@harness-control/runner 0.1.0

package/dist/local-actions/executors.js

@@ -0,0 +1,1103 @@
+import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
+import { realpathSync } from "node:fs";
+import { lstat, mkdir, readdir, readFile, realpath, rm, writeFile } from "node:fs/promises";
+import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { redactValue } from "../mcp/redaction.js";
+import { LocalCapabilityPolicyError, } from "./index.js";
+const MAX_CAPTURED_OUTPUT_BYTES = 64 * 1024;
+const PROCESS_TIMEOUT_KILL_GRACE_MS = 500;
+const PROCESS_FORCE_KILL_SETTLE_MS = 500;
+const DEV_SERVER_START_SETTLE_MS = 250;
+const DEV_SERVER_READINESS_POLL_MS = 100;
+export class LocalCapabilityExecutor {
+    #engine;
+    #auditLogger;
+    #devServers = new Map();
+    constructor(engine, auditLogger) {
+        this.#engine = engine;
+        this.#auditLogger = auditLogger;
+    }
+    async readFile(context, path, options = {}) {
+        return this.#runAction(context, "filesystem", "read_file", "read", async () => {
+            this.#engine.authorizeFilesystemAction(context.lease, {
+                session_id: context.session_id,
+                turn_id: context.turn_id,
+                workspace_id: context.workspace_id,
+                provider_instance_id: context.provider_instance_id,
+                action: "read",
+            });
+            const resolvedPath = await resolveExistingWorkspacePath(path, context.workspace_root);
+            const contentBytes = await readFile(resolvedPath);
+            const selectedBytes = applyByteRange(contentBytes, options.range);
+            const limitedContent = limitBuffer(selectedBytes, options.contentByteLimit);
+            const encoding = options.encoding ?? "utf8";
+            return {
+                path: workspaceRelativePath(resolvedPath, context.workspace_root),
+                content: encodeBuffer(limitedContent.buffer, encoding),
+                encoding,
+                hash: sha256Hash(contentBytes),
+                ...(limitedContent.truncated ? { truncated: true } : {}),
+            };
+        });
+    }
+    async listDirectory(context, path, options = {}) {
+        return this.#runAction(context, "filesystem", "list_directory", "list", async () => {
+            this.#engine.authorizeFilesystemAction(context.lease, {
+                session_id: context.session_id,
+                turn_id: context.turn_id,
+                workspace_id: context.workspace_id,
+                provider_instance_id: context.provider_instance_id,
+                action: "list",
+            });
+            const resolvedPath = await resolveExistingWorkspacePath(path, context.workspace_root);
+            const listResult = await listWorkspaceEntries(resolvedPath, options);
+            return {
+                path: workspaceRelativePath(resolvedPath, context.workspace_root),
+                entries: listResult.entries,
+                ...(listResult.truncated ? { truncated: true } : {}),
+            };
+        });
+    }
+    async writeFile(context, path, content, options = {}) {
+        const filesystemAction = options.mode === "create" ? "create" : "write";
+        return this.#runAction(context, "filesystem", "write_file", filesystemAction, async () => {
+            assertWritableSandbox(context, filesystemAction);
+            this.#engine.authorizeFilesystemAction(context.lease, {
+                session_id: context.session_id,
+                turn_id: context.turn_id,
+                workspace_id: context.workspace_id,
+                provider_instance_id: context.provider_instance_id,
+                action: filesystemAction,
+            });
+            const resolvedPath = await resolveWritableWorkspacePath(path, context.workspace_root);
+            await assertWriteModeAllowed(resolvedPath, options);
+            const contentBytes = decodeContent(content, options.encoding ?? "utf8");
+            if (options.createParents ?? true) {
+                await mkdir(dirname(resolvedPath), { recursive: true });
+            }
+            await writeFile(resolvedPath, contentBytes);
+            const writtenBytes = await readFile(resolvedPath);
+            return {
+                path: workspaceRelativePath(resolvedPath, context.workspace_root),
+                bytes_written: contentBytes.byteLength,
+                new_hash: sha256Hash(writtenBytes),
+            };
+        });
+    }
+    async patchFile(context, path, options) {
+        return this.#runAction(context, "filesystem", "patch_file", "patch", async () => {
+            assertWritableSandbox(context, "patch");
+            this.#engine.authorizeFilesystemAction(context.lease, {
+                session_id: context.session_id,
+                turn_id: context.turn_id,
+                workspace_id: context.workspace_id,
+                provider_instance_id: context.provider_instance_id,
+                action: "patch",
+            });
+            const resolvedPath = await resolveWritableWorkspacePath(path, context.workspace_root);
+            const existingBytes = await readExistingFileForPatch(resolvedPath, options.createIfMissing ?? false);
+            assertExpectedHash(existingBytes, options.expectedBaseHash);
+            const originalContent = existingBytes.toString("utf8");
+            const patchResult = applyUnifiedDiff(originalContent, options.patchContent);
+            const newBytes = Buffer.from(patchResult.content, "utf8");
+            if (patchResult.changed) {
+                await mkdir(dirname(resolvedPath), { recursive: true });
+                await writeFile(resolvedPath, newBytes);
+            }
+            return {
+                path: workspaceRelativePath(resolvedPath, context.workspace_root),
+                changed: patchResult.changed,
+                new_hash: sha256Hash(newBytes),
+            };
+        });
+    }
+    async deletePath(context, path) {
+        return this.#runAction(context, "filesystem", "delete_path", "delete", async () => {
+            assertWritableSandbox(context, "delete");
+            this.#engine.authorizeFilesystemAction(context.lease, {
+                session_id: context.session_id,
+                turn_id: context.turn_id,
+                workspace_id: context.workspace_id,
+                provider_instance_id: context.provider_instance_id,
+                action: "delete",
+            });
+            const resolvedPath = await resolveExistingWorkspacePath(path, context.workspace_root);
+            await rm(resolvedPath, { recursive: true, force: false });
+            return {
+                path: workspaceRelativePath(resolvedPath, context.workspace_root),
+            };
+        });
+    }
+    async git(context, operation, options = {}) {
+        return this.#runAction(context, "git", `git.${operation}`, operation, async () => {
+            if (operation === "commit" || operation === "checkout" || operation === "push") {
+                assertWritableSandbox(context, operation);
+            }
+            this.#engine.authorizeGitAction(context.lease, {
+                session_id: context.session_id,
+                turn_id: context.turn_id,
+                workspace_id: context.workspace_id,
+                provider_instance_id: context.provider_instance_id,
+                action: operation,
+            });
+            const cwd = await resolveExistingWorkspacePath(".", context.workspace_root);
+            const argv = await gitArgvForOperation(operation, context.workspace_root, options);
+            const outputByteLimit = operation === "status" ? options.status?.outputByteLimit : operation === "diff" ? options.diff?.outputByteLimit : undefined;
+            const output = await runProcess("git", argv, {
+                cwd,
+                timeoutSeconds: 30,
+                useShell: false,
+                env: minimalEnv(),
+                ...(outputByteLimit ? { stdoutByteLimit: outputByteLimit } : {}),
+            });
+            return {
+                operation,
+                exit_code: output.exitCode ?? 1,
+                stdout: output.stdout,
+                stderr: output.stderr,
+                ...(output.stdoutTruncated ? { stdout_truncated: true } : {}),
+                ...(output.stderrTruncated ? { stderr_truncated: true } : {}),
+                ...gitStatusBranchResult(operation, options, output.stdout),
+            };
+        });
+    }
+    async shell(context, request) {
+        return this.#runAction(context, "shell", "run_command", "run_command", async () => {
+            const cwd = await resolveExistingWorkspacePath(request.cwd ?? ".", context.workspace_root);
+            const useShell = request.use_shell ?? false;
+            await this.#engine.authorizeShellCommand(context.lease, {
+                session_id: context.session_id,
+                turn_id: context.turn_id,
+                workspace_id: context.workspace_id,
+                provider_instance_id: context.provider_instance_id,
+                executable: request.executable,
+                argv: request.argv,
+                cwd,
+                workspace_root: context.workspace_root,
+                use_shell: useShell,
+                timeout_seconds: request.timeout_seconds,
+                env: request.env ?? {},
+            });
+            const output = await runProcess(request.executable, request.argv, {
+                cwd,
+                timeoutSeconds: request.timeout_seconds,
+                useShell,
+                env: processEnvFor(request.env),
+                ...(request.stdin !== undefined ? { stdin: request.stdin } : {}),
+                ...(request.stdout_byte_limit ? { stdoutByteLimit: request.stdout_byte_limit } : {}),
+                ...(request.stderr_byte_limit ? { stderrByteLimit: request.stderr_byte_limit } : {}),
+                ...(request.signal ? { signal: request.signal } : {}),
+            });
+            return {
+                executable: request.executable,
+                argv: request.argv,
+                cwd,
+                exit_code: output.exitCode,
+                signal: output.signal,
+                stdout: output.stdout,
+                stderr: output.stderr,
+                timed_out: output.timedOut,
+                ...(output.stdoutTruncated ? { stdout_truncated: true } : {}),
+                ...(output.stderrTruncated ? { stderr_truncated: true } : {}),
+            };
+        });
+    }
+    async startDevServer(context, request) {
+        return this.#runAction(context, "dev_server", "dev_server.start", "start", async () => {
+            if (this.#devServers.has(request.server_id)) {
+                throw new LocalCapabilityPolicyError("local_capability_dev_server_exists", `Dev server '${request.server_id}' is already running.`);
+            }
+            assertAllowedDevServerEndpoint(request.host, request.port);
+            const cwd = await resolveExistingWorkspacePath(request.cwd ?? ".", context.workspace_root);
+            await this.#engine.authorizeDevServerAction(context.lease, {
+                session_id: context.session_id,
+                turn_id: context.turn_id,
+                workspace_id: context.workspace_id,
+                provider_instance_id: context.provider_instance_id,
+                action: "start",
+                executable: request.executable,
+                argv: request.argv,
+                cwd,
+                workspace_root: context.workspace_root,
+                use_shell: request.use_shell ?? false,
+                timeout_seconds: request.timeout_seconds,
+                env: request.env ?? {},
+            });
+            if (request.session_active && !request.session_active()) {
+                throw new LocalCapabilityPolicyError("local_capability_lease_revoked", "Local action session stopped before dev server start.");
+            }
+            const child = spawn(request.executable, request.argv, {
+                cwd,
+                shell: request.use_shell ?? false,
+                env: processEnvFor(request.env),
+                detached: true,
+                stdio: "pipe",
+            });
+            child.once("error", () => {
+                this.#devServers.delete(request.server_id);
+            });
+            child.stdout.on("data", () => undefined);
+            child.stderr.on("data", () => undefined);
+            const pid = child.pid;
+            if (pid === undefined) {
+                throw new LocalCapabilityPolicyError("local_capability_dev_server_start_failed", "Dev server process did not expose a pid.");
+            }
+            const record = {
+                server_id: request.server_id,
+                pid,
+                host: request.host,
+                port: request.port,
+                cwd,
+                started_at: new Date().toISOString(),
+            };
+            this.#devServers.set(request.server_id, {
+                ...record,
+                session_id: context.session_id,
+                process: child,
+            });
+            child.once("exit", () => {
+                this.#devServers.delete(request.server_id);
+            });
+            try {
+                await waitForDevServerStartup(child, request);
+            }
+            catch (error) {
+                await terminateProcessTree(child, "SIGTERM", PROCESS_TIMEOUT_KILL_GRACE_MS);
+                this.#devServers.delete(request.server_id);
+                throw error;
+            }
+            return record;
+        });
+    }
+    async stopDevServer(context, serverId, signal = "SIGTERM", timeoutMs = 5_000) {
+        return this.#runAction(context, "dev_server", "dev_server.stop", "stop", async () => {
+            await this.#engine.authorizeDevServerAction(context.lease, {
+                session_id: context.session_id,
+                turn_id: context.turn_id,
+                workspace_id: context.workspace_id,
+                provider_instance_id: context.provider_instance_id,
+                action: "stop",
+            });
+            const server = this.#devServers.get(serverId);
+            if (!server) {
+                throw new LocalCapabilityPolicyError("local_capability_dev_server_not_found", `Dev server '${serverId}' is not running.`);
+            }
+            await terminateProcessTree(server.process, signal, timeoutMs);
+            this.#devServers.delete(serverId);
+            return { server_id: serverId };
+        });
+    }
+    listDevServers() {
+        return Array.from(this.#devServers.values()).map(({ process: _process, session_id: _sessionId, ...record }) => record);
+    }
+    async stopDevServersForSession(sessionId, timeoutMs = 5_000) {
+        for (const server of Array.from(this.#devServers.values())) {
+            if (server.session_id !== sessionId) {
+                continue;
+            }
+            await terminateProcessTree(server.process, "SIGTERM", timeoutMs);
+            this.#devServers.delete(server.server_id);
+        }
+    }
+    async #runAction(context, capabilityId, action, policyAction, run) {
+        const events = [
+            localCapabilityEvent(context, "local_capability.action.started", capabilityId, action, "started"),
+        ];
+        await this.#recordAudit(context, `${capabilityId}.${action}.started`, { capability_id: capabilityId, action });
+        try {
+            const result = await run();
+            events.push(localCapabilityEvent(context, "local_capability.action.completed", capabilityId, action, "completed", {
+                output: summarizeResult(result),
+            }));
+            await this.#recordAudit(context, `${capabilityId}.${action}.completed`, {
+                capability_id: capabilityId,
+                action,
+                result: summarizeResult(result),
+            });
+            return { result, events };
+        }
+        catch (error) {
+            const errorSummary = errorToSummary(error);
+            events.push(localCapabilityEvent(context, "local_capability.action.failed", capabilityId, action, "failed", {
+                error: errorSummary,
+                input: { policy_action: policyAction },
+            }));
+            await this.#recordAudit(context, `${capabilityId}.${action}.failed`, {
+                capability_id: capabilityId,
+                action,
+                error: errorSummary,
+            });
+            throw new LocalCapabilityExecutionError(events, error);
+        }
+    }
+    async #recordAudit(context, event, data) {
+        if (!this.#auditLogger) {
+            return;
+        }
+        await this.#auditLogger.record({
+            event,
+            session_id: context.session_id,
+            turn_id: context.turn_id,
+            provider_instance_id: context.provider_instance_id,
+            workspace_id: context.workspace_id,
+            data,
+        });
+    }
+}
+export class LocalCapabilityExecutionError extends Error {
+    events;
+    cause;
+    constructor(events, cause) {
+        super(cause instanceof Error ? cause.message : "Local capability action failed.");
+        this.events = events;
+        this.cause = cause;
+        this.name = "LocalCapabilityExecutionError";
+    }
+}
+function localCapabilityEvent(context, eventType, capabilityId, action, status, data = {}) {
+    return {
+        event_type: eventType,
+        data: {
+            lease_id: context.lease.lease_id,
+            run_id: context.lease.run_id,
+            workspace_id: context.workspace_id,
+            provider_instance_id: context.provider_instance_id,
+            capability_id: capabilityId,
+            action,
+            status,
+            ...data,
+        },
+    };
+}
+async function resolveExistingWorkspacePath(path, workspaceRoot) {
+    const candidate = await resolveCandidatePath(path, workspaceRoot);
+    let resolvedPath;
+    try {
+        resolvedPath = await realpath(candidate);
+    }
+    catch (error) {
+        if (error instanceof Error) {
+            throw new LocalCapabilityPolicyError("local_capability_path_unresolved", `Path '${path}' could not be resolved inside the selected workspace: ${error.message}`);
+        }
+        throw error;
+    }
+    await assertInsideWorkspace(resolvedPath, workspaceRoot);
+    return resolvedPath;
+}
+async function resolveWritableWorkspacePath(path, workspaceRoot) {
+    const candidate = await resolveCandidatePath(path, workspaceRoot);
+    await assertCandidateInsideWorkspace(candidate, workspaceRoot);
+    try {
+        const resolvedPath = await realpath(candidate);
+        await assertInsideWorkspace(resolvedPath, workspaceRoot);
+        return resolvedPath;
+    }
+    catch (error) {
+        if (!isFileMissingError(error)) {
+            throw error;
+        }
+        const nearestExistingParent = await findNearestExistingParent(candidate, workspaceRoot);
+        await assertInsideWorkspace(nearestExistingParent, workspaceRoot);
+        await assertMissingWritableTargetHasNoSymlink(candidate);
+        return candidate;
+    }
+}
+async function resolveCandidatePath(path, workspaceRoot) {
+    return isAbsolute(path) ? path : resolve(await realpath(workspaceRoot), path);
+}
+async function assertInsideWorkspace(path, workspaceRoot) {
+    const resolvedWorkspace = await realpath(workspaceRoot);
+    const relativePath = relative(resolvedWorkspace, path);
+    if (relativePath === "" || (!relativePath.startsWith("..") && !isAbsolute(relativePath))) {
+        return;
+    }
+    throw new LocalCapabilityPolicyError("local_capability_path_denied", `Path '${path}' is outside the selected workspace.`);
+}
+async function assertCandidateInsideWorkspace(path, workspaceRoot) {
+    const resolvedWorkspace = await realpath(workspaceRoot);
+    const relativePath = relative(resolvedWorkspace, path);
+    if (relativePath === "" || (!relativePath.startsWith("..") && !isAbsolute(relativePath))) {
+        return;
+    }
+    throw new LocalCapabilityPolicyError("local_capability_path_denied", `Path '${path}' is outside the selected workspace.`);
+}
+async function findNearestExistingParent(path, workspaceRoot) {
+    let current = dirname(path);
+    const resolvedWorkspace = await realpath(workspaceRoot);
+    while (true) {
+        try {
+            return await realpath(current);
+        }
+        catch (error) {
+            if (!isFileMissingError(error)) {
+                throw error;
+            }
+            const parent = dirname(current);
+            if (parent === current) {
+                throw error;
+            }
+            const relativeParent = relative(resolvedWorkspace, parent);
+            if (relativeParent.startsWith("..") || isAbsolute(relativeParent)) {
+                throw error;
+            }
+            current = parent;
+        }
+    }
+}
+function workspaceRelativePath(path, workspaceRoot) {
+    const relativePath = relative(realpathSync(workspaceRoot), path);
+    return relativePath.length === 0 ? "." : relativePath;
+}
+function assertWritableSandbox(context, action) {
+    if (context.sandbox_mode === "read_only") {
+        throw new LocalCapabilityPolicyError("local_capability_sandbox_read_only", `Action '${action}' is not allowed in read_only sandbox mode.`);
+    }
+}
+async function gitArgvForOperation(operation, workspaceRoot, options) {
+    switch (operation) {
+        case "status": {
+            const statusOptions = options.status ?? {};
+            return [
+                "status",
+                `--porcelain=${statusOptions.porcelainVersion ?? "v1"}`,
+                ...(statusOptions.includeBranch ? ["--branch"] : []),
+            ];
+        }
+        case "diff": {
+            const diffOptions = options.diff ?? {};
+            if (diffOptions.paths) {
+                await assertRequestedPathsInsideWorkspace(diffOptions.paths, workspaceRoot);
+            }
+            if (diffOptions.baseRef) {
+                assertSafeGitRevision(diffOptions.baseRef);
+            }
+            return [
+                "diff",
+                ...(diffOptions.staged ? ["--staged"] : []),
+                ...(diffOptions.baseRef ? [diffOptions.baseRef] : []),
+                "--",
+                ...(diffOptions.paths ?? []),
+            ];
+        }
+        case "branch":
+            return ["branch", "--show-current"];
+        case "commit_metadata":
+            return ["log", "-1", "--format=%H%n%an%n%ae%n%aI%n%s"];
+        case "commit":
+        case "checkout":
+        case "push":
+            throw new LocalCapabilityPolicyError("local_capability_git_operation_requires_args", `Git operation '${operation}' requires explicit arguments and is not available through the generic executor.`);
+    }
+}
+function assertSafeGitRevision(revision) {
+    if (revision.startsWith("-") || revision.includes("\0")) {
+        throw new LocalCapabilityPolicyError("local_capability_command_denied", "Git base ref is not a safe revision token.");
+    }
+}
+async function runProcess(executable, argv, options) {
+    return await new Promise((resolveProcess, rejectProcess) => {
+        const child = spawn(executable, argv, {
+            cwd: options.cwd,
+            env: options.env,
+            shell: options.useShell,
+            detached: true,
+            stdio: "pipe",
+        });
+        let stdout = "";
+        let stderr = "";
+        let timedOut = false;
+        let stdoutTruncated = false;
+        let stderrTruncated = false;
+        let settled = false;
+        let timeout;
+        let forceKillTimeout;
+        let forceKillSettleTimeout;
+        let onAbort = () => undefined;
+        child.stdin.on("error", () => undefined);
+        child.stdin.end(options.stdin ?? "");
+        const clearProcessTimers = () => {
+            if (timeout) {
+                clearTimeout(timeout);
+                timeout = undefined;
+            }
+            if (forceKillTimeout) {
+                clearTimeout(forceKillTimeout);
+                forceKillTimeout = undefined;
+            }
+            if (forceKillSettleTimeout) {
+                clearTimeout(forceKillSettleTimeout);
+                forceKillSettleTimeout = undefined;
+            }
+        };
+        const resolveOutput = (exitCode, signal) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            clearProcessTimers();
+            if (options.signal) {
+                options.signal.removeEventListener("abort", onAbort);
+            }
+            resolveProcess({
+                exitCode,
+                signal,
+                stdout,
+                stderr,
+                timedOut,
+                stdoutTruncated,
+                stderrTruncated,
+            });
+        };
+        const terminateChild = (signal) => {
+            if (child.exitCode !== null || child.signalCode !== null) {
+                return;
+            }
+            killProcessTree(child, signal);
+            if (forceKillTimeout || forceKillSettleTimeout) {
+                return;
+            }
+            forceKillTimeout = setTimeout(() => {
+                forceKillTimeout = undefined;
+                killProcessTree(child, "SIGKILL");
+                forceKillSettleTimeout = setTimeout(() => {
+                    resolveOutput(child.exitCode, child.signalCode ?? "SIGKILL");
+                }, PROCESS_FORCE_KILL_SETTLE_MS);
+            }, PROCESS_TIMEOUT_KILL_GRACE_MS);
+        };
+        timeout = setTimeout(() => {
+            timedOut = true;
+            terminateChild("SIGTERM");
+        }, options.timeoutSeconds * 1000);
+        onAbort = () => {
+            terminateChild("SIGTERM");
+        };
+        if (options.signal) {
+            if (options.signal.aborted) {
+                onAbort();
+            }
+            else {
+                options.signal.addEventListener("abort", onAbort, { once: true });
+            }
+        }
+        child.stdout.on("data", (chunk) => {
+            const appended = appendLimited(stdout, chunk, options.stdoutByteLimit ?? MAX_CAPTURED_OUTPUT_BYTES);
+            stdout = appended.value;
+            stdoutTruncated = stdoutTruncated || appended.truncated;
+        });
+        child.stderr.on("data", (chunk) => {
+            const appended = appendLimited(stderr, chunk, options.stderrByteLimit ?? MAX_CAPTURED_OUTPUT_BYTES);
+            stderr = appended.value;
+            stderrTruncated = stderrTruncated || appended.truncated;
+        });
+        child.once("error", (error) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            clearProcessTimers();
+            if (options.signal) {
+                options.signal.removeEventListener("abort", onAbort);
+            }
+            rejectProcess(error);
+        });
+        child.once("close", (exitCode, signal) => {
+            resolveOutput(exitCode, signal);
+        });
+    });
+}
+function appendLimited(existing, chunk, limitBytes) {
+    const combined = Buffer.concat([Buffer.from(existing), chunk]);
+    if (combined.byteLength <= limitBytes) {
+        return { value: combined.toString("utf8"), truncated: false };
+    }
+    return { value: combined.subarray(0, limitBytes).toString("utf8"), truncated: true };
+}
+function minimalEnv() {
+    return {
+        PATH: process.env.PATH ?? "/usr/bin:/bin:/usr/sbin:/sbin",
+    };
+}
+function processEnvFor(env) {
+    return {
+        ...minimalEnv(),
+        ...(env ?? {}),
+    };
+}
+function summarizeResult(value) {
+    return redactValue(value);
+}
+function errorToSummary(error) {
+    if (error instanceof LocalCapabilityPolicyError) {
+        return {
+            code: error.code,
+            message: error.message,
+            retryable: false,
+        };
+    }
+    if (error instanceof Error) {
+        return {
+            code: "local_capability_action_failed",
+            message: error.message,
+            retryable: false,
+        };
+    }
+    return {
+        code: "local_capability_action_failed",
+        message: "Local capability action failed.",
+        retryable: false,
+    };
+}
+function isFileMissingError(error) {
+    return (typeof error === "object" &&
+        error !== null &&
+        "code" in error &&
+        error.code === "ENOENT");
+}
+function assertAllowedDevServerEndpoint(host, port) {
+    if (host !== "127.0.0.1" && host !== "localhost") {
+        throw new LocalCapabilityPolicyError("local_capability_dev_server_host_denied", `Dev server host '${host}' is not allowed.`);
+    }
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        throw new LocalCapabilityPolicyError("local_capability_dev_server_port_denied", `Dev server port '${port}' is invalid.`);
+    }
+}
+async function waitForDevServerStartup(child, request) {
+    const readiness = request.readiness;
+    if (readiness === undefined || readiness.url === undefined) {
+        await waitForDevServerNoFailure(child, request, DEV_SERVER_START_SETTLE_MS);
+        return;
+    }
+    const readinessUrl = readiness.url;
+    const allowedUrl = assertAllowedReadinessUrl(readinessUrl, request);
+    const readinessTimeoutMs = Math.min(readiness.timeout_ms, devServerStartupTimeoutMs(request));
+    await waitForReadinessUrl(child, request, allowedUrl, readinessTimeoutMs);
+}
+function devServerStartupTimeoutMs(request) {
+    return Math.max(1, request.timeout_seconds) * 1000;
+}
+function assertAllowedReadinessUrl(url, request) {
+    let parsedUrl;
+    try {
+        parsedUrl = new URL(url);
+    }
+    catch (error) {
+        if (error instanceof TypeError) {
+            throw new LocalCapabilityPolicyError("local_capability_dev_server_host_denied", `Readiness URL '${url}' is invalid.`);
+        }
+        throw error;
+    }
+    if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") {
+        throw new LocalCapabilityPolicyError("local_capability_dev_server_host_denied", `Readiness URL '${url}' must use http or https.`);
+    }
+    if (parsedUrl.hostname !== "127.0.0.1" && parsedUrl.hostname !== "localhost") {
+        throw new LocalCapabilityPolicyError("local_capability_dev_server_host_denied", `Readiness URL host '${parsedUrl.hostname}' is not allowed.`);
+    }
+    const port = portForUrl(parsedUrl);
+    if (port !== request.port) {
+        throw new LocalCapabilityPolicyError("local_capability_dev_server_port_denied", `Readiness URL port ${port} does not match dev server port ${request.port}.`);
+    }
+    return parsedUrl.toString();
+}
+function portForUrl(url) {
+    if (url.port.length > 0) {
+        return Number.parseInt(url.port, 10);
+    }
+    return url.protocol === "https:" ? 443 : 80;
+}
+async function waitForReadinessUrl(child, request, url, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    let lastErrorMessage;
+    while (Date.now() < deadline) {
+        assertDevServerStillRunning(child, request.server_id);
+        assertDevServerSessionActive(request);
+        const remainingMs = deadline - Date.now();
+        const probe = await probeReadinessUrl(url, Math.max(1, Math.min(remainingMs, DEV_SERVER_READINESS_POLL_MS)));
+        if (probe.ready) {
+            return;
+        }
+        if (probe.errorMessage) {
+            lastErrorMessage = probe.errorMessage;
+        }
+        const waitMs = Math.max(0, Math.min(deadline - Date.now(), DEV_SERVER_READINESS_POLL_MS));
+        await waitForDevServerNoFailure(child, request, waitMs);
+    }
+    throw new LocalCapabilityPolicyError("local_capability_timeout", `Dev server '${request.server_id}' did not become ready at '${url}' within ${timeoutMs}ms${lastErrorMessage ? `: ${lastErrorMessage}` : "."}`);
+}
+async function probeReadinessUrl(url, timeoutMs) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => {
+        controller.abort();
+    }, timeoutMs);
+    try {
+        const response = await fetch(url, { signal: controller.signal });
+        if (response.ok) {
+            return { ready: true };
+        }
+        return { ready: false, errorMessage: `HTTP ${response.status}` };
+    }
+    catch (error) {
+        return { ready: false, errorMessage: error instanceof Error ? error.message : "Readiness probe failed." };
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+async function waitForDevServerNoFailure(child, request, timeoutMs) {
+    assertDevServerStillRunning(child, request.server_id);
+    assertDevServerSessionActive(request);
+    if (timeoutMs <= 0) {
+        return;
+    }
+    await new Promise((resolve, reject) => {
+        let settled = false;
+        let timer;
+        const settle = (result) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            if (timer) {
+                clearTimeout(timer);
+                timer = undefined;
+            }
+            child.off("exit", onExit);
+            child.off("error", onError);
+            if (result === "ready") {
+                try {
+                    assertDevServerSessionActive(request);
+                    resolve();
+                }
+                catch (error) {
+                    reject(error);
+                }
+                return;
+            }
+            reject(result);
+        };
+        function onExit(exitCode, signal) {
+            settle(devServerExitError(request.server_id, exitCode, signal));
+        }
+        function onError(error) {
+            settle(devServerProcessError(request.server_id, error));
+        }
+        timer = setTimeout(() => {
+            settle("ready");
+        }, timeoutMs);
+        child.once("exit", onExit);
+        child.once("error", onError);
+        try {
+            assertDevServerStillRunning(child, request.server_id);
+        }
+        catch (error) {
+            if (error instanceof Error) {
+                settle(error);
+                return;
+            }
+            throw error;
+        }
+    });
+}
+function assertDevServerStillRunning(child, serverId) {
+    if (child.exitCode !== null || child.signalCode !== null) {
+        throw devServerExitError(serverId, child.exitCode, child.signalCode);
+    }
+}
+function assertDevServerSessionActive(request) {
+    if (request.session_active && !request.session_active()) {
+        throw new LocalCapabilityPolicyError("local_capability_lease_revoked", "Local action session stopped before dev server was ready.");
+    }
+}
+function devServerExitError(serverId, exitCode, signal) {
+    const exitDescription = signal ? `signal ${signal}` : `exit code ${exitCode ?? "unknown"}`;
+    return new LocalCapabilityPolicyError("local_capability_dev_server_start_failed", `Dev server '${serverId}' exited before it was ready with ${exitDescription}.`);
+}
+function devServerProcessError(serverId, error) {
+    return new LocalCapabilityPolicyError("local_capability_dev_server_start_failed", `Dev server '${serverId}' failed to start: ${error.message}`);
+}
+function killProcessTree(child, signal) {
+    const pid = child.pid;
+    if (pid === undefined) {
+        return;
+    }
+    try {
+        process.kill(-pid, signal);
+    }
+    catch (error) {
+        if (error instanceof Error && "code" in error && error.code === "ESRCH") {
+            return;
+        }
+        child.kill(signal);
+    }
+}
+async function terminateProcessTree(child, signal, timeoutMs) {
+    if (child.exitCode !== null || child.signalCode !== null) {
+        return;
+    }
+    await new Promise((resolve) => {
+        let settled = false;
+        let forceKillTimer;
+        let forceKillSettleTimer;
+        const settle = () => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            if (forceKillTimer) {
+                clearTimeout(forceKillTimer);
+                forceKillTimer = undefined;
+            }
+            if (forceKillSettleTimer) {
+                clearTimeout(forceKillSettleTimer);
+                forceKillSettleTimer = undefined;
+            }
+            child.off("exit", settle);
+            child.off("error", settle);
+            resolve();
+        };
+        forceKillTimer = setTimeout(() => {
+            forceKillTimer = undefined;
+            killProcessTree(child, "SIGKILL");
+            forceKillSettleTimer = setTimeout(() => {
+                settle();
+            }, PROCESS_FORCE_KILL_SETTLE_MS);
+        }, Math.max(1, timeoutMs));
+        child.once("exit", settle);
+        child.once("error", settle);
+        killProcessTree(child, signal);
+    });
+}
+async function listWorkspaceEntries(root, options) {
+    const entries = [];
+    const includeHidden = options.includeHidden ?? false;
+    const recursive = options.recursive ?? false;
+    const maxDepth = recursive ? options.maxDepth ?? Number.POSITIVE_INFINITY : 1;
+    const entryLimit = options.entryLimit;
+    let truncated = false;
+    const collect = async (directory, relativeDirectory, depth) => {
+        if (truncated) {
+            return;
+        }
+        const directoryEntries = (await readdir(directory, { withFileTypes: true })).sort((left, right) => left.name.localeCompare(right.name));
+        for (const entry of directoryEntries) {
+            if (!includeHidden && entry.name.startsWith(".")) {
+                continue;
+            }
+            if (entryLimit !== undefined && entries.length >= entryLimit) {
+                truncated = true;
+                return;
+            }
+            const name = relativeDirectory.length > 0 ? `${relativeDirectory}/${entry.name}` : entry.name;
+            entries.push({
+                name,
+                type: entry.isFile() ? "file" : entry.isDirectory() ? "directory" : "other",
+            });
+            if (recursive && entry.isDirectory() && depth < maxDepth) {
+                await collect(resolve(directory, entry.name), name, depth + 1);
+            }
+        }
+    };
+    await collect(root, "", 1);
+    return { entries, truncated };
+}
+function applyByteRange(buffer, range) {
+    if (!range) {
+        return buffer;
+    }
+    const start = range.start ?? 0;
+    const end = range.length === undefined ? buffer.byteLength : start + range.length;
+    return buffer.subarray(start, end);
+}
+function limitBuffer(buffer, limitBytes) {
+    if (limitBytes === undefined || buffer.byteLength <= limitBytes) {
+        return { buffer, truncated: false };
+    }
+    return {
+        buffer: buffer.subarray(0, limitBytes),
+        truncated: true,
+    };
+}
+function encodeBuffer(buffer, encoding) {
+    return buffer.toString(encoding);
+}
+function decodeContent(content, encoding) {
+    return Buffer.from(content, encoding);
+}
+function sha256Hash(buffer) {
+    return `sha256:${createHash("sha256").update(buffer).digest("hex")}`;
+}
+async function assertWriteModeAllowed(path, options) {
+    const mode = options.mode ?? "overwrite";
+    if (mode === "create") {
+        if (await fileExists(path)) {
+            throw new LocalCapabilityPolicyError("local_capability_action_failed", `Path '${path}' already exists.`);
+        }
+        return;
+    }
+    if (options.expectedBaseHash === undefined) {
+        return;
+    }
+    const existingBytes = await readFile(path);
+    assertExpectedHash(existingBytes, options.expectedBaseHash);
+}
+async function fileExists(path) {
+    try {
+        const pathStat = await lstat(path);
+        if (pathStat.isSymbolicLink()) {
+            throw new LocalCapabilityPolicyError("local_capability_path_denied", `Path '${path}' is a dangling symlink.`);
+        }
+        return true;
+    }
+    catch (error) {
+        if (isFileMissingError(error)) {
+            return false;
+        }
+        throw error;
+    }
+}
+async function readExistingFileForPatch(path, createIfMissing) {
+    try {
+        return await readFile(path);
+    }
+    catch (error) {
+        if (isFileMissingError(error) && createIfMissing) {
+            await assertMissingWritableTargetHasNoSymlink(path);
+            return Buffer.alloc(0);
+        }
+        throw error;
+    }
+}
+async function assertMissingWritableTargetHasNoSymlink(path) {
+    try {
+        const pathStat = await lstat(path);
+        if (pathStat.isSymbolicLink()) {
+            throw new LocalCapabilityPolicyError("local_capability_path_denied", `Path '${path}' is a dangling symlink.`);
+        }
+    }
+    catch (error) {
+        if (isFileMissingError(error)) {
+            return;
+        }
+        throw error;
+    }
+}
+function assertExpectedHash(buffer, expectedHash) {
+    const actualHash = sha256Hash(buffer);
+    if (actualHash !== expectedHash) {
+        throw new LocalCapabilityPolicyError("local_capability_expected_hash_mismatch", `Expected base hash '${expectedHash}' did not match current hash '${actualHash}'.`);
+    }
+}
+function applyUnifiedDiff(originalContent, patchContent) {
+    const originalLines = splitLinesPreservingEndings(originalContent);
+    const patchLines = splitLinesPreservingEndings(patchContent);
+    const outputLines = [];
+    let originalIndex = 0;
+    let patchIndex = 0;
+    let changed = false;
+    while (patchIndex < patchLines.length) {
+        const line = patchLines[patchIndex] ?? "";
+        if (!line.startsWith("@@")) {
+            patchIndex += 1;
+            continue;
+        }
+        const hunk = parseUnifiedDiffHunkHeader(line);
+        while (originalIndex < hunk.oldStart - 1) {
+            const originalLine = originalLines[originalIndex];
+            if (originalLine === undefined) {
+                throw new LocalCapabilityPolicyError("local_capability_action_failed", "Unified diff hunk starts beyond the end of the file.");
+            }
+            outputLines.push(originalLine);
+            originalIndex += 1;
+        }
+        patchIndex += 1;
+        while (patchIndex < patchLines.length && !(patchLines[patchIndex] ?? "").startsWith("@@")) {
+            const hunkLine = patchLines[patchIndex] ?? "";
+            if (hunkLine.startsWith("\\ ")) {
+                patchIndex += 1;
+                continue;
+            }
+            const prefix = hunkLine.slice(0, 1);
+            const body = hunkLine.slice(1);
+            if (prefix === " ") {
+                assertPatchLineMatches(originalLines[originalIndex], body);
+                outputLines.push(body);
+                originalIndex += 1;
+            }
+            else if (prefix === "-") {
+                assertPatchLineMatches(originalLines[originalIndex], body);
+                originalIndex += 1;
+                changed = true;
+            }
+            else if (prefix === "+") {
+                outputLines.push(body);
+                changed = true;
+            }
+            else if (hunkLine.startsWith("--- ") || hunkLine.startsWith("+++ ")) {
+                break;
+            }
+            else {
+                throw new LocalCapabilityPolicyError("local_capability_action_failed", `Unsupported unified diff line '${hunkLine.trimEnd()}'.`);
+            }
+            patchIndex += 1;
+        }
+    }
+    while (originalIndex < originalLines.length) {
+        const originalLine = originalLines[originalIndex];
+        if (originalLine !== undefined) {
+            outputLines.push(originalLine);
+        }
+        originalIndex += 1;
+    }
+    return {
+        content: outputLines.join(""),
+        changed,
+    };
+}
+function splitLinesPreservingEndings(content) {
+    if (content.length === 0) {
+        return [];
+    }
+    const matches = content.match(/.*(?:\r\n|\n|\r|$)/g);
+    if (!matches) {
+        return [content];
+    }
+    return matches.filter((line) => line.length > 0);
+}
+function parseUnifiedDiffHunkHeader(header) {
+    if (/^@@\s*$/.test(header)) {
+        return { oldStart: 1 };
+    }
+    const match = /^@@ -(?<oldStart>\d+)(?:,\d+)? \+\d+(?:,\d+)? @@/.exec(header);
+    if (!match?.groups?.oldStart) {
+        throw new LocalCapabilityPolicyError("local_capability_action_failed", `Invalid unified diff hunk header '${header.trimEnd()}'.`);
+    }
+    return { oldStart: Number.parseInt(match.groups.oldStart, 10) };
+}
+function assertPatchLineMatches(actual, expected) {
+    if (actual === expected) {
+        return;
+    }
+    throw new LocalCapabilityPolicyError("local_capability_action_failed", "Unified diff context did not match the current file.");
+}
+async function assertRequestedPathsInsideWorkspace(paths, workspaceRoot) {
+    for (const path of paths) {
+        const candidate = await resolveCandidatePath(path, workspaceRoot);
+        await assertCandidateInsideWorkspace(candidate, workspaceRoot);
+    }
+}
+function parseGitStatusBranch(stdout) {
+    const firstLine = stdout.split(/\r?\n/, 1)[0];
+    if (!firstLine?.startsWith("## ")) {
+        return undefined;
+    }
+    const branch = firstLine.slice(3).split("...", 1)[0]?.trim();
+    return branch && branch !== "HEAD (no branch)" ? branch : undefined;
+}
+function gitStatusBranchResult(operation, options, stdout) {
+    if (operation !== "status" || !options.status?.includeBranch) {
+        return {};
+    }
+    const branch = parseGitStatusBranch(stdout);
+    return branch ? { branch } : {};
+}
+//# sourceMappingURL=executors.js.map