@jigging/jig 0.0.0 → 0.1.0-alpha.2

package/libexec/linux-rootless-supervisor.js

@@ -0,0 +1,623 @@
+// @bun
+// src/internal/linux-rootless-supervisor.ts
+import { spawn } from "child_process";
+import { randomBytes } from "crypto";
+import { closeSync, readFileSync, statSync, writeSync } from "fs";
+import {
+  link,
+  mkdir,
+  open,
+  readFile,
+  rmdir,
+  stat,
+  unlink,
+  writeFile
+} from "fs/promises";
+import { connect } from "net";
+import { posix } from "path";
+var POLICY = Object.freeze(["--no-env-file", "--no-install", "--config=/dev/null"]);
+var SANDBOX_BUN = "/jig-runtime/bun";
+var SANDBOX_LIBRARY_PATH = "/jig-runtime/lib";
+var MAX_CONTROL_BYTES = 64 * 1024;
+var MODULE_DESTINATION = "/jig/linux-rootless-supervisor.ts";
+var DIGEST = /^sha256:[0-9a-f]{64}$/;
+var OWNER_TOKEN = /^[0-9a-f]{64}$/;
+var ENVIRONMENT_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+async function supervisorMain(controlPath, startupTimeoutText) {
+  requireFixedBunPosture("supervisor");
+  if (!absolute(controlPath))
+    throw new Error("invalid rootless supervisor control path");
+  const startupTimeoutMs = Number(startupTimeoutText);
+  if (!/^[1-9][0-9]*$/.test(startupTimeoutText) || !positiveInteger(startupTimeoutMs) || startupTimeoutMs > 2147483647) {
+    throw new Error("invalid rootless supervisor startup timeout");
+  }
+  const startupDeadlineUnixMs = Date.now() + startupTimeoutMs;
+  const control = connect(controlPath);
+  control.on("error", () => {});
+  try {
+    await beforeStartupDeadline(connected(control), startupDeadlineUnixMs, control);
+    await superviseConnected(control, startupDeadlineUnixMs);
+  } finally {
+    control.destroy();
+  }
+}
+async function superviseConnected(control, startupDeadlineUnixMs) {
+  const iterator = readJsonLines(control)[Symbol.asyncIterator]();
+  const first = await beforeStartupDeadline(iterator.next(), startupDeadlineUnixMs, control);
+  if (first.done)
+    return;
+  const configuration = requireStart(first.value);
+  const { limits, runCgroup } = configuration;
+  const claim = await claimActive(configuration);
+  if (claim === "cancelled")
+    return;
+  let cgroupCreated = false;
+  let child;
+  let childExit;
+  let stopReason;
+  let admitted = false;
+  let resolveAdmission;
+  let rejectAdmission;
+  const admission = new Promise((resolve, reject) => {
+    resolveAdmission = resolve;
+    rejectAdmission = reject;
+  });
+  const killRun = async () => {
+    if (!cgroupCreated)
+      return;
+    await writeFile(`${runCgroup}/cgroup.kill`, `1
+`).catch(ignoreMissing);
+  };
+  const stop = (reason) => {
+    if (stopReason === undefined || stopReason === "payload_exit")
+      stopReason = reason;
+    if (!admitted)
+      rejectAdmission(new Error(`rootless launch stopped before admission: ${reason}`));
+    child?.kill("SIGKILL");
+    killRun().catch(() => {});
+  };
+  const controlTask = (async () => {
+    for (;; ) {
+      const next = await iterator.next();
+      if (next.done)
+        return stop("coordinator_lost");
+      const type = recordType(next.value);
+      if (type === "admit" && !admitted) {
+        admitted = true;
+        resolveAdmission();
+      } else if (type === "cancel") {
+        stop("cancelled");
+      } else {
+        stop("cancelled");
+      }
+    }
+  })();
+  controlTask.catch(() => stop("coordinator_lost"));
+  const hardDeadlineUnixMs = limits.deadlineUnixMs + limits.cancellationGraceMs;
+  const deadline = setTimeout(() => stop("deadline"), Math.max(0, hardDeadlineUnixMs - Date.now()));
+  let exitCode = null;
+  let exitSignal = null;
+  let evidence = emptyEvidence();
+  let terminal;
+  try {
+    await mkdir(runCgroup, { mode: 493 });
+    cgroupCreated = true;
+    await writeFile(`${runCgroup}/memory.max`, `${limits.memoryBytes}
+`);
+    if (await exists(`${runCgroup}/memory.swap.max`))
+      await writeFile(`${runCgroup}/memory.swap.max`, `0
+`);
+    await writeFile(`${runCgroup}/pids.max`, `${limits.pids}
+`);
+    await writeFile(`${runCgroup}/cpu.max`, `${limits.cpuQuotaMicros} ${limits.cpuPeriodMicros}
+`);
+    if (stopReason !== undefined)
+      throw new Error(`rootless launch stopped during setup: ${stopReason}`);
+    safeSend(control, { type: "prepared", runCgroup, supervisorPid: process.pid });
+    await admission;
+    if (stopReason !== undefined)
+      throw new Error(`rootless launch stopped before spawn: ${stopReason}`);
+    const launched = spawn(configuration.bunPath, [
+      ...POLICY,
+      configuration.supervisorPath,
+      "--enter",
+      runCgroup,
+      configuration.ownerStateDirectory,
+      configuration.ownerToken,
+      configuration.ownerStateAllocationDigest,
+      configuration.bubblewrapPath,
+      ...bubblewrapArguments(configuration)
+    ], {
+      cwd: "/",
+      env: {
+        LD_LIBRARY_PATH: configuration.bunHostLibraryPath
+      },
+      stdio: ["inherit", "inherit", "inherit", "pipe"]
+    });
+    childExit = childClose(launched);
+    child = launched;
+    const ready = await readReady(launched);
+    safeSend(control, {
+      type: "ready",
+      runCgroup,
+      payloadPid: ready,
+      supervisorPid: process.pid
+    });
+    const exit = await childExit;
+    exitCode = exit.code;
+    exitSignal = exit.signal;
+    stopReason ??= "payload_exit";
+  } catch (error) {
+    stopReason ??= "setup_failed";
+    if (stopReason === "setup_failed")
+      process.stderr.write(`${errorText(error)}
+`);
+  } finally {
+    clearTimeout(deadline);
+    let cleanupError;
+    try {
+      child?.kill("SIGKILL");
+      await killRun();
+      if (childExit !== undefined) {
+        await withinTimeout(childExit.catch(() => {
+          return;
+        }), limits.cleanupTimeoutMs, "rootless entry child did not settle");
+      }
+      if (cgroupCreated) {
+        await waitUntilEmpty(runCgroup, limits.cleanupTimeoutMs);
+        evidence = await readEvidence(runCgroup);
+        await removeEmptyCgroup(runCgroup, limits.cleanupTimeoutMs);
+        cgroupCreated = false;
+      }
+    } catch (error) {
+      cleanupError = errorText(error);
+    }
+    terminal = Object.freeze({
+      type: "terminal",
+      ownerDigest: configuration.ownerDigest,
+      runCgroup,
+      supervisorPid: process.pid,
+      exitCode,
+      signal: exitSignal,
+      stopReason: stopReason ?? "setup_failed",
+      fenced: cleanupError === undefined && !cgroupCreated,
+      ...cleanupError === undefined ? {} : { cleanupError },
+      evidence
+    });
+    if (terminal.fenced)
+      await persistFinal(configuration, terminal);
+    safeSend(control, terminal);
+    control.end();
+  }
+}
+async function enterMain(arguments_) {
+  requireFixedBunPosture("entry trampoline");
+  if (arguments_.length < 7)
+    throw new Error("invalid rootless entry trampoline arguments");
+  const [
+    runCgroup,
+    ownerStateDirectory,
+    ownerToken,
+    ownerStateAllocationDigest,
+    bubblewrap,
+    ...bubblewrapArguments_
+  ] = arguments_;
+  if (!absolute(runCgroup) || !absolute(ownerStateDirectory) || !absolute(bubblewrap)) {
+    throw new Error("invalid rootless entry trampoline path");
+  }
+  await writeFile(`${runCgroup}/cgroup.procs`, `0
+`);
+  const current = readFileSync("/proc/self/cgroup", "utf8").split(`
+`).find((line) => line.startsWith("0::"))?.slice(3);
+  if (`/sys/fs/cgroup${current ?? ""}` !== runCgroup) {
+    throw new Error("rootless entry trampoline did not enter the Run cgroup");
+  }
+  await requireActiveClaim(ownerStateDirectory, ownerToken, ownerStateAllocationDigest);
+  writeSync(3, `${process.pid}
+`);
+  closeSync(3);
+  const child = spawn(bubblewrap, bubblewrapArguments_, { cwd: "/", env: {}, stdio: "inherit" });
+  const exit = await childClose(child);
+  if (exit.signal !== null)
+    process.kill(process.pid, exit.signal);
+  process.exitCode = exit.code ?? 1;
+}
+async function innerMain(command) {
+  if (command.length === 0 || !absolute(command[0]))
+    throw new Error("invalid rootless inner command");
+  const nullDevice = statSync("/dev/null");
+  const entropyDevice = statSync("/dev/urandom");
+  if (!nullDevice.isCharacterDevice() || !entropyDevice.isCharacterDevice() || (nullDevice.mode & 511) !== 438 || (entropyDevice.mode & 511) !== 438) {
+    throw new Error("rootless private devices do not satisfy the required projection");
+  }
+  const child = spawn(command[0], command.slice(1), { cwd: "/work", env: process.env, stdio: "inherit" });
+  const exit = await childClose(child);
+  if (exit.signal !== null)
+    process.kill(process.pid, exit.signal);
+  process.exitCode = exit.code ?? 1;
+}
+function bubblewrapArguments(configuration) {
+  const result = [
+    "--unshare-all",
+    ...configuration.network === "inherited" ? ["--share-net"] : [],
+    "--unshare-user",
+    "--disable-userns",
+    "--assert-userns-disabled",
+    "--as-pid-1",
+    "--die-with-parent",
+    "--new-session",
+    "--clearenv",
+    "--proc",
+    "/proc",
+    "--remount-ro",
+    "/proc",
+    "--dev",
+    "/dev",
+    "--tmpfs",
+    "/tmp",
+    "--tmpfs",
+    "/run",
+    "--dir",
+    "/work",
+    "--dir",
+    "/etc",
+    "--dir",
+    "/jig",
+    "--dir",
+    "/jig-runtime",
+    "--dir",
+    "/jig-runtime/lib",
+    "--dir",
+    "/lib64",
+    "--chdir",
+    "/work"
+  ];
+  for (const mount of configuration.readOnlyMounts)
+    result.push("--ro-bind", mount.source, mount.destination);
+  result.push("--ro-bind", configuration.supervisorPath, MODULE_DESTINATION);
+  for (const [name, value] of Object.entries(configuration.environment).sort(([a], [b]) => a.localeCompare(b))) {
+    result.push("--setenv", name, value);
+  }
+  result.push("--setenv", "LD_LIBRARY_PATH", SANDBOX_LIBRARY_PATH, "--uid", String(configuration.payloadUid), "--gid", String(configuration.payloadGid), "--cap-drop", "ALL", "--", SANDBOX_BUN, ...POLICY, MODULE_DESTINATION, "--inner", "--", ...configuration.command);
+  return result;
+}
+async function claimActive(configuration) {
+  await requireOwnerRecord(configuration);
+  const path = `${configuration.ownerStateDirectory}/claim.json`;
+  try {
+    const file = await open(path, "wx", 384);
+    try {
+      await file.writeFile(`${JSON.stringify({
+        allocationDigest: configuration.ownerStateAllocationDigest,
+        kind: "private-linux-owner-claim/1",
+        state: "active",
+        token: configuration.ownerToken
+      })}
+`, "utf8");
+      await file.sync();
+    } finally {
+      await file.close();
+    }
+    await syncDirectory(configuration.ownerStateDirectory);
+    return "created";
+  } catch (error) {
+    if (!hasCode(error, "EEXIST"))
+      throw error;
+  }
+  const claim = JSON.parse(await readFile(path, "utf8"));
+  if (claim.allocationDigest !== configuration.ownerStateAllocationDigest || claim.kind !== "private-linux-owner-claim/1" || claim.token !== configuration.ownerToken || claim.state !== "active" && claim.state !== "cancelled") {
+    throw new Error("rootless owner claim is invalid");
+  }
+  if (claim.state === "active") {
+    throw new Error("rootless owner claim is already active");
+  }
+  return "cancelled";
+}
+async function requireActiveClaim(directory, token, allocationDigest) {
+  const claim = JSON.parse(await readFile(`${directory}/claim.json`, "utf8"));
+  if (claim.kind !== "private-linux-owner-claim/1" || claim.state !== "active" || claim.token !== token || claim.allocationDigest !== allocationDigest) {
+    throw new Error("rootless owner was cancelled before entry");
+  }
+}
+async function requireOwnerRecord(configuration) {
+  const value = JSON.parse(await readFile(`${configuration.ownerStateDirectory}/owner.json`, "utf8"));
+  if (value.kind !== "private-linux-owner-state/1" || value.allocationDigest !== configuration.ownerStateAllocationDigest || value.token !== configuration.ownerToken || value.ownerDigest !== configuration.ownerDigest || value.runCgroup !== configuration.runCgroup || value.mechanismDigest !== configuration.mechanismDigest || value.sealedPlanDigest !== configuration.sealedPlanDigest) {
+    throw new Error("rootless owner-state record is invalid");
+  }
+}
+async function persistFinal(configuration, terminal) {
+  const directory = configuration.ownerStateDirectory;
+  const target = `${directory}/final.json`;
+  const temporary = `${directory}/.final-${randomBytes(8).toString("hex")}`;
+  const file = await open(temporary, "wx", 384);
+  try {
+    await file.writeFile(`${JSON.stringify(terminal)}
+`, "utf8");
+    await file.sync();
+  } finally {
+    await file.close();
+  }
+  try {
+    await link(temporary, target);
+    await syncDirectory(directory);
+  } catch (error) {
+    if (!hasCode(error, "EEXIST"))
+      throw error;
+    const existing = await readFile(target, "utf8");
+    if (existing !== `${JSON.stringify(terminal)}
+`) {
+      throw new Error("rootless cleanup owners produced conflicting fence receipts");
+    }
+  } finally {
+    await unlink(temporary).catch(() => {
+      return;
+    });
+  }
+}
+function requireStart(value) {
+  if (recordType(value) !== "start" || value === null || typeof value !== "object" || !("configuration" in value))
+    throw new Error("invalid rootless supervisor start message");
+  const configuration = value.configuration;
+  const keys = [
+    "bubblewrapPath",
+    "bunHostLibraryPath",
+    "bunPath",
+    "command",
+    "delegatedCgroup",
+    "environment",
+    "limits",
+    "mechanismDigest",
+    "network",
+    "ownerDigest",
+    "ownerStateAllocationDigest",
+    "ownerStateDirectory",
+    "ownerToken",
+    "payloadGid",
+    "payloadUid",
+    "readOnlyMounts",
+    "runCgroup",
+    "sealedPlanDigest",
+    "supervisorPath"
+  ];
+  if (configuration === null || typeof configuration !== "object" || Array.isArray(configuration) || Object.keys(configuration).sort().join("\x00") !== keys.sort().join("\x00") || !absolute(configuration.delegatedCgroup) || !absolute(configuration.bunHostLibraryPath) || !absolute(configuration.runCgroup) || posix.dirname(configuration.runCgroup) !== configuration.delegatedCgroup || !/^jig-run-[a-z0-9][a-z0-9-]{0,47}-[0-9a-f]{24}$/.test(posix.basename(configuration.runCgroup)) || !configuration.runCgroup.startsWith("/sys/fs/cgroup/") || !absolute(configuration.ownerStateDirectory) || !absolute(configuration.bunPath) || !absolute(configuration.bubblewrapPath) || !absolute(configuration.supervisorPath) || typeof configuration.mechanismDigest !== "string" || !DIGEST.test(configuration.mechanismDigest) || typeof configuration.ownerDigest !== "string" || !DIGEST.test(configuration.ownerDigest) || typeof configuration.sealedPlanDigest !== "string" || !DIGEST.test(configuration.sealedPlanDigest) || typeof configuration.ownerStateAllocationDigest !== "string" || !DIGEST.test(configuration.ownerStateAllocationDigest) || typeof configuration.ownerToken !== "string" || !OWNER_TOKEN.test(configuration.ownerToken) || configuration.network !== "isolated" && configuration.network !== "inherited" || !positiveInteger(configuration.payloadUid) || !positiveInteger(configuration.payloadGid) || !validLimits(configuration.limits) || !validMounts(configuration.readOnlyMounts) || !validEnvironment(configuration.environment) || !Array.isArray(configuration.command) || configuration.command.length === 0 || !absolute(configuration.command[0]) || configuration.command.some((part) => typeof part !== "string" || part.includes("\x00"))) {
+    throw new Error("invalid rootless supervisor configuration");
+  }
+  return configuration;
+}
+function validLimits(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    return false;
+  const limits = value;
+  const keys = [
+    "cancellationGraceMs",
+    "cleanupTimeoutMs",
+    "cpuPeriodMicros",
+    "cpuQuotaMicros",
+    "deadlineUnixMs",
+    "memoryBytes",
+    "pids"
+  ];
+  return Object.keys(limits).sort().join("\x00") === keys.sort().join("\x00") && positiveInteger(limits.memoryBytes) && positiveInteger(limits.pids) && positiveInteger(limits.cpuQuotaMicros) && positiveInteger(limits.cpuPeriodMicros) && nonnegativeInteger(limits.deadlineUnixMs) && positiveInteger(limits.cancellationGraceMs) && positiveInteger(limits.cleanupTimeoutMs) && Number(limits.deadlineUnixMs) + Number(limits.cancellationGraceMs) <= Number.MAX_SAFE_INTEGER && Number(limits.deadlineUnixMs) + Number(limits.cancellationGraceMs) - Date.now() <= 2147483647;
+}
+function validMounts(value) {
+  return Array.isArray(value) && value.every((mount) => {
+    if (mount === null || typeof mount !== "object" || Array.isArray(mount))
+      return false;
+    const record = mount;
+    return Object.keys(record).sort().join("\x00") === "destination\x00source" && typeof record.source === "string" && absolute(record.source) && typeof record.destination === "string" && absolute(record.destination);
+  });
+}
+function validEnvironment(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    return false;
+  return Object.entries(value).every(([name, content]) => ENVIRONMENT_NAME.test(name) && name !== "BUN_BE_BUN" && name !== "LD_LIBRARY_PATH" && typeof content === "string" && !content.includes("\x00"));
+}
+function positiveInteger(value) {
+  return Number.isSafeInteger(value) && Number(value) > 0;
+}
+function nonnegativeInteger(value) {
+  return Number.isSafeInteger(value) && Number(value) >= 0;
+}
+function recordType(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) && "type" in value && typeof value.type === "string" ? value.type : undefined;
+}
+async function* readJsonLines(stream) {
+  let buffer = "";
+  for await (const chunk of stream) {
+    buffer += String(chunk);
+    if (Buffer.byteLength(buffer) > MAX_CONTROL_BYTES)
+      throw new Error("rootless control stream overflow");
+    let newline = buffer.indexOf(`
+`);
+    while (newline !== -1) {
+      const line = buffer.slice(0, newline);
+      buffer = buffer.slice(newline + 1);
+      if (line !== "")
+        yield JSON.parse(line);
+      newline = buffer.indexOf(`
+`);
+    }
+  }
+  if (buffer !== "")
+    throw new Error("rootless control stream ended mid-message");
+}
+function safeSend(stream, value) {
+  try {
+    stream.write(`${JSON.stringify(value)}
+`);
+  } catch {}
+}
+async function readReady(child) {
+  const stream = child.stdio[3];
+  if (stream === null || stream === undefined)
+    throw new Error("rootless entry readiness pipe is unavailable");
+  let text = "";
+  for await (const chunk of stream) {
+    text += String(chunk);
+    if (text.length > 32)
+      throw new Error("invalid rootless entry readiness receipt");
+  }
+  const pid = Number(text.trim());
+  if (!Number.isSafeInteger(pid) || pid <= 0)
+    throw new Error("invalid rootless entry readiness receipt");
+  return pid;
+}
+async function waitUntilEmpty(cgroup, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() <= deadline) {
+    if ((await readCounters(`${cgroup}/cgroup.events`)).populated === 0)
+      return;
+    await new Promise((resolve) => setTimeout(resolve, 10));
+  }
+  throw new Error("rootless Run cgroup did not become empty");
+}
+async function removeEmptyCgroup(cgroup, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  for (;; ) {
+    try {
+      await rmdir(cgroup);
+      return;
+    } catch (error) {
+      if (!hasCode(error, "EBUSY") || Date.now() > deadline)
+        throw error;
+      await new Promise((resolve) => setTimeout(resolve, 10));
+    }
+  }
+}
+async function readEvidence(cgroup) {
+  return Object.freeze({
+    cpuStat: Object.freeze(await readCounters(`${cgroup}/cpu.stat`)),
+    memoryEvents: Object.freeze(await readCounters(`${cgroup}/memory.events`)),
+    pidsEvents: Object.freeze(await readCounters(`${cgroup}/pids.events`))
+  });
+}
+async function readCounters(path) {
+  const result = Object.create(null);
+  for (const line of (await readFile(path, "utf8")).trim().split(`
+`)) {
+    if (line === "")
+      continue;
+    const [name, raw] = line.trim().split(/\s+/, 2);
+    const value = Number(raw);
+    if (name === undefined || !Number.isSafeInteger(value) || value < 0)
+      throw new Error(`invalid counter in ${path}`);
+    result[name] = value;
+  }
+  return result;
+}
+function emptyEvidence() {
+  return Object.freeze({ cpuStat: Object.freeze({}), memoryEvents: Object.freeze({}), pidsEvents: Object.freeze({}) });
+}
+async function exists(path) {
+  try {
+    await stat(path);
+    return true;
+  } catch (error) {
+    if (hasCode(error, "ENOENT"))
+      return false;
+    throw error;
+  }
+}
+function ignoreMissing(error) {
+  if (!hasCode(error, "ENOENT"))
+    throw error;
+}
+function hasCode(error, code) {
+  return error !== null && typeof error === "object" && error.code === code;
+}
+function absolute(path) {
+  return typeof path === "string" && path.startsWith("/") && !path.includes("\x00") && posix.normalize(path) === path;
+}
+function requireFixedBunPosture(label) {
+  const environmentKeys = Object.keys(process.env).sort();
+  if (process.cwd() !== "/" || environmentKeys.join("\x00") !== "LD_LIBRARY_PATH" || !absolute(process.env.LD_LIBRARY_PATH ?? "") || process.execArgv.length !== POLICY.length || process.execArgv.some((value, index) => value !== POLICY[index])) {
+    throw new Error(`rootless ${label} has an invalid startup posture`);
+  }
+}
+function childClose(child) {
+  return new Promise((resolve, reject) => {
+    let failure;
+    child.on("error", (error) => {
+      failure ??= error;
+    });
+    child.once("close", (code, signal) => {
+      if (failure === undefined)
+        resolve({ code, signal });
+      else
+        reject(failure);
+    });
+  });
+}
+function withinTimeout(promise, timeoutMs, message) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error(message)), timeoutMs);
+    promise.then((value) => {
+      clearTimeout(timer);
+      resolve(value);
+    }, (error) => {
+      clearTimeout(timer);
+      reject(error);
+    });
+  });
+}
+async function syncDirectory(path) {
+  const handle = await open(path, "r");
+  try {
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+}
+function connected(socket) {
+  return new Promise((resolve, reject) => {
+    socket.once("connect", resolve);
+    socket.once("error", reject);
+  });
+}
+function beforeStartupDeadline(promise, deadlineUnixMs, control) {
+  return new Promise((resolve, reject) => {
+    const remaining = deadlineUnixMs - Date.now();
+    if (remaining <= 0) {
+      control.destroy();
+      reject(new Error("rootless supervisor start timed out"));
+      return;
+    }
+    const timer = setTimeout(() => {
+      control.destroy();
+      reject(new Error("rootless supervisor start timed out"));
+    }, remaining);
+    promise.then((value) => {
+      clearTimeout(timer);
+      resolve(value);
+    }, (error) => {
+      clearTimeout(timer);
+      reject(error);
+    });
+  });
+}
+function errorText(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+async function main() {
+  const [mode, ...arguments_] = process.argv.slice(2);
+  if (mode === "--supervisor") {
+    if (arguments_.length !== 2)
+      throw new Error("invalid rootless supervisor arguments");
+    return await supervisorMain(arguments_[0], arguments_[1]);
+  }
+  if (mode === "--enter")
+    return await enterMain(arguments_);
+  if (mode === "--inner") {
+    if (arguments_[0] !== "--")
+      throw new Error("invalid rootless inner separator");
+    return await innerMain(arguments_.slice(1));
+  }
+  throw new Error("invalid rootless supervisor mode");
+}
+if (import.meta.main) {
+  main().catch((error) => {
+    process.stderr.write(`jig rootless supervisor failed: ${errorText(error)}
+`);
+    process.exitCode = 70;
+  });
+}