Dashboard › cli › Distillation
612adb66-4ec6-4bb6-93cd-ce69fe943b14["lore_tm_v1_Z6nDGoU8vX2q4OTgtF7ZK4zESv94RVzf0A8wIEkzLhQ","lore_tm_v1_LGfgNsOkdXA8ChctrJOPGB2yNzDamCNgiiSGMxGkxgQ","lore_tm_v1_dedKayNQ3EFOfuYutSgDtVaXU7Sbf_YIvmmFFXXqgm8","lore_tm_v1_C86oysmi8BTqcw4j3TFHIKb9SFHI8NWu1rjHpUVRjLM","lore_tm_v1_dPlO_Aqm21g8-53iXEZsg33NTuxa1yKRr7ExA07v0e4","lore_tm_v1_HwLtJbTmrpZ6LAxjEZX0NeFKEqyWTBQpGE6-lGgSa28","lore_tm_v1_gtIVqDJK4CXDZ3l8voY8J37P1HVoYCjKcKxCRR-0AJo","lore_tm_v1_j83i6yjB2RvDyBszPSjdDzkkIcYVuTzvZ48TO_eyz_w","lore_tm_v1_MKUWWID_CDyAnX3wHp2o5HmDG1aUdI3iAFOK4c-kNcA","lore_tm_v1_vZKIh2oC368hv9bgJibneRBEzW5XElKJQGNNhvyog9E"]
packages/cli/package.json requires Node >=22.15, pins packageManager to pnpm@10.11.0, and defines tsx/cli commands with --env-file-if-exists=.env.local --import ./script/require-shim.mjs.packages/cli/package.json: dev, build, build:all, and bundle first run generated schema/docs/SDK tasks; build invokes pnpm tsx script/build.ts --single, build:all invokes pnpm tsx script/build.ts, and bundle invokes pnpm tsx script/bundle.ts.packages/cli/package.json: typecheck generates docs/SDK then runs tsc --noEmit; lint uses biome check --no-errors-on-unmatched --error-on-warnings --max-diagnostics=none ./; lint:fix adds --write.packages/cli/package.json: test delegates to test:unit; test:unit generates docs/SDK then runs vitest run test/lib test/commands test/types test/script --coverage; test:changed uses vitest run --changed; test:e2e runs vitest run test/e2e; test:init-eval runs vitest run test/init-eval --testTimeout 600000.packages/cli/package.json: generate:parser → script/generate-parser.ts; generate:sdk → script/generate-sdk.ts; generate:skill → script/generate-skill.ts; generate:banner → script/generate-banner-sixel.ts; generate:docs-sections → script/generate-docs-sections.ts; generate:schema → script/generate-api-schema.ts; generate:command-docs → script/generate-command-docs.ts. generate:docs runs banner, parser, command-docs, skill, and docs-sections in that order.packages/cli/package.json scripts include eval:skill, bench, bench:save, bench:compare, bench:sweep, check:fragments, check:deps, check:errors, check:patches, check:docs-sections, check:env-coverage, and check:stale-refs; check:docs-sections invokes script/generate-docs-sections.ts --check.binpatch@0.4.2 exposes BinpatchError, MAX_NIGHTLY_CHAIN_DEPTH, MAX_OUTPUT_SIZE, MAX_STABLE_CHAIN_DEPTH, OciClient, PATCH_TAG_PREFIX, SIZE_THRESHOLD_RATIO, addDiffChunk, applyPatch, applyPatchChainInMemory, applyPatchToMemory, chainFileName, extractSha256, extractStableChain, filterAndSortChainTags, getPatchFromVersion, getPatchTargetSha256, getStableTargetSha256, ghcrSource, githubReleaseSource, makeCache, offtin, parsePatchHeader, patchFileName, resolveAndApply, safeProgress, and validateChainStep.binpatch@0.4.2 implements streaming TRDIFF10/zig-bsdiff patch application: the old binary is read on demand through positional read() and a single-block read-ahead cache, so the base never sits fully in the JS heap; diff/extra blocks stream through node:zlib createZstdDecompress(); output is incrementally written with fs.openSync and fs.writeSync; the descriptor is closeSync’d before return to avoid Linux ETXTBSY; SHA-256 is computed inline with node:crypto createHash.[0..8] magic "TRDIFF10", [8..16] signed-magnitude little-endian controlLen, [16..24] diffLen, [24..32] newSize, then zstd(control) | zstd(diff) | zstd(extra).offtin() decodes zig-bsdiff signed 64-bit little-endian integers using sign-magnitude rather than two’s complement: sign in bit 7 of byte 7 and magnitude in the lower 63 bits.addDiffChunk() performs wrapping old + diff mod 256 addition four bytes at a time via SWAR using 0x7f7f7f7f and 0x80808080, with a short loop for the trailing n % 4 bytes.MAX_OUTPUT_SIZE guards the untrusted TRDIFF10 newSize before allocating new Uint8Array(newSize), preventing an OOM denial of service; the documented ceiling is 2 GiB, chosen as generous relative to the approximately 310 MB gateway binary.applyPatchChainInMemory(oldPath, patches, destPath, onBytes?) copies only the running base binary to a temporary file, keeps every intermediate patch result in memory, and writes only the final output; intermediates never hit disk and only the final binary is hashed. This removes N−1 disk writes, temporary copies, and SHA-256 passes and avoids truncating a file being read.applyPatch() is a thin one-patch wrapper over applyPatchChainInMemory(), while applyPatchToMemory() serves callers that already hold the base bytes in memory.binpatch’s file cache uses <fromVersion>-<toVersion>.patch for raw patch bytes and chain-<fromVersion>-<toVersion>.json for metadata. makeCache(cacheDir) injects the cache location, creates it lazily on first write, and treats a missing directory as empty; cache operations are save(), load(), cleanup(), and clear().ChainMeta stores fromVersion, toVersion, expectedSha256, cachedAt, and ordered PatchStepMeta[]; each patch-step entry stores fromVersion, toVersion, and exact size.binpatch wire-contract values are MAX_STABLE_CHAIN_DEPTH = 10, MAX_NIGHTLY_CHAIN_DEPTH = 30, SIZE_THRESHOLD_RATIO = 0.6, and PATCH_TAG_PREFIX = "patch-".PatchChain consists of ordered patches, totalSize, final trust-anchor expectedSha256, and optional steps; a successful DeltaResult returns sha256, patchBytes, and chainLength.InstrumentHook wraps individual HTTP operations and must transparently return or reject with the wrapped function’s result; throwing inside the hook aborts the operation. Both ghcrSource() and githubReleaseSource() accept this optional per-request instrumentation.BinpatchErrorReason is exactly "network_error" | "execution_failed" | "version_not_found" | "offline_cache_miss".binpatch library never renders progress — it emits structured lifecycle events and lets the consumer attach a stderr bar, spinner, log line, or no handler. Ordered phases are "resolve", "download", "apply", and "verify"; events are phase, bytes with written and nullable total, and done.safeProgress() wraps a potentially throwing ProgressHandler so consumer progress code can never abort the underlying operation; progress is cosmetic and no handler means silent operation.SourceStrategy.resolveChain() returns an oldest-first patch chain or null; a null return always falls back to a full download. Its optional unavailable report never changes control flow—a null return is always a full-download fallback."no_patches" for no published deltas, "malformed_chain" for a published but broken chain, "too_long" for exceeding depth, "over_budget" for exceeding the size-ratio gate, and "network" for transient resolution failure.resolveAndApply() checks the cache first, accesses the source only when not offline, applies the chain, verifies final SHA-256, writes destPath, and returns DeltaResult | null; genuine apply/verification failures such as corrupt patches or SHA mismatch throw, and the caller then falls back to a full download.DeltaSource is "cache" | "network" | "offline_miss"; telemetry hooks are onResolved, onOfflineMiss, and onUnavailable, but the library itself remains telemetry-agnostic.OciClient is an anonymous read-only OCI/GHCR client with injected registry, repo, userAgent, and optional fetch; it exchanges pull tokens, fetches manifests, paginates/list tags, and downloads blobs. GHCR blob redirects are followed manually without the Authorization header because forwarding it to Azure Blob Storage produces a 404.<patchTagPrefix><version>, annotation from-version=<prev>, annotation sha256-<binaryName>=<hex>, and a patch layer titled <binaryName>.patch; the target image’s <binaryName>.gz layer supplies the full-download size for the ratio gate.ghcrSource() requires injected binaryName, targetTag(version), and a semver-aware compareVersions(a, b) returning -1 | 0 | 1; optional instrumentation wraps token exchange, manifest fetches, tag listing, and blob downloads.githubReleaseSource() expects each release to provide <binaryName>, <binaryName>.gz, and <binaryName>.patch; the binary asset digest is the expected SHA-256, the gzip asset size drives the 0.6 ratio gate, and release patches are capped at MAX_STABLE_CHAIN_DEPTH = 10.extractStableChain() finds current and target release indices, returns "no_patches" if either is absent or ordering is invalid, slices releases from target to current, returns "too_long" above 10 hops, returns "malformed_chain" when the target binary digest or any patch asset is missing, and returns "over_budget" once cumulative patch bytes exceed fullGzSize * SIZE_THRESHOLD_RATIO.extractStableChain() reverses downloaded patch URLs into oldest-first apply order and builds exact { fromVersion, toVersion } steps beginning at currentVersion and advancing release by release to targetVersion.githubReleaseSource() requests ${releasesUrl}?per_page=${MAX_STABLE_CHAIN_DEPTH + 2}—12 releases—with Accept: application/vnd.github.v3+json and the configured User-Agent; fetch exceptions or non-OK responses yield null."network"; absent target release reports "no_patches"; absent target <binaryName>.gz reports "malformed_chain"; and extractStableChain() reports its exact "no_patches", "malformed_chain", "too_long", or "over_budget" result before returning null.