@appforge-ci/admin-cli 0.3.1 → 0.3.3

package/dist/lib/build-user.test.js

@@ -0,0 +1,161 @@
+import "../test-support/home-sandbox.js";
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { BUILD_HELPER_PATH, BUILD_USER_NAME } from "@appforge-ci/agent/dist/lib/sandbox/build-user.js";
+import { BUILD_USER_PF_ANCHOR, pfRulesSha256, renderBuildUserPfRules } from "@appforge-ci/agent/dist/lib/sandbox/pf-rules.js";
+import { APPFORGE_ETC_DIR, PF_RULES_FILE, SUDOERS_FILE, ensureSudoersLines, installBuildUser, nextFreeSystemId, renderBuildHelperScript, requiredSudoersLines, } from "./build-user.js";
+function fakeDeps(over = {}) {
+    const calls = [];
+    const writes = [];
+    const logs = [];
+    const deps = {
+        userExists: () => false,
+        groupExists: () => false,
+        isGroupMember: () => false,
+        listUserUids: () => "a 501\nb 502\n",
+        listGroupGids: () => "",
+        etcDirExists: () => false,
+        readSudoers: () => "",
+        validateSudoers: () => { },
+        writeRootOwnedFile: (path, content, mode) => writes.push({ path, content, mode }),
+        run: (cmd, args) => calls.push({ cmd, args }),
+        whoami: () => "tooming",
+        log: (l) => logs.push(l),
+        ...over,
+    };
+    return { deps, calls, writes, logs };
+}
+test("nextFreeSystemId picks one past the highest used id in the 300-399 band, and never picks one already in use", () => {
+    assert.equal(nextFreeSystemId("a 399\nb 398\n"), 397);
+    assert.equal(nextFreeSystemId(""), 399);
+    assert.equal(nextFreeSystemId("unrelated 501\n"), 399, "a regular-user uid outside the band is irrelevant");
+    assert.equal(nextFreeSystemId("x 398\ny 397\n"), 399, "picks the TOP of the band when it is itself free, not just one above the highest used id");
+});
+test("nextFreeSystemId throws rather than guessing when the entire band is already taken", () => {
+    const all = Array.from({ length: 100 }, (_, i) => `u${i} ${300 + i}`).join("\n");
+    assert.throws(() => nextFreeSystemId(all, 399, 300), /no free id/);
+});
+test("requiredSudoersLines: one line per grant, neither one grants blanket root or blanket sandbox-exec to anyone but the build user", () => {
+    const { helper, becomeUser } = requiredSudoersLines("tooming", "_appforgebuild");
+    assert.equal(helper, `tooming ALL=(root) NOPASSWD: ${BUILD_HELPER_PATH} *`);
+    assert.equal(becomeUser, "tooming ALL=(_appforgebuild) NOPASSWD: /usr/bin/sandbox-exec *");
+    assert.ok(!helper.includes("ALL=(ALL)"), "the root grant must be scoped to one fixed path, not every command");
+    assert.ok(becomeUser.includes("(_appforgebuild)"), "the second grant must become the build user specifically, not root");
+});
+test("renderBuildHelperScript substitutes every token and leaves none behind", () => {
+    const script = renderBuildHelperScript("_appforgebuild", "/Users/tooming/appforge/jobs.noindex", "/Users/tooming/appforge/cache.noindex");
+    assert.ok(script.includes('BUILD_USER="_appforgebuild"'));
+    assert.ok(script.includes('JOBS_ROOT="/Users/tooming/appforge/jobs.noindex"'));
+    assert.ok(script.includes('CACHE_ROOT="/Users/tooming/appforge/cache.noindex"'));
+    assert.ok(script.includes(`PF_ANCHOR="${BUILD_USER_PF_ANCHOR}"`));
+    assert.doesNotMatch(script, /@@[A-Z_]+@@/);
+});
+// ---- ensureSudoersLines: the single most security-relevant piece — exercised directly ----
+test("ensureSudoersLines appends only the missing lines, validates with visudo BEFORE writing, and never touches an existing unrelated line", () => {
+    const { deps, writes } = fakeDeps({ readSudoers: () => "tooming ALL=(root) NOPASSWD: /sbin/shutdown -r now\n" });
+    let validated;
+    deps.validateSudoers = (content) => {
+        validated = content;
+    };
+    ensureSudoersLines(["tooming ALL=(root) NOPASSWD: /etc/appforge/build-helper.sh *", "tooming ALL=(_appforgebuild) NOPASSWD: /usr/bin/sandbox-exec *"], deps);
+    assert.equal(writes.length, 1);
+    assert.equal(writes[0].path, SUDOERS_FILE);
+    assert.equal(writes[0].mode, "0440");
+    assert.match(writes[0].content, /^tooming ALL=\(root\) NOPASSWD: \/sbin\/shutdown -r now\n/, "the REBOOT_HOST line from bootstrap.sh is kept, not replaced");
+    assert.match(writes[0].content, /build-helper\.sh \*\n/);
+    assert.match(writes[0].content, /sandbox-exec \*\n$/);
+    assert.equal(validated, writes[0].content, "the EXACT content that gets written is what was validated — never a different string");
+});
+test("ensureSudoersLines is a no-op when every line is already present — never re-validates, never re-writes", () => {
+    const helper = "tooming ALL=(root) NOPASSWD: /etc/appforge/build-helper.sh *";
+    const becomeUser = "tooming ALL=(_appforgebuild) NOPASSWD: /usr/bin/sandbox-exec *";
+    const { deps, writes } = fakeDeps({ readSudoers: () => `${helper}\n${becomeUser}\n` });
+    let validateCalls = 0;
+    deps.validateSudoers = () => {
+        validateCalls++;
+    };
+    ensureSudoersLines([helper, becomeUser], deps);
+    assert.equal(writes.length, 0);
+    assert.equal(validateCalls, 0);
+});
+test("ensureSudoersLines adds only the ONE line that's actually missing when the other already exists", () => {
+    const helper = "tooming ALL=(root) NOPASSWD: /etc/appforge/build-helper.sh *";
+    const becomeUser = "tooming ALL=(_appforgebuild) NOPASSWD: /usr/bin/sandbox-exec *";
+    const { deps, writes } = fakeDeps({ readSudoers: () => `${helper}\n` });
+    ensureSudoersLines([helper, becomeUser], deps);
+    assert.equal(writes.length, 1);
+    const added = writes[0].content.split("\n").filter(Boolean);
+    assert.deepEqual(added, [helper, becomeUser]);
+});
+test("ensureSudoersLines refuses (never writes) when visudo rejects the candidate content", () => {
+    const { deps, writes } = fakeDeps();
+    deps.validateSudoers = () => {
+        throw new Error("visudo: syntax error");
+    };
+    assert.throws(() => ensureSudoersLines(["x ALL=(root) NOPASSWD: /bin/true"], deps), /syntax error/);
+    assert.equal(writes.length, 0, "a rejected candidate must never reach the real sudoers file");
+});
+// ---- installBuildUser: the full orchestration, each step's idempotency in isolation ----
+test("installBuildUser creates the account, adds the agent user to its group, installs the helper + pf rules, and writes both sudoers lines — on a clean host", () => {
+    const { deps, calls, writes, logs } = fakeDeps();
+    installBuildUser({ user: "_appforgebuild", agentUser: "tooming", jobsRoot: "/j", cacheRoot: "/c" }, deps);
+    assert.ok(calls.some((c) => c.cmd === "sudo" && c.args.join(" ") === "dseditgroup -o create -i 399 _appforgebuild"), "the group is created atomically, WITH its gid, in one call");
+    assert.ok(calls.some((c) => c.cmd === "sudo" && c.args.join(" ") === "dscl . -create /Users/_appforgebuild UniqueID 399"));
+    assert.ok(calls.some((c) => c.cmd === "sudo" && c.args.join(" ") === "dscl . -create /Users/_appforgebuild IsHidden 1"));
+    assert.ok(!calls.some((c) => c.args.includes("Password")), "no password entry is ever created for this account");
+    assert.ok(calls.some((c) => c.cmd === "sudo" && c.args.join(" ") === "dseditgroup -o edit -a tooming -t user _appforgebuild"));
+    assert.ok(calls.some((c) => c.cmd === "sudo" && c.args.join(" ") === "mkdir -m 0755 /etc/appforge"));
+    assert.ok(writes.some((w) => w.path === BUILD_HELPER_PATH && w.mode === "0500" && w.content.includes('JOBS_ROOT="/j"')));
+    assert.ok(writes.some((w) => w.path === PF_RULES_FILE && w.mode === "0600"));
+    assert.ok(calls.some((c) => c.cmd === "sudo" && c.args.join(" ") === `${BUILD_HELPER_PATH} pf-reload`));
+    assert.ok(writes.some((w) => w.path === SUDOERS_FILE));
+    assert.match(logs.join("\n"), /Done\./);
+});
+test("installBuildUser picks an id free in BOTH namespaces — reproduces the real failure on a stock Mac, where com.apple.access_ssh/access_screensharing/access_sessionkey/access_disabled/access_ftp already occupy gids 395-399", () => {
+    const { deps, calls } = fakeDeps({
+        listUserUids: () => "", // no user anywhere near the band: a check of this listing ALONE would (wrongly) pick 399
+        listGroupGids: () => ["com.apple.access_ftp 395", "com.apple.access_disabled 396", "com.apple.access_sessionkey 397", "com.apple.access_screensharing 398", "com.apple.access_ssh 399"].join("\n"),
+    });
+    installBuildUser({ user: "_appforgebuild", agentUser: "tooming", jobsRoot: "/j", cacheRoot: "/c" }, deps);
+    assert.ok(calls.some((c) => c.cmd === "sudo" && c.args.join(" ") === "dseditgroup -o create -i 394 _appforgebuild"), "394 is the first id free in BOTH listings, not 399");
+    assert.ok(!calls.some((c) => c.args.includes("399")), "399 (taken by com.apple.access_ssh) must never be assigned to anything here");
+});
+test("installBuildUser is fully idempotent: nothing is created, written, or run again when everything already exists", () => {
+    const helper = requiredSudoersLines("tooming", "_appforgebuild").helper;
+    const becomeUser = requiredSudoersLines("tooming", "_appforgebuild").becomeUser;
+    const { deps, calls, writes } = fakeDeps({
+        userExists: () => true,
+        groupExists: () => true,
+        isGroupMember: () => true,
+        etcDirExists: () => true,
+        readSudoers: () => `${helper}\n${becomeUser}\n`,
+    });
+    installBuildUser({ user: "_appforgebuild", agentUser: "tooming", jobsRoot: "/j", cacheRoot: "/c" }, deps);
+    // The account/group/membership/etc-dir/sudoers steps all skip; only the helper script and pf rules are
+    // UNCONDITIONALLY rewritten each run (so a template or rules change always takes effect on the next
+    // install), plus the one pf-reload `run` call that goes with them.
+    assert.ok(!calls.some((c) => c.args[0] === "dscl"), "no dscl calls at all: nothing about the account needed creating");
+    assert.ok(!calls.some((c) => c.cmd === "sudo" && c.args[0] === "dseditgroup"));
+    assert.ok(!calls.some((c) => c.cmd === "sudo" && c.args[0] === "mkdir"));
+    assert.equal(writes.find((w) => w.path === SUDOERS_FILE), undefined, "sudoers is untouched when both lines are already present");
+    assert.equal(calls.filter((c) => c.cmd === "sudo" && c.args.join(" ") === `${BUILD_HELPER_PATH} pf-reload`).length, 1);
+});
+test("installBuildUser defaults user to BUILD_USER_NAME and agentUser to whoami()", () => {
+    const { deps, writes } = fakeDeps({ whoami: () => "martin" });
+    installBuildUser({ jobsRoot: "/j", cacheRoot: "/c" }, deps);
+    assert.ok(writes.some((w) => w.content.includes(`BUILD_USER="${BUILD_USER_NAME}"`)));
+    assert.ok(writes.some((w) => w.path === SUDOERS_FILE && w.content.includes("martin ALL=")));
+});
+test("the pf rules actually written match pf-rules.ts's own renderer exactly (no drift between the two modules)", () => {
+    const { deps, writes } = fakeDeps();
+    installBuildUser({ user: "_appforgebuild", agentUser: "tooming", jobsRoot: "/j", cacheRoot: "/c" }, deps);
+    const pfWrite = writes.find((w) => w.path === PF_RULES_FILE);
+    assert.equal(pfWrite.content, renderBuildUserPfRules("_appforgebuild"));
+    assert.equal(pfRulesSha256(pfWrite.content), pfRulesSha256(renderBuildUserPfRules("_appforgebuild")));
+});
+test("APPFORGE_ETC_DIR / PF_RULES_FILE / SUDOERS_FILE are the exact paths the agent-side detector and the helper template expect", () => {
+    assert.equal(APPFORGE_ETC_DIR, "/etc/appforge");
+    assert.equal(PF_RULES_FILE, "/etc/appforge/build-user.pf.conf");
+    assert.equal(SUDOERS_FILE, "/etc/sudoers.d/appforge-agent", "the SAME file bootstrap.ts's REBOOT_HOST line already lives in — never a second sudoers file");
+});
+//# sourceMappingURL=build-user.test.js.map

package/dist/lib/build-user.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-user.test.js","sourceRoot":"","sources":["../../src/lib/build-user.test.ts"],"names":[],"mappings":"AAAA,OAAO,iCAAiC,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,mDAAmD,CAAC;AACvG,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,iDAAiD,CAAC;AAC9H,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,EACvB,oBAAoB,GAErB,MAAM,iBAAiB,CAAC;AAEzB,SAAS,QAAQ,CAAC,OAAsC,EAAE;IACxD,MAAM,KAAK,GAAsC,EAAE,CAAC;IACpD,MAAM,MAAM,GAAsD,EAAE,CAAC;IACrE,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAyB;QACjC,UAAU,EAAE,GAAG,EAAE,CAAC,KAAK;QACvB,WAAW,EAAE,GAAG,EAAE,CAAC,KAAK;QACxB,aAAa,EAAE,GAAG,EAAE,CAAC,KAAK;QAC1B,YAAY,EAAE,GAAG,EAAE,CAAC,gBAAgB;QACpC,aAAa,EAAE,GAAG,EAAE,CAAC,EAAE;QACvB,YAAY,EAAE,GAAG,EAAE,CAAC,KAAK;QACzB,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE;QACrB,eAAe,EAAE,GAAG,EAAE,GAAE,CAAC;QACzB,kBAAkB,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACjF,GAAG,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QAC7C,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS;QACvB,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACxB,GAAG,IAAI;KACR,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,IAAI,CAAC,6GAA6G,EAAE,GAAG,EAAE;IACvH,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,GAAG,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,GAAG,EAAE,mDAAmD,CAAC,CAAC;IAC5G,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,0FAA0F,CAAC,CAAC;AACpJ,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oFAAoF,EAAE,GAAG,EAAE;IAC9F,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjF,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,YAAY,CAAC,CAAC;AACrE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gIAAgI,EAAE,GAAG,EAAE;IAC1I,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,oBAAoB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IACjF,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,gCAAgC,iBAAiB,IAAI,CAAC,CAAC;IAC5E,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,gEAAgE,CAAC,CAAC;IAC3F,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,oEAAoE,CAAC,CAAC;IAC/G,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,oEAAoE,CAAC,CAAC;AAC3H,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wEAAwE,EAAE,GAAG,EAAE;IAClF,MAAM,MAAM,GAAG,uBAAuB,CAAC,gBAAgB,EAAE,sCAAsC,EAAE,uCAAuC,CAAC,CAAC;IAC1I,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CAAC,CAAC;IAC1D,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,kDAAkD,CAAC,CAAC,CAAC;IAC/E,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,oDAAoD,CAAC,CAAC,CAAC;IACjF,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,oBAAoB,GAAG,CAAC,CAAC,CAAC;IAClE,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAC7C,CAAC,CAAC,CAAC;AAEH,6FAA6F;AAE7F,IAAI,CAAC,uIAAuI,EAAE,GAAG,EAAE;IACjJ,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,sDAAsD,EAAE,CAAC,CAAC;IACjH,IAAI,SAA6B,CAAC;IAClC,IAAI,CAAC,eAAe,GAAG,CAAC,OAAO,EAAE,EAAE;QACjC,SAAS,GAAG,OAAO,CAAC;IACtB,CAAC,CAAC;IACF,kBAAkB,CAAC,CAAC,8DAA8D,EAAE,gEAAgE,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7J,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC5C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,2DAA2D,EAAE,8DAA8D,CAAC,CAAC;IAC9J,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;IACvD,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,sFAAsF,CAAC,CAAC;AACtI,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wGAAwG,EAAE,GAAG,EAAE;IAClH,MAAM,MAAM,GAAG,8DAA8D,CAAC;IAC9E,MAAM,UAAU,GAAG,gEAAgE,CAAC;IACpF,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,MAAM,KAAK,UAAU,IAAI,EAAE,CAAC,CAAC;IACvF,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC,eAAe,GAAG,GAAG,EAAE;QAC1B,aAAa,EAAE,CAAC;IAClB,CAAC,CAAC;IACF,kBAAkB,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;AACjC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iGAAiG,EAAE,GAAG,EAAE;IAC3G,MAAM,MAAM,GAAG,8DAA8D,CAAC;IAC9E,MAAM,UAAU,GAAG,gEAAgE,CAAC;IACpF,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,MAAM,IAAI,EAAE,CAAC,CAAC;IACxE,kBAAkB,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAChD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qFAAqF,EAAE,GAAG,EAAE;IAC/F,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC;IACpC,IAAI,CAAC,eAAe,GAAG,GAAG,EAAE;QAC1B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC,CAAC;IACF,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,CAAC,kCAAkC,CAAC,EAAE,IAAI,CAAC,EAAE,cAAc,CAAC,CAAC;IACpG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,6DAA6D,CAAC,CAAC;AAChG,CAAC,CAAC,CAAC;AAEH,2FAA2F;AAE3F,IAAI,CAAC,yJAAyJ,EAAE,GAAG,EAAE;IACnK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,EAAE,CAAC;IACjD,gBAAgB,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAE1G,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,6CAA6C,CAAC,EAAE,4DAA4D,CAAC,CAAC;IACnL,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,mDAAmD,CAAC,CAAC,CAAC;IAC3H,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,iDAAiD,CAAC,CAAC,CAAC;IACzH,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,oDAAoD,CAAC,CAAC;IACjH,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,uDAAuD,CAAC,CAAC,CAAC;IAC/H,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,6BAA6B,CAAC,CAAC,CAAC;IACrG,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;IACzH,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC;IAC7E,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,iBAAiB,YAAY,CAAC,CAAC,CAAC;IACxG,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC;IACvD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6NAA6N,EAAE,GAAG,EAAE;IACvO,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;QAC/B,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,yFAAyF;QACjH,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,0BAA0B,EAAE,+BAA+B,EAAE,iCAAiC,EAAE,oCAAoC,EAAE,0BAA0B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;KACnM,CAAC,CAAC;IACH,gBAAgB,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAC1G,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,6CAA6C,CAAC,EAAE,oDAAoD,CAAC,CAAC;IAC3K,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,6EAA6E,CAAC,CAAC;AACvI,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gHAAgH,EAAE,GAAG,EAAE;IAC1H,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC;IACxE,MAAM,UAAU,GAAG,oBAAoB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,UAAU,CAAC;IAChF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;QACvC,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI;QACtB,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI;QACvB,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI;QACzB,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI;QACxB,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,MAAM,KAAK,UAAU,IAAI;KAChD,CAAC,CAAC;IACH,gBAAgB,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAC1G,uGAAuG;IACvG,oGAAoG;IACpG,mEAAmE;IACnE,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,iEAAiE,CAAC,CAAC;IACvH,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC;IAC/E,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC;IACzE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,SAAS,EAAE,0DAA0D,CAAC,CAAC;IACjI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,iBAAiB,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AACzH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6EAA6E,EAAE,GAAG,EAAE;IACvF,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9D,gBAAgB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAC5D,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,eAAe,GAAG,CAAC,CAAC,CAAC,CAAC;IACrF,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;AAC9F,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2GAA2G,EAAE,GAAG,EAAE;IACrH,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC;IACpC,gBAAgB,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAC1G,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAE,CAAC;IAC9D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,sBAAsB,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACxE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;AACxG,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4HAA4H,EAAE,GAAG,EAAE;IACtI,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;IAChD,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,kCAAkC,CAAC,CAAC;IAChE,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,+BAA+B,EAAE,8FAA8F,CAAC,CAAC;AAC9J,CAAC,CAAC,CAAC"}

package/dist/lib/runner-user.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Gives a GitHub Actions self-hosted runner its OWN, separate macOS user — run ON the target Mac, by the
+ * operator, in their own terminal (`appforge-admin agents install-runner-user`).
+ *
+ * Why. A runner installed as the agent's OWN user exposes every job's environment (CI secrets included) to
+ * anything else that runs as that same user, including a regulated build: `sysctl kern.procargs2` lets any
+ * same-uid process read another's argv and env, and Seatbelt cannot close that (docs/security.md's "Known
+ * gaps"). packages/agent's own `detectSameUidCoHostedRunner` (co-hosted-runner.ts) now refuses a regulated
+ * build while that condition holds, but refusing is a workaround, not a fix: giving the runner a DIFFERENT
+ * uid removes the condition outright, with no ongoing check needed. The Mac mini in this fleet already has
+ * exactly this (its runner runs as `ci-runner`, a separate account) — this command automates making a Mac
+ * that doesn't look like that one.
+ *
+ * What it does, idempotently (safe to re-run):
+ *   1. Creates a plain, ordinary (not hidden, not admin) macOS user with its own home directory — a real
+ *      account, the same kind the operator would create by hand in System Settings, not a system/service
+ *      account: GitHub's runner sometimes needs a real login session for GUI frameworks (Xcode, the
+ *      Simulator), which a hidden service account cannot provide. Skips account creation entirely if the
+ *      user already exists, so re-running never fights with (or resets) an account the operator customised.
+ *   2. Downloads and extracts the official GitHub Actions runner release into that account's home, owned
+ *      by it.
+ *
+ * What it deliberately does NOT do, and why:
+ *   - Register the runner with GitHub (`config.sh --url --token`) or install/start its service (`svc.sh`).
+ *     That needs a registration token the operator copies from GitHub's own UI (Settings → Actions →
+ *     Runners → "New self-hosted runner") — short-lived (about an hour) and single-use by design, so this
+ *     command takes it only as an explicit, one-time `--url`/--token pair the operator pastes in, and never
+ *     stores or re-derives it. Given both, it runs the two commands GitHub's own instructions show, as that
+ *     user; given neither, it prints those same two commands for the operator to run themselves.
+ *   - Enable automatic login or any other change to how this Mac's console session works. A runner that
+ *     needs GUI access (Simulator, keychain unlock) needs a real logged-in session for this user, which is a
+ *     call about THIS Mac's physical security the operator makes themselves (Lock Screen settings), not
+ *     something this command decides on their behalf.
+ */
+export declare const DEFAULT_RUNNER_USER = "ci-runner";
+/** Pinned, update deliberately (same reasoning as MIN_EGRESS_HELPER_VERSION elsewhere): the exact release
+ *  this command downloads, checked against GitHub's own release list when bumped. */
+export declare const DEFAULT_RUNNER_VERSION = "2.321.0";
+export declare function runnerDownloadUrl(version: string, arch: "arm64" | "x64"): string;
+/** `process.arch` as the runner release asset names it (`x64`, not Node's own `x64`... they happen to agree;
+ *  arm64 likewise — kept as its own function so a future Node arch string that does NOT agree has one place
+ *  to fix, and so this is mockable in a test without faking process.arch globally). */
+export declare function runnerArch(nodeArch?: string): "arm64" | "x64";
+export interface InstallRunnerUserDeps {
+    userExists(user: string): boolean;
+    /** Raw `dscl . -list /Users UniqueID` output: one `<name> <uid>` line per user. Its own function (rather
+     *  than folding into `run`/`tryRun`) so `nextFreeUid`'s parsing is testable without a real `dscl`. */
+    listUserUids(): string;
+    run(cmd: string, args: string[]): void;
+    tryRun(cmd: string, args: string[]): boolean;
+    exists(path: string): boolean;
+    mkdirp(path: string): void;
+    log(line: string): void;
+    arch: string;
+}
+export declare const realInstallRunnerUserDeps: InstallRunnerUserDeps;
+export interface InstallRunnerUserOptions {
+    user?: string;
+    version?: string;
+    /** From GitHub's "New self-hosted runner" page. Both or neither — see the module docblock. */
+    githubUrl?: string;
+    githubToken?: string;
+    /** Shown to GitHub as this runner's name. Default: this Mac's hostname. */
+    runnerName?: string;
+}
+/**
+ * The exact commands GitHub's own instructions show for registering and starting a downloaded runner, as
+ * absolute-path argv arrays (never a shell string: nothing here needs `bash -c` or its quoting) — one
+ * function so the "run them now" and "print them for later" paths can never drift apart.
+ */
+export declare function registrationCommands(opts: {
+    dir: string;
+    user: string;
+    githubUrl: string;
+    githubToken: string;
+    runnerName: string;
+}): {
+    config: string[];
+    svcInstall: string[];
+    svcStart: string[];
+};
+/** The standard scripted-macOS-user-creation idiom: one past the highest uid already in the regular (500+)
+ *  range. dscl has no "pick one for me" primitive the way System Settings' own UI does. A listing with
+ *  nothing parseable (including an empty string, `listUserUids`'s own failure value) falls back to 501,
+ *  macOS's own first regular uid. */
+export declare function nextFreeUid(listing: string): number;
+/** Creates the dedicated account, or leaves it alone if it already exists. Returns its home directory. */
+export declare function ensureRunnerUser(user: string, deps?: InstallRunnerUserDeps): string;
+/** Downloads and extracts the runner release into `<home>/actions-runner`, owned by `user`. A no-op (besides
+ *  logging) if that directory already looks like a runner install. */
+export declare function ensureRunnerDownloaded(user: string, home: string, version: string, deps?: InstallRunnerUserDeps): string;
+export declare function installRunnerUser(opts?: InstallRunnerUserOptions, deps?: InstallRunnerUserDeps): void;
+//# sourceMappingURL=runner-user.d.ts.map

package/dist/lib/runner-user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-user.d.ts","sourceRoot":"","sources":["../../src/lib/runner-user.ts"],"names":[],"mappings":"AASA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,eAAO,MAAM,mBAAmB,cAAc,CAAC;AAC/C;qFACqF;AACrF,eAAO,MAAM,sBAAsB,YAAY,CAAC;AAEhD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,CAEhF;AAED;;uFAEuF;AACvF,wBAAgB,UAAU,CAAC,QAAQ,GAAE,MAAqB,GAAG,OAAO,GAAG,KAAK,CAE3E;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAClC;0GACsG;IACtG,YAAY,IAAI,MAAM,CAAC;IACvB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC7C,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,eAAO,MAAM,yBAAyB,EAAE,qBAkCvC,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8FAA8F;IAC9F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG;IAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CASjE;AAED;;;qCAGqC;AACrC,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAOnD;AAED,0GAA0G;AAC1G,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,qBAAiD,GAAG,MAAM,CAwB9G;AAED;sEACsE;AACtE,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,qBAAiD,GAAG,MAAM,CAgBnJ;AAED,wBAAgB,iBAAiB,CAAC,IAAI,GAAE,wBAA6B,EAAE,IAAI,GAAE,qBAAiD,GAAG,IAAI,CA0BpI"}

package/dist/lib/runner-user.js

@@ -0,0 +1,191 @@
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+// (existsSync/mkdirSync are used only inside realInstallRunnerUserDeps below — every function in this file
+// that needs to touch the filesystem goes through the injectable `deps.exists`/`deps.mkdirp`, the same
+// seam `run`/`tryRun`/`userExists`/`listUserUids` already are, so the whole module is testable without a
+// real `/Users/ci-runner`.)
+/**
+ * Gives a GitHub Actions self-hosted runner its OWN, separate macOS user — run ON the target Mac, by the
+ * operator, in their own terminal (`appforge-admin agents install-runner-user`).
+ *
+ * Why. A runner installed as the agent's OWN user exposes every job's environment (CI secrets included) to
+ * anything else that runs as that same user, including a regulated build: `sysctl kern.procargs2` lets any
+ * same-uid process read another's argv and env, and Seatbelt cannot close that (docs/security.md's "Known
+ * gaps"). packages/agent's own `detectSameUidCoHostedRunner` (co-hosted-runner.ts) now refuses a regulated
+ * build while that condition holds, but refusing is a workaround, not a fix: giving the runner a DIFFERENT
+ * uid removes the condition outright, with no ongoing check needed. The Mac mini in this fleet already has
+ * exactly this (its runner runs as `ci-runner`, a separate account) — this command automates making a Mac
+ * that doesn't look like that one.
+ *
+ * What it does, idempotently (safe to re-run):
+ *   1. Creates a plain, ordinary (not hidden, not admin) macOS user with its own home directory — a real
+ *      account, the same kind the operator would create by hand in System Settings, not a system/service
+ *      account: GitHub's runner sometimes needs a real login session for GUI frameworks (Xcode, the
+ *      Simulator), which a hidden service account cannot provide. Skips account creation entirely if the
+ *      user already exists, so re-running never fights with (or resets) an account the operator customised.
+ *   2. Downloads and extracts the official GitHub Actions runner release into that account's home, owned
+ *      by it.
+ *
+ * What it deliberately does NOT do, and why:
+ *   - Register the runner with GitHub (`config.sh --url --token`) or install/start its service (`svc.sh`).
+ *     That needs a registration token the operator copies from GitHub's own UI (Settings → Actions →
+ *     Runners → "New self-hosted runner") — short-lived (about an hour) and single-use by design, so this
+ *     command takes it only as an explicit, one-time `--url`/--token pair the operator pastes in, and never
+ *     stores or re-derives it. Given both, it runs the two commands GitHub's own instructions show, as that
+ *     user; given neither, it prints those same two commands for the operator to run themselves.
+ *   - Enable automatic login or any other change to how this Mac's console session works. A runner that
+ *     needs GUI access (Simulator, keychain unlock) needs a real logged-in session for this user, which is a
+ *     call about THIS Mac's physical security the operator makes themselves (Lock Screen settings), not
+ *     something this command decides on their behalf.
+ */
+export const DEFAULT_RUNNER_USER = "ci-runner";
+/** Pinned, update deliberately (same reasoning as MIN_EGRESS_HELPER_VERSION elsewhere): the exact release
+ *  this command downloads, checked against GitHub's own release list when bumped. */
+export const DEFAULT_RUNNER_VERSION = "2.321.0";
+export function runnerDownloadUrl(version, arch) {
+    return `https://github.com/actions/runner/releases/download/v${version}/actions-runner-osx-${arch}-${version}.tar.gz`;
+}
+/** `process.arch` as the runner release asset names it (`x64`, not Node's own `x64`... they happen to agree;
+ *  arm64 likewise — kept as its own function so a future Node arch string that does NOT agree has one place
+ *  to fix, and so this is mockable in a test without faking process.arch globally). */
+export function runnerArch(nodeArch = process.arch) {
+    return nodeArch === "arm64" ? "arm64" : "x64";
+}
+export const realInstallRunnerUserDeps = {
+    userExists(user) {
+        try {
+            execFileSync("dscl", [".", "-read", `/Users/${user}`, "UniqueID"], { stdio: "ignore" });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    },
+    listUserUids() {
+        try {
+            return execFileSync("dscl", [".", "-list", "/Users", "UniqueID"], { encoding: "utf8" });
+        }
+        catch {
+            return "";
+        }
+    },
+    run(cmd, args) {
+        // eslint-disable-next-line no-console
+        console.log(`  $ ${cmd} ${args.join(" ")}`);
+        execFileSync(cmd, args, { stdio: "inherit" });
+    },
+    tryRun(cmd, args) {
+        try {
+            execFileSync(cmd, args, { stdio: "ignore" });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    },
+    exists: (path) => existsSync(path),
+    mkdirp: (path) => mkdirSync(path, { recursive: true }),
+    // eslint-disable-next-line no-console
+    log: (l) => console.log(l),
+    arch: runnerArch(),
+};
+/**
+ * The exact commands GitHub's own instructions show for registering and starting a downloaded runner, as
+ * absolute-path argv arrays (never a shell string: nothing here needs `bash -c` or its quoting) — one
+ * function so the "run them now" and "print them for later" paths can never drift apart.
+ */
+export function registrationCommands(opts) {
+    const svc = join(opts.dir, "svc.sh");
+    return {
+        config: [join(opts.dir, "config.sh"), "--url", opts.githubUrl, "--token", opts.githubToken, "--unattended", "--name", opts.runnerName],
+        // `svc.sh install [username]` must be given the target user explicitly: run under `sudo` with none, it
+        // would install the service to run as root, which is exactly what this command exists to avoid.
+        svcInstall: [svc, "install", opts.user],
+        svcStart: [svc, "start"],
+    };
+}
+/** The standard scripted-macOS-user-creation idiom: one past the highest uid already in the regular (500+)
+ *  range. dscl has no "pick one for me" primitive the way System Settings' own UI does. A listing with
+ *  nothing parseable (including an empty string, `listUserUids`'s own failure value) falls back to 501,
+ *  macOS's own first regular uid. */
+export function nextFreeUid(listing) {
+    let max = 500;
+    for (const line of listing.split("\n")) {
+        const m = /\s(\d+)\s*$/.exec(line);
+        if (m)
+            max = Math.max(max, Number(m[1]));
+    }
+    return max + 1;
+}
+/** Creates the dedicated account, or leaves it alone if it already exists. Returns its home directory. */
+export function ensureRunnerUser(user, deps = realInstallRunnerUserDeps) {
+    const home = `/Users/${user}`;
+    if (deps.userExists(user)) {
+        deps.log(`  user '${user}' already exists, leaving it alone`);
+        return home;
+    }
+    deps.log(`\n==> Creating the dedicated '${user}' account (so this Mac's CI runner no longer shares a uid with the build agent)`);
+    const uid = nextFreeUid(deps.listUserUids());
+    const gid = uid;
+    deps.run("sudo", ["dscl", ".", "-create", `/Groups/${user}`]);
+    deps.run("sudo", ["dscl", ".", "-create", `/Groups/${user}`, "PrimaryGroupID", String(gid)]);
+    deps.run("sudo", ["dscl", ".", "-create", `/Users/${user}`]);
+    deps.run("sudo", ["dscl", ".", "-create", `/Users/${user}`, "UserShell", "/bin/zsh"]);
+    deps.run("sudo", ["dscl", ".", "-create", `/Users/${user}`, "RealName", "AppForge CI runner (dedicated)"]);
+    deps.run("sudo", ["dscl", ".", "-create", `/Users/${user}`, "UniqueID", String(uid)]);
+    deps.run("sudo", ["dscl", ".", "-create", `/Users/${user}`, "PrimaryGroupID", String(gid)]);
+    deps.run("sudo", ["dscl", ".", "-create", `/Users/${user}`, "NFSHomeDirectory", home]);
+    // No -create .../Password at all: an account with no AuthenticationAuthority entry cannot authenticate by
+    // password until one is set. `createhomedir` below needs no password to run (root does it on the
+    // account's behalf). Deliberately NOT marking IsHidden — see the module docblock on why this is an
+    // ordinary account, not a service account.
+    deps.run("sudo", ["createhomedir", "-c", "-u", user]);
+    deps.log(`  created ${home} (uid ${uid})`);
+    return home;
+}
+/** Downloads and extracts the runner release into `<home>/actions-runner`, owned by `user`. A no-op (besides
+ *  logging) if that directory already looks like a runner install. */
+export function ensureRunnerDownloaded(user, home, version, deps = realInstallRunnerUserDeps) {
+    const dir = join(home, "actions-runner");
+    if (deps.exists(join(dir, "config.sh"))) {
+        deps.log(`  ${dir} already has a runner install, leaving it alone`);
+        return dir;
+    }
+    deps.log(`\n==> Downloading the GitHub Actions runner v${version} (${deps.arch})`);
+    deps.mkdirp(dir);
+    const url = runnerDownloadUrl(version, deps.arch);
+    const tarball = join(dir, `actions-runner.tar.gz`);
+    deps.run("curl", ["-fsSL", "-o", tarball, url]);
+    deps.run("tar", ["-xzf", tarball, "-C", dir]);
+    deps.run("rm", [tarball]);
+    deps.run("sudo", ["chown", "-R", `${user}:${user}`, dir]);
+    deps.log(`  extracted to ${dir}`);
+    return dir;
+}
+export function installRunnerUser(opts = {}, deps = realInstallRunnerUserDeps) {
+    const user = opts.user ?? DEFAULT_RUNNER_USER;
+    const version = opts.version ?? DEFAULT_RUNNER_VERSION;
+    const home = ensureRunnerUser(user, deps);
+    const dir = ensureRunnerDownloaded(user, home, version, deps);
+    const runnerName = opts.runnerName ?? (deps.tryRun("hostname", []) ? execFileSync("hostname", { encoding: "utf8" }).trim() : "mac-runner");
+    if (opts.githubUrl && opts.githubToken) {
+        const { config, svcInstall, svcStart } = registrationCommands({ dir, user, githubUrl: opts.githubUrl, githubToken: opts.githubToken, runnerName });
+        deps.log(`\n==> Registering the runner with GitHub as '${runnerName}'`);
+        deps.run("sudo", ["-u", user, "--", ...config]);
+        deps.log("\n==> Installing and starting the runner service");
+        deps.run("sudo", svcInstall);
+        deps.run("sudo", svcStart);
+        deps.log(`\nDone. '${user}' now runs its own GitHub Actions jobs, out of reach of anything that runs as this Mac's agent user.`);
+    }
+    else {
+        const { config, svcInstall, svcStart } = registrationCommands({ dir, user, githubUrl: "<url>", githubToken: "<token>", runnerName });
+        deps.log(`\nNot registered yet — both --github-url and --github-token are needed for that (from this repo's Settings → Actions →\n` +
+            `Runners → "New self-hosted runner"; the token is short-lived, so copy it right before running this). Either re-run this\n` +
+            `command with both flags, or finish by hand as the '${user}' user:\n\n` +
+            `  sudo -u ${user} -- ${config.join(" ")}\n` +
+            `  sudo ${svcInstall.join(" ")}\n` +
+            `  sudo ${svcStart.join(" ")}\n`);
+    }
+}
+//# sourceMappingURL=runner-user.js.map

package/dist/lib/runner-user.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-user.js","sourceRoot":"","sources":["../../src/lib/runner-user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,2GAA2G;AAC3G,uGAAuG;AACvG,yGAAyG;AACzG,4BAA4B;AAE5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAC/C;qFACqF;AACrF,MAAM,CAAC,MAAM,sBAAsB,GAAG,SAAS,CAAC;AAEhD,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,IAAqB;IACtE,OAAO,wDAAwD,OAAO,uBAAuB,IAAI,IAAI,OAAO,SAAS,CAAC;AACxH,CAAC;AAED;;uFAEuF;AACvF,MAAM,UAAU,UAAU,CAAC,WAAmB,OAAO,CAAC,IAAI;IACxD,OAAO,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;AAChD,CAAC;AAeD,MAAM,CAAC,MAAM,yBAAyB,GAA0B;IAC9D,UAAU,CAAC,IAAI;QACb,IAAI,CAAC;YACH,YAAY,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,IAAI,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YACxF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,YAAY;QACV,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1F,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,GAAG,CAAC,GAAG,EAAE,IAAI;QACX,sCAAsC;QACtC,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5C,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,CAAC,GAAG,EAAE,IAAI;QACd,IAAI,CAAC;YACH,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;IAClC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACtD,sCAAsC;IACtC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,UAAU,EAAE;CACnB,CAAC;AAYF;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAMpC;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACrC,OAAO;QACL,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;QACtI,uGAAuG;QACvG,gGAAgG;QAChG,UAAU,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC;QACvC,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC;KACzB,CAAC;AACJ,CAAC;AAED;;;qCAGqC;AACrC,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,IAAI,GAAG,GAAG,GAAG,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC;YAAE,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,GAAG,GAAG,CAAC,CAAC;AACjB,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,OAA8B,yBAAyB;IACpG,MAAM,IAAI,GAAG,UAAU,IAAI,EAAE,CAAC;IAC9B,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,oCAAoC,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,iCAAiC,IAAI,iFAAiF,CAAC,CAAC;IACjI,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,GAAG,CAAC;IAChB,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,WAAW,IAAI,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7F,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,IAAI,EAAE,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;IACtF,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,IAAI,EAAE,EAAE,UAAU,EAAE,gCAAgC,CAAC,CAAC,CAAC;IAC3G,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACtF,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,IAAI,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5F,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,IAAI,EAAE,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC;IACvF,0GAA0G;IAC1G,iGAAiG;IACjG,mGAAmG;IACnG,2CAA2C;IAC3C,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACtD,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,SAAS,GAAG,GAAG,CAAC,CAAC;IAC3C,OAAO,IAAI,CAAC;AACd,CAAC;AAED;sEACsE;AACtE,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAE,IAAY,EAAE,OAAe,EAAE,OAA8B,yBAAyB;IACzI,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,iDAAiD,CAAC,CAAC;QACpE,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,gDAAgD,OAAO,KAAK,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;IACnF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjB,MAAM,GAAG,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,IAAuB,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IACnD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,GAAG,CAAC,kBAAkB,GAAG,EAAE,CAAC,CAAC;IAClC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAiC,EAAE,EAAE,OAA8B,yBAAyB;IAC5H,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,mBAAmB,CAAC;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,sBAAsB,CAAC;IACvD,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,sBAAsB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAE9D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IAC3I,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,oBAAoB,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;QACnJ,IAAI,CAAC,GAAG,CAAC,gDAAgD,UAAU,GAAG,CAAC,CAAC;QACxE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;QAC7D,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,sGAAsG,CAAC,CAAC;IACnI,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,oBAAoB,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;QACrI,IAAI,CAAC,GAAG,CACN,0HAA0H;YACxH,2HAA2H;YAC3H,sDAAsD,IAAI,aAAa;YACvE,aAAa,IAAI,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI;YAC5C,UAAU,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI;YAClC,UAAU,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CACnC,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/lib/runner-user.test.d.ts

@@ -0,0 +1,2 @@
+import "../test-support/home-sandbox.js";
+//# sourceMappingURL=runner-user.test.d.ts.map

package/dist/lib/runner-user.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-user.test.d.ts","sourceRoot":"","sources":["../../src/lib/runner-user.test.ts"],"names":[],"mappings":"AAAA,OAAO,iCAAiC,CAAC"}