@inneranimalmedia/agentsam-sdk 2.6.2 → 2.6.4

package/src/go/container.js

@@ -0,0 +1,120 @@
+import { spawnSync } from 'node:child_process';
+import { probeGoDeploymentWithRetry } from './cloudflare.js';
+
+function runDocker(args, { productRoot, spawn = spawnSync } = {}) {
+  const res = spawn('docker', args, {
+    cwd: productRoot,
+    encoding: 'utf8',
+    maxBuffer: 16 * 1024 * 1024,
+  });
+  return {
+    status: res.status,
+    stdout: res.stdout || '',
+    stderr: res.stderr || '',
+    output: ((res.stdout || '') + '\n' + (res.stderr || '')).trim(),
+  };
+}
+
+export async function verifyGoContainer({
+  productRoot,
+  product = 'agentsam-go-worker',
+  expectedSource,
+  expectedSourceCommit,
+  expectedBuiltAt = '',
+  spawn = spawnSync,
+  fetchImpl = globalThis.fetch,
+} = {}) {
+  const tag = product + ':agentsam-verify';
+  const build = runDocker(['build', '--platform', 'linux/amd64', '-t', tag, '.'], { productRoot, spawn });
+  if (build.status !== 0) {
+    const err = new Error('go_container_build_failed');
+    err.detail = build.output.slice(-4000);
+    throw err;
+  }
+
+  const inspected = runDocker(['image', 'inspect', tag], { productRoot, spawn });
+  if (inspected.status !== 0) throw new Error('go_container_inspect_failed');
+  let image = null;
+  try { image = JSON.parse(inspected.stdout)?.[0] || null; } catch {}
+  if (!image) throw new Error('go_container_inspect_invalid');
+  if (image.Architecture !== 'amd64') throw new Error('go_container_architecture_invalid');
+  const imageUser = String(image.Config?.User || '');
+  if (!imageUser || imageUser === '0' || imageUser === 'root' || imageUser.startsWith('0:')) {
+    throw new Error('go_container_root_user_forbidden');
+  }
+
+  const name = product + '-verify-' + process.pid + '-' + Date.now();
+  const start = runDocker([
+    'run', '-d', '--name', name,
+    '-p', '127.0.0.1::8080',
+    '-e', 'AGENTSAM_TARGET=container',
+    '-e', 'AGENTSAM_BUILD_SOURCE=' + (expectedSource || ''),
+    '-e', 'AGENTSAM_BUILD_COMMIT=' + (expectedSourceCommit || ''),
+    '-e', 'AGENTSAM_BUILT_AT=' + expectedBuiltAt,
+    tag,
+  ], { productRoot, spawn });
+  if (start.status !== 0) {
+    const err = new Error('go_container_start_failed');
+    err.detail = start.output.slice(-3000);
+    throw err;
+  }
+
+  const containerId = start.stdout.trim();
+  let stopped = false;
+  let cleaned = false;
+  try {
+    let port = null;
+    for (let attempt = 0; attempt < 30; attempt += 1) {
+      const mapped = runDocker(['port', containerId, '8080/tcp'], { productRoot, spawn });
+      const match = mapped.stdout.match(/:(\d+)\s*$/m);
+      if (mapped.status === 0 && match) {
+        port = Number(match[1]);
+        break;
+      }
+      await new Promise((resolve) => setTimeout(resolve, 100));
+    }
+    if (!port) throw new Error('go_container_port_missing');
+
+    const origin = 'http://127.0.0.1:' + port;
+    const probe = await probeGoDeploymentWithRetry(origin, {
+      fetchImpl,
+      expectedSource,
+      expectedSourceCommit,
+      expectedTarget: 'container',
+      edge: false,
+      attempts: 20,
+      delayMs: 250,
+    });
+    if (!probe.ok) {
+      const err = new Error('go_container_probe_failed');
+      err.detail = probe;
+      throw err;
+    }
+
+    const stop = runDocker(['stop', '-t', '5', containerId], { productRoot, spawn });
+    stopped = stop.status === 0;
+    if (!stopped) throw new Error('go_container_stop_failed');
+    const cleanup = runDocker(['container', 'rm', containerId], { productRoot, spawn });
+    cleaned = cleanup.status === 0;
+    if (!cleaned) throw new Error('go_container_cleanup_failed');
+
+    return {
+      ok: true,
+      tag,
+      name,
+      image_digest: image.Id || null,
+      architecture: image.Architecture,
+      os: image.Os || null,
+      user: imageUser,
+      container_id: containerId,
+      clean_shutdown: true,
+      clean_cleanup: true,
+      probe,
+      retained_stopped_container: false,
+      build_output: build.output.slice(-2000),
+    };
+  } finally {
+    if (!stopped) runDocker(['stop', '-t', '1', containerId], { productRoot, spawn });
+    if (!cleaned) runDocker(['container', 'rm', containerId], { productRoot, spawn });
+  }
+}

package/src/go/contract.js

@@ -0,0 +1,144 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { DEFAULT_PRODUCT } from './discover.js';
+
+const PACKAGE_TEMPLATE = {
+  schema: 'agentsam.package.v1',
+  name: DEFAULT_PRODUCT,
+  type: 'service',
+  runtime: 'go',
+  version: '0.1.0',
+  targets: ['cloudflare-worker', 'cloudflare-container', 'local'],
+  entrypoints: {
+    server: './runtime/cmd/server',
+    worker: './worker/src/index.js',
+  },
+  capabilities: ['hash', 'inspect', 'runtime', 'capabilities'],
+  distribution: {
+    package: '@inneranimalmedia/agentsam-go-worker',
+    normal_user: 'official-hosted-service',
+    self_host: 'advanced-opt-in',
+  },
+  deployment: {
+    adapter: 'cloudflare',
+    mode: 'worker-container',
+    wrangler_config: './wrangler.jsonc',
+    authority: 'explicit-cloudflare-account',
+  },
+  product: {
+    slug: DEFAULT_PRODUCT,
+    kind: 'service',
+    registry: 'local-by-default',
+    official_registry: 'agentsam_products',
+    official_registry_only: true,
+  },
+};
+
+/**
+ * Ensure product adapter files exist. Never scaffolds a second product directory.
+ * Returns { created: string[], updated: string[], existing: true }.
+ */
+export function ensureProductContract(productRoot, { overwrite = false } = {}) {
+  const created = [];
+  const updated = [];
+  const manifestPath = path.join(productRoot, 'agentsam.package.json');
+
+  if (!fs.existsSync(productRoot)) {
+    throw new Error(`product_root_missing: ${productRoot} — seed apps/${DEFAULT_PRODUCT} first; do not invent a sibling product`);
+  }
+
+  if (!fs.existsSync(manifestPath)) {
+    fs.writeFileSync(manifestPath, `${JSON.stringify(PACKAGE_TEMPLATE, null, 2)}\n`);
+    created.push(rel(productRoot, manifestPath));
+  } else if (overwrite) {
+    const current = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+    const merged = { ...PACKAGE_TEMPLATE, ...current, name: DEFAULT_PRODUCT };
+    fs.writeFileSync(manifestPath, `${JSON.stringify(merged, null, 2)}\n`);
+    updated.push(rel(productRoot, manifestPath));
+  }
+
+  const required = [
+    'runtime/go.mod',
+    'runtime/cmd/server/main.go',
+    'worker/src/index.js',
+    'wrangler.jsonc',
+    'Dockerfile',
+  ];
+  const missing = required.filter((relPath) => !fs.existsSync(path.join(productRoot, relPath)));
+  if (missing.length) {
+    throw new Error(`product_incomplete: missing ${missing.join(', ')}`);
+  }
+
+  return {
+    product: DEFAULT_PRODUCT,
+    productRoot,
+    existing: created.length === 0,
+    created,
+    updated,
+    manifest: JSON.parse(fs.readFileSync(manifestPath, 'utf8')),
+  };
+}
+
+export function readProductManifest(productRoot) {
+  const manifestPath = path.join(productRoot, 'agentsam.package.json');
+  if (!fs.existsSync(manifestPath)) return null;
+  return JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+}
+
+function rel(root, file) {
+  return path.relative(root, file).split(path.sep).join('/');
+}
+
+export function preflightToolchain({ requireDocker = false, productRoot = null } = {}) {
+  const checks = [];
+  const push = (id, ok, detail = '') => checks.push({ id, ok, detail });
+
+  try {
+    const v = spawnSync('go', ['version'], { encoding: 'utf8' });
+    push('go', v.status === 0, (v.stdout || v.stderr || '').trim());
+  } catch (e) {
+    push('go', false, e.message);
+  }
+
+  const wranglerBin = resolveWranglerBin(productRoot);
+  try {
+    const v = spawnSync(wranglerBin.command, wranglerBin.args.concat(['--version']), {
+      encoding: 'utf8',
+      cwd: productRoot || process.cwd(),
+    });
+    push('wrangler', v.status === 0, (v.stdout || v.stderr || '').trim().slice(0, 120));
+  } catch (e) {
+    push('wrangler', false, e.message);
+  }
+
+  try {
+    const v = spawnSync('docker', ['info'], { encoding: 'utf8' });
+    push('docker', v.status === 0, v.status === 0 ? 'available' : (v.stderr || 'unavailable').trim().slice(0, 200));
+  } catch (e) {
+    push('docker', false, e.message);
+  }
+
+  const failed = checks.filter((c) => {
+    if (c.ok) return false;
+    if (c.id === 'docker' && !requireDocker) return false;
+    return true;
+  });
+  return { ok: failed.length === 0, checks, failed, wrangler: wranglerBin };
+}
+
+function resolveWranglerBin(productRoot) {
+  const candidates = [];
+  if (productRoot) {
+    candidates.push(path.join(productRoot, 'node_modules', 'wrangler', 'bin', 'wrangler.js'));
+    candidates.push(path.join(productRoot, 'node_modules', '.bin', 'wrangler'));
+  }
+  candidates.push(path.join(process.cwd(), 'node_modules', '.bin', 'wrangler'));
+  for (const candidate of candidates) {
+    if (fs.existsSync(candidate)) {
+      if (candidate.endsWith('.js')) return { command: process.execPath, args: [candidate] };
+      return { command: candidate, args: [] };
+    }
+  }
+  return { command: 'npx', args: ['--yes', 'wrangler'] };
+}

package/src/go/discover.js

@@ -0,0 +1,212 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+import { execFileSync } from 'node:child_process';
+import { repositoryRoot, gitEvidence } from '../knowledge/config.js';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const MODULE_REQUIRE = createRequire(import.meta.url);
+export const SDK_ROOT = path.resolve(HERE, '../..');
+export const DEFAULT_PRODUCT = 'agentsam-go-worker';
+export const DEFAULT_PRODUCT_REL = path.join('apps', DEFAULT_PRODUCT);
+export const GO_WORKER_PACKAGE = '@inneranimalmedia/agentsam-go-worker';
+
+function readJSON(file) {
+  try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return null; }
+}
+
+function normalizeExplicitProductRoot(value) {
+  if (!value) return null;
+  const resolved = path.resolve(value);
+  if (!fs.existsSync(resolved)) return null;
+  if (path.basename(resolved) === 'runtime' && fs.existsSync(path.join(resolved, 'go.mod'))) {
+    return path.dirname(resolved);
+  }
+  return resolved;
+}
+
+function packageRootFrom(requireFn) {
+  try {
+    return path.dirname(requireFn.resolve(GO_WORKER_PACKAGE + '/package.json'));
+  } catch {
+    return null;
+  }
+}
+
+function cwdRequire(cwd) {
+  try {
+    return createRequire(path.join(path.resolve(cwd), 'package.json'));
+  } catch {
+    return null;
+  }
+}
+
+function runtimeCandidate(productRoot, origin) {
+  if (!productRoot) return null;
+  const runtimeRoot = path.join(productRoot, 'runtime');
+  const modPath = path.join(runtimeRoot, 'go.mod');
+  if (!fs.existsSync(modPath)) return null;
+  const mod = fs.readFileSync(modPath, 'utf8');
+  const moduleMatch = mod.match(/^module\s+(\S+)/m);
+  const serverMain = path.join(runtimeRoot, 'cmd', 'server', 'main.go');
+  const packageJson = path.join(productRoot, 'package.json');
+  return {
+    origin,
+    runtimeRoot,
+    module: moduleMatch?.[1] || null,
+    goMod: modPath,
+    entry: fs.existsSync(serverMain) ? serverMain : findFirstGoMain(runtimeRoot),
+    productRoot,
+    packageManifest: path.join(productRoot, 'agentsam.package.json'),
+    packageJson,
+    package: readJSON(packageJson),
+  };
+}
+
+function legacyRuntimeCandidate(runtimeRoot, origin) {
+  const modPath = path.join(runtimeRoot, 'go.mod');
+  if (!fs.existsSync(modPath)) return null;
+  const mod = fs.readFileSync(modPath, 'utf8');
+  const moduleMatch = mod.match(/^module\s+(\S+)/m);
+  const productRoot = path.basename(runtimeRoot) === 'runtime' ? path.dirname(runtimeRoot) : runtimeRoot;
+  return {
+    origin,
+    runtimeRoot,
+    module: moduleMatch?.[1] || null,
+    goMod: modPath,
+    entry: findFirstGoMain(runtimeRoot),
+    productRoot,
+    packageManifest: path.join(productRoot, 'agentsam.package.json'),
+    packageJson: path.join(productRoot, 'package.json'),
+    package: readJSON(path.join(productRoot, 'package.json')),
+  };
+}
+
+/**
+ * Locate the one AgentSam Go service implementation without assuming the SDK
+ * development checkout ships inside the root npm package.
+ *
+ * Resolution order:
+ *   1. explicit AGENTSAM_GO_WORKER_ROOT
+ *   2. current repository apps/agentsam-go-worker (maintainer/contributor mode)
+ *   3. installed @inneranimalmedia/agentsam-go-worker package (distribution mode)
+ *   4. SDK development tree when present
+ *   5. narrow legacy runtime candidates
+ */
+export function discoverGoRuntime(cwd = process.cwd()) {
+  const root = repositoryRoot(cwd);
+  const req = cwdRequire(cwd);
+  const productCandidates = [
+    [normalizeExplicitProductRoot(process.env.AGENTSAM_GO_WORKER_ROOT), 'explicit'],
+    [path.join(root, DEFAULT_PRODUCT_REL), 'repository'],
+    [req ? packageRootFrom(req) : null, 'installed_package'],
+    [packageRootFrom(MODULE_REQUIRE), 'installed_package'],
+    [path.join(SDK_ROOT, DEFAULT_PRODUCT_REL), 'sdk_development_tree'],
+  ];
+
+  const found = [];
+  const seen = new Set();
+  for (const [productRoot, origin] of productCandidates) {
+    if (!productRoot) continue;
+    let real;
+    try { real = fs.realpathSync(productRoot); } catch { continue; }
+    if (seen.has(real)) continue;
+    seen.add(real);
+    const candidate = runtimeCandidate(real, origin);
+    if (candidate) found.push(candidate);
+  }
+
+  for (const [runtimeRoot, origin] of [
+    [path.join(root, 'runtime'), 'legacy_repository_runtime'],
+    [path.join(root, 'cmd', 'agentsam'), 'legacy_repository_cmd'],
+  ]) {
+    let real;
+    try { real = fs.realpathSync(runtimeRoot); } catch { continue; }
+    if (seen.has(real)) continue;
+    seen.add(real);
+    const candidate = legacyRuntimeCandidate(real, origin);
+    if (candidate) found.push(candidate);
+  }
+
+  const preferred = found.find((row) => row.module?.includes('agentsam-go-worker')) || found[0] || null;
+  const goTool = probeGoToolchain();
+  const git = gitEvidence(root);
+
+  return {
+    schema: 'agentsam.go-discovery.v2',
+    repository_root: root,
+    sdk_root: SDK_ROOT,
+    go: goTool,
+    git,
+    runtime: preferred,
+    candidates: found,
+    product_exists: Boolean(preferred && fs.existsSync(preferred.packageManifest)),
+    distribution: preferred
+      ? {
+          origin: preferred.origin,
+          package_name: preferred.package?.name || null,
+          package_version: preferred.package?.version || null,
+          product_root: preferred.productRoot,
+        }
+      : null,
+  };
+}
+
+function findFirstGoMain(dir) {
+  const stack = [dir];
+  while (stack.length) {
+    const cur = stack.pop();
+    let ents;
+    try { ents = fs.readdirSync(cur, { withFileTypes: true }); } catch { continue; }
+    for (const ent of ents) {
+      if (ent.name === 'vendor' || ent.name === '.git' || ent.name === 'node_modules') continue;
+      const full = path.join(cur, ent.name);
+      if (ent.isDirectory()) stack.push(full);
+      else if (ent.name === 'main.go') return full;
+    }
+  }
+  return null;
+}
+
+export function probeGoToolchain() {
+  try {
+    const version = execFileSync('go', ['version'], { encoding: 'utf8' }).trim();
+    const env = execFileSync('go', ['env', 'GOROOT', 'GOVERSION'], { encoding: 'utf8' }).trim().split(/\r?\n/);
+    return { ok: true, version, goroot: env[0] || null, goversion: env[1] || null };
+  } catch (error) {
+    return { ok: false, error: error.message };
+  }
+}
+
+export function resolveGoStateRoot(discovery, cwd = process.cwd()) {
+  const origin = discovery?.runtime?.origin || null;
+  if (origin === 'repository' || origin === 'sdk_development_tree') {
+    return discovery.runtime.productRoot;
+  }
+  return repositoryRoot(cwd);
+}
+
+export function resolveProductRoot(discovery, productName = DEFAULT_PRODUCT) {
+  const runtime = discovery?.runtime;
+  if (
+    runtime?.productRoot
+    && (
+      path.basename(runtime.productRoot) === productName
+      || runtime.package?.name === GO_WORKER_PACKAGE
+    )
+  ) {
+    return runtime.productRoot;
+  }
+
+  const fromCandidates = discovery?.candidates?.find((row) => (
+    path.basename(row.productRoot || '') === productName
+    || row.package?.name === GO_WORKER_PACKAGE
+  ));
+  if (fromCandidates?.productRoot) return fromCandidates.productRoot;
+
+  const err = new Error('go_product_not_discovered:' + productName);
+  err.code = 'go_product_not_discovered';
+  err.hint = 'Install ' + GO_WORKER_PACKAGE + ' for self-host deployment or run from the AgentSam SDK maintainer checkout.';
+  throw err;
+}

package/src/go/index.js

@@ -0,0 +1,25 @@
+export { discoverGoRuntime, resolveProductRoot, resolveGoStateRoot, probeGoToolchain, DEFAULT_PRODUCT, SDK_ROOT } from './discover.js';
+export { ensureProductContract, readProductManifest, preflightToolchain } from './contract.js';
+export { buildGoProduct, runGoBuild, runGoTests, runGoVet } from './build.js';
+export { deployGoCloudflare, resolveWranglerIdentity, probeGoDeployment, probeGoDeploymentWithRetry, readLatestWranglerDeployment } from './cloudflare.js';
+export { verifyGoContainer } from './container.js';
+export { verifyGoProduct } from './verify.js';
+export {
+  applyInnerAnimalMediaOfficialGoProductRegistry,
+  applyIamOfficialGoProductRegistry,
+  buildGoProductRegistrySql,
+} from './official-registry.js';
+export {
+  INNERANIMALMEDIA_OFFICIAL_RELEASE_ENV,
+  LEGACY_IAM_OFFICIAL_RELEASE_ENV,
+  innerAnimalMediaOfficialReleaseEnabled,
+} from './official-release.js';
+export {
+  writeGoBuildReceipt,
+  writeDeploymentReceipt,
+  writeDeploymentValidationReceipt,
+  writeProductRegistryLocal,
+  writeProductValidationLocal,
+  readLatestStatus,
+  buildProductRow,
+} from './receipts.js';

package/src/go/native-probe-runner.mjs

@@ -0,0 +1,119 @@
+import { spawn } from 'node:child_process';
+import net from 'node:net';
+
+const binary = process.argv[2];
+const expectedSource = process.argv[3] || '';
+const expectedCommit = process.argv[4] || '';
+const expectedHash = '2e60bba13dc2bc37d75dd2ce5deb25466f19cb2994e20889388948879875eae9';
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+const port = await new Promise((resolve, reject) => {
+  const server = net.createServer();
+  server.unref();
+  server.on('error', reject);
+  server.listen(0, '127.0.0.1', () => {
+    const value = server.address().port;
+    server.close(() => resolve(value));
+  });
+});
+
+const child = spawn(binary, [], {
+  env: { ...process.env, PORT: String(port), AGENTSAM_TARGET: 'local' },
+  stdio: ['ignore', 'ignore', 'pipe'],
+});
+let stderr = '';
+child.stderr.on('data', (chunk) => { stderr += String(chunk); });
+const base = 'http://127.0.0.1:' + port;
+const results = {};
+
+async function request(name, pathname, init = {}) {
+  const res = await fetch(base + pathname, init);
+  let body = null;
+  try { body = await res.json(); } catch {}
+  results[name] = { status: res.status, ok: res.ok, body };
+  return results[name];
+}
+
+let ready = false;
+for (let attempt = 0; attempt < 100 && child.exitCode == null; attempt += 1) {
+  try {
+    const health = await request('health', '/health', { headers: { Accept: 'application/json' } });
+    if (health.ok) { ready = true; break; }
+  } catch {}
+  await sleep(50);
+}
+
+let error = null;
+if (!ready) {
+  error = 'runtime_not_ready';
+} else {
+  try {
+    await request('runtime', '/v1/runtime');
+    await request('capabilities', '/v1/capabilities');
+    await request('hash', '/v1/hash', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ input: 'agentsam', algorithm: 'sha256' }),
+    });
+    await request('inspect', '/v1/inspect', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ files: [{ path: 'demo.css', content: '.button { color: #2563eb; }' }] }),
+    });
+    await request('malformed', '/v1/inspect', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ not_files: true }),
+    });
+  } catch (cause) {
+    error = cause.message;
+  }
+}
+
+const health = results.health?.body;
+const runtime = results.runtime?.body;
+const capabilities = results.capabilities?.body;
+const malformed = results.malformed?.body;
+const checks = {
+  health: results.health?.status === 200 && health?.ok === true && health?.target === 'local',
+  source_identity: Boolean(expectedSource) && health?.build?.source === expectedSource,
+  source_commit: expectedCommit ? health?.build?.commit === expectedCommit : true,
+  runtime: results.runtime?.status === 200 && runtime?.schema === 'agentsam.go-runtime.v1',
+  capabilities: results.capabilities?.status === 200
+    && capabilities?.schema === 'agentsam.go-capabilities.v1'
+    && ['hash', 'inspect', 'runtime', 'capabilities'].every((name) => capabilities?.capabilities?.includes(name)),
+  hash: results.hash?.status === 200 && results.hash?.body?.hash === expectedHash,
+  inspect: results.inspect?.status === 200
+    && results.inspect?.body?.findings?.some((finding) => finding.kind === 'hardcoded_color' && finding.value === '#2563eb'),
+  error_envelope: results.malformed?.status === 400
+    && malformed?.ok === false
+    && malformed?.schema_version === 1
+    && malformed?.reason === 'input_invalid'
+    && malformed?.code === 'INVALID_ARGUMENT',
+};
+
+const exitPromise = new Promise((resolve) => {
+  const timer = setTimeout(() => {
+    child.kill('SIGKILL');
+    resolve({ code: child.exitCode, signal: 'SIGKILL', timeout: true });
+  }, 5000);
+  child.once('exit', (code, signal) => {
+    clearTimeout(timer);
+    resolve({ code, signal, timeout: false });
+  });
+});
+child.kill('SIGTERM');
+const exit = await exitPromise;
+checks.clean_shutdown = exit.code === 0 && !exit.timeout;
+
+const ok = !error && Object.values(checks).every(Boolean);
+process.stdout.write(JSON.stringify({
+  ok,
+  origin: base,
+  checks,
+  results,
+  exit,
+  stderr: stderr.slice(-2000),
+  error,
+}));
+process.exit(ok ? 0 : 1);