@ai-development-environment/control-agent 0.0.96 → 0.0.97

package/dist/control-agent.js

@@ -8576,6 +8576,215 @@ function parseCliHealthJobPayload(value) {
   return { checks };
 }
 
+// ../agent-contract/src/tailscale.ts
+var TAILSCALE_SERVE_INSPECT_JOB_KIND = "tailscale.serve.inspect.v1";
+var TAILSCALE_SERVE_UPSERT_JOB_KIND = "tailscale.serve.upsert.v1";
+var TAILSCALE_SERVE_REMOVE_JOB_KIND = "tailscale.serve.remove.v1";
+var TAILSCALE_SERVE_JOB_KINDS = [
+  TAILSCALE_SERVE_INSPECT_JOB_KIND,
+  TAILSCALE_SERVE_UPSERT_JOB_KIND,
+  TAILSCALE_SERVE_REMOVE_JOB_KIND
+];
+var TAILSCALE_SERVE_PROTOCOLS = [
+  "HTTP",
+  "HTTPS",
+  "TCP",
+  "TLS_TERMINATED_TCP"
+];
+var TAILSCALE_DESTINATION_PROTOCOLS = [
+  "HTTP",
+  "HTTPS",
+  "HTTPS_INSECURE",
+  "TCP"
+];
+var TAILSCALE_PROXY_PROTOCOLS = ["NONE", "V1", "V2"];
+function objectValue13(value, name) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${name} must be an object`);
+  }
+  return value;
+}
+function exactKeys3(value, keys, name) {
+  const unexpected = Object.keys(value).find((key) => !keys.includes(key));
+  if (unexpected) throw new Error(`Unexpected ${name} field: ${unexpected}`);
+}
+function requiredString(value, name) {
+  if (typeof value !== "string" || value.trim().length === 0 || value.includes("\0")) {
+    throw new Error(`${name} must be a non-empty string`);
+  }
+  return value.trim();
+}
+function integerPort(value, name) {
+  if (!Number.isInteger(value) || value < 1 || value > 65535) {
+    throw new Error(`${name} must be an integer from 1 through 65535`);
+  }
+  return value;
+}
+function enumValue4(value, values, name) {
+  if (typeof value !== "string" || !values.includes(value)) {
+    throw new Error(`${name} is invalid`);
+  }
+  return value;
+}
+function normalizeTailscaleMountPath(value) {
+  if (typeof value !== "string" || value.includes("\0") || value.includes("?")) {
+    throw new Error("Tailscale mount path is invalid");
+  }
+  const path = value.trim() || "/";
+  const prefixed = path.startsWith("/") ? path : `/${path}`;
+  return prefixed === "/" ? prefixed : prefixed.replace(/\/+$/, "");
+}
+function normalizeDestinationPath(value) {
+  if (typeof value !== "string" || value.includes("\0")) {
+    throw new Error("Tailscale destination path is invalid");
+  }
+  const path = value.trim();
+  if (!path) return "";
+  return path.startsWith("/") ? path : `/${path}`;
+}
+function appCapabilities(value) {
+  if (!Array.isArray(value) || value.length > 100) {
+    throw new Error("Tailscale app capabilities must be an array");
+  }
+  const pattern = /^(?:[\p{L}\p{N}-]+\.)+[\p{L}\p{N}-]+\/[\p{L}\p{N}-]+(?:\/[\p{L}\p{N}-]+)*$/u;
+  return [
+    ...new Set(
+      value.map((item, index) => {
+        const capability = requiredString(
+          item,
+          `Tailscale app capabilities[${index}]`
+        );
+        if (!pattern.test(capability)) {
+          throw new Error(
+            `Tailscale app capabilities[${index}] must use domain/name format`
+          );
+        }
+        return capability;
+      })
+    )
+  ].sort();
+}
+function parseTailscaleServeRoute(value) {
+  const route = objectValue13(value, "Tailscale Serve route");
+  exactKeys3(
+    route,
+    [
+      "protocol",
+      "listenPort",
+      "mountPath",
+      "destination",
+      "funnel",
+      "appCapabilities",
+      "proxyProtocol"
+    ],
+    "Tailscale Serve route"
+  );
+  const protocol = enumValue4(
+    route.protocol,
+    TAILSCALE_SERVE_PROTOCOLS,
+    "Tailscale Serve protocol"
+  );
+  const listenPort = integerPort(route.listenPort, "Tailscale listen port");
+  const destination = objectValue13(
+    route.destination,
+    "Tailscale Serve destination"
+  );
+  exactKeys3(
+    destination,
+    ["protocol", "port", "path"],
+    "Tailscale Serve destination"
+  );
+  const destinationProtocol = enumValue4(
+    destination.protocol,
+    TAILSCALE_DESTINATION_PROTOCOLS,
+    "Tailscale destination protocol"
+  );
+  const funnel = route.funnel;
+  if (typeof funnel !== "boolean")
+    throw new Error("Tailscale Funnel must be a boolean");
+  const proxyProtocol = enumValue4(
+    route.proxyProtocol,
+    TAILSCALE_PROXY_PROTOCOLS,
+    "Tailscale PROXY protocol"
+  );
+  const capabilities = appCapabilities(route.appCapabilities);
+  const isWeb = protocol === "HTTP" || protocol === "HTTPS";
+  if (isWeb && destinationProtocol === "TCP") {
+    throw new Error("Web listeners require an HTTP(S) destination");
+  }
+  if (!isWeb && destinationProtocol !== "TCP") {
+    throw new Error("TCP listeners require a TCP destination");
+  }
+  if (!isWeb && normalizeTailscaleMountPath(route.mountPath) !== "/") {
+    throw new Error("TCP listeners do not support mount paths");
+  }
+  if (funnel && (protocol === "HTTP" || ![443, 8443, 1e4].includes(listenPort))) {
+    throw new Error(
+      "Funnel requires HTTPS or TLS TCP on port 443, 8443, or 10000"
+    );
+  }
+  if (capabilities.length && (!isWeb || funnel)) {
+    throw new Error(
+      "App capabilities are supported only by private HTTP(S) listeners"
+    );
+  }
+  if (proxyProtocol !== "NONE" && protocol !== "TCP") {
+    throw new Error("PROXY protocol is supported only by TCP listeners");
+  }
+  return {
+    protocol,
+    listenPort,
+    mountPath: isWeb ? normalizeTailscaleMountPath(route.mountPath) : "/",
+    destination: {
+      protocol: destinationProtocol,
+      port: integerPort(destination.port, "Tailscale destination port"),
+      path: isWeb ? normalizeDestinationPath(destination.path) : ""
+    },
+    funnel,
+    appCapabilities: capabilities,
+    proxyProtocol
+  };
+}
+function tailscaleServeInspectPayload(value) {
+  const payload = objectValue13(value, "Tailscale Serve inspect payload");
+  exactKeys3(payload, ["operationId"], "Tailscale Serve inspect payload");
+  return { operationId: requiredString(payload.operationId, "operationId") };
+}
+function mutationPayload(value, allowPrevious) {
+  const payload = objectValue13(value, "Tailscale Serve mutation payload");
+  exactKeys3(
+    payload,
+    [
+      "operationId",
+      "templateId",
+      "revision",
+      "route",
+      ...allowPrevious ? ["previousRoute"] : []
+    ],
+    "Tailscale Serve mutation payload"
+  );
+  if (!Number.isInteger(payload.revision) || payload.revision < 1) {
+    throw new Error("Tailscale template revision must be a positive integer");
+  }
+  return {
+    operationId: requiredString(payload.operationId, "operationId"),
+    templateId: requiredString(payload.templateId, "templateId"),
+    revision: payload.revision,
+    route: parseTailscaleServeRoute(payload.route)
+  };
+}
+function tailscaleServeUpsertPayload(value) {
+  const base = mutationPayload(value, true);
+  const payload = value;
+  return {
+    ...base,
+    previousRoute: payload.previousRoute === null ? null : parseTailscaleServeRoute(payload.previousRoute)
+  };
+}
+function tailscaleServeRemovePayload(value) {
+  return mutationPayload(value, false);
+}
+
 // src/inventory.ts
 var AGENT_VERSION = process.env.CONTROL_AGENT_VERSION ?? "0.1.0";
 var PORTABLE_AGENT_CAPABILITIES = [
@@ -8599,9 +8808,11 @@ var MACOS_AGENT_CAPABILITIES = [
   ...IOS_BUILD_JOB_KINDS,
   ...SIGNING_ASSET_JOB_KINDS
 ];
+var UNIX_AGENT_CAPABILITIES = [...TAILSCALE_SERVE_JOB_KINDS];
 function capabilitiesForPlatform(targetPlatform) {
   return [
     ...PORTABLE_AGENT_CAPABILITIES,
+    ...targetPlatform === "darwin" || targetPlatform === "linux" ? UNIX_AGENT_CAPABILITIES : [],
     ...targetPlatform === "darwin" ? MACOS_AGENT_CAPABILITIES : []
   ];
 }
@@ -10897,8 +11108,8 @@ async function writeJsonReport(input, kind, timeoutMs, signal) {
       ),
       `Could not generate ${filename}`
     );
-    const serialized = await readFile2(temporary, "utf8");
-    const parsed = JSON.parse(serialized);
+    const serialized2 = await readFile2(temporary, "utf8");
+    const parsed = JSON.parse(serialized2);
     const normalized = kind === "TEST_RESULTS" ? normalizeTestResults(parsed) : normalizeCoverage(parsed);
     await rename2(temporary, destination);
     return {
@@ -18385,6 +18596,280 @@ var autoSyncWorktree = async (payload, timeoutMs, signal) => {
   };
 };
 
+// src/handlers/tailscale.ts
+import { accessSync as accessSync2, constants as constants2 } from "node:fs";
+var MAX_OUTPUT_BYTES2 = 2 * 1024 * 1024;
+var mutationQueues = /* @__PURE__ */ new Map();
+function objectValue14(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function resolveTailscaleExecutable(platform2 = process.platform, resolve12 = findExecutable, isExecutable2 = (path) => {
+  accessSync2(path, constants2.X_OK);
+  return true;
+}) {
+  const resolved = resolve12("tailscale", {
+    overrideVariable: "CONTROL_AGENT_TAILSCALE_EXECUTABLE"
+  });
+  if (resolved) return resolved;
+  if (platform2 === "darwin") {
+    for (const path of [
+      "/Applications/Tailscale.app/Contents/MacOS/Tailscale",
+      "/Applications/Tailscale.app/Contents/MacOS/tailscale"
+    ]) {
+      try {
+        if (isExecutable2(path)) return path;
+      } catch {
+      }
+    }
+  }
+  throw new Error(
+    "Tailscale CLI was not found. Install Tailscale or set CONTROL_AGENT_TAILSCALE_EXECUTABLE."
+  );
+}
+function parseTailscaleJson(value, label) {
+  try {
+    const parsed = JSON.parse(value);
+    const object = objectValue14(parsed);
+    if (!object) throw new Error("expected an object");
+    return object;
+  } catch (error) {
+    throw new Error(
+      `${label} returned malformed JSON: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+}
+function tailscaleCommandFailure(command3, result) {
+  const reason = result.timedOut ? "timed out" : result.cancelled ? "was cancelled" : result.stderr.trim() || `exited with status ${result.exitCode}`;
+  return new Error(`${command3} failed: ${reason}`);
+}
+async function captureTailscale(executable, args, timeoutMs, signal) {
+  const result = await captureCommand({
+    command: executable,
+    args,
+    timeoutMs,
+    signal,
+    maxOutputBytes: MAX_OUTPUT_BYTES2
+  });
+  if (result.outputTruncated) {
+    throw new Error(`tailscale ${args.join(" ")} exceeded the output limit`);
+  }
+  if (result.exitCode !== 0) {
+    throw tailscaleCommandFailure(`tailscale ${args.join(" ")}`, result);
+  }
+  return result;
+}
+function backendIdentity(status2) {
+  const self2 = objectValue14(status2.Self);
+  const rawAddresses = Array.isArray(self2?.TailscaleIPs) ? self2.TailscaleIPs : status2.TailscaleIPs;
+  const addresses = Array.isArray(rawAddresses) ? rawAddresses.filter((value) => typeof value === "string") : [];
+  const dnsName = typeof self2?.DNSName === "string" ? self2.DNSName : null;
+  return {
+    dnsHostname: dnsName?.replace(/\.$/, "") ?? null,
+    ipv4: addresses.filter((value) => value.includes(".")),
+    ipv6: addresses.filter((value) => value.includes(":")),
+    backendState: typeof status2.BackendState === "string" ? status2.BackendState : "Unknown"
+  };
+}
+function destinationFromProxy(proxy) {
+  const parsed = new URL(proxy);
+  if (parsed.hostname !== "127.0.0.1") {
+    throw new Error("Only 127.0.0.1 Tailscale Serve targets are managed");
+  }
+  const rawProtocol = parsed.protocol.replace(/:$/, "");
+  const protocol = rawProtocol === "https+insecure" ? "HTTPS_INSECURE" : rawProtocol === "https" ? "HTTPS" : rawProtocol === "tcp" ? "TCP" : "HTTP";
+  return {
+    protocol,
+    port: Number(parsed.port),
+    path: protocol === "TCP" ? "" : parsed.pathname === "/" ? "" : parsed.pathname
+  };
+}
+function portFromListener(value) {
+  const match = value.match(/:(\d+)$/) ?? value.match(/^(\d+)$/);
+  return match ? Number(match[1]) : null;
+}
+function normalizeTailscaleServeSnapshot(status2, serve, inspectedAt = (/* @__PURE__ */ new Date()).toISOString()) {
+  const routes = [];
+  const tcp = objectValue14(serve.TCP) ?? {};
+  const web = objectValue14(serve.Web) ?? {};
+  const funnel = objectValue14(serve.AllowFunnel) ?? {};
+  for (const [listener, rawWeb] of Object.entries(web)) {
+    const listenPort = portFromListener(listener);
+    const webConfig = objectValue14(rawWeb);
+    const handlers2 = objectValue14(webConfig?.Handlers);
+    if (!listenPort || !handlers2) continue;
+    const tcpConfig = objectValue14(tcp[String(listenPort)]);
+    const protocol = tcpConfig?.HTTPS === true ? "HTTPS" : "HTTP";
+    const isFunnel = Object.entries(funnel).some(
+      ([key, enabled]) => enabled === true && portFromListener(key) === listenPort
+    );
+    for (const [mountPath, rawHandler] of Object.entries(handlers2)) {
+      const handler = objectValue14(rawHandler);
+      if (!handler || typeof handler.Proxy !== "string") continue;
+      const capabilities = Array.isArray(handler.AcceptAppCaps) ? handler.AcceptAppCaps.filter(
+        (value) => typeof value === "string"
+      ) : [];
+      try {
+        routes.push(
+          parseTailscaleServeRoute({
+            protocol,
+            listenPort,
+            mountPath,
+            destination: destinationFromProxy(handler.Proxy),
+            funnel: isFunnel,
+            appCapabilities: capabilities,
+            proxyProtocol: "NONE"
+          })
+        );
+      } catch {
+      }
+    }
+  }
+  for (const [listener, rawTcp] of Object.entries(tcp)) {
+    const listenPort = portFromListener(listener);
+    const config = objectValue14(rawTcp);
+    if (!listenPort || !config || typeof config.TCPForward !== "string")
+      continue;
+    const destination = config.TCPForward.startsWith("tcp://") ? config.TCPForward : `tcp://${config.TCPForward}`;
+    const proxy = config.ProxyProtocol;
+    try {
+      routes.push(
+        parseTailscaleServeRoute({
+          protocol: config.TerminateTLS ? "TLS_TERMINATED_TCP" : "TCP",
+          listenPort,
+          mountPath: "/",
+          destination: destinationFromProxy(destination),
+          funnel: Object.entries(funnel).some(
+            ([key, enabled]) => enabled === true && portFromListener(key) === listenPort
+          ),
+          appCapabilities: [],
+          proxyProtocol: proxy === 1 || proxy === "1" || proxy === "V1" ? "V1" : proxy === 2 || proxy === "2" || proxy === "V2" ? "V2" : "NONE"
+        })
+      );
+    } catch {
+    }
+  }
+  return {
+    identity: backendIdentity(status2),
+    routes: routes.sort(
+      (first, second) => `${first.listenPort}:${first.mountPath}`.localeCompare(
+        `${second.listenPort}:${second.mountPath}`
+      )
+    ),
+    inspectedAt
+  };
+}
+async function inspect(executable, timeoutMs, signal) {
+  const status2 = await captureTailscale(
+    executable,
+    ["status", "--json"],
+    timeoutMs,
+    signal
+  );
+  const serve = await captureTailscale(
+    executable,
+    ["serve", "status", "--json"],
+    timeoutMs,
+    signal
+  );
+  return normalizeTailscaleServeSnapshot(
+    parseTailscaleJson(status2.stdout, "tailscale status --json"),
+    parseTailscaleJson(serve.stdout, "tailscale serve status --json")
+  );
+}
+function listenerArguments(route) {
+  const flag = route.protocol === "TLS_TERMINATED_TCP" ? "tls-terminated-tcp" : route.protocol.toLowerCase();
+  return [
+    `--${flag}=${route.listenPort}`,
+    ...route.protocol === "HTTP" || route.protocol === "HTTPS" ? [`--set-path=${route.mountPath}`] : []
+  ];
+}
+function routeTarget(route) {
+  const scheme = route.destination.protocol === "HTTPS_INSECURE" ? "https+insecure" : route.destination.protocol.toLowerCase();
+  return `${scheme}://127.0.0.1:${route.destination.port}${route.destination.path}`;
+}
+function tailscaleUpsertArguments(route) {
+  const normalized = parseTailscaleServeRoute(route);
+  return [
+    normalized.funnel ? "funnel" : "serve",
+    "--bg",
+    "--yes",
+    ...listenerArguments(normalized),
+    ...normalized.appCapabilities.length ? [`--accept-app-caps=${normalized.appCapabilities.join(",")}`] : [],
+    ...normalized.proxyProtocol === "NONE" ? [] : [`--proxy-protocol=${normalized.proxyProtocol === "V1" ? "1" : "2"}`],
+    routeTarget(normalized)
+  ];
+}
+function tailscaleRemoveArguments(route) {
+  const normalized = parseTailscaleServeRoute(route);
+  return [
+    normalized.funnel ? "funnel" : "serve",
+    ...listenerArguments(normalized),
+    "off"
+  ];
+}
+function tailscaleUpsertCommandSequence(route, previousRoute) {
+  return [
+    ...previousRoute && JSON.stringify(previousRoute) !== JSON.stringify(route) ? [tailscaleRemoveArguments(previousRoute)] : [],
+    tailscaleUpsertArguments(route)
+  ];
+}
+async function serialized(agentId, work) {
+  const previous = mutationQueues.get(agentId) ?? Promise.resolve();
+  let release2;
+  const current = new Promise((resolve12) => {
+    release2 = resolve12;
+  });
+  const tail = previous.then(() => current);
+  mutationQueues.set(agentId, tail);
+  await previous;
+  try {
+    return await work();
+  } finally {
+    release2();
+    if (mutationQueues.get(agentId) === tail) mutationQueues.delete(agentId);
+  }
+}
+function success2(snapshot) {
+  return {
+    exitCode: 0,
+    signal: null,
+    timedOut: false,
+    cancelled: false,
+    snapshot
+  };
+}
+var inspectTailscaleServe = async (rawPayload, timeoutMs, signal) => {
+  tailscaleServeInspectPayload(rawPayload);
+  const executable = resolveTailscaleExecutable();
+  return success2(await inspect(executable, timeoutMs, signal));
+};
+var upsertTailscaleServe = async (rawPayload, timeoutMs, signal, _onLog, context) => {
+  const payload = tailscaleServeUpsertPayload(rawPayload);
+  const executable = resolveTailscaleExecutable();
+  return serialized(context?.agentId ?? "default", async () => {
+    for (const args of tailscaleUpsertCommandSequence(
+      payload.route,
+      payload.previousRoute
+    )) {
+      await captureTailscale(executable, args, timeoutMs, signal);
+    }
+    return success2(await inspect(executable, timeoutMs, signal));
+  });
+};
+var removeTailscaleServe = async (rawPayload, timeoutMs, signal, _onLog, context) => {
+  const payload = tailscaleServeRemovePayload(rawPayload);
+  const executable = resolveTailscaleExecutable();
+  return serialized(context?.agentId ?? "default", async () => {
+    await captureTailscale(
+      executable,
+      tailscaleRemoveArguments(payload.route),
+      timeoutMs,
+      signal
+    );
+    return success2(await inspect(executable, timeoutMs, signal));
+  });
+};
+
 // src/handlers/index.ts
 var handlers = {
   [CLI_HEALTH_JOB_KIND]: runCliHealth,
@@ -18437,7 +18922,10 @@ var handlers = {
   [SIGNING_PROFILE_INSTALL_JOB_KIND]: installSigningProfile,
   [SIGNING_PROFILE_DELETE_JOB_KIND]: deleteSigningProfile,
   [SIGNING_IDENTITY_IMPORT_JOB_KIND]: importSigningIdentity,
-  [SIGNING_IDENTITY_DELETE_JOB_KIND]: deleteSigningIdentity
+  [SIGNING_IDENTITY_DELETE_JOB_KIND]: deleteSigningIdentity,
+  [TAILSCALE_SERVE_INSPECT_JOB_KIND]: inspectTailscaleServe,
+  [TAILSCALE_SERVE_UPSERT_JOB_KIND]: upsertTailscaleServe,
+  [TAILSCALE_SERVE_REMOVE_JOB_KIND]: removeTailscaleServe
 };
 
 // src/repository-coordinator.ts
@@ -52441,8 +52929,8 @@ var ClaudeAdapter = class {
               dir: worktree.folder,
               limit: 500
             });
-            const serialized = JSON.stringify(history);
-            if (serialized.includes('"permissionMode":"plan"')) kind = "PLAN";
+            const serialized2 = JSON.stringify(history);
+            if (serialized2.includes('"permissionMode":"plan"')) kind = "PLAN";
             finalOutput = firstString([...history].reverse());
             this.hydrationCache.set(session.sessionId, {
               lastModified: lastModifiedKey,
@@ -53008,8 +53496,8 @@ var CodexAdapter = class {
                   })
                 );
                 const hydrated = asRecord(detail.thread);
-                const serialized = JSON.stringify(hydrated.turns ?? []);
-                if (serialized.includes('"type":"plan"')) kind = "PLAN";
+                const serialized2 = JSON.stringify(hydrated.turns ?? []);
+                if (serialized2.includes('"type":"plan"')) kind = "PLAN";
                 finalOutput = firstString(
                   Array.isArray(hydrated.turns) ? [...hydrated.turns].reverse() : []
                 );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-development-environment/control-agent",
-  "version": "0.0.96",
+  "version": "0.0.97",
   "description": "Control agent for the AI Development Environment",
   "license": "MIT",
   "repository": {