howtofixcli 0.7.8 → 0.7.9

package/dist/update.js

@@ -1,533 +0,0 @@
-/**
- * Keeping an npm-installed HowToFix current.
- *
- * The shape is taken from Claude Code's updater, because the pitfalls it solves
- * are not obvious:
- *
- * 1. **The check must run from the home directory.** `npm view` reads the
- *    nearest `.npmrc`, so running it inside a project lets a checked-out
- *    repository point the CLI at an attacker's registry — and then the update
- *    installs whatever that registry serves. Every npm invocation here runs
- *    with `cwd` set to the user's home.
- * 2. **The check must never block the session.** It is a network call on the
- *    startup path, so it is bounded by a short timeout and its failure is
- *    silent: an offline machine must not notice that anything was attempted.
- * 3. **An install must be exclusive.** Two sessions starting at once would
- *    otherwise run two `npm install -g` against the same tree; a lock file with
- *    a stale timeout keeps one of them from corrupting the other's install.
- * 4. **Only an npm install can be updated this way.** A copy run from a source
- *    checkout, or bundled some other way, must be told so rather than have
- *    `npm install -g` write a second copy somewhere else.
- *
- * The version comparison is local (no semver dependency) and deliberately
- * forgiving: a version string this cannot parse is treated as "not newer", so a
- * weird tag can never trigger an install.
- */
-import { execFile } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, realpathSync, statSync, unlinkSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { delimiter, dirname, join, sep } from "node:path";
-/** The package an installed copy updates from. */
-export const PACKAGE_NAME = "howtofixcli";
-/** The npm launchers to look for on PATH, in the order npm itself installs them. */
-const NPM_BIN_NAMES = ["npm", "npm.cmd", "npm.exe"];
-/**
- * How long the registry may take before the check is abandoned.
- *
- * This runs on the startup path through `npm view`, and the first `npm` of a
- * session is not a cheap call: node loads `npm-cli.js` and its whole module
- * graph before it touches the network. On a cold Windows box behind a virus
- * scanner that alone can take several seconds, and the registry lookup that
- * follows is a second network round trip on top. The old five seconds was
- * measured on a warm cache; it expired before the answer arrived often enough
- * that the check looked unreliable, which is exactly what it was.
- */
-export const CHECK_TIMEOUT_MS = 20_000;
-/** How many times a check may be attempted before it is reported as lost. */
-export const CHECK_ATTEMPTS = 2;
-/** An install gets longer than a check: it downloads a tarball. */
-export const INSTALL_TIMEOUT_MS = 120_000;
-/**
- * How long a lock may sit before it is considered abandoned.
- *
- * A killed process leaves its lock behind, and without a staleness rule the
- * next update would never run. Ten minutes is longer than any install here and
- * shorter than a user's patience.
- */
-export const LOCK_TIMEOUT_MS = 10 * 60 * 1000;
-/**
- * How long a half-written lock is respected.
- *
- * The file is created and then filled with a pid; a reader that catches the gap
- * sees an empty file. Five seconds is far longer than that gap and far shorter
- * than a user's patience.
- */
-export const BROKEN_LOCK_GRACE_MS = 5 * 1000;
-/**
- * Compare two dotted version strings.
- *
- * Returns -1, 0 or 1. Anything unparseable returns 0 ("equal"), so an odd tag
- * cannot be mistaken for a newer release. Pre-release suffixes are ignored:
- * this updater only ever installs the `latest` tag, which is not a pre-release.
- */
-export function compareVersions(left, right) {
-    const parse = (value) => {
-        const core = value.trim().split("-")[0]?.split("+")[0] ?? "";
-        if (!/^\d+(\.\d+)*$/.test(core))
-            return undefined;
-        return core.split(".").map((part) => Number(part));
-    };
-    const a = parse(left);
-    const b = parse(right);
-    if (!a || !b)
-        return 0;
-    const length = Math.max(a.length, b.length);
-    for (let index = 0; index < length; index += 1) {
-        const x = a[index] ?? 0;
-        const y = b[index] ?? 0;
-        if (x > y)
-            return 1;
-        if (x < y)
-            return -1;
-    }
-    return 0;
-}
-/**
- * Whether `candidate` is a strictly newer release than `current`.
- *
- * A pre-release candidate is never treated as an upgrade. The registry's
- * `latest` tag is stable by convention, so a `-beta` string reaching here means
- * the tag was moved by mistake — and a broken beta silently replacing a working
- * install is a far worse outcome than missing one release. Core versions are
- * still compared, so a pre-release of an *older* core stays older.
- */
-export function isNewer(candidate, current) {
-    if (candidate.includes("-"))
-        return false;
-    return compareVersions(candidate, current) > 0;
-}
-/**
- * Run a command and capture its output, never throwing.
- *
- * `error.code` is reported twice, deliberately: as the numeric exit code when it
- * is a number, and as `errorCode` when it is a string. A spawn that never
- * started — no such file, not executable, refused on Windows — carries a string
- * there and leaves `stderr` empty, which is the only way to tell "the program
- * did not run" apart from "the program ran and failed". Reading `stderr` alone
- * reported both as a registry that did not answer.
- */
-const run = (command, args, options) => {
-    return new Promise((resolve) => {
-        execFile(command, args, { cwd: options.cwd, timeout: options.timeoutMs, windowsHide: true }, (error, stdout, stderr) => {
-            const raw = error ? error.code : undefined;
-            const code = typeof raw === "number" ? raw : error ? 1 : 0;
-            const errorCode = typeof raw === "string" ? raw : undefined;
-            resolve({ code, stdout: String(stdout ?? ""), stderr: String(stderr ?? ""), ...(errorCode ? { errorCode } : {}) });
-        });
-    });
-};
-/**
- * How a spawn that never started is told apart from a registry that did not answer.
- *
- * A spawn that fails reports a *string* code in `error.code` — `ENOENT` for a
- * program that is not there, `EACCES` for one that is not executable, `EINVAL`
- * for a `.cmd` refused on Windows — and leaves `stderr` empty. Reading `stderr`
- * therefore classified every one of those as "the registry did not answer",
- * which sends a user to look at their network when the problem is on their disk.
- * The code is the signal; `stderr` is only a fallback for a runner that reports
- * it there.
- */
-const MISSING_COMMAND = new Set(["ENOENT", "EACCES", "EINVAL", "EPERM"]);
-/**
- * The npm to run, which is not always the one on PATH.
- *
- * `npm install -g howtofixcli` puts the `howtofix` bin next to npm's own, but a
- * GUI launcher, a shim directory, or an nvm-style shell hook can leave `node`
- * resolvable and `npm` not — and then the update check reported a network-style
- * failure for a machine that simply had no npm in front of it.
- *
- * npm's own entry point is preferred over the launcher on PATH, because the
- * launcher on Windows is `npm.cmd`: `execFile` refuses a `.cmd` without a shell
- * (the fix for CVE-2024-27980), so spawning it fails with `EINVAL` before npm
- * ever runs. `npm-cli.js` is a JavaScript file, which `execFile` starts with the
- * running node on every platform. It sits beside node in every layout npm
- * itself installs — POSIX `<node>/../lib/node_modules/npm`, Windows
- * `<node>/node_modules/npm` — so both are probed.
- *
- * The PATH lookup is still the fallback, so a version-managed npm that is not
- * laid out this way is found. Only npm is probed: the updater knows the shape of
- * an npm installation, and guessing at other package managers would be worse
- * than saying plainly that npm is missing.
- */
-export function resolveNpm() {
-    const nodeDir = dirname(process.execPath);
-    // POSIX layout, then the Windows layout, which keeps npm under the node dir.
-    for (const relative of [
-        ["..", "lib", "node_modules", "npm", "bin", "npm-cli.js"],
-        ["node_modules", "npm", "bin", "npm-cli.js"],
-    ]) {
-        const npmCli = join(nodeDir, ...relative);
-        if (existsSync(npmCli))
-            return { command: process.execPath, args: [npmCli] };
-    }
-    const onPath = process.env.PATH?.split(delimiter).filter(Boolean) ?? [];
-    for (const dir of onPath) {
-        for (const name of NPM_BIN_NAMES) {
-            const candidate = join(dir, name);
-            // A `.cmd`/`.bat` cannot be spawned without a shell, so a shim in one of
-            // those forms is skipped rather than returned to fail later.
-            if (name.endsWith(".cmd") || name.endsWith(".bat"))
-                continue;
-            if (existsSync(candidate))
-                return { command: candidate, args: [] };
-        }
-    }
-    // Windows was giving up here. npm's launcher there is `npm.cmd`, which
-    // `execFile` refuses to start without a shell, so the loop above skips it — and
-    // if the `npm-cli.js` probes missed, the answer was "npm was not found" on a
-    // machine whose npm is right there on PATH. The `.cmd` is still not spawnable
-    // directly, so it is run *through* cmd.exe, which is how npm itself invokes it.
-    if (process.platform === "win32") {
-        for (const dir of onPath) {
-            for (const name of NPM_BIN_NAMES) {
-                if (!name.endsWith(".cmd") && !name.endsWith(".bat"))
-                    continue;
-                const candidate = join(dir, name);
-                if (existsSync(candidate)) {
-                    return { command: process.env.ComSpec || "cmd.exe", args: ["/d", "/s", "/c", `"${candidate}"`] };
-                }
-            }
-        }
-    }
-    return undefined;
-}
-/** A missing npm is a fact about the machine, not a failed registry lookup. */
-export const NPM_MISSING_MESSAGE = "could not check for a newer version: npm was not found, so run `npm install -g howtofixcli@latest` yourself";
-/** A registry that answered nothing is transient, and the wording says so. */
-export const CHECK_FAILED_MESSAGE = "could not check for a newer version: the registry did not answer";
-/**
- * A one-line note that a check did not happen, for the feed.
- *
- * The check itself stays silent when it succeeds and the copy is current — "you
- * are up to date" on every start is noise. A check that *failed* is different:
- * staying silent about it is what made a broken lookup indistinguishable from a
- * working one, and the user's only signal was that the update never appeared.
- * The note is one line, says only what was tried, and does not pretend the
- * absence of an update means the software is current.
- */
-export function checkFailedNote(check) {
-    if (check.latest !== undefined)
-        return undefined;
-    return `${check.message} (this is why no update was offered; /update retries it)`;
-}
-/** Whether the failure was "there is no npm here" rather than "npm said no". */
-function npmMissing(result) {
-    if (result.code === -2)
-        return true;
-    const code = result.errorCode ?? (result.stderr ?? "").trim();
-    return MISSING_COMMAND.has(code);
-}
-/** Where the update lock lives. */
-function lockPath() {
-    const configured = process.env.HOWTOFIX_CODING_AGENT_DIR?.trim();
-    const dir = configured || join(homedir(), ".howtofix", "agent");
-    try {
-        mkdirSync(dir, { recursive: true });
-    }
-    catch {
-        // A read-only home is not fatal: the lock then just never blocks.
-    }
-    return join(dir, "update.lock");
-}
-/**
- * Whether a process with this id still exists.
- *
- * `EPERM` is the interesting answer: it means the process is there but belongs
- * to another user. Treating that as "dead" would let a second install start
- * while the first is still writing, which is the race the lock exists to stop.
- */
-export function pidAlive(pid) {
-    if (!Number.isInteger(pid) || pid <= 0)
-        return false;
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch (error) {
-        return error?.code === "EPERM";
-    }
-}
-function readLock(path, now) {
-    try {
-        const ageMs = now - statSync(path).mtimeMs;
-        const raw = readFileSync(path, "utf8").trim();
-        const pid = /^\d+$/.test(raw) ? Number.parseInt(raw, 10) : undefined;
-        return { pid, ageMs };
-    }
-    catch {
-        return undefined;
-    }
-}
-/**
- * Whether a lock still represents work in progress.
- *
- * Age alone is not enough. An update that crashed, or that the user cancelled
- * by closing the terminal, leaves the file behind; waiting the full ten minutes
- * before trying again is exactly the wrong answer, and it produced the message
- * "another HowToFix is already installing an update" when nothing was. The pid
- * written inside the file is the fact that settles it: a dead holder means a
- * free lock, immediately.
- */
-function lockIsHeld(state) {
-    if (!state)
-        return false;
-    if (state.pid === undefined) {
-        // Half-written file: give the writer a moment, then treat it as debris.
-        return state.ageMs < BROKEN_LOCK_GRACE_MS;
-    }
-    if (state.pid === process.pid)
-        return false;
-    if (!pidAlive(state.pid))
-        return false;
-    // A live holder that has been inside `npm install` for longer than the
-    // timeout is stuck, not working. Taking over is better than blocking forever.
-    return state.ageMs < LOCK_TIMEOUT_MS;
-}
-/**
- * Take the update lock, or report that someone else holds it.
- *
- * A lock whose holder is gone is taken over at once; one held by a live process
- * blocks until {@link LOCK_TIMEOUT_MS}. The state is re-read immediately before
- * the file is removed, so two processes that both saw a stale lock cannot both
- * believe they own it.
- */
-export function acquireUpdateLock(now = Date.now()) {
-    const path = lockPath();
-    try {
-        if (existsSync(path)) {
-            if (lockIsHeld(readLock(path, now)))
-                return false;
-            if (lockIsHeld(readLock(path, now)))
-                return false;
-            unlinkSync(path);
-        }
-        writeFileSync(path, String(process.pid), { mode: 0o600 });
-        return true;
-    }
-    catch {
-        // An unwritable home means no lock; an update is still better attempted
-        // than silently skipped, so this reports success rather than blocking.
-        return true;
-    }
-}
-/** Release the update lock. Never throws, and never removes another's lock. */
-export function releaseUpdateLock() {
-    const path = lockPath();
-    try {
-        const state = readLock(path, Date.now());
-        if (state && state.pid !== undefined && state.pid !== process.pid)
-            return;
-        unlinkSync(path);
-    }
-    catch {
-        // Already gone, or never written.
-    }
-}
-/**
- * What the registry says the newest release is, or why it could not be read.
- *
- * Retried once. The failure this catches is a dropped connection or a stalled
- * DNS lookup in the first second of a session — transient by nature, and the
- * only chance to notice it used to be a restart, because nothing else asks
- * again before the process exits.
- *
- * `no-npm` is not retried: npm's absence is a fact about the machine, and
- * running the lookup twice would not change it.
- */
-async function probeLatest(options) {
-    const runner = options?.runner ?? run;
-    const npm = resolveNpm();
-    // No npm anywhere on this machine: the user can fix that, so it is named.
-    if (!npm)
-        return { reason: "no-npm" };
-    let last = "no-answer";
-    for (let attempt = 0; attempt < CHECK_ATTEMPTS; attempt += 1) {
-        // The runner is documented never to throw, and `checkForUpdate` is documented
-        // never to throw either — but a promise executor that throws (an `execFile`
-        // that rejects its own arguments, say) rejects the returned promise, and this
-        // runs on the startup path. A spawn that could not start is not an answer from
-        // the registry, so it is classified as one, not propagated.
-        let result;
-        try {
-            result = await runner(npm.command, [...npm.args, "view", `${PACKAGE_NAME}@latest`, "version", "--prefer-online"], {
-                cwd: homedir(),
-                timeoutMs: options?.timeoutMs ?? CHECK_TIMEOUT_MS,
-            });
-        }
-        catch {
-            last = "no-answer";
-            continue;
-        }
-        if (result.code !== 0) {
-            // npm exists but could not run: a launcher that is not executable, or a
-            // shim whose target is gone. Both are the same advice as a missing npm,
-            // and neither is worth a second attempt.
-            if (npmMissing(result))
-                return { reason: "no-npm" };
-            last = "no-answer";
-            continue;
-        }
-        const version = result.stdout.trim().split("\n").pop()?.trim() ?? "";
-        if (/^\d+\.\d+/.test(version))
-            return { version };
-        last = "no-answer";
-    }
-    return { reason: last };
-}
-/** The newest published version, or `undefined` when it could not be read. */
-export async function latestVersion(options) {
-    return (await probeLatest(options)).version;
-}
-/**
- * Ask the registry whether a newer release exists.
- *
- * Never throws and never blocks for long: this runs on the startup path, so an
- * offline machine, a slow registry, or a missing `npm` must all be quiet
- * non-events rather than a delay or a crash.
- */
-export async function checkForUpdate(current, options) {
-    const probe = await probeLatest(options);
-    if (!probe.version) {
-        // The two failures read the same to a user and could not be more different
-        // to fix: one is "install npm", the other is "try again". Saying which is
-        // the whole value of the message.
-        return {
-            current,
-            available: false,
-            message: probe.reason === "no-npm" ? NPM_MISSING_MESSAGE : CHECK_FAILED_MESSAGE,
-        };
-    }
-    const latest = probe.version;
-    if (!isNewer(latest, current)) {
-        return { current, latest, available: false, message: `HowToFix ${current} is up to date` };
-    }
-    return {
-        current,
-        latest,
-        available: true,
-        message: `HowToFix ${latest} is available (you have ${current})`,
-    };
-}
-/**
- * The line that explains an npm failure.
- *
- * npm prints deprecation warnings on stderr and a real failure after them, so
- * taking the last line reported `npm warn deprecated node-domexception@1.0.0`
- * as the reason an install failed. Warnings are dropped, error lines win, and
- * the code that is left is mapped to the action a user can actually take.
- */
-export function npmFailureDetail(stdout, stderr, errorCode) {
-    const lines = `${stderr}\n${stdout}`
-        .split("\n")
-        .map((line) => line.trim())
-        .filter(Boolean)
-        .filter((line) => !/^npm warn\b/i.test(line));
-    const errors = lines.filter((line) => /^npm error\b/i.test(line) || /\bERR!/i.test(line));
-    const codeLine = errors.find((line) => /^npm error code\b/i.test(line));
-    const detail = (codeLine ?? errors.at(-1) ?? lines.at(-1) ?? errorCode ?? "")
-        .replace(/^npm error\s*/i, "")
-        .trim();
-    // The hint reads the whole output: the code that names the cause is often on
-    // an earlier line than the path or syscall that failed last.
-    const evidence = `${lines.join(" ")} ${errorCode ?? ""}`;
-    let hint = "";
-    if (/EACCES|EPERM|permission denied/i.test(evidence)) {
-        hint = " — npm could not replace its files; close other HowToFix windows and run the terminal as Administrator";
-    }
-    else if (/EBUSY|EEXIST|ENOTEMPTY|resource busy|being used by another process/i.test(evidence)) {
-        hint = " — a file is in use; close other HowToFix windows and try again";
-    }
-    else if (/ENOSPC/i.test(evidence)) {
-        hint = " — the disk is full";
-    }
-    else if (/ETIMEDOUT|ENOTFOUND|EAI_AGAIN|ECONNREFUSED/i.test(evidence)) {
-        hint = " — npm could not reach the registry";
-    }
-    return { detail, hint };
-}
-/**
- * Install the newest release globally.
- *
- * The lock is the point: two sessions starting together would otherwise run two
- * installs over the same tree. A held lock is not a failure — it means another
- * process is already doing exactly this — so it is reported as such and the
- * caller can simply wait for the next start.
- */
-export async function installUpdate(options) {
-    const runner = options?.runner ?? run;
-    if (!acquireUpdateLock()) {
-        return { ok: false, message: "another HowToFix is already installing an update" };
-    }
-    try {
-        const npm = resolveNpm();
-        if (!npm) {
-            return { ok: false, message: "npm was not found, so run `npm install -g howtofixcli@latest` yourself" };
-        }
-        const spec = options?.version ? `${PACKAGE_NAME}@${options.version}` : `${PACKAGE_NAME}@latest`;
-        const result = await runner(npm.command, [...npm.args, "install", "-g", spec], {
-            cwd: homedir(),
-            timeoutMs: options?.timeoutMs ?? INSTALL_TIMEOUT_MS,
-        });
-        if (result.code !== 0) {
-            const { detail, hint } = npmFailureDetail(result.stdout, result.stderr, result.errorCode);
-            return { ok: false, message: `the update did not install${hint}${detail ? `: ${detail}` : ""}` };
-        }
-        return { ok: true, version: options?.version, message: "updated; it takes effect the next time HowToFix starts" };
-    }
-    catch (cause) {
-        return { ok: false, message: `the update failed: ${cause instanceof Error ? cause.message : String(cause)}` };
-    }
-    finally {
-        releaseUpdateLock();
-    }
-}
-/**
- * Whether the running copy is one `npm install -g` can update.
- *
- * The test is on the launcher's path, resolved through symlinks, and *not* on
- * `import.meta.url`. That is not a style preference: esbuild substitutes
- * `import.meta.url` with the **output file's** URL at build time, so in the
- * published bundle it is forever the path of the machine that built it — a
- * release would never recognise itself as installed and could never update.
- * `process.argv[1]` is the file the user actually ran; `realpath` follows the
- * `bin` symlink npm creates into `lib/node_modules/howtofixcli/`.
- *
- * An npm install — global or as a dependency — lives under
- * `node_modules/howtofixcli/`, so that is what the resolved path is tested for.
- * A copy run from a source checkout has no business being replaced by a global
- * install, and the caller is told so instead of having a second copy written.
- */
-export function isInstalledCopy(launcher = process.argv[1]) {
-    if (!launcher)
-        return false;
-    let path = launcher;
-    try {
-        // npm's global `bin` entry is a symlink to the package's own file.
-        path = realpathSync(launcher);
-    }
-    catch {
-        // A launcher that cannot be resolved is tested as the path it was given.
-    }
-    return path.includes(`${sep}node_modules${sep}${PACKAGE_NAME}${sep}`);
-}
-/** Whether the user turned the automatic update off. */
-export function autoUpdateEnabled(settingsPath) {
-    try {
-        const parsed = JSON.parse(readFileSync(settingsPath, "utf8"));
-        return parsed.autoUpdate !== false;
-    }
-    catch {
-        // Missing or unreadable settings means the default, which is on.
-        return true;
-    }
-}

package/dist/usage-segment.js

@@ -1,69 +0,0 @@
-import { mkdirSync, readFileSync } from "node:fs";
-import { dirname } from "node:path";
-import { USAGE_CACHE_PATH } from "./paths.js";
-import { usageSegment } from "./hud-line.js";
-import { writeFileAtomicSync } from "./fs-atomic.js";
-import { checkUsage, HOWTOFIX_PROVIDERS, isHowtofixProvider } from "./howtofix-account.js";
-const cachePath = USAGE_CACHE_PATH;
-const cacheTtlMs = 180_000;
-/**
- * The connected account's key, or undefined.
- *
- * Mirrors how `/usage` and `/sync` resolve it: the first configured gateway
- * provider that the runtime knows about, then that provider's key.
- */
-export async function howtofixKeyFrom(source) {
-    const configured = new Set((await source.modelRuntime.getAvailable()).map((model) => model.provider).filter((provider) => isHowtofixProvider(provider)));
-    const target = HOWTOFIX_PROVIDERS.find((provider) => configured.has(provider));
-    if (!target)
-        return undefined;
-    const auth = await source.modelRuntime.getAuth(target);
-    return auth?.auth?.apiKey;
-}
-function readCache() {
-    try {
-        const cache = JSON.parse(readFileSync(cachePath, "utf8"));
-        if (!cache.data || typeof cache.cachedAt !== "number")
-            return undefined;
-        return { data: cache.data, cachedAt: cache.cachedAt };
-    }
-    catch {
-        return undefined;
-    }
-}
-function format(usage) {
-    if (usage.unlimited)
-        return usageSegment("unlimited", "", usage.latencyMs);
-    const money = usage.unit === "USD" || usage.unit === "CNY";
-    const balance = money ? `$${usage.remaining.toFixed(2)}` : `${usage.remaining.toLocaleString()}`;
-    return usageSegment(balance, usage.unit, usage.latencyMs);
-}
-/**
- * The HUD segment, or undefined when there is nothing to say.
- *
- * A stale cache is better than nothing: when the gateway cannot be reached the
- * last known figure is shown rather than the segment vanishing, and only a start
- * with no cache and no reachable gateway leaves the HUD without one.
- */
-export async function loadUsageSegment(source) {
-    const cache = readCache();
-    if (cache && Date.now() - cache.cachedAt < cacheTtlMs)
-        return format(cache.data);
-    const key = await howtofixKeyFrom(source);
-    if (!key)
-        return cache ? format(cache.data) : undefined;
-    const started = Date.now();
-    const check = await checkUsage(key, { timeoutMs: 3_000 });
-    if (!check.ok)
-        return cache ? format(cache.data) : undefined;
-    const usage = {
-        remaining: check.remaining ?? 0,
-        limit: check.limit ?? 0,
-        unit: check.unit,
-        unlimited: check.unlimited,
-        latencyMs: Date.now() - started,
-    };
-    mkdirSync(dirname(cachePath), { recursive: true });
-    writeFileAtomicSync(cachePath, JSON.stringify({ data: usage, cachedAt: Date.now() }));
-    return format(usage);
-}

package/dist/web-tools.js

@@ -1,46 +0,0 @@
-import { Type } from "@netrodev/hxf-ai";
-import { defineTool } from "@netrodev/hxf-coding-agent";
-import { fetchUrl, searchWeb } from "./web.js";
-function formatHits(hits) {
-    if (hits.length === 0)
-        return "no results";
-    return hits.map((hit, i) => `${i + 1}. ${hit.title}\n   ${hit.url}${hit.snippet ? `\n   ${hit.snippet}` : ""}`).join("\n");
-}
-export const webSearchTool = defineTool({
-    name: "web_search",
-    label: "web_search",
-    description: "Search the public web. Use for current docs, changelogs, error messages, and anything not in this repo. Returns titles, URLs, and snippets. Follow a URL with web_fetch.",
-    promptSnippet: "web_search: search the public web",
-    parameters: Type.Object({
-        query: Type.String({ description: "Search query" }),
-    }),
-    async execute(_toolCallId, params) {
-        const result = await searchWeb(params.query, { braveKey: process.env.BRAVE_API_KEY });
-        if (!result.ok) {
-            return { content: [{ type: "text", text: result.error }], details: { error: result.error }, isError: true };
-        }
-        return {
-            content: [{ type: "text", text: formatHits(result.hits) }],
-            details: { count: result.hits.length, provider: result.provider },
-        };
-    },
-});
-export const webFetchTool = defineTool({
-    name: "web_fetch",
-    label: "web_fetch",
-    description: "Fetch a public http(s) URL and return its text. HTML is stripped to visible text. Local, loopback, and private addresses are refused.",
-    promptSnippet: "web_fetch: read a public URL as text",
-    parameters: Type.Object({
-        url: Type.String({ description: "http(s) URL" }),
-    }),
-    async execute(_toolCallId, params) {
-        const result = await fetchUrl(params.url);
-        if (!result.ok) {
-            return { content: [{ type: "text", text: result.error }], details: { error: result.error }, isError: true };
-        }
-        return {
-            content: [{ type: "text", text: result.text }],
-            details: { url: result.url, contentType: result.contentType, chars: result.text.length },
-        };
-    },
-});