@addai/node 0.30.13 → 0.30.14

package/dist/direct/worker.js

@@ -0,0 +1,278 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runDirectWorker = runDirectWorker;
+const path = __importStar(require("node:path"));
+const ws_1 = __importDefault(require("ws"));
+const store_1 = require("../store");
+const paths_1 = require("../paths");
+const sessions_1 = require("./sessions");
+const board_chat_1 = require("./board-chat");
+const launch_1 = require("./launch");
+const protocol_1 = require("./protocol");
+function runDirectWorker() {
+    const roots = JSON.parse(process.env.AINODE_DIRECT_ROOTS ?? '[]');
+    if (!Array.isArray(roots) || roots.some(r => typeof r !== 'string'))
+        throw new Error('AINODE_DIRECT_ROOTS must be a JSON array of project folders.');
+    const endpoint = (0, protocol_1.relayUrl)(process.env.AINODE_DIRECT_RELAY_URL ?? '', '/node');
+    const healthUrl = new URL(endpoint);
+    healthUrl.protocol = healthUrl.protocol === 'wss:' ? 'https:' : 'http:';
+    healthUrl.pathname = '/health';
+    const maxActive = Number(process.env.AINODE_DIRECT_MAX_SESSIONS ?? 2);
+    if (!Number.isInteger(maxActive) || maxActive < 1 || maxActive > 8)
+        throw new Error('Direct-session limit must be between 1 and 8.');
+    let ws = null;
+    let stopped = false;
+    let ready = false;
+    let retry;
+    let retryMs = 1000;
+    let boundToken;
+    let relayId;
+    let lastPing = Date.now();
+    let queued = 0;
+    let accepting = true;
+    let chain = Promise.resolve();
+    const connectedViewers = new Set();
+    let chats;
+    const notifyParent = (count) => { if (process.connected)
+        process.send?.({ type: 'direct-count', count }); };
+    function send(value) {
+        if (!ready || ws?.readyState !== ws_1.default.OPEN)
+            return;
+        if (ws.bufferedAmount > 4 * 1024 * 1024) {
+            ws.close(1013, 'Reconnecting a slow connection.');
+            return;
+        }
+        ws.send(JSON.stringify(value));
+    }
+    const sessions = new sessions_1.DirectSessions({
+        directory: path.join(paths_1.RUNTIME_HOME, 'direct-sessions'), roots, maxActive,
+        providers: launch_1.directProviders, spawn: launch_1.spawnDirect,
+        emit: (viewerId, event) => send({ type: 'event', viewerId, event }),
+        onCount: count => notifyParent(count + (chats?.count ?? 0)),
+        canStart: () => sessions.count + (chats?.count ?? 0) < maxActive,
+    });
+    chats = new board_chat_1.BoardChats({
+        directory: path.join(paths_1.RUNTIME_HOME, 'board-chats'),
+        emit: (viewerId, event) => send({ type: 'event', viewerId, event }),
+        canStart: () => accepting && sessions.count + (chats?.count ?? 0) < maxActive,
+        onCount: () => notifyParent(sessions.count + (chats?.count ?? 0)),
+    });
+    notifyParent(0);
+    function schedule() {
+        if (stopped)
+            return;
+        retry = setTimeout(connect, retryMs);
+        retryMs = Math.min(retryMs * 2, 30_000);
+    }
+    function connect() {
+        if (stopped)
+            return;
+        const pairing = (0, store_1.readPairing)();
+        if (!pairing) {
+            schedule();
+            return;
+        }
+        if (boundToken && boundToken !== pairing.daemonToken) {
+            // Pairing ownership changed: never carry interactive sessions into a different pairing.
+            stop();
+            return;
+        }
+        boundToken = pairing.daemonToken;
+        const socket = new ws_1.default(endpoint, { maxPayload: protocol_1.MAX_FRAME, perMessageDeflate: false });
+        ws = socket;
+        ready = false;
+        lastPing = Date.now();
+        const handshake = setTimeout(() => socket.terminate(), 12_000);
+        socket.on('open', () => socket.send(JSON.stringify({ type: 'authenticate', token: pairing.daemonToken })));
+        socket.on('ping', () => { lastPing = Date.now(); });
+        socket.on('error', () => { });
+        socket.on('close', () => {
+            clearTimeout(handshake);
+            if (ws !== socket)
+                return;
+            ready = false;
+            ws = null;
+            connectedViewers.clear();
+            sessions.detachAll();
+            chats?.detachAll();
+            schedule();
+        });
+        socket.on('message', raw => {
+            if (ws !== socket)
+                return;
+            let message;
+            try {
+                message = JSON.parse(raw.toString());
+            }
+            catch {
+                socket.close(1008, 'Invalid protocol.');
+                return;
+            }
+            if (message.type === 'ready') {
+                if (message.protocol !== protocol_1.DIRECT_PROTOCOL || message.runtimeId !== pairing.runtimeId) {
+                    socket.close(1008, 'Incompatible relay.');
+                    return;
+                }
+                clearTimeout(handshake);
+                ready = true;
+                retryMs = 1000;
+                relayId = message.relayId;
+                return;
+            }
+            if (!ready || !protocol_1.UUID.test(message.viewerId ?? ''))
+                return;
+            if (message.type === 'detach_viewer') {
+                connectedViewers.delete(message.viewerId);
+                sessions.detach(message.viewerId);
+                chats?.disconnect(message.viewerId);
+                return;
+            }
+            if (message.type !== 'request' || !protocol_1.UUID.test(message.ownerId ?? ''))
+                return;
+            connectedViewers.add(message.viewerId);
+            if (++queued > 128) {
+                queued--;
+                socket.close(1013, 'Request queue full.');
+                return;
+            }
+            const viewerId = message.viewerId;
+            chain = chain.then(async () => {
+                // A queued create/input from a disconnected viewer must never execute later.
+                if (ws !== socket || !ready || !connectedViewers.has(viewerId))
+                    return;
+                const id = message.request?.id;
+                try {
+                    if (!accepting && ['create', 'resume'].includes(message.request?.op))
+                        throw new Error('The node is updating. Try again after it reconnects.');
+                    const result = message.request?.op === 'chat'
+                        ? chats.request(viewerId, message.ownerId, message.request)
+                        : await sessions.request(viewerId, message.ownerId, message.request);
+                    if (message.request?.op === 'describe')
+                        result.chat = { version: 1, providers: ['codex'] };
+                    if (!connectedViewers.has(viewerId)) {
+                        sessions.detach(viewerId);
+                        chats?.disconnect(viewerId);
+                        return;
+                    }
+                    if (typeof result?.screen === 'string') {
+                        const screen = result.screen;
+                        // Snapshot chunks keep every relay frame bounded, even for colourful wide terminals.
+                        for (let i = 0; i < screen.length; i += 16_384)
+                            send({ type: 'snapshot', viewerId, id, data: screen.slice(i, i + 16_384) });
+                        delete result.screen;
+                    }
+                    send({ type: 'response', viewerId, id, ok: true, result });
+                }
+                catch (err) {
+                    send({ type: 'response', viewerId, id, ok: false, error: err.message });
+                }
+            }).catch(() => { }).finally(() => { queued--; });
+        });
+    }
+    let checking = false;
+    const health = setInterval(async () => {
+        notifyParent(sessions.count + (chats?.count ?? 0));
+        if (boundToken && (0, store_1.readPairing)()?.daemonToken !== boundToken) {
+            stop();
+            return;
+        }
+        if (ready && Date.now() - lastPing > 75_000)
+            ws?.terminate();
+        if (!ready || checking)
+            return;
+        checking = true;
+        try {
+            const response = await fetch(healthUrl, { signal: AbortSignal.timeout(5000) });
+            const data = await response.json();
+            // Reconnect to the current deployment rather than an old draining relay instance.
+            if (response.ok && relayId && data.relayId && relayId !== data.relayId)
+                ws?.close(1012, 'Relay updated.');
+        }
+        catch { /* Ping timeout handles a failed link; a failed health check does not end sessions. */ }
+        finally {
+            checking = false;
+        }
+    }, 15_000);
+    function stop() {
+        if (stopped)
+            return;
+        stopped = true;
+        ready = false;
+        clearInterval(health);
+        if (retry)
+            clearTimeout(retry);
+        ws?.terminate();
+        connectedViewers.clear();
+        sessions.stop();
+        chats?.stop();
+        if (process.connected)
+            process.disconnect();
+    }
+    process.once('disconnect', stop);
+    process.once('SIGTERM', stop);
+    process.once('SIGINT', stop);
+    process.on('message', (value) => {
+        if (value?.type === 'direct-stop')
+            stop();
+        if (value?.type === 'direct-accept')
+            accepting = true;
+        if (value?.type === 'direct-quiesce') {
+            accepting = false;
+            void chain.then(() => {
+                const count = sessions.count + (chats?.count ?? 0);
+                if (count > 0)
+                    accepting = true;
+                if (process.connected)
+                    process.send?.({ type: 'direct-quiesced', id: value.id, count });
+            });
+        }
+    });
+    connect();
+    return stop;
+}
+if (require.main === module) {
+    try {
+        runDirectWorker();
+    }
+    catch (err) {
+        if (process.connected)
+            process.send?.({ type: 'direct-error', message: err.message });
+        process.exitCode = 1;
+    }
+}

package/dist/entitybox/container-action.cjs

@@ -0,0 +1,85 @@
+'use strict';
+// Trusted root entrypoint for one command. Input and command output are separate
+// from the watchdog's renewal channel; neither can grant more execution time.
+const fs = require('node:fs');
+const {spawn} = require('node:child_process');
+const authorityPath = '/run/entitybox/authority.json';
+const uuid = x => typeof x === 'string' && /^[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}$/.test(x);
+let packet, child, watchdogPid, input = '', launched = false, finished = false, timer;
+const now = () => process.hrtime.bigint();
+if (process.getuid?.() !== 0 || !fs.existsSync('/.dockerenv')) process.exit(78);
+
+function sameIdentity(a, b) {
+ return a && b && a.requestId === b.requestId && a.attemptId === b.attemptId
+  && a.scope?.version === 1 && b.scope?.version === 1
+  && ['runId','desktopId','runtimeId'].every(k => a.scope[k] === b.scope[k]);
+}
+function authority() {
+ const dir = fs.lstatSync('/run/entitybox'), stat = fs.lstatSync(authorityPath);
+ if (!dir.isDirectory() || dir.uid !== 0 || (dir.mode & 0o777) !== 0o700
+  || !stat.isFile() || stat.uid !== 0 || (stat.mode & 0o777) !== 0o600 || stat.size > 4096) throw Error();
+ const a = JSON.parse(fs.readFileSync(authorityPath, 'utf8'));
+ if (a.version !== 1 || !sameIdentity(a.identity, packet.identity) || a.phase !== 'running'
+  || (packet.display !== undefined && (packet.display !== ':1' || a.display !== packet.display))
+  || typeof a.expiresNs !== 'string' || !/^\d{1,30}$/.test(a.expiresNs)
+  || !Number.isSafeInteger(a.watchdogPid) || a.watchdogPid <= 1 || a.watchdogPid === process.pid) throw Error();
+ // Remember only a root-owned, correctly scoped watchdog identity. If a running
+ // action loses authority, end the namespace, including detached descendants.
+ watchdogPid = a.watchdogPid;
+ if (now() >= BigInt(a.expiresNs)) throw Error();
+ return a;
+}
+function fail() {
+ if (finished) return;
+ finished = true; clearInterval(timer);
+ if (launched && watchdogPid) {try {process.kill(watchdogPid, 'SIGTERM');} catch {}}
+ process.stderr.write('EntityBox action authority ended\n');
+ process.exit(78);
+}
+function launch() {
+ clearTimeout(startup);
+ try {
+  packet = JSON.parse(input);
+  if (packet?.version !== 1 || !uuid(packet.actionId) || !uuid(packet.identity?.requestId)
+   || !uuid(packet.identity?.attemptId) || packet.identity?.scope?.version !== 1
+   || !['runId','desktopId','runtimeId'].every(k => uuid(packet.identity.scope[k]))
+   || !Array.isArray(packet.argv) || !packet.argv.length || packet.argv.length > 64
+   || !packet.argv.every(v => typeof v === 'string' && v.length <= 32768 && !v.includes('\0'))
+   || !packet.argv[0] || !Number.isInteger(packet.timeoutMs) || packet.timeoutMs < 1 || packet.timeoutMs > 600000
+   || typeof packet.input !== 'string' || packet.input.length%4!==0 || !/^[A-Za-z0-9+/]*={0,2}$/.test(packet.input)) throw Error();
+  authority();
+  // A task action ID is single-use, even if the first Docker exec reply is lost.
+  // The root-only ledger is bounded by this container's tiny private tmpfs.
+  fs.closeSync(fs.openSync('/run/entitybox/action-' + packet.actionId, 'wx', 0o600));
+  const until = now() + BigInt(packet.timeoutMs) * 1000000n;
+  authority();
+  launched = true;
+  child = spawn(packet.argv[0], packet.argv.slice(1), {
+   uid:10001, gid:10001, cwd:'/work',
+   env:{PATH:'/usr/local/bin:/usr/bin:/bin',HOME:'/home/entitybox',TERM:'dumb',NODE_ENV:'production',LANG:'C.UTF-8',...(packet.display?{DISPLAY:packet.display}:{})},
+   stdio:['pipe','pipe','pipe'], detached:false,
+  });
+  child.on('error', fail);
+  child.stdin.on('error', () => {});
+  child.stdin.end(Buffer.from(packet.input, 'base64'));
+  const emit = (type, data) => process.stdout.write(JSON.stringify({type,data:data.toString('base64')})+'\n');
+  for (const [stream, type] of [[child.stdout,'stdout'],[child.stderr,'stderr']]) {
+   stream.on('data', data => {if(!emit(type,data)) stream.pause();});
+  }
+  process.stdout.on('drain', () => {child.stdout.resume();child.stderr.resume();});
+  child.on('close', (code, signal) => {
+   if (finished) return;
+   try {authority(); if (now() >= until || signal || !Number.isInteger(code)) throw Error();} catch {fail();return;}
+   finished = true; clearInterval(timer);
+   process.stdout.write(JSON.stringify({type:'result',code})+'\n');
+  });
+  timer = setInterval(() => {try {authority(); if(now() >= until) throw Error();} catch {fail();}}, 25);
+ } catch {fail();}
+}
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', chunk => {input += chunk; if(Buffer.byteLength(input) > 512*1024) fail();});
+process.stdin.once('end', launch);
+process.stdin.on('error', fail); process.stdout.on('error', fail); process.stderr.on('error', fail);
+process.on('SIGTERM', fail); process.on('SIGINT', fail);
+// A delayed/broken transport cannot leave a root dispatcher waiting forever.
+const startup = setTimeout(fail, 10000); startup.unref();

package/dist/entitybox/container-watchdog.cjs

@@ -0,0 +1,70 @@
+'use strict';
+// Trusted container supervisor; model code runs as a different, unprivileged
+// UID. No RPC, provider or entity credentials enter this process or its child.
+const {spawn}=require('node:child_process');
+const {randomUUID}=require('node:crypto');
+const fs=require('node:fs');
+if(process.getuid?.()!==0||!fs.existsSync('/.dockerenv'))process.exit(78);
+// hrtime is shared across processes in this PID namespace. A separate trusted
+// action dispatcher can check this deadline without trusting wall-clock time.
+const now=()=>process.hrtime.bigint(),authorityPath='/run/entitybox/authority.json';
+let input='',config,child,pending,deadline=now()+10000000000n,stopped=false,challengeTimer;
+const requests=new Set();let brokerBuffer='';
+const write=value=>process.stdout.write(JSON.stringify(value)+'\n');
+function publish(phase){
+ const value={version:1,identity:config.identity,display:config.display??null,phase,expiresNs:deadline.toString(),watchdogPid:process.pid};
+ fs.writeFileSync(authorityPath+'.next',JSON.stringify(value),{mode:0o600});
+ fs.renameSync(authorityPath+'.next',authorityPath);
+}
+function stop(code){if(stopped)return;stopped=true;clearTimeout(challengeTimer);try{if(config)publish('stopped');}catch{}process.exit(code);}
+function challenge(){if(stopped||pending)return;pending={id:randomUUID(),at:now()};write({type:'challenge',id:pending.id});}
+function validIdentity(v){const uuid=x=>typeof x==='string'&&/^[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}$/.test(x);return v&&uuid(v.requestId)&&uuid(v.attemptId)&&v.scope?.version===1&&['runId','desktopId','runtimeId'].every(k=>uuid(v.scope[k]));}
+function launch(){
+ child=spawn(config.command[0],config.command.slice(1),{uid:10001,gid:10001,cwd:'/work',env:{PATH:'/usr/local/bin:/usr/bin:/bin',HOME:'/home/entitybox',TERM:'dumb',NODE_ENV:'production'},stdio:['pipe','pipe','pipe','pipe'],detached:false});
+ child.on('error',()=>stop(70));
+ child.stdio[3].setEncoding('utf8');child.stdio[3].on('error',()=>stop(70));
+ child.stdio[3].on('data',chunk=>{try{brokerBuffer+=chunk;if(Buffer.byteLength(brokerBuffer)>1024*1024)throw Error();let end;while((end=brokerBuffer.indexOf('\n'))>=0){const p=JSON.parse(brokerBuffer.slice(0,end));brokerBuffer=brokerBuffer.slice(end+1);if(typeof p.id!=='string'||!/^[-0-9a-f]{36}$/.test(p.id))throw Error();if(p.type==='broker_cancel'){if(requests.delete(p.id))write({type:'broker_cancel',id:p.id});continue;}if(p.type!=='broker_request'||requests.size>=8||requests.has(p.id))throw Error();requests.add(p.id);write({type:'broker_request',id:p.id,request:p.request});}}catch{stop(78);}});
+ // The child never writes raw control messages. Framing is exclusively owned
+ // by this root supervisor; output is encoded and backpressure pauses only
+ // the model stream, leaving lease challenges and timers independent.
+ for(const [stream,type] of [[child.stdout,'output'],[child.stderr,'diagnostic']])stream.on('data',data=>{
+  if(type==='diagnostic')return; // raw model diagnostics can contain task data
+  if(!write({type,data:data.toString('base64')}))stream.pause();
+ });
+ process.stdout.on('drain',()=>child.stdout.resume());
+ child.stdin.on('error',()=>{});child.stdin.end(JSON.stringify(config.task)+'\n');
+ child.on('close',code=>{write({type:'model_exit',code:Number.isInteger(code)?code:70});stop(Number.isInteger(code)?code:70);});
+ write({type:'started'});
+}
+function packet(value){
+ if(!config){
+  if(value?.type!=='configure'||!Array.isArray(value.command)||!value.command.length||value.command.length>32||!value.command.every(x=>typeof x==='string'&&x.length<16000)||value.task===undefined)throw Error();
+  if(!validIdentity(value.identity))throw Error();
+  if(value.display!==undefined&&value.display!==':1')throw Error();
+  const dir=fs.lstatSync('/run/entitybox');if(!dir.isDirectory()||dir.uid!==0||(dir.mode&0o777)!==0o700)throw Error();
+  config=value;publish('waiting');challenge();return;
+ }
+ if(value?.type==='broker_event'){
+  if(!requests.has(value.id))return;
+  if(now()>=deadline)throw Error();
+  child.stdio[3].write(JSON.stringify({id:value.id,event:value.event})+'\n');
+  if(['end','error'].includes(value.event?.type))requests.delete(value.id);
+  return;
+ }
+ if(value?.type==='stop'){stop(78);return;}
+ if(value?.type!=='grant'||!pending||value.id!==pending.id)throw Error();
+ const next=pending.at+12000000000n;
+ // Compare both the current authority and the original challenge deadline.
+ // Arrival time is never a new grant origin; replay cannot reset either clock.
+ if(now()>=deadline||now()>=next)throw Error();
+ deadline=next;pending=null;
+ publish('running');
+ if(!child)launch();
+ challengeTimer=setTimeout(challenge,3000);
+}
+process.stdin.setEncoding('utf8');
+process.stdin.on('data',chunk=>{try{input+=chunk;if(Buffer.byteLength(input)>1024*1024)throw Error();let end;while((end=input.indexOf('\n'))>=0){const line=input.slice(0,end);input=input.slice(end+1);packet(JSON.parse(line));}}catch{stop(78);}});
+process.stdin.on('end',()=>stop(78));process.stdin.on('error',()=>stop(78));
+process.stdout.on('error',()=>stop(78));
+process.on('SIGTERM',()=>stop(78));process.on('SIGINT',()=>stop(78));
+setInterval(()=>{if(now()>=deadline)stop(78);},50);

package/dist/entitybox/model-entry.d.ts

@@ -0,0 +1,3 @@
+/** Runs only as the isolated model user. Its extra inherited pipe carries
+ * bounded broker requests; ordinary model stdout never becomes control data. */
+export declare function runEntityboxModel(task: unknown): Promise<number>;

package/dist/entitybox/model-entry.js

@@ -0,0 +1,233 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runEntityboxModel = runEntityboxModel;
+const fs = __importStar(require("fs"));
+const http = __importStar(require("http"));
+const net = __importStar(require("net"));
+const crypto_1 = require("crypto");
+const claude_print_1 = require("../claude-print");
+const model_mcp_proxy_1 = require("./model-mcp-proxy");
+/** Runs only as the isolated model user. Its extra inherited pipe carries
+ * bounded broker requests; ordinary model stdout never becomes control data. */
+async function runEntityboxModel(task) {
+    if (process.getuid?.() !== 10001 || process.env.HOME !== '/home/entitybox' || !fs.existsSync('/.dockerenv'))
+        throw Error('Isolated model container required');
+    const t = task;
+    if (!t || typeof t.prompt !== 'string' || t.prompt.length > 12200 || typeof t.model !== 'string' || !/^[a-zA-Z0-9_.:-]{1,120}$/.test(t.model)
+        || (t.systemPrompt !== undefined && (typeof t.systemPrompt !== 'string' || t.systemPrompt.length > 64000))
+        || (t.effort !== undefined && !['low', 'medium', 'high', 'xhigh', 'max'].includes(t.effort))
+        || (t.desktopMcp !== undefined && typeof t.desktopMcp !== 'boolean')
+        || (t.allowedTools !== undefined && (!Array.isArray(t.allowedTools) || !t.allowedTools.every(x => typeof x === 'string' && x.length < 200))))
+        throw Error('Invalid isolated model task');
+    const bus = new net.Socket({ fd: 3, readable: true, writable: true }), pending = new Map();
+    let buffer = '';
+    let handle, failed = false, finishing = false, catalogReady = !t.desktopMcp, cliReady = !t.desktopMcp;
+    let readyResolve, readyReject;
+    const desktopReady = new Promise((resolve, reject) => { readyResolve = resolve; readyReject = reject; });
+    desktopReady.catch(() => { });
+    let startupTimer;
+    const maybeReady = () => { if (catalogReady && cliReady) {
+        clearTimeout(startupTimer);
+        readyResolve();
+    } };
+    const send = (packet) => { if (bus.destroyed)
+        throw Error('Broker disconnected'); bus.write(JSON.stringify(packet) + '\n'); };
+    const clearPending = () => { for (const value of pending.values()) {
+        clearTimeout(value.timer);
+        value.res.destroy();
+    } pending.clear(); };
+    const failAll = () => { if (finishing)
+        return; failed = true; readyReject(Error('Required desktop connection unavailable')); clearPending(); handle?.kill(); bus.destroy(); };
+    bus.setEncoding('utf8');
+    bus.on('error', failAll);
+    bus.on('close', failAll);
+    bus.on('data', chunk => {
+        try {
+            buffer += chunk;
+            if (Buffer.byteLength(buffer) > 1024 * 1024)
+                throw Error();
+            let end;
+            while ((end = buffer.indexOf('\n')) >= 0) {
+                const packet = JSON.parse(buffer.slice(0, end));
+                buffer = buffer.slice(end + 1);
+                const item = pending.get(packet.id);
+                if (!item)
+                    continue;
+                const event = packet.event;
+                if (event?.type === 'head' && [200, 400, 429, 502].includes(event.status) && ['application/json', 'text/event-stream'].includes(event.contentType))
+                    item.res.writeHead(event.status, { 'content-type': event.contentType });
+                else if (event?.type === 'data' && typeof event.data === 'string') {
+                    const bytes = Buffer.from(event.data, 'base64');
+                    item.res.write(bytes);
+                    if (item.catalog) {
+                        item.catalogBytes = (item.catalogBytes ?? 0) + bytes.length;
+                        if (item.catalogBytes > 512 * 1024)
+                            throw Error();
+                        item.catalog.push(bytes);
+                    }
+                }
+                else if (event?.type === 'end') {
+                    if (item.catalog) {
+                        const response = JSON.parse(Buffer.concat(item.catalog).toString('utf8'));
+                        if (!Array.isArray(response?.result?.tools) || !response.result.tools.length)
+                            throw Error();
+                        catalogReady = true;
+                    }
+                    clearTimeout(item.timer);
+                    pending.delete(packet.id);
+                    item.res.end();
+                    maybeReady();
+                }
+                else if (event?.type === 'error') {
+                    clearTimeout(item.timer);
+                    pending.delete(packet.id);
+                    if (item.res.headersSent)
+                        item.res.destroy();
+                    else {
+                        item.res.writeHead(502, { 'content-type': 'application/json' });
+                        item.res.end(JSON.stringify({ type: 'error', error: { type: 'api_error', message: 'The task connection ended.' } }));
+                    }
+                    if (t.desktopMcp)
+                        failAll();
+                }
+                else
+                    throw Error();
+            }
+        }
+        catch {
+            failAll();
+        }
+    });
+    const proxy = http.createServer(async (req, res) => {
+        const id = (0, crypto_1.randomUUID)();
+        let tracked = false;
+        try {
+            const desktop = req.url === '/entitybox/mcp' && t.desktopMcp === true;
+            if (req.method !== 'POST' || (!desktop && !['/v1/messages', '/v1/messages?beta=true', '/v1/messages/count_tokens', '/v1/messages/count_tokens?beta=true'].includes(req.url || '')) || pending.size >= 8)
+                throw Error();
+            let body = '';
+            req.setEncoding('utf8');
+            for await (const chunk of req) {
+                body += chunk;
+                if (Buffer.byteLength(body) > 512 * 1024)
+                    throw Error();
+            }
+            const message = desktop ? JSON.parse(body) : undefined;
+            // Do not let the CLI silently continue with built-in tools after ignoring
+            // a failed required MCP startup. Both its connection status and the
+            // successfully delivered broker catalog must precede provider traffic.
+            if (!desktop)
+                await desktopReady;
+            if (failed || finishing || bus.destroyed || res.destroyed || pending.size >= 8)
+                throw Error();
+            const timer = setTimeout(() => { pending.delete(id); res.destroy(); try {
+                send({ type: 'broker_cancel', id });
+            }
+            catch { } if (desktop)
+                failAll(); }, 125000);
+            pending.set(id, { res, timer, ...(message?.method === 'tools/list' ? { catalog: [], catalogBytes: 0 } : {}) });
+            tracked = true;
+            res.on('close', () => { if (pending.delete(id)) {
+                clearTimeout(timer);
+                try {
+                    send({ type: 'broker_cancel', id });
+                }
+                catch { }
+            } });
+            send({ type: 'broker_request', id, request: desktop ? { kind: 'desktop_mcp', message } : { kind: 'provider', method: 'POST', path: req.url, body, ...(typeof req.headers['anthropic-beta'] === 'string' ? { beta: req.headers['anthropic-beta'] } : {}) } });
+        }
+        catch {
+            if (tracked) {
+                const value = pending.get(id);
+                if (value)
+                    clearTimeout(value.timer);
+                pending.delete(id);
+            }
+            if (!res.headersSent)
+                res.writeHead(502, { 'content-type': 'application/json' });
+            res.end(JSON.stringify({ type: 'error', error: { type: 'api_error', message: 'The task connection is unavailable.' } }));
+            // Optional CLI discovery (for example HEAD /api/hello) is refused
+            // locally without treating it as a lost required MCP connection.
+            if (t.desktopMcp && req.url === '/entitybox/mcp')
+                failAll();
+        }
+    });
+    proxy.requestTimeout = 130000;
+    await new Promise(resolve => proxy.listen(0, '127.0.0.1', resolve));
+    const port = proxy.address().port;
+    Object.assign(process.env, { ANTHROPIC_BASE_URL: 'http://127.0.0.1:' + port, ANTHROPIC_API_KEY: 'entitybox-broker', CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: '1', DISABLE_AUTOUPDATER: '1', SHELL: '/bin/sh' });
+    const mcpServers = {};
+    if (t.desktopMcp) {
+        fs.writeFileSync('/work/entitybox-mcp-proxy.cjs', (0, model_mcp_proxy_1.entityboxModelMcpProxySource)('http://127.0.0.1:' + port + '/entitybox/mcp'), { mode: 0o600 });
+        mcpServers['entity-desktop-mcp'] = { command: process.execPath, args: ['/work/entitybox-mcp-proxy.cjs'] };
+        startupTimer = setTimeout(failAll, 25000);
+    }
+    fs.writeFileSync('/work/entitybox-mcp.json', JSON.stringify({ mcpServers }), { mode: 0o600 });
+    maybeReady();
+    try {
+        handle = (0, claude_print_1.spawnClaudePrint)({ workingDirectory: '/work', prompt: t.prompt, model: t.model, permissionMode: t.permissionMode ?? 'default', allowedTools: t.allowedTools, mcpConfigPath: '/work/entitybox-mcp.json', appendSystemPrompt: t.systemPrompt, effortLevel: t.effort });
+        handle.onEvent(event => {
+            if (event.type === 'error')
+                failed = true;
+            if (t.desktopMcp && event.type === 'claude:system') {
+                const raw = event.raw;
+                if (raw?.subtype === 'init') {
+                    cliReady = Array.isArray(raw.mcp_servers) && raw.mcp_servers.some(server => server.name === 'entity-desktop-mcp' && server.status === 'connected');
+                    if (!cliReady)
+                        failAll();
+                    else
+                        maybeReady();
+                }
+            }
+            if (event.type === 'turn_complete' && (failed || !catalogReady || !cliReady))
+                return;
+            process.stdout.write(JSON.stringify(event) + '\n');
+        });
+        if (failed)
+            handle.kill();
+        const code = await handle.done;
+        return code === 0 && !failed && catalogReady && cliReady ? 0 : 70;
+    }
+    finally {
+        finishing = true;
+        clearTimeout(startupTimer);
+        readyReject(Error('Task ended'));
+        clearPending();
+        proxy.closeAllConnections();
+        await new Promise(resolve => proxy.close(() => resolve()));
+        bus.destroy();
+    }
+}