@erichll/pi-sandbox 0.15.2 → 0.16.0

package/src/external-runs-view.ts

@@ -1,173 +0,0 @@
-// Optional FleetView integration for pi-sandbox's isolated external workers.
-//
-// When the host is running the external `pi-subagents` provider with
-// `externalWorkerIsolation: "enforce"`, pi-sandbox supervises the external
-// worker process trees itself. This module mirrors those supervised workers
-// into pi-subagents' caller-owned external-run registry so they show up in the
-// FleetView (pi-subagents >= 0.50.0).
-//
-// This is a pure observability enhancement: it participates in NO sandbox
-// allow/deny decision, and nothing here can downgrade an isolated worker into
-// host execution. `pi-subagents/external-runs` is loaded via a DYNAMIC import
-// only (never a top-level static import), because pi-subagents is an OPTIONAL
-// peer dependency: builtin/off deployments may not have it installed.
-//
-// Deliberate scope of v1: records are "running" only. No completed/failed/
-// endedAt are fabricated because neither the launcher nor the supervisor
-// protocol currently reports process exit evidence to this extension (the
-// record would therefore be a lie). See docs/compat-notes.md seam 5.
-
-type ExternalRunState = "running";
-
-/** Structural view of the specific pi-subagents API we consume. */
-type ExternalRunsApi = {
-  registerExternalRun(input: {
-    id: string;
-    sessionId: string;
-    source: string;
-    label: string;
-    state: ExternalRunState;
-    startedAt: number;
-    preview?: string;
-  }): unknown;
-  unregisterExternalRun(sessionId: string, id: string): boolean;
-};
-
-export type ExternalRunsView = {
-  /** Whether the pi-subagents runtime is reachable (dynamic import succeeded). */
-  readonly enabled: boolean;
-  /** Diagnostic string when the runtime is disabled. */
-  readonly error?: string;
-  /** Mirror a supervisor lifecycle.registered event into the registry. */
-  registered(worker: { id: string; cwd: string; startedAt: number }): void;
-  /** Mirror a supervisor lifecycle.unregistered event out of the registry. */
-  unregistered(workerId: string): void;
-  /** Unregister every run this view registered (session shutdown / replace). */
-  close(): void;
-};
-
-const VIEW_LABEL = "isolated pi-subagents worker";
-const VIEW_SOURCE = "pi-sandbox";
-
-/**
- * Whether the FleetView integration should be enabled for a given provider /
- * isolation combination. It is enabled ONLY when the external pi-subagents
- * provider owns orchestration AND outer worker isolation is enforced -- the
- * sole case where pi-sandbox actually supervises external workers and can
- * truthfully vouch for a "running" record it owns.
- */
-export function externalRunsViewEnabledWhen(
-  provider: string,
-  externalWorkerIsolation: string,
-): boolean {
-  return provider === "pi-subagents" && externalWorkerIsolation === "enforce";
-}
-
-function ident(value: string): { ok: true; value: string } | { ok: false; error: string } {
-  const trimmed = value.trim();
-  if (!trimmed || trimmed !== value) {
-    return { ok: false, error: "must be a non-empty trimmed string" };
-  }
-  return { ok: true, value: trimmed };
-}
-
-export function createExternalRunsView(
-  sessionIdInput: string,
-  load: () => Promise<unknown> = () => import("pi-subagents/external-runs"),
-): Promise<ExternalRunsView> {
-  return (async () => {
-    const sessionId = ident(sessionIdInput);
-    if (!sessionId.ok) {
-      return disabledView(`invalid session id: ${sessionId.error}`);
-    }
-    let api: ExternalRunsApi | undefined;
-    let loadError: string | undefined;
-    try {
-      const mod = (await load()) as Record<string, unknown>;
-      const registerExternalRun = mod.registerExternalRun;
-      const unregisterExternalRun = mod.unregisterExternalRun;
-      if (typeof registerExternalRun !== "function" || typeof unregisterExternalRun !== "function") {
-        throw new Error("pi-subagents/external-runs does not expose registerExternalRun/unregisterExternalRun");
-      }
-      api = { registerExternalRun, unregisterExternalRun } as unknown as ExternalRunsApi;
-    } catch (error) {
-      loadError = `FleetView external-run registration unavailable: ${error instanceof Error ? error.message : String(error)}`;
-      // Never thrown: disable only the display path. Sandbox fail-closed and
-      // network approval for the supervisor are untouched.
-      return disabledView(loadError);
-    }
-
-    // (sessionId, workerId) pairs this extension registered, so we never
-    // duplicate-register and never unregister records owned by other sources.
-    const registered = new Map<string, number>();
-
-    return {
-      get enabled() {
-        return Boolean(api);
-      },
-      error: loadError,
-      registered(worker) {
-        const fullId = ident(worker.id);
-        const cwd = ident(worker.cwd);
-        if (!api || !fullId.ok || !cwd.ok) return;
-        if (registered.has(fullId.value)) return; // avoid duplicate registration
-        try {
-          api!.registerExternalRun({
-            id: fullId.value,
-            sessionId: sessionId.value,
-            source: VIEW_SOURCE,
-            label: VIEW_LABEL,
-            state: "running",
-            startedAt:
-              Number.isSafeInteger(worker.startedAt) && worker.startedAt > 0
-                ? worker.startedAt
-                : Date.now(),
-            preview: cwd.value,
-          });
-          registered.set(fullId.value, Date.now());
-        } catch (error) {
-          // Registry full / malformed record / unknown fields: log, do not emit.
-          console.error(
-            `pi-sandbox: could not register external run for worker '${fullId.value}': ${error instanceof Error ? error.message : String(error)}`,
-          );
-        }
-      },
-      unregistered(workerId) {
-        const fullId = ident(workerId);
-        if (!fullId.ok) return;
-        if (!registered.has(fullId.value)) return; // we did not register it
-        registered.delete(fullId.value);
-        if (api) {
-          try {
-            api.unregisterExternalRun(sessionId.value, fullId.value);
-          } catch {
-            // Best-effort; nothing else to fall back to.
-          }
-        }
-      },
-      close() {
-        for (const workerId of registered.keys()) {
-          if (api) {
-            try {
-              api.unregisterExternalRun(sessionId.value, workerId);
-            } catch {
-              // best-effort
-            }
-          }
-        }
-        registered.clear();
-      },
-    };
-  })();
-}
-
-function disabledView(error: string): ExternalRunsView {
-  console.error(`pi-sandbox: ${error}`);
-  return {
-    enabled: false,
-    error,
-    registered() {},
-    unregistered() {},
-    close() {},
-  };
-}

package/src/external-supervisor.ts

@@ -1,189 +0,0 @@
-import { randomBytes } from "node:crypto";
-import { createServer, type Server } from "node:net";
-import { chmod, mkdtemp, rm } from "node:fs/promises";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
-import type { NetworkEndpoint, TrapApprovalContext } from "./approval.ts";
-import { approveDomainEndpoint } from "./approval.ts";
-import type { NetworkConfig } from "./config.ts";
-
-const MAX_FRAME_BYTES = 16 * 1024;
-const PROTOCOL_VERSION = 1;
-
-type Request = {
-  version?: unknown;
-  capability?: unknown;
-  id?: unknown;
-  type?: unknown;
-  workerId?: unknown;
-  cwd?: unknown;
-  hostname?: unknown;
-  port?: unknown;
-};
-
-export type ExternalWorkerSupervisorLifecycle = {
-  /** Called immediately after a worker finishes the register protocol. */
-  registered?(worker: { id: string; cwd: string; startedAt: number }): void;
-  /** Called immediately after a worker completes the unregister protocol. */
-  unregistered?(worker: { id: string; cwd: string }): void;
-};
-
-export type ExternalWorkerSupervisor = {
-  socketPath: string;
-  capability: string;
-  workers(): ReadonlyArray<{
-    id: string;
-    cwd: string;
-    state: "active" | "exited";
-    startedAt: number;
-    requests: number;
-  }>;
-  close(): Promise<void>;
-};
-
-export async function createExternalWorkerSupervisor(
-  approvalContext: (worker: { id: string; cwd: string }) => TrapApprovalContext,
-  lifecycle: ExternalWorkerSupervisorLifecycle = {},
-  network: NetworkConfig = { allowedDomains: [], deniedDomains: [] },
-): Promise<ExternalWorkerSupervisor> {
-  const trustedNetwork = {
-    allowedDomains: [...network.allowedDomains],
-    deniedDomains: [...network.deniedDomains],
-  };
-  const directory = await mkdtemp(join(tmpdir(), "pi-sandbox-external-"));
-  await chmod(directory, 0o700);
-  const socketPath = join(directory, "supervisor.sock");
-  const capability = randomBytes(32).toString("hex");
-  const seen = new Set<string>();
-  const workers = new Map<string, {
-    cwd: string;
-    state: "active" | "exited";
-    startedAt: number;
-    requests: number;
-  }>();
-  const server: Server = createServer((socket) => {
-    let buffer = "";
-    socket.setEncoding("utf8");
-    socket.on("data", (chunk: string) => {
-      buffer += chunk;
-      if (Buffer.byteLength(buffer, "utf8") > MAX_FRAME_BYTES) {
-        socket.end('{"action":"deny"}\n');
-        return;
-      }
-      let newline = buffer.indexOf("\n");
-      while (newline >= 0) {
-        const line = buffer.slice(0, newline);
-        buffer = buffer.slice(newline + 1);
-        void respond(line);
-        newline = buffer.indexOf("\n");
-      }
-    });
-    const respond = async (line: string): Promise<void> => {
-      let request: Request | undefined;
-      try { request = JSON.parse(line) as Request; } catch { /* denied below */ }
-      if (!request) {
-        socket.write('{"action":"deny"}\n');
-        return;
-      }
-      const baseValid =
-        request.version === PROTOCOL_VERSION &&
-        request.capability === capability &&
-        typeof request.id === "string" && request.id.length > 0 && request.id.length <= 128 &&
-        !seen.has(request.id);
-      if (!baseValid) {
-        socket.write('{"action":"deny"}\n');
-        return;
-      }
-      const registered =
-        request.type === "register" &&
-        typeof request.workerId === "string" && request.workerId.length > 0 && request.workerId.length <= 128 &&
-        typeof request.cwd === "string" && request.cwd.startsWith("/") && request.cwd.length <= 4_096 &&
-        !workers.has(request.workerId);
-      if (registered) {
-        seen.add(request.id as string);
-        workers.set(request.workerId as string, {
-          cwd: request.cwd as string,
-          state: "active",
-          startedAt: Date.now(),
-          requests: 0,
-        });
-        socket.write(`${JSON.stringify({
-          id: request.id,
-          action: "allow",
-          network: {
-            allowedDomains: [...trustedNetwork.allowedDomains],
-            deniedDomains: [...trustedNetwork.deniedDomains],
-          },
-        })}\n`);
-        lifecycle.registered?.({
-          id: request.workerId as string,
-          cwd: request.cwd as string,
-          startedAt: workers.get(request.workerId as string)!.startedAt,
-        });
-        return;
-      }
-      const knownWorker =
-        typeof request.workerId === "string" && typeof request.cwd === "string"
-          ? workers.get(request.workerId)
-          : undefined;
-      const unregister = request.type === "unregister" &&
-        knownWorker?.state === "active" && knownWorker.cwd === request.cwd;
-      if (unregister) {
-        seen.add(request.id as string);
-        knownWorker.state = "exited";
-        socket.write(`${JSON.stringify({ id: request.id, action: "allow" })}\n`);
-        lifecycle.unregistered?.({
-          id: request.workerId as string,
-          cwd: request.cwd as string,
-        });
-        return;
-      }
-      const workerCwd =
-        knownWorker?.state === "active" ? knownWorker.cwd : undefined;
-      const valid = request.type === "network" &&
-        workerCwd === request.cwd &&
-        typeof request.hostname === "string" && request.hostname.length <= 253 &&
-        Number.isInteger(request.port) && Number(request.port) > 0 && Number(request.port) <= 65535 &&
-        Boolean(workerCwd);
-      if (!valid) {
-        socket.write('{"action":"deny"}\n');
-        return;
-      }
-      const approvedRequest = request as Required<Request>;
-      seen.add(approvedRequest.id as string);
-      knownWorker!.requests++;
-      let action: "allow" | "deny" = "deny";
-      try {
-        const endpoint: NetworkEndpoint = {
-          hostname: approvedRequest.hostname as string,
-          port: approvedRequest.port as number,
-          protocol: "tcp",
-        };
-        action = (await approveDomainEndpoint(endpoint, approvalContext({
-          id: approvedRequest.workerId as string,
-          cwd: workerCwd as string,
-        }))).action;
-      } catch {
-        action = "deny";
-      }
-      socket.write(`${JSON.stringify({ id: approvedRequest.id, action })}\n`);
-    };
-  });
-  await new Promise<void>((resolve, reject) => {
-    server.once("error", reject);
-    server.listen(socketPath, () => resolve());
-  });
-  return {
-    socketPath,
-    capability,
-    workers() {
-      return [...workers.entries()].map(([id, worker]) => ({ id, ...worker }));
-    },
-    async close() {
-      await new Promise<void>((resolve) => server.close(() => resolve()));
-      await rm(directory, { recursive: true, force: true });
-    },
-  };
-}
-
-export const EXTERNAL_SUPERVISOR_PROTOCOL_VERSION = PROTOCOL_VERSION;

package/src/external-worker-launcher.mjs

@@ -1,266 +0,0 @@
-#!/usr/bin/env node
-// Public PI_SUBAGENT_PI_BINARY wrapper. It deliberately has no host fallback:
-// failure to initialize the broker prevents the worker from starting.
-import { fork } from "node:child_process";
-import { createConnection } from "node:net";
-import { randomUUID } from "node:crypto";
-import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, rmdirSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
-import { homedir, tmpdir } from "node:os";
-import { dirname, join, parse, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-import { decodeExternalNetworkPolicy } from "./external-network-policy.mjs";
-
-const realPi = process.env.PI_SANDBOX_EXTERNAL_REAL_PI_BINARY;
-const workerId = randomUUID();
-
-function worktreeGitReadPaths(cwd) {
-  const dotGit = join(cwd, ".git");
-  try {
-    const pointer = readFileSync(dotGit, "utf8").match(/^gitdir:\s*(.+)\s*$/m)?.[1];
-    if (!pointer) return [];
-    const gitDir = resolve(cwd, pointer);
-    const paths = [gitDir];
-    try {
-      const common = readFileSync(join(gitDir, "commondir"), "utf8").trim();
-      if (common) paths.push(resolve(gitDir, common));
-    } catch { /* a direct worktree gitdir has no commondir */ }
-    return paths;
-  } catch {
-    return [];
-  }
-}
-
-function supervisorRequest(payload) {
-  const socketPath = process.env.PI_SANDBOX_EXTERNAL_SUPERVISOR_SOCKET;
-  const capability = process.env.PI_SANDBOX_EXTERNAL_SUPERVISOR_CAPABILITY;
-  if (!socketPath || !capability) return Promise.resolve({ action: "deny" });
-  return new Promise((resolveResponse) => {
-    const socket = createConnection(socketPath);
-    let buffer = "";
-    const finish = (response) => {
-      socket.destroy();
-      resolveResponse(response?.action === "allow" ? response : { action: "deny" });
-    };
-    socket.setEncoding("utf8");
-    socket.setTimeout(30_000, () => finish({ action: "deny" }));
-    socket.once("error", () => finish({ action: "deny" }));
-    socket.on("data", (chunk) => {
-      buffer += chunk;
-      const newline = buffer.indexOf("\n");
-      if (newline < 0 || Buffer.byteLength(buffer, "utf8") > 16 * 1024) return;
-      try { finish(JSON.parse(buffer.slice(0, newline))); } catch { finish({ action: "deny" }); }
-    });
-    socket.once("connect", () => socket.write(`${JSON.stringify({
-      version: 1, capability, id: randomUUID(), ...payload,
-    })}\n`));
-  });
-}
-function registerWorker() {
-  return supervisorRequest({ type: "register", workerId, cwd: process.cwd() });
-}
-function unregisterWorker() {
-  return supervisorRequest({ type: "unregister", workerId, cwd: process.cwd() }).then((response) => response.action);
-}
-function askSupervisor(hostname, port) {
-  return supervisorRequest({ type: "network", workerId, cwd: process.cwd(), hostname, port }).then((response) => response.action);
-}
-
-function createMandatoryDenyPlaceholders(cwd, agentDir) {
-  // Sandbox Runtime protects these names unconditionally. Under an outer
-  // bubblewrap it cannot create a missing bind target after the root becomes
-  // read-only, so create only absent regular-file placeholders before broker
-  // bootstrap and remove exactly those placeholders at wrapper exit.
-  const created = [];
-  const remember = (path, kind, content) => {
-    const stat = lstatSync(path);
-    created.push({ path, kind, content, dev: stat.dev, ino: stat.ino });
-  };
-  for (const name of [
-    ".gitconfig", ".gitmodules", ".bashrc", ".bash_profile", ".zshrc",
-    ".zprofile", ".profile", ".ripgreprc", ".mcp.json",
-  ]) {
-    const path = join(cwd, name);
-    if (existsSync(path)) continue;
-    try {
-      writeFileSync(path, "", { flag: "wx", mode: 0o600 });
-      remember(path, "file", "");
-    } catch {
-      // Sandbox bootstrap will fail closed if a mandatory target is unusable.
-    }
-  }
-  for (const directory of [".vscode", ".idea", ".claude/commands", ".claude/agents"]) {
-    let path = cwd;
-    for (const part of directory.split("/")) {
-      path = join(path, part);
-      if (existsSync(path)) continue;
-      try {
-        mkdirSync(path, { mode: 0o700 });
-        remember(path, "directory");
-      } catch {
-        // Sandbox bootstrap will fail closed if a mandatory target is unusable.
-        break;
-      }
-    }
-  }
-  // Keep the project-state directory available so denyWrite can bind missing
-  // security files at their exact paths instead of masking the first missing
-  // `.pi` component and preventing ordinary project-state creation.
-  const projectState = join(cwd, ".pi");
-  if (!existsSync(projectState)) {
-    try {
-      mkdirSync(projectState, { mode: 0o700 });
-      remember(projectState, "directory");
-    } catch {
-      // Sandbox bootstrap will fail closed if the directory remains unusable.
-    }
-  }
-  // The agent directory sits below denyRead(home). Bubblewrap cannot create a
-  // missing nested bind target there after the home mask becomes read-only, so
-  // seed valid empty JSON files and remove only unchanged placeholders later.
-  for (const name of ["settings.json", "permissions.json", "sandbox.json"]) {
-    const path = join(agentDir, name);
-    if (existsSync(path)) continue;
-    try {
-      writeFileSync(path, "{}\n", { flag: "wx", mode: 0o600 });
-      remember(path, "file", "{}\n");
-    } catch {
-      // Sandbox bootstrap will fail closed if a protected target is unusable.
-    }
-  }
-  return () => {
-    for (const item of created.reverse()) {
-      try {
-        const current = lstatSync(item.path);
-        if (current.dev !== item.dev || current.ino !== item.ino) continue;
-        if (item.kind === "directory") rmdirSync(item.path);
-        else if (readFileSync(item.path, "utf8") === item.content) unlinkSync(item.path);
-      } catch { /* remove only unchanged empty placeholders */ }
-    }
-  };
-}
-if (!realPi) {
-  process.stderr.write("pi-sandbox: external worker wrapper has no verified Pi binary\n");
-  process.exitCode = 1;
-} else {
-  const cwd = process.cwd();
-  const workerTempDir = mkdtempSync(join(tmpdir(), "pi-sandbox-external-worker-"));
-  process.once("exit", () => {
-    try { rmSync(workerTempDir, { recursive: true, force: true }); } catch { /* best-effort cleanup */ }
-  });
-  const home = resolve(homedir());
-  const agentDir = resolve(process.env.PI_CODING_AGENT_DIR || join(home, ".pi", "agent"));
-  const removeMandatoryDenyPlaceholders = createMandatoryDenyPlaceholders(cwd, agentDir);
-  process.once("exit", removeMandatoryDenyPlaceholders);
-  const sessionDir = process.env.PI_CODING_AGENT_SESSION_DIR;
-  const packageRoot = dirname(fileURLToPath(import.meta.url));
-  const nodeRoot = dirname(dirname(process.execPath));
-  const runtimeRoot = dirname(dirname(fileURLToPath(import.meta.resolve("@anthropic-ai/sandbox-runtime"))));
-  const extraRead = (process.env.PI_SANDBOX_EXTERNAL_ALLOW_READ || "")
-    .split(":")
-    .filter(Boolean);
-  const existingGitConfig = [
-    join(home, ".gitconfig"),
-    join(home, ".config", "git", "config"),
-  ].filter(existsSync);
-  // On Linux Sandbox Runtime masks the first missing component of a deny path.
-  // Denying a not-yet-created `.pi/settings.json` would therefore mask `.pi`
-  // itself and prevent Pi from creating its ordinary project state directory.
-  // Existing security files remain outer-sandbox protected; creation attempts
-  // are still gated by permission-system and pi-auto-review.
-  const workspaceSecurityFiles = [
-    join(cwd, ".pi", "settings.json"),
-    join(cwd, ".pi", "sandbox.json"),
-    join(cwd, ".pi", "pi-auto-review.json"),
-  ];
-  const agentSecurityPaths = [
-    join(agentDir, "settings.json"),
-    join(agentDir, "permissions.json"),
-    join(agentDir, "sandbox.json"),
-    join(agentDir, "extensions"),
-  ];
-  const registration = await registerWorker();
-  if (registration.action !== "allow") {
-    process.stderr.write("pi-sandbox: external worker registration was denied\n");
-    process.exitCode = 1;
-    process.exit();
-  }
-  const registeredNetwork = decodeExternalNetworkPolicy(registration.network);
-  const runtimeConfig = {
-    filesystem: {
-      denyRead: home === parse(home).root ? [] : [home],
-      allowRead: [cwd, nodeRoot, runtimeRoot, ...existingGitConfig, "/dev/null", ...worktreeGitReadPaths(cwd), ...extraRead],
-      // Child sessions and permission-forwarding request/response files live
-      // here. Keep this narrower than the agent directory, whose security
-      // settings and extensions remain read-only.
-      allowWrite: [
-        cwd,
-        "/dev/null",
-        workerTempDir,
-        ...(sessionDir?.startsWith("/") ? [sessionDir] : []),
-        // Pi creates directory-style settings locks and provider model caches
-        // beside its global settings. Security-sensitive files and extensions
-        // below remain explicit denyWrite entries.
-        agentDir,
-      ],
-      denyWrite: [
-        ...workspaceSecurityFiles,
-        ...agentSecurityPaths,
-        packageRoot,
-        dirname(process.execPath),
-      ],
-      allowGitConfig: true,
-    },
-    network: {
-      allowedDomains: registeredNetwork.allowedDomains,
-      deniedDomains: registeredNetwork.deniedDomains,
-      allowAllUnixSockets: false, allowUnixSockets: [],
-      allowLocalBinding: false,
-    },
-  };
-  const broker = fork(new URL("./srt-broker.mjs", import.meta.url), [], {
-    cwd,
-    detached: true,
-    env: {
-      ...process.env,
-      PI_SANDBOX_TMPDIR: workerTempDir,
-      CLAUDE_CODE_TMPDIR: workerTempDir,
-      TMPDIR: workerTempDir,
-      TMP: workerTempDir,
-      TEMP: workerTempDir,
-    },
-    stdio: ["pipe", "pipe", "pipe", "ipc"],
-  });
-  broker.stdout.pipe(process.stdout);
-  broker.stderr.pipe(process.stderr);
-  process.stdin.pipe(broker.stdin);
-  broker.on("message", (message) => {
-    if (!message || typeof message !== "object" || message.type !== "network-request") return;
-    void askSupervisor(message.hostname, message.port).then((action) => {
-      if (broker.connected) broker.send({ type: "network-response", id: message.id, action });
-    });
-  });
-  let prefix = [];
-  try { prefix = JSON.parse(process.env.PI_SANDBOX_EXTERNAL_REAL_PI_PREFIX || "[]"); } catch { prefix = []; }
-  if (!Array.isArray(prefix) || prefix.some((item) => typeof item !== "string")) {
-    process.stderr.write("pi-sandbox: external worker wrapper received invalid Pi prefix\n");
-    broker.kill("SIGKILL");
-    process.exitCode = 1;
-  } else {
-    broker.send({ type: "init", invocation: [realPi, ...prefix, ...process.argv.slice(2)], runtimeConfig });
-  }
-  const stop = (signal) => {
-    if (broker.pid) {
-      try { process.kill(-broker.pid, signal); } catch { broker.kill(signal); }
-    }
-  };
-  process.on("SIGINT", () => stop("SIGINT"));
-  process.on("SIGTERM", () => stop("SIGTERM"));
-  broker.once("exit", async (code, signal) => {
-    await unregisterWorker();
-    process.exitCode = code ?? (signal ? 1 : 1);
-  });
-  broker.once("error", (error) => {
-    process.stderr.write(`pi-sandbox: external worker broker failed: ${error.message}\n`);
-    process.exitCode = 1;
-  });
-}