@lobu/connector-worker 6.0.1

package/dist/executor/runtime.js

@@ -0,0 +1,82 @@
+import { SubprocessExecutor } from './subprocess.js';
+function mergeExecutionEnv(env, connectionCredentials) {
+    return {
+        ...(env ?? {}),
+        ...(connectionCredentials ?? {}),
+    };
+}
+function mergeExecutionSessionState(sessionState, credentials) {
+    if (!sessionState && !credentials)
+        return null;
+    return {
+        ...(sessionState ?? {}),
+        ...(credentials ? { oauth: credentials } : {}),
+    };
+}
+function buildConnectorExecutionContext(params) {
+    const env = mergeExecutionEnv(params.env, params.connectionCredentials);
+    const sessionState = mergeExecutionSessionState(params.sessionState, params.credentials);
+    if (params.mode === 'action') {
+        return {
+            options: {
+                __action_key: params.actionKey,
+                __action_input: params.actionInput ?? {},
+                ...(params.actionInput ?? {}),
+            },
+            checkpoint: (params.checkpoint ?? null),
+            env,
+            sessionState,
+            apiType: params.apiType ?? 'api',
+        };
+    }
+    if (params.mode === 'authenticate') {
+        return {
+            options: {
+                __auth_mode: true,
+                __auth_config: params.config ?? {},
+                __auth_previous_credentials: params.previousCredentials ?? null,
+            },
+            checkpoint: null,
+            env,
+            sessionState,
+            apiType: params.apiType ?? 'api',
+        };
+    }
+    return {
+        options: {
+            ...(params.config ?? {}),
+            __feed_key: params.feedKey,
+            __entity_ids: params.entityIds ?? [],
+        },
+        checkpoint: (params.checkpoint ?? null),
+        env,
+        sessionState,
+        apiType: params.apiType ?? 'api',
+    };
+}
+export async function executeCompiledConnector(params) {
+    const executor = params.executor ?? new SubprocessExecutor();
+    const context = buildConnectorExecutionContext(params);
+    return executor.execute(params.compiledCode, context, params.hooks);
+}
+export function normalizeEventEnvelope(event) {
+    const originType = event.origin_type;
+    const rawDate = event.occurred_at ?? event.published_at;
+    return {
+        origin_id: event.origin_id ?? event.external_id,
+        payload_text: event.payload_text ?? event.content ?? '',
+        title: event.title,
+        author_name: event.author_name ?? event.author,
+        source_url: event.source_url ?? event.url ?? '',
+        occurred_at: rawDate ? new Date(rawDate) : new Date(),
+        origin_type: originType,
+        semantic_type: event.semantic_type ?? originType,
+        score: typeof event.score === 'number' ? event.score : 0,
+        origin_parent_id: event.origin_parent_id ?? event.parent_external_id ?? null,
+        metadata: event.metadata ?? {},
+    };
+}
+export function getActionOutput(result) {
+    return (result.contents[0]?.metadata ?? {});
+}
+//# sourceMappingURL=runtime.js.map

package/dist/executor/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/executor/runtime.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAiDrD,SAAS,iBAAiB,CACxB,GAAwC,EACxC,qBAAiE;IAEjE,OAAO;QACL,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;QACd,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CACjC,YAAkC,EAClC,WAA8C;IAE9C,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAE/C,OAAO;QACL,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;QACvB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/C,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CAAC,MAAgC;IACtE,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACxE,MAAM,YAAY,GAAG,0BAA0B,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAEzF,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO;YACL,OAAO,EAAE;gBACP,YAAY,EAAE,MAAM,CAAC,SAAS;gBAC9B,cAAc,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE;gBACxC,GAAI,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAA6B;aAC5C;YAChB,UAAU,EAAE,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,CAAsB;YAC5D,GAAG;YACH,YAAY;YACZ,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,KAAK;SACjC,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACnC,OAAO;YACL,OAAO,EAAE;gBACP,WAAW,EAAE,IAAI;gBACjB,aAAa,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;gBAClC,2BAA2B,EAAE,MAAM,CAAC,mBAAmB,IAAI,IAAI;aACjD;YAChB,UAAU,EAAE,IAAI;YAChB,GAAG;YACH,YAAY;YACZ,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,KAAK;SACjC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE;YACP,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;YACxB,UAAU,EAAE,MAAM,CAAC,OAAO;YAC1B,YAAY,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE;SACtB;QAChB,UAAU,EAAE,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,CAAsB;QAC5D,GAAG;QACH,YAAY;QACZ,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,KAAK;KACjC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAgC;IAEhC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,IAAI,kBAAkB,EAAE,CAAC;IAC7D,MAAM,OAAO,GAAG,8BAA8B,CAAC,MAAM,CAAC,CAAC;IACvD,OAAO,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAA0B;IAC/D,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,YAAY,CAAC;IACxD,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,WAAW;QAC/C,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,OAAO,IAAI,EAAE;QACvD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM;QAC9C,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,GAAG,IAAI,EAAE;QAC/C,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE;QACrD,WAAW,EAAE,UAAU;QACvB,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,UAAU;QAChD,KAAK,EAAE,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,kBAAkB,IAAI,IAAI;QAC5E,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAsB;IACpD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,IAAI,EAAE,CAA4B,CAAC;AACzE,CAAC"}

package/dist/executor/subprocess.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Subprocess Executor
+ *
+ * Executes compiled connector code in a forked child process.
+ * Provides process isolation between the worker and connector code.
+ * This is not a hardened security sandbox.
+ */
+import type { ExecutionHooks, FeedSyncResult, SyncContext, SyncExecutor } from './interface.js';
+/**
+ * exit_reason values surfaced to the runs table:
+ *  - ok: successful 'result' IPC.
+ *  - error_message: child sent {type:'error',...} via IPC.
+ *  - timeout: parent killed the child with SIGKILL after timeoutMs.
+ *  - oom: code !== 0 and output tail mentions a JS heap OOM.
+ *  - crash: any other non-zero exit / unexpected signal.
+ */
+export type SubprocessExitReason = 'ok' | 'error_message' | 'timeout' | 'oom' | 'crash';
+/** Diagnostic fields attached to errors thrown by the executor. */
+export interface SubprocessDiagnostics {
+    exitCode: number | null;
+    exitSignal: string | null;
+    outputTail: string;
+    exitReason: SubprocessExitReason;
+}
+export declare class SubprocessError extends Error implements SubprocessDiagnostics {
+    exitCode: number | null;
+    exitSignal: string | null;
+    outputTail: string;
+    exitReason: SubprocessExitReason;
+    constructor(message: string, diagnostics: SubprocessDiagnostics, options?: {
+        cause?: unknown;
+    });
+}
+interface SubprocessExecutorOptions {
+    /** Maximum execution time in ms (default: 600000 = 10 minutes) */
+    timeoutMs: number;
+    /** Max old space size for the child process in MB (default: 512) */
+    maxOldSpaceSize: number;
+}
+export declare class SubprocessExecutor implements SyncExecutor {
+    private options;
+    constructor(options?: Partial<SubprocessExecutorOptions>);
+    execute(compiledCode: string, context: SyncContext, hooks?: ExecutionHooks): Promise<FeedSyncResult>;
+}
+export {};
+//# sourceMappingURL=subprocess.d.ts.map

package/dist/executor/subprocess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subprocess.d.ts","sourceRoot":"","sources":["../../src/executor/subprocess.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAGhG;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG,IAAI,GAAG,eAAe,GAAG,SAAS,GAAG,KAAK,GAAG,OAAO,CAAC;AAExF,mEAAmE;AACnE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,oBAAoB,CAAC;CAClC;AAED,qBAAa,eAAgB,SAAQ,KAAM,YAAW,qBAAqB;IACzE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,oBAAoB,CAAC;gBAG/B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,qBAAqB,EAClC,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAShC;AAqDD,UAAU,yBAAyB;IACjC,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,eAAe,EAAE,MAAM,CAAC;CACzB;AAOD,qBAAa,kBAAmB,YAAW,YAAY;IACrD,OAAO,CAAC,OAAO,CAA4B;gBAE/B,OAAO,CAAC,EAAE,OAAO,CAAC,yBAAyB,CAAC;IAIlD,OAAO,CACX,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,WAAW,EACpB,KAAK,CAAC,EAAE,cAAc,GACrB,OAAO,CAAC,cAAc,CAAC;CAuT3B"}

package/dist/executor/subprocess.js

@@ -0,0 +1,378 @@
+/**
+ * Subprocess Executor
+ *
+ * Executes compiled connector code in a forked child process.
+ * Provides process isolation between the worker and connector code.
+ * This is not a hardened security sandbox.
+ */
+import { fork } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { StreamRedactor, redactOutput } from './redact.js';
+export class SubprocessError extends Error {
+    exitCode;
+    exitSignal;
+    outputTail;
+    exitReason;
+    constructor(message, diagnostics, options) {
+        super(message, options);
+        this.name = 'SubprocessError';
+        this.exitCode = diagnostics.exitCode;
+        this.exitSignal = diagnostics.exitSignal;
+        this.outputTail = diagnostics.outputTail;
+        this.exitReason = diagnostics.exitReason;
+    }
+}
+/** Per-stream ring buffer that preserves the most recent bytes. */
+class RingBuffer {
+    cap;
+    chunks = [];
+    size = 0;
+    constructor(cap) {
+        this.cap = cap;
+    }
+    append(chunk) {
+        if (!chunk)
+            return;
+        this.chunks.push(chunk);
+        this.size += chunk.length;
+        while (this.size > this.cap && this.chunks.length > 0) {
+            const front = this.chunks[0];
+            const overflow = this.size - this.cap;
+            if (front.length <= overflow) {
+                this.size -= front.length;
+                this.chunks.shift();
+            }
+            else {
+                this.chunks[0] = front.slice(overflow);
+                this.size -= overflow;
+            }
+        }
+    }
+    toString() {
+        return this.chunks.join('');
+    }
+}
+const STREAM_TAIL_CAP_BYTES = 16 * 1024;
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+/** Only pass system env vars that child processes need for module resolution and basic operation. */
+const SYSTEM_ENV_KEYS = [
+    'PATH',
+    'HOME',
+    'TMPDIR',
+    'TZ',
+    'NODE_ENV',
+    'NODE_PATH',
+    'PLAYWRIGHT_BROWSERS_PATH',
+];
+function pickSystemEnv() {
+    const env = {};
+    for (const key of SYSTEM_ENV_KEYS) {
+        if (process.env[key])
+            env[key] = process.env[key];
+    }
+    return env;
+}
+const DEFAULT_OPTIONS = {
+    timeoutMs: 600000,
+    maxOldSpaceSize: 512,
+};
+export class SubprocessExecutor {
+    options;
+    constructor(options) {
+        this.options = { ...DEFAULT_OPTIONS, ...options };
+    }
+    async execute(compiledCode, context, hooks) {
+        return new Promise((resolve, reject) => {
+            let childRunnerPath = join(__dirname, 'child-runner.js');
+            const childRunnerTsPath = join(__dirname, 'child-runner.ts');
+            const execArgv = [`--max-old-space-size=${this.options.maxOldSpaceSize}`];
+            const isBun = typeof process.versions.bun === 'string';
+            if (!existsSync(childRunnerPath) && existsSync(childRunnerTsPath)) {
+                childRunnerPath = childRunnerTsPath;
+                // Bun runs .ts natively. Loading tsx as an ESM hook on Bun fails
+                // with "Cannot find module './cjs/index.cjs' from ''" because tsx's
+                // loader.mjs invokes module.register('./cjs/index.cjs') with a parent
+                // URL that Bun's resolver treats as empty. Skip --import tsx on Bun.
+                if (!isBun)
+                    execArgv.unshift('--import', 'tsx');
+            }
+            // Node subprocess execution is process isolation, not a security sandbox.
+            // Keep permission flags disabled unless the connector runtime is made compatible.
+            try {
+                const nodeVersion = parseInt(process.versions.node.split('.')[0], 10);
+                if (nodeVersion >= 20) {
+                    // Uncomment only when the connector runtime is compatible with Node permissions:
+                    // execArgv.push('--experimental-permission');
+                    // execArgv.push(`--allow-fs-read=/tmp/*,${__dirname}/*`);
+                    // execArgv.push('--allow-fs-write=/tmp/*');
+                }
+            }
+            catch {
+                // Ignore - permissions are best-effort
+            }
+            const child = fork(childRunnerPath, [], {
+                stdio: ['pipe', 'pipe', 'pipe', 'ipc'],
+                execArgv,
+                env: { ...pickSystemEnv(), ...context.env },
+            });
+            let resolved = false;
+            let terminalMessageReceived = false;
+            let timedOut = false;
+            let latestCheckpoint = context.checkpoint;
+            let finalMetadata;
+            let finalAuthUpdate;
+            let finalAuthResult;
+            const collectedContents = [];
+            const collectContents = hooks?.collectContents !== false;
+            let processingChain = Promise.resolve();
+            // Per-stream ring buffers — preserve the *tail* (most recent bytes),
+            // which is where the failure cause lands. Cap each at 16 KiB so a
+            // chatty connector can't grow the worker's memory.
+            const stdoutTail = new RingBuffer(STREAM_TAIL_CAP_BYTES);
+            const stderrTail = new RingBuffer(STREAM_TAIL_CAP_BYTES);
+            // Set timeout - kill child if it takes too long. timeoutMs <= 0 disables
+            // the timer (used for interactive auth runs that wait on human input).
+            const timeout = this.options.timeoutMs > 0
+                ? setTimeout(() => {
+                    if (!resolved) {
+                        console.error(`[SubprocessExecutor] Killing child process after ${this.options.timeoutMs}ms timeout`);
+                        timedOut = true;
+                        child.kill('SIGKILL');
+                    }
+                }, this.options.timeoutMs)
+                : null;
+            const cleanup = () => {
+                if (timeout)
+                    clearTimeout(timeout);
+                child.removeListener('message', onMessage);
+                child.removeListener('error', onError);
+                child.removeListener('exit', onExit);
+                child.stdout?.removeListener('data', onStdout);
+                child.stderr?.removeListener('data', onStderr);
+                // Flush any trailing partial line from each stream so the live tee
+                // matches what the persisted tail saw.
+                stdoutRedactor.flush((clean) => process.stdout.write(`[subprocess] ${clean}`));
+                stderrRedactor.flush((clean) => process.stderr.write(`[subprocess] ${clean}`));
+            };
+            const settle = (fn) => {
+                if (!resolved) {
+                    resolved = true;
+                    cleanup();
+                    fn();
+                }
+            };
+            const queueTask = (task) => {
+                processingChain = processingChain.then(async () => {
+                    await task();
+                });
+                processingChain.catch((err) => {
+                    settle(() => {
+                        child.kill('SIGKILL');
+                        reject(err instanceof Error ? err : new Error(String(err)));
+                    });
+                });
+            };
+            const combinedTail = () => {
+                const out = stdoutTail.toString();
+                const err = stderrTail.toString();
+                if (!out && !err)
+                    return '';
+                if (!out)
+                    return `[stderr]\n${err}`;
+                if (!err)
+                    return `[stdout]\n${out}`;
+                return `[stdout]\n${out}\n[stderr]\n${err}`;
+            };
+            const computeExitReason = (tail) => {
+                if (timedOut)
+                    return 'timeout';
+                if (/javascript heap out of memory/i.test(tail))
+                    return 'oom';
+                return 'crash';
+            };
+            // Handle messages from child
+            const onMessage = (msg) => {
+                if (msg.type === 'content_chunk') {
+                    const items = Array.isArray(msg.items) ? msg.items : [];
+                    queueTask(async () => {
+                        if (collectContents) {
+                            collectedContents.push(...items);
+                        }
+                        await hooks?.onContentChunk?.(items);
+                    });
+                    return;
+                }
+                if (msg.type === 'checkpoint_update') {
+                    latestCheckpoint = msg.checkpoint ?? null;
+                    queueTask(async () => {
+                        await hooks?.onCheckpointUpdate?.(latestCheckpoint);
+                    });
+                    return;
+                }
+                if (msg.type === 'auth_artifact') {
+                    queueTask(async () => {
+                        await hooks?.onAuthArtifact?.(msg.artifact ?? {});
+                    });
+                    return;
+                }
+                if (msg.type === 'await_signal_request') {
+                    const requestId = msg.requestId;
+                    const name = msg.name;
+                    const timeoutMs = msg.timeoutMs ?? null;
+                    queueTask(async () => {
+                        if (!hooks?.onAwaitAuthSignal) {
+                            try {
+                                child.send({
+                                    type: 'await_signal_response',
+                                    requestId,
+                                    error: 'awaitSignal is not supported in this context',
+                                });
+                            }
+                            catch {
+                                /* ignore */
+                            }
+                            return;
+                        }
+                        try {
+                            const signal = await hooks.onAwaitAuthSignal(name, {
+                                timeoutMs: timeoutMs ?? undefined,
+                            });
+                            child.send({ type: 'await_signal_response', requestId, signal });
+                        }
+                        catch (err) {
+                            child.send({
+                                type: 'await_signal_response',
+                                requestId,
+                                error: err instanceof Error ? err.message : String(err),
+                            });
+                        }
+                    });
+                    return;
+                }
+                if (msg.type === 'result') {
+                    terminalMessageReceived = true;
+                    const result = msg.result;
+                    queueTask(async () => {
+                        finalMetadata = result.metadata;
+                        finalAuthUpdate = result.auth_update;
+                        finalAuthResult = result.auth_result;
+                        latestCheckpoint = result.checkpoint;
+                        if (Array.isArray(result.contents) && result.contents.length > 0) {
+                            if (collectContents) {
+                                collectedContents.push(...result.contents);
+                            }
+                            await hooks?.onContentChunk?.(result.contents);
+                        }
+                        settle(() => resolve({
+                            contents: collectedContents,
+                            checkpoint: latestCheckpoint,
+                            metadata: finalMetadata,
+                            auth_update: finalAuthUpdate,
+                            auth_result: finalAuthResult,
+                        }));
+                    });
+                    return;
+                }
+                if (msg.type === 'error') {
+                    terminalMessageReceived = true;
+                    const tail = redactOutput(combinedTail());
+                    const diagnostics = {
+                        exitCode: null,
+                        exitSignal: null,
+                        outputTail: tail,
+                        exitReason: 'error_message',
+                    };
+                    // Connector code is allowed to throw with the offending value
+                    // embedded — `throw new Error('failed with api_key=sk_live_…')`.
+                    // Redact the message and stack the same way the persisted tail
+                    // is redacted so secrets don't leak through the error path
+                    // (which is also written to gateway logs by upstream callers).
+                    const rawMessage = msg.error?.message ?? 'Subprocess reported error';
+                    const error = new SubprocessError(redactOutput(rawMessage), diagnostics);
+                    error.name = msg.error?.name ?? 'SubprocessError';
+                    if (msg.error?.stack)
+                        error.stack = redactOutput(msg.error.stack);
+                    settle(() => reject(error));
+                    return;
+                }
+            };
+            // Handle child errors
+            const onError = (err) => {
+                const tail = redactOutput(combinedTail());
+                const diagnostics = {
+                    exitCode: null,
+                    exitSignal: null,
+                    outputTail: tail,
+                    exitReason: 'crash',
+                };
+                const wrapped = new SubprocessError(`Subprocess error: ${err.message}`, diagnostics, {
+                    cause: err,
+                });
+                settle(() => reject(wrapped));
+            };
+            // Handle child exit (single handler for both timeout cleanup and unexpected exits)
+            const onExit = (code, signal) => {
+                if (terminalMessageReceived) {
+                    return;
+                }
+                settle(() => {
+                    const tail = redactOutput(combinedTail());
+                    const reason = computeExitReason(tail);
+                    const prefix = reason === 'timeout'
+                        ? `Feed execution timed out after ${this.options.timeoutMs}ms`
+                        : reason === 'oom'
+                            ? `Subprocess out of memory (code ${code}, signal ${signal})`
+                            : `Subprocess exited with code ${code}, signal ${signal}`;
+                    const message = tail ? `${prefix}\n${tail}` : prefix;
+                    const diagnostics = {
+                        exitCode: code,
+                        exitSignal: signal,
+                        outputTail: tail,
+                        exitReason: reason,
+                    };
+                    reject(new SubprocessError(message, diagnostics));
+                });
+            };
+            // Forward child stdout to parent stdout for live tailing AND tap into
+            // the ring buffer so we can surface the tail on failure. Without this
+            // listener, stdio: 'pipe' fills the OS pipe buffer (~16-64 KB) and the
+            // child blocks on its next console.log until SIGKILL.
+            // Stream redactors buffer up to the last newline so secrets split
+            // across chunk boundaries still match. Persisted tails already
+            // redact the full ring-buffer string and are unaffected.
+            const stdoutRedactor = new StreamRedactor();
+            const stderrRedactor = new StreamRedactor();
+            const onStdout = (data) => {
+                const text = data.toString();
+                stdoutTail.append(text);
+                stdoutRedactor.process(text, (clean) => process.stdout.write(`[subprocess] ${clean}`));
+            };
+            // Forward child stderr to parent stderr for logging + ring buffer.
+            const onStderr = (data) => {
+                const text = data.toString();
+                stderrTail.append(text);
+                stderrRedactor.process(text, (clean) => process.stderr.write(`[subprocess] ${clean}`));
+            };
+            child.on('message', onMessage);
+            child.on('error', onError);
+            child.on('exit', onExit);
+            child.stdout?.on('data', onStdout);
+            child.stderr?.on('data', onStderr);
+            // Send the compiled code and context to the child
+            child.send({
+                compiledCode,
+                context: {
+                    options: context.options,
+                    checkpoint: context.checkpoint,
+                    env: context.env,
+                    sessionState: context.sessionState,
+                    apiType: context.apiType,
+                },
+            });
+        });
+    }
+}
+//# sourceMappingURL=subprocess.js.map

package/dist/executor/subprocess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subprocess.js","sourceRoot":"","sources":["../../src/executor/subprocess.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAoB3D,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAgB;IACxB,UAAU,CAAgB;IAC1B,UAAU,CAAS;IACnB,UAAU,CAAuB;IAEjC,YACE,OAAe,EACf,WAAkC,EAClC,OAA6B;QAE7B,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC;QACrC,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC;QACzC,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC;QACzC,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC;IAC3C,CAAC;CACF;AAED,mEAAmE;AACnE,MAAM,UAAU;IAGe;IAFrB,MAAM,GAAa,EAAE,CAAC;IACtB,IAAI,GAAG,CAAC,CAAC;IACjB,YAA6B,GAAW;QAAX,QAAG,GAAH,GAAG,CAAQ;IAAG,CAAC;IAE5C,MAAM,CAAC,KAAa;QAClB,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;QAC1B,OAAO,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC;YACtC,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;gBAC7B,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;gBAC1B,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACvC,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC;CACF;AAED,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AAExC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAEtC,qGAAqG;AACrG,MAAM,eAAe,GAAG;IACtB,MAAM;IACN,MAAM;IACN,QAAQ;IACR,IAAI;IACJ,UAAU;IACV,WAAW;IACX,0BAA0B;CAC3B,CAAC;AACF,SAAS,aAAa;IACpB,MAAM,GAAG,GAAuC,EAAE,CAAC;IACnD,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AASD,MAAM,eAAe,GAA8B;IACjD,SAAS,EAAE,MAAM;IACjB,eAAe,EAAE,GAAG;CACrB,CAAC;AAEF,MAAM,OAAO,kBAAkB;IACrB,OAAO,CAA4B;IAE3C,YAAY,OAA4C;QACtD,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,EAAE,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,OAAO,CACX,YAAoB,EACpB,OAAoB,EACpB,KAAsB;QAEtB,OAAO,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrD,IAAI,eAAe,GAAG,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;YACzD,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;YAE7D,MAAM,QAAQ,GAAG,CAAC,wBAAwB,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;YAC1E,MAAM,KAAK,GAAG,OAAQ,OAAO,CAAC,QAA6B,CAAC,GAAG,KAAK,QAAQ,CAAC;YAC7E,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBAClE,eAAe,GAAG,iBAAiB,CAAC;gBACpC,iEAAiE;gBACjE,oEAAoE;gBACpE,sEAAsE;gBACtE,qEAAqE;gBACrE,IAAI,CAAC,KAAK;oBAAE,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAClD,CAAC;YAED,0EAA0E;YAC1E,kFAAkF;YAClF,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtE,IAAI,WAAW,IAAI,EAAE,EAAE,CAAC;oBACtB,iFAAiF;oBACjF,8CAA8C;oBAC9C,0DAA0D;oBAC1D,4CAA4C;gBAC9C,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,uCAAuC;YACzC,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,EAAE,EAAE,EAAE;gBACtC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC;gBACtC,QAAQ;gBACR,GAAG,EAAE,EAAE,GAAG,aAAa,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAuB;aACjE,CAAC,CAAC;YAEH,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,IAAI,uBAAuB,GAAG,KAAK,CAAC;YACpC,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,IAAI,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;YAC1C,IAAI,aAA8C,CAAC;YACnD,IAAI,eAAgD,CAAC;YACrD,IAAI,eAA0D,CAAC;YAC/D,MAAM,iBAAiB,GAA+B,EAAE,CAAC;YACzD,MAAM,eAAe,GAAG,KAAK,EAAE,eAAe,KAAK,KAAK,CAAC;YACzD,IAAI,eAAe,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;YAExC,qEAAqE;YACrE,kEAAkE;YAClE,mDAAmD;YACnD,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,qBAAqB,CAAC,CAAC;YACzD,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,qBAAqB,CAAC,CAAC;YAEzD,yEAAyE;YACzE,uEAAuE;YACvE,MAAM,OAAO,GACX,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC;gBACxB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE;oBACd,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACd,OAAO,CAAC,KAAK,CACX,oDAAoD,IAAI,CAAC,OAAO,CAAC,SAAS,YAAY,CACvF,CAAC;wBACF,QAAQ,GAAG,IAAI,CAAC;wBAChB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACxB,CAAC;gBACH,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;gBAC5B,CAAC,CAAC,IAAI,CAAC;YAEX,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,IAAI,OAAO;oBAAE,YAAY,CAAC,OAAO,CAAC,CAAC;gBACnC,KAAK,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;gBAC3C,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACvC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACrC,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC/C,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC/C,mEAAmE;gBACnE,uCAAuC;gBACvC,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAC,CAAC;gBAC/E,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAC,CAAC;YACjF,CAAC,CAAC;YAEF,MAAM,MAAM,GAAG,CAAC,EAAc,EAAE,EAAE;gBAChC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,QAAQ,GAAG,IAAI,CAAC;oBAChB,OAAO,EAAE,CAAC;oBACV,EAAE,EAAE,CAAC;gBACP,CAAC;YACH,CAAC,CAAC;YAEF,MAAM,SAAS,GAAG,CAAC,IAAgC,EAAE,EAAE;gBACrD,eAAe,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;oBAChD,MAAM,IAAI,EAAE,CAAC;gBACf,CAAC,CAAC,CAAC;gBACH,eAAe,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBAC5B,MAAM,CAAC,GAAG,EAAE;wBACV,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;wBACtB,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBAC9D,CAAC,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACL,CAAC,CAAC;YAEF,MAAM,YAAY,GAAG,GAAW,EAAE;gBAChC,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC;gBAClC,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC;gBAClC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG;oBAAE,OAAO,EAAE,CAAC;gBAC5B,IAAI,CAAC,GAAG;oBAAE,OAAO,aAAa,GAAG,EAAE,CAAC;gBACpC,IAAI,CAAC,GAAG;oBAAE,OAAO,aAAa,GAAG,EAAE,CAAC;gBACpC,OAAO,aAAa,GAAG,eAAe,GAAG,EAAE,CAAC;YAC9C,CAAC,CAAC;YAEF,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAwB,EAAE;gBAC/D,IAAI,QAAQ;oBAAE,OAAO,SAAS,CAAC;gBAC/B,IAAI,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAC9D,OAAO,OAAO,CAAC;YACjB,CAAC,CAAC;YAEF,6BAA6B;YAC7B,MAAM,SAAS,GAAG,CAAC,GAAQ,EAAE,EAAE;gBAC7B,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;oBACjC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;oBACxD,SAAS,CAAC,KAAK,IAAI,EAAE;wBACnB,IAAI,eAAe,EAAE,CAAC;4BACpB,iBAAiB,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;wBACnC,CAAC;wBACD,MAAM,KAAK,EAAE,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC;oBACvC,CAAC,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBAED,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;oBACrC,gBAAgB,GAAG,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC;oBAC1C,SAAS,CAAC,KAAK,IAAI,EAAE;wBACnB,MAAM,KAAK,EAAE,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,CAAC;oBACtD,CAAC,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBAED,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;oBACjC,SAAS,CAAC,KAAK,IAAI,EAAE;wBACnB,MAAM,KAAK,EAAE,cAAc,EAAE,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;oBACpD,CAAC,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBAED,IAAI,GAAG,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;oBACxC,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;oBAChC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;oBACtB,MAAM,SAAS,GAAkB,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC;oBACvD,SAAS,CAAC,KAAK,IAAI,EAAE;wBACnB,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,CAAC;4BAC9B,IAAI,CAAC;gCACH,KAAK,CAAC,IAAI,CAAC;oCACT,IAAI,EAAE,uBAAuB;oCAC7B,SAAS;oCACT,KAAK,EAAE,8CAA8C;iCACtD,CAAC,CAAC;4BACL,CAAC;4BAAC,MAAM,CAAC;gCACP,YAAY;4BACd,CAAC;4BACD,OAAO;wBACT,CAAC;wBACD,IAAI,CAAC;4BACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE;gCACjD,SAAS,EAAE,SAAS,IAAI,SAAS;6BAClC,CAAC,CAAC;4BACH,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;wBACnE,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,KAAK,CAAC,IAAI,CAAC;gCACT,IAAI,EAAE,uBAAuB;gCAC7B,SAAS;gCACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;6BACxD,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBAED,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC1B,uBAAuB,GAAG,IAAI,CAAC;oBAC/B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAwB,CAAC;oBAC5C,SAAS,CAAC,KAAK,IAAI,EAAE;wBACnB,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC;wBAChC,eAAe,GAAG,MAAM,CAAC,WAAW,CAAC;wBACrC,eAAe,GAAG,MAAM,CAAC,WAAW,CAAC;wBACrC,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC;wBAErC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BACjE,IAAI,eAAe,EAAE,CAAC;gCACpB,iBAAiB,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;4BAC7C,CAAC;4BACD,MAAM,KAAK,EAAE,cAAc,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;wBACjD,CAAC;wBAED,MAAM,CAAC,GAAG,EAAE,CACV,OAAO,CAAC;4BACN,QAAQ,EAAE,iBAAiB;4BAC3B,UAAU,EAAE,gBAAgB;4BAC5B,QAAQ,EAAE,aAAa;4BACvB,WAAW,EAAE,eAAe;4BAC5B,WAAW,EAAE,eAAe;yBAC7B,CAAC,CACH,CAAC;oBACJ,CAAC,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBAED,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBACzB,uBAAuB,GAAG,IAAI,CAAC;oBAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,YAAY,EAAE,CAAC,CAAC;oBAC1C,MAAM,WAAW,GAA0B;wBACzC,QAAQ,EAAE,IAAI;wBACd,UAAU,EAAE,IAAI;wBAChB,UAAU,EAAE,IAAI;wBAChB,UAAU,EAAE,eAAe;qBAC5B,CAAC;oBACF,8DAA8D;oBAC9D,iEAAiE;oBACjE,+DAA+D;oBAC/D,2DAA2D;oBAC3D,+DAA+D;oBAC/D,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,EAAE,OAAO,IAAI,2BAA2B,CAAC;oBACrE,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,CAAC;oBACzE,KAAK,CAAC,IAAI,GAAG,GAAG,CAAC,KAAK,EAAE,IAAI,IAAI,iBAAiB,CAAC;oBAClD,IAAI,GAAG,CAAC,KAAK,EAAE,KAAK;wBAAE,KAAK,CAAC,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBAClE,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC5B,OAAO;gBACT,CAAC;YACH,CAAC,CAAC;YAEF,sBAAsB;YACtB,MAAM,OAAO,GAAG,CAAC,GAAU,EAAE,EAAE;gBAC7B,MAAM,IAAI,GAAG,YAAY,CAAC,YAAY,EAAE,CAAC,CAAC;gBAC1C,MAAM,WAAW,GAA0B;oBACzC,QAAQ,EAAE,IAAI;oBACd,UAAU,EAAE,IAAI;oBAChB,UAAU,EAAE,IAAI;oBAChB,UAAU,EAAE,OAAO;iBACpB,CAAC;gBACF,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,qBAAqB,GAAG,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE;oBACnF,KAAK,EAAE,GAAG;iBACX,CAAC,CAAC;gBACH,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YAChC,CAAC,CAAC;YAEF,mFAAmF;YACnF,MAAM,MAAM,GAAG,CAAC,IAAmB,EAAE,MAAqB,EAAE,EAAE;gBAC5D,IAAI,uBAAuB,EAAE,CAAC;oBAC5B,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,GAAG,EAAE;oBACV,MAAM,IAAI,GAAG,YAAY,CAAC,YAAY,EAAE,CAAC,CAAC;oBAC1C,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;oBACvC,MAAM,MAAM,GACV,MAAM,KAAK,SAAS;wBAClB,CAAC,CAAC,kCAAkC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI;wBAC9D,CAAC,CAAC,MAAM,KAAK,KAAK;4BAChB,CAAC,CAAC,kCAAkC,IAAI,YAAY,MAAM,GAAG;4BAC7D,CAAC,CAAC,+BAA+B,IAAI,YAAY,MAAM,EAAE,CAAC;oBAChE,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;oBACrD,MAAM,WAAW,GAA0B;wBACzC,QAAQ,EAAE,IAAI;wBACd,UAAU,EAAE,MAAM;wBAClB,UAAU,EAAE,IAAI;wBAChB,UAAU,EAAE,MAAM;qBACnB,CAAC;oBACF,MAAM,CAAC,IAAI,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;gBACpD,CAAC,CAAC,CAAC;YACL,CAAC,CAAC;YAEF,sEAAsE;YACtE,sEAAsE;YACtE,uEAAuE;YACvE,sDAAsD;YACtD,kEAAkE;YAClE,+DAA+D;YAC/D,yDAAyD;YACzD,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;YAC5C,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;YAE5C,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE;gBAChC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC7B,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACxB,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAC,CAAC;YACzF,CAAC,CAAC;YAEF,mEAAmE;YACnE,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE;gBAChC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC7B,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACxB,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAC,CAAC;YACzF,CAAC,CAAC;YAEF,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAC/B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC3B,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACzB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACnC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAEnC,kDAAkD;YAClD,KAAK,CAAC,IAAI,CAAC;gBACT,YAAY;gBACZ,OAAO,EAAE;oBACP,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,YAAY,EAAE,OAAO,CAAC,YAAY;oBAClC,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * @owletto/worker
+ *
+ * Self-hosted worker for content intelligence.
+ * Includes subprocess executor and embedding generation.
+ *
+ * Usage:
+ *   connector-worker daemon --api-url https://api.example.com
+ */
+export type { CompleteRequest, ContentItem, DaemonConfig, ExecutorConfig, PollResponse, StreamBatch, WorkerCapabilities, } from './daemon/index.js';
+export { executeRun, startDaemon, WorkerClient, WorkerDaemon } from './daemon/index.js';
+export type { Env } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,YAAY,EACV,eAAe,EACf,WAAW,EACX,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,WAAW,EACX,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGxF,YAAY,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,12 @@
+/**
+ * @owletto/worker
+ *
+ * Self-hosted worker for content intelligence.
+ * Includes subprocess executor and embedding generation.
+ *
+ * Usage:
+ *   connector-worker daemon --api-url https://api.example.com
+ */
+// Worker Daemon
+export { executeRun, startDaemon, WorkerClient, WorkerDaemon } from './daemon/index.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAWH,gBAAgB;AAChB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/runtime-deps.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Single source of truth for npm packages that connector code may import but
+ * which we deliberately do NOT bundle into the compiled connector artifact.
+ *
+ * These deps must be installed in every runtime that executes compiled
+ * connectors — the server container that hosts in-process feed sync,
+ * and the connector-worker daemon that runs out-of-process. They appear in:
+ *
+ *   - `server/src/utils/connector-compiler.ts` `external` list
+ *     (esbuild leaves the imports as bare specifiers in the bundle)
+ *   - `packages/connector-worker/package.json` dependencies (so the runtime can
+ *     resolve them)
+ *   - `assertExternalDepsResolvable()` (boot-time check that crashes loud
+ *     instead of failing silently per-feed)
+ *
+ * Rule of thumb: only externalize deps that genuinely can't be bundled —
+ * native binaries (`sharp`, `jimp`) or runtime install steps
+ * (`playwright` ships browsers via `npx playwright install`). Pure JS deps
+ * like `pino` or `link-preview-js` should be bundled instead, even if it
+ * costs a few hundred KB per connector — bundling eliminates the entire
+ * class of "compiled connector references X but X isn't installed in the
+ * worker image" outages.
+ */
+export declare const EXTERNAL_RUNTIME_DEPS: readonly ["playwright", "sharp", "jimp"];
+export type ExternalRuntimeDep = (typeof EXTERNAL_RUNTIME_DEPS)[number];
+/**
+ * Verify that every external runtime dep is resolvable from the current
+ * process. Call this once at startup of any service that executes compiled
+ * connectors. Throws (so the process crashes) instead of letting individual
+ * feed runs fail with `Missing npm dependency: X`.
+ */
+export declare function assertExternalDepsResolvable(resolve: (specifier: string) => void): void;
+//# sourceMappingURL=runtime-deps.d.ts.map

package/dist/runtime-deps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-deps.d.ts","sourceRoot":"","sources":["../src/runtime-deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,qBAAqB,0CAA2C,CAAC;AAE9E,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GACnC,IAAI,CAiBN"}