@halcyonlabs/app 0.47.0-halcyon.151 → 0.47.0-halcyon.154

package/README.md

@@ -116,7 +116,7 @@ takes precedence. In-place progress updates require a stdout TTY.
 
 The same output capture applies to `bb-server` and `bb-host-daemon`.
 
-To stop a Moonlet that runs in another terminal or in the background:
+To stop a Moonlet install that runs in another terminal or in the background:
 
 ```bash
 npx -y -p @halcyonlabs/app bb-app stop
@@ -124,7 +124,7 @@ npx -y -p @halcyonlabs/app bb-app stop
 
 `stop` reads `bb-app-runtime.json` from the data directory, confirms that the
 recorded process really is that launcher, then stops it. Pass `--data-dir` when
-the Moonlet you want to stop does not use the default `~/.bb/`.
+the Moonlet install you want to stop does not use the default `~/.bb/`.
 
 ### The `bb` command
 

package/dist/bb-app.js

@@ -19664,7 +19664,7 @@ async function writeOwnCliLauncher(context) {
   } catch (error2) {
     log(
       yellow("!"),
-      `Could not write the Moonlet command launcher at ${launcherPath}: ${error2 instanceof Error ? error2.message : String(error2)}`
+      `Could not write the bb command launcher at ${launcherPath}: ${error2 instanceof Error ? error2.message : String(error2)}`
     );
     return null;
   }

package/dist/index.d.ts

@@ -155,10 +155,10 @@ declare const uiPreferenceDefinitions: {
     }>>;
     readonly "sidebar.threadGrouping.environment": UiPreferenceDefinition<z$1.ZodUnion<readonly [z$1.ZodLiteral<"auto">, z$1.ZodBoolean]>>;
     readonly "sidebar.chronologicalSort": UiPreferenceDefinition<z$1.ZodEnum<{
+        none: "none";
         updated: "updated";
         created: "created";
         alpha: "alpha";
-        none: "none";
     }>>;
     readonly "sidebar.sortDirection": UiPreferenceDefinition<z$1.ZodEnum<{
         default: "default";
@@ -7336,8 +7336,8 @@ declare const hostDaemonCommandRegistry: {
                 providerInstallation: z$1.ZodBoolean;
                 supportsServiceTier: z$1.ZodBoolean;
                 permissionModes: z$1.ZodArray<z$1.ZodEnum<{
-                    auto: "auto";
                     "accept-edits": "accept-edits";
+                    auto: "auto";
                     full: "full";
                 }>>;
                 supportsThreadArchive: z$1.ZodBoolean;
@@ -7363,16 +7363,16 @@ declare const hostDaemonCommandRegistry: {
             permissionScope: z$1.ZodLiteral<"workspace">;
             approvalReviewer: z$1.ZodLiteral<"user">;
             permissionEscalation: z$1.ZodEnum<{
-                deny: "deny";
                 ask: "ask";
+                deny: "deny";
             }>;
         }, z$1.core.$strip>, z$1.ZodObject<{
             permissionMode: z$1.ZodLiteral<"auto">;
             permissionScope: z$1.ZodLiteral<"workspace">;
             approvalReviewer: z$1.ZodLiteral<"automatic">;
             permissionEscalation: z$1.ZodEnum<{
-                deny: "deny";
                 ask: "ask";
+                deny: "deny";
             }>;
         }, z$1.core.$strip>, z$1.ZodObject<{
             permissionMode: z$1.ZodLiteral<"full">;
@@ -7485,8 +7485,8 @@ declare const hostDaemonCommandRegistry: {
                 providerInstallation: z$1.ZodBoolean;
                 supportsServiceTier: z$1.ZodBoolean;
                 permissionModes: z$1.ZodArray<z$1.ZodEnum<{
-                    auto: "auto";
                     "accept-edits": "accept-edits";
+                    auto: "auto";
                     full: "full";
                 }>>;
                 supportsThreadArchive: z$1.ZodBoolean;
@@ -7512,16 +7512,16 @@ declare const hostDaemonCommandRegistry: {
             permissionScope: z$1.ZodLiteral<"workspace">;
             approvalReviewer: z$1.ZodLiteral<"user">;
             permissionEscalation: z$1.ZodEnum<{
-                deny: "deny";
                 ask: "ask";
+                deny: "deny";
             }>;
         }, z$1.core.$strip>, z$1.ZodObject<{
             permissionMode: z$1.ZodLiteral<"auto">;
             permissionScope: z$1.ZodLiteral<"workspace">;
             approvalReviewer: z$1.ZodLiteral<"automatic">;
             permissionEscalation: z$1.ZodEnum<{
-                deny: "deny";
                 ask: "ask";
+                deny: "deny";
             }>;
         }, z$1.core.$strip>, z$1.ZodObject<{
             permissionMode: z$1.ZodLiteral<"full">;
@@ -7657,8 +7657,8 @@ declare const hostDaemonCommandRegistry: {
                     }>;
                     origin: z$1.ZodEnum<{
                         builtin: "builtin";
-                        user: "user";
                         project: "project";
+                        user: "user";
                     }>;
                     label: z$1.ZodString;
                     argumentHint: z$1.ZodNullable<z$1.ZodString>;
@@ -7747,8 +7747,8 @@ declare const hostDaemonCommandRegistry: {
                     }>;
                     origin: z$1.ZodEnum<{
                         builtin: "builtin";
-                        user: "user";
                         project: "project";
+                        user: "user";
                     }>;
                     label: z$1.ZodString;
                     argumentHint: z$1.ZodNullable<z$1.ZodString>;
@@ -7850,8 +7850,8 @@ declare const hostDaemonCommandRegistry: {
                     }>;
                     origin: z$1.ZodEnum<{
                         builtin: "builtin";
-                        user: "user";
                         project: "project";
+                        user: "user";
                     }>;
                     label: z$1.ZodString;
                     argumentHint: z$1.ZodNullable<z$1.ZodString>;
@@ -7940,8 +7940,8 @@ declare const hostDaemonCommandRegistry: {
                     }>;
                     origin: z$1.ZodEnum<{
                         builtin: "builtin";
-                        user: "user";
                         project: "project";
+                        user: "user";
                     }>;
                     label: z$1.ZodString;
                     argumentHint: z$1.ZodNullable<z$1.ZodString>;
@@ -7995,16 +7995,16 @@ declare const hostDaemonCommandRegistry: {
             permissionScope: z$1.ZodLiteral<"workspace">;
             approvalReviewer: z$1.ZodLiteral<"user">;
             permissionEscalation: z$1.ZodEnum<{
-                deny: "deny";
                 ask: "ask";
+                deny: "deny";
             }>;
         }, z$1.core.$strip>, z$1.ZodObject<{
             permissionMode: z$1.ZodLiteral<"auto">;
             permissionScope: z$1.ZodLiteral<"workspace">;
             approvalReviewer: z$1.ZodLiteral<"automatic">;
             permissionEscalation: z$1.ZodEnum<{
-                deny: "deny";
                 ask: "ask";
+                deny: "deny";
             }>;
         }, z$1.core.$strip>, z$1.ZodObject<{
             permissionMode: z$1.ZodLiteral<"full">;
@@ -8023,8 +8023,8 @@ declare const hostDaemonCommandRegistry: {
                 providerInstallation: z$1.ZodBoolean;
                 supportsServiceTier: z$1.ZodBoolean;
                 permissionModes: z$1.ZodArray<z$1.ZodEnum<{
-                    auto: "auto";
                     "accept-edits": "accept-edits";
+                    auto: "auto";
                     full: "full";
                 }>>;
                 supportsThreadArchive: z$1.ZodBoolean;
@@ -8042,9 +8042,6 @@ declare const hostDaemonCommandRegistry: {
             workspaceContext: z$1.ZodObject<{
                 workspacePath: z$1.ZodString;
             }, z$1.core.$strip>;
-            projectId: z$1.ZodString;
-            providerThreadId: z$1.ZodString;
-            providerId: z$1.ZodString;
             bridgeLaunch: z$1.ZodObject<{
                 pluginId: z$1.ZodString;
                 source: z$1.ZodObject<{
@@ -8056,8 +8053,8 @@ declare const hostDaemonCommandRegistry: {
                     providerInstallation: z$1.ZodBoolean;
                     supportsServiceTier: z$1.ZodBoolean;
                     permissionModes: z$1.ZodArray<z$1.ZodEnum<{
-                        auto: "auto";
                         "accept-edits": "accept-edits";
+                        auto: "auto";
                         full: "full";
                     }>>;
                     supportsThreadArchive: z$1.ZodBoolean;
@@ -8075,6 +8072,8 @@ declare const hostDaemonCommandRegistry: {
                 replace: "replace";
                 append: "append";
             }>;
+            projectId: z$1.ZodString;
+            providerId: z$1.ZodString;
             instructions: z$1.ZodString;
             dynamicTools: z$1.ZodArray<z$1.ZodObject<{
                 name: z$1.ZodString;
@@ -8150,6 +8149,7 @@ declare const hostDaemonCommandRegistry: {
                 sourceRootPath: z$1.ZodString;
                 skillFilePath: z$1.ZodString;
             }, z$1.core.$strict>], "kind">>;
+            providerThreadId: z$1.ZodString;
         }, z$1.core.$strict>;
         target: z$1.ZodDiscriminatedUnion<[z$1.ZodObject<{
             mode: z$1.ZodLiteral<"start">;
@@ -8211,16 +8211,16 @@ declare const hostDaemonCommandRegistry: {
             permissionScope: z$1.ZodLiteral<"workspace">;
             approvalReviewer: z$1.ZodLiteral<"user">;
             permissionEscalation: z$1.ZodEnum<{
-                deny: "deny";
                 ask: "ask";
+                deny: "deny";
             }>;
         }, z$1.core.$strip>, z$1.ZodObject<{
             permissionMode: z$1.ZodLiteral<"auto">;
             permissionScope: z$1.ZodLiteral<"workspace">;
             approvalReviewer: z$1.ZodLiteral<"automatic">;
             permissionEscalation: z$1.ZodEnum<{
-                deny: "deny";
                 ask: "ask";
+                deny: "deny";
             }>;
         }, z$1.core.$strip>, z$1.ZodObject<{
             permissionMode: z$1.ZodLiteral<"full">;
@@ -8239,8 +8239,8 @@ declare const hostDaemonCommandRegistry: {
                 providerInstallation: z$1.ZodBoolean;
                 supportsServiceTier: z$1.ZodBoolean;
                 permissionModes: z$1.ZodArray<z$1.ZodEnum<{
-                    auto: "auto";
                     "accept-edits": "accept-edits";
+                    auto: "auto";
                     full: "full";
                 }>>;
                 supportsThreadArchive: z$1.ZodBoolean;
@@ -8258,9 +8258,6 @@ declare const hostDaemonCommandRegistry: {
             workspaceContext: z$1.ZodObject<{
                 workspacePath: z$1.ZodString;
             }, z$1.core.$strip>;
-            projectId: z$1.ZodString;
-            providerThreadId: z$1.ZodString;
-            providerId: z$1.ZodString;
             bridgeLaunch: z$1.ZodObject<{
                 pluginId: z$1.ZodString;
                 source: z$1.ZodObject<{
@@ -8272,8 +8269,8 @@ declare const hostDaemonCommandRegistry: {
                     providerInstallation: z$1.ZodBoolean;
                     supportsServiceTier: z$1.ZodBoolean;
                     permissionModes: z$1.ZodArray<z$1.ZodEnum<{
-                        auto: "auto";
                         "accept-edits": "accept-edits";
+                        auto: "auto";
                         full: "full";
                     }>>;
                     supportsThreadArchive: z$1.ZodBoolean;
@@ -8291,6 +8288,8 @@ declare const hostDaemonCommandRegistry: {
                 replace: "replace";
                 append: "append";
             }>;
+            projectId: z$1.ZodString;
+            providerId: z$1.ZodString;
             instructions: z$1.ZodString;
             dynamicTools: z$1.ZodArray<z$1.ZodObject<{
                 name: z$1.ZodString;
@@ -8366,6 +8365,7 @@ declare const hostDaemonCommandRegistry: {
                 sourceRootPath: z$1.ZodString;
                 skillFilePath: z$1.ZodString;
             }, z$1.core.$strict>], "kind">>;
+            providerThreadId: z$1.ZodString;
         }, z$1.core.$strict>;
     }, z$1.core.$strict>, z$1.ZodObject<{
         cleared: z$1.ZodBoolean;
@@ -8404,8 +8404,8 @@ declare const hostDaemonCommandRegistry: {
                 providerInstallation: z$1.ZodBoolean;
                 supportsServiceTier: z$1.ZodBoolean;
                 permissionModes: z$1.ZodArray<z$1.ZodEnum<{
-                    auto: "auto";
                     "accept-edits": "accept-edits";
+                    auto: "auto";
                     full: "full";
                 }>>;
                 supportsThreadArchive: z$1.ZodBoolean;
@@ -8437,8 +8437,8 @@ declare const hostDaemonCommandRegistry: {
                 providerInstallation: z$1.ZodBoolean;
                 supportsServiceTier: z$1.ZodBoolean;
                 permissionModes: z$1.ZodArray<z$1.ZodEnum<{
-                    auto: "auto";
                     "accept-edits": "accept-edits";
+                    auto: "auto";
                     full: "full";
                 }>>;
                 supportsThreadArchive: z$1.ZodBoolean;
@@ -8820,8 +8820,8 @@ declare const hostDaemonCommandRegistry: {
                 skills: z$1.ZodArray<z$1.ZodObject<{
                     path: z$1.ZodString;
                     origin: z$1.ZodEnum<{
-                        user: "user";
                         project: "project";
+                        user: "user";
                     }>;
                     recursive: z$1.ZodBoolean;
                     ancestors: z$1.ZodBoolean;
@@ -8839,8 +8839,8 @@ declare const hostDaemonCommandRegistry: {
                 commands: z$1.ZodArray<z$1.ZodObject<{
                     path: z$1.ZodString;
                     origin: z$1.ZodEnum<{
-                        user: "user";
                         project: "project";
+                        user: "user";
                     }>;
                     recursive: z$1.ZodBoolean;
                     ancestors: z$1.ZodBoolean;
@@ -8865,8 +8865,8 @@ declare const hostDaemonCommandRegistry: {
                 skill: "skill";
             }>;
             origin: z$1.ZodEnum<{
-                user: "user";
                 project: "project";
+                user: "user";
             }>;
             description: z$1.ZodNullable<z$1.ZodString>;
             argumentHint: z$1.ZodNullable<z$1.ZodString>;
@@ -8913,8 +8913,8 @@ declare const hostDaemonCommandRegistry: {
                 skills: z$1.ZodArray<z$1.ZodObject<{
                     path: z$1.ZodString;
                     origin: z$1.ZodEnum<{
-                        user: "user";
                         project: "project";
+                        user: "user";
                     }>;
                     recursive: z$1.ZodBoolean;
                     ancestors: z$1.ZodBoolean;
@@ -8932,8 +8932,8 @@ declare const hostDaemonCommandRegistry: {
                 commands: z$1.ZodArray<z$1.ZodObject<{
                     path: z$1.ZodString;
                     origin: z$1.ZodEnum<{
-                        user: "user";
                         project: "project";
+                        user: "user";
                     }>;
                     recursive: z$1.ZodBoolean;
                     ancestors: z$1.ZodBoolean;
@@ -8959,14 +8959,14 @@ declare const hostDaemonCommandRegistry: {
             realPath: z$1.ZodString;
             contentSha256: z$1.ZodString;
             rootKind: z$1.ZodEnum<{
-                plugin: "plugin";
                 "shared-user": "shared-user";
                 "shared-project": "shared-project";
+                plugin: "plugin";
                 "bb-project": "bb-project";
+                "provider-user": "provider-user";
+                "provider-project": "provider-project";
                 "bb-data-dir": "bb-data-dir";
                 "bb-builtin": "bb-builtin";
-                "provider-project": "provider-project";
-                "provider-user": "provider-user";
             }>;
             linked: z$1.ZodBoolean;
         }, z$1.core.$strip>>;
@@ -9020,14 +9020,14 @@ declare const hostDaemonCommandRegistry: {
             realPath: z$1.ZodString;
             contentSha256: z$1.ZodString;
             rootKind: z$1.ZodEnum<{
-                plugin: "plugin";
                 "shared-user": "shared-user";
                 "shared-project": "shared-project";
+                plugin: "plugin";
                 "bb-project": "bb-project";
+                "provider-user": "provider-user";
+                "provider-project": "provider-project";
                 "bb-data-dir": "bb-data-dir";
                 "bb-builtin": "bb-builtin";
-                "provider-project": "provider-project";
-                "provider-user": "provider-user";
             }>;
             linked: z$1.ZodBoolean;
         }, z$1.core.$strip>>;
@@ -9035,10 +9035,10 @@ declare const hostDaemonCommandRegistry: {
     "host.delete_skill": HostDaemonCommandDescriptor<"host.delete_skill", z$1.ZodObject<{
         type: z$1.ZodLiteral<"host.delete_skill">;
         scope: z$1.ZodEnum<{
+            "bb-user": "bb-user";
             "bb-project": "bb-project";
-            "provider-project": "provider-project";
             "provider-user": "provider-user";
-            "bb-user": "bb-user";
+            "provider-project": "provider-project";
         }>;
         name: z$1.ZodString;
         cwd: z$1.ZodNullable<z$1.ZodString>;
@@ -9049,8 +9049,8 @@ declare const hostDaemonCommandRegistry: {
     "host.write_skill": HostDaemonCommandDescriptor<"host.write_skill", z$1.ZodObject<{
         type: z$1.ZodLiteral<"host.write_skill">;
         scope: z$1.ZodEnum<{
-            "bb-project": "bb-project";
             "bb-user": "bb-user";
+            "bb-project": "bb-project";
         }>;
         name: z$1.ZodString;
         cwd: z$1.ZodNullable<z$1.ZodString>;
@@ -9147,8 +9147,8 @@ declare const hostDaemonCommandRegistry: {
         selectedBranch: z$1.ZodOptional<z$1.ZodString>;
         limit: z$1.ZodNumber;
         remoteRefresh: z$1.ZodEnum<{
-            background: "background";
             none: "none";
+            background: "background";
         }>;
     }, z$1.core.$strict>, z$1.ZodObject<{
         branches: z$1.ZodArray<z$1.ZodString>;
@@ -9269,8 +9269,8 @@ declare const hostDaemonCommandRegistry: {
                 providerInstallation: z$1.ZodBoolean;
                 supportsServiceTier: z$1.ZodBoolean;
                 permissionModes: z$1.ZodArray<z$1.ZodEnum<{
-                    auto: "auto";
                     "accept-edits": "accept-edits";
+                    auto: "auto";
                     full: "full";
                 }>>;
                 supportsThreadArchive: z$1.ZodBoolean;
@@ -9399,8 +9399,8 @@ declare const hostDaemonCommandRegistry: {
                 providerInstallation: z$1.ZodBoolean;
                 supportsServiceTier: z$1.ZodBoolean;
                 permissionModes: z$1.ZodArray<z$1.ZodEnum<{
-                    auto: "auto";
                     "accept-edits": "accept-edits";
+                    auto: "auto";
                     full: "full";
                 }>>;
                 supportsThreadArchive: z$1.ZodBoolean;
@@ -9436,8 +9436,8 @@ declare const hostDaemonCommandRegistry: {
                 providerInstallation: z$1.ZodBoolean;
                 supportsServiceTier: z$1.ZodBoolean;
                 permissionModes: z$1.ZodArray<z$1.ZodEnum<{
-                    auto: "auto";
                     "accept-edits": "accept-edits";
+                    auto: "auto";
                     full: "full";
                 }>>;
                 supportsThreadArchive: z$1.ZodBoolean;
@@ -9490,8 +9490,8 @@ declare const hostDaemonCommandRegistry: {
                 providerInstallation: z$1.ZodBoolean;
                 supportsServiceTier: z$1.ZodBoolean;
                 permissionModes: z$1.ZodArray<z$1.ZodEnum<{
-                    auto: "auto";
                     "accept-edits": "accept-edits";
+                    auto: "auto";
                     full: "full";
                 }>>;
                 supportsThreadArchive: z$1.ZodBoolean;
@@ -9551,8 +9551,8 @@ declare const hostDaemonCommandRegistry: {
                 providerInstallation: z$1.ZodBoolean;
                 supportsServiceTier: z$1.ZodBoolean;
                 permissionModes: z$1.ZodArray<z$1.ZodEnum<{
-                    auto: "auto";
                     "accept-edits": "accept-edits";
+                    auto: "auto";
                     full: "full";
                 }>>;
                 supportsThreadArchive: z$1.ZodBoolean;
@@ -9605,8 +9605,8 @@ declare const hostDaemonCommandRegistry: {
                 providerInstallation: z$1.ZodBoolean;
                 supportsServiceTier: z$1.ZodBoolean;
                 permissionModes: z$1.ZodArray<z$1.ZodEnum<{
-                    auto: "auto";
                     "accept-edits": "accept-edits";
+                    auto: "auto";
                     full: "full";
                 }>>;
                 supportsThreadArchive: z$1.ZodBoolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@halcyonlabs/app",
-  "version": "0.47.0-halcyon.151",
+  "version": "0.47.0-halcyon.154",
   "description": "bb app launcher for npx",
   "keywords": [
     "bb",

package/server/dist/builtin-plugins/orbit/dist/assets/orbit/revision

@@ -1 +1 @@
-ddb77093407d3f48442a6c11df8bd5be3046f8b4
+258c1d580303d01c95b5bd12b782ff70704deed9

package/server/dist/builtin-plugins/orbit/dist/host.js

@@ -377,7 +377,8 @@ mountpoint -q ${xr} || { systemctl daemon-reload; mount ${xr}; }
 findmnt -no OPTIONS ${xr} | grep -qw ro`});if(c.code!==0)throw new E(`mounting the host's library folder on ${r.name} failed: ${(c.stderr||c.stdout).trim()}`)}return 0}var st,at,Zn,K,Zp,Rp,M$=P(()=>{"use strict";Ce();Tp();hs();it();ot();st={name:"ubuntu-24.04-20260926.qcow2",url:"https://cloud-images.ubuntu.com/releases/24.04/release-20260926/ubuntu-24.04-server-cloudimg-amd64.img",sha256:"6a81c37564db9b1ee84e141922625e1d7c5b389b99bb3c572e0243607d5bb4d2"},at="orbit",Zn="orbit",K="virsh -c qemu:///system",Zp="org.qemu.guest_agent.0";s(T$,"hypervisor");s(ms,"serverName");s(Me,"onServer");s(Z$,"libvirtInfo");s(Qk,"ensureBaseImage");s(R$,"cloudInit");s(ex,"ensureAgentChannel");Rp=["import io, sys","import xml.etree.ElementTree as ET","view, tag = sys.argv[1], sys.argv[2]","text = sys.stdin.read()","for _, (prefix, uri) in ET.iterparse(io.StringIO(text), events=('start-ns',)):","    ET.register_namespace(prefix, uri)","domain = ET.fromstring(text)","devices = domain.find('devices')","backing = domain.find('memoryBacking')","def attr(parent, child, name):","    found = None if parent is None else parent.find(child)","    return None if found is None else found.get(name)","shares = [f for f in devices.findall('filesystem') if attr(f, 'target', 'dir') == tag]","memory_ok = attr(backing, 'source', 'type') == 'memfd' and attr(backing, 'access', 'mode') == 'shared'","share_ok = len(shares) == 1 and attr(shares[0], 'source', 'dir') == view and attr(shares[0], 'driver', 'type') == 'virtiofs'","if memory_ok and share_ok:","    sys.exit(3)","if backing is None:","    backing = ET.SubElement(domain, 'memoryBacking')","for old in [c for c in backing if c.tag in ('source', 'access')]:","    backing.remove(old)","ET.SubElement(backing, 'source', type='memfd')","ET.SubElement(backing, 'access', mode='shared')","for old in shares:","    devices.remove(old)","share = ET.SubElement(devices, 'filesystem', type='mount', accessmode='passthrough')","ET.SubElement(share, 'driver', type='virtiofs')","ET.SubElement(share, 'source', dir=view)","ET.SubElement(share, 'target', dir=tag)","sys.stdout.write(ET.tostring(domain, encoding='unicode'))"].join(`
 `);s(D$,"libraryShare");s(tx,"ensureLibraryShare");s(j$,"ensureLibvirtStation");s(L$,"pinLease");s(rx,"buildLinux")});import{dirname as QP,join as nx}from"node:path";function ox(e,t,r){return e.find(n=>n.kind===t&&n.name===r)}function ix(e){return e.filter(t=>t.kind==="station"&&t.table.server!==void 0&&!ox(e,"server",t.table.server)).map(t=>`station ${t.name} runs on server ${t.table.server}, but Orbit has no server record ${t.table.server}: add it with bb orbit station set ${t.table.server} --server --set driver=aws --set region=\u2026 --set vms=true (or correct the station's server with bb orbit station set ${t.name} --set server=<name>)`)}function V$(e){let t=ix(e);if(t.length)throw new Oe(t.join(`
 `))}var rI,U$=P(()=>{"use strict";Et();it();rI=nx(ce,"machine-records.json");s(ox,"findRecord");s(ix,"missingServerRecords");s(V$,"checkServerRecords")});var H$={};ve(H$,{TERRAFORM_DIR:()=>gs,TFVARS_FILE:()=>J$,awsArgs:()=>W$,awsFirewallRules:()=>dx,awsInfo:()=>q$,awsTfvars:()=>G$,buildAws:()=>fx,provisionAws:()=>px});import{spawn as sx}from"node:child_process";import{existsSync as Lp}from"node:fs";import{mkdir as K$,readFile as ax,writeFile as cx}from"node:fs/promises";import{join as jp}from"node:path";function W$(e){return[...e.region?["--region",e.region]:[],...e.profile?["--profile",e.profile]:[]]}async function Fp(e,t){let r=await ue("aws",[...W$(e),...t,"--output","json"]);if(r.code!==0)throw new E(`aws ${t.slice(0,2).join(" ")} failed: ${r.stderr.trim()||r.stdout.trim()}`);return r.stdout.trim()?ps(r.stdout,"AWS response"):void 0}async function ux(e){let r=(await Fp(e,["ec2","describe-instances","--filters",`Name=tag:Name,Values=${e.name}`,`Name=tag:orbit,Values=${e.role??"station"}`,"Name=instance-state-name,Values=pending,running,stopping,stopped"])).Reservations.flatMap(n=>n.Instances);if(r.length>1)throw new E(`${e.name}: ${r.length} instances in AWS carry its name; expected one (${r.map(n=>n.InstanceId).join(", ")})`);return r[0]}async function q$(e){let t=await ux(e);if(t)return{status:t.State.Name,ipAddress:t.PrivateIpAddress,id:t.InstanceId}}async function lx(e,t){return(await Fp(e,["ssm","describe-instance-information","--filters",`Key=InstanceIds,Values=${t}`])).InstanceInformationList.some(n=>n.PingStatus==="Online")}async function fx(e,t){let r=e.station,n=s(u=>X.log(`  ${u}`),"log");if(X.log(`${r.name} (${r.role==="server"?"host, ":""}EC2${r.region?`, ${r.region}`:""})`),await K$(ce,{recursive:!0,mode:448}),!Lp(ae)){let u=await ue("ssh-keygen",["-q","-t","ed25519","-N","","-C","orbit station admin","-f",ae]);if(u.code!==0)throw new E(`ssh-keygen failed: ${u.stderr.trim()}`);n(`made Orbit's station key (${ae}); Terraform puts its public half on new instances`)}let o=await q$(r);if(!o?.id)throw new E(`${r.name} has no instance in AWS; make it first: pnpm orbit station provision (its record: bb orbit station show ${r.name}${r.role==="server"?" --server":""})`);(o.status==="stopped"||o.status==="stopping")&&(n(`starting ${r.name} (${o.id})`),await Fp(r,["ec2","start-instances","--instance-ids",o.id])),n(`waiting for Session Manager to reach ${o.id}`);let i=Date.now()+6e5;for(;!await lx(r,o.id);){if(Date.now()>i)throw new E(`${r.name}'s SSM agent didn't check in within 10 minutes (is its instance profile orbit-${r.name}, and was the agent restarted after a role change?)`);await new Promise(u=>setTimeout(u,5e3))}n("waiting for ssh");let a=await _e.waitFor(r,600);if(!a)throw new E(`${r.name} didn't answer ssh through Session Manager within 10 minutes`);await a.exec({as:"root",script:"cloud-init status --wait >/dev/null 2>&1 || true"});let c=await kr(a,vr(e),!1);return c!==0?c:kr(a,vr(t),!1)}function G$(e,t,r){let n=[...e,...t].filter(p=>p.driver==="aws"),o=new Set(e.filter(p=>p.driver==="aws").map(p=>p.name)),i=t.filter(p=>p.driver==="aws"&&o.has(p.name)).map(p=>p.name);if(i.length>0)throw new E(`a station and a server in AWS can't share a name: each box's security group, role and instance profile are orbit-<name> (${i.join(", ")} is both)`);if(n.some(p=>p.name==="station"))throw new E("a station or server in AWS can't be named station: orbit-station is the shared security group, role and instance profile an account from before each box had its own still has, and the box's own would collide with them");let a=n[0];if(!a)throw new E('no station or server record in Orbit says driver = "aws"; nothing to provision');let c=s(p=>{if(new Set(n.map(m=>m[p]??"")).size>1)throw new E(`the stations in AWS must share one ${p} (${gs} is one account and region): ${n.map(m=>`${m.name}: ${m[p]??"unset"}`).join(", ")}`);return a[p]},"one"),u=c("region"),l=c("profile"),f=s(p=>({...p.instance_type?{instance_type:p.instance_type}:{},...p.disk_gb?{disk_gb:p.disk_gb}:{},...p.vms?{nested_virtualization:!0}:{}}),"size");return{...u?{region:u}:{},...l?{profile:l}:{},admin_user:a.admin_user,admin_public_key:r.trim(),stations:Object.fromEntries(e.filter(p=>p.driver==="aws").map(p=>[p.name,f(p)])),servers:Object.fromEntries(t.filter(p=>p.driver==="aws").map(p=>{let d=e.filter(m=>m.server===p.name).map(m=>m.name);return[p.name,{...f(p),...d.length?{stations:d}:{}}]}))}}function B$(e,t){return new Promise((r,n)=>{let o=sx("terraform",[`-chdir=${e}`,...t],{stdio:["inherit","pipe","pipe"]});k$(o),o.on("error",i=>n(new E(`terraform: ${i.message} (is Terraform installed?)`))),o.on("close",i=>r(i??1))})}async function px(e,t,r){V$(r);let n=await Promise.all(r.filter(l=>l.kind==="station").map(async l=>(await Op(e,"base",[],l.name,l.table)).station)),o=await Promise.all(r.filter(l=>l.kind==="server").map(async l=>(await us(e,l.name,l.table)).station));if(await K$(ce,{recursive:!0,mode:448}),!Lp(ae)){let l=await ue("ssh-keygen",["-q","-t","ed25519","-N","","-C","orbit station admin","-f",ae]);if(l.code!==0)throw new E(`ssh-keygen failed: ${l.stderr.trim()}`);X.log(`  made Orbit's station key (${ae}); new instances get its public half`)}let i=G$(n,o,await ax(`${ae}.pub`,"utf8")),a=jp(e,gs);await cx(jp(a,J$),`${JSON.stringify(i,null,2)}
-`);let c=Object.keys(i.stations),u=Object.keys(i.servers);if(X.log(`${gs}: ${c.length===1?"1 station":`${c.length} stations`} from Orbit's station records (${c.join(", ")||"none"}), ${u.length===1?"1 host":`${u.length} hosts`} from its server records (${u.join(", ")||"none"})`),!Lp(jp(a,".terraform"))){let l=await B$(a,["init","-input=false"]);if(l!==0)return l}return B$(a,t?["plan","-input=false"]:["apply"])}function dx(e){return[`ip daddr { ${e.replace(/\.0\/24$/,".2")}, 169.254.169.253 } meta l4proto { tcp, udp } th dport 53 accept`,'ip daddr 169.254.169.254 meta skuid "root" accept',"ip daddr 169.254.169.123 udp dport 123 accept",'meta skuid "root" tcp dport 443 accept']}var gs,J$,X$=P(()=>{"use strict";Ce();Ce();Ce();Tp();Et();U$();it();ot();gs="orbit/infra/aws",J$="stations.auto.tfvars.json";s(W$,"awsArgs");s(Fp,"aws");s(ux,"instanceOf");s(q$,"awsInfo");s(lx,"ssmOnline");s(fx,"buildAws");s(G$,"awsTfvars");s(B$,"terraform");s(px,"provisionAws");s(dx,"awsFirewallRules")});import{spawn as Q$}from"node:child_process";import{existsSync as mx}from"node:fs";import{homedir as ey}from"node:os";import{join as ys}from"node:path";function ue(e,t,r="",n){if(Cp(t))throw new E("refusing to put a secret in command arguments");return new Promise((o,i)=>{let a=e==="ssh"&&ty?["-o","StrictHostKeyChecking=yes","-o","UpdateHostKeys=no","-o","ControlMaster=no","-o","ControlPath=none",...t]:t,c=Q$(e,a,{stdio:["pipe","pipe","pipe"],env:n??process.env}),u="",l="";c.stdout.on("data",f=>u+=f),c.stderr.on("data",f=>l+=f),c.on("error",i),c.on("close",f=>o({code:f??1,stdout:u,stderr:l})),c.stdin.on("error",()=>{}),c.stdin.end(r)})}function hx(){let e=ys(ey(),".local","bin","lume");return process.env.LUME??(mx(e)?e:"lume")}async function gx(e){let t=await ue(hx(),["get",e,"--format","json"]);if(t.code!==0){if(/not found|does not exist/i.test(t.stderr+t.stdout))return;throw new E(`lume get ${e} failed (exit ${t.code}); VM output is withheld because it may contain credentials`)}let r=t.stdout.search(/^[[{]/m),n=ps(r>=0?t.stdout.slice(r):t.stdout,`lume get ${e}`),o=Array.isArray(n)?n[0]:n;if(o?.vncUrl){nt(o.vncUrl);let i;try{i=new URL(o.vncUrl)}catch{throw new E(`lume get ${e} returned an invalid VNC address; contents withheld`)}nt(decodeURIComponent(i.password))}return o}async function Sr(e){if(e.driver==="libvirt"){let{libvirtInfo:t}=await Promise.resolve().then(()=>(M$(),F$));return t(e)}if(e.driver==="aws"){let{awsInfo:t}=await Promise.resolve().then(()=>(X$(),H$));return t(e)}return gx(e.name)}async function $x(e){let t=await Sr(e);if(t?.status!=="running"||!t.ipAddress){let r={libvirt:`virsh -c qemu:///system start ${e.name} (on ${e.server??e.hypervisor})`,aws:`orbit station build --station ${e.name}`,lume:`lume run ${e.name} --detach --display none`}[e.driver??"lume"];throw new E(`${e.name} isn't running (status: ${t?.status??"no such VM"}). Start it with: ${r}`)}return{host:t.id??t.ipAddress,address:t.ipAddress}}function yx(e){return["aws",...[...e.region?["--region",e.region]:[],...e.profile?["--profile",e.profile]:[]],"ssm","start-session","--target","%h","--document-name","AWS-StartSSHSession","--parameters","portNumber=%p"].join(" ")}function Mp(e){return e.driver==="libvirt"&&!e.server?{jump:e.hypervisor}:e.driver==="aws"?{proxyCommand:yx(e)}:{}}async function $s(e){if(e.driver!=="libvirt"||!e.server)return Mp(e);let{serverProxyCommand:t}=await Promise.resolve().then(()=>(hs(),ry)),r=await t(e);return r?{proxyCommand:r}:{}}function Y$(e){return`/usr/bin/env XDG_RUNTIME_DIR=/run/user/$(id -u ${e}) DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/$(id -u ${e})/bus`}function Tt(e={},t=ty){return[...e.jump?["-o",`ProxyJump=${e.jump}`]:[],...e.proxyCommand?["-o",`ProxyCommand=${e.proxyCommand}`]:[],"-i",ae,"-o","IdentitiesOnly=yes","-o","BatchMode=yes","-o","ConnectTimeout=10","-o",t?"StrictHostKeyChecking=yes":"StrictHostKeyChecking=accept-new",...t?["-o","UpdateHostKeys=no","-o","ControlMaster=no","-o","ControlPath=none"]:[],"-o",`UserKnownHostsFile=${ys(ce,"known_hosts")}`]}var ce,ae,E,ty,_e,it=P(()=>{"use strict";Ce();Ce();ot();ce=ys(ey(),".config","orbit"),ae=ys(ce,"station_ed25519"),E=class extends Error{static{s(this,"StationError")}constructor(t){super(we(t))}},ty=!1;s(ue,"run");s(hx,"lume");s(gx,"vmInfo");s(Sr,"vmInfoFor");s($x,"address_");s(yx,"ssmProxyCommand");s(Mp,"sshVia");s($s,"sshViaFor");_e=class e{static{s(this,"Station")}name;host;address;admin;desktopUser;os;via;readOnly=!1;constructor(t,r,n,o){this.name=t.name,this.host=r,this.address=n,this.admin=t.admin_user,this.desktopUser=t.desktop_user,this.os=t.os,this.via=o}static async connect(t,r=!1){let{host:n,address:o}=await $x(t),i=new e(t,n,o,await $s(t));return i.readOnly=r,i}static async waitFor(t,r=180){let n=Date.now()+r*1e3;for(;Date.now()<n;){let o=await Sr(t);if(o?.status==="running"&&o.ipAddress){let i=new e(t,o.id??o.ipAddress,o.ipAddress,await $s(t));if((await i.exec({as:"root",script:"id -u"})).stdout.trim()==="0")return i}await new Promise(i=>setTimeout(i,3e3))}}async exec(t){let r=k(this.desktopUser),n={root:"sudo -n /bin/bash -s",admin:"/bin/bash -l -s",orbit:this.os==="linux"?`sudo -n -u ${r} -H ${Y$(r)} /bin/bash -s`:`if [ "$(stat -f %Su /dev/console)" = ${r} ]; then sudo -n launchctl asuser "$(id -u ${r})" sudo -n -u ${r} -H /bin/bash -s; else sudo -n -u ${r} -H /bin/bash -s; fi`}[t.as];for(let o=1;;o++){let i=await ue("ssh",[...Tt(this.via,this.readOnly),`${this.admin}@${this.host}`,`cd / && ${n}`],t.script);if(!(i.code===255&&i.stdout===""&&/Connection (closed|refused|reset)|timed out/.test(i.stderr))||o>=6)return i;await new Promise(c=>setTimeout(c,1e4))}}run(t){if(Cp(t.argv))throw new E("refusing to put a secret in command arguments");let r=k(this.desktopUser),n=t.argv.map(k).join(" "),o=this.os==="linux"?`cd / && exec sudo -n -u ${r} -H ${Y$(r)} PATH=/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin ${n}`:`cd / && if [ "$(stat -f %Su /dev/console)" = ${r} ]; then exec sudo -n launchctl asuser "$(id -u ${r})" sudo -n -u ${r} -H /usr/bin/env PATH=/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin ${n}; else exec sudo -n -u ${r} -H /usr/bin/env PATH=/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin ${n}; fi`;return new Promise((i,a)=>{let c=Q$("ssh",[...Tt(this.via),`${this.admin}@${this.host}`,o],{stdio:["pipe","pipe","pipe"]}),u=s(()=>c.kill("SIGTERM"),"stop"),l=setTimeout(u,t.timeoutMs);t.signal.addEventListener("abort",u,{once:!0});let f=Tn(t.onOutput),p=Tn(t.onOutput);c.stdout.on("data",d=>f.write(d)),c.stderr.on("data",d=>p.write(d)),c.on("error",a),c.on("close",d=>{f.end(),p.end(),clearTimeout(l),t.signal.removeEventListener("abort",u),i(d??1)}),c.stdin.end(t.stdin)})}};s(Y$,"userSession");s(Tt,"sshOptions")});var ry={};ve(ry,{BUCKET_PATH:()=>xr,HOST_LIBRARY_SOURCES:()=>Kp,HOST_MARKER:()=>Up,LIBRARY_ROOT:()=>Dp,LIBRARY_TAG:()=>Nt,SHARE_ROOT:()=>Rn,hostLibrarySource:()=>wx,onHost:()=>jn,onHostItself:()=>bs,repoDir:()=>iy,serverOf:()=>Dn,serverProxyCommand:()=>bx,useServerRecord:()=>Jp});import{existsSync as Vp,readFileSync as oy}from"node:fs";import{join as ny}from"node:path";function iy(){let e=ny(ce,"repo"),t=Vp(e)?oy(e,"utf8").trim():"";if(!t||!Vp(ny(t,"orbit","config")))throw new E("this machine has no Orbit repository on record: run any `pnpm orbit \u2026` command in it once");return t}function Jp(e,t){t?Bp.set(e,t):Bp.delete(e)}async function Dn(e,t=iy){if(!e.server)throw new E(`${e.name}: a station on a host needs \`server\` (a name in orbit/config/servers/)`);let r=(await us(t(),e.server,Bp.get(e.server))).station;if(!r.vms)throw new E(`${e.name}: its server ${r.name} doesn't carry station VMs; set \`vms = true\` in orbit/config/servers/${r.name}.toml and run orbit server build`);return r}function bs(e){return Vp(Up)&&oy(Up,"utf8").trim()===e.name}async function jn(e,t,r=""){if(bs(e))return ue("/bin/bash",["-c",t],r);let n=await _e.connect(e);return ue("ssh",[...Tt(n.via),`${n.admin}@${n.host}`,`bash -c ${k(t)}`],r)}async function bx(e){let t=await Dn(e);if(bs(t))return;let r=await _e.connect(t);return["ssh",...[...r.via.proxyCommand?["-o",`ProxyCommand=${r.via.proxyCommand.replaceAll("%h",r.host).replaceAll("%p","22")}`]:r.via.jump?["-o",`ProxyJump=${r.via.jump}`]:[],...Tt({}),`${r.admin}@${r.host}`,"-W","%h:%p"].map(k)].join(" ")}async function wx(e,t){let r=await Dn(e),n=`${Kp}/${e.name}.conf`,o=(bs(r),"sudo -n");if(!t){let c=await jn(r,`${o} rm -f ${k(n)} && echo removed`);if(c.code!==0)throw new E(`removing ${e.name}'s library source on ${r.name} failed: ${(c.stderr||c.stdout).trim()}`);return`no library source: ${r.name} pulls nothing for ${e.name}`}if(t.item)throw new E(`${e.name}: the library's source names a vault item (${t.item}), which its host can't read yet; use a source the host's instance role or plain options reach`);let i=`# Orbit: ${e.name}'s library source (orbit station policy). Changes here don't last.
+`);let c=Object.keys(i.stations),u=Object.keys(i.servers);if(X.log(`${gs}: ${c.length===1?"1 station":`${c.length} stations`} from Orbit's station records (${c.join(", ")||"none"}), ${u.length===1?"1 host":`${u.length} hosts`} from its server records (${u.join(", ")||"none"})`),!Lp(jp(a,".terraform"))){let l=await B$(a,["init","-input=false"]);if(l!==0)return l}return B$(a,t?["plan","-input=false"]:["apply"])}function dx(e){return[`ip daddr { ${e.replace(/\.0\/24$/,".2")}, 169.254.169.253 } meta l4proto { tcp, udp } th dport 53 accept`,'ip daddr 169.254.169.254 meta skuid "root" accept',"ip daddr 169.254.169.123 udp dport 123 accept",'meta skuid "root" tcp dport 443 accept']}var gs,J$,X$=P(()=>{"use strict";Ce();Ce();Ce();Tp();Et();U$();it();ot();gs="orbit/infra/aws",J$="stations.auto.tfvars.json";s(W$,"awsArgs");s(Fp,"aws");s(ux,"instanceOf");s(q$,"awsInfo");s(lx,"ssmOnline");s(fx,"buildAws");s(G$,"awsTfvars");s(B$,"terraform");s(px,"provisionAws");s(dx,"awsFirewallRules")});import{spawn as Q$}from"node:child_process";import{existsSync as mx}from"node:fs";import{homedir as ey}from"node:os";import{join as ys}from"node:path";function ue(e,t,r="",n){if(Cp(t))throw new E("refusing to put a secret in command arguments");return new Promise((o,i)=>{let a=e==="ssh"&&ty?["-o","StrictHostKeyChecking=yes","-o","UpdateHostKeys=no","-o","ControlMaster=no","-o","ControlPath=none",...t]:t,c=Q$(e,a,{stdio:["pipe","pipe","pipe"],env:n??process.env}),u="",l="";c.stdout.on("data",f=>u+=f),c.stderr.on("data",f=>l+=f),c.on("error",i),c.on("close",f=>o({code:f??1,stdout:u,stderr:l})),c.stdin.on("error",()=>{}),c.stdin.end(r)})}function hx(){let e=ys(ey(),".local","bin","lume");return process.env.LUME??(mx(e)?e:"lume")}async function gx(e){let t=await ue(hx(),["get",e,"--format","json"]);if(t.code!==0){if(/not found|does not exist/i.test(t.stderr+t.stdout))return;throw new E(`lume get ${e} failed (exit ${t.code}); VM output is withheld because it may contain credentials`)}let r=t.stdout.search(/^[[{]/m),n=ps(r>=0?t.stdout.slice(r):t.stdout,`lume get ${e}`),o=Array.isArray(n)?n[0]:n;if(o?.vncUrl){nt(o.vncUrl);let i;try{i=new URL(o.vncUrl)}catch{throw new E(`lume get ${e} returned an invalid VNC address; contents withheld`)}nt(decodeURIComponent(i.password))}return o}async function Sr(e){if(e.driver==="libvirt"){let{libvirtInfo:t}=await Promise.resolve().then(()=>(M$(),F$));return t(e)}if(e.driver==="aws"){let{awsInfo:t}=await Promise.resolve().then(()=>(X$(),H$));return t(e)}return gx(e.name)}async function $x(e){let t=await Sr(e);if(t?.status!=="running"||!t.ipAddress){let r={libvirt:`virsh -c qemu:///system start ${e.name} (on ${e.server??e.hypervisor})`,aws:`orbit station build --station ${e.name}`,lume:`lume run ${e.name} --detach --display none`}[e.driver??"lume"];throw new E(`${e.name} isn't running (status: ${t?.status??"no such VM"}). Start it with: ${r}`)}return{host:t.id??t.ipAddress,address:t.ipAddress}}function yx(e){return["aws",...[...e.region?["--region",e.region]:[],...e.profile?["--profile",e.profile]:[]],"ssm","start-session","--target","%h","--document-name","AWS-StartSSHSession","--parameters","portNumber=%p"].join(" ")}function Mp(e){return e.driver==="libvirt"&&!e.server?{jump:e.hypervisor}:e.driver==="aws"?{proxyCommand:yx(e)}:{}}async function $s(e){if(e.driver!=="libvirt"||!e.server)return Mp(e);let{serverProxyCommand:t}=await Promise.resolve().then(()=>(hs(),ry)),r=await t(e);return r?{proxyCommand:r}:{}}function Y$(e){return`/usr/bin/env XDG_RUNTIME_DIR=/run/user/$(id -u ${e}) DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/$(id -u ${e})/bus`}function Tt(e={},t=ty){return[...e.jump?["-o",`ProxyJump=${e.jump}`]:[],...e.proxyCommand?["-o",`ProxyCommand=${e.proxyCommand}`]:[],"-i",ae,"-o","IdentitiesOnly=yes","-o","BatchMode=yes","-o","ConnectTimeout=10","-o",t?"StrictHostKeyChecking=yes":"StrictHostKeyChecking=accept-new",...t?["-o","UpdateHostKeys=no","-o","ControlMaster=no","-o","ControlPath=none"]:[],"-o",`UserKnownHostsFile=${ys(ce,"known_hosts")}`]}var ce,ae,E,ty,_e,it=P(()=>{"use strict";Ce();Ce();ot();ce=ys(ey(),".config","orbit"),ae=ys(ce,"station_ed25519"),E=class extends Error{static{s(this,"StationError")}constructor(t){super(we(t))}},ty=!1;s(ue,"run");s(hx,"lume");s(gx,"vmInfo");s(Sr,"vmInfoFor");s($x,"address_");s(yx,"ssmProxyCommand");s(Mp,"sshVia");s($s,"sshViaFor");_e=class e{static{s(this,"Station")}name;host;address;admin;desktopUser;os;via;readOnly=!1;constructor(t,r,n,o){this.name=t.name,this.host=r,this.address=n,this.admin=t.admin_user,this.desktopUser=t.desktop_user,this.os=t.os,this.via=o}static async connect(t,r=!1){let{host:n,address:o}=await $x(t),i=new e(t,n,o,await $s(t));return i.readOnly=r,i}static async waitFor(t,r=180){let n=Date.now()+r*1e3;for(;Date.now()<n;){let o=await Sr(t);if(o?.status==="running"&&o.ipAddress){let i=new e(t,o.id??o.ipAddress,o.ipAddress,await $s(t));if((await i.exec({as:"root",script:"id -u"})).stdout.trim()==="0")return i}await new Promise(i=>setTimeout(i,3e3))}}async exec(t){let r=k(this.desktopUser),n={root:"sudo -n /bin/bash -s",admin:"/bin/bash -l -s",orbit:this.os==="linux"?`sudo -n -u ${r} -H ${Y$(r)} /bin/bash -s`:`if [ "$(stat -f %Su /dev/console)" = ${r} ]; then sudo -n launchctl asuser "$(id -u ${r})" sudo -n -u ${r} -H /bin/bash -s; else sudo -n -u ${r} -H /bin/bash -s; fi`}[t.as],o=t.as==="orbit"&&this.os==="linux"?`if [ -f /etc/profile.d/orbit-outbound.sh ]; then . /etc/profile.d/orbit-outbound.sh || exit $?; fi
+${t.script}`:t.script;for(let i=1;;i++){let a=await ue("ssh",[...Tt(this.via,this.readOnly),`${this.admin}@${this.host}`,`cd / && ${n}`],o);if(!(a.code===255&&a.stdout===""&&/Connection (closed|refused|reset)|timed out/.test(a.stderr))||i>=6)return a;await new Promise(u=>setTimeout(u,1e4))}}run(t){if(Cp(t.argv))throw new E("refusing to put a secret in command arguments");let r=k(this.desktopUser),n=t.argv.map(k).join(" "),o=this.os==="linux"?`cd / && exec sudo -n -u ${r} -H ${Y$(r)} PATH=/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin ${n}`:`cd / && if [ "$(stat -f %Su /dev/console)" = ${r} ]; then exec sudo -n launchctl asuser "$(id -u ${r})" sudo -n -u ${r} -H /usr/bin/env PATH=/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin ${n}; else exec sudo -n -u ${r} -H /usr/bin/env PATH=/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin ${n}; fi`;return new Promise((i,a)=>{let c=Q$("ssh",[...Tt(this.via),`${this.admin}@${this.host}`,o],{stdio:["pipe","pipe","pipe"]}),u=s(()=>c.kill("SIGTERM"),"stop"),l=setTimeout(u,t.timeoutMs);t.signal.addEventListener("abort",u,{once:!0});let f=Tn(t.onOutput),p=Tn(t.onOutput);c.stdout.on("data",d=>f.write(d)),c.stderr.on("data",d=>p.write(d)),c.on("error",a),c.on("close",d=>{f.end(),p.end(),clearTimeout(l),t.signal.removeEventListener("abort",u),i(d??1)}),c.stdin.end(t.stdin)})}};s(Y$,"userSession");s(Tt,"sshOptions")});var ry={};ve(ry,{BUCKET_PATH:()=>xr,HOST_LIBRARY_SOURCES:()=>Kp,HOST_MARKER:()=>Up,LIBRARY_ROOT:()=>Dp,LIBRARY_TAG:()=>Nt,SHARE_ROOT:()=>Rn,hostLibrarySource:()=>wx,onHost:()=>jn,onHostItself:()=>bs,repoDir:()=>iy,serverOf:()=>Dn,serverProxyCommand:()=>bx,useServerRecord:()=>Jp});import{existsSync as Vp,readFileSync as oy}from"node:fs";import{join as ny}from"node:path";function iy(){let e=ny(ce,"repo"),t=Vp(e)?oy(e,"utf8").trim():"";if(!t||!Vp(ny(t,"orbit","config")))throw new E("this machine has no Orbit repository on record: run any `pnpm orbit \u2026` command in it once");return t}function Jp(e,t){t?Bp.set(e,t):Bp.delete(e)}async function Dn(e,t=iy){if(!e.server)throw new E(`${e.name}: a station on a host needs \`server\` (a name in orbit/config/servers/)`);let r=(await us(t(),e.server,Bp.get(e.server))).station;if(!r.vms)throw new E(`${e.name}: its server ${r.name} doesn't carry station VMs; set \`vms = true\` in orbit/config/servers/${r.name}.toml and run orbit server build`);return r}function bs(e){return Vp(Up)&&oy(Up,"utf8").trim()===e.name}async function jn(e,t,r=""){if(bs(e))return ue("/bin/bash",["-c",t],r);let n=await _e.connect(e);return ue("ssh",[...Tt(n.via),`${n.admin}@${n.host}`,`bash -c ${k(t)}`],r)}async function bx(e){let t=await Dn(e);if(bs(t))return;let r=await _e.connect(t);return["ssh",...[...r.via.proxyCommand?["-o",`ProxyCommand=${r.via.proxyCommand.replaceAll("%h",r.host).replaceAll("%p","22")}`]:r.via.jump?["-o",`ProxyJump=${r.via.jump}`]:[],...Tt({}),`${r.admin}@${r.host}`,"-W","%h:%p"].map(k)].join(" ")}async function wx(e,t){let r=await Dn(e),n=`${Kp}/${e.name}.conf`,o=(bs(r),"sudo -n");if(!t){let c=await jn(r,`${o} rm -f ${k(n)} && echo removed`);if(c.code!==0)throw new E(`removing ${e.name}'s library source on ${r.name} failed: ${(c.stderr||c.stdout).trim()}`);return`no library source: ${r.name} pulls nothing for ${e.name}`}if(t.item)throw new E(`${e.name}: the library's source names a vault item (${t.item}), which its host can't read yet; use a source the host's instance role or plain options reach`);let i=`# Orbit: ${e.name}'s library source (orbit station policy). Changes here don't last.
 # path: ${t.path}
 ${t.config}`,a=await jn(r,`set -euo pipefail
 ${o} install -d -o root -g root -m 700 ${Kp}

package/server/dist/builtin-plugins/orbit/dist/host.meta.json

@@ -8,5 +8,5 @@
     "bbVersion": "0.47.0",
     "pluginSdkVersion": "0.6.79"
   },
-  "artifactDigest": "ac8d8c074083d9d21bad4264cff9a672dc7a9bd50475b8a31216cf24d7ac0cb5"
+  "artifactDigest": "6cdd762dcaaaf490f7f0ac9eb13885315194f4cccff79ee9f70a55d74f500aba"
 }