@atomic-chat/core 0.5.1 → 0.13.2

package/dist/host/recipes/executor-io-windows.js

@@ -0,0 +1,235 @@
+/**
+ * The real I/O behind `executeHostStep` on Windows (change `add-tensorrt-llm-windows`, task 2.4,
+ * design D15), for a process UAC elevated. The Linux checks (`executor-io.ts`) trust a folder by its
+ * uid and mode bits; Windows has neither, so the same promise is kept with its owner and its ACL.
+ *
+ * The app writes `<step_id>.request.json` into a folder under the user's `%LOCALAPPDATA%` whose ACL
+ * grants access only to the user, `SYSTEM` and `Administrators`, then runs this executor elevated.
+ * Before the request is read and again before the result is written, the folder — and the request
+ * itself — must be:
+ *
+ * - a real directory (file), not a reparse point: a junction or a symlink could send the elevated
+ *   write of `<step_id>.result.json` into a system folder;
+ * - owned by an account, not by a broad group (`Everyone`, `Users`, `Authenticated Users`, …);
+ * - writable by nobody but that owner, `SYSTEM`, `Administrators` and `CREATOR OWNER`: an `Allow`
+ *   entry granting any write, delete or permission-changing right to anyone else refuses it.
+ *
+ * Owner and ACL are read by SID, never by name (names are localized): one PowerShell query per
+ * path, the path passed in an environment variable rather than spliced into the script. Every file
+ * the executor writes goes to a fresh temporary name created exclusively and is renamed into place.
+ *
+ * Commands: only `wsl.exe`, resolved to `%SystemRoot%\System32\wsl.exe`; anything else is refused —
+ * the only recipe that runs on Windows is `windows.enable-wsl`.
+ */
+import { spawn } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
+import { lstat, open, readFile, rename, rm } from 'node:fs/promises';
+import { win32 } from 'node:path';
+import { AtomicCoreError } from '../../contracts/index.js';
+import { hostExec, parseRebootPending, REBOOT_PENDING_KEY } from '../../runtime/environment/index.js';
+const SYSTEM = 'S-1-5-18';
+const ADMINISTRATORS = 'S-1-5-32-544';
+const CREATOR_OWNER = 'S-1-3-0';
+/** Never an acceptable owner: a group anyone on the machine belongs to. */
+const BROAD = new Set([
+    'S-1-1-0', // Everyone
+    'S-1-5-11', // Authenticated Users
+    'S-1-5-32-545', // Users
+    'S-1-5-32-546', // Guests
+    'S-1-5-4', // Interactive
+    'S-1-5-7', // Anonymous
+]);
+/**
+ * Any right that lets its holder change what is in the folder or who may: write or append data,
+ * write attributes, delete a child or the object, change its permissions or owner, and the generic
+ * write and all bits.
+ */
+const WRITE_RIGHTS = 0x2 | 0x4 | 0x10 | 0x40 | 0x100 | 0x10000 | 0x40000 | 0x80000 | 0x10000000 | 0x40000000;
+/** Why `acl` cannot be trusted for `what`, or null when it can. Pure. */
+export function judgeWindowsAcl(acl, what, expect) {
+    if (acl.reparse)
+        return `${what} is a reparse point (a junction or a link is refused)`;
+    if (acl.directory !== (expect === 'directory'))
+        return `${what} is not a ${expect}`;
+    if (BROAD.has(acl.owner))
+        return `${what} is owned by ${acl.owner}, a group anyone belongs to`;
+    const trusted = new Set([acl.owner, SYSTEM, ADMINISTRATORS, CREATOR_OWNER]);
+    const writers = acl.rules
+        .filter((rule) => rule.allow && (rule.rights & WRITE_RIGHTS) !== 0 && !trusted.has(rule.sid))
+        .map((rule) => rule.sid);
+    return writers.length === 0 ? null : `${what} is writable by ${[...new Set(writers)].join(', ')}`;
+}
+const ACL_QUERY = [
+    '$p = $env:ATOMIC_HOST_STEP_PATH',
+    '$i = Get-Item -LiteralPath $p -Force',
+    '$a = Get-Acl -LiteralPath $p',
+    '$t = [System.Security.Principal.SecurityIdentifier]',
+    '[pscustomobject]@{',
+    '  reparse = [bool]($i.Attributes -band [System.IO.FileAttributes]::ReparsePoint)',
+    '  directory = [bool]$i.PSIsContainer',
+    '  owner = $a.GetOwner($t).Value',
+    '  rules = @($a.GetAccessRules($true, $true, $t) | ForEach-Object {',
+    "    [pscustomobject]@{ sid = $_.IdentityReference.Value; allow = ($_.AccessControlType -eq 'Allow'); rights = [int64]$_.FileSystemRights } })",
+    '} | ConvertTo-Json -Compress -Depth 4',
+].join('\n');
+/** `Get-Acl`'s answer, parsed; throws when PowerShell did not give one. */
+export function parseWindowsAcl(output) {
+    if (output.code !== 0)
+        throw new Error(`Get-Acl failed (${String(output.code)}): ${output.stderr.trim()}`);
+    const raw = JSON.parse(output.stdout);
+    const rules = (Array.isArray(raw.rules) ? raw.rules : raw.rules === undefined ? [] : [raw.rules]);
+    if (typeof raw.owner !== 'string' ||
+        typeof raw.reparse !== 'boolean' ||
+        typeof raw.directory !== 'boolean') {
+        throw new Error('Get-Acl answered without an owner');
+    }
+    return {
+        reparse: raw.reparse,
+        directory: raw.directory,
+        owner: raw.owner,
+        rules: rules.map((rule) => ({
+            sid: String(rule.sid),
+            allow: rule.allow === true,
+            rights: Number(rule.rights),
+        })),
+    };
+}
+/**
+ * Runs `command` with this process's own console (stdio inherited, window hidden), no shell, and
+ * resolves with the exit code only. The elevated executor is started by the app with `SW_HIDE`, so the
+ * console it shares is invisible. Used for the inbox `wsl.exe --install`, which refuses to install
+ * when its output is a pipe.
+ *
+ * The deadline and `until` end the whole process tree with `taskkill /T /F`: `wsl --install` runs a
+ * second `wsl.exe` that holds the distribution's console, and killing only the first leaves it behind.
+ */
+const consoleExec = (command, args, timeoutMs, taskkill, until) => new Promise((resolve) => {
+    const child = spawn(command, args, { stdio: 'inherit', windowsHide: true, shell: false });
+    let settled = false;
+    let cut = false;
+    let poll;
+    const endTree = () => {
+        if (child.pid === undefined)
+            return void child.kill();
+        spawn(taskkill, ['/T', '/F', '/PID', String(child.pid)], { stdio: 'ignore', windowsHide: true }).once('error', () => child.kill());
+    };
+    const timer = setTimeout(endTree, timeoutMs);
+    const check = async () => {
+        const done = await until().catch(() => false);
+        if (settled)
+            return;
+        if (done) {
+            cut = true;
+            endTree();
+        }
+        else
+            poll = setTimeout(() => void check(), UNTIL_POLL_MS);
+    };
+    if (until !== undefined)
+        poll = setTimeout(() => void check(), UNTIL_POLL_MS);
+    const settle = (output) => {
+        settled = true;
+        clearTimeout(timer);
+        clearTimeout(poll);
+        resolve(output);
+    };
+    child.once('error', (error) => settle({ code: null, stdout: '', stderr: error.message }));
+    child.once('exit', (code) => settle(cut ? { code: 0, stdout: '', stderr: '', cutShort: true } : { code, stdout: '', stderr: '' }));
+});
+/** How often `until` is asked while a console command runs. */
+const UNTIL_POLL_MS = 5_000;
+const nodeIo = () => {
+    const systemRoot = (process.env['SystemRoot'] ?? process.env['SYSTEMROOT'] ?? 'C:\\Windows').replace(/[\\/]+$/, '');
+    const taskkill = `${systemRoot}\\System32\\taskkill.exe`;
+    return {
+        exec: (command, args, options) => options?.console === true
+            ? consoleExec(command, args, options.timeoutMs ?? 60_000, taskkill, options.until)
+            : hostExec({ timeoutMs: options?.timeoutMs ?? 60_000 })(command, args, options?.env),
+        lstat: (path) => lstat(path),
+        readFile: (path) => readFile(path, 'utf8'),
+        createExclusive: async (path, text) => {
+            const handle = await open(path, 'wx', 0o644);
+            try {
+                await handle.writeFile(text);
+                await handle.sync();
+            }
+            finally {
+                await handle.close();
+            }
+        },
+        rename: (from, to) => rename(from, to),
+        remove: (path) => rm(path, { force: true }),
+    };
+};
+const REQUEST_SIZE_LIMIT = 64 * 1024;
+/** `wsl --install` downloads the WSL package from the Store: minutes, not hours. */
+const INSTALL_TIMEOUT_MS = 30 * 60_000;
+const COMMAND_TIMEOUT_MS = 5 * 60_000;
+const refuse = (message) => {
+    throw new AtomicCoreError('MANAGED_HOST_STEP_INVALID', message);
+};
+/**
+ * The executor's dependencies on a Windows machine. `env` gives `%SystemRoot%`, where the only
+ * command it runs — `wsl.exe` — and PowerShell live.
+ */
+export function windowsHostStepDeps(env, io = nodeIo()) {
+    const system32 = `${(env['SystemRoot'] ?? env['SYSTEMROOT'] ?? 'C:\\Windows').replace(/[\\/]+$/, '')}\\System32`;
+    const powershell = `${system32}\\WindowsPowerShell\\v1.0\\powershell.exe`;
+    const trust = async (path, what, expect) => {
+        let acl;
+        try {
+            acl = parseWindowsAcl(await io.exec(powershell, ['-NoProfile', '-NonInteractive', '-Command', ACL_QUERY], {
+                env: { ATOMIC_HOST_STEP_PATH: path },
+            }));
+        }
+        catch (error) {
+            return refuse(`could not read the owner and permissions of ${what}: ${error.message}`);
+        }
+        const problem = judgeWindowsAcl(acl, what, expect);
+        if (problem !== null)
+            refuse(problem);
+    };
+    return {
+        readRequest: async (path) => {
+            const folder = win32.dirname(path);
+            await trust(folder, folder, 'directory');
+            const info = await io.lstat(path);
+            if (info.isSymbolicLink() || !info.isFile())
+                refuse(`${path} is not a regular file`);
+            if (info.size > REQUEST_SIZE_LIMIT)
+                refuse(`${path} is too large to be a request`);
+            await trust(path, path, 'file');
+            return io.readFile(path);
+        },
+        writeResult: async (path, text) => {
+            const folder = win32.dirname(path);
+            await trust(folder, folder, 'directory');
+            const temp = win32.join(folder, `.${win32.basename(path)}.${randomBytes(6).toString('hex')}.tmp`);
+            try {
+                await io.createExclusive(temp, text);
+                await io.rename(temp, path);
+            }
+            catch (error) {
+                // Only our own temporary file: it was created exclusively.
+                await io.remove(temp);
+                throw error;
+            }
+        },
+        readFile: async () => refuse('the Windows executor reads no system file'),
+        writeFile: async () => refuse('the Windows executor writes no system file'),
+        exec: async ([command, ...args], options) => {
+            if (command !== 'wsl.exe')
+                return refuse(`${String(command)} is not a command the Windows executor runs`);
+            return io.exec(`${system32}\\wsl.exe`, args, {
+                timeoutMs: options?.longRunning === true ? INSTALL_TIMEOUT_MS : COMMAND_TIMEOUT_MS,
+                ...(options?.console === true ? { console: true } : {}),
+                ...(options?.console === true && options.until !== undefined ? { until: options.until } : {}),
+            });
+        },
+        fetch: async () => refuse('the Windows executor downloads nothing'),
+        rebootPending: async () => parseRebootPending(await io.exec(`${system32}\\reg.exe`, ['query', REBOOT_PENDING_KEY])),
+        now: () => Date.now(),
+        invokingUid: null,
+    };
+}
+//# sourceMappingURL=executor-io-windows.js.map

package/dist/host/recipes/executor-io-windows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor-io-windows.js","sourceRoot":"","sources":["../../../src/host/recipes/executor-io-windows.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAA;AACpE,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAC1D,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAA;AAkBrG,MAAM,MAAM,GAAG,UAAU,CAAA;AACzB,MAAM,cAAc,GAAG,cAAc,CAAA;AACrC,MAAM,aAAa,GAAG,SAAS,CAAA;AAC/B,2EAA2E;AAC3E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC;IACpB,SAAS,EAAE,WAAW;IACtB,UAAU,EAAE,sBAAsB;IAClC,cAAc,EAAE,QAAQ;IACxB,cAAc,EAAE,SAAS;IACzB,SAAS,EAAE,cAAc;IACzB,SAAS,EAAE,YAAY;CACxB,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,YAAY,GAAG,GAAG,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,GAAG,KAAK,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,GAAG,UAAU,CAAA;AAE5G,yEAAyE;AACzE,MAAM,UAAU,eAAe,CAAC,GAAe,EAAE,IAAY,EAAE,MAA4B;IACzF,IAAI,GAAG,CAAC,OAAO;QAAE,OAAO,GAAG,IAAI,uDAAuD,CAAA;IACtF,IAAI,GAAG,CAAC,SAAS,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC;QAAE,OAAO,GAAG,IAAI,aAAa,MAAM,EAAE,CAAA;IACnF,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,IAAI,gBAAgB,GAAG,CAAC,KAAK,6BAA6B,CAAA;IAC9F,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC,CAAA;IAC3E,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK;SACtB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;SAC5F,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC1B,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,mBAAmB,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;AACnG,CAAC;AAED,MAAM,SAAS,GAAG;IAChB,iCAAiC;IACjC,sCAAsC;IACtC,8BAA8B;IAC9B,qDAAqD;IACrD,oBAAoB;IACpB,kFAAkF;IAClF,sCAAsC;IACtC,iCAAiC;IACjC,oEAAoE;IACpE,+IAA+I;IAC/I,uCAAuC;CACxC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAEZ,2EAA2E;AAC3E,MAAM,UAAU,eAAe,CAAC,MAAyB;IACvD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAC1G,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAA8C,CAAA;IAClF,MAAM,KAAK,GAAG,CACZ,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAC9D,CAAA;IACrB,IACE,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAC7B,OAAO,GAAG,CAAC,OAAO,KAAK,SAAS;QAChC,OAAO,GAAG,CAAC,SAAS,KAAK,SAAS,EAClC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;IACtD,CAAC;IACD,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC1B,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK,KAAK,IAAI;YAC1B,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;SAC5B,CAAC,CAAC;KACJ,CAAA;AACH,CAAC;AA2BD;;;;;;;;GAQG;AACH,MAAM,WAAW,GAAG,CAClB,OAAe,EACf,IAAc,EACd,SAAiB,EACjB,QAAgB,EAChB,KAA8B,EACF,EAAE,CAC9B,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;IACtB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IACzF,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,IAAI,GAAG,GAAG,KAAK,CAAA;IACf,IAAI,IAA+C,CAAA;IACnD,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;YAAE,OAAO,KAAK,KAAK,CAAC,IAAI,EAAE,CAAA;QACrD,KAAK,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CACnG,OAAO,EACP,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CACnB,CAAA;IACH,CAAC,CAAA;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IAC5C,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE;QACvB,MAAM,IAAI,GAAG,MAAM,KAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAA;QAC9C,IAAI,OAAO;YAAE,OAAM;QACnB,IAAI,IAAI,EAAE,CAAC;YACT,GAAG,GAAG,IAAI,CAAA;YACV,OAAO,EAAE,CAAA;QACX,CAAC;;YAAM,IAAI,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,KAAK,EAAE,EAAE,aAAa,CAAC,CAAA;IAC7D,CAAC,CAAA;IACD,IAAI,KAAK,KAAK,SAAS;QAAE,IAAI,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,KAAK,EAAE,EAAE,aAAa,CAAC,CAAA;IAC7E,MAAM,MAAM,GAAG,CAAC,MAAyB,EAAE,EAAE;QAC3C,OAAO,GAAG,IAAI,CAAA;QACd,YAAY,CAAC,KAAK,CAAC,CAAA;QACnB,YAAY,CAAC,IAAI,CAAC,CAAA;QAClB,OAAO,CAAC,MAAM,CAAC,CAAA;IACjB,CAAC,CAAA;IACD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;IACzF,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CACrG,CAAA;AACH,CAAC,CAAC,CAAA;AAEJ,+DAA+D;AAC/D,MAAM,aAAa,GAAG,KAAK,CAAA;AAE3B,MAAM,MAAM,GAAG,GAAsB,EAAE;IACrC,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,aAAa,CAAC,CAAC,OAAO,CAClG,SAAS,EACT,EAAE,CACH,CAAA;IACD,MAAM,QAAQ,GAAG,GAAG,UAAU,0BAA0B,CAAA;IACxD,OAAO;QACL,IAAI,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAC/B,OAAO,EAAE,OAAO,KAAK,IAAI;YACvB,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,SAAS,IAAI,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC;YAClF,CAAC,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC;QACxF,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;QAC5B,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAC1C,eAAe,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;YAC5C,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;gBAC5B,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;YACrB,CAAC;oBAAS,CAAC;gBACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;YACtB,CAAC;QACH,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACtC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;KAC5C,CAAA;AACH,CAAC,CAAA;AAED,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAA;AACpC,oFAAoF;AACpF,MAAM,kBAAkB,GAAG,EAAE,GAAG,MAAM,CAAA;AACtC,MAAM,kBAAkB,GAAG,CAAC,GAAG,MAAM,CAAA;AAErC,MAAM,MAAM,GAAG,CAAC,OAAe,EAAS,EAAE;IACxC,MAAM,IAAI,eAAe,CAAC,2BAA2B,EAAE,OAAO,CAAC,CAAA;AACjE,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAsB,EACtB,KAAwB,MAAM,EAAE;IAEhC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,IAAI,aAAa,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAA;IAChH,MAAM,UAAU,GAAG,GAAG,QAAQ,2CAA2C,CAAA;IAEzE,MAAM,KAAK,GAAG,KAAK,EAAE,IAAY,EAAE,IAAY,EAAE,MAA4B,EAAiB,EAAE;QAC9F,IAAI,GAAe,CAAA;QACnB,IAAI,CAAC;YACH,GAAG,GAAG,eAAe,CACnB,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE;gBAClF,GAAG,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE;aACrC,CAAC,CACH,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,MAAM,CAAC,+CAA+C,IAAI,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAA;QACnG,CAAC;QACD,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;QAClD,IAAI,OAAO,KAAK,IAAI;YAAE,MAAM,CAAC,OAAO,CAAC,CAAA;IACvC,CAAC,CAAA;IAED,OAAO;QACL,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAClC,MAAM,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,CAAA;YACxC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACjC,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBAAE,MAAM,CAAC,GAAG,IAAI,wBAAwB,CAAC,CAAA;YACpF,IAAI,IAAI,CAAC,IAAI,GAAG,kBAAkB;gBAAE,MAAM,CAAC,GAAG,IAAI,+BAA+B,CAAC,CAAA;YAClF,MAAM,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;YAC/B,OAAO,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC1B,CAAC;QACD,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YAChC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAClC,MAAM,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,CAAA;YACxC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YACjG,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;gBACpC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YAC7B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,2DAA2D;gBAC3D,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;gBACrB,MAAM,KAAK,CAAA;YACb,CAAC;QACH,CAAC;QACD,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,2CAA2C,CAAC;QACzE,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,4CAA4C,CAAC;QAC3E,IAAI,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE;YAC1C,IAAI,OAAO,KAAK,SAAS;gBACvB,OAAO,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,6CAA6C,CAAC,CAAA;YAChF,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,QAAQ,WAAW,EAAE,IAAI,EAAE;gBAC3C,SAAS,EAAE,OAAO,EAAE,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB;gBAClF,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9F,CAAC,CAAA;QACJ,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,wCAAwC,CAAC;QACnE,aAAa,EAAE,KAAK,IAAI,EAAE,CACxB,kBAAkB,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,QAAQ,WAAW,EAAE,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC;QAC1F,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QACrB,WAAW,EAAE,IAAI;KAClB,CAAA;AACH,CAAC"}

package/dist/host/recipes/executor-io.d.ts

@@ -0,0 +1,80 @@
+/**
+ * The real I/O behind `executeHostStep`, for a process that is already root.
+ *
+ * The request and result live in a folder the unprivileged user owns, so everything touching them
+ * assumes someone may have planted a link there, or be racing us:
+ *
+ * - The folder itself must be a real directory (not a symlink), writable by nobody but its owner,
+ *   and owned by the user who asked for elevation (`PKEXEC_UID`/`SUDO_UID`) — not by root, so
+ *   `host-step exec /etc/<dir>/<x>.request.json` can never make root write a result into a system
+ *   folder. Only when nobody is named (root ran it directly) is a root-owned folder the trusted one.
+ *   Clients create it `0700` and the request `0600` (see `request-file.ts`).
+ * - System files (keys, repository files) are written only into root-owned folders that nobody else
+ *   can write.
+ * - The request is opened with `O_NOFOLLOW | O_NONBLOCK` — a link is refused, a FIFO cannot hang
+ *   root — and, on the open handle, must be a small regular file owned by root or the invoking user
+ *   and not group- or world-writable.
+ * - Every file root writes (the result, keys, repository files) goes to a fresh temporary name
+ *   opened `O_CREAT | O_EXCL | O_NOFOLLOW`, gets its mode through the handle (`fchmod`, never a
+ *   path-based `chmod` that a swapped link would redirect), and is renamed into place, which
+ *   replaces a planted link instead of writing through it.
+ *
+ * The folder is opened once (`O_DIRECTORY | O_NOFOLLOW`) and checked through that handle, and every
+ * file in it is then addressed as `/proc/self/fd/<fd>/<name>`, which the kernel resolves to the
+ * directory that was checked — node has no `openat`, and this is the same guarantee. A swap of the
+ * folder's path after the check changes nothing. Only where `/proc` is not mounted (never on the
+ * distributions the recipe supports) does the executor fall back to the checked path; there a
+ * swap between check and write could make root create or replace a `<step_id>.result.json` (0644,
+ * our JSON) in whatever folder the swapped-in link points at. The trusted folder owner — the
+ * invoking user, or root — is the only one who could make that swap. Seteuid-ing to the user was
+ * ruled out (controller ruling, fix round 1).
+ *
+ * Commands run through `hostExec` — `spawn` without a shell — with the recipe's fixed environment.
+ */
+import type { HostStepExecutorDeps } from './executor.js';
+/** The slice of an open file the executor uses; node's `FileHandle` is one. */
+export interface HostFileHandle {
+    stat(): Promise<{
+        isFile(): boolean;
+        uid: number;
+        mode: number;
+        size: number;
+    }>;
+    readFile(encoding: 'utf8'): Promise<string>;
+    writeFile(data: Uint8Array | string): Promise<void>;
+    /** `fchmod`: applies to this open file, whatever its path now points at. */
+    chmod(mode: number): Promise<void>;
+    sync(): Promise<void>;
+    close(): Promise<void>;
+}
+/** An open directory: checked through its handle, and addressed through its descriptor. */
+export interface HostDirHandle {
+    fd: number;
+    stat(): Promise<{
+        isDirectory(): boolean;
+        uid: number;
+        mode: number;
+    }>;
+    close(): Promise<void>;
+}
+/** The file-system calls the executor makes, injectable so tests can fake owners they cannot create. */
+export interface HostFs {
+    open(path: string, flags: number, mode?: number): Promise<HostFileHandle>;
+    /** `open(path, O_RDONLY | O_DIRECTORY | O_NOFOLLOW)`: a link or a non-directory is refused. */
+    openDirectory(path: string): Promise<HostDirHandle>;
+    /** Whether something is at `path` (used for `/proc/self/fd/<fd>`). */
+    exists(path: string): Promise<boolean>;
+    rename(from: string, to: string): Promise<void>;
+    /** Removes one file if it is there; used only on our own temporary files. */
+    remove(path: string): Promise<void>;
+    mkdir(path: string, mode: number): Promise<void>;
+    readFile(path: string): Promise<Uint8Array>;
+}
+export declare const nodeHostFs: HostFs;
+/** `PKEXEC_UID` (set by pkexec itself) or `SUDO_UID`, when it is a number; otherwise null. */
+export declare function invokingUidFrom(env: NodeJS.ProcessEnv): string | null;
+/**
+ * The executor's dependencies on this machine. `env` is only read for who asked for elevation,
+ * which also decides whose folder and request file are trusted (root's alone when nobody is named).
+ */
+export declare function nodeHostStepDeps(env: NodeJS.ProcessEnv, fs?: HostFs): HostStepExecutorDeps;

package/dist/host/recipes/executor-io.js

@@ -0,0 +1,211 @@
+/**
+ * The real I/O behind `executeHostStep`, for a process that is already root.
+ *
+ * The request and result live in a folder the unprivileged user owns, so everything touching them
+ * assumes someone may have planted a link there, or be racing us:
+ *
+ * - The folder itself must be a real directory (not a symlink), writable by nobody but its owner,
+ *   and owned by the user who asked for elevation (`PKEXEC_UID`/`SUDO_UID`) — not by root, so
+ *   `host-step exec /etc/<dir>/<x>.request.json` can never make root write a result into a system
+ *   folder. Only when nobody is named (root ran it directly) is a root-owned folder the trusted one.
+ *   Clients create it `0700` and the request `0600` (see `request-file.ts`).
+ * - System files (keys, repository files) are written only into root-owned folders that nobody else
+ *   can write.
+ * - The request is opened with `O_NOFOLLOW | O_NONBLOCK` — a link is refused, a FIFO cannot hang
+ *   root — and, on the open handle, must be a small regular file owned by root or the invoking user
+ *   and not group- or world-writable.
+ * - Every file root writes (the result, keys, repository files) goes to a fresh temporary name
+ *   opened `O_CREAT | O_EXCL | O_NOFOLLOW`, gets its mode through the handle (`fchmod`, never a
+ *   path-based `chmod` that a swapped link would redirect), and is renamed into place, which
+ *   replaces a planted link instead of writing through it.
+ *
+ * The folder is opened once (`O_DIRECTORY | O_NOFOLLOW`) and checked through that handle, and every
+ * file in it is then addressed as `/proc/self/fd/<fd>/<name>`, which the kernel resolves to the
+ * directory that was checked — node has no `openat`, and this is the same guarantee. A swap of the
+ * folder's path after the check changes nothing. Only where `/proc` is not mounted (never on the
+ * distributions the recipe supports) does the executor fall back to the checked path; there a
+ * swap between check and write could make root create or replace a `<step_id>.result.json` (0644,
+ * our JSON) in whatever folder the swapped-in link points at. The trusted folder owner — the
+ * invoking user, or root — is the only one who could make that swap. Seteuid-ing to the user was
+ * ruled out (controller ruling, fix round 1).
+ *
+ * Commands run through `hostExec` — `spawn` without a shell — with the recipe's fixed environment.
+ */
+import { constants } from 'node:fs';
+import { randomBytes } from 'node:crypto';
+import { lstat, mkdir, open, readFile, rename, rm } from 'node:fs/promises';
+import { basename, dirname, join } from 'node:path';
+import { AtomicCoreError } from '../../contracts/index.js';
+import { hostExec } from '../../runtime/environment/index.js';
+import { INSTALL_CONTAINER_RUNTIME_RECIPE } from './install-container-runtime.js';
+export const nodeHostFs = {
+    open: (path, flags, mode) => open(path, flags, mode),
+    openDirectory: (path) => open(path, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW),
+    exists: (path) => lstat(path).then(() => true, () => false),
+    rename: (from, to) => rename(from, to),
+    remove: (path) => rm(path, { force: true }),
+    mkdir: async (path, mode) => {
+        await mkdir(path, { recursive: true, mode });
+    },
+    readFile: async (path) => new Uint8Array(await readFile(path)),
+};
+// `O_NOFOLLOW`/`O_NONBLOCK` exist on every POSIX platform node supports; this module only ever runs
+// on Linux (the recipe is Linux-only), so there is no fallback that would silently drop them.
+const REQUEST_SIZE_LIMIT = 64 * 1024;
+/** Checks, `nvidia-ctk`, `systemctl`, `usermod`: minutes at most. */
+const COMMAND_TIMEOUT_MS = 10 * 60_000;
+/**
+ * A package install over a slow mirror can take long, and killing dpkg mid-run can leave packages
+ * half-configured: two hours, then SIGTERM and five more minutes to stop before SIGKILL.
+ */
+const INSTALL_TIMEOUT_MS = 2 * 60 * 60_000;
+const INSTALL_TERMINATE_GRACE_MS = 5 * 60_000;
+/** A read that only explains a failure (the Docker journal): quick, and small. */
+const DIAGNOSTIC_TIMEOUT_MS = 30_000;
+const DIAGNOSTIC_MAX_OUTPUT_BYTES = 64 * 1024;
+const refuse = (message) => {
+    throw new AtomicCoreError('MANAGED_HOST_STEP_INVALID', message);
+};
+const GROUP_OR_WORLD_WRITABLE = 0o022;
+/** Who may own the request/result folder: the invoking user when known, otherwise root only. */
+function folderOwners(invokingUid) {
+    return new Set([invokingUid === null ? 0 : Number(invokingUid)]);
+}
+/** Who may own the request file inside that folder: root or the invoking user. */
+function requestOwners(invokingUid) {
+    return new Set(invokingUid === null ? [0] : [0, Number(invokingUid)]);
+}
+/** System folders (`/etc/apt/keyrings`, `/etc/yum.repos.d`, ...): root's alone. */
+const SYSTEM_OWNERS = new Set([0]);
+function checkOwnership(what, info, owners) {
+    if (!owners.has(info.uid))
+        refuse(`${what} is owned by uid ${info.uid}; only uid ${[...owners].join(' or ')} is trusted here`);
+    if ((info.mode & GROUP_OR_WORLD_WRITABLE) !== 0)
+        refuse(`${what} is group- or world-writable (mode ${(info.mode & 0o777).toString(8)})`);
+}
+/**
+ * Opens the folder `path` lives in (`O_DIRECTORY | O_NOFOLLOW`), checks it through the handle —
+ * a real directory, trusted owner, writable by nobody else — and hands `act` a base to address
+ * files in it by. On Linux that base is `/proc/self/fd/<fd>`, which the kernel resolves to the very
+ * directory that was checked, whatever happens to its path afterwards. Only where `/proc` is not
+ * mounted does it fall back to the checked path, and the race described in the header returns.
+ */
+async function withFolder(fs, path, owners, act) {
+    const folder = dirname(path);
+    let handle;
+    try {
+        handle = await fs.openDirectory(folder);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === 'ELOOP' || code === 'ENOTDIR' || code === 'EMLINK')
+            refuse(`${folder} is not a directory (a symlink is refused)`);
+        throw error;
+    }
+    try {
+        const info = await handle.stat();
+        if (!info.isDirectory())
+            refuse(`${folder} is not a directory (a symlink is refused)`);
+        checkOwnership(folder, info, owners);
+        const pinned = `/proc/self/fd/${handle.fd}`;
+        return await act((await fs.exists(pinned)) ? pinned : folder);
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function readRequest(fs, folder, owners, path) {
+    return withFolder(fs, path, folder, async (base) => {
+        const flags = constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK;
+        const handle = await fs.open(join(base, basename(path)), flags);
+        try {
+            const info = await handle.stat();
+            if (!info.isFile())
+                refuse(`${path} is not a regular file`);
+            checkOwnership(path, info, owners);
+            if (info.size > REQUEST_SIZE_LIMIT)
+                refuse(`${path} is too large to be a request`);
+            return await handle.readFile('utf8');
+        }
+        finally {
+            await handle.close();
+        }
+    });
+}
+async function writeAtomically(fs, owners, path, data, mode) {
+    await withFolder(fs, path, owners, async (base) => {
+        const name = basename(path);
+        const tmp = join(base, `.${name}.${randomBytes(6).toString('hex')}.tmp`);
+        const flags = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW;
+        const handle = await fs.open(tmp, flags, mode);
+        try {
+            try {
+                await handle.writeFile(data);
+                await handle.chmod(mode);
+                await handle.sync();
+            }
+            finally {
+                await handle.close();
+            }
+            await fs.rename(tmp, join(base, name));
+        }
+        catch (error) {
+            // Only our own temporary file: it was created exclusively, so nobody else's can be at that name.
+            await fs.remove(tmp);
+            throw error;
+        }
+    });
+}
+async function readFileOrNull(fs, path) {
+    try {
+        return await fs.readFile(path);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+}
+/** `PKEXEC_UID` (set by pkexec itself) or `SUDO_UID`, when it is a number; otherwise null. */
+export function invokingUidFrom(env) {
+    for (const name of ['PKEXEC_UID', 'SUDO_UID']) {
+        const value = env[name];
+        if (value !== undefined)
+            return /^\d+$/.test(value) ? value : null;
+    }
+    return null;
+}
+/**
+ * The executor's dependencies on this machine. `env` is only read for who asked for elevation,
+ * which also decides whose folder and request file are trusted (root's alone when nobody is named).
+ */
+export function nodeHostStepDeps(env, fs = nodeHostFs) {
+    const environment = { ...INSTALL_CONTAINER_RUNTIME_RECIPE.environment };
+    const quick = hostExec({ timeoutMs: COMMAND_TIMEOUT_MS, env: environment });
+    const long = hostExec({
+        timeoutMs: INSTALL_TIMEOUT_MS,
+        terminateGraceMs: INSTALL_TERMINATE_GRACE_MS,
+        env: environment,
+    });
+    const diagnostic = hostExec({
+        timeoutMs: DIAGNOSTIC_TIMEOUT_MS,
+        maxOutputBytes: DIAGNOSTIC_MAX_OUTPUT_BYTES,
+        env: environment,
+    });
+    const invokingUid = invokingUidFrom(env);
+    const folder = folderOwners(invokingUid);
+    return {
+        readRequest: (path) => readRequest(fs, folder, requestOwners(invokingUid), path),
+        writeResult: (path, text) => writeAtomically(fs, folder, path, text, 0o644),
+        readFile: (path) => readFileOrNull(fs, path),
+        writeFile: async (path, data, mode) => {
+            await fs.mkdir(dirname(path), 0o755);
+            await writeAtomically(fs, SYSTEM_OWNERS, path, data, mode);
+        },
+        exec: ([command, ...args], options) => (options?.longRunning ? long : options?.diagnostic ? diagnostic : quick)(command, args),
+        fetch: (input, init) => fetch(input, init),
+        now: () => Date.now(),
+        invokingUid,
+    };
+}
+//# sourceMappingURL=executor-io.js.map

package/dist/host/recipes/executor-io.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor-io.js","sourceRoot":"","sources":["../../../src/host/recipes/executor-io.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAA;AAC3E,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,oCAAoC,CAAA;AAE7D,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAA;AAkCjF,MAAM,CAAC,MAAM,UAAU,GAAW;IAChC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC;IACpD,aAAa,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,WAAW,GAAG,SAAS,CAAC,UAAU,CAAC;IACtG,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CACf,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CACd,GAAG,EAAE,CAAC,IAAI,EACV,GAAG,EAAE,CAAC,KAAK,CACZ;IACH,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;IACtC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC3C,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QAC1B,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9C,CAAC;IACD,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;CAC/D,CAAA;AAED,oGAAoG;AACpG,8FAA8F;AAC9F,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAA;AACpC,qEAAqE;AACrE,MAAM,kBAAkB,GAAG,EAAE,GAAG,MAAM,CAAA;AACtC;;;GAGG;AACH,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,MAAM,CAAA;AAC1C,MAAM,0BAA0B,GAAG,CAAC,GAAG,MAAM,CAAA;AAC7C,kFAAkF;AAClF,MAAM,qBAAqB,GAAG,MAAM,CAAA;AACpC,MAAM,2BAA2B,GAAG,EAAE,GAAG,IAAI,CAAA;AAE7C,MAAM,MAAM,GAAG,CAAC,OAAe,EAAS,EAAE;IACxC,MAAM,IAAI,eAAe,CAAC,2BAA2B,EAAE,OAAO,CAAC,CAAA;AACjE,CAAC,CAAA;AAED,MAAM,uBAAuB,GAAG,KAAK,CAAA;AAErC,gGAAgG;AAChG,SAAS,YAAY,CAAC,WAA0B;IAC9C,OAAO,IAAI,GAAG,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA;AAClE,CAAC;AAED,kFAAkF;AAClF,SAAS,aAAa,CAAC,WAA0B;IAC/C,OAAO,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA;AACvE,CAAC;AAED,mFAAmF;AACnF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAElC,SAAS,cAAc,CAAC,IAAY,EAAE,IAAmC,EAAE,MAAmB;IAC5F,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC;QACvB,MAAM,CAAC,GAAG,IAAI,oBAAoB,IAAI,CAAC,GAAG,cAAc,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;IACrG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC,KAAK,CAAC;QAC7C,MAAM,CAAC,GAAG,IAAI,sCAAsC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;AAC3F,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,UAAU,CACvB,EAAU,EACV,IAAY,EACZ,MAAmB,EACnB,GAAiC;IAEjC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5B,IAAI,MAAqB,CAAA;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAA;QAClD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ;YAC7D,MAAM,CAAC,GAAG,MAAM,4CAA4C,CAAC,CAAA;QAC/D,MAAM,KAAK,CAAA;IACb,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;QAChC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,CAAC,GAAG,MAAM,4CAA4C,CAAC,CAAA;QACtF,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;QACpC,MAAM,MAAM,GAAG,iBAAiB,MAAM,CAAC,EAAE,EAAE,CAAA;QAC3C,OAAO,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IAC/D,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;IACtB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,EAAU,EACV,MAAmB,EACnB,MAAmB,EACnB,IAAY;IAEZ,OAAO,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACjD,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAA;QAC9E,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC/D,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;YAChC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBAAE,MAAM,CAAC,GAAG,IAAI,wBAAwB,CAAC,CAAA;YAC3D,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;YAClC,IAAI,IAAI,CAAC,IAAI,GAAG,kBAAkB;gBAAE,MAAM,CAAC,GAAG,IAAI,+BAA+B,CAAC,CAAA;YAClF,OAAO,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QACtC,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;QACtB,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,EAAU,EACV,MAAmB,EACnB,IAAY,EACZ,IAAyB,EACzB,IAAY;IAEZ,MAAM,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACxE,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,UAAU,CAAA;QAC9F,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;QAC9C,IAAI,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;gBAC5B,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBACxB,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;YACrB,CAAC;oBAAS,CAAC;gBACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;YACtB,CAAC;YACD,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,iGAAiG;YACjG,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACpB,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,EAAU,EAAE,IAAY;IACpD,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QACnE,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,eAAe,CAAC,GAAsB;IACpD,KAAK,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAA;QACvB,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IACpE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAsB,EAAE,KAAa,UAAU;IAC9E,MAAM,WAAW,GAAG,EAAE,GAAG,gCAAgC,CAAC,WAAW,EAAE,CAAA;IACvE,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAA;IAC3E,MAAM,IAAI,GAAG,QAAQ,CAAC;QACpB,SAAS,EAAE,kBAAkB;QAC7B,gBAAgB,EAAE,0BAA0B;QAC5C,GAAG,EAAE,WAAW;KACjB,CAAC,CAAA;IACF,MAAM,UAAU,GAAG,QAAQ,CAAC;QAC1B,SAAS,EAAE,qBAAqB;QAChC,cAAc,EAAE,2BAA2B;QAC3C,GAAG,EAAE,WAAW;KACjB,CAAC,CAAA;IACF,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;IACxC,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,CAAC,CAAA;IACxC,OAAO;QACL,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,aAAa,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC;QAChF,WAAW,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC;QAC3E,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC;QAC5C,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YACpC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAA;YACpC,MAAM,eAAe,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QAC5D,CAAC;QACD,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,CACpC,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAiB,EAAE,IAAI,CAAC;QACnG,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC;QAC1C,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QACrB,WAAW;KACZ,CAAA;AACH,CAAC"}

package/dist/host/recipes/executor.d.ts

@@ -0,0 +1,81 @@
+/**
+ * The privileged half of a host step (design D3): read one request file, refuse it unless it names
+ * this build's recipe with matching digests and valid parameters, bring the machine to what the
+ * recipe describes, and write the result file beside the request. `atomic-chat-core host-step exec`
+ * and `atc host-step exec` both call `executeHostStep`, so the app and the CLI run the same code
+ * as root.
+ *
+ * Every step checks the machine before it acts and does nothing when its part is already in place.
+ * That makes the whole request idempotent: a replay — a retried receipt, a person re-running the
+ * manual command — reports `completed` without changing anything. The first failing step stops the
+ * run; the ones after it are reported `not-run`, never attempted.
+ *
+ * All I/O is injected (`HostStepExecutorDeps`); `executor-io.ts` has the real implementations.
+ * This file never touches the file system, the network or a process itself.
+ */
+import type { HostStepResult } from './request-file.js';
+export interface HostCommandOutput {
+    /** Null when the command could not run or answer at all. */
+    code: number | null;
+    stdout: string;
+    stderr: string;
+    /** The command was ended, its process tree with it, because `until` said its work was done. */
+    cutShort?: boolean;
+}
+export interface HostStepExecutorDeps {
+    /** The request's text. Throws when it is not a readable regular file of sane size. */
+    readRequest: (path: string) => Promise<string>;
+    /** Writes the result without following a link planted at its path. */
+    writeResult: (path: string, text: string) => Promise<void>;
+    /** A file's bytes, or null when there is no file there. */
+    readFile: (path: string) => Promise<Uint8Array | null>;
+    /** Atomically creates or replaces a file with exactly this mode, creating parent directories. */
+    writeFile: (path: string, data: Uint8Array, mode: number) => Promise<void>;
+    /**
+     * Runs one argv, no shell, with the recipe's fixed environment. `longRunning` marks a package
+     * install: a much longer deadline, and SIGTERM before SIGKILL, so dpkg is not killed mid-run.
+     * `diagnostic` marks a read made only to explain a failure: a short deadline and a small output
+     * cap, so explaining never holds the result back.
+     */
+    exec: (argv: string[], options?: {
+        longRunning?: boolean;
+        diagnostic?: boolean;
+        /**
+         * Windows only: run with this process's own (hidden) console instead of pipes; nothing is
+         * captured, only the exit code. The inbox `wsl.exe` stub starts installing only with a console —
+         * with piped output it answers "not installed" at once (live acceptance, build 26200).
+         */
+        console?: boolean;
+        /**
+         * With `console` only: asked every few seconds while the command runs; once it answers true the
+         * command's process tree is ended and the output says `cutShort` with code 0.
+         */
+        until?: () => Promise<boolean>;
+    }) => Promise<HostCommandOutput>;
+    fetch: typeof fetch;
+    /**
+     * Windows only: whether Windows waits for a restart to apply a component change (CBS
+     * `RebootPending`), or null when unread. Absent elsewhere.
+     */
+    rebootPending?: () => Promise<boolean | null>;
+    now: () => number;
+    /**
+     * The uid of the person who asked for elevation (`PKEXEC_UID`, `SUDO_UID`), or null when this
+     * process was started as root directly. When known, only that account is added to `docker`.
+     */
+    invokingUid: string | null;
+}
+/**
+ * Runs one host-step request and writes `<step>.result.json` beside it. This is the entry point
+ * `atomic-chat-core host-step exec` and `atc host-step exec` call as root.
+ *
+ * Client requirement: the folder holding the request must be owned by the invoking user (named by
+ * `PKEXEC_UID`/`SUDO_UID`) with mode `0700`, and the request file must be `0600` — see
+ * `request-file.ts`. With `nodeHostStepDeps`, anything else is refused.
+ *
+ * Throws only when no result file can be written: `MANAGED_HOST_STEP_INVALID` when the path is not
+ * a `*.request.json` or the folder is not trusted, or the file system's own error when the write
+ * itself fails (ENOSPC, EROFS, ...). Every other problem — an unreadable request, a refused
+ * request, a failed step, an unexpected error — is a `failed` result file.
+ */
+export declare function executeHostStep(requestPath: string, deps: HostStepExecutorDeps): Promise<HostStepResult>;