@almyty/runner 1.2.0

package/dist/handlers.js

@@ -0,0 +1,299 @@
+import { shellExec } from './process-manager.js';
+import { enforceSpawnPolicy, enforceShellPolicy } from './policy.js';
+import { detectRuntimeInfo, RUNNER_VERSION } from './runtime-info.js';
+import { WORKER_ERROR_CODES } from './protocol.js';
+import { buildAgentSpawn, classifyStatus, detectCodingAgents, findByBinary, getCodingAgent, listCodingAgents, stripVtEscapes, } from './coding-agents/index.js';
+import { realExec } from './binaries.js';
+import { RUNNER_ERROR_CODES, RunnerError, } from './types.js';
+export async function dispatchHandler(ctx, req) {
+    try {
+        switch (req.method) {
+            case 'process.spawn': return ok(await spawn(ctx, req));
+            case 'process.write': return ok(await write(ctx, req));
+            case 'process.read': return ok(await read(ctx, req));
+            case 'process.wait_for_idle': return ok(await waitForIdle(ctx, req));
+            case 'process.signal': return ok(await signal(ctx, req));
+            case 'process.close_input': return ok(await closeInput(ctx, req));
+            case 'process.list': return ok(await list(ctx, req));
+            case 'process.wait': return ok(await waitH(ctx, req));
+            case 'shell.exec': return ok(await shell(ctx, req));
+            case 'runner.info': return ok(await info(ctx));
+            case 'agent.list': return ok(agentList());
+            case 'agent.spawn': return ok(await agentSpawn(ctx, req));
+            case 'agent.status': return ok(agentStatus(ctx, req));
+            case 'coding.list': return ok(await codingList(ctx));
+            case 'coding.start': return ok(await codingStart(ctx, req));
+            case 'coding.input': return ok(codingInput(ctx, req));
+            case 'coding.status': return ok(codingStatus(ctx, req));
+            case 'coding.stop': return ok(codingStop(ctx, req));
+            default:
+                return err(WORKER_ERROR_CODES.MALFORMED_ENVELOPE, `unknown method ${req.method}`);
+        }
+    }
+    catch (e) {
+        if (e instanceof RunnerError) {
+            return err(WORKER_ERROR_CODES.INTERNAL, e.message, { code: e.code, data: e.data });
+        }
+        return err(WORKER_ERROR_CODES.INTERNAL, e?.message ?? String(e));
+    }
+}
+// ── handlers ────────────────────────────────────────────────────────
+async function spawn(ctx, req) {
+    const ws = requireWorkspace(req);
+    const p = req.params;
+    if (typeof p.binary !== 'string' || p.binary.length === 0) {
+        throw new RunnerError('binary is required', RUNNER_ERROR_CODES.PATH_DENIED);
+    }
+    const args = Array.isArray(p.args) ? p.args.map(String) : [];
+    const env = isStringMap(p.env) ? p.env : undefined;
+    const opts = {
+        binary: p.binary,
+        args,
+        env,
+        pty: p.pty !== false,
+        cwd: typeof p.cwd === 'string' ? p.cwd : undefined,
+    };
+    // Enforce the runner execution policy (isolation/deny/cwd/install) and
+    // use the sanitized env — refuses, rather than silently running, anything
+    // the config forbids.
+    opts.env = enforceSpawnPolicy(ctx.config, opts).env;
+    const handle = await ctx.processes.spawn(ws, opts);
+    return { processId: handle.processId };
+}
+async function write(ctx, req) {
+    const ws = requireWorkspace(req);
+    const p = req.params;
+    ctx.processes.write(ws, requireString(p.processId, 'processId'), requireString(p.data, 'data'));
+    return {};
+}
+async function read(ctx, req) {
+    const ws = requireWorkspace(req);
+    const p = req.params;
+    return ctx.processes.read(ws, requireString(p.processId, 'processId'));
+}
+async function waitForIdle(ctx, req) {
+    const ws = requireWorkspace(req);
+    const p = req.params;
+    const idleMs = typeof p.idleMs === 'number' ? p.idleMs : 250;
+    const maxWaitMs = typeof p.maxWaitMs === 'number' ? p.maxWaitMs : 30_000;
+    return ctx.processes.waitForIdle(ws, requireString(p.processId, 'processId'), { idleMs, maxWaitMs });
+}
+async function signal(ctx, req) {
+    const ws = requireWorkspace(req);
+    const p = req.params;
+    const sig = p.signal ?? 'TERM';
+    if (sig !== 'TERM' && sig !== 'INT' && sig !== 'KILL') {
+        throw new RunnerError(`unsupported signal ${sig}`, RUNNER_ERROR_CODES.PATH_DENIED);
+    }
+    ctx.processes.signal(ws, requireString(p.processId, 'processId'), sig);
+    return {};
+}
+async function closeInput(ctx, req) {
+    const ws = requireWorkspace(req);
+    const p = req.params;
+    ctx.processes.closeInput(ws, requireString(p.processId, 'processId'));
+    return {};
+}
+async function list(ctx, req) {
+    const ws = req.workspaceId; // optional: list all when undefined
+    return { processes: ctx.processes.list(ws) };
+}
+async function waitH(ctx, req) {
+    const ws = requireWorkspace(req);
+    const p = req.params;
+    return ctx.processes.wait(ws, requireString(p.processId, 'processId'), p.timeoutMs);
+}
+async function shell(ctx, req) {
+    // shell.exec is workspace-scoped for audit but doesn't depend on
+    // the process manager's bookkeeping; one-shot execution returns
+    // stdout+stderr+exit and forgets.
+    requireWorkspace(req);
+    const p = req.params;
+    const cmd = requireString(p.cmd, 'cmd');
+    // Enforce the same execution policy as process.spawn — isolation
+    // fail-closed, denyPatterns, installBlocked — and run with the
+    // sanitized env. Without this, shell.exec was a hole straight past
+    // every protection spawn honours.
+    const { env } = enforceShellPolicy(ctx.config, cmd, p.env);
+    return shellExec(cmd, env, p.timeoutMs);
+}
+async function info(ctx) {
+    // We re-detect on every call; binaries can be installed/removed at
+    // runtime and the user expects the snapshot to be fresh. Cheap when
+    // probeAll runs in parallel.
+    const runtime = ctx.cachedRuntimeInfo
+        ?? await detectRuntimeInfo({ binaries: [] });
+    return {
+        name: ctx.runnerName,
+        labels: ctx.labels,
+        runtime,
+        runnerVersion: RUNNER_VERSION,
+        binaries: runtime.binaries,
+        capacity: { maxConcurrent: ctx.maxConcurrent, inUse: ctx.processes.inUse() },
+    };
+}
+// ── coding-agent surface ────────────────────────────────────────────
+/**
+ * Catalog of coding-agent platforms this runner knows how to drive. Static —
+ * what's actually installed is in runner.info's runtime.codingAgents. The
+ * catalog tells an orchestrator what it COULD ask for and the levers per CLI.
+ */
+function agentList() {
+    return {
+        platforms: listCodingAgents().map((s) => ({
+            id: s.id,
+            displayName: s.displayName,
+            binary: s.binary,
+            providerFamily: s.providerFamily,
+            apiKeyEnvVars: s.apiKeyEnvVars,
+            configDirEnvVar: s.configDirEnvVar,
+            supportsMcp: s.supportsMcp,
+            canManage: s.canManage,
+            resume: s.session.kind,
+        })),
+    };
+}
+/**
+ * Launch a coding-agent CLI as an unattended member. Builds the platform's
+ * spawn spec (headless auth + isolated config home + auto-approve + resume),
+ * then runs it through the SAME execution policy as process.spawn — the coding
+ * agent gets no privilege the generic surface wouldn't.
+ */
+async function agentSpawn(ctx, req) {
+    const ws = requireWorkspace(req);
+    const p = req.params;
+    const spec = getCodingAgent(requireString(p.platform, 'platform'));
+    if (!spec) {
+        throw new RunnerError(`unknown coding-agent platform ${p.platform}`, RUNNER_ERROR_CODES.PATH_DENIED);
+    }
+    const opts = buildAgentSpawn(spec, {
+        apiKey: p.apiKey,
+        apiKeyEnvVar: p.apiKeyEnvVar,
+        configDir: p.configDir,
+        autoApprove: p.autoApprove,
+        model: p.model,
+        resumeSessionId: p.resumeSessionId,
+        extraArgs: Array.isArray(p.extraArgs) ? p.extraArgs.map(String) : undefined,
+        cwd: p.cwd,
+    });
+    // Same policy gate as process.spawn — isolation/deny/cwd/install all apply.
+    opts.env = enforceSpawnPolicy(ctx.config, opts).env;
+    const handle = await ctx.processes.spawn(ws, opts);
+    return { processId: handle.processId, platform: spec.id, binary: spec.binary, args: opts.args };
+}
+/**
+ * Non-destructively classify a spawned agent's pane: busy / idle /
+ * awaiting_input / awaiting_auth / error. Resolves the platform from the
+ * process's binary (or an explicit `platform` override), strips VT escapes
+ * from the recent tail, and runs the per-CLI status table. Does NOT drain the
+ * agent's own read() buffer.
+ */
+function agentStatus(ctx, req) {
+    const ws = requireWorkspace(req);
+    const p = req.params;
+    const snap = ctx.processes.snapshot(ws, requireString(p.processId, 'processId'));
+    const spec = p.platform ? getCodingAgent(p.platform) : findByBinary(snap.binary);
+    if (!spec) {
+        throw new RunnerError(`cannot resolve coding-agent platform for binary ${snap.binary}`, RUNNER_ERROR_CODES.PATH_DENIED);
+    }
+    const screen = stripVtEscapes(snap.tail);
+    const agentStatusValue = snap.status !== 'running' ? 'exited' : classifyStatus(spec.status, screen);
+    return {
+        platform: spec.id,
+        processStatus: snap.status,
+        status: agentStatusValue,
+        idleMs: snap.idleMs,
+    };
+}
+// ── coding-session surface (chat-to-runner bridge) ─────────────────
+//
+// Unlike agent.* (workspace-scoped unattended members), coding.* sessions
+// are daemon-global interactive sessions driven from the chat REPL. The
+// CodingSessionManager namespaces each one under a synthetic workspace and
+// streams output upstream as coding.output/coding.exit event envelopes.
+function requireCoding(ctx) {
+    if (!ctx.coding) {
+        throw new RunnerError('coding sessions are not available on this runner', RUNNER_ERROR_CODES.PATH_DENIED);
+    }
+    return ctx.coding;
+}
+/** Coding CLIs actually installed on this machine (fresh probe). */
+async function codingList(ctx) {
+    const agents = await detectCodingAgents(ctx.probeExec ?? realExec);
+    return { agents };
+}
+/**
+ * Start a coding session: resolve the platform spec, build the spawn spec
+ * (auto-approve, task as final positional arg, pipe stdio), run it through
+ * the SAME execution policy as process.spawn, then hand it to the session
+ * registry which streams output back as events.
+ */
+async function codingStart(ctx, req) {
+    const coding = requireCoding(ctx);
+    const p = req.params;
+    const spec = getCodingAgent(requireString(p.agent, 'agent'));
+    if (!spec) {
+        throw new RunnerError(`unknown coding agent ${p.agent}`, RUNNER_ERROR_CODES.PATH_DENIED);
+    }
+    const input = {
+        task: requireString(p.task, 'task'),
+        cwd: typeof p.cwd === 'string' && p.cwd.length > 0 ? p.cwd : undefined,
+        model: typeof p.model === 'string' ? p.model : undefined,
+        extraArgs: Array.isArray(p.extraArgs) ? p.extraArgs.map(String) : undefined,
+    };
+    const opts = coding.buildStartOptions(spec, input);
+    // Same policy gate as process.spawn — isolation/deny/cwd/install all apply.
+    opts.env = enforceSpawnPolicy(ctx.config, opts).env;
+    return coding.start(spec, input, opts);
+}
+/** Route a line of user input to the session's stdin. */
+function codingInput(ctx, req) {
+    const coding = requireCoding(ctx);
+    const p = req.params;
+    coding.input(requireString(p.sessionId, 'sessionId'), requireString(p.data, 'data'));
+    return {};
+}
+/** One session's status, or the full session list when sessionId is omitted. */
+function codingStatus(ctx, req) {
+    const coding = requireCoding(ctx);
+    const p = req.params;
+    if (typeof p.sessionId === 'string' && p.sessionId.length > 0) {
+        return coding.status(p.sessionId);
+    }
+    return { sessions: coding.list() };
+}
+/** Stop a session (TERM; KILL with force). */
+function codingStop(ctx, req) {
+    const coding = requireCoding(ctx);
+    const p = req.params;
+    return coding.stop(requireString(p.sessionId, 'sessionId'), p.force === true);
+}
+// ── helpers ─────────────────────────────────────────────────────────
+function requireWorkspace(req) {
+    if (!req.workspaceId) {
+        throw new RunnerError('workspaceId is required', RUNNER_ERROR_CODES.PATH_DENIED);
+    }
+    return req.workspaceId;
+}
+function requireString(v, name) {
+    if (typeof v !== 'string' || v.length === 0) {
+        throw new RunnerError(`${name} is required`, RUNNER_ERROR_CODES.PATH_DENIED);
+    }
+    return v;
+}
+function isStringMap(v) {
+    if (!v || typeof v !== 'object')
+        return false;
+    for (const val of Object.values(v)) {
+        if (typeof val !== 'string')
+            return false;
+    }
+    return true;
+}
+function ok(result) {
+    return { ok: true, result };
+}
+function err(code, message, data) {
+    return { ok: false, error: { code, message, data } };
+}
+//# sourceMappingURL=handlers.js.map

package/dist/handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers.js","sourceRoot":"","sources":["../src/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAmC,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACpF,OAAO,EACL,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,cAAc,GAEf,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAkB,MAAM,eAAe,CAAC;AAEzD,OAAO,EAEL,kBAAkB,EAClB,WAAW,GAGZ,MAAM,YAAY,CAAC;AAmCpB,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAmB,EAAE,GAAmB;IAC5E,IAAI,CAAC;QACH,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;YACnB,KAAK,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YACvD,KAAK,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YACvD,KAAK,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YACrD,KAAK,uBAAuB,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YACrE,KAAK,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YACzD,KAAK,qBAAqB,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YAClE,KAAK,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YACrD,KAAK,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YACtD,KAAK,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YACpD,KAAK,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/C,KAAK,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;YAC1C,KAAK,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YAC1D,KAAK,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YACtD,KAAK,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YACrD,KAAK,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YAC5D,KAAK,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YACtD,KAAK,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YACxD,KAAK,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YACpD;gBACE,OAAO,GAAG,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,IAAI,CAAC,YAAY,WAAW,EAAE,CAAC;YAC7B,OAAO,GAAG,CAAC,kBAAkB,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,GAAG,CAAC,kBAAkB,CAAC,QAAQ,EAAE,CAAC,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,uEAAuE;AAEvE,KAAK,UAAU,KAAK,CAAC,GAAmB,EAAE,GAAmB;IAC3D,MAAM,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,CAAC,GAAG,GAAG,CAAC,MAA+B,CAAC;IAC9C,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,MAAM,IAAI,GAAiB;QACzB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,IAAI;QACJ,GAAG;QACH,GAAG,EAAE,CAAC,CAAC,GAAG,KAAK,KAAK;QACpB,GAAG,EAAE,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;KACnD,CAAC;IACF,uEAAuE;IACvE,0EAA0E;IAC1E,sBAAsB;IACtB,IAAI,CAAC,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACnD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;AACzC,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,GAAmB,EAAE,GAAmB;IAC3D,MAAM,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,CAAC,GAAG,GAAG,CAAC,MAA+C,CAAC;IAC9D,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAChG,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,GAAmB,EAAE,GAAmB;IAC1D,MAAM,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,CAAC,GAAG,GAAG,CAAC,MAAgC,CAAC;IAC/C,OAAO,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAmB,EAAE,GAAmB;IACjE,MAAM,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,CAAC,GAAG,GAAG,CAAC,MAAqE,CAAC;IACpF,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7D,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IACzE,OAAO,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;AACvG,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,GAAmB,EAAE,GAAmB;IAC5D,MAAM,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,CAAC,GAAG,GAAG,CAAC,MAAwD,CAAC;IACvE,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC;IAC/B,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACtD,MAAM,IAAI,WAAW,CAAC,sBAAsB,GAAG,EAAE,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACrF,CAAC;IACD,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,GAAG,CAAC,CAAC;IACvE,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,GAAmB,EAAE,GAAmB;IAChE,MAAM,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,CAAC,GAAG,GAAG,CAAC,MAAgC,CAAC;IAC/C,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IACtE,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,GAAmB,EAAE,GAAmB;IAC1D,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,oCAAoC;IAChE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,GAAmB,EAAE,GAAmB;IAC3D,MAAM,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,CAAC,GAAG,GAAG,CAAC,MAAoD,CAAC;IACnE,OAAO,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;AACtF,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,GAAmB,EAAE,GAAmB;IAC3D,iEAAiE;IACjE,gEAAgE;IAChE,kCAAkC;IAClC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,CAAC,GAAG,GAAG,CAAC,MAA4E,CAAC;IAC3F,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxC,iEAAiE;IACjE,+DAA+D;IAC/D,mEAAmE;IACnE,kCAAkC;IAClC,MAAM,EAAE,GAAG,EAAE,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3D,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,GAAmB;IACrC,mEAAmE;IACnE,oEAAoE;IACpE,6BAA6B;IAC7B,MAAM,OAAO,GAAG,GAAG,CAAC,iBAAiB;WAChC,MAAM,iBAAiB,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/C,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,UAAU;QACpB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO;QACP,aAAa,EAAE,cAAc;QAC7B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE;KAC7E,CAAC;AACJ,CAAC;AAED,uEAAuE;AAEvE;;;;GAIG;AACH,SAAS,SAAS;IAChB,OAAO;QACL,SAAS,EAAE,gBAAgB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACxC,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,cAAc,EAAE,CAAC,CAAC,cAAc;YAChC,aAAa,EAAE,CAAC,CAAC,aAAa;YAC9B,eAAe,EAAE,CAAC,CAAC,eAAe;YAClC,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI;SACvB,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,UAAU,CAAC,GAAmB,EAAE,GAAmB;IAChE,MAAM,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,CAAC,GAAG,GAAG,CAAC,MAAiD,CAAC;IAChE,MAAM,IAAI,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;IACnE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,WAAW,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,EAAE;QACjC,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,eAAe,EAAE,CAAC,CAAC,eAAe;QAClC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;QAC3E,GAAG,EAAE,CAAC,CAAC,GAAG;KACX,CAAC,CAAC;IACH,4EAA4E;IAC5E,IAAI,CAAC,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACnD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;AAClG,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,GAAmB,EAAE,GAAmB;IAC3D,MAAM,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,CAAC,GAAG,GAAG,CAAC,MAAmD,CAAC;IAClE,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IACjF,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,WAAW,CACnB,mDAAmD,IAAI,CAAC,MAAM,EAAE,EAChE,kBAAkB,CAAC,WAAW,CAC/B,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,gBAAgB,GACpB,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7E,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,EAAE;QACjB,aAAa,EAAE,IAAI,CAAC,MAAM;QAC1B,MAAM,EAAE,gBAAgB;QACxB,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,EAAE;AACF,0EAA0E;AAC1E,wEAAwE;AACxE,2EAA2E;AAC3E,wEAAwE;AAExE,SAAS,aAAa,CAAC,GAAmB;IACxC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,IAAI,WAAW,CACnB,kDAAkD,EAClD,kBAAkB,CAAC,WAAW,CAC/B,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,oEAAoE;AACpE,KAAK,UAAU,UAAU,CAAC,GAAmB;IAC3C,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;IACnE,OAAO,EAAE,MAAM,EAAE,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,WAAW,CAAC,GAAmB,EAAE,GAAmB;IACjE,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,CAAC,GAAG,GAAG,CAAC,MAMb,CAAC;IACF,MAAM,IAAI,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,WAAW,CAAC,wBAAwB,CAAC,CAAC,KAAK,EAAE,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,KAAK,GAAG;QACZ,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC;QACnC,GAAG,EAAE,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QACtE,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACxD,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;KAC5E,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnD,4EAA4E;IAC5E,IAAI,CAAC,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC;IACpD,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,yDAAyD;AACzD,SAAS,WAAW,CAAC,GAAmB,EAAE,GAAmB;IAC3D,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,CAAC,GAAG,GAAG,CAAC,MAA+C,CAAC;IAC9D,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACrF,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,gFAAgF;AAChF,SAAS,YAAY,CAAC,GAAmB,EAAE,GAAmB;IAC5D,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,CAAC,GAAG,GAAG,CAAC,MAAgC,CAAC;IAC/C,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9D,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AACrC,CAAC;AAED,8CAA8C;AAC9C,SAAS,UAAU,CAAC,GAAmB,EAAE,GAAmB;IAC1D,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,CAAC,GAAG,GAAG,CAAC,MAAiD,CAAC;IAChE,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;AAChF,CAAC;AAED,uEAAuE;AAEvE,SAAS,gBAAgB,CAAC,GAAmB;IAC3C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,IAAI,WAAW,CAAC,yBAAyB,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,GAAG,CAAC,WAAW,CAAC;AACzB,CAAC;AAED,SAAS,aAAa,CAAC,CAAU,EAAE,IAAY;IAC7C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,WAAW,CAAC,GAAG,IAAI,cAAc,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,WAAW,CAAC,CAAU;IAC7B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAA4B,CAAC,EAAE,CAAC;QAC9D,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,EAAE,CAAC,MAAe;IACzB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,IAAc;IACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;AACvD,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Programmatic exports for the runner package.
+ *
+ * Most consumers run the CLI (`almyty-runner start`); programmatic
+ * access exists so backend tests and the integration spec can drive
+ * the runner without spawning a subprocess.
+ */
+export { RunnerDaemon, readStatus, stopDaemon, type DaemonStatus } from './daemon.js';
+export { ProcessManager, shellExec, createDefaultAdapterFactory, type ProcessAdapter, type AdapterFactory, } from './process-manager.js';
+export { CodingSessionManager, type CodingEmitter, type CodingEventPayload, type CodingSessionRecord, type CodingStartInput, } from './coding-sessions.js';
+export { loadConfig, DEFAULTS, DEFAULT_BINARY_PROBE_LIST, GLOBAL_CONFIG_PATH, PROJECT_CONFIG_PATH } from './config.js';
+export { detectRuntimeInfo, RUNNER_VERSION } from './runtime-info.js';
+export { probe, probeAll, realExec, type ProbeExec } from './binaries.js';
+export { dispatchHandler, type HandlerContext } from './handlers.js';
+export { StreamableClient, envelope, type StreamableClientOptions, } from './streamable-client.js';
+export { WORKER_PROTOCOL_VERSION, WORKER_ERROR_CODES, isWorkerEnvelope, type WorkerEnvelope, type RequestPayload, type ResponsePayload, type HeartbeatPayload, } from './protocol.js';
+export { RunnerError, RUNNER_ERROR_CODES, type ResolvedConfig, type RunnerConfig, type RunnerInfo, type RunnerRuntimeInfo, type ProcessHandle, type ProcessSignal, type SpawnOptions, type ReadResult, type WaitForIdleOptions, type WaitForIdleResult, type WaitResult, type ShellExecResult, } from './types.js';

package/dist/index.js

@@ -0,0 +1,18 @@
+/**
+ * Programmatic exports for the runner package.
+ *
+ * Most consumers run the CLI (`almyty-runner start`); programmatic
+ * access exists so backend tests and the integration spec can drive
+ * the runner without spawning a subprocess.
+ */
+export { RunnerDaemon, readStatus, stopDaemon } from './daemon.js';
+export { ProcessManager, shellExec, createDefaultAdapterFactory, } from './process-manager.js';
+export { CodingSessionManager, } from './coding-sessions.js';
+export { loadConfig, DEFAULTS, DEFAULT_BINARY_PROBE_LIST, GLOBAL_CONFIG_PATH, PROJECT_CONFIG_PATH } from './config.js';
+export { detectRuntimeInfo, RUNNER_VERSION } from './runtime-info.js';
+export { probe, probeAll, realExec } from './binaries.js';
+export { dispatchHandler } from './handlers.js';
+export { StreamableClient, envelope, } from './streamable-client.js';
+export { WORKER_PROTOCOL_VERSION, WORKER_ERROR_CODES, isWorkerEnvelope, } from './protocol.js';
+export { RunnerError, RUNNER_ERROR_CODES, } from './types.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAqB,MAAM,aAAa,CAAC;AACtF,OAAO,EACL,cAAc,EACd,SAAS,EACT,2BAA2B,GAG5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,oBAAoB,GAKrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvH,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAkB,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAuB,MAAM,eAAe,CAAC;AACrE,OAAO,EACL,gBAAgB,EAChB,QAAQ,GAET,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,gBAAgB,GAKjB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,WAAW,EACX,kBAAkB,GAanB,MAAM,YAAY,CAAC"}

package/dist/policy.d.ts

@@ -0,0 +1,16 @@
+import { RunnerConfig } from './types.js';
+/** Drop env keys a payload must not be allowed to set. */
+export declare function sanitizeEnv(env?: Record<string, string>): Record<string, string> | undefined;
+/** Enforce policy for a process.spawn; returns the sanitized env to use. */
+export declare function enforceSpawnPolicy(config: RunnerConfig, opts: {
+    binary: string;
+    args: string[];
+    cwd?: string;
+    env?: Record<string, string>;
+}): {
+    env?: Record<string, string>;
+};
+/** Enforce policy for a shell.exec; returns the sanitized env to use. */
+export declare function enforceShellPolicy(config: RunnerConfig, cmd: string, env?: Record<string, string>): {
+    env?: Record<string, string>;
+};

package/dist/policy.js

@@ -0,0 +1,134 @@
+/**
+ * Runner execution policy enforcement.
+ *
+ * The runner config advertises an isolation tier, a cwd allowlist, deny
+ * patterns, a network-blocked flag, and an install-blocked flag. Until
+ * this module these were *documented but never enforced* — every
+ * `process.spawn` / `shell.exec` ran any backend-supplied command on the
+ * host, with attacker-controllable env, regardless of config. That is host
+ * RCE behind a config that lies about protecting the user.
+ *
+ * This enforces the contract before any spawn:
+ *   - Fail closed when `defaultIsolation: 'container'` is configured but no
+ *     container runtime is implemented (the default) — refuse rather than
+ *     silently run on the host. Host execution is opt-in (`isolation: host`).
+ *   - Fail closed when `networkBlocked` is requested (can't be honoured on
+ *     the host).
+ *   - Reject commands matching `denyPatterns`, and package installs when
+ *     `installBlocked`.
+ *   - Constrain `cwd` to `allowedCwdRoots` (realpath-canonicalized to block
+ *     symlink/`..` escape).
+ *   - Strip env keys a payload must never set (PATH, LD_PRELOAD, …).
+ */
+import { realpathSync } from 'fs';
+import { resolve, sep } from 'path';
+import { RunnerError, RUNNER_ERROR_CODES } from './types.js';
+// Env vars a payload must never override: they redirect which binary runs
+// (PATH), preload code into the process (LD_PRELOAD and friends), or change
+// interpreter behaviour. The daemon's own values are kept by stripping
+// these from the inbound env before it's merged over process.env.
+const BLOCKED_ENV_KEYS = new Set([
+    'PATH',
+    'LD_PRELOAD',
+    'LD_LIBRARY_PATH',
+    'LD_AUDIT',
+    'DYLD_INSERT_LIBRARIES',
+    'DYLD_LIBRARY_PATH',
+    'NODE_OPTIONS',
+    'PYTHONPATH',
+    'PYTHONSTARTUP',
+    'BASH_ENV',
+    'ENV',
+    'IFS',
+    'GIT_SSH',
+    'GIT_SSH_COMMAND',
+    'GIT_EXEC_PATH',
+    'PROMPT_COMMAND',
+].map((k) => k.toUpperCase()));
+const INSTALL_RE = /\b(?:npm\s+(?:i|install|ci|add)|yarn\s+add|pnpm\s+(?:add|install|i)|pip3?\s+install|gem\s+install|cargo\s+install|go\s+install|apt(?:-get)?\s+install|brew\s+install|nix-env|conda\s+install)\b/i;
+/** Drop env keys a payload must not be allowed to set. */
+export function sanitizeEnv(env) {
+    if (!env)
+        return env;
+    const out = {};
+    for (const [k, v] of Object.entries(env)) {
+        if (BLOCKED_ENV_KEYS.has(k.toUpperCase()))
+            continue;
+        out[k] = v;
+    }
+    return out;
+}
+function assertIsolationSupported(config) {
+    if (config.defaultIsolation === 'container') {
+        throw new RunnerError('container isolation is configured but not implemented by this runner build; ' +
+            "refusing to run on the host. Set isolation to 'host' to explicitly allow host execution.", RUNNER_ERROR_CODES.COMMAND_DENIED);
+    }
+    if (config.networkBlocked) {
+        throw new RunnerError('networkBlocked is set but cannot be enforced under host isolation; refusing to run.', RUNNER_ERROR_CODES.COMMAND_DENIED);
+    }
+}
+function matchesDeny(command, patterns) {
+    for (const pat of patterns) {
+        if (!pat)
+            continue;
+        try {
+            if (new RegExp(pat).test(command))
+                return pat;
+        }
+        catch {
+            // Invalid regex — fall back to a literal substring match so a
+            // malformed pattern still denies rather than silently allowing.
+            if (command.includes(pat))
+                return pat;
+        }
+    }
+    return null;
+}
+function assertCommandAllowed(config, command) {
+    const deny = matchesDeny(command, config.denyPatterns ?? []);
+    if (deny) {
+        throw new RunnerError(`command blocked by denyPattern: ${deny}`, RUNNER_ERROR_CODES.COMMAND_DENIED);
+    }
+    if (config.installBlocked && INSTALL_RE.test(command)) {
+        throw new RunnerError('package installation is blocked by runner policy (installBlocked)', RUNNER_ERROR_CODES.COMMAND_DENIED);
+    }
+}
+function canonical(p) {
+    const abs = resolve(p);
+    try {
+        return realpathSync(abs); // resolve symlinks to block escape via a link
+    }
+    catch {
+        return abs; // path may legitimately not exist yet
+    }
+}
+function assertCwdAllowed(config, cwd) {
+    const roots = config.allowedCwdRoots ?? [];
+    if (roots.length === 0)
+        return; // no restriction configured
+    if (!cwd) {
+        throw new RunnerError('cwd is required when allowedCwdRoots is configured', RUNNER_ERROR_CODES.PATH_DENIED);
+    }
+    const real = canonical(cwd);
+    const allowed = roots.some((root) => {
+        const r = canonical(root);
+        return real === r || real.startsWith(r + sep);
+    });
+    if (!allowed) {
+        throw new RunnerError(`cwd is outside allowedCwdRoots: ${cwd}`, RUNNER_ERROR_CODES.PATH_DENIED);
+    }
+}
+/** Enforce policy for a process.spawn; returns the sanitized env to use. */
+export function enforceSpawnPolicy(config, opts) {
+    assertIsolationSupported(config);
+    assertCwdAllowed(config, opts.cwd);
+    assertCommandAllowed(config, [opts.binary, ...opts.args].join(' '));
+    return { env: sanitizeEnv(opts.env) };
+}
+/** Enforce policy for a shell.exec; returns the sanitized env to use. */
+export function enforceShellPolicy(config, cmd, env) {
+    assertIsolationSupported(config);
+    assertCommandAllowed(config, cmd);
+    return { env: sanitizeEnv(env) };
+}
+//# sourceMappingURL=policy.js.map

package/dist/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAgB,WAAW,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAE3E,0EAA0E;AAC1E,4EAA4E;AAC5E,uEAAuE;AACvE,kEAAkE;AAClE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAC9B;IACE,MAAM;IACN,YAAY;IACZ,iBAAiB;IACjB,UAAU;IACV,uBAAuB;IACvB,mBAAmB;IACnB,cAAc;IACd,YAAY;IACZ,eAAe;IACf,UAAU;IACV,KAAK;IACL,KAAK;IACL,SAAS;IACT,iBAAiB;IACjB,eAAe;IACf,gBAAgB;CACjB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAC9B,CAAC;AAEF,MAAM,UAAU,GACd,kMAAkM,CAAC;AAErM,0DAA0D;AAC1D,MAAM,UAAU,WAAW,CACzB,GAA4B;IAE5B,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC;IACrB,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAAE,SAAS;QACpD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACb,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAoB;IACpD,IAAI,MAAM,CAAC,gBAAgB,KAAK,WAAW,EAAE,CAAC;QAC5C,MAAM,IAAI,WAAW,CACnB,8EAA8E;YAC5E,0FAA0F,EAC5F,kBAAkB,CAAC,cAAc,CAClC,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,IAAI,WAAW,CACnB,qFAAqF,EACrF,kBAAkB,CAAC,cAAc,CAClC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,QAAkB;IACtD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI,CAAC;YACH,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,GAAG,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;YAC9D,gEAAgE;YAChE,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,GAAG,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAoB,EAAE,OAAe;IACjE,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IAC7D,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,IAAI,WAAW,CACnB,mCAAmC,IAAI,EAAE,EACzC,kBAAkB,CAAC,cAAc,CAClC,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,WAAW,CACnB,mEAAmE,EACnE,kBAAkB,CAAC,cAAc,CAClC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,8CAA8C;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,CAAC,sCAAsC;IACpD,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAoB,EAAE,GAAuB;IACrE,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC;IAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,4BAA4B;IAC5D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,WAAW,CACnB,oDAAoD,EACpD,kBAAkB,CAAC,WAAW,CAC/B,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QAClC,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,WAAW,CACnB,mCAAmC,GAAG,EAAE,EACxC,kBAAkB,CAAC,WAAW,CAC/B,CAAC;IACJ,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB,CAChC,MAAoB,EACpB,IAAoF;IAEpF,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACjC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,oBAAoB,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE,OAAO,EAAE,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,kBAAkB,CAChC,MAAoB,EACpB,GAAW,EACX,GAA4B;IAE5B,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACjC,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,OAAO,EAAE,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;AACnC,CAAC"}

package/dist/process-manager.d.ts

@@ -0,0 +1,107 @@
+import { EventEmitter } from 'events';
+import { ProcessHandle, ProcessSignal, ProcessStatus, ReadResult, ShellExecResult, SpawnOptions, WaitForIdleOptions, WaitForIdleResult, WaitResult } from './types.js';
+/**
+ * Adapter interface around the actual PTY/pipe implementation.
+ *
+ * The runtime uses node-pty for PTY mode (the default) and node's
+ * built-in child_process for raw pipe mode. Both behind one interface
+ * so tests can swap in a synthetic child without spinning subprocesses.
+ *
+ * node-pty isn't loaded at module-init time; it's a native dep that
+ * we don't want to require for unit tests. The default factory below
+ * lazy-loads it on first PTY spawn, so non-PTY tests never touch it.
+ */
+export interface ProcessAdapter extends EventEmitter {
+    readonly pid: number | undefined;
+    write(data: string): void;
+    resize?(cols: number, rows: number): void;
+    kill(signal?: string): void;
+    /**
+     * Best-effort EOF on stdin. PTY mode sends ^D; pipe mode closes
+     * the writable side of the child's stdin stream.
+     */
+    closeInput(): void;
+}
+export interface AdapterFactory {
+    spawnPty(opts: SpawnOptions): Promise<ProcessAdapter>;
+    spawnPipe(opts: SpawnOptions): Promise<ProcessAdapter>;
+}
+interface RunningProcess {
+    handle: ProcessHandle;
+    adapter: ProcessAdapter;
+    /** Output buffer; bytes accumulate here between read() calls. */
+    buffer: string;
+    /**
+     * Rolling tail of recent output, capped and NOT drained by read(). Used for
+     * non-destructive status snapshots (coding-agent status classification needs
+     * to see the current screen even after the agent has drained `buffer`).
+     */
+    recentTail: string;
+    /** Last time we observed any output activity from the child. */
+    lastOutputAt: number;
+    /** Resolved when the child exits, with the final exit info. */
+    exitPromise: Promise<WaitResult>;
+    exitInfo: WaitResult | null;
+}
+/**
+ * Per-runner process orchestrator.
+ *
+ * Bookkeeping: every process is namespaced by workspaceId. Cross-
+ * workspace lookups error loudly (process_cross_workspace) — this is
+ * cheap insurance against an agent in workspace A handing a stale
+ * process_id to a tool that runs in workspace B.
+ *
+ * Buffering: stdout/stderr accumulate in a per-process string buffer.
+ * read() drains it; wait_for_idle() reads with idle-detection. We
+ * don't try to interpret encodings or framing; the runner's job is
+ * to deliver bytes faithfully, not to reason about what they mean.
+ */
+export declare class ProcessManager {
+    private readonly adapter;
+    private readonly maxConcurrent;
+    private readonly processes;
+    constructor(adapter: AdapterFactory, maxConcurrent: number);
+    inUse(): number;
+    list(workspaceId?: string): ProcessHandle[];
+    spawn(workspaceId: string, opts: SpawnOptions): Promise<ProcessHandle>;
+    /** Look up a process; enforces workspace ownership. */
+    getOrThrow(workspaceId: string, processId: string): RunningProcess;
+    write(workspaceId: string, processId: string, data: string): void;
+    /**
+     * Drain the output buffer. Returns whatever has accumulated since
+     * the last call; future calls return only what's new.
+     */
+    read(workspaceId: string, processId: string): ReadResult;
+    /**
+     * Non-destructive peek at the recent output tail. Unlike read(), this does
+     * NOT drain anything — it's for status classification, which must work even
+     * after the agent has drained `buffer` via read(). Returns the rolling tail
+     * (capped at RECENT_TAIL_CAP) plus the process status and idle interval.
+     */
+    snapshot(workspaceId: string, processId: string): {
+        tail: string;
+        binary: string;
+        status: ProcessStatus;
+        idleMs: number;
+    };
+    /**
+     * Subscribe to a process's live output and exit. Push-based counterpart to
+     * read(): the coding-session layer streams chunks to the backend as they
+     * arrive instead of polling. Does NOT drain the pull buffer — a caller can
+     * observe and read() the same process without losing bytes in either place.
+     * Returns an unsubscribe function.
+     */
+    observe(workspaceId: string, processId: string, handlers: {
+        onData?: (chunk: string) => void;
+        onExit?: (info: WaitResult) => void;
+    }): () => void;
+    waitForIdle(workspaceId: string, processId: string, opts: WaitForIdleOptions): Promise<WaitForIdleResult>;
+    closeInput(workspaceId: string, processId: string): void;
+    signal(workspaceId: string, processId: string, sig: ProcessSignal): void;
+    wait(workspaceId: string, processId: string, timeoutMs?: number): Promise<WaitResult>;
+    /** Kill all processes for a workspace and forget them. Used on workspace release. */
+    killWorkspace(workspaceId: string): Promise<number>;
+}
+export declare function createDefaultAdapterFactory(): AdapterFactory;
+export declare function shellExec(cmd: string, env?: Record<string, string>, timeoutMs?: number): Promise<ShellExecResult>;
+export {};