@addai/node 0.30.12 → 0.30.14

package/dist/entitybox-execution-container.js

@@ -0,0 +1,450 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EntityboxExecutionContainer = void 0;
+const child_process_1 = require("child_process");
+const entitybox_operation_1 = require("./entitybox-operation");
+const util_1 = require("util");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const crypto_1 = require("crypto");
+const entitybox_execution_lease_1 = require("./entitybox-execution-lease");
+const entitybox_display_binding_1 = require("./entitybox-display-binding");
+const exec = (0, util_1.promisify)(child_process_1.execFile);
+const label = 'ai.add.entitybox.execution';
+/** Owns a new container by its immutable ID. It never enters, mounts, changes
+ * or stops a native desktop. External tool actions must acquire their own
+ * verified stop boundary before this can serve as a complete task executor. */
+class EntityboxExecutionContainer {
+    lease;
+    options;
+    proc;
+    docker;
+    watchdogDigest;
+    actionSource;
+    done;
+    id;
+    failureCode;
+    stopped;
+    output = '';
+    modelExit;
+    closed = false;
+    stopping = false;
+    ready = false;
+    started;
+    startedResolve;
+    startedReject;
+    actions = new Set();
+    requests = new Map();
+    constructor(lease, options, id, proc, docker, watchdogDigest, actionSource) {
+        this.lease = lease;
+        this.options = options;
+        this.proc = proc;
+        this.docker = docker;
+        this.watchdogDigest = watchdogDigest;
+        this.actionSource = actionSource;
+        this.id = id;
+        this.started = new Promise((resolve, reject) => { this.startedResolve = resolve; this.startedReject = reject; });
+        this.started.catch(() => { });
+        this.done = new Promise(resolve => {
+            proc.on('error', () => { this.startedReject(new entitybox_execution_lease_1.EntityboxExecutionError('Executor startup ended')); lease.fence(); resolve(70); });
+            proc.on('close', code => { this.closed = true; this.startedReject(new entitybox_execution_lease_1.EntityboxExecutionError('Executor startup ended')); for (const value of this.requests.values())
+                value.abort.abort(); resolve(code === 0 && this.modelExit === 0 ? 0 : 70); });
+        });
+        proc.stdin.on('error', () => lease.fence());
+        proc.stdout.setEncoding('utf8');
+        proc.stdout.on('data', chunk => this.consume(chunk));
+        proc.stderr.resume(); // Docker/model stderr is not a transcript or public error.
+        lease.signal.addEventListener('abort', () => { void this.stopAndVerify().catch(() => { }); }, { once: true });
+        proc.stdin.write(JSON.stringify({ type: 'configure', identity: lease.identity, display: options.display ? ':1' : undefined, command: options.command, task: options.task }) + '\n');
+        if (lease.signal.aborted)
+            void this.stopAndVerify().catch(() => { });
+    }
+    static async start(lease, options) {
+        lease.assertActive();
+        const memory = options.memoryMiB ?? 1536;
+        if (!Number.isInteger(memory) || memory < 256 || memory > 4096 || !/^sha256:[0-9a-f]{64}$/.test(options.imageId)
+            || (options.dockerContext !== undefined && !/^[a-zA-Z0-9_.-]{1,80}$/.test(options.dockerContext))
+            || !Array.isArray(options.command) || !options.command.length || options.command.length > 32
+            || !options.command.every(v => typeof v === 'string' && v.length < 16000)
+            || Buffer.byteLength(JSON.stringify({ command: options.command, task: options.task })) > 240 * 1024)
+            throw new entitybox_execution_lease_1.EntityboxExecutionError('Invalid isolated executor configuration');
+        const prefix = options.dockerContext ? ['--context', options.dockerContext] : [];
+        const docker = async (args) => {
+            try {
+                return (await exec('docker', [...prefix, ...args], { windowsHide: true, timeout: 15000, maxBuffer: 1024 * 1024 })).stdout.trim();
+            }
+            catch {
+                throw new entitybox_execution_lease_1.EntityboxExecutionError('Isolated executor operation failed');
+            }
+        };
+        const watchdog = fs.readFileSync(path.join(__dirname, 'entitybox', 'container-watchdog.cjs'), 'utf8');
+        const actionSource = fs.readFileSync(path.join(__dirname, 'entitybox', 'container-action.cjs'), 'utf8');
+        const owner = lease.identity;
+        if (options.display) {
+            options = { ...options, display: Object.freeze({ ...options.display }) };
+            await (0, entitybox_display_binding_1.verifyEntityboxDisplay)(options.display, owner.scope, docker);
+            lease.assertActive();
+        }
+        const name = 'entitybox-execution-' + owner.attemptId;
+        const digest = (0, crypto_1.createHash)('sha256').update(watchdog).digest('hex');
+        const args = ['create', '-i', '--name', name, '--label', label + '=' + owner.attemptId,
+            '--label', label + '.request=' + owner.requestId, '--label', label + '.watchdog=' + digest,
+            '--init', '--restart', 'no', '--network', 'none', '--ipc', 'private', '--user', '0:0',
+            '--cpus', '1', '--memory', memory + 'm', '--memory-swap', memory + 'm', '--pids-limit', '96',
+            '--cap-drop', 'ALL', '--cap-add', 'SETUID', '--cap-add', 'SETGID', '--security-opt', 'no-new-privileges',
+            '--read-only', '--tmpfs', '/tmp:rw,noexec,nosuid,nodev,size=64m,mode=1777',
+            '--tmpfs', '/run/entitybox:rw,noexec,nosuid,nodev,size=1m,mode=700',
+            '--tmpfs', '/work:rw,nosuid,nodev,size=64m,uid=10001,gid=10001,mode=755',
+            '--tmpfs', '/home/entitybox:rw,noexec,nosuid,nodev,size=64m,uid=10001,gid=10001,mode=700',
+            ...(options.display ? ['--mount', 'type=volume,src=' + (0, entitybox_display_binding_1.entityboxDisplayVolume)(options.display) + ',dst=/tmp/.X11-unix,readonly,volume-nocopy'] : []),
+            '--workdir', '/', '--entrypoint', 'node', options.imageId, '-e', watchdog];
+        let id;
+        try {
+            id = await docker(args);
+        }
+        catch {
+            // An ambiguous create may have committed. Leave its never-started record
+            // for explicit reconciliation; never adopt an object by name alone.
+            lease.fence();
+            throw new entitybox_execution_lease_1.EntityboxExecutionError('Isolated executor could not be created');
+        }
+        if (!/^[0-9a-f]{64}$/.test(id)) {
+            lease.fence();
+            throw new entitybox_execution_lease_1.EntityboxExecutionError('Isolated executor identity unavailable');
+        }
+        try {
+            const inspected = JSON.parse(await docker(['container', 'inspect', id]))[0];
+            if (inspected.Id !== id || inspected.Image !== options.imageId || inspected.Config?.Labels?.[label] !== owner.attemptId
+                || inspected.Config?.Labels?.[label + '.request'] !== owner.requestId || inspected.Config?.Labels?.[label + '.watchdog'] !== digest
+                || inspected.State?.Running || inspected.State?.Status !== 'created' || inspected.HostConfig?.RestartPolicy?.Name !== 'no')
+                throw new Error();
+            lease.assertActive();
+            if (options.display)
+                await (0, entitybox_display_binding_1.verifyEntityboxDisplay)(options.display, owner.scope, docker);
+            if (options.onCreated)
+                await (0, entitybox_operation_1.entityboxOperation)([lease.signal], 10000, () => options.onCreated(Object.freeze({ containerId: id, imageId: options.imageId, watchdogSha256: digest })));
+            lease.assertActive();
+        }
+        catch {
+            lease.fence();
+            // The verified create returned this full ID; removing an unstarted
+            // container cannot dispatch or interrupt any other task.
+            await docker(['container', 'rm', id]).catch(() => { });
+            throw new entitybox_execution_lease_1.EntityboxExecutionError('Isolated executor could not be verified');
+        }
+        const proc = (0, child_process_1.spawn)('docker', [...prefix, 'start', '--attach', '--interactive', id], { windowsHide: true, stdio: ['pipe', 'pipe', 'pipe'] });
+        return new EntityboxExecutionContainer(lease, options, id, proc, docker, digest, actionSource);
+    }
+    consume(chunk) {
+        try {
+            this.output += chunk;
+            if (Buffer.byteLength(this.output) > 1024 * 1024)
+                throw new Error();
+            let end;
+            while ((end = this.output.indexOf('\n')) >= 0) {
+                const packet = JSON.parse(this.output.slice(0, end));
+                this.output = this.output.slice(end + 1);
+                if (packet.type === 'challenge' && typeof packet.id === 'string' && /^[0-9a-f-]{36}$/.test(packet.id)) {
+                    void this.grant(packet.id);
+                }
+                else if (packet.type === 'broker_request' && typeof packet.id === 'string' && /^[-0-9a-f]{36}$/.test(packet.id)) {
+                    this.broker(packet.id, packet.request);
+                }
+                else if (packet.type === 'broker_cancel' && typeof packet.id === 'string') {
+                    this.requests.get(packet.id)?.abort.abort();
+                }
+                else if (packet.type === 'output' && typeof packet.data === 'string' && /^[A-Za-z0-9+/]*={0,2}$/.test(packet.data)) {
+                    this.lease.assertActive();
+                    this.options.onOutput(Buffer.from(packet.data, 'base64'));
+                }
+                else if (packet.type === 'model_exit' && Number.isInteger(packet.code)) {
+                    this.modelExit = packet.code;
+                }
+                else if (packet.type === 'started') {
+                    this.ready = true;
+                    this.startedResolve();
+                }
+                else
+                    throw new Error();
+            }
+        }
+        catch {
+            this.lease.fence();
+        }
+    }
+    broker(id, request) {
+        this.lease.assertActive();
+        if (this.requests.size >= 8 || this.requests.has(id))
+            throw new Error();
+        const abort = new AbortController();
+        const send = async (event) => { this.lease.assertActive(); if (abort.signal.aborted || this.closed)
+            throw new Error(); const packet = JSON.stringify({ type: 'broker_event', id, event }) + '\n'; if (!this.proc.stdin.write(packet))
+            await new Promise((resolve, reject) => { const done = () => { clean(); resolve(); }, ended = () => { clean(); reject(new Error()); }, clean = () => { this.proc.stdin.removeListener('drain', done); abort.signal.removeEventListener('abort', ended); }; this.proc.stdin.once('drain', done); abort.signal.addEventListener('abort', ended, { once: true }); if (abort.signal.aborted)
+                ended(); }); };
+        const done = Promise.resolve().then(async () => { try {
+            if (!this.options.onBroker)
+                throw new Error();
+            await this.options.onBroker(request, abort.signal, send);
+        }
+        catch {
+            if (!abort.signal.aborted) {
+                this.failureCode = 'entitybox_broker_connection_failed';
+                this.lease.fence();
+            }
+        }
+        finally {
+            this.requests.delete(id);
+        } });
+        this.requests.set(id, { abort, done });
+    }
+    async grant(id) {
+        try {
+            if (this.options.display)
+                await (0, entitybox_display_binding_1.verifyEntityboxDisplay)(this.options.display, this.lease.identity.scope, this.docker);
+            await this.lease.authorizeQueuedChallenge();
+            this.lease.assertActive();
+            if (!this.closed && !this.stopping)
+                this.proc.stdin.write(JSON.stringify({ type: 'grant', id }) + '\n');
+        }
+        catch {
+            this.lease.fence();
+        }
+    }
+    get scope() { return this.lease.identity.scope; }
+    async whenStarted() {
+        let timer;
+        try {
+            await Promise.race([this.started, new Promise((_, reject) => { timer = setTimeout(() => reject(new entitybox_execution_lease_1.EntityboxExecutionError('Executor startup deadline ended')), 10000); })]);
+            this.lease.assertActive();
+        }
+        catch {
+            this.lease.fence();
+            throw new entitybox_execution_lease_1.EntityboxExecutionError('Executor startup ended');
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    get executionIdentity() { return this.lease.identity; }
+    get hasDedicatedDisplay() { return !!this.options.display; }
+    async assertActive() {
+        this.lease.assertActive();
+        if (this.stopping || this.closed || !this.ready)
+            throw new entitybox_execution_lease_1.EntityboxExecutionError('Isolated executor is unavailable');
+        const c = await this.inspectOwned();
+        if (!c.State?.Running || c.State.Pid <= 0)
+            throw new entitybox_execution_lease_1.EntityboxExecutionError('Isolated executor ended');
+        if (this.options.display)
+            await (0, entitybox_display_binding_1.verifyEntityboxDisplay)(this.options.display, this.scope, this.docker);
+        this.lease.assertActive();
+        if (this.stopping || this.closed)
+            throw new entitybox_execution_lease_1.EntityboxExecutionError('Isolated executor ended');
+    }
+    async inspectOwned() {
+        const v = JSON.parse(await this.docker(['container', 'inspect', this.id]))[0];
+        if (v.Id !== this.id || v.Config?.Labels?.[label] !== this.lease.identity.attemptId
+            || v.Config?.Labels?.[label + '.request'] !== this.lease.identity.requestId
+            || v.Config?.Labels?.[label + '.watchdog'] !== this.watchdogDigest || v.Image !== this.options.imageId
+            || v.HostConfig?.RestartPolicy?.Name !== 'no')
+            throw new entitybox_execution_lease_1.EntityboxExecutionError('Executor ownership changed');
+        return v;
+    }
+    /** Commands run only in this task's PID namespace. No native desktop, host
+     * execution or remote-queue fallback is permitted here. A lost exec transport
+     * fences the entire task: closing a Docker client is not proof of inner stop. */
+    async executeAction(options) {
+        const timeoutMs = options.timeoutMs ?? 60000;
+        if (!Array.isArray(options.argv) || !options.argv.length || options.argv.length > 64 || !options.argv[0]
+            || !options.argv.every(v => typeof v === 'string' && v.length <= 32768 && !v.includes('\0'))
+            || (options.input !== undefined && !Buffer.isBuffer(options.input))
+            || (options.display !== undefined && (options.display !== ':1' || !this.options.display))
+            || !Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 600000)
+            throw new entitybox_execution_lease_1.EntityboxExecutionError('Invalid isolated action');
+        const packet = JSON.stringify({ version: 1, actionId: (0, crypto_1.randomUUID)(), identity: this.lease.identity,
+            argv: options.argv, input: (options.input ?? Buffer.alloc(0)).toString('base64'), timeoutMs, display: options.display });
+        if (Buffer.byteLength(packet) > 512 * 1024)
+            throw new entitybox_execution_lease_1.EntityboxExecutionError('Isolated action input is too large');
+        this.lease.assertActive();
+        if (this.stopping || this.closed || !this.ready || this.actions.size >= 8)
+            throw new entitybox_execution_lease_1.EntityboxExecutionError('Isolated executor is unavailable');
+        if (options.signal?.aborted) {
+            this.lease.fence();
+            throw new entitybox_execution_lease_1.EntityboxExecutionError('Isolated action canceled');
+        }
+        // Register before the first await, so Stop also owns actions awaiting Docker
+        // inspection. Recheck authority after that asynchronous preparation.
+        let settle;
+        const done = new Promise(resolve => { settle = resolve; });
+        this.actions.add(done);
+        try {
+            const inspected = await this.inspectOwned();
+            if (this.options.display)
+                await (0, entitybox_display_binding_1.verifyEntityboxDisplay)(this.options.display, this.scope, this.docker);
+            this.lease.assertActive();
+            if (this.stopping || this.closed || options.signal?.aborted || !inspected.State?.Running || inspected.State.Pid <= 0)
+                throw new Error();
+            const prefix = this.options.dockerContext ? ['--context', this.options.dockerContext] : [];
+            const proc = (0, child_process_1.spawn)('docker', [...prefix, 'exec', '--interactive', '--user', '0:0', this.id, 'node', '-e', this.actionSource], { windowsHide: true, stdio: ['pipe', 'pipe', 'pipe'] });
+            return await new Promise((resolve, reject) => {
+                const stdout = [], stderr = [];
+                let raw = '', bytes = 0, code, invalid = false, closed = false;
+                const fail = () => {
+                    if (invalid)
+                        return;
+                    invalid = true;
+                    this.lease.fence();
+                    // This is the still-owned client object; namespace shutdown is proved
+                    // separately before any lease acknowledgement can release the screen.
+                    proc.stdin.destroy();
+                    if (!closed)
+                        proc.kill();
+                };
+                const timer = setTimeout(fail, timeoutMs + 10000);
+                this.lease.signal.addEventListener('abort', fail, { once: true });
+                options.signal?.addEventListener('abort', fail, { once: true });
+                proc.stdin.on('error', fail);
+                proc.on('error', fail);
+                proc.stderr.resume();
+                proc.stdout.setEncoding('utf8');
+                proc.stdout.on('data', chunk => {
+                    try {
+                        if (invalid)
+                            return;
+                        raw += chunk;
+                        if (Buffer.byteLength(raw) > 1024 * 1024)
+                            throw new Error();
+                        let end;
+                        while ((end = raw.indexOf('\n')) >= 0) {
+                            const p = JSON.parse(raw.slice(0, end));
+                            raw = raw.slice(end + 1);
+                            if (code !== undefined)
+                                throw new Error();
+                            if (p.type === 'result' && Number.isInteger(p.code) && p.code >= 0 && p.code <= 255)
+                                code = p.code;
+                            else if (['stdout', 'stderr'].includes(p.type) && typeof p.data === 'string' && p.data.length % 4 === 0 && /^[A-Za-z0-9+/]*={0,2}$/.test(p.data)) {
+                                const data = Buffer.from(p.data, 'base64');
+                                bytes += data.length;
+                                if (bytes > 32 * 1024 * 1024)
+                                    throw new Error();
+                                (p.type === 'stdout' ? stdout : stderr).push(data);
+                            }
+                            else
+                                throw new Error();
+                        }
+                    }
+                    catch {
+                        fail();
+                    }
+                });
+                proc.once('close', (exitCode, signal) => {
+                    closed = true;
+                    clearTimeout(timer);
+                    this.lease.signal.removeEventListener('abort', fail);
+                    options.signal?.removeEventListener('abort', fail);
+                    if (invalid || signal || exitCode !== 0 || code === undefined || raw || this.stopping || this.lease.signal.aborted) {
+                        this.lease.fence();
+                        reject(new entitybox_execution_lease_1.EntityboxExecutionError('Isolated action could not complete'));
+                        return;
+                    }
+                    try {
+                        this.lease.assertActive();
+                        resolve({ stdout: Buffer.concat(stdout), stderr: Buffer.concat(stderr), code });
+                    }
+                    catch {
+                        reject(new entitybox_execution_lease_1.EntityboxExecutionError('Isolated action authority ended'));
+                    }
+                });
+                if (this.lease.signal.aborted || options.signal?.aborted)
+                    fail();
+                else
+                    proc.stdin.end(packet);
+            });
+        }
+        catch {
+            this.lease.fence();
+            throw new entitybox_execution_lease_1.EntityboxExecutionError('Isolated action could not complete');
+        }
+        finally {
+            this.actions.delete(done);
+            settle();
+        }
+    }
+    async stopAndVerify() {
+        if (this.stopped)
+            return this.stopped;
+        this.stopping = true;
+        this.stopped = Promise.resolve().then(() => this.stopOwned());
+        this.lease.fence();
+        try {
+            await this.stopped;
+        }
+        catch (error) {
+            this.stopped = undefined;
+            throw error;
+        }
+    }
+    async stopOwned() {
+        // No more grants or task output are accepted while containment is stopping.
+        // Do not recurse through fence()'s abort listener: this method is idempotent.
+        const pending = [...this.requests.values()];
+        for (const value of pending)
+            value.abort.abort();
+        const actions = [...this.actions];
+        const before = await this.inspectOwned();
+        if (before.State.Running)
+            await this.docker(['container', 'kill', this.id]);
+        const after = await this.inspectOwned();
+        if (after.State.Running || after.State.Pid !== 0 || !['exited', 'created', 'dead'].includes(after.State.Status))
+            throw new entitybox_execution_lease_1.EntityboxExecutionError('Executor has not stopped');
+        let timer;
+        try {
+            await Promise.race([Promise.all([...pending.map(v => v.done), ...actions]), new Promise((_, reject) => { timer = setTimeout(() => reject(new entitybox_execution_lease_1.EntityboxExecutionError('Executor requests have not stopped')), 20000); })]);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        this.proc.stdin.destroy();
+        if (!this.closed)
+            await this.done;
+    }
+    /** Keep the stopped resource until the caller has recorded its stop receipt.
+     * Missing/unverifiable resources cannot themselves prove process shutdown. */
+    async removeStopped() {
+        await this.stopAndVerify();
+        await this.docker(['container', 'rm', this.id]);
+    }
+}
+exports.EntityboxExecutionContainer = EntityboxExecutionContainer;

package/dist/entitybox-execution-host.d.ts

@@ -0,0 +1,40 @@
+import { readEntityboxCapacity } from './entitybox-capacity-provisioner';
+import { createEntityboxNativeServices, type EntityboxNativeServicesTransport } from './entitybox-native-services';
+import type { EntityboxQueueServices } from './entitybox-queue-request';
+export interface EntityboxExecutionHostConfiguration {
+    enabled: true;
+    imageId: string;
+    capacityImageId: string;
+    dockerContext: string;
+    capacityDirectory: string;
+    recoveryDirectory: string;
+    fileGatewayUrl?: string;
+}
+export interface EntityboxExecutionHostIO {
+    rpc: <T>(name: string, args: Record<string, unknown>) => Promise<T>;
+    pairing: () => {
+        runtimeId: string;
+        daemonToken: string;
+    } | null;
+    /** Fixture-only transports. Never read from queued requests or models. */
+    readCapacity?: typeof readEntityboxCapacity;
+    createServices?: typeof createEntityboxNativeServices;
+    transport?: EntityboxNativeServicesTransport;
+}
+export declare function entityboxExecutionEnvironment(env?: NodeJS.ProcessEnv): EntityboxExecutionHostConfiguration | undefined;
+/** Reopen only the published, physically verified capacity for this native
+ * lease. No cached inventory, ordinary-desktop adoption or host execution. */
+export declare function createEntityboxExecutionHost(config: EntityboxExecutionHostConfiguration | undefined, io: EntityboxExecutionHostIO): {
+    services: undefined;
+    stop(): void;
+} | {
+    services: EntityboxQueueServices;
+    stop(): void;
+};
+export declare function startEntityboxExecutionHost(io: EntityboxExecutionHostIO, env?: NodeJS.ProcessEnv): {
+    services: undefined;
+    stop(): void;
+} | {
+    services: EntityboxQueueServices;
+    stop(): void;
+};

package/dist/entitybox-execution-host.js

@@ -0,0 +1,168 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.entityboxExecutionEnvironment = entityboxExecutionEnvironment;
+exports.createEntityboxExecutionHost = createEntityboxExecutionHost;
+exports.startEntityboxExecutionHost = startEntityboxExecutionHost;
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+const util_1 = require("util");
+const paths_1 = require("./paths");
+const entitybox_capacity_provisioner_1 = require("./entitybox-capacity-provisioner");
+const entitybox_native_services_1 = require("./entitybox-native-services");
+const entitybox_recovery_store_1 = require("./entitybox-recovery-store");
+const entitybox_execution_lease_1 = require("./entitybox-execution-lease");
+const entitybox_file_inputs_1 = require("./entitybox-file-inputs");
+const uuid = /^[a-f0-9]{8}(-[a-f0-9]{4}){3}-[a-f0-9]{12}$/;
+const image = /^sha256:[a-f0-9]{64}$/;
+const fail = () => new entitybox_execution_lease_1.EntityboxExecutionError('The dedicated computer is not available for this task');
+const exec = (0, util_1.promisify)(child_process_1.execFile);
+const tools = Object.freeze(['click', 'press_key', 'type_text', 'screenshot', 'run_command']);
+function entityboxExecutionEnvironment(env = process.env) {
+    if (env.AINODE_ENTITYBOX_EXECUTION_ENABLED !== '1')
+        return undefined;
+    const config = {
+        enabled: true,
+        ...(env.AINODE_ENTITYBOX_FILE_INPUTS_ENABLED === '1' ? { fileGatewayUrl: (0, entitybox_file_inputs_1.entityboxFileGatewayUrl)(env.AINODE_ENTITYBOX_FILE_GATEWAY_URL ?? '') } : {}),
+        imageId: env.AINODE_ENTITYBOX_EXECUTION_IMAGE ?? '',
+        capacityImageId: env.AINODE_ENTITYBOX_CAPACITY_IMAGE ?? '',
+        dockerContext: env.AINODE_ENTITYBOX_DOCKER_CONTEXT ?? '',
+        capacityDirectory: env.AINODE_ENTITYBOX_CAPACITY_DIRECTORY ?? path.join(paths_1.RUNTIME_HOME, 'entitybox', 'capacities'),
+        recoveryDirectory: env.AINODE_ENTITYBOX_RECOVERY_DIRECTORY ?? path.join(paths_1.RUNTIME_HOME, 'entitybox', 'recovery'),
+    };
+    if (env.DOCKER_HOST)
+        throw fail();
+    validate(config);
+    return config;
+}
+function validate(c) {
+    if (c.fileGatewayUrl !== undefined)
+        (0, entitybox_file_inputs_1.entityboxFileGatewayUrl)(c.fileGatewayUrl);
+    if (!image.test(c.imageId) || !image.test(c.capacityImageId) || !/^[-a-zA-Z0-9_.]{1,80}$/.test(c.dockerContext)
+        || ![c.capacityDirectory, c.recoveryDirectory].every(d => typeof d === 'string' && path.isAbsolute(d) && !d.startsWith('\\\\'))
+        || path.resolve(c.capacityDirectory) === path.resolve(c.recoveryDirectory))
+        throw fail();
+}
+/** Reopen only the published, physically verified capacity for this native
+ * lease. No cached inventory, ordinary-desktop adoption or host execution. */
+function createEntityboxExecutionHost(config, io) {
+    if (!config?.enabled)
+        return { services: undefined, stop() { } };
+    validate(config);
+    const settings = Object.freeze({ ...config });
+    const initial = io.pairing();
+    if (!initial || !uuid.test(initial.runtimeId) || !initial.daemonToken)
+        throw fail();
+    const runtimeId = initial.runtimeId;
+    const stop = new AbortController();
+    const token = () => {
+        const current = io.pairing();
+        if (stop.signal.aborted || !current || current.runtimeId !== runtimeId || !current.daemonToken)
+            throw fail();
+        return current.daemonToken;
+    };
+    const docker = io.transport?.docker ?? (async (args) => (await exec('docker', ['--context', settings.dockerContext, ...args], { windowsHide: true, timeout: 5000, maxBuffer: 1024 * 1024 })).stdout.trim());
+    async function published(desktopId, signal) {
+        const seen = new Set(), desktops = new Set();
+        let after = null, match;
+        for (let page = 0; page < 10; page++) {
+            if (signal.aborted)
+                throw fail();
+            const rows = await io.rpc('entitybox_native_capacity_inventory', { p_token: token(), p_after: after, p_limit: 50 });
+            token();
+            if (signal.aborted || !Array.isArray(rows) || rows.length > 50)
+                throw fail();
+            for (const row of rows) {
+                if (!row || ![row.id, row.runtimeId, row.desktopId].every(v => typeof v === 'string' && uuid.test(v))
+                    || row.runtimeId !== runtimeId || !['reserved', 'provisioning', 'ready'].includes(row.phase)
+                    || seen.has(row.id) || desktops.has(row.desktopId) || after !== null && row.id <= after)
+                    throw fail();
+                seen.add(row.id);
+                desktops.add(row.desktopId);
+                after = row.id;
+                if (row.desktopId === desktopId)
+                    match = row;
+            }
+            if (rows.length < 50) {
+                if (match?.phase !== 'ready' || match.receipt?.dockerContext !== settings.dockerContext
+                    || match.receipt.application?.imageId !== settings.capacityImageId || match.receipt.display?.imageId !== settings.capacityImageId)
+                    throw fail();
+                // Snapshot before asynchronous physical reads; transport objects cannot
+                // replace the server evidence while those reads are pending.
+                const expected = (0, entitybox_recovery_store_1.entityboxCanonical)(match.receipt);
+                const receipt = await (io.readCapacity ?? entitybox_capacity_provisioner_1.readEntityboxCapacity)(settings.capacityDirectory, desktopId, runtimeId, docker);
+                token();
+                if (signal.aborted || (0, entitybox_recovery_store_1.entityboxCanonical)(receipt) !== expected)
+                    throw fail();
+                return receipt;
+            }
+        }
+        throw fail();
+    }
+    const services = {
+        signal: stop.signal,
+        prepare: async (request, lease, signal) => {
+            try {
+                token();
+                lease.assertActive();
+                if (signal.aborted || request.runtime_id !== runtimeId || request.id !== lease.identity.requestId
+                    || request.desktop_id !== lease.identity.scope.desktopId || lease.identity.scope.runtimeId !== runtimeId)
+                    throw fail();
+                const capacity = await published(request.desktop_id, signal);
+                token();
+                lease.assertActive();
+                const adapter = (io.createServices ?? entitybox_native_services_1.createEntityboxNativeServices)({ enabled: true, runtimeId,
+                    imageId: settings.imageId, dockerContext: settings.dockerContext, recoveryDirectory: settings.recoveryDirectory,
+                    capacities: [capacity], desktopTools: tools, ...(settings.fileGatewayUrl ? { fileGatewayUrl: settings.fileGatewayUrl } : {}) }, { ...io.transport, docker });
+                if (!adapter)
+                    throw fail();
+                return await adapter.prepare(request, lease, signal);
+            }
+            catch {
+                throw fail();
+            }
+        },
+    };
+    return { services, stop() { stop.abort(); } };
+}
+function startEntityboxExecutionHost(io, env = process.env) {
+    try {
+        return createEntityboxExecutionHost(entityboxExecutionEnvironment(env), io);
+    }
+    catch {
+        console.warn('[entitybox] Computer task execution is disabled: host configuration unavailable.');
+        return { services: undefined, stop() { } };
+    }
+}