github-router 0.3.250 → 0.3.255

package/dist/provision-DSkPa5hY.js

@@ -0,0 +1,656 @@
+import { D as TOOLBELT_TOOLS, E as vscodeRipgrepPath, O as assetFor, Pt as withInstallLock, T as toolbeltSkipSet, vt as extractTarGzMember, w as toolbeltEnabled, wt as collapsePathKeys, yt as extractZipMember } from "./peer-mcp-personas-BDet588n.js";
+import { t as PATHS } from "./paths-C1cLZ7Ga.js";
+import { a as resolveExecutable, r as parseBoolEnv, t as killChildProcessTree } from "./exec-DTO2oin0.js";
+import { a as sweepRegistry } from "./lifecycle-DD88ka3f.js";
+import consola from "consola";
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { createHash, randomBytes } from "node:crypto";
+import { chmod, copyFile, link, mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
+import process from "node:process";
+import { execFileSync, spawn } from "node:child_process";
+//#region src/lib/process-guard/index.ts
+/**
+* Crash-safe process guard (POSIX only).
+*
+* If the proxy dies WITHOUT running its own shutdown handlers (hard crash,
+* SIGKILL, OOM), nothing in `cleanup()` runs to reap the launched CLI's
+* process tree. This guard is the last-resort net for that case.
+*
+* Platform split:
+*   - **Windows: no guard needed.** Node assigns each child to a Job
+*     Object with `JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE`, so when the proxy
+*     dies (any cause) the OS tears down the whole descendant tree —
+*     verified: force-killing a Node parent kills child AND grandchild.
+*     `startProcessGuard` is a no-op on win32.
+*   - **POSIX: a detached `node -e` reaper.** There is no job-object
+*     equivalent (a killed parent's children reparent to init), so we
+*     spawn a detached watchdog that learns of proxy death via an inherited
+*     stdin PIPE EOF (the proxy holds the write end; the OS closes it on
+*     proxy death) and reaps the CLI's process group.
+*
+* Never kill the WRONG process: if the child's PID/PGID was recycled after
+* the child exited, a blind `kill(-pid)` could hit an innocent group. The
+* reaper snapshots the child's process start-time at startup and, on proxy
+* death, kills ONLY if the live PID's start-time still matches. A mismatch
+* / unreadable probe → skip (fail-safe). We never trade an orphan-leak for
+* killing the user's work.
+*
+* The reaper is detached + unref'd so it survives the proxy's SIGKILL, and
+* self-exits once it has acted (or after a 24h cap) so it can never become
+* the orphan it exists to prevent. Opt out with
+* `GH_ROUTER_DISABLE_PROCESS_GUARD=1`.
+*/
+/**
+* Live reaper children, held so the GC can't collect the `ChildProcess`
+* (and with it the stdin write-end that is the proxy-death signal) while
+* the proxy runs. Entries self-remove on the reaper's exit. We do NOT
+* proactively kill these on graceful shutdown: when the proxy exits the OS
+* closes the stdin pipe, the reaper hits EOF, re-verifies the child's
+* identity, and reaps any survivor that ignored the graceful SIGTERM —
+* exactly the backstop we want.
+*/
+const _activeReapers = /* @__PURE__ */ new Set();
+/** Guard is on by default; `GH_ROUTER_DISABLE_PROCESS_GUARD=1` opts out. */
+function processGuardEnabled() {
+	return parseBoolEnv(process.env.GH_ROUTER_DISABLE_PROCESS_GUARD) !== true;
+}
+/**
+* Build the start-time-verified node reaper script (POSIX). PURE — `pid`
+* is our own integer. `detachedGroup` selects `kill(-pid)` (process group,
+* the detached CLI) vs `kill(pid)` on POSIX.
+*
+* Kept dependency-free (require'd builtins only) so it runs under `node -e`
+* with no module resolution against the dist bundle.
+*/
+function buildNodeReaperScript(pid, detachedGroup) {
+	const target = detachedGroup ? "-PID" : "PID";
+	return `
+const cp = require("node:child_process");
+const fs = require("node:fs");
+const PID = ${pid >>> 0};
+function startTime() {
+  try {
+    if (process.platform === "linux") {
+      const stat = fs.readFileSync("/proc/" + PID + "/stat", "utf8");
+      const post = stat.slice(stat.lastIndexOf(")") + 1).trim().split(/\\s+/);
+      return post[19] || null; // field 22 (starttime) = index 19 after comm
+    }
+    const out = cp.execFileSync("ps", ["-o","lstart=","-p",String(PID)],
+      { stdio: ["ignore","pipe","ignore"], timeout: 2000 }).toString().trim();
+    return out || null;
+  } catch { return null; }
+}
+function alive() { try { process.kill(PID, 0); return true; } catch { return false; } }
+function treeKill() {
+  try { process.kill(${target}, "SIGTERM"); } catch {}
+  // NOT unref'd: this must keep the loop alive to deliver the escalated
+  // SIGKILL (the onDeath exit timer below stays alive past 500ms too).
+  setTimeout(() => { try { process.kill(${target}, "SIGKILL"); } catch {} }, 500);
+}
+const snap = (() => {
+  // The child is definitely ours and alive at startup, so a null here is a
+  // transient probe failure (e.g. a momentary 'ps' hiccup), NOT a real
+  // identity loss. Retry a few times so a one-off failure can't silently
+  // disable the guard for the rest of the run.
+  for (let i = 0; i < 3; i++) { const s = startTime(); if (s !== null) return s; }
+  return null;
+})();
+let done = false;
+function onDeath() {
+  if (done) return; done = true;
+  // Re-verify identity: kill ONLY if the live PID is still our child.
+  if (snap !== null && alive() && startTime() === snap) treeKill();
+  // REF'd (NOT unref'd): stdin has closed, so an unref'd timer would let
+  // the loop empty and the process exit immediately — dropping the 500ms
+  // SIGKILL escalation. Keep the loop alive to deliver it, then exit.
+  setTimeout(() => process.exit(0), 1500);
+}
+process.stdin.resume();
+process.stdin.on("end", onDeath);
+process.stdin.on("close", onDeath);
+process.stdin.on("error", onDeath);
+const cap = setTimeout(() => process.exit(0), 24*3600*1000); if (cap.unref) cap.unref();
+`.trim();
+}
+/**
+* Spawn the detached node reaper holding the stdin death-pipe. Always
+* `detached` so it outlives a force-kill of the proxy, and `unref`'d so it
+* never holds the proxy's event loop open. Returns null on spawn failure.
+*/
+function spawnNodeReaper(pid, detachedGroup) {
+	try {
+		const child = spawn(process.execPath, ["-e", buildNodeReaperScript(pid, detachedGroup)], {
+			stdio: [
+				"pipe",
+				"ignore",
+				"ignore"
+			],
+			detached: true,
+			windowsHide: true,
+			shell: false
+		});
+		child.on("error", () => {});
+		child.stdin?.on("error", () => {});
+		_activeReapers.add(child);
+		child.once("exit", () => _activeReapers.delete(child));
+		child.unref();
+		return child;
+	} catch {
+		return null;
+	}
+}
+/**
+* Start the crash-safe guard for a launched CLI child. No-op on Windows
+* (Node's Job Object already reaps the tree on proxy death) and when
+* disabled / unspawnable. Fire-and-forget; never throws.
+*/
+function startProcessGuard(child) {
+	if (!processGuardEnabled()) return;
+	const pid = child.pid;
+	if (!pid) return;
+	if (process.platform === "win32") return;
+	spawnNodeReaper(pid, true);
+}
+//#endregion
+//#region src/lib/stripped-env-keys.ts
+/**
+* Auth / routing / remote / wire-fingerprint environment keys that must never
+* reach a github-router-spawned Claude or Codex child — through ANY channel.
+*
+* Two channels carry these keys to a spawned agent, and both must be defended:
+*   1. The PARENT PROCESS ENV — a user's shell exports. Stripped by
+*      `sanitizeParentEnv` (`src/lib/launch.ts`) before the proxy's overrides.
+*   2. The serve mirror `settings.json` `env` BLOCK — a user's own
+*      `~/.claude/settings.json`, snapshot-mirrored and applied to the
+*      SDK-spawned claude via `settingSources`. Stripped by
+*      `sanitizeServeSettingsEnv` (`src/lib/mcp-permissions-settings.ts`).
+*
+* If any of these survived, a Bedrock/Vertex/gateway user's config would
+* re-route the session OFF the github-router proxy, inject real auth that wins
+* over the synthetic `.credentials.json`, or activate Claude Code's
+* unimplemented Bridge/remote code path. `CLAUDE_CODE_COORDINATOR_MODE` (a
+* toolset-stripper) is NOT here — it's serve-specific, added to the serve list
+* directly. `ANTHROPIC_SMALL_FAST_MODEL` is deliberately NOT stripped (users
+* legitimately rely on it; `resolveModel` translates unrecognized values).
+*/
+const STRIPPED_AUTH_ROUTING_ENV_KEYS = [
+	"ANTHROPIC_API_KEY",
+	"ANTHROPIC_AUTH_TOKEN",
+	"ANTHROPIC_BASE_URL",
+	"ANTHROPIC_CUSTOM_HEADERS",
+	"ANTHROPIC_MODEL",
+	"CLAUDE_CODE_OAUTH_TOKEN",
+	"CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR",
+	"CLAUDE_CODE_USE_BEDROCK",
+	"CLAUDE_CODE_USE_VERTEX",
+	"CLAUDE_CODE_USE_FOUNDRY",
+	"CLAUDE_CONFIG_DIR",
+	"CLAUDE_BRIDGE_OAUTH_TOKEN",
+	"CLAUDE_BRIDGE_BASE_URL",
+	"CLAUDE_BRIDGE_SESSION_INGRESS_URL",
+	"SESSION_INGRESS_URL",
+	"CLAUDE_CODE_REMOTE",
+	"CLAUDE_CODE_CONTAINER_ID",
+	"CLAUDE_CODE_REMOTE_SESSION_ID",
+	"CLAUDE_CODE_SESSION_ID",
+	"CLAUDE_CODE_ADDITIONAL_PROTECTION",
+	"OPENAI_API_KEY",
+	"OPENAI_BASE_URL",
+	"CODEX_HOME",
+	"AIORDIE_CLAUDE_BIND",
+	"AIORDIE_TOKEN",
+	"AIORDIE_INSECURE_TLS"
+];
+//#endregion
+//#region src/lib/launch.ts
+/**
+* Auth-related env keys we strip from the parent before spawning the child CLI.
+* The proxy provides its own values for everything we care about, so the child
+* behaves as if the user had no parent-env auth at all. The canonical list lives
+* in `./stripped-env-keys` (shared with serve's settings.json `env` strip).
+*
+* Why strip rather than override-with-empty-string: Claude Code emits "Auth
+* conflict" warnings whenever both ANTHROPIC_AUTH_TOKEN and ANTHROPIC_API_KEY
+* are present (any value); stripping suppresses it AND prevents an inherited
+* real key from leaking. Cloud-provider toggles + OAuth tokens are simpler
+* dropped than overridden — a missing var is unambiguously absent everywhere.
+*/
+const STRIPPED_PARENT_ENV_KEYS = STRIPPED_AUTH_ROUTING_ENV_KEYS;
+/**
+* Strip auth-related keys from a parent-process env object. The result
+* is suitable to spread into a spawned child's env BEFORE the proxy's
+* explicit overrides, so the proxy is the only source of truth for
+* auth — and stale shell exports can't leak through.
+*/
+function sanitizeParentEnv(parent) {
+	const sanitized = { ...parent };
+	for (const key of STRIPPED_PARENT_ENV_KEYS) delete sanitized[key];
+	return sanitized;
+}
+function commandExists(name) {
+	try {
+		execFileSync(process.platform === "win32" ? "where.exe" : "which", [name], { stdio: "ignore" });
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Whether the launcher can execute `executable`.
+*
+* `buildLaunchCommand` resolves the CLI to an ABSOLUTE path (anti-shadow).
+* `where.exe` (and POSIX `which`) reject a full path argument — `where`
+* returns "Could not find files for the given pattern(s)" for an absolute
+* path even when the file exists — so the where/which probe is only valid
+* for bare command names. For an absolute path (already resolved against
+* PATH and existence-checked by `resolveExecutable`), check the
+* filesystem directly. Without this split, every launch where the CLI is
+* installed fails with a spurious "not found on PATH".
+*/
+function isExecutableAvailable(executable) {
+	if (path.isAbsolute(executable)) return existsSync(executable);
+	return commandExists(executable);
+}
+/**
+* Provider-config flags (`-c model_providers.github_router=...`) that
+* point Codex at our proxy. Extracted from `buildCodexCmd` so the new
+* `codex mcp-server` MCP-config builder can reuse the exact same
+* provider definition — drift between the two paths would silently
+* break the MCP wiring.
+*/
+function buildCodexProviderConfigFlags(serverUrl) {
+	return [
+		"-c",
+		`model_providers.github_router={name="github-router",base_url="${serverUrl}/v1",wire_api="responses",env_key="OPENAI_API_KEY"}`,
+		"-c",
+		"model_provider=github_router"
+	];
+}
+/**
+* Inspect the installed `codex` binary. Used by the codex-MCP wiring
+* in `claude.ts` to gate `--codex-cli`. Codex 0.129.0 introduced the
+* `mcp-server` subcommand; older versions don't expose it, so we
+* downgrade to the HTTP backend with a warning.
+*/
+function getCodexVersion() {
+	if (!commandExists("codex")) return { ok: false };
+	let raw;
+	try {
+		raw = execFileSync("codex", ["--version"], {
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).trim();
+	} catch {
+		return { ok: false };
+	}
+	const m = /(\d+)\.(\d+)\.(\d+)/.exec(raw);
+	if (!m) return {
+		ok: false,
+		version: raw
+	};
+	const major = Number.parseInt(m[1], 10);
+	const minor = Number.parseInt(m[2], 10);
+	const version = `${m[1]}.${m[2]}.${m[3]}`;
+	return {
+		ok: major > 0 || major === 0 && minor >= 129,
+		version
+	};
+}
+/**
+* Codex 0.129.0 broke two things the launcher had been relying on:
+*   (1) `--full-auto` was removed in favor of `--sandbox` + `--ask-for-approval`;
+*       passing it now exits the child immediately with
+*       `error: unexpected argument '--full-auto' found`.
+*   (2) `OPENAI_BASE_URL` is silently ignored — Codex hardcodes
+*       `https://api.openai.com/v1/responses` and 401s out without an
+*       explicit `-c model_providers.<name>.base_url` override.
+*
+* `buildCodexCmd` builds the launch argv that works on Codex 0.129+ while
+* still being compatible with older versions that accept the same flags.
+*/
+function buildCodexCmd(target) {
+	const cmd = ["codex"];
+	if (target.serverUrl) cmd.push(...buildCodexProviderConfigFlags(target.serverUrl));
+	cmd.push("--sandbox", "workspace-write", "--ask-for-approval", "on-request", "-m", target.model ?? "gpt-5.6-sol", ...target.extraArgs);
+	return cmd;
+}
+function buildLaunchCommand(target) {
+	const wantsPermissionMode = target.kind === "claude-code" && target.extraArgs.some((arg) => arg === "--permission-mode" || arg.startsWith("--permission-mode="));
+	const cmd = target.kind === "claude-code" ? wantsPermissionMode ? ["claude", ...target.extraArgs] : [
+		"claude",
+		"--dangerously-skip-permissions",
+		...target.extraArgs
+	] : buildCodexCmd(target);
+	const resolved = resolveExecutable(cmd[0], { env: process.env });
+	if (resolved) cmd[0] = resolved;
+	return {
+		cmd,
+		env: collapsePathKeys({
+			...sanitizeParentEnv(process.env),
+			...target.envVars
+		})
+	};
+}
+/**
+* Whether a resolved Windows executable must be launched through cmd.exe
+* (`shell:true`). Only batch shims (`.cmd`/`.bat`) need it — and even then
+* cmd.exe stays alive as the CLI's parent, so `taskkill /T` reaps the
+* whole tree. A real `.exe` (e.g. the native-installer `claude.exe`) is
+* spawned DIRECTLY so the CLI is the direct child, with no cmd.exe
+* intermediary to orphan its node/MCP grandchildren on a kill.
+*/
+function windowsLaunchNeedsShell(executable) {
+	const ext = path.extname(executable).toLowerCase();
+	return ext === ".cmd" || ext === ".bat";
+}
+function launchChild(target, server, options = {}) {
+	const { cmd, env } = buildLaunchCommand(target);
+	const executable = cmd[0];
+	if (!isExecutableAvailable(executable)) {
+		const msg = `"${executable}" not found on PATH. Install it first, then try again.`;
+		consola.error(msg);
+		process.stderr.write(msg + "\n");
+		process.exit(1);
+	}
+	let child;
+	try {
+		if (process.platform === "win32") if (windowsLaunchNeedsShell(cmd[0])) {
+			const quoted = cmd.map((a) => a.includes(" ") ? `"${a}"` : a).join(" ");
+			child = spawn(quoted, [], {
+				env,
+				stdio: "inherit",
+				shell: true
+			});
+		} else child = spawn(cmd[0], cmd.slice(1), {
+			env,
+			stdio: "inherit"
+		});
+		else child = spawn(cmd[0], cmd.slice(1), {
+			env,
+			stdio: "inherit",
+			detached: true
+		});
+	} catch (error) {
+		const msg = `Failed to launch ${executable}: ${error instanceof Error ? error.message : String(error)}`;
+		consola.error(msg);
+		process.stderr.write(msg + "\n");
+		server.close(true).catch(() => {});
+		if (options.onShutdown) Promise.resolve(options.onShutdown()).catch(() => {});
+		process.exit(1);
+	}
+	startProcessGuard(child);
+	let cleaned = false;
+	let exiting = false;
+	async function cleanup() {
+		if (cleaned) return;
+		cleaned = true;
+		const timeout = setTimeout(() => process.exit(1), 5e3);
+		try {
+			killChildProcessTree(child, { detachedGroup: process.platform !== "win32" });
+		} catch {}
+		try {
+			await server.close(true);
+		} catch {}
+		if (options.onShutdown) try {
+			await options.onShutdown();
+		} catch {}
+		clearTimeout(timeout);
+	}
+	function exit(code) {
+		if (exiting) return;
+		exiting = true;
+		process.exit(code);
+	}
+	let forwardGrace = null;
+	const lastForwardAt = {
+		SIGINT: 0,
+		SIGTERM: 0
+	};
+	const onSignal = (sig) => {
+		if (process.platform !== "win32" && child.pid && !cleaned) {
+			const now = Date.now();
+			if (now - lastForwardAt[sig] > 250) {
+				lastForwardAt[sig] = now;
+				try {
+					process.kill(-child.pid, sig);
+				} catch {}
+			}
+			const graceMs = sig === "SIGINT" ? 1e4 : 3e3;
+			if (!forwardGrace) {
+				forwardGrace = setTimeout(() => {
+					cleanup().then(() => exit(130)).catch(() => exit(1));
+				}, graceMs);
+				forwardGrace.unref?.();
+			}
+			return;
+		}
+		cleanup().then(() => exit(130)).catch(() => exit(1));
+	};
+	process.on("SIGINT", () => onSignal("SIGINT"));
+	process.on("SIGTERM", () => onSignal("SIGTERM"));
+	child.on("exit", (exitCode, signal) => {
+		try {
+			sweepRegistry();
+		} catch {}
+		const code = exitCode ?? (signal ? 128 : 1);
+		cleanup().then(() => exit(code)).catch(() => exit(1));
+	});
+	child.on("error", () => {
+		cleanup().then(() => exit(1)).catch(() => exit(1));
+	});
+}
+//#endregion
+//#region src/lib/toolbelt/provision.ts
+/**
+* Toolbelt provisioner: materialize curated CLI tools into the durable
+* router `bin/` dir so the spawned agent can call them on PATH.
+*
+* Properties (all load-bearing):
+*   - **Best-effort.** Every tool is isolated in try/catch; a failure
+*     skips that one tool and never throws to the launcher.
+*   - **Gap-fill.** A tool already on the user's PATH is NOT
+*     materialized (and a stale copy is removed) so we never shadow the
+*     user's own `jq`/`yq`/etc.
+*   - **Verified.** The downloaded archive's SHA256 must match the
+*     hardcoded manifest digest BEFORE extraction.
+*   - **Safe extraction.** Only the expected regular-file binary is
+*     pulled out; symlink/hardlink/device entries are rejected.
+*   - **Concurrency-safe.** A cross-process lock serializes writers;
+*     unique temp names + atomic rename avoid half-written binaries.
+*   - **Integrity-pruned.** Unexpected files in `bin/` are removed each
+*     launch so a prompt-injected agent can't plant a `git.cmd` that
+*     shadows real tools in future sessions.
+*/
+/** Per-download cap (bytes) — these binaries are a few MB at most. */
+const MAX_DOWNLOAD_BYTES = 67108864;
+const DOWNLOAD_TIMEOUT_MS = 3e4;
+const EXE_EXT = process.platform === "win32" ? ".exe" : "";
+/**
+* Materialize the toolbelt. Returns the list of command names exposed
+* in `bin/` after provisioning. Best-effort; never throws.
+*/
+async function provisionToolbelt() {
+	if (!toolbeltEnabled()) return [];
+	const binDir = PATHS.TOOLBELT_BIN_DIR;
+	try {
+		await mkdir(binDir, { recursive: true });
+	} catch (err) {
+		consola.debug("toolbelt: could not create bin dir:", err);
+		return [];
+	}
+	const skip = toolbeltSkipSet();
+	await withInstallLock("toolbelt.lock", async () => {
+		await pruneUnexpected(binDir);
+		await provisionRg(binDir, skip).catch((err) => consola.debug("toolbelt: rg skipped:", err));
+		await Promise.all(TOOLBELT_TOOLS.map((spec) => provisionTool(spec, binDir, skip).catch((err) => consola.debug(`toolbelt: ${spec.command} skipped:`, err))));
+	});
+	return exposedCommands(binDir);
+}
+/** Names allowed to live in `bin/` (managed binaries + their sidecars). */
+function expectedFileNames() {
+	const names = /* @__PURE__ */ new Set();
+	const add = (base) => {
+		names.add(base + EXE_EXT);
+		names.add(`${base}${EXE_EXT}.sha256`);
+	};
+	add("rg");
+	for (const spec of TOOLBELT_TOOLS) {
+		add(spec.binBasename);
+		for (const a of spec.aliases ?? []) add(a);
+	}
+	return names;
+}
+/** Remove any file in `bin/` that isn't a managed binary or sidecar. */
+async function pruneUnexpected(binDir) {
+	const expected = expectedFileNames();
+	let entries;
+	try {
+		entries = await readdir(binDir);
+	} catch {
+		return;
+	}
+	for (const name of entries) {
+		if (name.endsWith(".tmp")) continue;
+		if (!expected.has(name)) await rm(path.join(binDir, name), { force: true }).catch(() => {});
+	}
+}
+async function provisionRg(binDir, skip) {
+	const dest = path.join(binDir, "rg" + EXE_EXT);
+	if (skip.has("rg") || resolveExecutable("rg")) {
+		await removeBin(dest);
+		return;
+	}
+	if (existsSync(dest)) return;
+	const src = vscodeRipgrepPath();
+	if (!src) return;
+	const tmp = tempName(dest);
+	try {
+		await link(src, tmp);
+	} catch {
+		await copyFile(src, tmp);
+	}
+	if (process.platform !== "win32") await chmod(tmp, 493).catch(() => {});
+	await commit(tmp, dest);
+}
+async function provisionTool(spec, binDir, skip) {
+	const dest = path.join(binDir, spec.binBasename + EXE_EXT);
+	const sidecar = `${dest}.sha256`;
+	const asset = assetFor(spec);
+	if (skip.has(spec.command) || !asset) {
+		await removeTool(spec, binDir);
+		return;
+	}
+	if (resolveExecutable(spec.command)) {
+		await removeTool(spec, binDir);
+		return;
+	}
+	if (existsSync(dest) && await sidecarMatches(sidecar, asset.sha256)) {
+		await ensureAliases(spec, binDir, dest);
+		return;
+	}
+	await atomicInstall(dest, await downloadAndExtract(spec, asset));
+	await writeFile(sidecar, asset.sha256).catch(() => {});
+	await ensureAliases(spec, binDir, dest);
+}
+async function downloadAndExtract(spec, asset) {
+	const data = await download(asset.url);
+	const digest = createHash("sha256").update(data).digest("hex");
+	if (digest !== asset.sha256) throw new Error(`checksum mismatch for ${spec.command} (${asset.url}): expected ${asset.sha256}, got ${digest}`);
+	if (asset.archive === "raw") return data;
+	const member = asset.archive === "zip" ? extractZipMember(data, spec.binBasename) : extractTarGzMember(data, spec.binBasename);
+	if (!member) throw new Error(`binary "${spec.binBasename}" not found in ${asset.url}`);
+	return member;
+}
+async function download(url) {
+	const controller = new AbortController();
+	const timer = setTimeout(() => controller.abort(), DOWNLOAD_TIMEOUT_MS);
+	try {
+		const res = await fetch(url, {
+			signal: controller.signal,
+			redirect: "follow",
+			headers: { "User-Agent": "github-router-toolbelt" }
+		});
+		if (!res.ok) throw new Error(`download ${url}: HTTP ${res.status}`);
+		const buf = Buffer.from(await res.arrayBuffer());
+		if (buf.length > MAX_DOWNLOAD_BYTES) throw new Error(`download ${url}: exceeds ${MAX_DOWNLOAD_BYTES} bytes`);
+		return buf;
+	} finally {
+		clearTimeout(timer);
+	}
+}
+/** Write to a unique temp then atomically rename into place. */
+async function atomicInstall(dest, bytes) {
+	const tmp = tempName(dest);
+	await writeFile(tmp, bytes);
+	if (process.platform !== "win32") await chmod(tmp, 493).catch(() => {});
+	await commit(tmp, dest);
+}
+/** Rename tmp→dest, handling Windows replace-existing / in-use locks. */
+async function commit(tmp, dest) {
+	try {
+		await rename(tmp, dest);
+	} catch {
+		try {
+			await rm(dest, { force: true });
+			await rename(tmp, dest);
+		} catch (err) {
+			await rm(tmp, { force: true }).catch(() => {});
+			throw err;
+		}
+	}
+}
+async function ensureAliases(spec, binDir, dest) {
+	for (const alias of spec.aliases ?? []) {
+		const ap = path.join(binDir, alias + EXE_EXT);
+		if (existsSync(ap)) continue;
+		const tmp = tempName(ap);
+		try {
+			await copyFile(dest, tmp);
+			if (process.platform !== "win32") await chmod(tmp, 493).catch(() => {});
+			await commit(tmp, ap);
+		} catch (err) {
+			consola.debug(`toolbelt: alias ${alias} skipped:`, err);
+		}
+	}
+}
+async function removeTool(spec, binDir) {
+	await removeBin(path.join(binDir, spec.binBasename + EXE_EXT));
+	for (const alias of spec.aliases ?? []) await removeBin(path.join(binDir, alias + EXE_EXT));
+}
+async function removeBin(dest) {
+	await rm(dest, { force: true }).catch(() => {});
+	await rm(`${dest}.sha256`, { force: true }).catch(() => {});
+}
+async function sidecarMatches(sidecar, sha256) {
+	try {
+		return (await readFile(sidecar, "utf8")).trim() === sha256;
+	} catch {
+		return false;
+	}
+}
+function tempName(dest) {
+	return `${dest}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+}
+/** The command names currently exposed in `bin/`. */
+async function exposedCommands(binDir) {
+	let files;
+	try {
+		files = new Set(await readdir(binDir));
+	} catch {
+		return [];
+	}
+	const present = (base) => files.has(base + EXE_EXT);
+	const out = [];
+	if (present("rg")) out.push("rg");
+	for (const spec of TOOLBELT_TOOLS) if (present(spec.binBasename)) out.push(spec.command);
+	return out;
+}
+//#endregion
+export { STRIPPED_AUTH_ROUTING_ENV_KEYS as a, launchChild as i, buildCodexProviderConfigFlags as n, getCodexVersion as r, provisionToolbelt as t };
+
+//# sourceMappingURL=provision-DSkPa5hY.js.map