@crvouga/dev-fleet 0.0.0-stage → 0.2.0

package/src/definition.ts

@@ -0,0 +1,290 @@
+import { parseWorkerPolicy, type WorkerPolicy } from './worker-policy';
+import { readFileSync } from 'node:fs';
+import { FleetUsageError } from './errors';
+import { parseConfig, record } from './config';
+import type { FleetConfig } from './types';
+import { parseSecretsConfig, type SecretsConfig } from './secrets';
+import { parseLocation, type BucketLocation } from './state/bucket';
+
+export interface MachineDefinition {
+  id: string;
+  ssh: string;
+  os: 'linux' | 'macOS' | 'windows';
+  network?: {
+    tailscaleName: string;
+    user: string;
+    sshPort: number;
+    t3Port: number;
+  };
+}
+/** The singleton manager: the human's machine. It runs fleet-sync and hosts
+ * every singleton service; it is never converged over SSH. */
+export interface ManagerDefinition {
+  id: string;
+  os: 'macOS';
+  network: { tailscaleName: string; user: string };
+  neverSleepOnPower: true;
+}
+export interface FleetDefinition {
+  version: 3;
+  /** The Git repository machines take dev-fleet's code from. */
+  source: { repository: string };
+  /** Where this fleet keeps its secrets. */
+  secrets: SecretsConfig;
+  /** The bucket that holds the fleet state. Its credentials are never part
+   * of the configuration: they come from the environment of the command.
+   */
+  state?: BucketLocation;
+  manager: ManagerDefinition;
+  /** Stateless, replaceable Linux boxes; clients of the manager's services. */
+  workers: MachineDefinition[];
+  services: {
+    /** Public HTTPS origin of the CLI proxy every node uses. */
+    proxy: { endpoint: string };
+    monitoring: {
+      hubPort: 8443;
+      /** Public dashboard origin. */
+      publicUrl: string;
+      /** Beszel account the manager enrolls nodes with. */
+      managerAccount: string;
+      /** Read-only Beszel account visitors are signed in as. */
+      viewerAccount: string;
+    };
+  };
+  worker?: WorkerPolicy;
+  ubuntu: { release: '26.04'; architectures: ['amd64', 'arm64'] };
+}
+const ID = /^[a-z][a-z0-9-]{0,62}$/;
+const HOST = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,252}$/;
+function fail(): never {
+  throw new FleetUsageError(
+    'Invalid Fleet definition. Check version 3, one macOS manager, unique Linux worker IDs, singleton services and network metadata in fleet.json.'
+  );
+}
+function keys(value: Record<string, unknown>, allowed: string[]): boolean {
+  return Object.keys(value).every((key) => allowed.includes(key));
+}
+function network(value: unknown): NonNullable<MachineDefinition['network']> {
+  if (
+    !record(value) ||
+    !keys(value, ['tailscaleName', 'user', 'sshPort', 't3Port'])
+  )
+    return fail();
+  if (
+    typeof value['tailscaleName'] !== 'string' ||
+    !HOST.test(value['tailscaleName'])
+  )
+    return fail();
+  if (
+    typeof value['user'] !== 'string' ||
+    !/^[a-z_][a-z0-9_-]{0,31}$/.test(value['user'])
+  )
+    return fail();
+  for (const port of ['sshPort', 't3Port'])
+    if (!validPort(value[port])) return fail();
+  return value as NonNullable<MachineDefinition['network']>;
+}
+function validPort(value: unknown): boolean {
+  return (
+    Number.isInteger(value) && Number(value) >= 1 && Number(value) <= 65535
+  );
+}
+function worker(value: unknown): MachineDefinition {
+  if (!record(value) || !keys(value, ['id', 'ssh', 'os', 'network']))
+    return fail();
+  if (typeof value['id'] !== 'string' || !ID.test(value['id'])) return fail();
+  if (typeof value['ssh'] !== 'string' || !HOST.test(value['ssh']))
+    return fail();
+  // Workers are the Linux boxes; any other platform is not a worker.
+  if (value['os'] !== 'linux') return fail();
+  return {
+    id: value['id'],
+    ssh: value['ssh'],
+    os: 'linux',
+    ...(value['network'] ? { network: network(value['network']) } : {}),
+  };
+}
+function manager(value: unknown): ManagerDefinition {
+  if (
+    !record(value) ||
+    !keys(value, ['id', 'os', 'network', 'neverSleepOnPower']) ||
+    typeof value['id'] !== 'string' ||
+    !ID.test(value['id']) ||
+    value['os'] !== 'macOS' ||
+    value['neverSleepOnPower'] !== true
+  )
+    return fail();
+  return {
+    id: value['id'],
+    os: 'macOS',
+    network: managerNetwork(value['network']),
+    neverSleepOnPower: true,
+  };
+}
+function managerNetwork(value: unknown): ManagerDefinition['network'] {
+  if (
+    !record(value) ||
+    !keys(value, ['tailscaleName', 'user']) ||
+    typeof value['tailscaleName'] !== 'string' ||
+    !HOST.test(value['tailscaleName']) ||
+    typeof value['user'] !== 'string' ||
+    !/^[a-z_][a-z0-9_.-]{0,31}$/.test(value['user'])
+  )
+    return fail();
+  return { tailscaleName: value['tailscaleName'], user: value['user'] };
+}
+export function parseDefinition(value: unknown): FleetDefinition {
+  if (
+    !record(value) ||
+    value['version'] !== 3 ||
+    !keys(value, [
+      '$schema',
+      'version',
+      'source',
+      'secrets',
+      'state',
+      'manager',
+      'workers',
+      'services',
+      'ubuntu',
+      'worker',
+    ])
+  )
+    return fail();
+  if (!Array.isArray(value['workers']) || value['workers'].length > 64)
+    return fail();
+  const lead = manager(value['manager']);
+  const workers = value['workers'].map(worker);
+  const ids = [lead.id, ...workers.map((entry) => entry.id)];
+  if (new Set(ids).size !== ids.length) return fail();
+  return {
+    version: 3,
+    source: source(value['source']),
+    secrets: secrets(value['secrets']),
+    ...(value['state'] === undefined ? {} : { state: state(value['state']) }),
+    manager: lead,
+    workers,
+    services: services(value['services']),
+    ubuntu: baseline(value['ubuntu']),
+    ...(value['worker'] === undefined
+      ? {}
+      : { worker: parseWorkerPolicy(value['worker']) }),
+  };
+}
+/** Singleton services name no host: they always run on the manager. */
+function services(value: unknown): FleetDefinition['services'] {
+  if (!record(value) || !keys(value, ['proxy', 'monitoring'])) return fail();
+  const { proxy, monitoring } = value;
+  if (
+    !record(proxy) ||
+    !keys(proxy, ['endpoint']) ||
+    !origin(proxy['endpoint'])
+  )
+    return fail();
+  return {
+    proxy: { endpoint: proxy['endpoint'] },
+    monitoring: monitoringService(monitoring),
+  };
+}
+function monitoringService(
+  value: unknown
+): FleetDefinition['services']['monitoring'] {
+  const fields = ['hubPort', 'publicUrl', 'managerAccount', 'viewerAccount'];
+  if (!record(value) || !keys(value, fields) || value['hubPort'] !== 8443)
+    return fail();
+  const { publicUrl, managerAccount, viewerAccount } = value;
+  if (!origin(publicUrl) || !account(managerAccount) || !account(viewerAccount))
+    return fail();
+  return { hubPort: 8443, publicUrl, managerAccount, viewerAccount };
+}
+const origin = (value: unknown): value is string =>
+  typeof value === 'string' && /^https:\/\/[A-Za-z0-9.-]{1,253}$/.test(value);
+const account = (value: unknown): value is string =>
+  typeof value === 'string' &&
+  /^[^\s@]{1,64}@[A-Za-z0-9.-]{1,253}$/.test(value);
+function secrets(value: unknown): SecretsConfig {
+  return parseSecretsConfig(value) ?? fail();
+}
+/** Says what is wrong with the block itself: a bucket has several settings. */
+function state(value: unknown): BucketLocation {
+  const bucket = parseLocation(value);
+  if (bucket.kind === 'directory') return { directory: bucket.path };
+  const { bucket: name, endpoint, region } = bucket;
+  return {
+    bucket: name,
+    ...(endpoint ? { endpoint } : {}),
+    ...(region ? { region } : {}),
+    prefix: bucket.prefix,
+  };
+}
+function source(value: unknown): FleetDefinition['source'] {
+  if (
+    !record(value) ||
+    !keys(value, ['repository']) ||
+    typeof value['repository'] !== 'string' ||
+    !/^https:\/\/[A-Za-z0-9.-]+\/[A-Za-z0-9._/-]+\.git$/.test(
+      value['repository']
+    )
+  )
+    return fail();
+  return { repository: value['repository'] };
+}
+function baseline(ubuntu: unknown): FleetDefinition['ubuntu'] {
+  if (
+    !record(ubuntu) ||
+    !keys(ubuntu, ['release', 'architectures']) ||
+    ubuntu['release'] !== '26.04' ||
+    JSON.stringify(ubuntu['architectures']) !== '["amd64","arm64"]'
+  )
+    return fail();
+  return ubuntu as FleetDefinition['ubuntu'];
+}
+
+/** The configuration as every machine keeps it at
+ * ~/.config/dev-fleet/fleet.json: without the bucket. Only the devfleet CLI
+ * on the manager reaches the bucket, and a launcher that still runs the
+ * revision from before the block existed must go on accepting the file while
+ * a sync is under way.
+ */
+export function installedDefinition(definition: FleetDefinition): string {
+  const { state: _bucket, ...machine } = definition;
+  return JSON.stringify(machine, null, 2) + '\n';
+}
+
+export function loadDefinition(path: string): FleetDefinition {
+  try {
+    return parseDefinition(JSON.parse(readFileSync(path, 'utf8')));
+  } catch {
+    return fail();
+  }
+}
+/** Local v1 roster supplies paths/requirements only for explicitly enrolled workers. */
+export function enrolledRoster(
+  definition: FleetDefinition,
+  overrides: unknown
+): FleetConfig {
+  const roster = parseConfig(overrides);
+  for (const node of roster.nodes) {
+    const declared = definition.workers.find((entry) => entry.id === node.id);
+    if (!declared)
+      throw new FleetUsageError(
+        'Roster contains a node that is not a declared worker. Add the worker to fleet.json in Git before rollout; the manager is never a roster node.'
+      );
+    if (declared.ssh !== node.ssh)
+      throw new FleetUsageError(
+        'Fleet SSH assignment conflicts with the local roster. Review the migration; discovery cannot overwrite explicit assignments.'
+      );
+  }
+  return {
+    ...roster,
+    nodes: roster.nodes.map((node) => ({
+      ...node,
+      required: [
+        ...new Set([
+          ...node.required,
+          ...(definition.worker?.requiredCapabilities ?? []),
+        ]),
+      ],
+    })),
+  };
+}

package/src/diagnostics.ts

@@ -0,0 +1,92 @@
+import type { Check } from './types';
+
+export interface Diagnostic {
+  node: string;
+  phase: string;
+  checkId: string;
+  status: Check['status'];
+  code: string;
+  summary: string;
+  expected: string;
+  observed: string;
+  scope: 'manager' | 'node' | 'unverified';
+  durationMs: number | null;
+  retryable: boolean;
+  actionRequired: boolean;
+  remedy: { owner: string; action: string };
+}
+const EXPECTED: Record<string, string> = {
+  ssh: 'Fresh noninteractive SSH session with the enrolled host key and designated user.',
+  tailscale:
+    'The enrolled device identity is connected and reachable through the intended tailnet.',
+  ubuntu:
+    'Observed Ubuntu configuration matches the reviewed baseline without a distribution upgrade.',
+  t3: 'Pinned native T3 service and the specifically named runtime acceptance check pass.',
+  provider:
+    'The declared gateway model passes authenticated inference, completed streaming and a bounded tool round trip.',
+  proxy:
+    'One declared gateway owner preserves runtime identities and serves authorized clients.',
+  beszel:
+    'Pinned monitoring artifacts, canonical registration and fresh authenticated metrics are independently verified.',
+  rollout: 'Required prerequisites and canary gates pass before promotion.',
+  manager:
+    'Manager enrollment, approval and exclusive operation ownership are valid.',
+  source:
+    'The approved full commit and packaged canonical definition match verified source.',
+  configuration:
+    'The existing Workstation owner applies and verifies the selected source configuration.',
+};
+
+/** Derived only from already-redacted checks. No raw subprocess errors, journal
+ * contents, auth payloads or environment fields enter the diagnostic contract.
+ */
+export function diagnostic(node: string, check: Check): Diagnostic {
+  const phase = check.id.split(':')[0]!;
+  const failed = check.status !== 'pass';
+  const code = /^[A-Z][A-Z0-9_]{2,100}$/.test(check.summary)
+    ? check.summary
+    : `${check.id.replaceAll(/[^a-z0-9]/g, '_').toUpperCase()}_${failed ? 'UNVERIFIED' : 'VERIFIED'}`;
+  return {
+    node,
+    phase,
+    checkId: check.id,
+    status: check.status,
+    code,
+    summary: check.summary,
+    expected:
+      EXPECTED[phase] ??
+      'The named required check has independent verification evidence.',
+    observed: check.summary,
+    scope: scope(check.id),
+    durationMs: check.phaseDurationMs ?? null,
+    retryable: failed && /OFFLINE|UNREACHABLE|METRICS_STALE|TIMEOUT/.test(code),
+    actionRequired: failed,
+    remedy: {
+      owner: owner(phase),
+      action:
+        check.remedy?.action ??
+        'Inspect this named check in the Fleet runbook; preserve runtime identity and repair persistent configuration in source.',
+    },
+  };
+}
+function scope(id: string): Diagnostic['scope'] {
+  if (
+    /^(t3:manager-(endpoint|origin)|ssh:|manager:|rollout:|source:|tailscale:(reachability|identity|enrolled-identity))/.test(
+      id
+    )
+  )
+    return 'manager';
+  if (
+    /^(provider:|proxy:|configuration:|ubuntu:baseline|t3:(service|policy)|tailscale:configuration)/.test(
+      id
+    )
+  )
+    return 'node';
+  if (/^beszel:(version|registration|connection|freshness|api)/.test(id))
+    return 'manager';
+  return 'unverified';
+}
+function owner(phase: string): string {
+  if (phase === 'proxy') return 'cliproxy';
+  return 'dev-fleet';
+}

package/src/doctor-check.ts

@@ -0,0 +1,10 @@
+export type CheckSeverity = 'pass' | 'warn' | 'fail';
+
+/** One human-readable health finding, with an optional fix to run. */
+export type DoctorCheck = {
+  id: string;
+  label: string;
+  severity: CheckSeverity;
+  detail: string;
+  fix?: string | undefined;
+};

package/src/errors.ts

@@ -0,0 +1 @@
+export class FleetUsageError extends Error {}

package/src/fingerprint.ts

@@ -0,0 +1,120 @@
+import { readFile, mkdir, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { record } from './config';
+import {
+  fileHash,
+  manifestHash,
+  sidecarHash,
+  INPUT_FILES,
+  FINGERPRINT_FILES,
+} from './input-hashes';
+import type { Fingerprint, Runner, Check } from './types';
+
+const RECEIPT = 'node_modules/.fleet-sync.json';
+
+export async function fingerprint(
+  root: string,
+  run: Runner
+): Promise<Fingerprint> {
+  const files: Fingerprint['files'] = {};
+  for (const name of INPUT_FILES)
+    files[name] = await fileHash(join(root, name));
+  files['workspace-manifests'] = await manifestHash(root);
+  files['mise-sidecars'] = await sidecarHash(root);
+  const head = await run(['git', 'rev-parse', 'HEAD'], { cwd: root });
+  return {
+    head:
+      head.ok && /^[a-f0-9]{40,64}\s*$/.test(head.stdout)
+        ? head.stdout.trim()
+        : null,
+    files,
+  };
+}
+
+export async function dependencyCheck(
+  root: string,
+  current: Fingerprint
+): Promise<Check> {
+  const remedy = {
+    action:
+      'Review devfleet fleet-repair --repair workspace, then explicitly apply a frozen toolchain/dependency sync.',
+  };
+  try {
+    const receipt: unknown = JSON.parse(
+      await readFile(join(root, RECEIPT), 'utf8')
+    );
+    const matches =
+      record(receipt) &&
+      receipt['version'] === 1 &&
+      JSON.stringify(receipt['files']) === JSON.stringify(current.files);
+    return {
+      id: 'dependencies',
+      status: matches ? 'pass' : 'fail',
+      summary: matches
+        ? 'Last successful frozen sync matches input hashes; not a full integrity audit.'
+        : 'Dependency sync receipt is stale or invalid.',
+      ...(matches ? {} : { remedy }),
+    };
+  } catch {
+    return {
+      id: 'dependencies',
+      status: 'warn',
+      summary: 'No frozen-sync receipt; installed dependencies are unverified.',
+      remedy,
+    };
+  }
+}
+
+export async function writeReceipt(
+  root: string,
+  current: Fingerprint
+): Promise<void> {
+  await mkdir(join(root, 'node_modules'), { recursive: true });
+  await writeFile(
+    join(root, RECEIPT),
+    JSON.stringify({ version: 1, files: current.files }),
+    { mode: 0o600 }
+  );
+}
+
+export function compareFingerprints(
+  expected: Fingerprint,
+  actual: Fingerprint
+): Check[] {
+  return [
+    compare('revision', expected.head, actual.head),
+    ...FINGERPRINT_FILES.map((name) =>
+      compare(
+        `sync:${name}`,
+        expected.files[name] ?? null,
+        actual.files[name] ?? null
+      )
+    ),
+  ];
+}
+
+function compare(
+  id: string,
+  expected: string | null,
+  actual: string | null
+): Check {
+  const known = expected !== null && actual !== null;
+  const matches = known && expected === actual;
+  return {
+    id,
+    status: matches ? 'pass' : 'fail',
+    summary: matches
+      ? 'Matches the manager checkout.'
+      : known
+        ? 'Differs from the manager checkout.'
+        : 'Cannot verify; reference or node input is missing.',
+    ...(matches
+      ? {}
+      : {
+          remedy: {
+            action:
+              'Reconcile branches/lockfiles; review devfleet fleet-sync for the approved revision. Never reset a working tree.',
+          },
+        }),
+  };
+}

package/src/fleet-config.ts

@@ -0,0 +1,174 @@
+import { spawn } from 'node:child_process';
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  writeFileSync,
+} from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import {
+  installedDefinition,
+  parseDefinition,
+  type FleetDefinition,
+} from './definition';
+import { FleetUsageError } from './errors';
+import { pinnedPath } from './agents/toolchain';
+import type { Runner } from './types';
+import {
+  secretsProvider,
+  type SecretCommand,
+  type SecretsProvider,
+} from './secrets';
+import { isOperator, stateDefinition } from './state/operator';
+import type { BucketLocation } from './state/bucket';
+import { definitionPath, stateRoot } from './state/paths';
+
+/** Where every machine keeps the fleet configuration fleet-sync approved.
+ * Launchers and scheduled jobs get no environment and read it from here.
+ */
+const installedPath = (home: string): string =>
+  join(home, '.config/dev-fleet/fleet.json');
+
+/** Where this process reads the fleet configuration from, in this order:
+ * - `file`: the file `DEVFLEET_CONFIG` names. The devfleet CLI sets it to the
+ *   `fleet.json` of the project it is run from (src/cli/project.ts);
+ * - `state`: the `definition` document in the manager's fleet state, the
+ *   configuration fleet-sync last applied, which only the devfleet CLI
+ *   reads. `path` is its copy as a file;
+ * - `installed`: the copy fleet-sync installed on this machine.
+ */
+export interface DefinitionSource {
+  kind: 'file' | 'state' | 'installed';
+  path: string;
+}
+
+export function definitionSource(
+  env = process.env,
+  home = homedir()
+): DefinitionSource {
+  const root = stateRoot(env, home);
+  const copy = definitionPath(root);
+  const named = env['DEVFLEET_CONFIG'];
+  // A devfleet command names the state's copy for the commands it starts.
+  const inherited = named === copy && isOperator();
+  if (named && !inherited) return { kind: 'file', path: named };
+  if (stateDefinition(root) !== null) return { kind: 'state', path: copy };
+  return { kind: 'installed', path: installedPath(home) };
+}
+
+function writePrivate(path: string, content: string): boolean {
+  if (existsSync(path) && readFileSync(path, 'utf8') === content) return false;
+  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+  writeFileSync(`${path}.new`, content, { mode: 0o600 });
+  renameSync(`${path}.new`, path);
+  return true;
+}
+
+/** The file that holds the configuration this process runs with, for the
+ * subprocesses that take a path. Every command this process starts reads the
+ * same one.
+ */
+export function configPath(env = process.env, home = homedir()): string {
+  const source = definitionSource(env, home);
+  if (source.kind !== 'state') return source.path;
+  const body = stateDefinition(stateRoot(env, home));
+  if (body !== null) writePrivate(source.path, body);
+  env['DEVFLEET_CONFIG'] = source.path;
+  return source.path;
+}
+
+/** Installs the configuration this process runs with as the machine's copy,
+ * so launchers and scheduled jobs (which get no environment) use the same one.
+ * Returns whether the file changed.
+ */
+export function installConfig(home = homedir()): boolean {
+  return writePrivate(installedPath(home), installedDefinition(fleet));
+}
+
+function read(path: string): FleetDefinition {
+  let value: unknown;
+  try {
+    value = JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    throw new FleetUsageError(
+      `The fleet configuration at ${path} is not readable JSON.`
+    );
+  }
+  return parseDefinition(value);
+}
+
+function load(): FleetDefinition {
+  const path = configPath();
+  if (!existsSync(path))
+    throw new FleetUsageError(
+      `No fleet configuration. Run devfleet from the project that holds your fleet.json (devfleet fleet-state --example prints one to start from), or name the file with DEVFLEET_CONFIG. A manager whose bucket already holds one restores it with devfleet fleet-state --init. Looked at ${path}.`
+    );
+  return read(path);
+}
+
+/** Where the configuration says the fleet state is kept, read from the file
+ * each time: null when it names no bucket, or when this machine has no
+ * configuration yet.
+ */
+export function declaredState(
+  env = process.env,
+  home = homedir()
+): BucketLocation | null {
+  const path = configPath(env, home);
+  return existsSync(path) ? (read(path).state ?? null) : null;
+}
+
+let loaded: FleetDefinition | undefined;
+const current = (): FleetDefinition => (loaded ??= load());
+
+/** Forgets the configuration read so far; the next use reads it again. For
+ * a command that has just replaced the fleet state under itself.
+ */
+export function reloadFleet(): void {
+  loaded = undefined;
+}
+
+/** This fleet's own configuration: its machines, endpoints, accounts and source
+ * repository. Fleet code never names any of them; it reads them here, and this
+ * is the only module that loads the file. It is read on first use, so a
+ * command that needs no configuration runs on a machine that has none yet.
+ */
+export const fleet: FleetDefinition = new Proxy({} as FleetDefinition, {
+  get: (_, key) => Reflect.get(current(), key),
+  has: (_, key) => Reflect.has(current(), key),
+  ownKeys: () => Reflect.ownKeys(current()),
+  getOwnPropertyDescriptor: (_, key) =>
+    Reflect.getOwnPropertyDescriptor(current(), key),
+});
+
+/** Reads one of this fleet's secrets for this node. Tools run from the pinned
+ * toolchain, whatever PATH the caller (T3, launchd, systemd) started with.
+ */
+export const secret: SecretsProvider = (name) =>
+  secretsProvider(fleet.secrets, { run: pinned })(name);
+
+/** The same, through an injected runner (fleet-sync phases and their tests). */
+export const secretVia = (run: Runner): SecretsProvider =>
+  secretsProvider(fleet.secrets, {
+    run: async (argv) => {
+      const result = await run(argv, { timeoutMs: 20_000 });
+      return result.ok ? result.stdout : null;
+    },
+  });
+
+const pinned: SecretCommand = (argv) =>
+  new Promise((resolve) => {
+    const child = spawn(argv[0]!, argv.slice(1), {
+      stdio: ['ignore', 'pipe', 'ignore'],
+      timeout: 20_000,
+      env: { ...process.env, PATH: pinnedPath() },
+    });
+    let output = '';
+    child.stdout.on('data', (chunk: Buffer) => {
+      if (output.length < 65_536) output += chunk.toString('utf8');
+    });
+    child.on('error', () => resolve(null));
+    child.on('close', (code) => resolve(code === 0 ? output : null));
+  });