@hachej/boring-agent 0.1.111 → 0.2.1

package/dist/server/worker/index.js

@@ -1,377 +0,0 @@
-import {
-  REMOTE_WORKER_EXCLUSIVE_BINARY_CREATE_CAPABILITY,
-  WORKER_INTERNAL_TOKEN_HEADER,
-  constantTimeTokenEqual
-} from "../../chunk-V3H5A3BR.js";
-import "../../chunk-42D6KAQV.js";
-import "../../chunk-72KT6VWV.js";
-import "../../chunk-7XAOVFSN.js";
-import "../../chunk-YTUZFKB3.js";
-import "../../chunk-KN72XWP7.js";
-import "../../chunk-YGRQ4Q5P.js";
-import "../../chunk-KJIEMSQP.js";
-
-// src/server/worker/index.ts
-import Fastify from "fastify";
-
-// src/server/config/workerConfig.ts
-var FILE_SIZE_BLOCKS_PER_MIB = 2048;
-var KIB_PER_MIB = 1024;
-function requireEnv(name) {
-  const value = process.env[name]?.trim();
-  if (!value) throw new Error(`${name} is required`);
-  return value;
-}
-function numberEnv(name, fallback) {
-  const raw = process.env[name]?.trim();
-  if (!raw) return fallback;
-  const parsed = Number.parseInt(raw, 10);
-  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
-}
-function bwrapNetworkEnv() {
-  const raw = process.env.BORING_WORKER_BWRAP_NETWORK?.trim().toLowerCase();
-  return raw === "shared" ? "shared" : "isolated";
-}
-function resourceLimitsEnv() {
-  return {
-    cpuSeconds: numberEnv("BORING_WORKER_EXEC_CPU_SECONDS", 30),
-    fileSizeBlocks: numberEnv("BORING_WORKER_EXEC_FILE_SIZE_MIB", 64) * FILE_SIZE_BLOCKS_PER_MIB,
-    maxProcesses: numberEnv("BORING_WORKER_EXEC_MAX_PROCESSES", 512),
-    openFiles: numberEnv("BORING_WORKER_EXEC_OPEN_FILES", 256),
-    virtualMemoryKb: numberEnv("BORING_WORKER_EXEC_VIRTUAL_MEMORY_MIB", 1024) * KIB_PER_MIB
-  };
-}
-function loadWorkerConfig() {
-  return {
-    workspaceRoot: requireEnv("BORING_WORKER_WORKSPACE_ROOT"),
-    internalToken: requireEnv("BORING_WORKER_INTERNAL_TOKEN"),
-    port: numberEnv("PORT", 3e3),
-    host: process.env.HOST?.trim() || "0.0.0.0",
-    execConcurrency: numberEnv("BORING_WORKER_EXEC_CONCURRENCY", 2),
-    bwrapNetwork: bwrapNetworkEnv(),
-    resourceLimits: resourceLimitsEnv()
-  };
-}
-
-// src/server/worker/error-codes.ts
-var WORKER_ERROR_CODES = {
-  AUTH_INVALID: "auth_invalid",
-  VALIDATION_ERROR: "validation_error",
-  INVALID_WORKSPACE_ID: "invalid_workspace_id",
-  NOT_IMPLEMENTED: "not_implemented",
-  ALREADY_EXISTS: "REMOTE_WORKER_ALREADY_EXISTS",
-  EXEC_CONCURRENCY_LIMIT: "exec_concurrency_limit",
-  UNSUPPORTED_WORKSPACE_OP: "unsupported_workspace_op"
-};
-
-// src/server/worker/auth.ts
-function verifyInternalToken(request, reply, expectedToken) {
-  const provided = request.headers[WORKER_INTERNAL_TOKEN_HEADER];
-  const token = Array.isArray(provided) ? provided[0] : provided;
-  if (typeof token !== "string" || !constantTimeTokenEqual(token, expectedToken)) {
-    reply.code(401).send({
-      error: {
-        code: WORKER_ERROR_CODES.AUTH_INVALID,
-        message: "invalid internal token",
-        statusCode: 401
-      }
-    });
-    return false;
-  }
-  return true;
-}
-
-// src/server/worker/exec.ts
-var ExecSemaphore = class {
-  constructor(limit) {
-    this.limit = limit;
-  }
-  limit;
-  active = 0;
-  async run(fn) {
-    if (this.active >= this.limit) {
-      throw Object.assign(new Error("worker exec concurrency limit reached"), {
-        statusCode: 429,
-        code: WORKER_ERROR_CODES.EXEC_CONCURRENCY_LIMIT
-      });
-    }
-    this.active += 1;
-    try {
-      return await fn();
-    } finally {
-      this.active -= 1;
-    }
-  }
-};
-function buildExecEnv(input) {
-  const safe = {
-    PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
-    HOME: "/workspace",
-    LANG: "C.UTF-8"
-  };
-  if (!input) return safe;
-  for (const [key, value] of Object.entries(input)) {
-    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) continue;
-    if (key.startsWith("BORING_WORKER_")) continue;
-    if (key.endsWith("_API_KEY") || key.endsWith("_TOKEN") || key.endsWith("_SECRET")) continue;
-    if (key === "DATABASE_URL") continue;
-    safe[key] = String(value);
-  }
-  return safe;
-}
-
-// src/server/worker/workspace.ts
-import { mkdir } from "node:fs/promises";
-import { join } from "node:path";
-var WORKSPACE_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-function assertSafeWorkspaceId(workspaceId) {
-  const normalized = workspaceId.trim().toLowerCase();
-  if (!WORKSPACE_UUID.test(normalized)) {
-    throw Object.assign(new Error("workspace id must be a uuid"), { statusCode: 400, code: WORKER_ERROR_CODES.INVALID_WORKSPACE_ID });
-  }
-  return normalized;
-}
-async function createWorkerRuntime(root, workspaceId, provider) {
-  const safeId = assertSafeWorkspaceId(workspaceId);
-  const hostRoot = join(root, safeId);
-  await mkdir(hostRoot, { recursive: true });
-  const pair = await provider.create({
-    workspaceRoot: hostRoot,
-    workspaceId: safeId,
-    sessionId: safeId
-  });
-  return { workspace: pair.workspace, sandbox: pair.sandbox, dispose: () => pair.dispose() };
-}
-async function runWorkspaceOp(workspace, op) {
-  switch (op.op) {
-    case "readFile":
-      return { content: await workspace.readFile(op.path) };
-    case "readBinaryFile":
-      if (!workspace.readBinaryFile) throw Object.assign(new Error("binary read unsupported"), { statusCode: 501, code: WORKER_ERROR_CODES.NOT_IMPLEMENTED });
-      return { dataBase64: Buffer.from(await workspace.readBinaryFile(op.path)).toString("base64") };
-    case "writeFile":
-      await workspace.writeFile(op.path, op.data);
-      return { ok: true };
-    case "writeBinaryFile":
-      if (!workspace.writeBinaryFile) throw Object.assign(new Error("binary write unsupported"), { statusCode: 501, code: WORKER_ERROR_CODES.NOT_IMPLEMENTED });
-      await workspace.writeBinaryFile(op.path, new Uint8Array(Buffer.from(op.dataBase64, "base64")));
-      return { ok: true };
-    case "createBinaryFile":
-      if (!workspace.createBinaryFile) throw Object.assign(new Error("exclusive binary create unsupported"), { statusCode: 501, code: WORKER_ERROR_CODES.NOT_IMPLEMENTED });
-      try {
-        await workspace.createBinaryFile(op.path, new Uint8Array(Buffer.from(op.dataBase64, "base64")));
-      } catch (error) {
-        if (error?.code === "EEXIST") {
-          throw Object.assign(new Error("exclusive binary create destination exists"), {
-            statusCode: 409,
-            code: WORKER_ERROR_CODES.ALREADY_EXISTS
-          });
-        }
-        throw error;
-      }
-      return { ok: true };
-    case "readFileWithStat":
-      if (!workspace.readFileWithStat) {
-        return { content: await workspace.readFile(op.path), stat: await workspace.stat(op.path) };
-      }
-      return await workspace.readFileWithStat(op.path);
-    case "writeFileWithStat":
-      if (!workspace.writeFileWithStat) {
-        await workspace.writeFile(op.path, op.data);
-        return { stat: await workspace.stat(op.path) };
-      }
-      return { stat: await workspace.writeFileWithStat(op.path, op.data) };
-    case "writeBinaryFileWithStat":
-      if (!workspace.writeBinaryFile) throw Object.assign(new Error("binary write unsupported"), { statusCode: 501, code: WORKER_ERROR_CODES.NOT_IMPLEMENTED });
-      if (!workspace.writeBinaryFileWithStat) {
-        await workspace.writeBinaryFile(op.path, new Uint8Array(Buffer.from(op.dataBase64, "base64")));
-        return { stat: await workspace.stat(op.path) };
-      }
-      return { stat: await workspace.writeBinaryFileWithStat(op.path, new Uint8Array(Buffer.from(op.dataBase64, "base64"))) };
-    case "unlink":
-      await workspace.unlink(op.path);
-      return { ok: true };
-    case "readdir":
-      return { entries: await workspace.readdir(op.path) };
-    case "stat":
-      return { stat: await workspace.stat(op.path) };
-    case "mkdir":
-      await workspace.mkdir(op.path, { recursive: op.recursive });
-      return { ok: true };
-    case "rename":
-      await workspace.rename(op.from, op.to);
-      return { ok: true };
-    default: {
-      const _never = op;
-      throw Object.assign(new Error(`unsupported workspace op ${op.op ?? "unknown"}`), {
-        statusCode: 400,
-        code: WORKER_ERROR_CODES.UNSUPPORTED_WORKSPACE_OP,
-        details: _never
-      });
-    }
-  }
-}
-
-// src/server/worker/routes.ts
-function errorPayload(error) {
-  const record = error;
-  const statusCode = typeof record.statusCode === "number" ? record.statusCode : 500;
-  return {
-    error: {
-      code: typeof record.code === "string" ? record.code : statusCode >= 500 ? "internal" : "bad_request",
-      message: typeof record.message === "string" ? record.message : "worker request failed",
-      statusCode,
-      ...record.details === void 0 ? {} : { details: record.details }
-    }
-  };
-}
-function sendError(reply, error) {
-  const payload = errorPayload(error);
-  reply.code(payload.error.statusCode).send(payload);
-}
-function resultToResponse(result) {
-  return {
-    stdoutBase64: Buffer.from(result.stdout).toString("base64"),
-    stderrBase64: Buffer.from(result.stderr).toString("base64"),
-    exitCode: result.exitCode,
-    durationMs: result.durationMs,
-    truncated: result.truncated,
-    stdoutEncoding: result.stdoutEncoding,
-    stderrEncoding: result.stderrEncoding
-  };
-}
-async function registerWorkerRoutes(app, config, runtimeProvider) {
-  const semaphore = new ExecSemaphore(config.execConcurrency);
-  const runtimes = /* @__PURE__ */ new Map();
-  const getRuntime = (workspaceId) => {
-    const safeId = assertSafeWorkspaceId(workspaceId);
-    let runtime = runtimes.get(safeId);
-    if (!runtime) {
-      if (!runtimeProvider) throw new Error("worker runtime provider must be injected by the host");
-      runtime = createWorkerRuntime(config.workspaceRoot, safeId, runtimeProvider);
-      runtimes.set(safeId, runtime);
-    }
-    return runtime;
-  };
-  app.addHook("onClose", async () => {
-    for (const runtimePromise of runtimes.values()) {
-      try {
-        const runtime = await runtimePromise;
-        await runtime.dispose();
-      } catch {
-      }
-    }
-  });
-  app.get("/health", async () => ({ ok: true }));
-  app.get("/internal/health", async () => ({
-    ok: true,
-    capabilities: [REMOTE_WORKER_EXCLUSIVE_BINARY_CREATE_CAPABILITY]
-  }));
-  app.addHook("preHandler", async (request, reply) => {
-    if (request.method === "GET" && request.url === "/health") return;
-    if (!verifyInternalToken(request, reply, config.internalToken)) return reply;
-  });
-  app.post(
-    "/internal/workspaces/:workspaceId/fs",
-    async (request, reply) => {
-      try {
-        const runtime = await getRuntime(request.params.workspaceId);
-        if (!request.body || typeof request.body.op !== "string") {
-          throw Object.assign(new Error("workspace op is required"), { statusCode: 400, code: WORKER_ERROR_CODES.VALIDATION_ERROR });
-        }
-        return await runWorkspaceOp(runtime.workspace, request.body);
-      } catch (error) {
-        sendError(reply, error);
-      }
-    }
-  );
-  app.post(
-    "/internal/workspaces/:workspaceId/exec",
-    async (request, reply) => {
-      try {
-        const runtime = await getRuntime(request.params.workspaceId);
-        const body = request.body;
-        if (!body || typeof body.cmd !== "string" || body.cmd.length === 0) {
-          throw Object.assign(new Error("cmd is required"), { statusCode: 400, code: WORKER_ERROR_CODES.VALIDATION_ERROR });
-        }
-        const abortController = new AbortController();
-        const abort = () => abortController.abort();
-        request.raw.on("aborted", abort);
-        reply.raw.on("close", abort);
-        const result = await semaphore.run(() => runtime.sandbox.exec(body.cmd, {
-          cwd: body.cwd,
-          env: buildExecEnv(body.env),
-          timeoutMs: body.timeoutMs,
-          maxOutputBytes: body.maxOutputBytes,
-          signal: abortController.signal
-        }));
-        return resultToResponse(result);
-      } catch (error) {
-        sendError(reply, error);
-      }
-    }
-  );
-  app.get(
-    "/internal/workspaces/:workspaceId/fs/events",
-    async (request, reply) => {
-      let unsubscribe = null;
-      let heartbeat = null;
-      try {
-        const runtime = await getRuntime(request.params.workspaceId);
-        reply.hijack();
-        reply.raw.writeHead(200, {
-          "content-type": "text/event-stream; charset=utf-8",
-          "cache-control": "no-cache, no-transform",
-          connection: "keep-alive",
-          "x-accel-buffering": "no"
-        });
-        reply.raw.flushHeaders?.();
-        reply.raw.write(": connected\n\n");
-        const send = (payload) => {
-          reply.raw.write(`event: change
-data: ${JSON.stringify(payload)}
-
-`);
-        };
-        if (!runtime.workspace.watch) {
-          throw Object.assign(new Error("workspace events unsupported"), { statusCode: 501, code: WORKER_ERROR_CODES.NOT_IMPLEMENTED });
-        }
-        unsubscribe = runtime.workspace.watch().subscribe((event) => send({ event }));
-        heartbeat = setInterval(() => reply.raw.write(": heartbeat\n\n"), 15e3);
-        const cleanup = () => {
-          unsubscribe?.();
-          unsubscribe = null;
-          if (heartbeat) clearInterval(heartbeat);
-          heartbeat = null;
-        };
-        request.raw.on("close", cleanup);
-        reply.raw.on("close", cleanup);
-      } catch (error) {
-        if (heartbeat) clearInterval(heartbeat);
-        unsubscribe?.();
-        if (!reply.sent) sendError(reply, error);
-      }
-    }
-  );
-}
-
-// src/server/worker/index.ts
-var DEFAULT_BODY_LIMIT = 20 * 1024 * 1024;
-async function createWorkerServer(options = {}) {
-  const config = options.config ?? loadWorkerConfig();
-  const app = Fastify({ logger: true, bodyLimit: DEFAULT_BODY_LIMIT, ...options.fastify });
-  await registerWorkerRoutes(app, config, options.runtimeProvider);
-  return { app, config };
-}
-export {
-  ExecSemaphore,
-  WORKER_ERROR_CODES,
-  assertSafeWorkspaceId,
-  buildExecEnv,
-  createWorkerRuntime,
-  createWorkerServer,
-  loadWorkerConfig,
-  registerWorkerRoutes,
-  runWorkspaceOp,
-  verifyInternalToken
-};