@cjhyy/code-shell-server 0.9.21 → 0.9.23

package/dist/project-runtime/seccomp.d.ts

@@ -0,0 +1,8 @@
+export interface ProjectSeccompProfile {
+    readonly json: string;
+    readonly sha256: string;
+}
+/** Administrator configuration only. Snapshot bytes once; never read project files or HTTP input. */
+export declare function readProjectSeccompProfile(path: string): ProjectSeccompProfile;
+/** Docker CLI reads its own private copy; editing the source cannot race container creation. */
+export declare function materializeProjectSeccompProfile(dataDir: string, profile: ProjectSeccompProfile): Promise<string>;

package/dist/project-runtime/seccomp.js

@@ -0,0 +1,72 @@
+import { createHash, randomUUID } from "node:crypto";
+import { closeSync, constants, fstatSync, lstatSync, openSync, readSync } from "node:fs";
+import { chmod, lstat, mkdir, open, rename, rm } from "node:fs/promises";
+import { join, resolve } from "node:path";
+/** Administrator configuration only. Snapshot bytes once; never read project files or HTTP input. */
+export function readProjectSeccompProfile(path) {
+    let fd;
+    try {
+        if (!path || /[\0\r\n]/.test(path))
+            throw new Error();
+        if (!lstatSync(resolve(path)).isFile())
+            throw new Error();
+        fd = openSync(resolve(path), constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+        const stat = fstatSync(fd);
+        const limit = 1024 * 1024;
+        if (!stat.isFile() || stat.size < 2 || stat.size > limit)
+            throw new Error();
+        const buffer = Buffer.alloc(limit + 1);
+        let bytes = 0;
+        while (bytes < buffer.length) {
+            const count = readSync(fd, buffer, bytes, buffer.length - bytes, null);
+            if (!count)
+                break;
+            bytes += count;
+        }
+        if (bytes > limit)
+            throw new Error();
+        const value = JSON.parse(buffer.subarray(0, bytes).toString("utf8"));
+        // Docker validates individual rules. Reject disabling the default filter here.
+        if (!value ||
+            Array.isArray(value) ||
+            value.defaultAction !== "SCMP_ACT_ERRNO" ||
+            !Array.isArray(value.syscalls))
+            throw new Error();
+        const json = JSON.stringify(value);
+        return Object.freeze({ json, sha256: createHash("sha256").update(json).digest("hex") });
+    }
+    catch {
+        // A mistaken path may name a private configuration file: never echo its contents.
+        throw new Error("Project seccomp profile must be a regular JSON file (max 1 MiB) with a deny-by-default policy.");
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}
+/** Docker CLI reads its own private copy; editing the source cannot race container creation. */
+export async function materializeProjectSeccompProfile(dataDir, profile) {
+    const directory = join(dataDir, "project-runtime-security");
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    const info = await lstat(directory);
+    if (!info.isDirectory() || info.isSymbolicLink())
+        throw new Error("Unsafe project runtime security directory.");
+    await chmod(directory, 0o700);
+    const destination = join(directory, `${profile.sha256}.json`);
+    const temporary = join(directory, `${randomUUID()}.tmp`);
+    try {
+        const handle = await open(temporary, "wx", 0o600);
+        try {
+            await handle.writeFile(profile.json, "utf8");
+            await handle.chmod(0o400);
+        }
+        finally {
+            await handle.close();
+        }
+        await rename(temporary, destination);
+        return destination;
+    }
+    finally {
+        await rm(temporary, { force: true });
+    }
+}

package/dist/project-runtime/types.d.ts

@@ -1,3 +1,4 @@
+import type { RemoteLinkConfiguration } from "@cjhyy/code-shell-core";
 /** Stored only by the trusted control plane; credentials must never reach browser DTOs. */
 export interface ProjectRuntimeRecord {
     id: string;
@@ -40,4 +41,5 @@ export interface ManagedProjectSecret {
     password: string;
     publicOrigin: string;
     publicPathPrefix: string;
+    remoteLink?: RemoteLinkConfiguration;
 }

package/dist/remote-relay/byte-stream.d.ts

@@ -0,0 +1,9 @@
+import { Duplex } from "node:stream";
+import { type WebSocket } from "ws";
+/**
+ * One raw TCP connection over one authenticated, OPEN data WebSocket. Callers
+ * must create ws with maxPayload=RELAY_DATA_MAX_BYTES and compression disabled.
+ * Native ws/Node streams supply backpressure; there is no multiplex/credit queue.
+ * EOF closes the entire connection (HTTP framing does not use stream EOF).
+ */
+export declare function createRelayByteStream(ws: WebSocket): Duplex;

package/dist/remote-relay/byte-stream.js

@@ -0,0 +1,71 @@
+import { Duplex } from "node:stream";
+import { createWebSocketStream } from "ws";
+import { RELAY_DATA_CHUNK_BYTES, RELAY_DATA_MAX_BYTES } from "./protocol.js";
+/**
+ * One raw TCP connection over one authenticated, OPEN data WebSocket. Callers
+ * must create ws with maxPayload=RELAY_DATA_MAX_BYTES and compression disabled.
+ * Native ws/Node streams supply backpressure; there is no multiplex/credit queue.
+ * EOF closes the entire connection (HTTP framing does not use stream EOF).
+ */
+export function createRelayByteStream(ws) {
+    if (ws.readyState !== ws.OPEN)
+        throw new Error("Relay data WebSocket is not open");
+    // Register before createWebSocketStream so invalid frames never reach consumers.
+    ws.on("message", (data, binary) => {
+        const size = Array.isArray(data)
+            ? data.reduce((total, item) => total + item.length, 0)
+            : data.byteLength;
+        if (!binary || size > RELAY_DATA_MAX_BYTES) {
+            stream.destroy(new Error("Invalid relay data frame"));
+        }
+    });
+    const wire = createWebSocketStream(ws, {
+        highWaterMark: RELAY_DATA_MAX_BYTES,
+        // The outer Duplex owns EOF: inner auto-finalization can race unread
+        // outer buffers or wait forever for finish after an abrupt WS close.
+        allowHalfOpen: true,
+    });
+    const stream = new Duplex({
+        highWaterMark: RELAY_DATA_MAX_BYTES,
+        allowHalfOpen: false,
+        read() {
+            wire.resume();
+        },
+        write(chunk, _encoding, callback) {
+            let offset = 0;
+            const next = (error) => {
+                if (error)
+                    return callback(error);
+                if (offset === chunk.length)
+                    return callback();
+                const end = Math.min(offset + RELAY_DATA_CHUNK_BYTES, chunk.length);
+                const part = chunk.subarray(offset, end);
+                offset = end;
+                wire.write(part, next);
+            };
+            next();
+        },
+        final(callback) {
+            if (ws.readyState === ws.CLOSED)
+                callback();
+            else
+                wire.end(callback);
+        },
+        destroy(error, callback) {
+            wire.destroy();
+            callback(error);
+        },
+    });
+    wire.on("data", (chunk) => {
+        if (!stream.destroyed && !stream.push(chunk))
+            wire.pause();
+    });
+    wire.on("end", () => stream.push(null));
+    wire.on("error", (error) => stream.destroy(error));
+    wire.on("close", () => {
+        // A normal EOF may still be buffered by a slow outer reader. Preserve it.
+        if (!wire.readableEnded)
+            stream.destroy();
+    });
+    return stream;
+}

package/dist/remote-relay/connector.d.ts

@@ -0,0 +1,27 @@
+import type { ConnectionOptions } from "node:tls";
+export type DeviceRelayState = "connecting" | "ready" | "disconnected" | "unauthorized" | "closed";
+/** Issued by RemoteHostManager.relayTarget(), bound to one running relay Host. */
+export interface RelayLocalTarget {
+    readonly port: number;
+    readonly signal: AbortSignal;
+    setPublicBaseUrl(origin: string): void;
+}
+export interface DeviceRelayConnectorOptions {
+    /** Directory HTTPS origin, never a relay-selected destination. */
+    relayOrigin: string;
+    hostId: string;
+    publicOrigin: string;
+    credential: string;
+    /** Target is always 127.0.0.1; stopping its Host revokes this capability. */
+    localHost: RelayLocalTarget;
+    /** Additional trusted CA for private installations; TLS verification stays enabled. */
+    ca?: ConnectionOptions["ca"];
+    onState?: (state: DeviceRelayState) => void;
+}
+export interface DeviceRelayConnector {
+    /** Idempotent while running. Callers must await close before restarting. */
+    start(): void;
+    /** Fences callbacks immediately, then waits for control/TCP/data connections to close. */
+    close(): Promise<void>;
+}
+export declare function createDeviceRelayConnector(options: DeviceRelayConnectorOptions): DeviceRelayConnector;

package/dist/remote-relay/connector.js

@@ -0,0 +1,197 @@
+import { WebSocket } from "ws";
+import { openRelayStream } from "./local-stream.js";
+import { isRelayHostId, isRelayOrigin, isRelayToken, parseRelayControlMessage, RELAY_CONNECT_PATH, RELAY_CONTROL_MAX_BYTES, RELAY_MAX_STREAMS, RELAY_PING_INTERVAL_MS, RELAY_PONG_TIMEOUT_MS, RELAY_SETUP_TIMEOUT_MS, } from "./protocol.js";
+export function createDeviceRelayConnector(options) {
+    if (!isRelayOrigin(options.relayOrigin) ||
+        !isRelayOrigin(options.publicOrigin) ||
+        !isRelayHostId(options.hostId) ||
+        !isRelayToken(options.credential) ||
+        !options.localHost ||
+        !Number.isInteger(options.localHost.port) ||
+        options.localHost.port < 1 ||
+        options.localHost.port > 65535) {
+        throw new Error("Invalid device relay configuration");
+    }
+    // Do not let a caller's later object mutation change authenticated endpoints.
+    const config = {
+        ...options,
+        localHost: {
+            port: options.localHost.port,
+            signal: options.localHost.signal,
+            setPublicBaseUrl: options.localHost.setPublicBaseUrl.bind(options.localHost),
+        },
+    };
+    let generation = 0;
+    let running = false;
+    let closing;
+    let control;
+    let reconnect;
+    let failures = 0;
+    const pending = new Set();
+    const streams = new Set();
+    const state = (value) => {
+        try {
+            config.onState?.(value);
+        }
+        catch {
+            /* Observers cannot retain live transports. */
+        }
+    };
+    const track = (done) => {
+        pending.add(done);
+        void done.finally(() => pending.delete(done));
+    };
+    const connect = (attempt) => {
+        if (!running || generation !== attempt || config.localHost.signal.aborted)
+            return;
+        state("connecting");
+        if (!running || generation !== attempt || config.localHost.signal.aborted)
+            return;
+        const url = new URL(RELAY_CONNECT_PATH, config.relayOrigin);
+        url.protocol = "wss:";
+        const ws = new WebSocket(url, {
+            headers: { Authorization: `Bearer ${config.credential}` },
+            ca: config.ca,
+            followRedirects: false,
+            perMessageDeflate: false,
+            maxPayload: RELAY_CONTROL_MAX_BYTES,
+            handshakeTimeout: RELAY_SETUP_TIMEOUT_MS,
+        });
+        control = ws;
+        const current = () => running && generation === attempt && control === ws && !config.localHost.signal.aborted;
+        let leaseId;
+        let lastPong = Date.now();
+        const owned = new Map();
+        const deadline = setTimeout(() => ws.terminate(), RELAY_SETUP_TIMEOUT_MS);
+        const heartbeat = setInterval(() => {
+            if (!current() || Date.now() - lastPong >= RELAY_PONG_TIMEOUT_MS)
+                return ws.terminate();
+            if (ws.readyState === ws.OPEN)
+                ws.ping();
+        }, RELAY_PING_INTERVAL_MS);
+        track(new Promise((resolve) => ws.once("close", () => {
+            clearTimeout(deadline);
+            clearInterval(heartbeat);
+            for (const stream of owned.values())
+                stream.close();
+            if (current()) {
+                control = undefined;
+                state("disconnected");
+                if (!running || generation !== attempt || control || config.localHost.signal.aborted)
+                    return resolve();
+                const delay = Math.min(30_000, 500 * 2 ** Math.min(failures++, 6));
+                reconnect = setTimeout(() => connect(attempt), delay * (0.75 + Math.random() * 0.5));
+            }
+            resolve();
+        })));
+        ws.on("error", () => {
+            /* close owns cleanup/retry; never log credentials or request data. */
+        });
+        ws.on("unexpected-response", (_request, response) => {
+            if (current() && (response.statusCode === 401 || response.statusCode === 403)) {
+                // A verified TLS endpoint rejected this credential. Retrying cannot
+                // restore authority; network failures and 5xx still use normal retry.
+                running = false;
+                state("unauthorized");
+            }
+            response.destroy();
+            ws.terminate();
+        });
+        ws.on("pong", () => {
+            if (current())
+                lastPong = Date.now();
+        });
+        ws.on("message", (data, binary) => {
+            if (!current())
+                return ws.terminate();
+            let message;
+            try {
+                if (binary || Buffer.byteLength(data.toString()) > RELAY_CONTROL_MAX_BYTES)
+                    throw new Error("Invalid control frame");
+                message = parseRelayControlMessage(JSON.parse(data.toString()));
+            }
+            catch {
+                ws.terminate();
+                return;
+            }
+            if (!message)
+                return ws.terminate();
+            if (message.type === "welcome" && !leaseId) {
+                if (message.hostId !== config.hostId || message.publicOrigin !== config.publicOrigin)
+                    return ws.terminate();
+                try {
+                    config.localHost.setPublicBaseUrl(message.publicOrigin);
+                }
+                catch {
+                    ws.terminate();
+                    return;
+                }
+                if (!current())
+                    return ws.terminate();
+                leaseId = message.leaseId;
+                clearTimeout(deadline);
+                ws.send(JSON.stringify({ type: "ready", v: 1, leaseId }));
+                failures = 0;
+                state("ready");
+                return;
+            }
+            if (message.type !== "open" ||
+                !leaseId ||
+                message.leaseId !== leaseId ||
+                owned.has(message.streamId))
+                return ws.terminate();
+            const failed = () => {
+                if (current() && ws.readyState === ws.OPEN)
+                    ws.send(JSON.stringify({ type: "failed", v: 1, leaseId, streamId: message.streamId }));
+            };
+            if (streams.size >= RELAY_MAX_STREAMS)
+                return failed();
+            const stream = openRelayStream(config, message, failed);
+            owned.set(message.streamId, stream);
+            streams.add(stream);
+            const done = stream.done.then(() => {
+                owned.delete(message.streamId);
+                streams.delete(stream);
+            });
+            track(done);
+        });
+    };
+    const connector = {
+        start() {
+            config.localHost.signal.throwIfAborted();
+            if (running)
+                return;
+            if (closing)
+                throw new Error("Device relay connector is closing");
+            config.localHost.signal.addEventListener("abort", revoke, { once: true });
+            running = true;
+            failures = 0;
+            connect(++generation);
+        },
+        close() {
+            if (closing)
+                return closing;
+            running = false;
+            config.localHost.signal.removeEventListener("abort", revoke);
+            generation++;
+            clearTimeout(reconnect);
+            reconnect = undefined;
+            control?.terminate();
+            control = undefined;
+            for (const stream of streams)
+                stream.close();
+            closing = Promise.all([...pending])
+                .then(() => {
+                state("closed");
+            })
+                .finally(() => {
+                closing = undefined;
+            });
+            return closing;
+        },
+    };
+    function revoke() {
+        void connector.close();
+    }
+    return connector;
+}

package/dist/remote-relay/local-stream.d.ts

@@ -0,0 +1,10 @@
+import type { DeviceRelayConnectorOptions } from "./connector.js";
+import { type RelayControlMessage } from "./protocol.js";
+export interface RelayLocalStream {
+    close(): void;
+    done: Promise<void>;
+}
+/** One fixed loopback connection. Never accept a target, URL, or port from control messages. */
+export declare function openRelayStream(config: DeviceRelayConnectorOptions, message: Extract<RelayControlMessage, {
+    type: "open";
+}>, failed: () => void): RelayLocalStream;

package/dist/remote-relay/local-stream.js

@@ -0,0 +1,120 @@
+import { connect } from "node:net";
+import { WebSocket } from "ws";
+import { createRelayByteStream } from "./byte-stream.js";
+import { RELAY_DATA_MAX_BYTES, RELAY_SETUP_TIMEOUT_MS, RELAY_STREAMS_PATH, } from "./protocol.js";
+const ERROR_DRAIN_TIMEOUT_MS = 2000;
+/** One fixed loopback connection. Never accept a target, URL, or port from control messages. */
+export function openRelayStream(config, message, failed) {
+    const socket = connect({ host: "127.0.0.1", port: config.localHost.port });
+    let ws;
+    let bytes;
+    let disposed = false;
+    let attached = false;
+    let tcpClosed = false;
+    let wsClosed = true;
+    let drainingResponse = false;
+    let errorDrainTimer;
+    let resolveDone;
+    const done = new Promise((resolve) => {
+        resolveDone = resolve;
+    });
+    const settle = () => {
+        if (tcpClosed && wsClosed)
+            resolveDone();
+    };
+    const close = () => {
+        if (disposed)
+            return;
+        disposed = true;
+        clearTimeout(timer);
+        clearTimeout(errorDrainTimer);
+        socket.destroy();
+        bytes?.destroy();
+        ws?.terminate();
+    };
+    const fail = () => {
+        if (!disposed && !attached)
+            failed();
+        close();
+    };
+    const drainResponse = () => {
+        if (disposed || drainingResponse || !bytes)
+            return;
+        drainingResponse = true;
+        socket.unpipe(bytes);
+        bytes.unpipe(socket);
+        // An early HTTP rejection can arrive before the request finishes writing.
+        // Preserve already-read response bytes instead of turning them into EPIPE
+        // at the peer. HTTP framing still rejects genuinely truncated responses.
+        // The dead TCP target receives no further body; discard inbound frames only
+        // during this bounded WSS close handshake so they cannot stall its close.
+        errorDrainTimer = setTimeout(close, ERROR_DRAIN_TIMEOUT_MS);
+        errorDrainTimer.unref?.();
+        bytes.resume();
+        bytes.end();
+    };
+    const timer = setTimeout(fail, RELAY_SETUP_TIMEOUT_MS);
+    socket.on("error", (error) => {
+        if (attached && socket.bytesRead > 0 && ["EPIPE", "ECONNRESET"].includes(error.code ?? ""))
+            drainResponse();
+        else
+            fail();
+    });
+    socket.once("close", () => {
+        tcpClosed = true;
+        // A clean local EOF must flush queued response bytes before closing WSS.
+        if (!attached)
+            fail();
+        else if (!socket.readableEnded || !socket.writableFinished) {
+            if (socket.bytesRead > 0)
+                drainResponse();
+            else
+                fail();
+        }
+        settle();
+    });
+    socket.once("connect", () => {
+        if (disposed)
+            return;
+        const url = new URL(RELAY_STREAMS_PATH + message.streamId, config.relayOrigin);
+        url.protocol = "wss:";
+        wsClosed = false;
+        ws = new WebSocket(url, {
+            headers: {
+                Authorization: `Bearer ${config.credential}`,
+                "X-CodeShell-Relay-Lease": message.leaseId,
+                "X-CodeShell-Relay-Ticket": message.ticket,
+            },
+            ca: config.ca,
+            followRedirects: false,
+            perMessageDeflate: false,
+            maxPayload: RELAY_DATA_MAX_BYTES,
+            handshakeTimeout: RELAY_SETUP_TIMEOUT_MS,
+        });
+        ws.on("error", fail);
+        ws.once("close", () => {
+            wsClosed = true;
+            clearTimeout(errorDrainTimer);
+            // The stream drains received bytes before ending the local TCP socket.
+            if (!attached)
+                fail();
+            settle();
+        });
+        ws.once("open", () => {
+            if (disposed)
+                return ws.terminate();
+            clearTimeout(timer);
+            attached = true;
+            bytes = createRelayByteStream(ws);
+            bytes.on("error", close);
+            bytes.on("close", () => {
+                if (bytes.readableEnded && bytes.writableFinished)
+                    socket.end();
+                else
+                    close();
+            });
+            socket.pipe(bytes).pipe(socket);
+        });
+    });
+    return { close, done };
+}

package/dist/remote-relay/protocol.d.ts

@@ -0,0 +1,39 @@
+/** Device relay v1. The relay terminates TLS and is a trusted transport. */
+export declare const RELAY_PROTOCOL_VERSION = 1;
+export declare const RELAY_CONTROL_MAX_BYTES: number;
+export declare const RELAY_DATA_MAX_BYTES: number;
+export declare const RELAY_DATA_CHUNK_BYTES: number;
+export declare const RELAY_MAX_STREAMS = 32;
+export declare const RELAY_CONNECT_PATH = "/api/v1/remote-hosts/connect";
+export declare const RELAY_STREAMS_PATH = "/api/v1/remote-hosts/streams/";
+export declare const RELAY_SETUP_TIMEOUT_MS = 10000;
+export declare const RELAY_PING_INTERVAL_MS = 20000;
+export declare const RELAY_PONG_TIMEOUT_MS = 60000;
+export type RelayControlMessage = {
+    type: "welcome";
+    v: 1;
+    hostId: string;
+    publicOrigin: string;
+    leaseId: string;
+} | {
+    type: "ready";
+    v: 1;
+    leaseId: string;
+} | {
+    type: "open";
+    v: 1;
+    leaseId: string;
+    streamId: string;
+    ticket: string;
+} | {
+    type: "failed";
+    v: 1;
+    leaseId: string;
+    streamId: string;
+};
+export declare function isRelayToken(value: unknown): value is string;
+export declare function isRelayHostId(value: unknown): value is string;
+/** Canonical HTTPS origin only: no credentials, path, fragment or query. */
+export declare function isRelayOrigin(value: unknown): value is string;
+/** Validate an already JSON-decoded message; wire size/direction are checked by its receiver. */
+export declare function parseRelayControlMessage(value: unknown): RelayControlMessage | undefined;

package/dist/remote-relay/protocol.js

@@ -0,0 +1,64 @@
+/** Device relay v1. The relay terminates TLS and is a trusted transport. */
+export const RELAY_PROTOCOL_VERSION = 1;
+export const RELAY_CONTROL_MAX_BYTES = 16 * 1024;
+export const RELAY_DATA_MAX_BYTES = 64 * 1024;
+export const RELAY_DATA_CHUNK_BYTES = 32 * 1024;
+export const RELAY_MAX_STREAMS = 32;
+export const RELAY_CONNECT_PATH = "/api/v1/remote-hosts/connect";
+export const RELAY_STREAMS_PATH = "/api/v1/remote-hosts/streams/";
+export const RELAY_SETUP_TIMEOUT_MS = 10_000;
+export const RELAY_PING_INTERVAL_MS = 20_000;
+export const RELAY_PONG_TIMEOUT_MS = 60_000;
+export function isRelayToken(value) {
+    return typeof value === "string" && /^[A-Za-z0-9_-]{43}$/.test(value);
+}
+export function isRelayHostId(value) {
+    return typeof value === "string" && /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(value);
+}
+/** Canonical HTTPS origin only: no credentials, path, fragment or query. */
+export function isRelayOrigin(value) {
+    if (typeof value !== "string")
+        return false;
+    try {
+        const url = new URL(value);
+        return url.protocol === "https:" && url.origin === value && !url.username && !url.password;
+    }
+    catch {
+        return false;
+    }
+}
+/** Validate an already JSON-decoded message; wire size/direction are checked by its receiver. */
+export function parseRelayControlMessage(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return;
+    const message = value;
+    if (message.v !== RELAY_PROTOCOL_VERSION || !isRelayToken(message.leaseId))
+        return;
+    switch (message.type) {
+        case "welcome":
+            if (isRelayHostId(message.hostId) && isRelayOrigin(message.publicOrigin))
+                return {
+                    type: "welcome",
+                    v: 1,
+                    leaseId: message.leaseId,
+                    hostId: message.hostId,
+                    publicOrigin: message.publicOrigin,
+                };
+            return;
+        case "ready":
+            return { type: "ready", v: 1, leaseId: message.leaseId };
+        case "open":
+            if (isRelayToken(message.streamId) && isRelayToken(message.ticket))
+                return {
+                    type: "open",
+                    v: 1,
+                    leaseId: message.leaseId,
+                    streamId: message.streamId,
+                    ticket: message.ticket,
+                };
+            return;
+        case "failed":
+            if (isRelayToken(message.streamId))
+                return { type: "failed", v: 1, leaseId: message.leaseId, streamId: message.streamId };
+    }
+}

package/dist/serve/automation-worker.d.ts

@@ -0,0 +1,16 @@
+import type { CronJob, CronRunRequest } from "@cjhyy/code-shell-core/internal";
+import { WorkerBridgeCore } from "../worker-bridge-core.js";
+export interface HubAutomationWorkerOptions {
+    bridge: WorkerBridgeCore;
+    cwd: string;
+    /** Must synchronously exclude other runs/configuration changes until release. */
+    reserve(job: CronJob, requestId: string): () => void;
+    model(): string | undefined;
+    admissionTimeoutMs?: number;
+}
+/** Borrows the project's live Worker so persisted Session state has one writer. */
+export declare function createHubAutomationWorker(options: HubAutomationWorkerOptions): {
+    execute: (request: CronRunRequest) => Promise<void>;
+    handleApproval: (params: Record<string, any>) => boolean;
+    ownsSession: (sessionId: string) => boolean;
+};