@kitman-sh/cli 0.10.53 → 0.10.55

package/dist/{chunk-6vns3ej0.js → chunk-rjfxnk05.js}

@@ -7,11 +7,11 @@ import {
   decoded2,
   readOpencode2,
   runOpencodeReader2
-} from "./chunk-x0b92bjb.js";
-import"./chunk-3bj7sc3v.js";
-import"./chunk-11p4wf6n.js";
-import"./chunk-arvwar2c.js";
-import"./chunk-mbctzx7e.js";
+} from "./chunk-vtn088tq.js";
+import"./chunk-mmetyep8.js";
+import"./chunk-7evwar6b.js";
+import"./chunk-xgwjcq4z.js";
+import"./chunk-61k67vxh.js";
 export {
   decoded2 as decoded,
   decodedOption2 as decodedOption,

package/dist/{chunk-g5bs3f6z.js → chunk-twp7aprz.js}

@@ -24,11 +24,11 @@ import {
   Record,
   Int,
   fromJsonString
-} from "./chunk-mbctzx7e.js";
+} from "./chunk-61k67vxh.js";
 import {
   withDefault,
   String2
-} from "./chunk-11p4wf6n.js";
+} from "./chunk-xgwjcq4z.js";
 import {
   digestSha256,
   digestSha512,
@@ -36,11 +36,9 @@ import {
   schemaBodyJson,
   filterStatusOk,
   get2,
-  layer2
-} from "./chunk-wh1pa2aa.js";
-import {
+  layer2,
   KitDigest
-} from "./chunk-z821b2gp.js";
+} from "./chunk-m32wb6t0.js";
 
 // packages/core/src/npm-registry.ts
 var KitManifest = Struct({

package/dist/{chunk-x0b92bjb.js → chunk-vtn088tq.js}

@@ -22,21 +22,21 @@ import {
   NullOr,
   Finite,
   encodeUnknownJsonStringSync
-} from "./chunk-mbctzx7e.js";
+} from "./chunk-61k67vxh.js";
 import {
   isNumber,
   isJsonObject,
   isString
-} from "./chunk-arvwar2c.js";
+} from "./chunk-7evwar6b.js";
 import {
   make11,
   runForEach,
   compiled2
-} from "./chunk-11p4wf6n.js";
+} from "./chunk-xgwjcq4z.js";
 import {
   ChildProcessSpawner,
-  make7
-} from "./chunk-3bj7sc3v.js";
+  make3
+} from "./chunk-mmetyep8.js";
 
 // packages/agent-runtime/src/opencode-store.ts
 import { lstatSync, readFileSync, realpathSync } from "fs";
@@ -164,7 +164,7 @@ var opencodeReaderCommand = () => compiled2 ? [process.execPath, "opencode-read"
 var isolatedRead = (store, name, input) => gen(function* () {
   const spawner = yield* ChildProcessSpawner;
   const [command, ...args] = opencodeReaderCommand();
-  const handle = yield* spawner.spawn(make7(command, args, {
+  const handle = yield* spawner.spawn(make3(command, args, {
     stdin: make11(new TextEncoder().encode(encodeUnknownJsonStringSync({ store, name, input }))),
     stderr: "ignore",
     extendEnv: false,

package/dist/{chunk-b6thzgc9.js → chunk-wczs5vrq.js}

@@ -13,8 +13,8 @@ import {
   writeSrtSettings2,
   srtStepArgv2,
   srtArgv2
-} from "./chunk-11p4wf6n.js";
-import"./chunk-mbctzx7e.js";
+} from "./chunk-xgwjcq4z.js";
+import"./chunk-61k67vxh.js";
 export {
   compiled2 as compiled,
   harnessesUnsupportedInSrt2 as harnessesUnsupportedInSrt,

package/dist/{chunk-11p4wf6n.js → chunk-xgwjcq4z.js}

@@ -195,11 +195,11 @@ import {
   toEncoded,
   decodeUnknownEffect,
   SchemaError,
-  make18,
+  make17,
   String4,
   toCodecStringTree,
   encodeUnknownJsonStringSync
-} from "./chunk-mbctzx7e.js";
+} from "./chunk-61k67vxh.js";
 
 // node_modules/.bun/effect@4.1.2/node_modules/effect/dist/Iterable.js
 var headUnsafe = (self) => {
@@ -3438,7 +3438,7 @@ var toConfigCursorAST = /* @__PURE__ */ memoize((root) => {
 function schema(codec, path) {
   const codecStringTree = toCodecStringTree(codec);
   const encodedAst = toEncoded(codecStringTree.ast);
-  const decodeCursor = decodeUnknownEffect(make18(toConfigCursorAST(codecStringTree.ast)));
+  const decodeCursor = decodeUnknownEffect(make17(toConfigCursorAST(codecStringTree.ast)));
   const localPath = typeof path === "string" ? [path] : path ?? [];
   return make14((provider, pathPrefix) => {
     const fullPath = [...pathPrefix, ...localPath];

package/dist/egress-proxy.ts

@@ -1,6 +1,6 @@
 // Runs alone inside the egress proxy container, so it imports nothing outside Node.
 import { once } from 'node:events'
-import { connect, createServer, type Server, type Socket } from 'node:net'
+import { connect, createServer, type LookupFunction, type Server, type Socket } from 'node:net'
 
 /** Whether the allowlist takes `host:port`: an entry `host` takes any port, `host:port` one, `*.domain` subdomains. */
 export const egressAllowed = (hosts: readonly string[], host: string, port: number) => {
@@ -39,7 +39,93 @@ const httpTarget = (absolute: string) => {
 
 const answer = (socket: Socket, status: string) => socket.end(`HTTP/1.1 ${status}\r\nContent-Length: 0\r\n\r\n`)
 
-const handle = (hosts: readonly string[]) => (client: Socket) => {
+/** Takes the next bytes a client sends: how many of them belong to the request body, and whether the body has ended. */
+type BodyFraming = (chunk: Buffer) => { readonly used: number; readonly done: boolean } | 'malformed'
+
+const countedBody = (length: number): BodyFraming => {
+  let remaining = length
+
+  return chunk => {
+    const used = Math.min(remaining, chunk.length)
+    remaining -= used
+
+    return { used, done: remaining === 0 }
+  }
+}
+
+const chunkedBody = (): BodyFraming => {
+  let state: 'size' | 'data' | 'trailer' | 'done' = 'size'
+  let line = ''
+  // The chunk's data and the CRLF after it.
+  let remaining = 0
+
+  return chunk => {
+    let index = 0
+
+    while (index < chunk.length && state !== 'done') {
+      if (state === 'data') {
+        const used = Math.min(remaining, chunk.length - index)
+        index += used
+        remaining -= used
+
+        if (remaining === 0) state = 'size'
+
+        continue
+      }
+
+      const byte = chunk[index++]
+
+      if (byte !== 0x0a) {
+        line += String.fromCharCode(byte ?? 0)
+
+        if (line.length > 4_096) return 'malformed'
+
+        continue
+      }
+
+      const content = line.trim()
+      line = ''
+
+      if (state === 'trailer') {
+        if (content === '') state = 'done'
+        continue
+      }
+
+      const hex = content.split(';')[0]?.trim() ?? ''
+
+      if (!/^[0-9a-f]+$/i.test(hex)) return 'malformed'
+
+      const size = Number.parseInt(hex, 16)
+
+      if (size === 0) state = 'trailer'
+      else {
+        remaining = size + 2
+        state = 'data'
+      }
+    }
+
+    return { used: index, done: state === 'done' }
+  }
+}
+
+const requestBody = (headers: readonly string[]): BodyFraming | 'malformed' => {
+  const value = (name: string) =>
+    headers.flatMap(line => (line.toLowerCase().startsWith(`${name}:`) ? [line.slice(name.length + 1).trim()] : []))
+
+  const transferEncoding = value('transfer-encoding').join(',').toLowerCase()
+
+  if (transferEncoding !== '') return /(^|,)\s*chunked\s*$/.test(transferEncoding) ? chunkedBody() : 'malformed'
+
+  const lengths = [...new Set(value('content-length'))]
+
+  if (lengths.length === 0) return countedBody(0)
+
+  const [length = ''] = lengths
+
+  return lengths.length === 1 && /^\d+$/.test(length) ? countedBody(Number(length)) : 'malformed'
+}
+
+const handle = (hosts: readonly string[], lookup: LookupFunction | undefined) => (client: Socket) => {
   let head = Buffer.alloc(0)
 
   const onData = (chunk: Buffer) => {
@@ -48,6 +134,8 @@ const handle = (hosts: readonly string[]) => (client: Socket) => {
 
     if (end === -1) return head.length > 16_384 ? answer(client, '431 Request Header Fields Too Large') : undefined
     client.off('data', onData)
+    // What a pipelining client sends next arrives while the proxy connects, and a flowing socket would drop it.
+    client.pause()
 
     const [requestLine = '', ...headers] = head.subarray(0, end).toString().split('\r\n')
     const [method = '', target = '', version = 'HTTP/1.1'] = requestLine.split(' ')
@@ -57,30 +145,57 @@ const handle = (hosts: readonly string[]) => (client: Socket) => {
 
     if (!egressAllowed(hosts, destination.host, destination.port)) return answer(client, '403 Forbidden')
 
-    const upstream = connect(destination.port, destination.host, () => {
-      if (!('path' in destination)) {
-        client.write('HTTP/1.1 200 Connection Established\r\n\r\n')
-        upstream.write(head.subarray(end + 4))
-      } else {
-        // One request per connection: a reused one could carry a request for another host to this one.
+    const framing = 'path' in destination ? requestBody(headers) : undefined
+
+    if (framing === 'malformed') return answer(client, '400 Bad Request')
+
+    const request = 'path' in destination && framing !== undefined ? { path: destination.path, framing } : undefined
+
+    const upstream = connect(
+      { port: destination.port, host: destination.host, ...(lookup === undefined ? undefined : { lookup }) },
+      () => {
+        if (request === undefined) {
+          client.write('HTTP/1.1 200 Connection Established\r\n\r\n')
+          upstream.write(head.subarray(end + 4))
+          client.pipe(upstream)
+          upstream.pipe(client)
+          client.resume()
+
+          return
+        }
+
+        // One request per connection, and the client's connection ends with its response: a reused one could
+        // carry a request for another host to this one, and a pipelined one would mismatch the answers.
         const kept = headers.filter(line => !/^(proxy-)?connection:/i.test(line))
+        upstream.write([[method, request.path, version].join(' '), ...kept, 'Connection: close', '', ''].join('\r\n'))
 
-        upstream.write(
-          Buffer.concat([
-            Buffer.from(
-              [[method, destination.path, version].join(' '), ...kept, 'Connection: close', '', ''].join('\r\n')
-            ),
-            head.subarray(end + 4)
-          ])
-        )
-      }
+        let bodyDone = false
 
-      client.pipe(upstream)
-      upstream.pipe(client)
-    })
+        const forward = (chunk: Buffer) => {
+          if (bodyDone) return
+
+          const framed = request.framing(chunk)
+
+          if (framed === 'malformed') return client.destroy()
+
+          bodyDone = framed.done
+
+          if (upstream.write(chunk.subarray(0, framed.used))) return
+          client.pause()
+          upstream.once('drain', () => client.resume())
+        }
+
+        // Pipelined requests after the body are dropped; the client sends them again on a new connection.
+        client.on('data', forward)
+        upstream.pipe(client)
+        client.resume()
+        forward(head.subarray(end + 4))
+      }
+    )
 
     upstream.on('error', () => (client.writable ? answer(client, '502 Bad Gateway') : client.destroy()))
     client.on('error', () => upstream.destroy())
+    client.on('close', () => upstream.destroy())
   }
 
   client.on('data', onData)
@@ -92,8 +207,10 @@ export const startEgressProxy = (input: {
   readonly hosts: readonly string[]
   readonly port: number
   readonly hostname: string
+  /** How it resolves a host, if not as the system does. */
+  readonly lookup?: LookupFunction
 }): Promise<Server> => {
-  const server = createServer(handle(input.hosts)).listen(input.port, input.hostname)
+  const server = createServer(handle(input.hosts, input.lookup)).listen(input.port, input.hostname)
 
   return once(server, 'listening').then(() => server)
 }

package/dist/half-close-relay.ts

@@ -0,0 +1,125 @@
+// Runs alone inside a pipeline check's sandbox too, so it imports nothing outside Node.
+import { once } from 'node:events'
+import { connect, createServer, type Server, type Socket } from 'node:net'
+
+/**
+ * srt's proxy closes a connection once its client stops sending, and a Docker client attached to a job stops before
+ * the job prints anything. So the encoder inside the sandbox never stops sending: it sends what its client sends as
+ * frames, each a 4-byte big-endian length and that many bytes, and the client's end as a frame of length 0. The
+ * decoder outside the sandbox turns that frame back into the end of what it sends on.
+ */
+const frameHeader = 4
+
+const frame = (chunk: Buffer) => {
+  const header = Buffer.alloc(frameHeader)
+
+  header.writeUInt32BE(chunk.length)
+
+  return Buffer.concat([header, chunk])
+}
+
+const endOfInput = Buffer.alloc(frameHeader)
+
+/** Far more than the one socket chunk the encoder frames; a longer frame is not the encoder's. */
+export const maxFrame = 1024 * 1024
+
+/** Holds `from` until `to` has caught up, when a write to `to` was `accepted` only into its buffer. */
+const keepUp = (from: Socket, to: Socket, accepted: boolean) => {
+  if (accepted) return
+  from.pause()
+  to.once('drain', () => from.resume())
+}
+
+/** Ends each of `sockets` once another has closed, after what it holds is sent, and destroys them all if one fails. */
+const closeTogether = (...sockets: readonly Socket[]) =>
+  sockets.forEach(socket => {
+    socket.on('error', () => sockets.forEach(other => other.destroy()))
+    socket.on('close', () => sockets.forEach(other => other.end()))
+  })
+
+const listening = (server: Server, port: number) =>
+  once(server.listen(port, '127.0.0.1'), 'listening').then(() => server)
+
+/** Serves `port` outside the sandbox, sending each connection's frames on to `127.0.0.1:<targetPort>`. */
+export const startHalfCloseDecoder = (input: { readonly port: number; readonly targetPort: number }) =>
+  listening(
+    createServer({ allowHalfOpen: true }, client => {
+      const upstream = connect({ port: input.targetPort, host: '127.0.0.1', allowHalfOpen: true })
+      let pending: Buffer = Buffer.alloc(0)
+
+      client.on('data', (chunk: Buffer) => {
+        pending = Buffer.concat([pending, chunk])
+
+        if (pending.length >= frameHeader && pending.readUInt32BE(0) > maxFrame) return void client.destroy()
+
+        while (pending.length >= frameHeader && pending.length >= frameHeader + pending.readUInt32BE(0)) {
+          const length = pending.readUInt32BE(0)
+
+          if (length === 0) upstream.end()
+          else keepUp(client, upstream, upstream.write(pending.subarray(frameHeader, frameHeader + length)))
+          pending = pending.subarray(frameHeader + length)
+        }
+      })
+      client.on('end', () => upstream.end())
+      upstream.pipe(client)
+      closeTogether(client, upstream)
+    }),
+    input.port
+  )
+
+/** `host` as `net.connect` takes it: a URL writes an IPv6 address in brackets. */
+const unbracketed = (host: string) => host.replace(/^\[(.*)\]$/, '$1')
+
+/**
+ * Serves `port` inside the sandbox, sending each connection through `proxy` to the decoder on the Runner's
+ * `127.0.0.1:<targetPort>`, as frames.
+ */
+export const startHalfCloseEncoder = (input: {
+  readonly port: number
+  readonly proxy: string
+  readonly targetPort: number
+}) => {
+  const proxy = new URL(input.proxy)
+  const target = `127.0.0.1:${input.targetPort}`
+
+  const credential =
+    proxy.username === ''
+      ? ''
+      : `Proxy-Authorization: Basic ${Buffer.from(`${decodeURIComponent(proxy.username)}:${decodeURIComponent(proxy.password)}`).toString('base64')}\r\n`
+
+  return listening(
+    createServer({ allowHalfOpen: true }, client => {
+      client.pause()
+      const upstream = connect({ port: Number(proxy.port === '' ? 80 : proxy.port), host: unbracketed(proxy.hostname) })
+      let head = Buffer.alloc(0)
+
+      const onHead = (chunk: Buffer) => {
+        head = Buffer.concat([head, chunk])
+        const end = head.indexOf('\r\n\r\n')
+
+        if (end === -1) return
+        upstream.off('data', onHead)
+
+        if (!/^HTTP\/1\.[01] 200/.test(head.toString('latin1', 0, end))) return void upstream.destroy()
+        client.write(head.subarray(end + 4))
+        upstream.pipe(client)
+        client.on('data', (chunk: Buffer) => keepUp(client, upstream, upstream.write(frame(chunk))))
+        client.on('end', () => upstream.write(endOfInput))
+        client.resume()
+      }
+
+      upstream.on('data', onHead)
+      upstream.write(`CONNECT ${target} HTTP/1.1\r\nHost: ${target}\r\n${credential}\r\n`)
+      closeTogether(client, upstream)
+    }),
+    input.port
+  )
+}
+
+// `bun half-close-relay.ts <port> <proxy URL> <decoder port>`, inside srt.
+if (import.meta.main)
+  await startHalfCloseEncoder({
+    port: Number(Bun.argv[2]),
+    proxy: Bun.argv[3] ?? '',
+    targetPort: Number(Bun.argv[4])
+  })

package/dist/index.js

@@ -5,15 +5,15 @@
 var args = process.argv.slice(2);
 if (args[0] === "srt") {
   process.argv.splice(2, 1);
-  const { runSrtCli } = await import("./chunk-b6thzgc9.js");
+  const { runSrtCli } = await import("./chunk-wczs5vrq.js");
   await runSrtCli();
 } else if (args[0] === "srt-step") {
-  const { runSrtStep } = await import("./chunk-mej2bx5n.js");
+  const { runSrtStep } = await import("./chunk-99ver3za.js");
   await runSrtStep(args.slice(1));
 } else if (args[0] === "opencode-read") {
-  const { runOpencodeReader } = await import("./chunk-6vns3ej0.js");
+  const { runOpencodeReader } = await import("./chunk-rjfxnk05.js");
   runOpencodeReader();
 } else {
-  const { runCli } = await import("./chunk-v290mf51.js");
+  const { runCli } = await import("./chunk-dj7pp4w4.js");
   runCli(args);
 }

package/dist/tcp-forwarder.ts

@@ -0,0 +1,29 @@
+// Runs alone inside a check Docker daemon's API forwarder container, so it imports nothing outside Node.
+import { once } from 'node:events'
+import { connect, createServer, type Server } from 'node:net'
+
+/** Forwards each connection to `port` on to `target:targetPort`, and only there. */
+export const startTcpForwarder = (input: {
+  readonly port: number
+  readonly target: string
+  readonly targetPort: number
+}): Promise<Server> => {
+  // A Docker client attached to a container stops sending long before the container's output ends.
+  const server = createServer({ allowHalfOpen: true }, client => {
+    const upstream = connect({ port: input.targetPort, host: input.target, allowHalfOpen: true })
+
+    client.pipe(upstream)
+    upstream.pipe(client)
+    client.on('error', () => upstream.destroy())
+    upstream.on('error', () => client.destroy())
+  }).listen(input.port, '0.0.0.0')
+
+  return once(server, 'listening').then(() => server)
+}
+
+if (import.meta.main)
+  await startTcpForwarder({
+    port: Number(Bun.argv[2]),
+    target: Bun.argv[3] ?? '',
+    targetPort: Number(Bun.argv[4])
+  })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kitman-sh/cli",
-  "version": "0.10.53",
+  "version": "0.10.55",
   "type": "module",
   "license": "UNLICENSED",
   "bin": {

package/dist/chunk-1mc9vgcr.js

@@ -1,39 +0,0 @@
-// @bun
-import {
-  isString
-} from "./chunk-arvwar2c.js";
-
-// packages/core/src/question-recommendation.ts
-var optionValue = (option) => isString(option) ? option : option.value;
-var splitQuestionOptions = (options) => {
-  const descriptions = Object.fromEntries(options.flatMap((option) => isString(option) || option.description === undefined || option.description.trim() === "" ? [] : [[option.value, option.description]]));
-  return {
-    options: options.map(optionValue),
-    ...Object.keys(descriptions).length === 0 ? undefined : { optionDescriptions: descriptions }
-  };
-};
-var recommendationProblem = (question) => {
-  const options = question.options?.map(optionValue);
-  const reason = question.recommendationReason?.trim() ?? "";
-  const recommended = question.recommended?.trim() ?? "";
-  if (question.informationOnly === true) {
-    if (options !== undefined)
-      return "A Question with options always has one to recommend: set `recommended` to one of them, and drop `informationOnly`.";
-    if (recommended !== "")
-      return "A Question that recommends an answer is not `informationOnly`: drop `informationOnly`.";
-    return reason === "" ? "Say in `recommendationReason` why you cannot suggest an answer, such as that only the person knows the secret\u2019s name." : undefined;
-  }
-  if (recommended === "")
-    return `Add \`recommended\`: the answer you would pick${options === undefined ? ", as a suggested free-text answer" : `, one of: ${options.join(", ")}`}. Add \`recommendationReason\` too, in one or two sentences. Only a Question that purely asks for information you cannot guess, such as a secret's name, may set \`informationOnly\` instead and say why in \`recommendationReason\`.`;
-  if (options !== undefined && !options.includes(question.recommended ?? ""))
-    return `The recommended answer "${question.recommended}" is not one of the options: ${options.join(", ")}.`;
-  return reason === "" ? "Add `recommendationReason`: why you recommend that answer, in one or two sentences." : undefined;
-};
-var questionAdvice = (question) => ({
-  ...question.optionDescriptions === undefined ? undefined : { optionDescriptions: question.optionDescriptions },
-  ...question.recommended === undefined ? undefined : { recommended: question.recommended },
-  ...question.recommendationReason === undefined ? undefined : { recommendationReason: question.recommendationReason },
-  ...question.informationOnly === true ? { informationOnly: true } : undefined
-});
-
-export { splitQuestionOptions, recommendationProblem, questionAdvice };