adevkit 0.1.0__py3-none-any.whl

devkit/skills/embedded/impeccable/scripts/impeccable

@@ -0,0 +1,213 @@
+#!/bin/sh
+# Impeccable launcher. Runs the platform binary shipped next to this script:
+#   <this dir>/bin/<os>-<arch>/impeccable
+# Order: $IMPECCABLE_BIN, the sibling binary, ~/.impeccable/bin/impeccable,
+# the version-pinned cache, then `impeccable` on PATH. Never needs Node.
+# The unversioned home binary and the PATH candidate are validated with the
+# engine-probe handshake first: the retired 3.x npm CLI also installed a bin
+# named `impeccable`, and exec'ing it would fail every verb with
+# "Unknown command". Trusted candidates (IMPECCABLE_BIN, the sibling binary,
+# the version-pinned cache) are exec'd without a probe: hooks run them on
+# every edit and must stay fast.
+set -eu
+
+# True when the candidate answers the engine handshake (prints
+# "impeccable-engine <version>", exit 0). Quiet and fast (<100ms).
+# IMPECCABLE_LAUNCHER_PROBE marks the child as a probe: a copy of this
+# launcher reached recursively (e.g. symlinked onto PATH as `impeccable`)
+# then skips its own probes and refuses to download, so probing stays cheap
+# and can never loop.
+probe_ok() {
+  probe_out=$(IMPECCABLE_LAUNCHER_PROBE=1 "$1" engine-probe 2>/dev/null) || return 1
+  case "$probe_out" in
+    impeccable-engine*) return 0 ;;
+  esac
+  return 1
+}
+probing=${IMPECCABLE_LAUNCHER_PROBE:-}
+
+dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+
+# What the binary needs to know about its home: the skill directory (for
+# reference/*.md and command-metadata.json) and how to name itself in the
+# commands it prints. Exported BEFORE any exec below, including the
+# IMPECCABLE_BIN override: an engine binary reached with no IMPECCABLE_SKILL_DIR
+# cannot find reference/*.md (so native platform refs never inline) or read its
+# own version (so UPDATE_AVAILABLE never fires). Setting it here covers every
+# candidate the launcher can exec.
+: "${IMPECCABLE_SKILL_DIR:=$(CDPATH= cd -- "$dir/.." && pwd)}"
+: "${IMPECCABLE_SELF:=$0}"
+export IMPECCABLE_SKILL_DIR IMPECCABLE_SELF
+
+if [ -n "${IMPECCABLE_BIN:-}" ] && [ -x "${IMPECCABLE_BIN}" ]; then
+  exec "${IMPECCABLE_BIN}" "$@"
+fi
+
+case "$(uname -s 2>/dev/null || echo unknown)" in
+  Darwin) os=darwin ;;
+  Linux) os=linux ;;
+  MINGW*|MSYS*|CYGWIN*|Windows_NT) os=windows ;;
+  *) os=unknown ;;
+esac
+case "$(uname -m 2>/dev/null || echo unknown)" in
+  arm64|aarch64) arch=arm64 ;;
+  x86_64|amd64) arch=x64 ;;
+  *) arch=unknown ;;
+esac
+
+bin="$dir/bin/$os-$arch/impeccable"
+[ "$os" = windows ] && bin="$bin.exe"
+
+if [ -x "$bin" ]; then
+  exec "$bin" "$@"
+fi
+if [ -f "$bin" ]; then
+  # Lost the executable bit in transit (zip extraction, some copiers).
+  chmod +x "$bin" 2>/dev/null && exec "$bin" "$@"
+fi
+# On Windows (an MSYS/Git Bash shell) the cached names carry .exe so this
+# launcher and impeccable.cmd share one cache.
+exe=""
+[ "$os" = windows ] && exe=".exe"
+home_bin="${HOME:-/nonexistent}/.impeccable/bin/impeccable$exe"
+if [ -z "$probing" ] && [ -x "$home_bin" ] && probe_ok "$home_bin"; then
+  exec "$home_bin" "$@"
+fi
+# Version-pinned user cache, filled by the download below or by `impeccable update`.
+version=""
+[ -f "$dir/VERSION" ] && version=$(tr -d '[:space:]' < "$dir/VERSION")
+cache_root="${IMPECCABLE_HOME:-${HOME:-/nonexistent}/.impeccable}"
+cached="$cache_root/bin/$version/impeccable$exe"
+if [ -n "$version" ] && [ -x "$cached" ]; then
+  exec "$cached" "$@"
+fi
+if [ -z "$probing" ] && command -v impeccable >/dev/null 2>&1 && probe_ok impeccable; then
+  exec impeccable "$@"
+fi
+
+# Last resort: fetch this version's binary for the current platform from the
+# public release channel into the user cache. Needs network; sandboxes without
+# egress preinstall the binary on PATH instead.
+setup_help() {
+  echo "Engine $version setup needs network access and write permission to $cache_root/bin/$version." >&2
+  echo "Run this launcher ($0) with engine-probe in a terminal that has those permissions, then retry the original command." >&2
+  echo "Alternatively, set IMPECCABLE_HOME to a writable cache location, or IMPECCABLE_BIN to a preinstalled engine binary." >&2
+}
+fetch_url() {
+  if command -v curl >/dev/null 2>&1; then
+    curl -fsSL --retry 2 -o "$tmp" "$1" 2>/dev/null
+  elif command -v wget >/dev/null 2>&1; then
+    wget -q -O "$tmp" "$1" 2>/dev/null
+  else
+    return 1
+  fi
+}
+check_download() {
+  download_file=${1:-$tmp}
+  if [ ! -f "$download_file" ]; then
+    rm -f "$tmp.sha256"
+    echo "impeccable: download completed but the file was removed before execution: $url; check your antivirus quarantine or logs. Refusing to continue; do not disable protection." >&2
+    exit 127
+  fi
+  if [ ! -s "$download_file" ]; then
+    rm -f "$download_file" "$tmp.sha256"
+    echo "impeccable: downloaded file is empty: $url; refusing the unverified download" >&2
+    exit 127
+  fi
+}
+if [ -n "$probing" ]; then
+  # Inside another launcher's probe: no download, fail fast and quiet.
+  exit 127
+fi
+if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
+  base="${IMPECCABLE_DOWNLOAD_BASE:-https://github.com/pbakaus/impeccable/releases/download}"
+  asset="impeccable-$os-$arch"
+  [ "$os" = windows ] && asset="$asset.exe"
+  url="$base/engine-v$version/$asset"
+  tmp="$cache_root/bin/$version/.impeccable.part.$$"
+  # An interrupted download (Ctrl-C, a hook timeout) would otherwise leave the
+  # PID-named staging file behind for good. The handlers must exit explicitly.
+  cleanup() { rm -f "$tmp" "$tmp.sha256" 2>/dev/null || :; }
+  trap 'cleanup; exit 129' HUP
+  trap 'cleanup; exit 130' INT
+  trap 'cleanup; exit 143' TERM
+  if ! mkdir -p "$cache_root/bin/$version" 2>/dev/null; then
+    echo "impeccable: engine $version is not installed; cannot create cache directory: $cache_root/bin/$version" >&2
+    setup_help
+    exit 127
+  fi
+  # Check the actual staging file, not just directory existence: a cache from
+  # an earlier run can be readable but no longer writable inside a sandbox.
+  if ! (umask 077; : > "$tmp") 2>/dev/null; then
+    echo "impeccable: engine $version is not installed; cannot write to cache directory: $cache_root/bin/$version" >&2
+    setup_help
+    exit 127
+  fi
+  fetched=0
+  if fetch_url "$url"; then
+    fetched=1
+  elif [ "$os" = windows ] && [ "$arch" = arm64 ]; then
+    # Windows on ARM runs x64 binaries; fall back when no arm64 asset exists.
+    url="$base/engine-v$version/impeccable-windows-x64.exe"
+    fetch_url "$url" && fetched=1
+  fi
+  if [ "$fetched" = 1 ]; then
+    check_download
+    # Fail closed: a freshly downloaded binary runs only after verifying
+    # against its .sha256 sidecar. A sidecar that cannot be fetched, or a
+    # machine with no sha256 tool, refuses the download instead of exec'ing
+    # an unverified binary. (A binary already on PATH or in the cache that
+    # passes engine-probe is unaffected.)
+    sidecar_ok=0
+    if command -v curl >/dev/null 2>&1; then
+      curl -fsSL --retry 2 -o "$tmp.sha256" "$url.sha256" 2>/dev/null && sidecar_ok=1
+    elif command -v wget >/dev/null 2>&1; then
+      wget -q -O "$tmp.sha256" "$url.sha256" 2>/dev/null && sidecar_ok=1
+    fi
+    check_download
+    expected=""
+    [ "$sidecar_ok" = 1 ] && expected=$(cut -d' ' -f1 < "$tmp.sha256")
+    actual=""
+    if command -v shasum >/dev/null 2>&1; then
+      if digest=$(shasum -a 256 "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
+    elif command -v sha256sum >/dev/null 2>&1; then
+      if digest=$(sha256sum "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
+    fi
+    check_download
+    rm -f "$tmp.sha256"
+    if [ -z "$expected" ] || [ -z "$actual" ]; then
+      rm -f "$tmp"
+      echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or hashing failed); refusing the unverified download" >&2
+      exit 127
+    fi
+    if [ "$actual" != "$expected" ]; then
+      rm -f "$tmp"
+      echo "impeccable: checksum mismatch downloading $url" >&2
+      exit 127
+    fi
+    check_download
+    if ! chmod +x "$tmp" 2>/dev/null; then
+      check_download
+      rm -f "$tmp"
+      echo "impeccable: could not make the verified download executable: $url" >&2
+      exit 127
+    fi
+    check_download
+    if ! mv -f "$tmp" "$cached" 2>/dev/null; then
+      check_download
+      rm -f "$tmp"
+      echo "impeccable: could not cache the verified download: $url" >&2
+      exit 127
+    fi
+    check_download "$cached"
+    exec "$cached" "$@"
+  fi
+  rm -f "$tmp" 2>/dev/null
+  echo "impeccable: could not download engine $version from $url; check network access, the release URL, and curl or wget availability." >&2
+  setup_help
+  exit 127
+fi
+
+echo "impeccable: no engine binary for $os-$arch found (looked in $bin, $cached, PATH)." >&2
+echo "Download impeccable-$os-$arch from https://github.com/pbakaus/impeccable/releases (tag engine-v$version) into $cache_root/bin/$version/impeccable$exe (then chmod +x), or set IMPECCABLE_BIN to a preinstalled engine binary. Docs: https://impeccable.style" >&2
+exit 127

devkit/skills/embedded/impeccable/scripts/impeccable.cmd

@@ -0,0 +1,239 @@
+@echo off
+setlocal
+rem Impeccable launcher (Windows). Runs bin\windows-<arch>\impeccable.exe next
+rem to this file, else a cached or freshly downloaded engine binary.
+rem
+rem Structure notes (this file is exercised by dry parsing and string-level
+rem tests, not yet on a real Windows machine):
+rem - No multi-line parenthesized blocks: cmd expands %var% at block parse
+rem   time, which made the old download path read back empty %url%/%cached%.
+rem   Linear goto flow keeps every expansion on its own line, and avoids
+rem   delayed expansion eating ! characters in user arguments.
+rem - The unversioned user binary and the PATH candidate are validated with
+rem   the engine-probe handshake (see :probe) so the retired 3.x npm CLI,
+rem   whose bin is also named impeccable, is never exec'd. IMPECCABLE_BIN,
+rem   the sibling binary, and the version-pinned cache stay trusted.
+rem - Downloads are verified against the .sha256 sidecar via certutil and
+rem   fail closed: a missing sidecar or hash tool refuses the download. On
+rem   ARM64 the arm64 asset is tried first and the x64 asset is the
+rem   fallback (Windows on ARM runs x64 binaries).
+if not defined IMPECCABLE_SKILL_DIR set "IMPECCABLE_SKILL_DIR=%~dp0.."
+if not defined IMPECCABLE_SELF set "IMPECCABLE_SELF=%~f0"
+set "arch=x64"
+if /I "%PROCESSOR_ARCHITECTURE%"=="ARM64" set "arch=arm64"
+
+if not defined IMPECCABLE_BIN goto no_env_bin
+if not exist "%IMPECCABLE_BIN%" goto no_env_bin
+set "run=%IMPECCABLE_BIN%"
+goto run
+:no_env_bin
+
+set "bin=%~dp0bin\windows-%arch%\impeccable.exe"
+if not exist "%bin%" goto no_sibling
+set "run=%bin%"
+goto run
+:no_sibling
+
+set "home_bin=%USERPROFILE%\.impeccable\bin\impeccable.exe"
+if not exist "%home_bin%" goto no_home_bin
+if defined IMPECCABLE_LAUNCHER_PROBE goto no_home_bin
+call :probe "%home_bin%"
+if not "%probe_ok%"=="1" goto no_home_bin
+set "run=%home_bin%"
+goto run
+:no_home_bin
+
+set "version="
+if exist "%~dp0VERSION" set /p version=<"%~dp0VERSION"
+if not defined IMPECCABLE_HOME set "IMPECCABLE_HOME=%USERPROFILE%\.impeccable"
+set "cached=%IMPECCABLE_HOME%\bin\%version%\impeccable.exe"
+if not defined version goto no_cache
+if not exist "%cached%" goto no_cache
+set "run=%cached%"
+goto run
+:no_cache
+
+if defined IMPECCABLE_LAUNCHER_PROBE goto download
+where impeccable >nul 2>nul
+if errorlevel 1 goto download
+call :probe impeccable
+if not "%probe_ok%"=="1" goto download
+impeccable %*
+exit /b %errorlevel%
+
+:download
+rem Last resort: fetch this version's binary from the release channel into
+rem the version-pinned user cache, verify it, then run it. Never inside
+rem another launcher's probe: fail fast and quiet instead.
+if defined IMPECCABLE_LAUNCHER_PROBE exit /b 127
+if not defined version goto fail
+where curl.exe >nul 2>nul
+if errorlevel 1 goto curl_missing
+if not defined IMPECCABLE_DOWNLOAD_BASE set "IMPECCABLE_DOWNLOAD_BASE=https://github.com/pbakaus/impeccable/releases/download"
+if exist "%IMPECCABLE_HOME%\bin\%version%\" goto cache_ready
+mkdir "%IMPECCABLE_HOME%\bin\%version%" >nul 2>nul
+if errorlevel 1 goto cache_directory_failed
+:cache_ready
+rem Stage the download in a directory only this run owns, as the sh launcher
+rem does with .impeccable.part.$$: concurrent first runs (parallel hooks, two
+rem agents) must never write, hash or move each other's files. mkdir fails
+rem when the name exists, so it claims the name atomically. RANDOM alone is
+rem not enough because cmd seeds it from the clock in whole seconds; the
+rem timestamp and the retry on collision keep same-second runs apart. A cache
+rem directory that refuses every mkdir is reported as unwritable.
+set "attempt=0"
+:claim_staging
+set /a attempt+=1
+if %attempt% GTR 20 goto cache_write_failed
+set "stamp=%TIME: =0%"
+set "stamp=%stamp::=%"
+set "stamp=%stamp:.=%"
+set "stamp=%stamp:,=%"
+set "staging=%IMPECCABLE_HOME%\bin\%version%\.impeccable.part.%stamp%-%RANDOM%%RANDOM%"
+mkdir "%staging%" >nul 2>nul
+if errorlevel 1 goto claim_staging
+set "part=%staging%\impeccable.exe"
+set "sidecar=%staging%\impeccable.sha256"
+rem Redirection failures do not reliably update ERRORLEVEL in cmd.exe;
+rem branch on the command's failure directly.
+(type nul >"%part%") 2>nul || goto staging_write_failed
+set "asset=impeccable-windows-%arch%.exe"
+set "url=%IMPECCABLE_DOWNLOAD_BASE%/engine-v%version%/%asset%"
+curl.exe -fsSL -o "%part%" "%url%" >nul 2>nul
+if not errorlevel 1 goto verify
+if not "%arch%"=="arm64" goto download_failed
+set "asset=impeccable-windows-x64.exe"
+set "url=%IMPECCABLE_DOWNLOAD_BASE%/engine-v%version%/%asset%"
+curl.exe -fsSL -o "%part%" "%url%" >nul 2>nul
+if errorlevel 1 goto download_failed
+
+:verify
+call :check_download
+if errorlevel 1 exit /b 127
+rem Mirrors the sh launcher and fails closed: a freshly downloaded binary
+rem runs only after verifying against its .sha256 sidecar. A sidecar that
+rem cannot be fetched, or an empty certutil result, refuses the download
+rem instead of running an unverified binary.
+curl.exe -fsSL -o "%sidecar%" "%url%.sha256" >nul 2>nul
+if errorlevel 1 goto verify_refuse
+set "expected="
+set /p expected=<"%sidecar%"
+for /f "tokens=1" %%h in ("%expected%") do set "expected=%%h"
+call :check_download
+if errorlevel 1 exit /b 127
+set "actual="
+rem Reuse the sidecar staging file after reading expected. Check certutil's
+rem status before parsing: its error text on stdout is not a digest.
+certutil -hashfile "%part%" SHA256 >"%sidecar%" 2>nul
+if errorlevel 1 goto verify_refuse
+call :check_download
+if errorlevel 1 exit /b 127
+for /f "usebackq skip=1 delims=" %%h in ("%sidecar%") do if not defined actual set "actual=%%h"
+del "%sidecar%" >nul 2>nul
+if not defined expected goto verify_refuse
+if not defined actual goto verify_refuse
+set "actual=%actual: =%"
+if /I "%actual%"=="%expected%" goto place
+call :discard_staging
+echo impeccable: checksum mismatch downloading %url% 1>&2
+exit /b 127
+
+:verify_refuse
+call :check_download
+if errorlevel 1 exit /b 127
+call :discard_staging
+echo impeccable: cannot verify %url% against %url%.sha256; refusing the unverified download 1>&2
+exit /b 127
+
+:check_download
+set "download_file=%~1"
+if not defined download_file set "download_file=%part%"
+if not exist "%download_file%" goto download_missing
+for %%f in ("%download_file%") do if %%~zf==0 goto download_empty
+exit /b 0
+
+:download_missing
+call :discard_staging
+echo impeccable: download completed but the file was removed before execution: %url%; check your antivirus quarantine or logs. Refusing to continue; do not disable protection. 1>&2
+exit /b 127
+
+:download_empty
+del "%download_file%" >nul 2>nul
+call :discard_staging
+echo impeccable: downloaded file is empty: %url%; refusing the unverified download 1>&2
+exit /b 127
+
+:discard_staging
+rem Removes this run's staging directory and whatever is left in it. Never
+rem touches another run's staging directory or the cached binary.
+if defined staging rd /s /q "%staging%" >nul 2>nul
+exit /b 0
+
+:place
+call :check_download
+if errorlevel 1 exit /b 127
+move /y "%part%" "%cached%" >nul 2>nul
+if errorlevel 1 goto place_failed
+call :discard_staging
+call :check_download "%cached%"
+if errorlevel 1 exit /b 127
+set "run=%cached%"
+goto run
+
+:place_failed
+call :check_download
+if errorlevel 1 exit /b 127
+call :discard_staging
+echo impeccable: could not cache the verified download: %url% 1>&2
+exit /b 127
+
+:run
+"%run%" %*
+exit /b %errorlevel%
+
+:probe
+rem Sets probe_ok=1 when %1 answers the engine handshake: prints
+rem "impeccable-engine <version>" and exits 0. The 3.x npm CLI answers any
+rem unknown verb with "Unknown command", exit 1, so it never passes.
+set "probe_ok="
+set "probe_tmp=%TEMP%\impeccable-probe-%RANDOM%%RANDOM%.txt"
+set "IMPECCABLE_LAUNCHER_PROBE=1"
+"%~1" engine-probe >"%probe_tmp%" 2>nul
+set "probe_err=%ERRORLEVEL%"
+set "IMPECCABLE_LAUNCHER_PROBE="
+if not "%probe_err%"=="0" goto probe_done
+findstr /b /c:"impeccable-engine" "%probe_tmp%" >nul 2>nul
+if not errorlevel 1 set "probe_ok=1"
+:probe_done
+del "%probe_tmp%" >nul 2>nul
+exit /b 0
+
+:cache_directory_failed
+echo impeccable: engine %version% is not installed; cannot create cache directory: "%IMPECCABLE_HOME%\bin\%version%" 1>&2
+goto setup_failed
+
+:staging_write_failed
+call :discard_staging
+
+:cache_write_failed
+echo impeccable: engine %version% is not installed; cannot write to cache directory: "%IMPECCABLE_HOME%\bin\%version%" 1>&2
+goto setup_failed
+
+:curl_missing
+echo impeccable: cannot download engine %version%; curl.exe is unavailable. 1>&2
+goto setup_failed
+
+:download_failed
+call :discard_staging
+echo impeccable: could not download engine %version% from %url%; check network access and the release URL. 1>&2
+
+:setup_failed
+echo Engine %version% setup needs network access and write permission to "%IMPECCABLE_HOME%\bin\%version%". 1>&2
+echo Run this launcher ("%~f0") with engine-probe in a terminal that has those permissions, then retry the original command. 1>&2
+echo Alternatively, set IMPECCABLE_HOME to a writable cache location, or IMPECCABLE_BIN to a preinstalled engine binary. 1>&2
+exit /b 127
+
+:fail
+echo impeccable: no engine binary found (looked in %bin%, %cached%, PATH). 1>&2
+echo Download impeccable-windows-%arch%.exe from https://github.com/pbakaus/impeccable/releases (tag engine-v%version%) and save it as %cached%, or set IMPECCABLE_BIN to a preinstalled engine binary. Docs: https://impeccable.style 1>&2
+exit /b 127