@hachej/boring-agent 0.1.77 → 0.1.79

package/dist/server/worker/index.d.ts

@@ -0,0 +1,65 @@
+import { FastifyInstance, FastifyRequest, FastifyReply, FastifyServerOptions } from 'fastify';
+import { B as BwrapResourceLimits, R as RemoteWorkerWorkspaceOp, a as RemoteWorkerWorkspaceResult } from '../../protocol-B_OQKfbI.js';
+import { a as Workspace, S as Sandbox } from '../../sandbox-DthfJaOB.js';
+
+interface WorkerConfig {
+    workspaceRoot: string;
+    internalToken: string;
+    port: number;
+    host: string;
+    execConcurrency: number;
+    bwrapNetwork: 'isolated' | 'shared';
+    resourceLimits: BwrapResourceLimits;
+}
+declare function loadWorkerConfig(): WorkerConfig;
+
+declare function registerWorkerRoutes(app: FastifyInstance, config: WorkerConfig): Promise<void>;
+
+declare const WORKER_ERROR_CODES: {
+    readonly AUTH_INVALID: "auth_invalid";
+    readonly VALIDATION_ERROR: "validation_error";
+    readonly INVALID_WORKSPACE_ID: "invalid_workspace_id";
+    readonly NOT_IMPLEMENTED: "not_implemented";
+    readonly EXEC_CONCURRENCY_LIMIT: "exec_concurrency_limit";
+    readonly UNSUPPORTED_WORKSPACE_OP: "unsupported_workspace_op";
+};
+type WorkerErrorCode = (typeof WORKER_ERROR_CODES)[keyof typeof WORKER_ERROR_CODES];
+
+interface WorkerRuntime {
+    workspace: Workspace;
+    sandbox: Sandbox;
+}
+declare function assertSafeWorkspaceId(workspaceId: string): string;
+declare function createWorkerRuntime(root: string, workspaceId: string, options: {
+    bwrapNetwork: 'isolated' | 'shared';
+    resourceLimits?: BwrapResourceLimits;
+}): Promise<WorkerRuntime>;
+declare function runWorkspaceOp(workspace: Workspace, op: RemoteWorkerWorkspaceOp): Promise<RemoteWorkerWorkspaceResult>;
+
+declare class ExecSemaphore {
+    private readonly limit;
+    private active;
+    constructor(limit: number);
+    run<T>(fn: () => Promise<T>): Promise<T>;
+}
+declare function buildExecEnv(input: Record<string, string> | undefined): Record<string, string>;
+
+declare function verifyInternalToken(request: FastifyRequest, reply: FastifyReply, expectedToken: string): boolean;
+
+interface CreateWorkerServerOptions {
+    /** Worker configuration. Defaults to {@link loadWorkerConfig} (reads env). */
+    config?: WorkerConfig;
+    /** Extra Fastify server options merged over the worker defaults. */
+    fastify?: FastifyServerOptions;
+}
+interface WorkerServer {
+    app: FastifyInstance;
+    config: WorkerConfig;
+}
+/**
+ * Build the internal worker Fastify server with worker routes registered.
+ * Callers own listening/lifecycle.
+ */
+declare function createWorkerServer(options?: CreateWorkerServerOptions): Promise<WorkerServer>;
+
+export { type CreateWorkerServerOptions, ExecSemaphore, WORKER_ERROR_CODES, type WorkerConfig, type WorkerErrorCode, type WorkerRuntime, type WorkerServer, assertSafeWorkspaceId, buildExecEnv, createWorkerRuntime, createWorkerServer, loadWorkerConfig, registerWorkerRoutes, runWorkspaceOp, verifyInternalToken };

package/dist/server/worker/index.js

@@ -0,0 +1,367 @@
+import {
+  REMOTE_WORKER_RUNTIME_CWD,
+  WORKER_INTERNAL_TOKEN_HEADER,
+  constantTimeTokenEqual,
+  createBwrapSandbox,
+  createNodeWorkspace
+} from "../../chunk-RFHSFIHF.js";
+import "../../chunk-Q42DWR3T.js";
+import "../../chunk-LCEBDU6G.js";
+import "../../chunk-WSQ5QNIY.js";
+import "../../chunk-P23XFC4W.js";
+import "../../chunk-X4WT3TPU.js";
+import "../../chunk-AQBXNPMD.js";
+import "../../chunk-YVON2BHN.js";
+
+// src/server/worker/index.ts
+import Fastify from "fastify";
+
+// src/server/config/workerConfig.ts
+var FILE_SIZE_BLOCKS_PER_MIB = 2048;
+var KIB_PER_MIB = 1024;
+function requireEnv(name) {
+  const value = process.env[name]?.trim();
+  if (!value) throw new Error(`${name} is required`);
+  return value;
+}
+function numberEnv(name, fallback) {
+  const raw = process.env[name]?.trim();
+  if (!raw) return fallback;
+  const parsed = Number.parseInt(raw, 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+function bwrapNetworkEnv() {
+  const raw = process.env.BORING_WORKER_BWRAP_NETWORK?.trim().toLowerCase();
+  return raw === "shared" ? "shared" : "isolated";
+}
+function resourceLimitsEnv() {
+  return {
+    cpuSeconds: numberEnv("BORING_WORKER_EXEC_CPU_SECONDS", 30),
+    fileSizeBlocks: numberEnv("BORING_WORKER_EXEC_FILE_SIZE_MIB", 64) * FILE_SIZE_BLOCKS_PER_MIB,
+    maxProcesses: numberEnv("BORING_WORKER_EXEC_MAX_PROCESSES", 512),
+    openFiles: numberEnv("BORING_WORKER_EXEC_OPEN_FILES", 256),
+    virtualMemoryKb: numberEnv("BORING_WORKER_EXEC_VIRTUAL_MEMORY_MIB", 1024) * KIB_PER_MIB
+  };
+}
+function loadWorkerConfig() {
+  return {
+    workspaceRoot: requireEnv("BORING_WORKER_WORKSPACE_ROOT"),
+    internalToken: requireEnv("BORING_WORKER_INTERNAL_TOKEN"),
+    port: numberEnv("PORT", 3e3),
+    host: process.env.HOST?.trim() || "0.0.0.0",
+    execConcurrency: numberEnv("BORING_WORKER_EXEC_CONCURRENCY", 2),
+    bwrapNetwork: bwrapNetworkEnv(),
+    resourceLimits: resourceLimitsEnv()
+  };
+}
+
+// src/server/worker/error-codes.ts
+var WORKER_ERROR_CODES = {
+  AUTH_INVALID: "auth_invalid",
+  VALIDATION_ERROR: "validation_error",
+  INVALID_WORKSPACE_ID: "invalid_workspace_id",
+  NOT_IMPLEMENTED: "not_implemented",
+  EXEC_CONCURRENCY_LIMIT: "exec_concurrency_limit",
+  UNSUPPORTED_WORKSPACE_OP: "unsupported_workspace_op"
+};
+
+// src/server/worker/auth.ts
+function verifyInternalToken(request, reply, expectedToken) {
+  const provided = request.headers[WORKER_INTERNAL_TOKEN_HEADER];
+  const token = Array.isArray(provided) ? provided[0] : provided;
+  if (typeof token !== "string" || !constantTimeTokenEqual(token, expectedToken)) {
+    reply.code(401).send({
+      error: {
+        code: WORKER_ERROR_CODES.AUTH_INVALID,
+        message: "invalid internal token",
+        statusCode: 401
+      }
+    });
+    return false;
+  }
+  return true;
+}
+
+// src/server/worker/exec.ts
+var ExecSemaphore = class {
+  constructor(limit) {
+    this.limit = limit;
+  }
+  limit;
+  active = 0;
+  async run(fn) {
+    if (this.active >= this.limit) {
+      throw Object.assign(new Error("worker exec concurrency limit reached"), {
+        statusCode: 429,
+        code: WORKER_ERROR_CODES.EXEC_CONCURRENCY_LIMIT
+      });
+    }
+    this.active += 1;
+    try {
+      return await fn();
+    } finally {
+      this.active -= 1;
+    }
+  }
+};
+function buildExecEnv(input) {
+  const safe = {
+    PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+    HOME: "/workspace",
+    LANG: "C.UTF-8"
+  };
+  if (!input) return safe;
+  for (const [key, value] of Object.entries(input)) {
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) continue;
+    if (key.startsWith("BORING_WORKER_")) continue;
+    if (key.endsWith("_API_KEY") || key.endsWith("_TOKEN") || key.endsWith("_SECRET")) continue;
+    if (key === "DATABASE_URL") continue;
+    safe[key] = String(value);
+  }
+  return safe;
+}
+
+// src/server/worker/workspace.ts
+import { mkdir } from "fs/promises";
+import { join } from "path";
+var WORKSPACE_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+function assertSafeWorkspaceId(workspaceId) {
+  const normalized = workspaceId.trim().toLowerCase();
+  if (!WORKSPACE_UUID.test(normalized)) {
+    throw Object.assign(new Error("workspace id must be a uuid"), { statusCode: 400, code: WORKER_ERROR_CODES.INVALID_WORKSPACE_ID });
+  }
+  return normalized;
+}
+async function createWorkerRuntime(root, workspaceId, options) {
+  const safeId = assertSafeWorkspaceId(workspaceId);
+  const hostRoot = join(root, safeId);
+  await mkdir(hostRoot, { recursive: true });
+  const workspace = createNodeWorkspace(hostRoot, { runtimeContext: { runtimeCwd: REMOTE_WORKER_RUNTIME_CWD } });
+  const sandbox = createBwrapSandbox({
+    hostWorkspaceRoot: hostRoot,
+    runtimeContext: { runtimeCwd: REMOTE_WORKER_RUNTIME_CWD },
+    network: options.bwrapNetwork,
+    dropAllCapabilities: true,
+    resourceLimits: options.resourceLimits
+  });
+  await sandbox.init?.({ workspace, sessionId: safeId });
+  return { workspace, sandbox };
+}
+async function runWorkspaceOp(workspace, op) {
+  switch (op.op) {
+    case "readFile":
+      return { content: await workspace.readFile(op.path) };
+    case "readBinaryFile":
+      if (!workspace.readBinaryFile) throw Object.assign(new Error("binary read unsupported"), { statusCode: 501, code: WORKER_ERROR_CODES.NOT_IMPLEMENTED });
+      return { dataBase64: Buffer.from(await workspace.readBinaryFile(op.path)).toString("base64") };
+    case "writeFile":
+      await workspace.writeFile(op.path, op.data);
+      return { ok: true };
+    case "writeBinaryFile":
+      if (!workspace.writeBinaryFile) throw Object.assign(new Error("binary write unsupported"), { statusCode: 501, code: WORKER_ERROR_CODES.NOT_IMPLEMENTED });
+      await workspace.writeBinaryFile(op.path, new Uint8Array(Buffer.from(op.dataBase64, "base64")));
+      return { ok: true };
+    case "readFileWithStat":
+      if (!workspace.readFileWithStat) {
+        return { content: await workspace.readFile(op.path), stat: await workspace.stat(op.path) };
+      }
+      return await workspace.readFileWithStat(op.path);
+    case "writeFileWithStat":
+      if (!workspace.writeFileWithStat) {
+        await workspace.writeFile(op.path, op.data);
+        return { stat: await workspace.stat(op.path) };
+      }
+      return { stat: await workspace.writeFileWithStat(op.path, op.data) };
+    case "writeBinaryFileWithStat":
+      if (!workspace.writeBinaryFile) throw Object.assign(new Error("binary write unsupported"), { statusCode: 501, code: WORKER_ERROR_CODES.NOT_IMPLEMENTED });
+      if (!workspace.writeBinaryFileWithStat) {
+        await workspace.writeBinaryFile(op.path, new Uint8Array(Buffer.from(op.dataBase64, "base64")));
+        return { stat: await workspace.stat(op.path) };
+      }
+      return { stat: await workspace.writeBinaryFileWithStat(op.path, new Uint8Array(Buffer.from(op.dataBase64, "base64"))) };
+    case "unlink":
+      await workspace.unlink(op.path);
+      return { ok: true };
+    case "readdir":
+      return { entries: await workspace.readdir(op.path) };
+    case "stat":
+      return { stat: await workspace.stat(op.path) };
+    case "mkdir":
+      await workspace.mkdir(op.path, { recursive: op.recursive });
+      return { ok: true };
+    case "rename":
+      await workspace.rename(op.from, op.to);
+      return { ok: true };
+    default: {
+      const _never = op;
+      throw Object.assign(new Error(`unsupported workspace op ${op.op ?? "unknown"}`), {
+        statusCode: 400,
+        code: WORKER_ERROR_CODES.UNSUPPORTED_WORKSPACE_OP,
+        details: _never
+      });
+    }
+  }
+}
+
+// src/server/worker/routes.ts
+function errorPayload(error) {
+  const record = error;
+  const statusCode = typeof record.statusCode === "number" ? record.statusCode : 500;
+  return {
+    error: {
+      code: typeof record.code === "string" ? record.code : statusCode >= 500 ? "internal" : "bad_request",
+      message: typeof record.message === "string" ? record.message : "worker request failed",
+      statusCode,
+      ...record.details === void 0 ? {} : { details: record.details }
+    }
+  };
+}
+function sendError(reply, error) {
+  const payload = errorPayload(error);
+  reply.code(payload.error.statusCode).send(payload);
+}
+function resultToResponse(result) {
+  return {
+    stdoutBase64: Buffer.from(result.stdout).toString("base64"),
+    stderrBase64: Buffer.from(result.stderr).toString("base64"),
+    exitCode: result.exitCode,
+    durationMs: result.durationMs,
+    truncated: result.truncated,
+    stdoutEncoding: result.stdoutEncoding,
+    stderrEncoding: result.stderrEncoding
+  };
+}
+async function registerWorkerRoutes(app, config) {
+  const semaphore = new ExecSemaphore(config.execConcurrency);
+  const runtimes = /* @__PURE__ */ new Map();
+  const getRuntime = (workspaceId) => {
+    const safeId = assertSafeWorkspaceId(workspaceId);
+    let runtime = runtimes.get(safeId);
+    if (!runtime) {
+      runtime = createWorkerRuntime(config.workspaceRoot, safeId, {
+        bwrapNetwork: config.bwrapNetwork,
+        resourceLimits: config.resourceLimits
+      });
+      runtimes.set(safeId, runtime);
+    }
+    return runtime;
+  };
+  app.addHook("onClose", async () => {
+    for (const runtimePromise of runtimes.values()) {
+      try {
+        const runtime = await runtimePromise;
+        runtime.workspace.watch?.().close();
+      } catch {
+      }
+    }
+  });
+  app.get("/health", async () => ({ ok: true }));
+  app.get("/internal/health", async () => ({ ok: true }));
+  app.addHook("preHandler", async (request, reply) => {
+    if (request.method === "GET" && request.url === "/health") return;
+    if (!verifyInternalToken(request, reply, config.internalToken)) return reply;
+  });
+  app.post(
+    "/internal/workspaces/:workspaceId/fs",
+    async (request, reply) => {
+      try {
+        const runtime = await getRuntime(request.params.workspaceId);
+        if (!request.body || typeof request.body.op !== "string") {
+          throw Object.assign(new Error("workspace op is required"), { statusCode: 400, code: WORKER_ERROR_CODES.VALIDATION_ERROR });
+        }
+        return await runWorkspaceOp(runtime.workspace, request.body);
+      } catch (error) {
+        sendError(reply, error);
+      }
+    }
+  );
+  app.post(
+    "/internal/workspaces/:workspaceId/exec",
+    async (request, reply) => {
+      try {
+        const runtime = await getRuntime(request.params.workspaceId);
+        const body = request.body;
+        if (!body || typeof body.cmd !== "string" || body.cmd.length === 0) {
+          throw Object.assign(new Error("cmd is required"), { statusCode: 400, code: WORKER_ERROR_CODES.VALIDATION_ERROR });
+        }
+        const abortController = new AbortController();
+        const abort = () => abortController.abort();
+        request.raw.on("aborted", abort);
+        reply.raw.on("close", abort);
+        const result = await semaphore.run(() => runtime.sandbox.exec(body.cmd, {
+          cwd: body.cwd,
+          env: buildExecEnv(body.env),
+          timeoutMs: body.timeoutMs,
+          maxOutputBytes: body.maxOutputBytes,
+          signal: abortController.signal
+        }));
+        return resultToResponse(result);
+      } catch (error) {
+        sendError(reply, error);
+      }
+    }
+  );
+  app.get(
+    "/internal/workspaces/:workspaceId/fs/events",
+    async (request, reply) => {
+      let unsubscribe = null;
+      let heartbeat = null;
+      try {
+        const runtime = await getRuntime(request.params.workspaceId);
+        reply.hijack();
+        reply.raw.writeHead(200, {
+          "content-type": "text/event-stream; charset=utf-8",
+          "cache-control": "no-cache, no-transform",
+          connection: "keep-alive",
+          "x-accel-buffering": "no"
+        });
+        reply.raw.flushHeaders?.();
+        reply.raw.write(": connected\n\n");
+        const send = (payload) => {
+          reply.raw.write(`event: change
+data: ${JSON.stringify(payload)}
+
+`);
+        };
+        if (!runtime.workspace.watch) {
+          throw Object.assign(new Error("workspace events unsupported"), { statusCode: 501, code: WORKER_ERROR_CODES.NOT_IMPLEMENTED });
+        }
+        unsubscribe = runtime.workspace.watch().subscribe((event) => send({ event }));
+        heartbeat = setInterval(() => reply.raw.write(": heartbeat\n\n"), 15e3);
+        const cleanup = () => {
+          unsubscribe?.();
+          unsubscribe = null;
+          if (heartbeat) clearInterval(heartbeat);
+          heartbeat = null;
+        };
+        request.raw.on("close", cleanup);
+        reply.raw.on("close", cleanup);
+      } catch (error) {
+        if (heartbeat) clearInterval(heartbeat);
+        unsubscribe?.();
+        if (!reply.sent) sendError(reply, error);
+      }
+    }
+  );
+}
+
+// src/server/worker/index.ts
+var DEFAULT_BODY_LIMIT = 20 * 1024 * 1024;
+async function createWorkerServer(options = {}) {
+  const config = options.config ?? loadWorkerConfig();
+  const app = Fastify({ logger: true, bodyLimit: DEFAULT_BODY_LIMIT, ...options.fastify });
+  await registerWorkerRoutes(app, config);
+  return { app, config };
+}
+export {
+  ExecSemaphore,
+  WORKER_ERROR_CODES,
+  assertSafeWorkspaceId,
+  buildExecEnv,
+  createWorkerRuntime,
+  createWorkerServer,
+  loadWorkerConfig,
+  registerWorkerRoutes,
+  runWorkspaceOp,
+  verifyInternalToken
+};