@ashx-j/lunr-dev 0.2.13-dev.8.1 → 0.2.19-dev.10.1

package/dist/core/computer-use/lease.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lease.d.ts","sourceRoot":"","sources":["../../../src/core/computer-use/lease.ts"],"names":[],"mappings":"AAOA,qBAAa,YAAY;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IACzC,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,IAAI,CAAuC;IACnD,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAyB;IACpD,IAAI,MAAM,IAAI,WAAW,CAExB;IACD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,YAAY,SAAS,SAA+C,EAEnE;YAEa,KAAK;YAwBL,aAAa;YAab,UAAU;YAUV,OAAO;IAwBf,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ7C;IAED,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,CAepE;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAU3B;CACD","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { mkdir, readFile, rename, rm, writeFile } from \"node:fs/promises\";\nimport { userInfo } from \"node:os\";\nimport { join } from \"node:path\";\nimport lockfile from \"proper-lockfile\";\nimport { assertOwnedPath } from \"./runtime.ts\";\n\nexport class DesktopLease {\n\tprivate readonly identity = randomUUID();\n\tprivate owned = false;\n\tprivate tail: Promise<unknown> = Promise.resolve();\n\tprivate closed = false;\n\tprivate readonly controller = new AbortController();\n\tget signal(): AbortSignal {\n\t\treturn this.controller.signal;\n\t}\n\tprivate readonly directory: string;\n\tconstructor(directory = join(userInfo().homedir, \".lunr\", \"desktop\")) {\n\t\tthis.directory = directory;\n\t}\n\n\tprivate async owner(): Promise<{ pid: number; identity: string; processes: number[] } | undefined> {\n\t\ttry {\n\t\t\tconst value: unknown = JSON.parse(await readFile(join(this.directory, \"workflow-owner.json\"), \"utf8\"));\n\t\t\tif (\n\t\t\t\t!value ||\n\t\t\t\ttypeof value !== \"object\" ||\n\t\t\t\t!(\"pid\" in value) ||\n\t\t\t\ttypeof value.pid !== \"number\" ||\n\t\t\t\t!Number.isInteger(value.pid) ||\n\t\t\t\tvalue.pid < 1 ||\n\t\t\t\t!(\"identity\" in value) ||\n\t\t\t\ttypeof value.identity !== \"string\"\n\t\t\t)\n\t\t\t\tthrow new Error(\"Invalid desktop owner record; refusing takeover.\");\n\t\t\tconst processes = \"processes\" in value ? value.processes : [];\n\t\t\tif (!Array.isArray(processes) || !processes.every((pid) => Number.isInteger(pid) && pid > 0))\n\t\t\t\tthrow new Error(\"Invalid runtime owner record; refusing takeover.\");\n\t\t\treturn { pid: value.pid, identity: value.identity, processes };\n\t\t} catch (error) {\n\t\t\tif (error instanceof Error && \"code\" in error && error.code === \"ENOENT\") return undefined;\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tprivate async withOwnerLock(operation: () => Promise<void>): Promise<void> {\n\t\tconst release = await lockfile.lock(this.directory, {\n\t\t\tlockfilePath: join(this.directory, \"workflow-acquire.lock\"),\n\t\t\tretries: 0,\n\t\t\tstale: 10000,\n\t\t});\n\t\ttry {\n\t\t\tawait operation();\n\t\t} finally {\n\t\t\tawait release();\n\t\t}\n\t}\n\n\tprivate async writeOwner(owner: { pid: number; identity: string; processes?: number[] }): Promise<void> {\n\t\tconst temporary = join(this.directory, `workflow-owner-${randomUUID()}.tmp`);\n\t\ttry {\n\t\t\tawait writeFile(temporary, JSON.stringify(owner), { mode: 0o600, flag: \"wx\" });\n\t\t\tawait rename(temporary, join(this.directory, \"workflow-owner.json\"));\n\t\t} finally {\n\t\t\tawait rm(temporary, { force: true });\n\t\t}\n\t}\n\n\tprivate async acquire(): Promise<void> {\n\t\tawait assertOwnedPath(this.directory);\n\t\tawait mkdir(this.directory, { recursive: true, mode: 0o700 });\n\t\tawait this.withOwnerLock(async () => {\n\t\t\tconst owner = await this.owner();\n\t\t\tif (owner) {\n\t\t\t\tconst alive = [owner.pid, ...owner.processes].some((pid) => {\n\t\t\t\t\ttry {\n\t\t\t\t\t\tprocess.kill(pid, 0);\n\t\t\t\t\t\treturn true;\n\t\t\t\t\t} catch (error) {\n\t\t\t\t\t\treturn !(error instanceof Error && \"code\" in error && error.code === \"ESRCH\");\n\t\t\t\t\t}\n\t\t\t\t});\n\t\t\t\tif (alive)\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t\"Desktop busy: another lunR workflow owns this user's desktop. Retry only after it ends.\",\n\t\t\t\t\t);\n\t\t\t}\n\t\t\tawait this.writeOwner({ pid: process.pid, identity: this.identity });\n\t\t\tthis.owned = true;\n\t\t});\n\t}\n\n\tasync trackProcess(pid: number): Promise<void> {\n\t\tawait this.withOwnerLock(async () => {\n\t\t\tconst owner = await this.owner();\n\t\t\tif (!owner || owner.identity !== this.identity || !Number.isInteger(pid) || pid < 1)\n\t\t\t\tthrow new Error(\"Cannot bind runtime to the desktop lease.\");\n\t\t\tif (!owner.processes.includes(pid)) owner.processes.push(pid);\n\t\t\tawait this.writeOwner(owner);\n\t\t});\n\t}\n\n\trun<T>(operation: () => Promise<T>, signal?: AbortSignal): Promise<T> {\n\t\tconst result = this.tail.then(async () => {\n\t\t\tif (this.closed) throw new Error(\"Desktop workflow ended. Start a new workflow and observe again.\");\n\t\t\tsignal?.throwIfAborted();\n\t\t\tif (!this.owned) await this.acquire();\n\t\t\tif ((await this.owner())?.identity !== this.identity) {\n\t\t\t\tthis.closed = true;\n\t\t\t\tthis.controller.abort(new Error(\"Desktop lease lost.\"));\n\t\t\t\tthrow new Error(\"Desktop lease lost. Input refused.\");\n\t\t\t}\n\t\t\tsignal?.throwIfAborted();\n\t\t\treturn operation();\n\t\t});\n\t\tthis.tail = result.catch(() => undefined);\n\t\treturn result;\n\t}\n\n\tasync close(): Promise<void> {\n\t\tthis.closed = true;\n\t\tthis.controller.abort();\n\t\tawait this.tail;\n\t\tif (this.owned) {\n\t\t\tawait this.withOwnerLock(async () => {\n\t\t\t\tif ((await this.owner())?.identity === this.identity) await rm(join(this.directory, \"workflow-owner.json\"));\n\t\t\t});\n\t\t\tthis.owned = false;\n\t\t}\n\t}\n}\n"]}

package/dist/core/computer-use/lease.js

@@ -0,0 +1,129 @@
+import { randomUUID } from "node:crypto";
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { userInfo } from "node:os";
+import { join } from "node:path";
+import lockfile from "proper-lockfile";
+import { assertOwnedPath } from "./runtime.js";
+export class DesktopLease {
+    identity = randomUUID();
+    owned = false;
+    tail = Promise.resolve();
+    closed = false;
+    controller = new AbortController();
+    get signal() {
+        return this.controller.signal;
+    }
+    directory;
+    constructor(directory = join(userInfo().homedir, ".lunr", "desktop")) {
+        this.directory = directory;
+    }
+    async owner() {
+        try {
+            const value = JSON.parse(await readFile(join(this.directory, "workflow-owner.json"), "utf8"));
+            if (!value ||
+                typeof value !== "object" ||
+                !("pid" in value) ||
+                typeof value.pid !== "number" ||
+                !Number.isInteger(value.pid) ||
+                value.pid < 1 ||
+                !("identity" in value) ||
+                typeof value.identity !== "string")
+                throw new Error("Invalid desktop owner record; refusing takeover.");
+            const processes = "processes" in value ? value.processes : [];
+            if (!Array.isArray(processes) || !processes.every((pid) => Number.isInteger(pid) && pid > 0))
+                throw new Error("Invalid runtime owner record; refusing takeover.");
+            return { pid: value.pid, identity: value.identity, processes };
+        }
+        catch (error) {
+            if (error instanceof Error && "code" in error && error.code === "ENOENT")
+                return undefined;
+            throw error;
+        }
+    }
+    async withOwnerLock(operation) {
+        const release = await lockfile.lock(this.directory, {
+            lockfilePath: join(this.directory, "workflow-acquire.lock"),
+            retries: 0,
+            stale: 10000,
+        });
+        try {
+            await operation();
+        }
+        finally {
+            await release();
+        }
+    }
+    async writeOwner(owner) {
+        const temporary = join(this.directory, `workflow-owner-${randomUUID()}.tmp`);
+        try {
+            await writeFile(temporary, JSON.stringify(owner), { mode: 0o600, flag: "wx" });
+            await rename(temporary, join(this.directory, "workflow-owner.json"));
+        }
+        finally {
+            await rm(temporary, { force: true });
+        }
+    }
+    async acquire() {
+        await assertOwnedPath(this.directory);
+        await mkdir(this.directory, { recursive: true, mode: 0o700 });
+        await this.withOwnerLock(async () => {
+            const owner = await this.owner();
+            if (owner) {
+                const alive = [owner.pid, ...owner.processes].some((pid) => {
+                    try {
+                        process.kill(pid, 0);
+                        return true;
+                    }
+                    catch (error) {
+                        return !(error instanceof Error && "code" in error && error.code === "ESRCH");
+                    }
+                });
+                if (alive)
+                    throw new Error("Desktop busy: another lunR workflow owns this user's desktop. Retry only after it ends.");
+            }
+            await this.writeOwner({ pid: process.pid, identity: this.identity });
+            this.owned = true;
+        });
+    }
+    async trackProcess(pid) {
+        await this.withOwnerLock(async () => {
+            const owner = await this.owner();
+            if (!owner || owner.identity !== this.identity || !Number.isInteger(pid) || pid < 1)
+                throw new Error("Cannot bind runtime to the desktop lease.");
+            if (!owner.processes.includes(pid))
+                owner.processes.push(pid);
+            await this.writeOwner(owner);
+        });
+    }
+    run(operation, signal) {
+        const result = this.tail.then(async () => {
+            if (this.closed)
+                throw new Error("Desktop workflow ended. Start a new workflow and observe again.");
+            signal?.throwIfAborted();
+            if (!this.owned)
+                await this.acquire();
+            if ((await this.owner())?.identity !== this.identity) {
+                this.closed = true;
+                this.controller.abort(new Error("Desktop lease lost."));
+                throw new Error("Desktop lease lost. Input refused.");
+            }
+            signal?.throwIfAborted();
+            return operation();
+        });
+        this.tail = result.catch(() => undefined);
+        return result;
+    }
+    async close() {
+        this.closed = true;
+        this.controller.abort();
+        await this.tail;
+        if (this.owned) {
+            await this.withOwnerLock(async () => {
+                if ((await this.owner())?.identity === this.identity)
+                    await rm(join(this.directory, "workflow-owner.json"));
+            });
+            this.owned = false;
+        }
+    }
+}
+//# sourceMappingURL=lease.js.map

package/dist/core/computer-use/lease.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lease.js","sourceRoot":"","sources":["../../../src/core/computer-use/lease.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,QAAQ,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,MAAM,OAAO,YAAY;IACP,QAAQ,GAAG,UAAU,EAAE,CAAC;IACjC,KAAK,GAAG,KAAK,CAAC;IACd,IAAI,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3C,MAAM,GAAG,KAAK,CAAC;IACN,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACpD,IAAI,MAAM,GAAgB;QACzB,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;IAAA,CAC9B;IACgB,SAAS,CAAS;IACnC,YAAY,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE;QACrE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAAA,CAC3B;IAEO,KAAK,CAAC,KAAK,GAAgF;QAClG,IAAI,CAAC;YACJ,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YACvG,IACC,CAAC,KAAK;gBACN,OAAO,KAAK,KAAK,QAAQ;gBACzB,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC;gBACjB,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;gBAC7B,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC;gBAC5B,KAAK,CAAC,GAAG,GAAG,CAAC;gBACb,CAAC,CAAC,UAAU,IAAI,KAAK,CAAC;gBACtB,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;gBAElC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;YACrE,MAAM,SAAS,GAAG,WAAW,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;gBAC3F,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;YACrE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAC3F,MAAM,KAAK,CAAC;QACb,CAAC;IAAA,CACD;IAEO,KAAK,CAAC,aAAa,CAAC,SAA8B,EAAiB;QAC1E,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YACnD,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,uBAAuB,CAAC;YAC3D,OAAO,EAAE,CAAC;YACV,KAAK,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,IAAI,CAAC;YACJ,MAAM,SAAS,EAAE,CAAC;QACnB,CAAC;gBAAS,CAAC;YACV,MAAM,OAAO,EAAE,CAAC;QACjB,CAAC;IAAA,CACD;IAEO,KAAK,CAAC,UAAU,CAAC,KAA8D,EAAiB;QACvG,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,UAAU,EAAE,MAAM,CAAC,CAAC;QAC7E,IAAI,CAAC;YACJ,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC;QACtE,CAAC;gBAAS,CAAC;YACV,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,CAAC;IAAA,CACD;IAEO,KAAK,CAAC,OAAO,GAAkB;QACtC,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,IAAI,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACjC,IAAI,KAAK,EAAE,CAAC;gBACX,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;oBAC3D,IAAI,CAAC;wBACJ,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;wBACrB,OAAO,IAAI,CAAC;oBACb,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBAChB,OAAO,CAAC,CAAC,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;oBAC/E,CAAC;gBAAA,CACD,CAAC,CAAC;gBACH,IAAI,KAAK;oBACR,MAAM,IAAI,KAAK,CACd,yFAAyF,CACzF,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAAA,CAClB,CAAC,CAAC;IAAA,CACH;IAED,KAAK,CAAC,YAAY,CAAC,GAAW,EAAiB;QAC9C,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,IAAI,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACjC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;gBAClF,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC9D,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC9D,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAAA,CAC7B,CAAC,CAAC;IAAA,CACH;IAED,GAAG,CAAI,SAA2B,EAAE,MAAoB,EAAc;QACrE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACzC,IAAI,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;YACpG,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACtC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACtD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;gBACnB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC;gBACxD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACvD,CAAC;YACD,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,OAAO,SAAS,EAAE,CAAC;QAAA,CACnB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1C,OAAO,MAAM,CAAC;IAAA,CACd;IAED,KAAK,CAAC,KAAK,GAAkB;QAC5B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,IAAI,CAAC;QAChB,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,IAAI,EAAE,CAAC;gBACpC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,KAAK,IAAI,CAAC,QAAQ;oBAAE,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC;YAAA,CAC5G,CAAC,CAAC;YACH,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACpB,CAAC;IAAA,CACD;CACD","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { mkdir, readFile, rename, rm, writeFile } from \"node:fs/promises\";\nimport { userInfo } from \"node:os\";\nimport { join } from \"node:path\";\nimport lockfile from \"proper-lockfile\";\nimport { assertOwnedPath } from \"./runtime.ts\";\n\nexport class DesktopLease {\n\tprivate readonly identity = randomUUID();\n\tprivate owned = false;\n\tprivate tail: Promise<unknown> = Promise.resolve();\n\tprivate closed = false;\n\tprivate readonly controller = new AbortController();\n\tget signal(): AbortSignal {\n\t\treturn this.controller.signal;\n\t}\n\tprivate readonly directory: string;\n\tconstructor(directory = join(userInfo().homedir, \".lunr\", \"desktop\")) {\n\t\tthis.directory = directory;\n\t}\n\n\tprivate async owner(): Promise<{ pid: number; identity: string; processes: number[] } | undefined> {\n\t\ttry {\n\t\t\tconst value: unknown = JSON.parse(await readFile(join(this.directory, \"workflow-owner.json\"), \"utf8\"));\n\t\t\tif (\n\t\t\t\t!value ||\n\t\t\t\ttypeof value !== \"object\" ||\n\t\t\t\t!(\"pid\" in value) ||\n\t\t\t\ttypeof value.pid !== \"number\" ||\n\t\t\t\t!Number.isInteger(value.pid) ||\n\t\t\t\tvalue.pid < 1 ||\n\t\t\t\t!(\"identity\" in value) ||\n\t\t\t\ttypeof value.identity !== \"string\"\n\t\t\t)\n\t\t\t\tthrow new Error(\"Invalid desktop owner record; refusing takeover.\");\n\t\t\tconst processes = \"processes\" in value ? value.processes : [];\n\t\t\tif (!Array.isArray(processes) || !processes.every((pid) => Number.isInteger(pid) && pid > 0))\n\t\t\t\tthrow new Error(\"Invalid runtime owner record; refusing takeover.\");\n\t\t\treturn { pid: value.pid, identity: value.identity, processes };\n\t\t} catch (error) {\n\t\t\tif (error instanceof Error && \"code\" in error && error.code === \"ENOENT\") return undefined;\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tprivate async withOwnerLock(operation: () => Promise<void>): Promise<void> {\n\t\tconst release = await lockfile.lock(this.directory, {\n\t\t\tlockfilePath: join(this.directory, \"workflow-acquire.lock\"),\n\t\t\tretries: 0,\n\t\t\tstale: 10000,\n\t\t});\n\t\ttry {\n\t\t\tawait operation();\n\t\t} finally {\n\t\t\tawait release();\n\t\t}\n\t}\n\n\tprivate async writeOwner(owner: { pid: number; identity: string; processes?: number[] }): Promise<void> {\n\t\tconst temporary = join(this.directory, `workflow-owner-${randomUUID()}.tmp`);\n\t\ttry {\n\t\t\tawait writeFile(temporary, JSON.stringify(owner), { mode: 0o600, flag: \"wx\" });\n\t\t\tawait rename(temporary, join(this.directory, \"workflow-owner.json\"));\n\t\t} finally {\n\t\t\tawait rm(temporary, { force: true });\n\t\t}\n\t}\n\n\tprivate async acquire(): Promise<void> {\n\t\tawait assertOwnedPath(this.directory);\n\t\tawait mkdir(this.directory, { recursive: true, mode: 0o700 });\n\t\tawait this.withOwnerLock(async () => {\n\t\t\tconst owner = await this.owner();\n\t\t\tif (owner) {\n\t\t\t\tconst alive = [owner.pid, ...owner.processes].some((pid) => {\n\t\t\t\t\ttry {\n\t\t\t\t\t\tprocess.kill(pid, 0);\n\t\t\t\t\t\treturn true;\n\t\t\t\t\t} catch (error) {\n\t\t\t\t\t\treturn !(error instanceof Error && \"code\" in error && error.code === \"ESRCH\");\n\t\t\t\t\t}\n\t\t\t\t});\n\t\t\t\tif (alive)\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t\"Desktop busy: another lunR workflow owns this user's desktop. Retry only after it ends.\",\n\t\t\t\t\t);\n\t\t\t}\n\t\t\tawait this.writeOwner({ pid: process.pid, identity: this.identity });\n\t\t\tthis.owned = true;\n\t\t});\n\t}\n\n\tasync trackProcess(pid: number): Promise<void> {\n\t\tawait this.withOwnerLock(async () => {\n\t\t\tconst owner = await this.owner();\n\t\t\tif (!owner || owner.identity !== this.identity || !Number.isInteger(pid) || pid < 1)\n\t\t\t\tthrow new Error(\"Cannot bind runtime to the desktop lease.\");\n\t\t\tif (!owner.processes.includes(pid)) owner.processes.push(pid);\n\t\t\tawait this.writeOwner(owner);\n\t\t});\n\t}\n\n\trun<T>(operation: () => Promise<T>, signal?: AbortSignal): Promise<T> {\n\t\tconst result = this.tail.then(async () => {\n\t\t\tif (this.closed) throw new Error(\"Desktop workflow ended. Start a new workflow and observe again.\");\n\t\t\tsignal?.throwIfAborted();\n\t\t\tif (!this.owned) await this.acquire();\n\t\t\tif ((await this.owner())?.identity !== this.identity) {\n\t\t\t\tthis.closed = true;\n\t\t\t\tthis.controller.abort(new Error(\"Desktop lease lost.\"));\n\t\t\t\tthrow new Error(\"Desktop lease lost. Input refused.\");\n\t\t\t}\n\t\t\tsignal?.throwIfAborted();\n\t\t\treturn operation();\n\t\t});\n\t\tthis.tail = result.catch(() => undefined);\n\t\treturn result;\n\t}\n\n\tasync close(): Promise<void> {\n\t\tthis.closed = true;\n\t\tthis.controller.abort();\n\t\tawait this.tail;\n\t\tif (this.owned) {\n\t\t\tawait this.withOwnerLock(async () => {\n\t\t\t\tif ((await this.owner())?.identity === this.identity) await rm(join(this.directory, \"workflow-owner.json\"));\n\t\t\t});\n\t\t\tthis.owned = false;\n\t\t}\n\t}\n}\n"]}

package/dist/core/computer-use/macos-runtime.d.ts

@@ -0,0 +1,14 @@
+export declare function macLaunchArguments(app: string, socket: string, home: string, lifetime: string): string[];
+export declare class MacRuntime {
+    private directory?;
+    private lifetime?;
+    private exited?;
+    private pid?;
+    get processId(): number | undefined;
+    private socket?;
+    private closing?;
+    start(app: string, signal: AbortSignal): Promise<string>;
+    close(): Promise<void>;
+    private stop;
+}
+//# sourceMappingURL=macos-runtime.d.ts.map

package/dist/core/computer-use/macos-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"macos-runtime.d.ts","sourceRoot":"","sources":["../../../src/core/computer-use/macos-runtime.ts"],"names":[],"mappings":"AAYA,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAwBxG;AAoCD,qBAAa,UAAU;IACtB,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,CAAa;IAC9B,OAAO,CAAC,MAAM,CAAC,CAAgB;IAC/B,OAAO,CAAC,GAAG,CAAC,CAAS;IACrB,IAAI,SAAS,IAAI,MAAM,GAAG,SAAS,CAElC;IACD,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,OAAO,CAAC,CAAgB;IAE1B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CA8C7D;IAED,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAGrB;YAEa,IAAI;CAoBlB","sourcesContent":["import { execFile, spawn } from \"node:child_process\";\nimport { constants } from \"node:fs\";\nimport { type FileHandle, mkdtemp, open, realpath, rm } from \"node:fs/promises\";\nimport { connect } from \"node:net\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { setTimeout as delay } from \"node:timers/promises\";\nimport { promisify } from \"node:util\";\nimport { CUA_VERSION, runtimeEnvironment } from \"./runtime.ts\";\n\nconst exec = promisify(execFile);\n\nexport function macLaunchArguments(app: string, socket: string, home: string, lifetime: string): string[] {\n\tconst environment = {\n\t\tHOME: home,\n\t\t...Object.fromEntries(Object.entries(runtimeEnvironment()).filter(([name]) => name.startsWith(\"CUA_\"))),\n\t};\n\treturn [\n\t\t\"-n\",\n\t\t\"-g\",\n\t\t\"-W\",\n\t\t\"-a\",\n\t\tapp,\n\t\t\"--stdin\",\n\t\tlifetime,\n\t\t...Object.entries(environment).flatMap(([name, value]) => [\"--env\", `${name}=${value}`]),\n\t\t\"--args\",\n\t\t\"serve\",\n\t\t\"--embedded\",\n\t\t\"--parent-liveness-stdio\",\n\t\t\"--socket\",\n\t\tsocket,\n\t\t\"--permission-mode\",\n\t\t\"standard\",\n\t\t\"--no-overlay\",\n\t];\n}\n\nfunction request(socket: string, method: string, args?: Record<string, unknown>): Promise<Record<string, unknown>> {\n\treturn new Promise((resolve, reject) => {\n\t\tconst stream = connect(socket);\n\t\tlet buffer = \"\";\n\t\tstream.setTimeout(1000, () => stream.destroy(new Error(\"Private computer endpoint timed out.\")));\n\t\tstream.on(\"error\", reject);\n\t\tstream.on(\"connect\", () => stream.write(`${JSON.stringify({ method, args })}\\n`));\n\t\tstream.on(\"data\", (chunk) => {\n\t\t\tbuffer += chunk.toString();\n\t\t\tif (buffer.length > 65536) {\n\t\t\t\tstream.destroy(new Error(\"Invalid private endpoint metadata.\"));\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tif (!buffer.includes(\"\\n\")) return;\n\t\t\ttry {\n\t\t\t\tconst reply: unknown = JSON.parse(buffer.slice(0, buffer.indexOf(\"\\n\")));\n\t\t\t\tif (\n\t\t\t\t\t!reply ||\n\t\t\t\t\ttypeof reply !== \"object\" ||\n\t\t\t\t\t!(\"result\" in reply) ||\n\t\t\t\t\t!reply.result ||\n\t\t\t\t\ttypeof reply.result !== \"object\"\n\t\t\t\t)\n\t\t\t\t\tthrow new Error(\"Private endpoint refused metadata.\");\n\t\t\t\tresolve(Object.fromEntries(Object.entries(reply.result)));\n\t\t\t} catch (error) {\n\t\t\t\treject(error);\n\t\t\t}\n\t\t\tstream.destroy();\n\t\t});\n\t\tstream.on(\"end\", () => reject(new Error(\"Private computer endpoint closed.\")));\n\t});\n}\n\nexport class MacRuntime {\n\tprivate directory?: string;\n\tprivate lifetime?: FileHandle;\n\tprivate exited?: Promise<void>;\n\tprivate pid?: number;\n\tget processId(): number | undefined {\n\t\treturn this.pid;\n\t}\n\tprivate socket?: string;\n\tprivate closing?: Promise<void>;\n\n\tasync start(app: string, signal: AbortSignal): Promise<string> {\n\t\tconst directory = await mkdtemp(join(await realpath(tmpdir()), \"lunr-cua-\"));\n\t\tthis.directory = directory;\n\t\tconst socket = join(directory, \"driver.sock\");\n\t\tthis.socket = socket;\n\t\tconst lifetime = join(directory, \"lifetime\");\n\t\tawait exec(\"/usr/bin/mkfifo\", [\"-m\", \"600\", lifetime], { timeout: 5000, signal });\n\t\tthis.lifetime = await open(lifetime, constants.O_RDWR);\n\t\tsignal.throwIfAborted();\n\t\tconst launcher = spawn(\"/usr/bin/open\", macLaunchArguments(app, socket, directory, lifetime), {\n\t\t\tenv: runtimeEnvironment(),\n\t\t\tstdio: \"ignore\",\n\t\t});\n\t\tthis.exited = new Promise<void>((resolve, reject) => {\n\t\t\tlauncher.once(\"error\", reject);\n\t\t\tlauncher.once(\"exit\", (code) =>\n\t\t\t\tcode === 0 ? resolve() : reject(new Error(`LaunchServices exited ${code}.`)),\n\t\t\t);\n\t\t});\n\t\tvoid this.exited.catch(() => undefined);\n\t\tconst deadline = Date.now() + 15000;\n\t\twhile (Date.now() < deadline) {\n\t\t\tsignal.throwIfAborted();\n\t\t\ttry {\n\t\t\t\tconst metadata = await request(socket, \"metadata\");\n\t\t\t\tif (\n\t\t\t\t\tmetadata.driver_version !== CUA_VERSION ||\n\t\t\t\t\tmetadata.embedded !== true ||\n\t\t\t\t\ttypeof metadata.pid !== \"number\" ||\n\t\t\t\t\tmetadata.pid < 1\n\t\t\t\t)\n\t\t\t\t\tthrow new Error(\"Private runtime has incompatible metadata.\");\n\t\t\t\tthis.pid = metadata.pid;\n\t\t\t\treturn socket;\n\t\t\t} catch {\n\t\t\t\tawait Promise.race([\n\t\t\t\t\tdelay(100, undefined, { signal }),\n\t\t\t\t\tthis.exited.then(() => {\n\t\t\t\t\t\tthrow new Error(\"Computer app exited during startup.\");\n\t\t\t\t\t}),\n\t\t\t\t]);\n\t\t\t}\n\t\t}\n\t\tthrow new Error(\n\t\t\t\"Private macOS runtime startup timed out. Check CuaDriver Accessibility and Screen Recording grants.\",\n\t\t);\n\t}\n\n\tclose(): Promise<void> {\n\t\tthis.closing ??= this.stop();\n\t\treturn this.closing;\n\t}\n\n\tprivate async stop(): Promise<void> {\n\t\tawait this.lifetime?.close();\n\t\tthis.lifetime = undefined;\n\t\tif (this.socket && this.pid)\n\t\t\tawait request(this.socket, \"shutdown_if_pid\", { expected_pid: this.pid }).catch(() => undefined);\n\t\tif (this.exited) {\n\t\t\tconst timeout = new AbortController();\n\t\t\ttry {\n\t\t\t\tawait Promise.race([\n\t\t\t\t\tthis.exited,\n\t\t\t\t\tdelay(10000, undefined, { signal: timeout.signal }).then(() => {\n\t\t\t\t\t\tthrow new Error(\"Owned macOS app shutdown is unconfirmed. Desktop lease retained.\");\n\t\t\t\t\t}),\n\t\t\t\t]);\n\t\t\t} finally {\n\t\t\t\ttimeout.abort();\n\t\t\t}\n\t\t}\n\t\tif (this.directory) await rm(this.directory, { recursive: true, force: true });\n\t}\n}\n"]}

package/dist/core/computer-use/macos-runtime.js

@@ -0,0 +1,148 @@
+import { execFile, spawn } from "node:child_process";
+import { constants } from "node:fs";
+import { mkdtemp, open, realpath, rm } from "node:fs/promises";
+import { connect } from "node:net";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+import { promisify } from "node:util";
+import { CUA_VERSION, runtimeEnvironment } from "./runtime.js";
+const exec = promisify(execFile);
+export function macLaunchArguments(app, socket, home, lifetime) {
+    const environment = {
+        HOME: home,
+        ...Object.fromEntries(Object.entries(runtimeEnvironment()).filter(([name]) => name.startsWith("CUA_"))),
+    };
+    return [
+        "-n",
+        "-g",
+        "-W",
+        "-a",
+        app,
+        "--stdin",
+        lifetime,
+        ...Object.entries(environment).flatMap(([name, value]) => ["--env", `${name}=${value}`]),
+        "--args",
+        "serve",
+        "--embedded",
+        "--parent-liveness-stdio",
+        "--socket",
+        socket,
+        "--permission-mode",
+        "standard",
+        "--no-overlay",
+    ];
+}
+function request(socket, method, args) {
+    return new Promise((resolve, reject) => {
+        const stream = connect(socket);
+        let buffer = "";
+        stream.setTimeout(1000, () => stream.destroy(new Error("Private computer endpoint timed out.")));
+        stream.on("error", reject);
+        stream.on("connect", () => stream.write(`${JSON.stringify({ method, args })}\n`));
+        stream.on("data", (chunk) => {
+            buffer += chunk.toString();
+            if (buffer.length > 65536) {
+                stream.destroy(new Error("Invalid private endpoint metadata."));
+                return;
+            }
+            if (!buffer.includes("\n"))
+                return;
+            try {
+                const reply = JSON.parse(buffer.slice(0, buffer.indexOf("\n")));
+                if (!reply ||
+                    typeof reply !== "object" ||
+                    !("result" in reply) ||
+                    !reply.result ||
+                    typeof reply.result !== "object")
+                    throw new Error("Private endpoint refused metadata.");
+                resolve(Object.fromEntries(Object.entries(reply.result)));
+            }
+            catch (error) {
+                reject(error);
+            }
+            stream.destroy();
+        });
+        stream.on("end", () => reject(new Error("Private computer endpoint closed.")));
+    });
+}
+export class MacRuntime {
+    directory;
+    lifetime;
+    exited;
+    pid;
+    get processId() {
+        return this.pid;
+    }
+    socket;
+    closing;
+    async start(app, signal) {
+        const directory = await mkdtemp(join(await realpath(tmpdir()), "lunr-cua-"));
+        this.directory = directory;
+        const socket = join(directory, "driver.sock");
+        this.socket = socket;
+        const lifetime = join(directory, "lifetime");
+        await exec("/usr/bin/mkfifo", ["-m", "600", lifetime], { timeout: 5000, signal });
+        this.lifetime = await open(lifetime, constants.O_RDWR);
+        signal.throwIfAborted();
+        const launcher = spawn("/usr/bin/open", macLaunchArguments(app, socket, directory, lifetime), {
+            env: runtimeEnvironment(),
+            stdio: "ignore",
+        });
+        this.exited = new Promise((resolve, reject) => {
+            launcher.once("error", reject);
+            launcher.once("exit", (code) => code === 0 ? resolve() : reject(new Error(`LaunchServices exited ${code}.`)));
+        });
+        void this.exited.catch(() => undefined);
+        const deadline = Date.now() + 15000;
+        while (Date.now() < deadline) {
+            signal.throwIfAborted();
+            try {
+                const metadata = await request(socket, "metadata");
+                if (metadata.driver_version !== CUA_VERSION ||
+                    metadata.embedded !== true ||
+                    typeof metadata.pid !== "number" ||
+                    metadata.pid < 1)
+                    throw new Error("Private runtime has incompatible metadata.");
+                this.pid = metadata.pid;
+                return socket;
+            }
+            catch {
+                await Promise.race([
+                    delay(100, undefined, { signal }),
+                    this.exited.then(() => {
+                        throw new Error("Computer app exited during startup.");
+                    }),
+                ]);
+            }
+        }
+        throw new Error("Private macOS runtime startup timed out. Check CuaDriver Accessibility and Screen Recording grants.");
+    }
+    close() {
+        this.closing ??= this.stop();
+        return this.closing;
+    }
+    async stop() {
+        await this.lifetime?.close();
+        this.lifetime = undefined;
+        if (this.socket && this.pid)
+            await request(this.socket, "shutdown_if_pid", { expected_pid: this.pid }).catch(() => undefined);
+        if (this.exited) {
+            const timeout = new AbortController();
+            try {
+                await Promise.race([
+                    this.exited,
+                    delay(10000, undefined, { signal: timeout.signal }).then(() => {
+                        throw new Error("Owned macOS app shutdown is unconfirmed. Desktop lease retained.");
+                    }),
+                ]);
+            }
+            finally {
+                timeout.abort();
+            }
+        }
+        if (this.directory)
+            await rm(this.directory, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=macos-runtime.js.map

package/dist/core/computer-use/macos-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"macos-runtime.js","sourceRoot":"","sources":["../../../src/core/computer-use/macos-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAmB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACnC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAE/D,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEjC,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,MAAc,EAAE,IAAY,EAAE,QAAgB,EAAY;IACzG,MAAM,WAAW,GAAG;QACnB,IAAI,EAAE,IAAI;QACV,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;KACvG,CAAC;IACF,OAAO;QACN,IAAI;QACJ,IAAI;QACJ,IAAI;QACJ,IAAI;QACJ,GAAG;QACH,SAAS;QACT,QAAQ;QACR,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;QACxF,QAAQ;QACR,OAAO;QACP,YAAY;QACZ,yBAAyB;QACzB,UAAU;QACV,MAAM;QACN,mBAAmB;QACnB,UAAU;QACV,cAAc;KACd,CAAC;AAAA,CACF;AAED,SAAS,OAAO,CAAC,MAAc,EAAE,MAAc,EAAE,IAA8B,EAAoC;IAClH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC,CAAC,CAAC;QACjG,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAClF,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC3B,IAAI,MAAM,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;gBAC3B,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC;gBAChE,OAAO;YACR,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO;YACnC,IAAI,CAAC;gBACJ,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACzE,IACC,CAAC,KAAK;oBACN,OAAO,KAAK,KAAK,QAAQ;oBACzB,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC;oBACpB,CAAC,KAAK,CAAC,MAAM;oBACb,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;oBAEhC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;gBACvD,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC3D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,CAAC,KAAK,CAAC,CAAC;YACf,CAAC;YACD,MAAM,CAAC,OAAO,EAAE,CAAC;QAAA,CACjB,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAC,CAAC;IAAA,CAC/E,CAAC,CAAC;AAAA,CACH;AAED,MAAM,OAAO,UAAU;IACd,SAAS,CAAU;IACnB,QAAQ,CAAc;IACtB,MAAM,CAAiB;IACvB,GAAG,CAAU;IACrB,IAAI,SAAS,GAAuB;QACnC,OAAO,IAAI,CAAC,GAAG,CAAC;IAAA,CAChB;IACO,MAAM,CAAU;IAChB,OAAO,CAAiB;IAEhC,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,MAAmB,EAAmB;QAC9D,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;QAC7E,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC7C,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,EAAE,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE;YAC7F,GAAG,EAAE,kBAAkB,EAAE;YACzB,KAAK,EAAE,QAAQ;SACf,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC;YACpD,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAC9B,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,IAAI,GAAG,CAAC,CAAC,CAC5E,CAAC;QAAA,CACF,CAAC,CAAC;QACH,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACpC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC9B,MAAM,CAAC,cAAc,EAAE,CAAC;YACxB,IAAI,CAAC;gBACJ,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;gBACnD,IACC,QAAQ,CAAC,cAAc,KAAK,WAAW;oBACvC,QAAQ,CAAC,QAAQ,KAAK,IAAI;oBAC1B,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ;oBAChC,QAAQ,CAAC,GAAG,GAAG,CAAC;oBAEhB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;gBAC/D,IAAI,CAAC,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;gBACxB,OAAO,MAAM,CAAC;YACf,CAAC;YAAC,MAAM,CAAC;gBACR,MAAM,OAAO,CAAC,IAAI,CAAC;oBAClB,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC;oBACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;wBACtB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;oBAAA,CACvD,CAAC;iBACF,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;QACD,MAAM,IAAI,KAAK,CACd,qGAAqG,CACrG,CAAC;IAAA,CACF;IAED,KAAK,GAAkB;QACtB,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC,OAAO,CAAC;IAAA,CACpB;IAEO,KAAK,CAAC,IAAI,GAAkB;QACnC,MAAM,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC1B,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG;YAC1B,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAClG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,OAAO,GAAG,IAAI,eAAe,EAAE,CAAC;YACtC,IAAI,CAAC;gBACJ,MAAM,OAAO,CAAC,IAAI,CAAC;oBAClB,IAAI,CAAC,MAAM;oBACX,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;wBAC9D,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;oBAAA,CACpF,CAAC;iBACF,CAAC,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACV,OAAO,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC;QACF,CAAC;QACD,IAAI,IAAI,CAAC,SAAS;YAAE,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAA,CAC/E;CACD","sourcesContent":["import { execFile, spawn } from \"node:child_process\";\nimport { constants } from \"node:fs\";\nimport { type FileHandle, mkdtemp, open, realpath, rm } from \"node:fs/promises\";\nimport { connect } from \"node:net\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { setTimeout as delay } from \"node:timers/promises\";\nimport { promisify } from \"node:util\";\nimport { CUA_VERSION, runtimeEnvironment } from \"./runtime.ts\";\n\nconst exec = promisify(execFile);\n\nexport function macLaunchArguments(app: string, socket: string, home: string, lifetime: string): string[] {\n\tconst environment = {\n\t\tHOME: home,\n\t\t...Object.fromEntries(Object.entries(runtimeEnvironment()).filter(([name]) => name.startsWith(\"CUA_\"))),\n\t};\n\treturn [\n\t\t\"-n\",\n\t\t\"-g\",\n\t\t\"-W\",\n\t\t\"-a\",\n\t\tapp,\n\t\t\"--stdin\",\n\t\tlifetime,\n\t\t...Object.entries(environment).flatMap(([name, value]) => [\"--env\", `${name}=${value}`]),\n\t\t\"--args\",\n\t\t\"serve\",\n\t\t\"--embedded\",\n\t\t\"--parent-liveness-stdio\",\n\t\t\"--socket\",\n\t\tsocket,\n\t\t\"--permission-mode\",\n\t\t\"standard\",\n\t\t\"--no-overlay\",\n\t];\n}\n\nfunction request(socket: string, method: string, args?: Record<string, unknown>): Promise<Record<string, unknown>> {\n\treturn new Promise((resolve, reject) => {\n\t\tconst stream = connect(socket);\n\t\tlet buffer = \"\";\n\t\tstream.setTimeout(1000, () => stream.destroy(new Error(\"Private computer endpoint timed out.\")));\n\t\tstream.on(\"error\", reject);\n\t\tstream.on(\"connect\", () => stream.write(`${JSON.stringify({ method, args })}\\n`));\n\t\tstream.on(\"data\", (chunk) => {\n\t\t\tbuffer += chunk.toString();\n\t\t\tif (buffer.length > 65536) {\n\t\t\t\tstream.destroy(new Error(\"Invalid private endpoint metadata.\"));\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tif (!buffer.includes(\"\\n\")) return;\n\t\t\ttry {\n\t\t\t\tconst reply: unknown = JSON.parse(buffer.slice(0, buffer.indexOf(\"\\n\")));\n\t\t\t\tif (\n\t\t\t\t\t!reply ||\n\t\t\t\t\ttypeof reply !== \"object\" ||\n\t\t\t\t\t!(\"result\" in reply) ||\n\t\t\t\t\t!reply.result ||\n\t\t\t\t\ttypeof reply.result !== \"object\"\n\t\t\t\t)\n\t\t\t\t\tthrow new Error(\"Private endpoint refused metadata.\");\n\t\t\t\tresolve(Object.fromEntries(Object.entries(reply.result)));\n\t\t\t} catch (error) {\n\t\t\t\treject(error);\n\t\t\t}\n\t\t\tstream.destroy();\n\t\t});\n\t\tstream.on(\"end\", () => reject(new Error(\"Private computer endpoint closed.\")));\n\t});\n}\n\nexport class MacRuntime {\n\tprivate directory?: string;\n\tprivate lifetime?: FileHandle;\n\tprivate exited?: Promise<void>;\n\tprivate pid?: number;\n\tget processId(): number | undefined {\n\t\treturn this.pid;\n\t}\n\tprivate socket?: string;\n\tprivate closing?: Promise<void>;\n\n\tasync start(app: string, signal: AbortSignal): Promise<string> {\n\t\tconst directory = await mkdtemp(join(await realpath(tmpdir()), \"lunr-cua-\"));\n\t\tthis.directory = directory;\n\t\tconst socket = join(directory, \"driver.sock\");\n\t\tthis.socket = socket;\n\t\tconst lifetime = join(directory, \"lifetime\");\n\t\tawait exec(\"/usr/bin/mkfifo\", [\"-m\", \"600\", lifetime], { timeout: 5000, signal });\n\t\tthis.lifetime = await open(lifetime, constants.O_RDWR);\n\t\tsignal.throwIfAborted();\n\t\tconst launcher = spawn(\"/usr/bin/open\", macLaunchArguments(app, socket, directory, lifetime), {\n\t\t\tenv: runtimeEnvironment(),\n\t\t\tstdio: \"ignore\",\n\t\t});\n\t\tthis.exited = new Promise<void>((resolve, reject) => {\n\t\t\tlauncher.once(\"error\", reject);\n\t\t\tlauncher.once(\"exit\", (code) =>\n\t\t\t\tcode === 0 ? resolve() : reject(new Error(`LaunchServices exited ${code}.`)),\n\t\t\t);\n\t\t});\n\t\tvoid this.exited.catch(() => undefined);\n\t\tconst deadline = Date.now() + 15000;\n\t\twhile (Date.now() < deadline) {\n\t\t\tsignal.throwIfAborted();\n\t\t\ttry {\n\t\t\t\tconst metadata = await request(socket, \"metadata\");\n\t\t\t\tif (\n\t\t\t\t\tmetadata.driver_version !== CUA_VERSION ||\n\t\t\t\t\tmetadata.embedded !== true ||\n\t\t\t\t\ttypeof metadata.pid !== \"number\" ||\n\t\t\t\t\tmetadata.pid < 1\n\t\t\t\t)\n\t\t\t\t\tthrow new Error(\"Private runtime has incompatible metadata.\");\n\t\t\t\tthis.pid = metadata.pid;\n\t\t\t\treturn socket;\n\t\t\t} catch {\n\t\t\t\tawait Promise.race([\n\t\t\t\t\tdelay(100, undefined, { signal }),\n\t\t\t\t\tthis.exited.then(() => {\n\t\t\t\t\t\tthrow new Error(\"Computer app exited during startup.\");\n\t\t\t\t\t}),\n\t\t\t\t]);\n\t\t\t}\n\t\t}\n\t\tthrow new Error(\n\t\t\t\"Private macOS runtime startup timed out. Check CuaDriver Accessibility and Screen Recording grants.\",\n\t\t);\n\t}\n\n\tclose(): Promise<void> {\n\t\tthis.closing ??= this.stop();\n\t\treturn this.closing;\n\t}\n\n\tprivate async stop(): Promise<void> {\n\t\tawait this.lifetime?.close();\n\t\tthis.lifetime = undefined;\n\t\tif (this.socket && this.pid)\n\t\t\tawait request(this.socket, \"shutdown_if_pid\", { expected_pid: this.pid }).catch(() => undefined);\n\t\tif (this.exited) {\n\t\t\tconst timeout = new AbortController();\n\t\t\ttry {\n\t\t\t\tawait Promise.race([\n\t\t\t\t\tthis.exited,\n\t\t\t\t\tdelay(10000, undefined, { signal: timeout.signal }).then(() => {\n\t\t\t\t\t\tthrow new Error(\"Owned macOS app shutdown is unconfirmed. Desktop lease retained.\");\n\t\t\t\t\t}),\n\t\t\t\t]);\n\t\t\t} finally {\n\t\t\t\ttimeout.abort();\n\t\t\t}\n\t\t}\n\t\tif (this.directory) await rm(this.directory, { recursive: true, force: true });\n\t}\n}\n"]}

package/dist/core/computer-use/policy.d.ts

@@ -0,0 +1,19 @@
+type ComputerSettings = {
+    enabled: boolean;
+    foreground: boolean;
+};
+export declare function computerSettingsChanged(settings: ComputerSettings): void;
+export declare function onComputerSettingsChanged(listener: (settings: ComputerSettings) => void): () => void;
+export declare const COMPUTER_TOOLS: readonly ["computer_load", "computer_apps", "computer_observe", "computer_click", "computer_drag", "computer_key", "computer_text", "computer_window", "computer_launch", "computer_scroll", "computer_end"];
+export declare function computerPolicy(name: string, input: Record<string, unknown>): {
+    observation: boolean;
+    foreground: boolean;
+} | undefined;
+export declare function computerRefusal(name: string, input: Record<string, unknown>, policy: {
+    enabled: boolean;
+    foreground: boolean;
+    child: boolean;
+    vision: boolean;
+}): string | undefined;
+export {};
+//# sourceMappingURL=policy.d.ts.map

package/dist/core/computer-use/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/core/computer-use/policy.ts"],"names":[],"mappings":"AAAA,KAAK,gBAAgB,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,CAAC;AAElE,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAExE;AACD,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,gBAAgB,KAAK,IAAI,GAAG,MAAM,IAAI,CAKpG;AAED,eAAO,MAAM,cAAc,8MAYjB,CAAC;AAEX,wBAAgB,cAAc,CAC7B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B;IAAE,WAAW,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,CAoB3D;AAED,wBAAgB,eAAe,CAC9B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,MAAM,EAAE;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;CAChB,GACC,MAAM,GAAG,SAAS,CAgBpB","sourcesContent":["type ComputerSettings = { enabled: boolean; foreground: boolean };\nconst settingsListeners = new Set<(settings: ComputerSettings) => void>();\nexport function computerSettingsChanged(settings: ComputerSettings): void {\n\tfor (const listener of settingsListeners) listener(settings);\n}\nexport function onComputerSettingsChanged(listener: (settings: ComputerSettings) => void): () => void {\n\tsettingsListeners.add(listener);\n\treturn () => {\n\t\tsettingsListeners.delete(listener);\n\t};\n}\n\nexport const COMPUTER_TOOLS = [\n\t\"computer_load\",\n\t\"computer_apps\",\n\t\"computer_observe\",\n\t\"computer_click\",\n\t\"computer_drag\",\n\t\"computer_key\",\n\t\"computer_text\",\n\t\"computer_window\",\n\t\"computer_launch\",\n\t\"computer_scroll\",\n\t\"computer_end\",\n] as const;\n\nexport function computerPolicy(\n\tname: string,\n\tinput: Record<string, unknown>,\n): { observation: boolean; foreground: boolean } | undefined {\n\tif (!name.startsWith(\"computer_\")) return undefined;\n\tswitch (name) {\n\t\tcase \"computer_load\":\n\t\tcase \"computer_apps\":\n\t\tcase \"computer_observe\":\n\t\tcase \"computer_end\":\n\t\t\treturn { observation: true, foreground: false };\n\t\tcase \"computer_click\":\n\t\tcase \"computer_drag\":\n\t\tcase \"computer_key\":\n\t\tcase \"computer_text\":\n\t\tcase \"computer_scroll\":\n\t\t\treturn { observation: false, foreground: input.foreground === true || input.desktop === true };\n\t\tcase \"computer_window\":\n\t\tcase \"computer_launch\":\n\t\t\treturn { observation: false, foreground: true };\n\t\tdefault:\n\t\t\tthrow new Error(`Unknown computer operation: ${name}`);\n\t}\n}\n\nexport function computerRefusal(\n\tname: string,\n\tinput: Record<string, unknown>,\n\tpolicy: {\n\t\tenabled: boolean;\n\t\tforeground: boolean;\n\t\tchild: boolean;\n\t\tvision: boolean;\n\t},\n): string | undefined {\n\tconst operation = computerPolicy(name, input);\n\tif (!operation) return \"Unknown computer operation.\";\n\tif (policy.child) return \"Computer tools are available only to main agents.\";\n\tif (!policy.enabled) return \"Computer use is disabled in settings.\";\n\tif (operation.foreground && !policy.foreground) return \"Foreground control is disabled. Use background operations.\";\n\tif (\n\t\t!policy.vision &&\n\t\t((name !== \"computer_window\" && (input.x !== undefined || input.y !== undefined)) ||\n\t\t\tname === \"computer_drag\" ||\n\t\t\tinput.screenshot === true ||\n\t\t\tinput.desktop === true)\n\t) {\n\t\treturn \"This model cannot receive images. Use accessibility elements or select an image-capable model.\";\n\t}\n\treturn undefined;\n}\n"]}

package/dist/core/computer-use/policy.js

@@ -0,0 +1,66 @@
+const settingsListeners = new Set();
+export function computerSettingsChanged(settings) {
+    for (const listener of settingsListeners)
+        listener(settings);
+}
+export function onComputerSettingsChanged(listener) {
+    settingsListeners.add(listener);
+    return () => {
+        settingsListeners.delete(listener);
+    };
+}
+export const COMPUTER_TOOLS = [
+    "computer_load",
+    "computer_apps",
+    "computer_observe",
+    "computer_click",
+    "computer_drag",
+    "computer_key",
+    "computer_text",
+    "computer_window",
+    "computer_launch",
+    "computer_scroll",
+    "computer_end",
+];
+export function computerPolicy(name, input) {
+    if (!name.startsWith("computer_"))
+        return undefined;
+    switch (name) {
+        case "computer_load":
+        case "computer_apps":
+        case "computer_observe":
+        case "computer_end":
+            return { observation: true, foreground: false };
+        case "computer_click":
+        case "computer_drag":
+        case "computer_key":
+        case "computer_text":
+        case "computer_scroll":
+            return { observation: false, foreground: input.foreground === true || input.desktop === true };
+        case "computer_window":
+        case "computer_launch":
+            return { observation: false, foreground: true };
+        default:
+            throw new Error(`Unknown computer operation: ${name}`);
+    }
+}
+export function computerRefusal(name, input, policy) {
+    const operation = computerPolicy(name, input);
+    if (!operation)
+        return "Unknown computer operation.";
+    if (policy.child)
+        return "Computer tools are available only to main agents.";
+    if (!policy.enabled)
+        return "Computer use is disabled in settings.";
+    if (operation.foreground && !policy.foreground)
+        return "Foreground control is disabled. Use background operations.";
+    if (!policy.vision &&
+        ((name !== "computer_window" && (input.x !== undefined || input.y !== undefined)) ||
+            name === "computer_drag" ||
+            input.screenshot === true ||
+            input.desktop === true)) {
+        return "This model cannot receive images. Use accessibility elements or select an image-capable model.";
+    }
+    return undefined;
+}
+//# sourceMappingURL=policy.js.map

package/dist/core/computer-use/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/core/computer-use/policy.ts"],"names":[],"mappings":"AACA,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAwC,CAAC;AAC1E,MAAM,UAAU,uBAAuB,CAAC,QAA0B,EAAQ;IACzE,KAAK,MAAM,QAAQ,IAAI,iBAAiB;QAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAAA,CAC7D;AACD,MAAM,UAAU,yBAAyB,CAAC,QAA8C,EAAc;IACrG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,OAAO,GAAG,EAAE,CAAC;QACZ,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAAA,CACnC,CAAC;AAAA,CACF;AAED,MAAM,CAAC,MAAM,cAAc,GAAG;IAC7B,eAAe;IACf,eAAe;IACf,kBAAkB;IAClB,gBAAgB;IAChB,eAAe;IACf,cAAc;IACd,eAAe;IACf,iBAAiB;IACjB,iBAAiB;IACjB,iBAAiB;IACjB,cAAc;CACL,CAAC;AAEX,MAAM,UAAU,cAAc,CAC7B,IAAY,EACZ,KAA8B,EAC8B;IAC5D,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,SAAS,CAAC;IACpD,QAAQ,IAAI,EAAE,CAAC;QACd,KAAK,eAAe,CAAC;QACrB,KAAK,eAAe,CAAC;QACrB,KAAK,kBAAkB,CAAC;QACxB,KAAK,cAAc;YAClB,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QACjD,KAAK,gBAAgB,CAAC;QACtB,KAAK,eAAe,CAAC;QACrB,KAAK,cAAc,CAAC;QACpB,KAAK,eAAe,CAAC;QACrB,KAAK,iBAAiB;YACrB,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAChG,KAAK,iBAAiB,CAAC;QACvB,KAAK,iBAAiB;YACrB,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACjD;YACC,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;AAAA,CACD;AAED,MAAM,UAAU,eAAe,CAC9B,IAAY,EACZ,KAA8B,EAC9B,MAKC,EACoB;IACrB,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,SAAS;QAAE,OAAO,6BAA6B,CAAC;IACrD,IAAI,MAAM,CAAC,KAAK;QAAE,OAAO,mDAAmD,CAAC;IAC7E,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,uCAAuC,CAAC;IACpE,IAAI,SAAS,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,UAAU;QAAE,OAAO,4DAA4D,CAAC;IACpH,IACC,CAAC,MAAM,CAAC,MAAM;QACd,CAAC,CAAC,IAAI,KAAK,iBAAiB,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;YAChF,IAAI,KAAK,eAAe;YACxB,KAAK,CAAC,UAAU,KAAK,IAAI;YACzB,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,EACvB,CAAC;QACF,OAAO,gGAAgG,CAAC;IACzG,CAAC;IACD,OAAO,SAAS,CAAC;AAAA,CACjB","sourcesContent":["type ComputerSettings = { enabled: boolean; foreground: boolean };\nconst settingsListeners = new Set<(settings: ComputerSettings) => void>();\nexport function computerSettingsChanged(settings: ComputerSettings): void {\n\tfor (const listener of settingsListeners) listener(settings);\n}\nexport function onComputerSettingsChanged(listener: (settings: ComputerSettings) => void): () => void {\n\tsettingsListeners.add(listener);\n\treturn () => {\n\t\tsettingsListeners.delete(listener);\n\t};\n}\n\nexport const COMPUTER_TOOLS = [\n\t\"computer_load\",\n\t\"computer_apps\",\n\t\"computer_observe\",\n\t\"computer_click\",\n\t\"computer_drag\",\n\t\"computer_key\",\n\t\"computer_text\",\n\t\"computer_window\",\n\t\"computer_launch\",\n\t\"computer_scroll\",\n\t\"computer_end\",\n] as const;\n\nexport function computerPolicy(\n\tname: string,\n\tinput: Record<string, unknown>,\n): { observation: boolean; foreground: boolean } | undefined {\n\tif (!name.startsWith(\"computer_\")) return undefined;\n\tswitch (name) {\n\t\tcase \"computer_load\":\n\t\tcase \"computer_apps\":\n\t\tcase \"computer_observe\":\n\t\tcase \"computer_end\":\n\t\t\treturn { observation: true, foreground: false };\n\t\tcase \"computer_click\":\n\t\tcase \"computer_drag\":\n\t\tcase \"computer_key\":\n\t\tcase \"computer_text\":\n\t\tcase \"computer_scroll\":\n\t\t\treturn { observation: false, foreground: input.foreground === true || input.desktop === true };\n\t\tcase \"computer_window\":\n\t\tcase \"computer_launch\":\n\t\t\treturn { observation: false, foreground: true };\n\t\tdefault:\n\t\t\tthrow new Error(`Unknown computer operation: ${name}`);\n\t}\n}\n\nexport function computerRefusal(\n\tname: string,\n\tinput: Record<string, unknown>,\n\tpolicy: {\n\t\tenabled: boolean;\n\t\tforeground: boolean;\n\t\tchild: boolean;\n\t\tvision: boolean;\n\t},\n): string | undefined {\n\tconst operation = computerPolicy(name, input);\n\tif (!operation) return \"Unknown computer operation.\";\n\tif (policy.child) return \"Computer tools are available only to main agents.\";\n\tif (!policy.enabled) return \"Computer use is disabled in settings.\";\n\tif (operation.foreground && !policy.foreground) return \"Foreground control is disabled. Use background operations.\";\n\tif (\n\t\t!policy.vision &&\n\t\t((name !== \"computer_window\" && (input.x !== undefined || input.y !== undefined)) ||\n\t\t\tname === \"computer_drag\" ||\n\t\t\tinput.screenshot === true ||\n\t\t\tinput.desktop === true)\n\t) {\n\t\treturn \"This model cannot receive images. Use accessibility elements or select an image-capable model.\";\n\t}\n\treturn undefined;\n}\n"]}

package/dist/core/computer-use/release.generated.d.ts

@@ -0,0 +1,31 @@
+export declare const computerRelease: {
+    readonly version: "0.28.1";
+    readonly tag: "cua-driver-rs-v0.28.1";
+    readonly sourceCommit: "d8028a7943087ee258dc1b4d19dc12a7cd27669c";
+    readonly repository: "https://github.com/trycua/cua";
+    readonly prerelease: true;
+    readonly approval: "development-only; production release not approved";
+    readonly artifacts: readonly [{
+        readonly platform: "win32";
+        readonly arch: "x64";
+        readonly packageName: "@ashx-j/lunr-computer-win32-x64";
+        readonly name: "cua-driver-rs-0.28.1-windows-x86_64-binary.zip";
+        readonly bytes: 28930759;
+        readonly sha256: "ab90418a54f84102f549cde4537daef3a0e20ba8254b7e24524a50fc5f4174d3";
+    }, {
+        readonly platform: "win32";
+        readonly arch: "arm64";
+        readonly packageName: "@ashx-j/lunr-computer-win32-arm64";
+        readonly name: "cua-driver-rs-0.28.1-windows-arm64-binary.zip";
+        readonly bytes: 27246194;
+        readonly sha256: "d260e6110e029680d543d317f3c3c09569475f8d65855fcedda202e2ee989bf0";
+    }, {
+        readonly platform: "darwin";
+        readonly arch: "arm64";
+        readonly packageName: "@ashx-j/lunr-computer-darwin-arm64";
+        readonly name: "cua-driver-rs-0.28.1-darwin-arm64.tar.gz";
+        readonly bytes: 70074352;
+        readonly sha256: "b3cb3781feb9855dfcdd616bc5c9c8e627453e3e16a073c1446326691a549b24";
+    }];
+};
+//# sourceMappingURL=release.generated.d.ts.map

package/dist/core/computer-use/release.generated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release.generated.d.ts","sourceRoot":"","sources":["../../../src/core/computer-use/release.generated.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiClB,CAAC","sourcesContent":["// Generated by scripts/generate-computer-use-manifest.mjs.\nexport const computerRelease = {\n  \"version\": \"0.28.1\",\n  \"tag\": \"cua-driver-rs-v0.28.1\",\n  \"sourceCommit\": \"d8028a7943087ee258dc1b4d19dc12a7cd27669c\",\n  \"repository\": \"https://github.com/trycua/cua\",\n  \"prerelease\": true,\n  \"approval\": \"development-only; production release not approved\",\n  \"artifacts\": [\n    {\n      \"platform\": \"win32\",\n      \"arch\": \"x64\",\n      \"packageName\": \"@ashx-j/lunr-computer-win32-x64\",\n      \"name\": \"cua-driver-rs-0.28.1-windows-x86_64-binary.zip\",\n      \"bytes\": 28930759,\n      \"sha256\": \"ab90418a54f84102f549cde4537daef3a0e20ba8254b7e24524a50fc5f4174d3\"\n    },\n    {\n      \"platform\": \"win32\",\n      \"arch\": \"arm64\",\n      \"packageName\": \"@ashx-j/lunr-computer-win32-arm64\",\n      \"name\": \"cua-driver-rs-0.28.1-windows-arm64-binary.zip\",\n      \"bytes\": 27246194,\n      \"sha256\": \"d260e6110e029680d543d317f3c3c09569475f8d65855fcedda202e2ee989bf0\"\n    },\n    {\n      \"platform\": \"darwin\",\n      \"arch\": \"arm64\",\n      \"packageName\": \"@ashx-j/lunr-computer-darwin-arm64\",\n      \"name\": \"cua-driver-rs-0.28.1-darwin-arm64.tar.gz\",\n      \"bytes\": 70074352,\n      \"sha256\": \"b3cb3781feb9855dfcdd616bc5c9c8e627453e3e16a073c1446326691a549b24\"\n    }\n  ]\n} as const;\n"]}

package/dist/core/computer-use/release.generated.js

@@ -0,0 +1,36 @@
+// Generated by scripts/generate-computer-use-manifest.mjs.
+export const computerRelease = {
+    "version": "0.28.1",
+    "tag": "cua-driver-rs-v0.28.1",
+    "sourceCommit": "d8028a7943087ee258dc1b4d19dc12a7cd27669c",
+    "repository": "https://github.com/trycua/cua",
+    "prerelease": true,
+    "approval": "development-only; production release not approved",
+    "artifacts": [
+        {
+            "platform": "win32",
+            "arch": "x64",
+            "packageName": "@ashx-j/lunr-computer-win32-x64",
+            "name": "cua-driver-rs-0.28.1-windows-x86_64-binary.zip",
+            "bytes": 28930759,
+            "sha256": "ab90418a54f84102f549cde4537daef3a0e20ba8254b7e24524a50fc5f4174d3"
+        },
+        {
+            "platform": "win32",
+            "arch": "arm64",
+            "packageName": "@ashx-j/lunr-computer-win32-arm64",
+            "name": "cua-driver-rs-0.28.1-windows-arm64-binary.zip",
+            "bytes": 27246194,
+            "sha256": "d260e6110e029680d543d317f3c3c09569475f8d65855fcedda202e2ee989bf0"
+        },
+        {
+            "platform": "darwin",
+            "arch": "arm64",
+            "packageName": "@ashx-j/lunr-computer-darwin-arm64",
+            "name": "cua-driver-rs-0.28.1-darwin-arm64.tar.gz",
+            "bytes": 70074352,
+            "sha256": "b3cb3781feb9855dfcdd616bc5c9c8e627453e3e16a073c1446326691a549b24"
+        }
+    ]
+};
+//# sourceMappingURL=release.generated.js.map

package/dist/core/computer-use/release.generated.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release.generated.js","sourceRoot":"","sources":["../../../src/core/computer-use/release.generated.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,SAAS,EAAE,QAAQ;IACnB,KAAK,EAAE,uBAAuB;IAC9B,cAAc,EAAE,0CAA0C;IAC1D,YAAY,EAAE,+BAA+B;IAC7C,YAAY,EAAE,IAAI;IAClB,UAAU,EAAE,mDAAmD;IAC/D,WAAW,EAAE;QACX;YACE,UAAU,EAAE,OAAO;YACnB,MAAM,EAAE,KAAK;YACb,aAAa,EAAE,iCAAiC;YAChD,MAAM,EAAE,gDAAgD;YACxD,OAAO,EAAE,QAAQ;YACjB,QAAQ,EAAE,kEAAkE;SAC7E;QACD;YACE,UAAU,EAAE,OAAO;YACnB,MAAM,EAAE,OAAO;YACf,aAAa,EAAE,mCAAmC;YAClD,MAAM,EAAE,+CAA+C;YACvD,OAAO,EAAE,QAAQ;YACjB,QAAQ,EAAE,kEAAkE;SAC7E;QACD;YACE,UAAU,EAAE,QAAQ;YACpB,MAAM,EAAE,OAAO;YACf,aAAa,EAAE,oCAAoC;YACnD,MAAM,EAAE,0CAA0C;YAClD,OAAO,EAAE,QAAQ;YACjB,QAAQ,EAAE,kEAAkE;SAC7E;KACF;CACO,CAAC","sourcesContent":["// Generated by scripts/generate-computer-use-manifest.mjs.\nexport const computerRelease = {\n  \"version\": \"0.28.1\",\n  \"tag\": \"cua-driver-rs-v0.28.1\",\n  \"sourceCommit\": \"d8028a7943087ee258dc1b4d19dc12a7cd27669c\",\n  \"repository\": \"https://github.com/trycua/cua\",\n  \"prerelease\": true,\n  \"approval\": \"development-only; production release not approved\",\n  \"artifacts\": [\n    {\n      \"platform\": \"win32\",\n      \"arch\": \"x64\",\n      \"packageName\": \"@ashx-j/lunr-computer-win32-x64\",\n      \"name\": \"cua-driver-rs-0.28.1-windows-x86_64-binary.zip\",\n      \"bytes\": 28930759,\n      \"sha256\": \"ab90418a54f84102f549cde4537daef3a0e20ba8254b7e24524a50fc5f4174d3\"\n    },\n    {\n      \"platform\": \"win32\",\n      \"arch\": \"arm64\",\n      \"packageName\": \"@ashx-j/lunr-computer-win32-arm64\",\n      \"name\": \"cua-driver-rs-0.28.1-windows-arm64-binary.zip\",\n      \"bytes\": 27246194,\n      \"sha256\": \"d260e6110e029680d543d317f3c3c09569475f8d65855fcedda202e2ee989bf0\"\n    },\n    {\n      \"platform\": \"darwin\",\n      \"arch\": \"arm64\",\n      \"packageName\": \"@ashx-j/lunr-computer-darwin-arm64\",\n      \"name\": \"cua-driver-rs-0.28.1-darwin-arm64.tar.gz\",\n      \"bytes\": 70074352,\n      \"sha256\": \"b3cb3781feb9855dfcdd616bc5c9c8e627453e3e16a073c1446326691a549b24\"\n    }\n  ]\n} as const;\n"]}

package/dist/core/computer-use/runtime.d.ts

@@ -0,0 +1,13 @@
+export declare const CUA_VERSION: "0.28.1";
+export declare function resolveRuntimeArchive(packageDirectory?: string, platform?: string, arch?: string): Promise<{
+    archive: string;
+    sha256: string;
+}>;
+export declare function runtimeEnvironment(inherited?: NodeJS.ProcessEnv): Record<string, string>;
+export declare function assertOwnedPath(path: string): Promise<void>;
+export declare function runtimeInventory(root: string, signal?: AbortSignal): Promise<Record<string, string>>;
+export declare function installRuntime(signal?: AbortSignal): Promise<{
+    command: string;
+    app?: string;
+}>;
+//# sourceMappingURL=runtime.d.ts.map

package/dist/core/computer-use/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../src/core/computer-use/runtime.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,WAAW,UAA0B,CAAC;AAEnD,wBAAsB,qBAAqB,CAC1C,gBAAgB,SAAkB,EAClC,QAAQ,GAAE,MAAyB,EACnC,IAAI,GAAE,MAAqB,GACzB,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA8B9C;AAED,wBAAgB,kBAAkB,CAAC,SAAS,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAYrG;AAQD,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAejE;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA6B1G;AAED,wBAAsB,cAAc,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAoDrG","sourcesContent":["import { execFile } from \"node:child_process\";\nimport { createHash, randomUUID } from \"node:crypto\";\nimport { createReadStream } from \"node:fs\";\nimport { lstat, mkdir, readdir, readFile, readlink, realpath, rename, rm } from \"node:fs/promises\";\nimport { createRequire } from \"node:module\";\nimport { userInfo } from \"node:os\";\nimport { dirname, isAbsolute, join, relative, resolve } from \"node:path\";\nimport { promisify } from \"node:util\";\nimport lockfile from \"proper-lockfile\";\nimport { getPackageDir } from \"../../config.ts\";\n\nimport { computerRelease } from \"./release.generated.ts\";\n\nconst exec = promisify(execFile);\nexport const CUA_VERSION = computerRelease.version;\n\nexport async function resolveRuntimeArchive(\n\tpackageDirectory = getPackageDir(),\n\tplatform: string = process.platform,\n\tarch: string = process.arch,\n): Promise<{ archive: string; sha256: string }> {\n\tconst payload = computerRelease.artifacts.find((item) => item.platform === platform && item.arch === arch);\n\tif (!payload) throw new Error(\"Computer use is unsupported on this platform or architecture.\");\n\tlet archive = join(packageDirectory, \"native\", \"computer-use\", payload.name);\n\ttry {\n\t\tawait lstat(archive);\n\t} catch (error) {\n\t\tif (!(error instanceof Error && \"code\" in error && error.code === \"ENOENT\")) throw error;\n\t\tlet manifestPath: string;\n\t\ttry {\n\t\t\tmanifestPath = createRequire(join(packageDirectory, \"package.json\")).resolve(\n\t\t\t\t`${payload.packageName}/package.json`,\n\t\t\t);\n\t\t} catch {\n\t\t\tthrow new Error(\n\t\t\t\t\"Computer-use payload is missing. Reinstall lunR with optional dependencies enabled. No runtime was downloaded.\",\n\t\t\t);\n\t\t}\n\t\tconst manifest = JSON.parse(await readFile(manifestPath, \"utf8\"));\n\t\tconst cli = JSON.parse(await readFile(join(packageDirectory, \"package.json\"), \"utf8\"));\n\t\tif (manifest.name !== payload.packageName || manifest.version !== cli.version)\n\t\t\tthrow new Error(\n\t\t\t\t\"Computer-use payload package version does not match lunR. Reinstall lunR with optional dependencies enabled.\",\n\t\t\t);\n\t\tarchive = join(dirname(manifestPath), payload.name);\n\t}\n\tconst info = await lstat(archive);\n\tif (!info.isFile() || info.isSymbolicLink() || info.size !== payload.bytes)\n\t\tthrow new Error(\"Bundled computer-use archive is not a regular file of the pinned size.\");\n\treturn { archive, sha256: payload.sha256 };\n}\n\nexport function runtimeEnvironment(inherited: NodeJS.ProcessEnv = process.env): Record<string, string> {\n\treturn {\n\t\t...Object.fromEntries(\n\t\t\tObject.entries(inherited).filter(\n\t\t\t\t(entry): entry is [string, string] => entry[1] !== undefined && !entry[0].toUpperCase().startsWith(\"CUA_\"),\n\t\t\t),\n\t\t),\n\t\tCUA_DRIVER_RS_TELEMETRY_ENABLED: \"false\",\n\t\tCUA_DRIVER_RS_UPDATE_CHECK: \"false\",\n\t\tCUA_DRIVER_PERMISSION_MODE: \"standard\",\n\t\tCUA_DRIVER_DISABLE_UNRESTRICTED: \"true\",\n\t};\n}\n\nasync function digest(path: string, signal?: AbortSignal): Promise<string> {\n\tconst hash = createHash(\"sha256\");\n\tfor await (const chunk of createReadStream(path, { signal })) hash.update(chunk);\n\treturn hash.digest(\"hex\");\n}\n\nexport async function assertOwnedPath(path: string): Promise<void> {\n\tlet current = resolve(path);\n\tfor (;;) {\n\t\ttry {\n\t\t\tconst info = await lstat(current);\n\t\t\tif (info.isSymbolicLink() || resolve(await realpath(current)).toLowerCase() !== current.toLowerCase()) {\n\t\t\t\tthrow new Error(`Computer runtime path redirects elsewhere: ${current}`);\n\t\t\t}\n\t\t} catch (error) {\n\t\t\tif (!(error instanceof Error && \"code\" in error && error.code === \"ENOENT\")) throw error;\n\t\t}\n\t\tconst parent = dirname(current);\n\t\tif (parent === current) return;\n\t\tcurrent = parent;\n\t}\n}\n\nexport async function runtimeInventory(root: string, signal?: AbortSignal): Promise<Record<string, string>> {\n\tconst inventory: Record<string, string> = {};\n\tasync function walk(path: string): Promise<void> {\n\t\tfor (const item of await readdir(path, { withFileTypes: true })) {\n\t\t\tconst entry = join(path, item.name);\n\t\t\tconst key = relative(root, entry);\n\t\t\tif (item.isSymbolicLink()) {\n\t\t\t\tconst target = await readlink(entry);\n\t\t\t\tconst resolved = relative(root, resolve(dirname(entry), target));\n\t\t\t\tif (\n\t\t\t\t\tisAbsolute(target) ||\n\t\t\t\t\tresolved === \"..\" ||\n\t\t\t\t\tresolved.startsWith(`..${process.platform === \"win32\" ? \"\\\\\" : \"/\"}`) ||\n\t\t\t\t\tisAbsolute(resolved)\n\t\t\t\t)\n\t\t\t\t\tthrow new Error(\"Runtime symlink escapes its bundle.\");\n\t\t\t\tinventory[key] = `link:${target}`;\n\t\t\t} else if (item.isDirectory()) {\n\t\t\t\tawait assertOwnedPath(entry);\n\t\t\t\tinventory[key] = \"directory\";\n\t\t\t\tawait walk(entry);\n\t\t\t} else if (item.isFile()) {\n\t\t\t\tawait assertOwnedPath(entry);\n\t\t\t\tinventory[key] = await digest(entry, signal);\n\t\t\t} else throw new Error(\"Unexpected runtime filesystem entry.\");\n\t\t}\n\t}\n\tawait walk(root);\n\treturn Object.fromEntries(Object.entries(inventory).sort(([a], [b]) => a.localeCompare(b)));\n}\n\nexport async function installRuntime(signal?: AbortSignal): Promise<{ command: string; app?: string }> {\n\tsignal?.throwIfAborted();\n\tconst platform = `${process.platform}-${process.arch}`;\n\tconst { archive, sha256 } = await resolveRuntimeArchive();\n\tif (process.platform === \"win32\" && process.env.SESSIONNAME === \"Services\")\n\t\tthrow new Error(\"Computer use requires a logged-in interactive desktop.\");\n\tif ((await digest(archive, signal)) !== sha256)\n\t\tthrow new Error(\"Bundled computer-use archive failed SHA-256 verification.\");\n\tconst root = join(userInfo().homedir, \".lunr\", \"desktop\");\n\tawait assertOwnedPath(root);\n\tawait mkdir(root, { recursive: true, mode: 0o700 });\n\tconst release = await lockfile.lock(root, { retries: 0, stale: 120000 });\n\tconst temporary = join(root, `extract-${randomUUID()}`);\n\tconst destination = join(root, `runtime-${platform}`);\n\ttry {\n\t\tawait assertOwnedPath(destination);\n\t\tawait mkdir(temporary, { mode: 0o700 });\n\t\tawait exec(\n\t\t\tprocess.platform === \"win32\"\n\t\t\t\t? join(process.env.SystemRoot ?? \"C:\\\\Windows\", \"System32\", \"tar.exe\")\n\t\t\t\t: \"/usr/bin/tar\",\n\t\t\t[\"-xf\", archive, \"-C\", temporary],\n\t\t\t{\n\t\t\t\ttimeout: 30000,\n\t\t\t\twindowsHide: true,\n\t\t\t\tsignal,\n\t\t\t},\n\t\t);\n\t\tconst extracted =\n\t\t\tprocess.platform === \"darwin\" ? join(temporary, `cua-driver-rs-${CUA_VERSION}-darwin-arm64`) : temporary;\n\t\tconst expected = await runtimeInventory(extracted, signal);\n\t\ttry {\n\t\t\tawait lstat(destination);\n\t\t\tif (JSON.stringify(await runtimeInventory(destination, signal)) !== JSON.stringify(expected))\n\t\t\t\tthrow new Error(\n\t\t\t\t\t\"Cached computer runtime differs from the verified archive. Remove the inactive lunR runtime directory before reinstalling; it was not executed or overwritten.\",\n\t\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (!(error instanceof Error && \"code\" in error && error.code === \"ENOENT\")) throw error;\n\t\t\tawait rename(extracted, destination);\n\t\t}\n\t\tsignal?.throwIfAborted();\n\t\tif (process.platform === \"darwin\") {\n\t\t\tconst app = join(destination, \"CuaDriver.app\");\n\t\t\tawait exec(\"/usr/bin/codesign\", [\"--verify\", \"--deep\", \"--strict\", app], { timeout: 15000, signal });\n\t\t\treturn { app, command: join(app, \"Contents\", \"MacOS\", \"cua-driver\") };\n\t\t}\n\t\treturn { command: join(destination, \"cua-driver.exe\") };\n\t} finally {\n\t\tawait rm(temporary, { recursive: true, force: true });\n\t\tawait release();\n\t}\n}\n"]}