = installKind(name);
+  if (!kind)
+    return null;
+  const kindScore = KIND_SCORE[platform.os]?.[kind];
+  if (kindScore === undefined)
+    return null;
+  const os5 = assetOs(name);
+  if (os5 === "ambiguous")
+    return null;
+  if (os5 !== "any" && os5 !== platform.os)
+    return null;
+  const arch = assetArch(name);
+  let archScore;
+  if (arch === platform.arch)
+    archScore = 100;
+  else if (arch === "universal")
+    archScore = 90;
+  else if (arch === "unknown")
+    archScore = platform.arch === "x86_64" ? 95 : 50;
+  else if (platform.os === "macos" && platform.arch === "arm64" && arch === "x86_64")
+    archScore = 10;
+  else if (platform.os === "windows" && platform.arch === "x86_64" && arch === "i386")
+    archScore = 10;
+  else
+    return null;
+  const osScore = os5 === platform.os ? 5 : 0;
+  return archScore + kindScore + osScore;
+}
+function pickAsset(releases, platform) {
+  const published = releases.filter((r) => !r.draft);
+  const stable = published.filter((r) => !r.prerelease);
+  for (const pool of [stable, published]) {
+    for (const release of pool) {
+      let best = null;
+      let bestScore = -1;
+      for (const asset of release.assets ?? []) {
+        const score = scoreAsset(asset.name, platform);
+        if (score === null || score <= bestScore)
+          continue;
+        bestScore = score;
+        best = {
+          name: asset.name,
+          url: asset.browser_download_url,
+          size: asset.size,
+          tag: release.tag_name,
+          kind: installKind(asset.name)
+        };
+      }
+      if (best)
+        return best;
+    }
+  }
+  return null;
+}
+function normalizeRepoSlug(input) {
+  if (!input)
+    return null;
+  let s3 = input.trim();
+  s3 = s3.replace(/^(https?:\/\/)?(www\.)?github\.com\//i, "");
+  s3 = s3.replace(/^git@github\.com:/i, "");
+  const [owner, repo] = s3.split(/[/?#]/);
+  if (!owner || !repo)
+    return null;
+  const name = repo.replace(/\.git$/i, "");
+  if (!/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/.test(owner))
+    return null;
+  if (!/^[A-Za-z0-9._-]{1,100}$/.test(name) || name === "." || name === "..")
+    return null;
+  return `${owner}/${name}`;
+}
+function parseSchemeUrl(link) {
+  const m2 = link.match(/^git0:\/{0,2}(.*)$/i);
+  if (!m2)
+    return null;
+  let rest = m2[1];
+  const query = rest.match(/[?&]repo=([^&#]+)/);
+  if (query)
+    return normalizeRepoSlug(decodeURIComponent(query[1]));
+  rest = rest.replace(/^install\/?/i, "").replace(/[?#].*$/, "");
+  return normalizeRepoSlug(decodeURIComponent(rest));
+}
+
+// src/service/installer.ts
+import fs7 from "fs";
+import os5 from "os";
+import path6 from "path";
+function git0Home() {
+  return process.env.GIT0_HOME || path6.join(os5.homedir(), ".git0");
+}
+async function downloadWithProgress(url, dest, onProgress, expectedSize = 0, fetchImpl = fetch) {
+  const res = await fetchImpl(url, { headers: { "User-Agent": "git0-service" }, redirect: "follow" });
+  if (!res.ok || !res.body)
+    throw new Error(`Download failed: HTTP ${res.status}`);
+  const total = Number(res.headers.get("content-length")) || expectedSize || 0;
+  fs7.mkdirSync(path6.dirname(dest), { recursive: true });
+  const partial = `${dest}.part`;
+  const out = fs7.createWriteStream(partial);
+  let received = 0;
+  onProgress(0, total);
+  try {
+    const reader = res.body.getReader();
+    for (;; ) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      received += value.byteLength;
+      if (!out.write(value))
+        await new Promise((r) => out.once("drain", r));
+      onProgress(received, total);
+    }
+    await new Promise((resolve, reject) => out.end((err) => err ? reject(err) : resolve()));
+    fs7.renameSync(partial, dest);
+  } catch (err) {
+    out.destroy();
+    fs7.rmSync(partial, { force: true });
+    throw err;
+  }
+}
+function hasCommand(cmd) {
+  try {
+    shell.execSync(process.platform === "win32" ? `where ${cmd}` : `command -v ${cmd}`, { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+var q2 = (s3) => JSON.stringify(s3);
+function openCommand(target, platform = process.platform) {
+  if (platform === "darwin")
+    return { cmd: "open", args: [target] };
+  if (platform === "win32")
+    return { cmd: "explorer.exe", args: [target] };
+  return { cmd: target, args: [] };
+}
+function findLaunchable(dir, repoName, platform = process.platform) {
+  const hits = [];
+  const want = repoName.toLowerCase().replace(/[^a-z0-9]/g, "");
+  const walk = (d, depth) => {
+    if (depth > 4)
+      return;
+    let entries;
+    try {
+      entries = fs7.readdirSync(d, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of entries) {
+      const p2 = path6.join(d, e.name);
+      const named = e.name.toLowerCase().replace(/[^a-z0-9]/g, "").includes(want);
+      if (platform === "darwin" && e.isDirectory() && e.name.endsWith(".app")) {
+        hits.push({ p: p2, depth, named });
+        continue;
+      }
+      if (e.isDirectory()) {
+        walk(p2, depth + 1);
+        continue;
+      }
+      if (!e.isFile())
+        continue;
+      if (platform === "win32") {
+        if (/\.exe$/i.test(e.name) && !/unins|uninstall|setup-helper/i.test(e.name))
+          hits.push({ p: p2, depth, named });
+      } else if (platform !== "darwin" || !e.name.includes(".")) {
+        try {
+          if (fs7.statSync(p2).mode & 73 && !/\.(so|dylib|sh)(\.|$)/.test(e.name))
+            hits.push({ p: p2, depth, named });
+        } catch {}
+      }
+    }
+  };
+  walk(dir, 0);
+  hits.sort((a, b2) => Number(b2.named) - Number(a.named) || a.depth - b2.depth);
+  return hits[0]?.p ?? null;
+}
+function extract(file, dest) {
+  fs7.mkdirSync(dest, { recursive: true });
+  const isZip = /\.zip$/i.test(file);
+  if (isZip && process.platform === "linux") {
+    shell.execSync(`unzip -q -o ${q2(file)} -d ${q2(dest)}`, { stdio: "ignore" });
+  } else {
+    shell.execSync(`tar -xf ${q2(file)} -C ${q2(dest)}`, { stdio: "ignore" });
+  }
+}
+function installAsset(file, asset, repo) {
+  const repoName = repo.split("/")[1];
+  const appsDir = path6.join(git0Home(), "apps", repo.replace("/", "__"));
+  fs7.mkdirSync(appsDir, { recursive: true });
+  switch (asset.kind) {
+    case "appimage":
+    case "binary": {
+      const target = path6.join(appsDir, asset.name);
+      fs7.copyFileSync(file, target);
+      fs7.chmodSync(target, 493);
+      return asset.kind === "appimage" ? { installedPath: target, launch: { cmd: target, args: [] }, message: `Installed ${asset.name}` } : { installedPath: target, launch: null, message: `Installed command-line tool at ${target}` };
+    }
+    case "deb":
+    case "rpm": {
+      const tool = asset.kind === "deb" ? `dpkg -i ${q2(file)}` : `rpm -U --replacepkgs ${q2(file)}`;
+      if (!hasCommand("pkexec")) {
+        return { installedPath: file, launch: null, message: `Downloaded. Install with: sudo ${tool}` };
+      }
+      shell.execSync(`pkexec ${tool}`, { stdio: "ignore" });
+      const launch = hasCommand(repoName) ? { cmd: repoName, args: [] } : null;
+      return { installedPath: file, launch, message: `Installed ${asset.name} system-wide` };
+    }
+    case "dmg": {
+      const mount = fs7.mkdtempSync(path6.join(os5.tmpdir(), "git0-dmg-"));
+      shell.execSync(`hdiutil attach -nobrowse -readonly -mountpoint ${q2(mount)} ${q2(file)}`, { stdio: "ignore" });
+      try {
+        const app = fs7.readdirSync(mount).find((n) => n.endsWith(".app"));
+        if (!app) {
+          const pkg = fs7.readdirSync(mount).find((n) => n.endsWith(".pkg"));
+          if (pkg) {
+            const copy = path6.join(appsDir, pkg);
+            fs7.copyFileSync(path6.join(mount, pkg), copy);
+            return { installedPath: copy, launch: openCommand(copy), message: `Opening installer ${pkg}` };
+          }
+          throw new Error("No .app or .pkg found in the disk image");
+        }
+        const userApps = path6.join(os5.homedir(), "Applications");
+        fs7.mkdirSync(userApps, { recursive: true });
+        const target = path6.join(userApps, app);
+        fs7.rmSync(target, { recursive: true, force: true });
+        shell.execSync(`cp -R ${q2(path6.join(mount, app))} ${q2(target)}`, { stdio: "ignore" });
+        return { installedPath: target, launch: openCommand(target), message: `Installed ${app} to ~/Applications` };
+      } finally {
+        try {
+          shell.execSync(`hdiutil detach ${q2(mount)} -quiet`, { stdio: "ignore" });
+        } catch {}
+        fs7.rmSync(mount, { recursive: true, force: true });
+      }
+    }
+    case "pkg":
+    case "msi":
+    case "exe": {
+      const launch = asset.kind === "msi" ? { cmd: "msiexec", args: ["/i", file] } : asset.kind === "pkg" ? openCommand(file) : { cmd: file, args: [] };
+      return { installedPath: file, launch, message: `Opening ${asset.name}` };
+    }
+    case "archive": {
+      const dest = path6.join(appsDir, asset.tag || "latest");
+      fs7.rmSync(dest, { recursive: true, force: true });
+      extract(file, dest);
+      const found = findLaunchable(dest, repoName);
+      if (!found)
+        return { installedPath: dest, launch: null, message: `Extracted to ${dest}` };
+      if (found.endsWith(".app") || /\.exe$/i.test(found)) {
+        return { installedPath: found, launch: openCommand(found), message: `Installed ${path6.basename(found)}` };
+      }
+      return { installedPath: found, launch: null, message: `Installed command-line tool at ${found}` };
+    }
+  }
+}
+function launchApp(launch) {
+  const child = shell.spawn(launch.cmd, launch.args, { detached: true, stdio: "ignore" });
+  child?.on?.("error", () => {});
+  child?.unref?.();
+}
+
+// src/service/server.ts
+import http from "http";
+import crypto from "crypto";
+import fs8 from "fs";
+import path7 from "path";
+var DEFAULT_PORT = 47100;
+var TERMINAL = ["done", "error", "denied"];
+async function fetchReleasesFromGithub(repo) {
+  const headers = {
+    "User-Agent": "git0-service",
+    Accept: "application/vnd.github+json"
+  };
+  if (process.env.GITHUB_TOKEN)
+    headers.Authorization = `token ${process.env.GITHUB_TOKEN}`;
+  const url = `https://api.github.com/repos/${repo}/releases?per_page=15`;
+  let res = await fetch(url, { headers });
+  if (res.status === 401 && headers.Authorization) {
+    delete headers.Authorization;
+    res = await fetch(url, { headers });
+  }
+  if (res.status === 403 || res.status === 429) {
+    throw new Error("GitHub rate limit reached — set GITHUB_TOKEN for the service");
+  }
+  if (res.status === 404)
+    throw new Error(`Repository ${repo} not found`);
+  if (!res.ok)
+    throw new Error(`GitHub returned HTTP ${res.status}`);
+  return await res.json();
+}
+function defaultDeps() {
+  return {
+    platform: getCurrentPlatform(),
+    fetchReleases: fetchReleasesFromGithub,
+    download: (url, dest, onProgress, size) => downloadWithProgress(url, dest, onProgress, size),
+    install: installAsset,
+    launch: launchApp
+  };
+}
+
+class TrustStore {
+  file;
+  constructor(file = path7.join(git0Home(), "service.json")) {
+    this.file = file;
+  }
+  read() {
+    try {
+      const data = JSON.parse(fs8.readFileSync(this.file, "utf8"));
+      return { trustedRepos: Array.isArray(data.trustedRepos) ? data.trustedRepos : [] };
+    } catch {
+      return { trustedRepos: [] };
+    }
+  }
+  has(repo) {
+    return this.read().trustedRepos.includes(repo.toLowerCase());
+  }
+  add(repo) {
+    const data = this.read();
+    if (!data.trustedRepos.includes(repo.toLowerCase()))
+      data.trustedRepos.push(repo.toLowerCase());
+    fs8.mkdirSync(path7.dirname(this.file), { recursive: true });
+    fs8.writeFileSync(this.file, JSON.stringify(data, null, 2));
+  }
+}
+var APPROVAL_TTL_MS = 10 * 60 * 1000;
+var MAX_PENDING = 5;
+var MAX_JOBS = 50;
+
+class JobManager {
+  deps;
+  trust;
+  jobs = new Map;
+  constructor(deps, trust = new TrustStore) {
+    this.deps = deps;
+    this.trust = trust;
+  }
+  view(job) {
+    const { approvalToken: _secret, ...rest } = job;
+    return rest;
+  }
+  get(id) {
+    this.expire();
+    return this.jobs.get(id);
+  }
+  list() {
+    this.expire();
+    return [...this.jobs.values()].map((j2) => this.view(j2));
+  }
+  request(repoInput) {
+    const repo = normalizeRepoSlug(repoInput);
+    if (!repo)
+      throw new Error("Expected a GitHub repository as owner/repo or a github.com URL");
+    this.expire();
+    const active = [...this.jobs.values()].find((j2) => j2.repo.toLowerCase() === repo.toLowerCase() && !TERMINAL.includes(j2.status));
+    if (active)
+      return active;
+    const trusted = this.trust.has(repo);
+    const pending = [...this.jobs.values()].filter((j2) => j2.status === "awaiting-approval").length;
+    if (!trusted && pending >= MAX_PENDING)
+      throw new Error("Too many install requests are waiting for approval");
+    const now = Date.now();
+    const job = {
+      id: crypto.randomUUID(),
+      repo,
+      status: trusted ? "resolving" : "awaiting-approval",
+      progress: 0,
+      receivedBytes: 0,
+      totalBytes: 0,
+      asset: null,
+      tag: null,
+      installedPath: null,
+      launched: false,
+      message: trusted ? "Finding the right release" : "Waiting for you to allow this install",
+      error: null,
+      createdAt: now,
+      updatedAt: now,
+      approvalToken: crypto.randomBytes(24).toString("hex")
+    };
+    this.jobs.set(job.id, job);
+    this.prune();
+    if (trusted)
+      this.run(job);
+    return job;
+  }
+  decide(id, token, allow, alwaysTrust = false) {
+    const job = this.get(id);
+    if (!job || job.status !== "awaiting-approval")
+      return false;
+    const a = Buffer.from(token);
+    const b2 = Buffer.from(job.approvalToken);
+    if (a.length !== b2.length || !crypto.timingSafeEqual(a, b2))
+      return false;
+    if (!allow) {
+      this.update(job, { status: "denied", message: "Install was declined" });
+      return true;
+    }
+    if (alwaysTrust)
+      this.trust.add(job.repo);
+    this.update(job, { status: "resolving", message: "Finding the right release" });
+    this.run(job);
+    return true;
+  }
+  update(job, patch) {
+    Object.assign(job, patch, { updatedAt: Date.now() });
+  }
+  expire() {
+    const now = Date.now();
+    for (const job of this.jobs.values()) {
+      if (job.status === "awaiting-approval" && now - job.createdAt > APPROVAL_TTL_MS) {
+        this.update(job, { status: "denied", message: "Approval request expired" });
+      }
+    }
+  }
+  prune() {
+    const done = [...this.jobs.values()].filter((j2) => TERMINAL.includes(j2.status));
+    while (this.jobs.size > MAX_JOBS && done.length)
+      this.jobs.delete(done.shift().id);
+  }
+  async run(job) {
+    const { platform } = this.deps;
+    try {
+      const releases = await this.deps.fetchReleases(job.repo);
+      const asset = pickAsset(releases, platform);
+      if (!asset) {
+        throw new Error(`No release of ${job.repo} ships a build for ${platform.os} ${platform.arch}`);
+      }
+      this.update(job, {
+        status: "downloading",
+        asset: asset.name,
+        tag: asset.tag,
+        totalBytes: asset.size,
+        message: `Downloading ${asset.name}`
+      });
+      const dest = path7.join(git0Home(), "downloads", job.repo.replace("/", "__"), asset.name);
+      await this.deps.download(asset.url, dest, (received, total) => {
+        const t = total || asset.size;
+        this.update(job, {
+          receivedBytes: received,
+          totalBytes: t,
+          progress: t ? Math.min(0.9, received / t * 0.9) : job.progress
+        });
+      }, asset.size);
+      this.update(job, { status: "installing", progress: 0.92, message: `Installing ${asset.name}` });
+      const result = this.deps.install(dest, asset, job.repo);
+      this.update(job, { installedPath: result.installedPath, message: result.message });
+      if (result.launch) {
+        this.update(job, { status: "launching", progress: 0.97 });
+        this.deps.launch(result.launch);
+        this.update(job, { launched: true });
+      }
+      this.update(job, { status: "done", progress: 1 });
+    } catch (err) {
+      this.update(job, { status: "error", error: err?.message ?? String(err), message: "Install failed" });
+    }
+  }
+}
+var CORS = {
+  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+  "Access-Control-Allow-Headers": "Content-Type",
+  "Access-Control-Allow-Private-Network": "true",
+  "Access-Control-Max-Age": "600"
+};
+var NO_FRAME = {
+  "X-Frame-Options": "DENY",
+  "Content-Security-Policy": "frame-ancestors 'none'",
+  "Cache-Control": "no-store"
+};
+function sendJson(res, status, body) {
+  res.writeHead(status, { "Content-Type": "application/json", "Cache-Control": "no-store", ...CORS });
+  res.end(JSON.stringify(body));
+}
+function sendHtml(res, status, html) {
+  res.writeHead(status, { "Content-Type": "text/html; charset=utf-8", ...NO_FRAME });
+  res.end(html);
+}
+function readBody(req, limit = 4096) {
+  return new Promise((resolve, reject) => {
+    let data = "";
+    req.on("data", (chunk) => {
+      data += chunk;
+      if (data.length > limit) {
+        reject(new Error("Body too large"));
+        req.destroy();
+      }
+    });
+    req.on("end", () => resolve(data));
+    req.on("error", reject);
+  });
+}
+var esc = (s3) => s3.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+function jobPage(job, token) {
+  const repo = esc(job.repo);
+  const prompt2 = job.status === "awaiting-approval" && token ? `<p>A web page asked git0 to download and install the latest release of
+         <a href="https://github.com/${repo}" target="_blank" rel="noopener"><b>${repo}</b></a>
+         on this computer and open it.</p>
+       <form method="post" action="/approve/${esc(job.id)}">
+         <input type="hidden" name="token" value="${esc(token)}">
+         <label><input type="checkbox" name="trust"> Always allow ${repo}</label>
+         <div class="row">
+           <button name="decision" value="allow" class="primary">Allow install</button>
+           <button name="decision" value="deny">Deny</button>
+         </div>
+       </form>` : "";
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>git0 · ${repo}</title>
+<style>
+  :root{color-scheme:light dark;--bg:#fafafa;--fg:#111;--muted:#666;--accent:#6d28d9;--track:#e5e5e5}
+  @media (prefers-color-scheme:dark){:root{--bg:#111;--fg:#eee;--muted:#999;--accent:#a78bfa;--track:#333}}
+  body{margin:0;font:15px/1.5 system-ui,sans-serif;background:var(--bg);color:var(--fg);display:grid;place-items:center;min-height:100vh}
+  main{max-width:440px;padding:24px}
+  h1{font-size:18px;margin:0 0 12px}
+  a{color:var(--accent)}
+  .row{display:flex;gap:8px;margin-top:16px}
+  button{font:inherit;padding:8px 16px;border-radius:8px;border:1px solid var(--track);background:transparent;color:var(--fg);cursor:pointer}
+  button.primary{background:var(--accent);border-color:var(--accent);color:#fff}
+  .bar{height:10px;border-radius:5px;background:var(--track);overflow:hidden;margin:16px 0 8px}
+  .bar>i{display:block;height:100%;width:0;background:var(--accent);transition:width .3s}
+  #msg{color:var(--muted);font-size:13px}
+</style></head><body><main>
+<h1>git0 · ${repo}</h1>
+${prompt2}
+<div id="progress" ${prompt2 ? "hidden" : ""}>
+  <div class="bar"><i id="fill"></i></div>
+  <div id="msg">${esc(job.message)}</div>
+</div>
+<script>
+  const id = ${JSON.stringify(job.id)};
+  async function poll(){
+    try{
+      const j = await (await fetch('/status/' + id)).json();
+      if (j.status === 'awaiting-approval') return setTimeout(poll, 1000);
+      document.getElementById('progress').hidden = false;
+      document.getElementById('fill').style.width = Math.round(j.progress * 100) + '%';
+      const mb = n => (n / 1048576).toFixed(1);
+      document.getElementById('msg').textContent =
+        j.status === 'downloading' && j.totalBytes ? j.message + ' — ' + mb(j.receivedBytes) + ' / ' + mb(j.totalBytes) + ' MB'
+        : j.status === 'error' ? 'Failed: ' + j.error : j.message;
+      if (!['done','error','denied'].includes(j.status)) setTimeout(poll, 500);
+    }catch{ setTimeout(poll, 2000) }
+  }
+  ${prompt2 ? "" : "poll();"}
+</script>
+</main></body></html>`;
+}
+function createServiceServer(opts = {}) {
+  const deps = opts.deps ?? defaultDeps();
+  const jobs = new JobManager(deps, opts.trust ?? new TrustStore);
+  const server = http.createServer(async (req, res) => {
+    try {
+      const port = server.address()?.port;
+      const host = (req.headers.host ?? "").toLowerCase();
+      if (host !== `127.0.0.1:${port}` && host !== `localhost:${port}`) {
+        return sendJson(res, 403, { error: "Forbidden host" });
+      }
+      const url = new URL(req.url ?? "/", `http://127.0.0.1:${port}`);
+      const method = req.method ?? "GET";
+      const parts = url.pathname.split("/").filter(Boolean);
+      if (method === "OPTIONS") {
+        res.writeHead(204, CORS);
+        return res.end();
+      }
+      if (parts[0] === "health" && method === "GET") {
+        return sendJson(res, 200, {
+          ok: true,
+          name: "git0",
+          version: opts.version ?? null,
+          os: deps.platform.os,
+          arch: deps.platform.arch
+        });
+      }
+      if (parts[0] === "install" && (method === "GET" || method === "POST")) {
+        let repo = url.searchParams.get("repo");
+        if (!repo && method === "POST") {
+          const raw = await readBody(req);
+          try {
+            repo = JSON.parse(raw).repo;
+          } catch {
+            repo = new URLSearchParams(raw).get("repo");
+          }
+        }
+        let job;
+        try {
+          job = jobs.request(repo ?? "");
+        } catch (err) {
+          return sendJson(res, 400, { error: err.message });
+        }
+        const jobUrl = `http://127.0.0.1:${port}/job/${job.id}`;
+        if (method === "GET" && (req.headers.accept ?? "").includes("text/html")) {
+          res.writeHead(303, { Location: `/job/${job.id}`, ...CORS });
+          return res.end();
+        }
+        return sendJson(res, 202, {
+          ...jobs.view(job),
+          statusUrl: `http://127.0.0.1:${port}/status/${job.id}`,
+          approveUrl: job.status === "awaiting-approval" ? jobUrl : null,
+          jobUrl
+        });
+      }
+      if (parts[0] === "status" && parts[1] && method === "GET") {
+        const job = jobs.get(parts[1]);
+        return job ? sendJson(res, 200, jobs.view(job)) : sendJson(res, 404, { error: "No such job" });
+      }
+      if (parts[0] === "jobs" && method === "GET") {
+        return sendJson(res, 200, jobs.list());
+      }
+      if (parts[0] === "job" && parts[1] && method === "GET") {
+        const job = jobs.get(parts[1]);
+        if (!job)
+          return sendHtml(res, 404, "<p>No such install request.</p>");
+        return sendHtml(res, 200, jobPage(jobs.view(job), job.approvalToken));
+      }
+      if (parts[0] === "approve" && parts[1] && method === "POST") {
+        const origin = req.headers.origin;
+        if (origin && origin !== `http://127.0.0.1:${port}` && origin !== `http://localhost:${port}`) {
+          return sendHtml(res, 403, "<p>Approval must come from the git0 page itself.</p>");
+        }
+        const form = new URLSearchParams(await readBody(req));
+        const ok = jobs.decide(parts[1], form.get("token") ?? "", form.get("decision") === "allow", form.get("trust") === "on");
+        if (!ok)
+          return sendHtml(res, 400, "<p>This request is no longer waiting for approval.</p>");
+        res.writeHead(303, { Location: `/job/${parts[1]}`, ...NO_FRAME });
+        return res.end();
+      }
+      sendJson(res, 404, { error: "Not found" });
+    } catch (err) {
+      if (!res.headersSent)
+        sendJson(res, 500, { error: err?.message ?? "Internal error" });
+    }
+  });
+  return { server, jobs };
+}
+function startService(opts = {}) {
+  const { server, jobs } = createServiceServer(opts);
+  return new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(opts.port ?? DEFAULT_PORT, "127.0.0.1", () => {
+      resolve({ server, jobs, port: server.address().port });
+    });
+  });
+}
+
+// src/service/client.ts
+var base = (port) => `http://127.0.0.1:${port}`;
+async function isServiceRunning(port = DEFAULT_PORT, fetchImpl = fetch) {
+  try {
+    const res = await fetchImpl(`${base(port)}/health`, { signal: AbortSignal.timeout(800) });
+    return res.ok && (await res.json())?.name === "git0";
+  } catch {
+    return false;
+  }
+}
+async function ensureService(runtime, script, port = DEFAULT_PORT) {
+  if (await isServiceRunning(port))
+    return true;
+  const child = shell.spawn(runtime, [script, "--service", `--port=${port}`], { detached: true, stdio: "ignore" });
+  child?.on?.("error", () => {});
+  child?.unref?.();
+  for (let i = 0;i < 20; i++) {
+    await new Promise((r) => setTimeout(r, 250));
+    if (await isServiceRunning(port))
+      return true;
+  }
+  return false;
+}
+async function requestInstall(repo, port = DEFAULT_PORT) {
+  const res = await fetch(`${base(port)}/install`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ repo })
+  });
+  const body = await res.json();
+  if (!res.ok)
+    throw new Error(body.error ?? `Service returned HTTP ${res.status}`);
+  const open = openCommand(body.jobUrl);
+  const { cmd, args } = process.platform === "linux" ? { cmd: "xdg-open", args: [body.jobUrl] } : open;
+  try {
+    const child = shell.spawn(cmd, args, { detached: true, stdio: "ignore" });
+    child?.on?.("error", () => {});
+    child?.unref?.();
+  } catch {}
+  return { id: body.id, jobUrl: body.jobUrl };
+}
+async function listJobs(port = DEFAULT_PORT) {
+  const res = await fetch(`${base(port)}/jobs`);
+  return res.json();
+}
+
+// src/service/system-service.ts
+import fs9 from "fs";
+import os6 from "os";
+import path8 from "path";
+var SERVICE_LABEL = "org.git0.service";
+var TASK_NAME = "git0-service";
+function systemdUnit(spec) {
+  return `[Unit]
+Description=git0 background install service
+After=network-online.target
+
+[Service]
+ExecStart="${spec.runtime}" "${spec.script}" --service --port=${spec.port}
+Restart=on-failure
+RestartSec=3
+
+[Install]
+WantedBy=default.target
+`;
+}
+function desktopEntry(spec) {
+  return `[Desktop Entry]
+Type=Application
+Name=git0
+Comment=Install GitHub releases from download links
+Exec="${spec.runtime}" "${spec.script}" %u
+NoDisplay=true
+Terminal=false
+MimeType=x-scheme-handler/git0;
+`;
+}
+var xml = (s3) => s3.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+function launchAgentPlist(spec) {
+  const logDir = path8.join(spec.home ?? os6.homedir(), "Library", "Logs");
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key><string>${SERVICE_LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${xml(spec.runtime)}</string>
+    <string>${xml(spec.script)}</string>
+    <string>--service</string>
+    <string>--port=${spec.port}</string>
+  </array>
+  <key>RunAtLoad</key><true/>
+  <key>KeepAlive</key><true/>
+  <key>StandardOutPath</key><string>${xml(path8.join(logDir, "git0-service.log"))}</string>
+  <key>StandardErrorPath</key><string>${xml(path8.join(logDir, "git0-service.log"))}</string>
+</dict>
+</plist>
+`;
+}
+function windowsCommands(spec) {
+  const run2 = `\\"${spec.runtime}\\" \\"${spec.script}\\" --service --port=${spec.port}`;
+  const open = `\\"${spec.runtime}\\" \\"${spec.script}\\" \\"%1\\"`;
+  return [
+    `schtasks /Create /F /SC ONLOGON /RL LIMITED /TN ${TASK_NAME} /TR "${run2}"`,
+    `reg add "HKCU\\Software\\Classes\\git0" /ve /d "URL:git0 Protocol" /f`,
+    `reg add "HKCU\\Software\\Classes\\git0" /v "URL Protocol" /d "" /f`,
+    `reg add "HKCU\\Software\\Classes\\git0\\shell\\open\\command" /ve /d "${open}" /f`
+  ];
+}
+function serviceFiles(home = os6.homedir()) {
+  return {
+    systemdUnit: path8.join(home, ".config", "systemd", "user", "git0.service"),
+    desktopEntry: path8.join(home, ".local", "share", "applications", "git0-handler.desktop"),
+    launchAgent: path8.join(home, "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`)
+  };
+}
+function run2(cmd, quiet = false) {
+  try {
+    shell.execSync(cmd, { stdio: quiet ? "ignore" : "inherit" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function write(file, content) {
+  fs9.mkdirSync(path8.dirname(file), { recursive: true });
+  fs9.writeFileSync(file, content);
+}
+function installSystemService(spec, platform = process.platform) {
+  const files = serviceFiles(spec.home);
+  const out = [];
+  if (platform === "linux") {
+    write(files.systemdUnit, systemdUnit(spec));
+    out.push(`Wrote ${files.systemdUnit}`);
+    const started = run2("systemctl --user daemon-reload", true) && run2("systemctl --user enable --now git0.service", true);
+    out.push(started ? "Started git0.service (systemctl --user status git0)" : "systemd --user is not available here — run `git0 --service` from your session startup instead");
+    write(files.desktopEntry, desktopEntry(spec));
+    run2(`xdg-mime default git0-handler.desktop x-scheme-handler/git0`, true);
+    run2(`update-desktop-database ${JSON.stringify(path8.dirname(files.desktopEntry))}`, true);
+    out.push("Registered git0:// links");
+    return out;
+  }
+  if (platform === "darwin") {
+    write(files.launchAgent, launchAgentPlist(spec));
+    run2(`launchctl unload ${JSON.stringify(files.launchAgent)}`, true);
+    out.push(run2(`launchctl load -w ${JSON.stringify(files.launchAgent)}`, true) ? `Loaded LaunchAgent ${SERVICE_LABEL}` : `Wrote ${files.launchAgent} — load it with launchctl load -w`);
+    out.push("git0:// links are not registered on macOS; buttons reach the service over HTTP");
+    return out;
+  }
+  if (platform === "win32") {
+    for (const cmd of windowsCommands(spec))
+      run2(cmd, true);
+    out.push(`Created logon task ${TASK_NAME} and registered git0:// links`);
+    out.push(run2(`schtasks /Run /TN ${TASK_NAME}`, true) ? "Started the service" : "Will start at next logon");
+    return out;
+  }
+  throw new Error(`Installing as a service is not supported on ${platform}`);
+}
+function uninstallSystemService(platform = process.platform, home = os6.homedir()) {
+  const files = serviceFiles(home);
+  if (platform === "linux") {
+    run2("systemctl --user disable --now git0.service", true);
+    fs9.rmSync(files.systemdUnit, { force: true });
+    fs9.rmSync(files.desktopEntry, { force: true });
+    run2("systemctl --user daemon-reload", true);
+    return ["Removed git0.service and the git0:// handler"];
+  }
+  if (platform === "darwin") {
+    run2(`launchctl unload -w ${JSON.stringify(files.launchAgent)}`, true);
+    fs9.rmSync(files.launchAgent, { force: true });
+    return [`Removed LaunchAgent ${SERVICE_LABEL}`];
+  }
+  if (platform === "win32") {
+    run2(`schtasks /End /TN ${TASK_NAME}`, true);
+    run2(`schtasks /Delete /F /TN ${TASK_NAME}`, true);
+    run2(`reg delete "HKCU\\Software\\Classes\\git0" /f`, true);
+    return [`Removed task ${TASK_NAME} and the git0:// handler`];
+  }
+  throw new Error(`Not supported on ${platform}`);
+}
+
+// src/service/index.ts
+function selfCommand() {
+  const script = process.argv[1] ? fs10.realpathSync(path9.resolve(process.argv[1])) : "";
+  return { runtime: process.execPath, script };
+}
+async function runServiceCommand(positional, flags, version) {
+  const port = flags.port ?? DEFAULT_PORT;
+  const link = positional.find((p2) => /^git0:/i.test(p2));
+  if (link) {
+    const repo = parseSchemeUrl(link);
+    if (!repo)
+      throw new Error(`Not a git0 install link: ${link}`);
+    const self = selfCommand();
+    if (!await ensureService(self.runtime, self.script, port)) {
+      throw new Error("Could not start the git0 service");
+    }
+    const { jobUrl } = await requestInstall(repo, port);
+    console.log(source_default.green(`Install of ${repo} requested — ${jobUrl}`));
+    return true;
+  }
+  if (!flags.service)
+    return false;
+  switch (flags.service) {
+    case "run": {
+      const { port: bound } = await startService({ port, version });
+      console.log(source_default.green(`git0 service listening on http://127.0.0.1:${bound}`));
+      return true;
+    }
+    case "install": {
+      for (const line of installSystemService({ ...selfCommand(), port }))
+        console.log(source_default.green(`✅ ${line}`));
+      return true;
+    }
+    case "uninstall": {
+      for (const line of uninstallSystemService())
+        console.log(source_default.green(`✅ ${line}`));
+      return true;
+    }
+    case "status": {
+      if (!await isServiceRunning(port)) {
+        console.log(source_default.yellow(`git0 service is not running on port ${port}`));
+        process.exitCode = 1;
+        return true;
+      }
+      console.log(source_default.green(`git0 service is running on http://127.0.0.1:${port}`));
+      for (const j2 of await listJobs(port)) {
+        const pct = `${Math.round(j2.progress * 100)}%`.padStart(4);
+        console.log(`  ${pct}  ${j2.status.padEnd(17)} ${j2.repo}${j2.error ? source_default.red(`  ${j2.error}`) : ""}`);
+      }
+      return true;
+    }
+  }
+  return false;
+}
+// package.json
+var package_default = {
+  name: "git0",
+  description: "CLI tool to search GitHub repositories, download source & releases for your system, and instantly set up, then install dependencies and open code editor.",
+  version: "0.3.68",
+  author: "vtempest",
+  scripts: {
+    build: "bun build src/cli.ts --outdir dist --target node --format esm --sourcemap",
+    test: "bun test",
+    "test:ci": "bun test --reporter=junit --reporter-outfile=./junit.xml --coverage --coverage-reporter=lcov --coverage-dir=./coverage",
+    docs: "cd docs && bun install && bun run dev",
+    "docs:build": "cd docs && bun install && bun run build",
+    demo: "bun src/cli.ts react template",
+    bench: "bun benchmark/tarball-vs-clone.bench.ts",
+    "publish:npm": "npm version patch && npm publish --access public",
+    "test:watch": "vitest",
+    coverage: "vitest run --coverage"
+  },
+  dependencies: {
+    chalk: "^5.4.1",
+    "git-url-parse": "^16.1.0",
+    "grab-api.js": "^0.9.127",
+    inquirer: "^12.6.3",
+    ora: "^8.2.0",
+    tar: "^7.4.3"
+  },
+  exports: {
+    ".": "./dist/cli.js"
+  },
+  bin: {
+    g: "dist/cli.js",
+    gg: "dist/cli.js",
+    fm: "src/fm.js",
+    git0: "dist/cli.js"
+  },
+  type: "module",
+  keywords: [
+    "github",
+    "git",
+    "package",
+    "manager",
+    "cli",
+    "download"
+  ],
+  license: "MIT",
+  repository: {
+    type: "git",
+    url: "git+https://github.com/OpenSourceAGI/dev-tools-starter-agent.git",
+    directory: "packages/git0-repo-downloader"
+  },
+  homepage: "https://git0.js.org",
+  devDependencies: {
+    "@vitest/coverage-v8": "^4.1.0",
+    vitest: "^4.1.0"
+  }
+};
+
 // src/cli.ts
 var Github = new github_api_default({ debug: false });
 async function downloadRepoAndSetup(target, folderPath = null, flags = { history: false, historyOnly: false, mirror: false }) {
@@ -27938,8 +28946,8 @@ async function downloadRepoAndSetup(target, folderPath = null, flags = { history
 }
 async function downloadHistoryOnly(target, flags) {
   printLogo();
-  const targetDir = getAvailableDirectoryName(path6.resolve(process.cwd(), `${target.name}.git`));
-  console.log(source_default.blue(`\uD83D\uDCE6 Cloning ${target.name} history into ${path6.basename(targetDir)}...`));
+  const targetDir = getAvailableDirectoryName(path10.resolve(process.cwd(), `${target.name}.git`));
+  console.log(source_default.blue(`\uD83D\uDCE6 Cloning ${target.name} history into ${path10.basename(targetDir)}...`));
   try {
     await cloneHistoryOnly(target.href, targetDir, { bare: !flags.mirror });
     console.log(source_default.green(`✅ History-only clone at ${targetDir}`));
@@ -27987,6 +28995,8 @@ async function handleRepoDownload(selectedRepo, flags) {
 async function main() {
   printLogo();
   const { positional, flags } = parseArgs(process.argv.slice(2));
+  if (await runServiceCommand(positional, flags, package_default.version))
+    return;
   if (!positional.length) {
     console.log(source_default.yellow("Usage: git0 <github-url | owner/repo[/path] | search-query>"));
     console.log(source_default.gray("  --path=<path>   download only that folder or file"));
@@ -27994,6 +29004,7 @@ async function main() {
     console.log(source_default.gray("  --history       also fetch .git history, in the background"));
     console.log(source_default.gray("  --history-only  clone only the history, no working files"));
     console.log(source_default.gray("  --mirror        keep every ref when cloning history"));
+    console.log(source_default.gray("  --service[=install|uninstall|status]  background install service for download buttons"));
     process.exit(1);
   }
   const query = positional.join(" ");
@@ -28024,5 +29035,5 @@ main().catch((error) => {
   process.exit(1);
 });
 
-//# debugId=8C91EA450462673964756E2164756E21
+//# debugId=4537FA246F91AB0B64756E2164756E21
 //# sourceMappingURL=cli.js.map