@kitman-sh/cli 0.0.0-stage → 0.6.0

package/dist/chunk-xdk488qp.js

@@ -0,0 +1,364 @@
+// @bun
+import {
+  build2,
+  provide2,
+  gen,
+  flatMap,
+  provideContext,
+  runForEach,
+  optionalKey,
+  optional,
+  Literal,
+  Null,
+  String2,
+  Boolean2,
+  Void,
+  Struct,
+  Record,
+  ArraySchema,
+  Union,
+  Literals,
+  UndefinedOr,
+  TaggedStruct,
+  Finite,
+  Int,
+  Uint8ArrayFromBase64,
+  TaggedError2,
+  Json,
+  WorkUnitRepoBinding,
+  WorkUnitClaimResult,
+  WorkUnitClaimInput,
+  WorkUnitHeartbeatInput,
+  WorkUnitHeartbeatResult,
+  WorkUnitReleaseInput,
+  WorkUnitCompletion
+} from "./chunk-txyq8r41.js";
+import {
+  layerWebSocketConstructorGlobal,
+  layerWebSocket,
+  make5,
+  make6,
+  layerJson,
+  make7,
+  withHeaders,
+  layerProtocolSocket,
+  Service
+} from "./chunk-hw7qkap1.js";
+
+// packages/live/src/rpc/runner-group.ts
+var RunnerHeaders = { runnerId: "x-kitman-runner-id", protocolVersion: "x-kitman-rpc-protocol" };
+var RunnerRpcProtocolVersion = 1;
+
+class RunnerRpcError extends TaggedError2()("RunnerRpcError", {
+  code: String2,
+  message: String2,
+  status: Finite
+}) {
+}
+
+class RunnerAuthentication extends Service()("RunnerAuthentication", {
+  error: RunnerRpcError
+}) {
+}
+var EventFilterValue = Union([String2, Finite, Boolean2, Null]);
+var WorkAvailable = TaggedStruct("WorkAvailable", {});
+var LeaseRevoked = TaggedStruct("LeaseRevoked", { workUnitId: String2 });
+var Settled = TaggedStruct("Settled", { workUnitId: String2 });
+var Canceled = TaggedStruct("Canceled", { workUnitId: String2 });
+var RunSettled = TaggedStruct("RunSettled", { runId: String2 });
+var Steer = TaggedStruct("Steer", {
+  workUnitId: String2,
+  messageId: String2,
+  text: String2
+});
+var SessionUpdated = TaggedStruct("SessionUpdated", { workUnitId: String2 });
+var RunnerSignal = Union([
+  WorkAvailable,
+  LeaseRevoked,
+  Settled,
+  Canceled,
+  RunSettled,
+  Steer,
+  SessionUpdated
+]);
+var ProgramLease = Struct({
+  workUnitId: String2,
+  leaseOwnerId: String2,
+  runnerReplicaId: String2,
+  leaseId: String2,
+  attempt: Int,
+  fencingToken: String2,
+  capacitySlot: String2
+});
+var CheckpointSession = Struct({
+  harness: String2,
+  id: String2,
+  name: String2,
+  content: Uint8ArrayFromBase64
+});
+var StepCheckpoint = Struct({
+  ref: optionalKey(String2),
+  revision: optionalKey(String2),
+  session: optionalKey(CheckpointSession)
+});
+var SuggestedVerification = Struct({
+  name: String2,
+  command: String2,
+  workingDirectory: optional(String2)
+});
+var ProgramOutcome = Union([
+  Struct({ status: Literal("completed"), output: Json }),
+  Struct({ status: Literal("failed"), failureSummary: String2 })
+]);
+
+class RunnerRpcs extends make6(make5("Claim", {
+  payload: WorkUnitClaimInput,
+  success: WorkUnitClaimResult,
+  error: RunnerRpcError
+}), make5("Heartbeat", {
+  payload: WorkUnitHeartbeatInput,
+  success: WorkUnitHeartbeatResult,
+  error: RunnerRpcError
+}), make5("Complete", {
+  payload: WorkUnitCompletion,
+  error: RunnerRpcError
+}), make5("Release", {
+  payload: WorkUnitReleaseInput,
+  error: RunnerRpcError
+}), make5("RecordActivity", {
+  payload: { lease: ProgramLease, name: String2, attempt: Int, exit: Json },
+  error: RunnerRpcError
+}), make5("DeferredDone", {
+  payload: { lease: ProgramLease, name: String2, exit: Json },
+  error: RunnerRpcError
+}), make5("ScheduleClock", {
+  payload: { lease: ProgramLease, name: String2, deferredName: String2, durationMillis: Int },
+  error: RunnerRpcError
+}), make5("PutQuestion", {
+  payload: {
+    lease: ProgramLease,
+    step: String2,
+    prompt: String2,
+    options: optional(ArraySchema(String2)),
+    verification: optional(SuggestedVerification),
+    deferredName: String2
+  },
+  success: Struct({ questionId: String2 }),
+  error: RunnerRpcError
+}), make5("StartAgentStep", {
+  payload: {
+    lease: ProgramLease,
+    step: String2,
+    deferredName: String2,
+    role: String2,
+    agentId: String2,
+    prompt: String2,
+    outputSchema: Json,
+    secrets: optionalKey(ArraySchema(String2))
+  },
+  success: Struct({ stepAttemptId: String2 }),
+  error: RunnerRpcError
+}), make5("StartVerification", {
+  payload: {
+    lease: ProgramLease,
+    step: String2,
+    deferredName: String2,
+    revision: optionalKey(String2),
+    checks: optional(ArraySchema(String2))
+  },
+  success: Struct({ verificationId: String2 }),
+  error: RunnerRpcError
+}), make5("KnownEvidence", {
+  payload: { lease: ProgramLease, trees: ArraySchema(String2) },
+  success: ArraySchema(Struct({ tree: String2, name: String2, command: String2 })),
+  error: RunnerRpcError
+}), make5("AwaitEvent", {
+  payload: {
+    lease: ProgramLease,
+    step: String2,
+    deferredName: String2,
+    event: String2,
+    filter: optional(Record(String2, Union([EventFilterValue, ArraySchema(EventFilterValue)]))),
+    timeoutMillis: Int
+  },
+  error: RunnerRpcError
+}), make5("AdmitChild", {
+  payload: {
+    lease: ProgramLease,
+    step: String2,
+    loop: String2,
+    input: Json,
+    deferredName: String2
+  },
+  success: Struct({ runId: String2 }),
+  error: RunnerRpcError
+}), make5("StoreArtifact", {
+  payload: {
+    lease: ProgramLease,
+    step: String2,
+    kind: String2,
+    title: String2,
+    text: String2,
+    data: optional(Json)
+  },
+  success: Struct({ artifactId: String2 }),
+  error: RunnerRpcError
+}), make5("RecordNote", {
+  payload: {
+    lease: ProgramLease,
+    step: String2,
+    text: String2,
+    artifactId: optional(String2)
+  },
+  error: RunnerRpcError
+}), make5("PerformHostEffect", {
+  payload: {
+    lease: ProgramLease,
+    step: String2,
+    effect: Union([
+      Struct({ kind: Literal("post_comment"), changeRequestId: String2, body: String2 }),
+      Struct({
+        kind: Literal("change_request"),
+        title: String2,
+        body: String2,
+        integration: optionalKey(String2)
+      }),
+      Struct({
+        kind: Literal("write_back"),
+        milestone: optionalKey(Literals(["started", "change_request_opened", "merged", "failed"])),
+        changeRequestUrl: optionalKey(String2)
+      })
+    ])
+  },
+  success: UndefinedOr(Struct({ id: String2, number: String2, url: String2 })),
+  error: RunnerRpcError
+}), make5("CreatePlanTasks", {
+  payload: {
+    lease: ProgramLease,
+    tickets: ArraySchema(Struct({
+      key: String2,
+      title: String2,
+      body: String2,
+      acceptanceCriteria: ArraySchema(String2),
+      blockedBy: ArraySchema(String2),
+      outcome: optionalKey(Literals(["feature", "bug", "refactor", "investigation", "docs", "migration"]))
+    }))
+  },
+  success: ArraySchema(Struct({ key: String2, taskId: String2 })),
+  error: RunnerRpcError
+}), make5("IntegrationBranch", {
+  payload: { lease: ProgramLease, repoBindingId: optionalKey(String2) },
+  success: Struct({ repoBindingId: String2, branch: String2, revision: String2 }),
+  error: RunnerRpcError
+}), make5("MergeChangeRequest", {
+  payload: { lease: ProgramLease, step: String2, changeRequestId: String2 },
+  success: Union([
+    Struct({ status: Literal("merged"), revision: String2 }),
+    Struct({ status: Literal("conflict") })
+  ]),
+  error: RunnerRpcError
+}), make5("PublishRelease", {
+  payload: {
+    lease: ProgramLease,
+    step: String2,
+    tag: String2,
+    revision: optionalKey(String2),
+    title: String2,
+    notes: String2
+  },
+  success: Struct({ tag: String2, revision: String2, url: String2 }),
+  error: RunnerRpcError
+}), make5("ReportSteer", {
+  payload: { workUnitId: String2, messageId: String2, delivered: Boolean2 },
+  success: Void,
+  error: RunnerRpcError
+}), make5("SaveCheckpoint", {
+  payload: { lease: ProgramLease, checkpoint: StepCheckpoint },
+  success: Void,
+  error: RunnerRpcError
+}), make5("ResumeCheckpoint", {
+  payload: { lease: ProgramLease },
+  success: UndefinedOr(StepCheckpoint),
+  error: RunnerRpcError
+}), make5("SettledCheckpoints", {
+  success: ArraySchema(Struct({
+    stepAttemptId: String2,
+    ref: optionalKey(String2),
+    repoBinding: optionalKey(WorkUnitRepoBinding)
+  })),
+  error: RunnerRpcError
+}), make5("ForgetCheckpoints", {
+  payload: { stepAttemptIds: ArraySchema(String2) },
+  success: Void,
+  error: RunnerRpcError
+}), make5("Bundle", {
+  payload: { digest: String2 },
+  success: Struct({ bundle: String2 }),
+  error: RunnerRpcError
+}), make5("SettledRuns", {
+  payload: { runIds: ArraySchema(String2) },
+  success: ArraySchema(String2),
+  error: RunnerRpcError
+}), make5("ProgramSecrets", {
+  payload: { lease: ProgramLease },
+  success: Record(String2, String2),
+  error: RunnerRpcError
+}), make5("Suspend", { payload: { lease: ProgramLease }, error: RunnerRpcError }), make5("FinishProgram", { payload: { lease: ProgramLease, outcome: ProgramOutcome }, error: RunnerRpcError }), make5("Signals", {
+  payload: { runnerReplicaId: String2 },
+  success: RunnerSignal,
+  error: RunnerRpcError,
+  stream: true
+})).middleware(RunnerAuthentication) {
+}
+
+// packages/live/src/rpc/runner-client.ts
+var runnerWebSocketProtocol2 = (url) => layerProtocolSocket({ retryTransientErrors: true }).pipe(provide2(layerWebSocket(url)), provide2(layerWebSocketConstructorGlobal), provide2(layerJson));
+function runnerRpcUrl2(apiUrl) {
+  const url = new URL("/v1/runners/rpc", apiUrl);
+  url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+  return url.toString();
+}
+var makeRunnerRpcClient2 = (options) => gen(function* () {
+  const protocol = yield* build2(options.protocol);
+  const client = yield* make7(RunnerRpcs).pipe(provideContext(protocol));
+  const authorized = (call) => flatMap(options.bearer, (token) => withHeaders(call, {
+    authorization: `Bearer ${token}`,
+    [RunnerHeaders.runnerId]: options.runnerId,
+    [RunnerHeaders.protocolVersion]: String(RunnerRpcProtocolVersion)
+  }));
+  return {
+    claim: (input) => authorized(client.Claim(input)),
+    heartbeat: (input) => authorized(client.Heartbeat(input)),
+    complete: (input) => authorized(client.Complete(input)),
+    release: (input) => authorized(client.Release(input)),
+    recordActivity: (input) => authorized(client.RecordActivity(input)),
+    deferredDone: (input) => authorized(client.DeferredDone(input)),
+    scheduleClock: (input) => authorized(client.ScheduleClock(input)),
+    putQuestion: (input) => authorized(client.PutQuestion(input)),
+    programSecrets: (input) => authorized(client.ProgramSecrets(input)),
+    suspend: (input) => authorized(client.Suspend(input)),
+    finishProgram: (input) => authorized(client.FinishProgram(input)),
+    startAgentStep: (input) => authorized(client.StartAgentStep(input)),
+    startVerification: (input) => authorized(client.StartVerification(input)),
+    knownEvidence: (input) => authorized(client.KnownEvidence(input)),
+    awaitEvent: (input) => authorized(client.AwaitEvent(input)),
+    admitChild: (input) => authorized(client.AdmitChild(input)),
+    storeArtifact: (input) => authorized(client.StoreArtifact(input)),
+    recordNote: (input) => authorized(client.RecordNote(input)),
+    performHostEffect: (input) => authorized(client.PerformHostEffect(input)),
+    createPlanTasks: (input) => authorized(client.CreatePlanTasks(input)),
+    integrationBranch: (input) => authorized(client.IntegrationBranch(input)),
+    mergeChangeRequest: (input) => authorized(client.MergeChangeRequest(input)),
+    publishRelease: (input) => authorized(client.PublishRelease(input)),
+    bundle: (digest) => authorized(client.Bundle({ digest })),
+    settledRuns: (runIds) => authorized(client.SettledRuns({ runIds })),
+    reportSteer: (input) => authorized(client.ReportSteer(input)),
+    saveCheckpoint: (input) => authorized(client.SaveCheckpoint(input)),
+    resumeCheckpoint: (input) => authorized(client.ResumeCheckpoint(input)),
+    settledCheckpoints: authorized(client.SettledCheckpoints()),
+    forgetCheckpoints: (stepAttemptIds) => authorized(client.ForgetCheckpoints({ stepAttemptIds })),
+    listen: (runnerReplicaId, onSignal) => authorized(runForEach(client.Signals({ runnerReplicaId }), onSignal))
+  };
+});
+
+export { RunnerRpcProtocolVersion, RunnerRpcError, RunSettled, runnerWebSocketProtocol2, runnerRpcUrl2, makeRunnerRpcClient2 };

package/dist/egress-proxy.ts

@@ -0,0 +1,107 @@
+// Runs alone inside the egress proxy container, so it imports nothing outside Node.
+import { once } from 'node:events'
+import { connect, createServer, type Server, type Socket } from 'node:net'
+
+/** Whether the allowlist takes `host:port`: an entry `host` takes any port, `host:port` one, `*.domain` subdomains. */
+export const egressAllowed = (hosts: readonly string[], host: string, port: number) => {
+  const target = host.toLowerCase()
+
+  return hosts.some(entry => {
+    const [name = '', entryPort] = entry.toLowerCase().split(':')
+
+    if (entryPort !== undefined && Number(entryPort) !== port) return false
+
+    return name.startsWith('*.') ? target.endsWith(name.slice(1)) : target === name
+  })
+}
+
+const connectTarget = (authority: string) => {
+  const separator = authority.lastIndexOf(':')
+  const port = Number(authority.slice(separator + 1))
+
+  return separator === -1 || !Number.isInteger(port)
+    ? undefined
+    : { host: authority.slice(0, separator).replace(/^\[|\]$/g, ''), port }
+}
+
+const httpTarget = (absolute: string) => {
+  if (!URL.canParse(absolute)) return undefined
+  const url = new URL(absolute)
+
+  return url.protocol !== 'http:'
+    ? undefined
+    : {
+        host: url.hostname.replace(/^\[|\]$/g, ''),
+        port: url.port === '' ? 80 : Number(url.port),
+        path: `${url.pathname}${url.search}`
+      }
+}
+
+const answer = (socket: Socket, status: string) => socket.end(`HTTP/1.1 ${status}\r\nContent-Length: 0\r\n\r\n`)
+
+const handle = (hosts: readonly string[]) => (client: Socket) => {
+  let head = Buffer.alloc(0)
+
+  const onData = (chunk: Buffer) => {
+    head = Buffer.concat([head, chunk])
+    const end = head.indexOf('\r\n\r\n')
+
+    if (end === -1) return head.length > 16_384 ? answer(client, '431 Request Header Fields Too Large') : undefined
+    client.off('data', onData)
+
+    const [requestLine = '', ...headers] = head.subarray(0, end).toString().split('\r\n')
+    const [method = '', target = '', version = 'HTTP/1.1'] = requestLine.split(' ')
+    const destination = method === 'CONNECT' ? connectTarget(target) : httpTarget(target)
+
+    if (destination === undefined) return answer(client, '405 Method Not Allowed')
+
+    if (!egressAllowed(hosts, destination.host, destination.port)) return answer(client, '403 Forbidden')
+
+    const upstream = connect(destination.port, destination.host, () => {
+      if (!('path' in destination)) {
+        client.write('HTTP/1.1 200 Connection Established\r\n\r\n')
+        upstream.write(head.subarray(end + 4))
+      } else {
+        // One request per connection: a reused one could carry a request for another host to this one.
+        const kept = headers.filter(line => !/^(proxy-)?connection:/i.test(line))
+
+        upstream.write(
+          Buffer.concat([
+            Buffer.from(
+              [[method, destination.path, version].join(' '), ...kept, 'Connection: close', '', ''].join('\r\n')
+            ),
+            head.subarray(end + 4)
+          ])
+        )
+      }
+
+      client.pipe(upstream)
+      upstream.pipe(client)
+    })
+
+    upstream.on('error', () => (client.writable ? answer(client, '502 Bad Gateway') : client.destroy()))
+    client.on('error', () => upstream.destroy())
+  }
+
+  client.on('data', onData)
+  client.on('error', () => client.destroy())
+}
+
+/** An HTTP proxy that tunnels CONNECT and forwards plain HTTP only to the allowlist. */
+export const startEgressProxy = (input: {
+  readonly hosts: readonly string[]
+  readonly port: number
+  readonly hostname: string
+}): Promise<Server> => {
+  const server = createServer(handle(input.hosts)).listen(input.port, input.hostname)
+
+  return once(server, 'listening').then(() => server)
+}
+
+// `bun egress-proxy.ts <comma-separated allowlist>`
+if (import.meta.main)
+  void startEgressProxy({
+    hosts: (Bun.argv[2] ?? '').split(',').filter(host => host.length > 0),
+    port: 3128,
+    hostname: '0.0.0.0'
+  })