@getforgeai/cli 0.1.0-beta.1

package/dist/vm/vm-manager.js

@@ -0,0 +1,515 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync, rmSync, } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { createServer } from "node:net";
+import { spawn as spawnChild } from "node:child_process";
+import { ensureRootfs } from "./image-manager.js";
+import { vmLog } from "./log.js";
+const SESSIONS_DIR = join(homedir(), ".forgeai", "vm", "sessions");
+/** Fixed port inside VM for MCP reverse tunnel */
+const MCP_TUNNEL_PORT = 19876;
+/**
+ * Resolve the ForgeAI CLI binary path for spawning `forge mcp` on the host.
+ */
+function resolveForgeBinary() {
+    const scriptPath = process.argv[1];
+    if (scriptPath) {
+        return { command: process.execPath, prefixArgs: [scriptPath] };
+    }
+    return { command: "forgeai", prefixArgs: [] };
+}
+/**
+ * TCP bridge that runs `forge mcp` on the host and exposes it as a TCP server.
+ * Each client connection (from the VM via SSH reverse tunnel) gets its own
+ * `forge mcp` subprocess with stdio piped through TCP.
+ */
+class McpTcpBridge {
+    context;
+    server = null;
+    port = 0;
+    constructor(context) {
+        this.context = context;
+    }
+    async start() {
+        return new Promise((resolve, reject) => {
+            this.server = createServer((socket) => {
+                // Spawn forge mcp for each connection
+                const { command, prefixArgs } = resolveForgeBinary();
+                const mcpArgs = [
+                    ...prefixArgs,
+                    "mcp",
+                    "--task-id",
+                    this.context.taskId,
+                    "--project-id",
+                    this.context.projectId,
+                    "--org-id",
+                    this.context.orgId,
+                ];
+                if (this.context.workflowId) {
+                    mcpArgs.push("--workflow-id", this.context.workflowId);
+                }
+                if (this.context.stepId) {
+                    mcpArgs.push("--step-id", this.context.stepId);
+                }
+                const mcpProc = spawnChild(command, mcpArgs, {
+                    stdio: ["pipe", "pipe", "ignore"],
+                });
+                // Bridge TCP ↔ stdio
+                socket.pipe(mcpProc.stdin);
+                mcpProc.stdout.pipe(socket);
+                socket.on("close", () => mcpProc.kill());
+                mcpProc.on("exit", () => socket.destroy());
+            });
+            this.server.listen(0, "127.0.0.1", () => {
+                const addr = this.server.address();
+                if (addr && typeof addr === "object") {
+                    this.port = addr.port;
+                }
+                resolve();
+            });
+            this.server.on("error", reject);
+        });
+    }
+    stop() {
+        if (this.server) {
+            this.server.close();
+            this.server = null;
+        }
+    }
+}
+/**
+ * Extract git credentials from the host's credential helper (e.g. osxkeychain).
+ * Returns null if no credentials found.
+ */
+async function extractHostGitCredentials(repoUrl) {
+    try {
+        const url = new URL(repoUrl);
+        const { exec: execCb } = await import("node:child_process");
+        const { promisify } = await import("node:util");
+        const execPromise = promisify(execCb);
+        const input = `protocol=${url.protocol.replace(":", "")}\nhost=${url.hostname}\n`;
+        const { stdout } = await execPromise(`printf '${input}' | git credential fill`, { timeout: 10_000 });
+        const lines = stdout.split("\n");
+        let username = "";
+        let password = "";
+        for (const line of lines) {
+            if (line.startsWith("username="))
+                username = line.slice(9);
+            if (line.startsWith("password="))
+                password = line.slice(9);
+        }
+        if (username && password) {
+            return { username, password };
+        }
+    }
+    catch {
+        // Credential helper not available or failed
+    }
+    return null;
+}
+const DEFAULT_CPUS = 4;
+const DEFAULT_MEMORY_MB = 6144;
+const DEFAULT_VSOCK_PORT = 6789;
+/**
+ * Network allowlist using IP CIDR ranges instead of hostnames.
+ * Iptables resolves hostnames at rule creation time only — IP ranges are reliable.
+ *
+ * Anthropic API: 104.18.0.0/16 (Cloudflare)
+ * GitHub: 140.82.112.0/20, 185.199.108.0/22, 143.55.64.0/20
+ * GitLab: 172.65.0.0/16 (Cloudflare)
+ * npm registry: 104.16.0.0/12 (Cloudflare)
+ * PyPI: 151.101.0.0/16 (Fastly)
+ * DNS: 8.8.8.8, 1.1.1.1
+ */
+const DEFAULT_NETWORK_ALLOWLIST = [
+    // DNS (required for git clone and package install)
+    { cidr: "8.8.8.8/32", port: 53, protocol: "udp" },
+    { cidr: "1.1.1.1/32", port: 53, protocol: "udp" },
+    // Anthropic API (Cloudflare)
+    { cidr: "104.18.0.0/16", port: 443, protocol: "tcp" },
+    // GitHub
+    { cidr: "140.82.112.0/20", port: 443, protocol: "tcp" },
+    { cidr: "140.82.112.0/20", port: 22, protocol: "tcp" },
+    { cidr: "185.199.108.0/22", port: 443, protocol: "tcp" },
+    { cidr: "143.55.64.0/20", port: 443, protocol: "tcp" },
+    { cidr: "143.55.64.0/20", port: 22, protocol: "tcp" },
+    // GitLab (Cloudflare)
+    { cidr: "172.65.0.0/16", port: 443, protocol: "tcp" },
+    { cidr: "172.65.0.0/16", port: 22, protocol: "tcp" },
+    // npm registry (Cloudflare)
+    { cidr: "104.16.0.0/12", port: 443, protocol: "tcp" },
+    // PyPI (Fastly)
+    { cidr: "151.101.0.0/16", port: 443, protocol: "tcp" },
+];
+let vmManagerInstance = null;
+export function getVmManager() {
+    if (!vmManagerInstance) {
+        throw new Error("VmManager not initialized. Call initVmManager() first.");
+    }
+    return vmManagerInstance;
+}
+export function initVmManager(provider) {
+    vmManagerInstance = new VmManager(provider);
+    return vmManagerInstance;
+}
+export class VmManager {
+    provider;
+    sessions = new Map();
+    constructor(provider) {
+        this.provider = provider;
+    }
+    async createSession(taskId, config) {
+        const sanitizedId = taskId.slice(0, 12).replace(/[^a-zA-Z0-9-]/g, "");
+        const sessionId = `forgeai-${sanitizedId}`;
+        const sessionDir = join(SESSIONS_DIR, sessionId);
+        if (!existsSync(SESSIONS_DIR)) {
+            mkdirSync(SESSIONS_DIR, { recursive: true, mode: 0o700 });
+        }
+        mkdirSync(sessionDir, { recursive: true, mode: 0o700 });
+        const session = {
+            id: sessionId,
+            taskId,
+            vmInfo: null,
+            sessionDir,
+            config,
+            status: "CREATED",
+        };
+        this.sessions.set(taskId, session);
+        vmLog.info("vm-manager", `Session created: ${sessionId} for task ${taskId}`);
+        return sessionId;
+    }
+    async bootVm(sessionId) {
+        const session = this.findSession(sessionId);
+        session.status = "BOOTING";
+        const rootfsPath = await ensureRootfs();
+        const vmInfo = await this.provider.start(sessionId, {
+            cpus: DEFAULT_CPUS,
+            memoryMB: DEFAULT_MEMORY_MB,
+            rootfsPath,
+            sessionDir: session.sessionDir,
+            networkAllowlist: DEFAULT_NETWORK_ALLOWLIST,
+            vsockPort: DEFAULT_VSOCK_PORT,
+        });
+        session.vmInfo = vmInfo;
+        session.status = "RUNNING";
+        // Mount VirtioFS shared directory (host session dir → /session in VM)
+        await this.provider.exec(sessionId, "sudo", ["mkdir", "-p", "/session"]);
+        await this.provider.exec(sessionId, "sudo", [
+            "mount",
+            "-t",
+            "virtiofs",
+            "session",
+            "/session",
+        ]);
+        vmLog.dim("vm-manager", `VirtioFS mounted at /session`);
+        // Ensure swap exists (prevents OOM kills when Claude Code uses too much memory)
+        await this.provider.exec(sessionId, "sudo", [
+            "bash",
+            "-c",
+            "if [ ! -f /swapfile ]; then fallocate -l 512M /swapfile && chmod 600 /swapfile && mkswap /swapfile && swapon /swapfile; fi",
+        ]);
+        // Provision the VM with required tools (Node.js, Claude Code CLI)
+        await this.provisionVm(sessionId);
+        vmLog.info("vm-manager", `VM booted: ${sessionId} (CID: ${vmInfo.vsockCid ?? "N/A"})`);
+        return vmInfo;
+    }
+    async cloneRepo(sessionId, repoUrl, branch, baseBranch) {
+        if (!repoUrl) {
+            vmLog.warn("vm-manager", `No repoUrl for session ${sessionId}, skipping clone`);
+            return;
+        }
+        vmLog.cyan("vm-manager", `Cloning repo in VM ${sessionId}...`);
+        // Ensure /workspace exists and is owned by the SSH user
+        await this.provider.exec(sessionId, "sudo", ["mkdir", "-p", "/workspace"]);
+        await this.provider.exec(sessionId, "sudo", [
+            "chown",
+            "-R",
+            "ubuntu:ubuntu",
+            "/workspace",
+        ]);
+        // Resolve authenticated clone URL from host's git credential helper.
+        // Works with any credential helper: osxkeychain (macOS), wincred (Windows),
+        // credential-store/cache (Linux), GitHub CLI (gh auth setup-git).
+        // The token is injected into the URL — never persisted on the VM disk.
+        const cloneUrl = await this.resolveAuthenticatedUrl(repoUrl);
+        const cloneResult = await this.provider.exec(sessionId, "git", [
+            "clone",
+            cloneUrl,
+            "/workspace",
+        ]);
+        if (cloneResult.exitCode !== 0) {
+            throw new Error(`Git clone failed in VM (exit ${cloneResult.exitCode}): ${cloneResult.stderr}`);
+        }
+        if (branch) {
+            // Try checkout — if branch doesn't exist, create it from baseBranch or HEAD
+            const checkoutResult = await this.provider.exec(sessionId, "git", [
+                "-C",
+                "/workspace",
+                "checkout",
+                branch,
+            ]);
+            if (checkoutResult.exitCode !== 0) {
+                // Branch doesn't exist on remote — create from baseBranch (remote ref) or HEAD
+                const base = baseBranch ? `origin/${baseBranch}` : "HEAD";
+                vmLog.dim("vm-manager", `Branch ${branch} not found, creating from ${base}`);
+                const createResult = await this.provider.exec(sessionId, "git", [
+                    "-C",
+                    "/workspace",
+                    "checkout",
+                    "-b",
+                    branch,
+                    base,
+                ]);
+                if (createResult.exitCode !== 0) {
+                    throw new Error(`Failed to create branch ${branch} from ${base} in VM: ${createResult.stderr}`);
+                }
+                // Push the new branch to remote
+                await this.provider.exec(sessionId, "git", [
+                    "-C",
+                    "/workspace",
+                    "push",
+                    "-u",
+                    "origin",
+                    branch,
+                ]);
+            }
+            vmLog.info("vm-manager", `Checked out branch ${branch} in VM ${sessionId}`);
+        }
+    }
+    async prepareWorkspace(sessionId, files) {
+        const session = this.findSession(sessionId);
+        // Write files to host session dir (mounted via VirtioFS at /session in VM)
+        writeFileSync(join(session.sessionDir, "context.json"), files.contextJson, "utf-8");
+        writeFileSync(join(session.sessionDir, "mcp_config.json"), files.mcpConfigJson, "utf-8");
+        for (const skillFile of files.skillFiles) {
+            if (skillFile.relativePath.includes("..")) {
+                throw new Error(`Path traversal detected in skill file: ${skillFile.relativePath}`);
+            }
+            const skillPath = join(session.sessionDir, "skills", skillFile.relativePath);
+            mkdirSync(join(skillPath, ".."), { recursive: true });
+            writeFileSync(skillPath, skillFile.content, "utf-8");
+        }
+        // Copy from VirtioFS mount (/session) to workspace inside VM
+        await this.provider.exec(sessionId, "mkdir", ["-p", "/workspace/.forgeai"]);
+        await this.provider.exec(sessionId, "mkdir", ["-p", "/workspace/.claude"]);
+        await this.provider.exec(sessionId, "cp", [
+            "/session/context.json",
+            "/workspace/.forgeai/context.json",
+        ]);
+        await this.provider.exec(sessionId, "cp", [
+            "/session/mcp_config.json",
+            "/workspace/.claude/mcp_config.json",
+        ]);
+        if (files.skillFiles.length > 0) {
+            await this.provider.exec(sessionId, "mkdir", [
+                "-p",
+                "/workspace/.claude/skills",
+            ]);
+            await this.provider.exec(sessionId, "cp", [
+                "-r",
+                "/session/skills/.",
+                "/workspace/.claude/skills/",
+            ]);
+        }
+        vmLog.info("vm-manager", `Workspace prepared in VM ${sessionId}`);
+    }
+    /**
+     * Provision the VM with required tools after boot.
+     * Skips if image is pre-baked (claude already installed via build.sh).
+     * Fallback installs Node.js + Claude CLI if using a stock Ubuntu image.
+     */
+    async provisionVm(sessionId) {
+        // Install tools only if not pre-baked
+        const check = await this.provider.exec(sessionId, "which", ["claude"]);
+        if (check.exitCode === 0) {
+            vmLog.dim("vm-manager", `Pre-baked image — skipping tool installation`);
+        }
+        else {
+            vmLog.cyan("vm-manager", `Provisioning VM ${sessionId} (installing Node.js + Claude CLI)...`);
+            const installResult = await this.provider.exec(sessionId, "sudo", [
+                "bash",
+                "-c",
+                "curl -fsSL https://deb.nodesource.com/setup_20.x | bash - && apt-get install -y nodejs && npm install -g @anthropic-ai/claude-code",
+            ]);
+            if (installResult.exitCode !== 0) {
+                throw new Error(`Failed to install Node.js and Claude CLI in VM: ${installResult.stderr}`);
+            }
+        }
+        // Always inject credentials (per-session, not baked into image)
+        await this.injectClaudeCredentials(sessionId);
+        vmLog.info("vm-manager", `VM provisioned`);
+    }
+    /**
+     * Inject Claude Code credentials into the VM.
+     * Supports:
+     * - macOS Keychain (Pro/Max subscription via OAuth)
+     * - ~/.claude/.credentials.json (Linux/manual setup)
+     * - ANTHROPIC_API_KEY env var (API key fallback — handled at spawn time)
+     */
+    async injectClaudeCredentials(sessionId) {
+        let credentials = null;
+        // 1. Try macOS Keychain (Pro/Max subscription)
+        if (process.platform === "darwin") {
+            try {
+                const { exec: execCb } = await import("node:child_process");
+                const { promisify } = await import("node:util");
+                const execPromise = promisify(execCb);
+                const { stdout } = await execPromise('security find-generic-password -s "Claude Code-credentials" -w', { timeout: 5_000 });
+                if (stdout.trim()) {
+                    credentials = stdout.trim();
+                }
+            }
+            catch {
+                // No Keychain entry — fall through
+            }
+        }
+        // 2. Try ~/.claude/.credentials.json (Linux/Windows or manual export)
+        if (!credentials) {
+            const credPath = join(homedir(), ".claude", ".credentials.json");
+            if (existsSync(credPath)) {
+                credentials = readFileSync(credPath, "utf-8");
+            }
+        }
+        if (!credentials) {
+            // No credentials found — ANTHROPIC_API_KEY will be used at spawn time
+            if (!process.env.ANTHROPIC_API_KEY) {
+                vmLog.warn("vm-manager", `No Claude credentials found. Set ANTHROPIC_API_KEY or run 'claude /login' first.`);
+            }
+            return;
+        }
+        // Write credentials to VM
+        vmLog.dim("vm-manager", `Injecting Claude credentials into VM`);
+        await this.provider.exec(sessionId, "mkdir", [
+            "-p",
+            "/home/ubuntu/.claude",
+        ]);
+        // Use printf to write the credentials (avoids quoting issues with echo)
+        const escaped = credentials.replace(/'/g, "'\\''");
+        await this.provider.exec(sessionId, "bash", [
+            "-c",
+            `printf '%s' '${escaped}' > /home/ubuntu/.claude/.credentials.json && chmod 600 /home/ubuntu/.claude/.credentials.json`,
+        ]);
+    }
+    /**
+     * Resolve an authenticated clone URL by extracting credentials from the host.
+     * Uses `git credential fill` which delegates to the user's credential helper
+     * (osxkeychain, wincred, credential-store, GitHub CLI, etc.).
+     *
+     * For SSH URLs, returns as-is (SSH agent forwarding handles auth).
+     * For HTTPS URLs, injects the token into the URL (ephemeral, never persisted in VM).
+     */
+    async resolveAuthenticatedUrl(repoUrl) {
+        // SSH URLs don't need credential extraction
+        if (repoUrl.startsWith("git@") || repoUrl.startsWith("ssh://")) {
+            return repoUrl;
+        }
+        const creds = await extractHostGitCredentials(repoUrl);
+        if (creds) {
+            const url = new URL(repoUrl);
+            url.username = creds.username;
+            url.password = creds.password;
+            return url.toString();
+        }
+        throw new Error(`No git credentials found for ${repoUrl}. ` +
+            "Ensure your git credential helper is configured " +
+            "(macOS: osxkeychain, Windows: wincred, Linux: credential-store, or gh auth setup-git).");
+    }
+    async spawnAgent(sessionId, cmd, args, mcpContext) {
+        const session = this.findSession(sessionId);
+        if (!session.vmInfo) {
+            throw new Error(`VM not booted for session ${sessionId}`);
+        }
+        // Start MCP bridge on host if context is provided
+        let mcpBridge;
+        const reverseTunnels = [];
+        if (mcpContext) {
+            mcpBridge = new McpTcpBridge(mcpContext);
+            await mcpBridge.start();
+            reverseTunnels.push({
+                remotePort: MCP_TUNNEL_PORT,
+                localPort: mcpBridge.port,
+            });
+            vmLog.dim("vm-manager", `MCP bridge on host port ${mcpBridge.port} → VM port ${MCP_TUNNEL_PORT}`);
+        }
+        // Spawn agent via SSH streaming with reverse tunnel for MCP
+        const result = this.provider.spawnStreaming(sessionId, cmd, args, "/workspace", {
+            reverseTunnels,
+        });
+        // Clean up when agent exits: stop MCP bridge + destroy VM
+        // Capture the current VM PID to avoid destroying a replacement VM (race condition
+        // when stop-and-replace creates a new VM with the same session ID)
+        const sid = sessionId;
+        const vmPid = result.pid;
+        result.process.once("exit", () => {
+            if (mcpBridge)
+                mcpBridge.stop();
+            // Only destroy if the session still belongs to this VM (not replaced)
+            const currentSession = this.findSessionOptional(sid);
+            if (currentSession?.vmInfo?.pid === vmPid) {
+                this.destroySession(sid).catch((err) => {
+                    vmLog.warn("vm-manager", `Failed to destroy session ${sid} after exit: ${err instanceof Error ? err.message : String(err)}`);
+                });
+            }
+            else {
+                vmLog.dim("vm-manager", `Skipping destroy for ${sid} — session replaced by new VM`);
+            }
+        });
+        vmLog.info("vm-manager", `Agent spawned in VM ${sessionId} (PID: ${result.pid})`);
+        return result;
+    }
+    async stopVm(sessionId) {
+        try {
+            await this.provider.stop(sessionId);
+            const session = this.findSessionOptional(sessionId);
+            if (session) {
+                session.status = "STOPPED";
+            }
+            vmLog.info("vm-manager", `VM stopped: ${sessionId}`);
+        }
+        catch (err) {
+            vmLog.warn("vm-manager", `Error stopping VM ${sessionId}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    async destroySession(sessionId) {
+        try {
+            await this.provider.destroy(sessionId);
+        }
+        catch {
+            // Best-effort destroy
+        }
+        // Find task ID from session
+        for (const [taskId, session] of this.sessions) {
+            if (session.id === sessionId) {
+                this.sessions.delete(taskId);
+                break;
+            }
+        }
+        // Clean up session directory
+        const sessionDir = join(SESSIONS_DIR, sessionId);
+        if (existsSync(sessionDir)) {
+            rmSync(sessionDir, { recursive: true, force: true });
+        }
+        vmLog.info("vm-manager", `Session destroyed: ${sessionId}`);
+    }
+    getSession(taskId) {
+        return this.sessions.get(taskId);
+    }
+    getAllSessions() {
+        return Array.from(this.sessions.values());
+    }
+    findSession(sessionId) {
+        for (const session of this.sessions.values()) {
+            if (session.id === sessionId)
+                return session;
+        }
+        throw new Error(`Session not found: ${sessionId}`);
+    }
+    findSessionOptional(sessionId) {
+        for (const session of this.sessions.values()) {
+            if (session.id === sessionId)
+                return session;
+        }
+        return undefined;
+    }
+}
+//# sourceMappingURL=vm-manager.js.map

package/dist/vm/vm-process-proxy.d.ts

@@ -0,0 +1,34 @@
+/**
+ * EventEmitter-based proxy that wraps vsock streams into an AgentProcess.
+ *
+ * The native VM addon delivers stdout/stderr data via vsock port callbacks.
+ * This class buffers that data into PassThrough streams and emits the same
+ * events (exit, close, error) that ChildProcess would, so the orchestrator's
+ * attachProcessHandlers() works identically for both local and VM agents.
+ */
+import { EventEmitter } from "node:events";
+import { PassThrough } from "node:stream";
+import type { AgentProcess } from "../orchestrator/connectors/connector.js";
+export declare class VmProcessProxy extends EventEmitter implements AgentProcess {
+    private readonly sessionId;
+    private readonly _sessionIndex;
+    readonly stdout: PassThrough;
+    readonly stderr: PassThrough;
+    pid: number;
+    exitCode: number | null;
+    killed: boolean;
+    constructor(sessionId: string, _sessionIndex: number);
+    /** Called by SessionManager once vminitd reports the sandbox PID */
+    setPid(pid: number): void;
+    /** Push raw stdout data from the vsock stream */
+    pushStdout(data: Buffer): void;
+    /** Push raw stderr data from the vsock stream */
+    pushStderr(data: Buffer): void;
+    /**
+     * Kill the agent process inside the VM sandbox.
+     * Returns true if the kill signal was sent, false if the process was already dead.
+     * Per AgentProcess interface, this must be synchronous (returns boolean, not Promise).
+     */
+    kill(signal?: string): boolean;
+}
+//# sourceMappingURL=vm-process-proxy.d.ts.map

package/dist/vm/vm-process-proxy.js

@@ -0,0 +1,64 @@
+/**
+ * EventEmitter-based proxy that wraps vsock streams into an AgentProcess.
+ *
+ * The native VM addon delivers stdout/stderr data via vsock port callbacks.
+ * This class buffers that data into PassThrough streams and emits the same
+ * events (exit, close, error) that ChildProcess would, so the orchestrator's
+ * attachProcessHandlers() works identically for both local and VM agents.
+ */
+import { EventEmitter } from "node:events";
+import { PassThrough } from "node:stream";
+import { getSessionManager } from "./session-manager.js";
+export class VmProcessProxy extends EventEmitter {
+    sessionId;
+    _sessionIndex;
+    stdout;
+    stderr;
+    pid = -1;
+    exitCode = null;
+    killed = false;
+    constructor(sessionId, _sessionIndex) {
+        super();
+        this.sessionId = sessionId;
+        this._sessionIndex = _sessionIndex;
+        this.stdout = new PassThrough();
+        this.stderr = new PassThrough();
+        // Register for exit events relayed by SessionManager's control channel handler
+        const sm = getSessionManager();
+        sm.onSessionExit(sessionId, (code) => {
+            this.exitCode = code;
+            this.stdout.end();
+            this.stderr.end();
+            this.emit("exit", code, null);
+            this.emit("close", code, null);
+        });
+    }
+    /** Called by SessionManager once vminitd reports the sandbox PID */
+    setPid(pid) {
+        this.pid = pid;
+    }
+    /** Push raw stdout data from the vsock stream */
+    pushStdout(data) {
+        this.stdout.push(data);
+    }
+    /** Push raw stderr data from the vsock stream */
+    pushStderr(data) {
+        this.stderr.push(data);
+    }
+    /**
+     * Kill the agent process inside the VM sandbox.
+     * Returns true if the kill signal was sent, false if the process was already dead.
+     * Per AgentProcess interface, this must be synchronous (returns boolean, not Promise).
+     */
+    kill(signal) {
+        if (this.exitCode !== null || this.killed)
+            return false;
+        this.killed = true;
+        const sm = getSessionManager();
+        sm.killAgent(this.sessionId, signal ?? "SIGTERM").catch(() => {
+            /* best effort — process may already be gone */
+        });
+        return true;
+    }
+}
+//# sourceMappingURL=vm-process-proxy.js.map

package/dist/vm/vsock-bridge.d.ts

@@ -0,0 +1,44 @@
+import { EventEmitter } from "node:events";
+export declare const CHANNEL_CONTROL = 0;
+export declare const CHANNEL_STDOUT = 1;
+export declare const CHANNEL_STDERR = 2;
+export declare const CHANNEL_MCP = 3;
+export type ControlMessage = {
+    type: "spawn";
+    command: string;
+    args: string[];
+    cwd: string;
+} | {
+    type: "pid";
+    pid: number;
+} | {
+    type: "exit";
+    code: number;
+} | {
+    type: "error";
+    message: string;
+} | {
+    type: "kill";
+    signal: string;
+    pid: number;
+};
+export declare class VsockBridge extends EventEmitter {
+    private readonly socketPath;
+    private socket;
+    private buffer;
+    private connected;
+    /**
+     * @param socketPath Unix domain socket path (vfkit exposes vsock as UDS on macOS)
+     */
+    constructor(socketPath: string);
+    connect(): Promise<void>;
+    private setupDataHandler;
+    private processBuffer;
+    private handleFrame;
+    send(channel: number, data: Buffer | string): void;
+    sendControl(msg: ControlMessage): void;
+    sendMcp(data: Buffer | string): void;
+    disconnect(): void;
+    isConnected(): boolean;
+}
+//# sourceMappingURL=vsock-bridge.d.ts.map