@modootoday/pmcp 0.10.0 → 0.12.0

package/dist/harness-launch-gate.js

@@ -0,0 +1,1187 @@
+// src/harness/adapters/process/launch-gate.ts
+import { spawn } from "child_process";
+import { existsSync as existsSync3 } from "fs";
+import { join as join7 } from "path";
+import { setTimeout as setTimeout2 } from "timers/promises";
+
+// src/harness/adapters/tmux/records.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import {
+  lstatSync,
+  mkdirSync,
+  readdirSync,
+  realpathSync as realpathSync2,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { homedir } from "os";
+import { join as join2 } from "path";
+
+// src/harness/groups/store.ts
+import { randomUUID } from "crypto";
+import {
+  closeSync,
+  constants,
+  fstatSync,
+  fsyncSync,
+  openSync,
+  readFileSync,
+  realpathSync,
+  renameSync,
+  writeFileSync
+} from "fs";
+import { dirname, join } from "path";
+
+// src/harness/validation.ts
+function object(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("invalid_object");
+  }
+  return value;
+}
+function text(value, name) {
+  if (typeof value !== "string" || value.length === 0 || value.includes("\0")) {
+    throw new Error(`invalid_${name}`);
+  }
+  return value;
+}
+function integer(value, name, min, max) {
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < min || value > max) {
+    throw new Error(`invalid_${name}`);
+  }
+  return value;
+}
+function strings(value, name) {
+  if (!Array.isArray(value) || value.length === 0 || value.length > 64) {
+    throw new Error(`invalid_${name}`);
+  }
+  return value.map((entry) => text(entry, name));
+}
+function id(value, name) {
+  const result = text(value, name);
+  if (!/^[a-zA-Z0-9-]{1,80}$/.test(result)) throw new Error(`invalid_${name}`);
+  return result;
+}
+
+// src/harness/runtimes/docker-policy.ts
+import { isAbsolute as isAbsolute3, posix as posix3 } from "path";
+
+// src/harness/runtimes/registry.ts
+var runtimeExecutables = {
+  "codex-cli": "codex",
+  "claude-code": "claude",
+  "gemini-cli": "gemini",
+  "grok-cli": "grok",
+  antigravity: "agy"
+};
+
+// src/harness/runtimes/egress-policy.ts
+import { isAbsolute, posix } from "path";
+function egressPolicy(value) {
+  const policy = object(value);
+  const hosts = strings(policy.hosts, "egress_hosts").map(
+    (host) => host.toLowerCase()
+  );
+  if (hosts.length > 16 || new Set(hosts).size !== hosts.length)
+    throw new Error("invalid_egress_hosts");
+  for (const host of hosts) {
+    if (host.length > 253 || !host.includes(".") || /^[0-9.]+$/.test(host) || !host.split(".").every(
+      (label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label)
+    ) || /\.(local|localhost|internal|invalid|test)$/.test(host))
+      throw new Error("invalid_egress_host");
+  }
+  if (policy.bridgeExecutable === void 0) return { hosts };
+  const executable = text(policy.bridgeExecutable, "egress_bridge_executable");
+  if (!isAbsolute(executable) || posix.normalize(executable) !== executable || /[\r\n\x1b]/.test(executable))
+    throw new Error("invalid_egress_bridge_executable");
+  return { hosts, bridgeExecutable: executable };
+}
+
+// src/harness/runtimes/private-profiles.ts
+import { isAbsolute as isAbsolute2, posix as posix2 } from "path";
+function profileName(value) {
+  const name = text(value, "private_profile");
+  if (!/^[a-z][a-z0-9-]{0,31}$/.test(name))
+    throw new Error("invalid_private_profile_name");
+  return name;
+}
+function privateProfiles(value) {
+  const entries = Object.entries(object(value));
+  if (!entries.length || entries.length > 16)
+    throw new Error("invalid_private_profile_grants");
+  const result = {};
+  for (const [name, entry] of entries) {
+    profileName(name);
+    const grant = object(entry);
+    const runtime = text(grant.runtime, "private_profile_runtime");
+    const directory = absolute(grant.directory, "private_profile_directory");
+    const lockExecutable = absolute(
+      grant.lockExecutable,
+      "private_profile_lock_executable"
+    );
+    const identity = grant.identity === void 0 ? void 0 : text(grant.identity, "private_profile_identity");
+    if (identity !== void 0 && !/^\d+:\d+:\d+:\d+$/.test(identity))
+      throw new Error("invalid_private_profile_identity");
+    result[name] = {
+      runtime,
+      directory,
+      lockExecutable,
+      ...identity ? { identity } : {}
+    };
+  }
+  if (new Set(Object.values(result).map((grant) => grant.directory)).size !== entries.length)
+    throw new Error("duplicate_private_profile_directory");
+  return result;
+}
+function absolute(value, field) {
+  const path = text(value, field);
+  if (!isAbsolute2(path) || posix2.normalize(path) !== path || /[\r\n\x1b]/.test(path))
+    throw new Error("invalid_private_profile_path");
+  return path;
+}
+function selectedProfile(policy, name, runtime) {
+  if (name === void 0) return;
+  const grant = policy.privateProfiles?.[profileName(name)];
+  if (!grant || grant.runtime !== runtime || !grant.identity)
+    throw new Error("private_profile_not_granted");
+  return grant;
+}
+
+// src/harness/runtimes/docker-policy.ts
+function dockerPolicy(value) {
+  const policy = object(value);
+  if (policy.schemaVersion !== 1)
+    throw new Error("invalid_docker_policy_version");
+  if (!/^sha256:[a-f0-9]{64}$/.test(text(policy.image, "docker_image")))
+    throw new Error("docker_image_requires_digest");
+  if (policy.network !== "none")
+    throw new Error("docker_network_not_qualified");
+  if (policy.workspaceAccess !== "read-only" && policy.workspaceAccess !== "read-write")
+    throw new Error("invalid_docker_workspace_access");
+  const commands = object(policy.commands);
+  const entries = Object.entries(commands);
+  if (!entries.length || entries.length > 5)
+    throw new Error("invalid_docker_runtime_commands");
+  const parsed = {};
+  for (const [runtime, value2] of entries) {
+    if (!Object.hasOwn(runtimeExecutables, runtime))
+      throw new Error("unsupported_docker_runtime");
+    const command2 = strings(value2, "docker_runtime_command");
+    const executable = command2[0];
+    if (!isAbsolute3(executable) || posix3.normalize(executable) !== executable || command2.some((argument) => /[\r\n\x1b]/.test(argument)))
+      throw new Error("invalid_docker_runtime_command");
+    parsed[runtime] = command2;
+  }
+  return {
+    schemaVersion: 1,
+    image: text(policy.image, "docker_image"),
+    network: "none",
+    workspaceAccess: policy.workspaceAccess,
+    commands: parsed,
+    ...policy.egress === void 0 ? {} : { egress: egressPolicy(policy.egress) },
+    ...policy.privateProfiles === void 0 ? {} : { privateProfiles: privateProfiles(policy.privateProfiles) }
+  };
+}
+
+// src/harness/groups/validation.ts
+function member(value, allowed) {
+  if (!allowed.includes(value)) throw new Error("invalid_state_value");
+}
+function records(value) {
+  if (!Array.isArray(value) || value.length > 4096)
+    throw new Error("invalid_state_collection");
+  return value.map(object);
+}
+function unique(values) {
+  if (new Set(values).size !== values.length)
+    throw new Error("duplicate_state_identity");
+}
+function validateState(value) {
+  const state = object(value);
+  const group = object(state.group);
+  member(group.schemaVersion, [1]);
+  for (const field of ["owner", "id", "generation"]) id(group[field], field);
+  text(group.projectRoot, "project_root");
+  strings(group.allowedRuntimes, "allowed_runtimes");
+  member(group.profile, ["native", "docker"]);
+  if (group.profile === "docker") dockerPolicy(group.dockerPolicy);
+  if (group.profile === "native" && group.dockerPolicy !== void 0)
+    throw new Error("docker_policy_requires_docker_profile");
+  member(group.state, ["ready", "paused", "stopped"]);
+  integer(group.memoryMb, "memory_budget", 128, 4096);
+  integer(group.maxActive, "max_active", 1, 5);
+  const sessions = records(group.sessions);
+  for (const session of sessions) {
+    id(session.id, "session_id");
+    member(session.role, ["main", "worker"]);
+    member(session.stopped, [true, false]);
+  }
+  unique(sessions.map((session) => session.id));
+  if (sessions.filter((s) => s.role === "main" && !s.stopped).length > 1)
+    throw new Error("multiple_active_main_sessions");
+  const leases = records(state.leases);
+  for (const lease of leases) {
+    id(lease.token, "control_token");
+    id(lease.controller, "controller");
+    member(lease.generation, [group.generation]);
+    member(lease.mode, ["cli", "native"]);
+    member(
+      lease.sessionId,
+      sessions.map((session) => session.id)
+    );
+    if (!Number.isFinite(Date.parse(text(lease.expiresAt, "control_expiry"))))
+      throw new Error("invalid_control_expiry");
+  }
+  unique(leases.map((lease) => lease.token));
+  unique(leases.map((lease) => lease.sessionId));
+  const deliveries = records(state.deliveries);
+  for (const delivery of deliveries) {
+    if (delivery.controller !== void 0)
+      id(delivery.controller, "controller");
+    id(delivery.requestId, "request_id");
+    id(delivery.sessionId, "session_id");
+    id(delivery.generation, "generation");
+    member(delivery.operation, ["write", "submit"]);
+    member(delivery.state, ["intent", "input_written", "delivery_uncertain"]);
+    if (!/^[a-f0-9]{64}$/.test(text(delivery.digest, "delivery_digest")))
+      throw new Error("invalid_delivery_digest");
+  }
+  unique(deliveries.map((delivery) => delivery.requestId));
+  return state;
+}
+
+// src/harness/groups/store.ts
+function privateJson(path, value) {
+  const temporary = `${path}.${randomUUID()}.new`;
+  const descriptor = openSync(temporary, "wx", 384);
+  try {
+    writeFileSync(descriptor, `${JSON.stringify(value, null, 2)}
+`);
+    fsyncSync(descriptor);
+  } finally {
+    closeSync(descriptor);
+  }
+  renameSync(temporary, path);
+  const directory = openSync(dirname(path), "r");
+  try {
+    fsyncSync(directory);
+  } finally {
+    closeSync(directory);
+  }
+}
+function readPrivateJson(path) {
+  const descriptor = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    const stat = fstatSync(descriptor);
+    if (!stat.isFile() || (stat.mode & 63) !== 0 || stat.size > 2097152)
+      throw new Error("unsafe_state_file");
+    if (stat.uid !== process.getuid?.()) throw new Error("foreign_state_file");
+    return JSON.parse(readFileSync(descriptor, "utf8"));
+  } finally {
+    closeSync(descriptor);
+  }
+}
+var GroupStore = class {
+  path;
+  state;
+  constructor(path) {
+    this.path = realpathSync(path);
+    this.state = validateState(readPrivateJson(path));
+    const metadata = object(
+      readPrivateJson(join(dirname(this.path), "harness.json"))
+    );
+    if (this.state.group.schemaVersion !== 1 || this.state.group.owner !== metadata.owner) {
+      throw new Error("foreign_group");
+    }
+  }
+  save() {
+    validateState(this.state);
+    privateJson(this.path, this.state);
+  }
+  session(id2) {
+    if (!this.state.group.sessions.some((entry) => entry.id === id2)) {
+      throw new Error("foreign_session");
+    }
+  }
+};
+
+// src/harness/adapters/docker/claims.ts
+import { createHash } from "crypto";
+
+// src/harness/adapters/docker/identity.ts
+var containerLabels = {
+  owner: "pmcp.harness.owner",
+  nonce: "pmcp.harness.nonce",
+  role: "pmcp.harness.role"
+};
+function containerName(owner, sessionId) {
+  return `pmcp-harness-${owner.slice(0, 8)}-${sessionId}`;
+}
+
+// src/harness/adapters/docker/claims.ts
+function resourceClaim(value, owner) {
+  const record = object(value);
+  if (record.kind !== "docker" || record.owner !== owner)
+    throw new Error("foreign_container_resource");
+  if (!/^[a-f0-9]{64}$/.test(text(record.id, "container_id")))
+    throw new Error("invalid_container_id");
+  if (!/^sha256:[a-f0-9]{64}$/.test(text(record.image, "container_image")))
+    throw new Error("invalid_container_image");
+  if (!/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(
+    text(record.nonce, "container_nonce")
+  ))
+    throw new Error("invalid_container_nonce");
+  if (record.role !== "main" && record.role !== "worker")
+    throw new Error("invalid_container_role");
+  if (!/^[a-f0-9]{64}$/.test(
+    text(record.configurationDigest, "container_configuration")
+  ))
+    throw new Error("invalid_container_configuration");
+  integer(record.memoryMb, "container_memory", 32, 1472);
+  integer(record.cpuQuota, "container_cpu", 1, 5e4);
+  if (record.managed !== void 0 && record.managed !== true)
+    throw new Error("invalid_container_custody");
+  if (record.privateProfile !== void 0) {
+    profileName(record.privateProfile);
+    if (record.managed !== true)
+      throw new Error("private_profile_requires_cli_owned_creation");
+  }
+  return record;
+}
+function assertResourceOwner(resource, actual) {
+  const config = object(actual.Config);
+  const labels = object(config.Labels);
+  if (actual.Id !== resource.id || actual.Image !== resource.image || labels[containerLabels.owner] !== resource.owner || labels[containerLabels.nonce] !== resource.nonce || labels[containerLabels.role] !== resource.role)
+    throw new Error("foreign_container_identity");
+}
+function configurationDigest(actual) {
+  const host = object(actual.HostConfig);
+  if (host.OomKillDisable !== false && host.OomKillDisable !== null)
+    throw new Error("container_oom_protection_disabled");
+  if (!Array.isArray(actual.Mounts))
+    throw new Error("invalid_container_mounts");
+  const mounts = actual.Mounts.map(object).sort(
+    (left, right) => text(left.Destination, "mount_destination").localeCompare(
+      text(right.Destination, "mount_destination")
+    )
+  );
+  return createHash("sha256").update(
+    JSON.stringify(
+      canonicalValue({
+        config: actual.Config,
+        host: { ...host, OomKillDisable: false },
+        mounts
+      })
+    )
+  ).digest("hex");
+}
+function canonicalValue(value) {
+  if (Array.isArray(value)) return value.map(canonicalValue);
+  if (value === null || typeof value !== "object") return value;
+  return Object.fromEntries(
+    Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => [key, canonicalValue(entry)])
+  );
+}
+
+// src/harness/adapters/tmux/records.ts
+function stateDirectory() {
+  return join2(
+    process.env.XDG_STATE_HOME ?? join2(homedir(), ".local/state"),
+    "pmcp/harness"
+  );
+}
+function runtimeUnit(id2) {
+  if (!/^[a-f0-9]{8}(-[a-f0-9]{4}){3}-[a-f0-9]{12}$/.test(id2))
+    throw new Error("invalid_session_id");
+  return `pmcp-${id2}.scope`;
+}
+function budgetSlice(owner) {
+  runtimeUnit(owner);
+  return `pmcp${owner.replaceAll("-", "")}.slice`;
+}
+var RecordStore = class _RecordStore {
+  directory;
+  socket;
+  metadataPath;
+  configPath;
+  owner;
+  constructor(directory) {
+    const stat = lstatSync(directory);
+    if (!stat.isDirectory() || stat.uid !== process.getuid?.() || (stat.mode & 63) !== 0)
+      throw new Error("unsafe_group_directory");
+    this.directory = realpathSync2(directory);
+    this.socket = join2(this.directory, "s");
+    if (Buffer.byteLength(this.socket) > 100)
+      throw new Error("socket_path_too_long");
+    this.metadataPath = join2(this.directory, "harness.json");
+    this.configPath = join2(this.directory, "tmux.conf");
+    this.owner = text(
+      object(readPrivateJson(this.metadataPath)).owner,
+      "owner"
+    );
+    runtimeUnit(this.owner);
+  }
+  static create() {
+    const root = stateDirectory();
+    mkdirSync(root, { recursive: true, mode: 448 });
+    const directory = join2(root, randomUUID2().slice(0, 16));
+    if (Buffer.byteLength(join2(directory, "s")) > 100)
+      throw new Error("socket_path_too_long");
+    mkdirSync(directory, { mode: 448 });
+    mkdirSync(join2(directory, "sessions"), { mode: 448 });
+    privateJson(join2(directory, "harness.json"), {
+      owner: randomUUID2(),
+      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    writeFileSync2(
+      join2(directory, "tmux.conf"),
+      [
+        "set -g remain-on-exit on",
+        "set -g history-limit 2000",
+        "set -g default-terminal tmux-256color",
+        "set -g status off",
+        "set -g mouse off",
+        "set -g destroy-unattached off",
+        ""
+      ].join("\n"),
+      { flag: "wx", mode: 384 }
+    );
+    return new _RecordStore(directory);
+  }
+  path(id2) {
+    runtimeUnit(id2);
+    return join2(this.directory, "sessions", `${id2}.json`);
+  }
+  read(id2) {
+    const record = object(readPrivateJson(this.path(id2)));
+    if (record.id !== id2 || record.owner !== this.owner || record.socket !== this.socket || record.unit !== runtimeUnit(id2))
+      throw new Error("foreign_backend_record");
+    for (const [field, pattern] of [
+      ["paneId", /^%\d+$/],
+      ["windowId", /^@\d+$/],
+      ["tmuxSessionId", /^\$\d+$/],
+      ["serverIdentity", /^\d+:\d+$/]
+    ]) {
+      if (!pattern.test(text(record[field], field)))
+        throw new Error("invalid_terminal_identity");
+    }
+    if (!Number.isSafeInteger(record.panePid) || Number(record.panePid) < 1)
+      throw new Error("invalid_pane_process");
+    if (record.resource !== void 0)
+      resourceClaim(record.resource, this.owner);
+    return record;
+  }
+  all() {
+    return readdirSync(join2(this.directory, "sessions")).filter((name) => name.endsWith(".json")).map((name) => this.read(name.slice(0, -5)));
+  }
+  save(record) {
+    privateJson(this.path(record.id), record);
+  }
+};
+
+// src/harness/adapters/process/command.ts
+import {
+  execFileSync
+} from "child_process";
+function command(binary, args, options = {}) {
+  return execFileSync(binary, args, {
+    encoding: "utf8",
+    timeout: 1e4,
+    maxBuffer: 256 * 1024,
+    stdio: ["pipe", "pipe", "pipe"],
+    ...options
+  });
+}
+
+// src/harness/adapters/process/identity.ts
+import { readFileSync as readFileSync2 } from "fs";
+function processIdentity(pid) {
+  if (!Number.isSafeInteger(pid) || pid < 1)
+    throw new Error("invalid_process_id");
+  const stat = readFileSync2(`/proc/${pid}/stat`, "utf8");
+  const fields = stat.slice(stat.lastIndexOf(")") + 2).split(" ");
+  if (!/^\d+$/.test(fields[19] ?? ""))
+    throw new Error("process_identity_unknown");
+  return `${pid}:${fields[19]}`;
+}
+
+// src/harness/adapters/docker/observation.ts
+function inspectResource(resource, enforceConfiguration = true) {
+  const result = JSON.parse(command("docker", ["inspect", resource.id]));
+  if (!Array.isArray(result) || result.length !== 1)
+    throw new Error("invalid_container_inspection");
+  const actual = object(result[0]);
+  assertResourceOwner(resource, actual);
+  if (enforceConfiguration && configurationDigest(actual) !== resource.configurationDigest)
+    throw new Error("container_configuration_changed");
+  return actual;
+}
+function resourceAbsent(error, id2) {
+  const failure = error;
+  const message = String(failure.stderr).toLowerCase();
+  return ["object", "container"].some(
+    (kind) => message.includes(`no such ${kind}: ${id2}`)
+  );
+}
+function assertResourceFresh(resource) {
+  const state = object(inspectResource(resource).State);
+  if (state.Status !== "created" || state.Running !== false || state.Pid !== 0)
+    throw new Error("container_requires_fresh_creation");
+}
+function resourceRunning(resource) {
+  let actual;
+  try {
+    actual = inspectResource(resource);
+  } catch (error) {
+    if (resourceAbsent(error, resource.id)) return false;
+    throw error;
+  }
+  const state = object(actual.State);
+  if (typeof state.Running !== "boolean")
+    throw new Error("unknown_container_lifecycle");
+  return state.Running;
+}
+
+// src/harness/adapters/tmux/connection.ts
+var Connection = class {
+  constructor(records3) {
+    this.records = records3;
+  }
+  records;
+  tmux(args, options = {}) {
+    return command(
+      "tmux",
+      ["-S", this.records.socket, "-f", this.records.configPath, ...args],
+      options
+    );
+  }
+  alive() {
+    try {
+      this.tmux(["list-sessions"]);
+      return true;
+    } catch (error) {
+      const failure = error;
+      if (/no server running|No such file or directory|no sessions/.test(
+        String(failure.stderr ?? failure.message)
+      ))
+        return false;
+      throw error;
+    }
+  }
+  inspect(id2) {
+    const record = this.records.read(id2);
+    const target = this.tmux([
+      "display-message",
+      "-p",
+      "-t",
+      record.paneId,
+      "#{pid}|#{pane_id}|#{pane_pid}|#{pane_dead}|#{@pmcp-owner}|#{@pmcp-session}|#{pane_width}|#{pane_height}|#{session_id}|#{window_id}"
+    ]).trim().split("|");
+    const [
+      serverPid,
+      paneId,
+      panePid,
+      dead,
+      owner,
+      sessionId,
+      width,
+      height,
+      tmuxSessionId,
+      windowId
+    ] = target;
+    if (processIdentity(Number(serverPid)) !== record.serverIdentity)
+      throw new Error("stale_server");
+    if (paneId !== record.paneId || Number(panePid) !== record.panePid || tmuxSessionId !== record.tmuxSessionId || windowId !== record.windowId)
+      throw new Error("stale_pane");
+    if (owner !== this.records.owner || sessionId !== id2)
+      throw new Error("foreign_pane");
+    return {
+      ...record,
+      alive: dead === "0" && (!record.resource || resourceRunning(record.resource)),
+      width: Number(width),
+      height: Number(height)
+    };
+  }
+};
+
+// src/harness/adapters/tmux/launch-identity.ts
+function createProof(connection2, intent2) {
+  const paneId = text(process.env.TMUX_PANE, "native_pane");
+  if (!/^%\d+$/.test(paneId)) throw new Error("invalid_native_pane");
+  const socket = text(process.env.TMUX, "native_tmux").split(",")[0];
+  if (socket !== intent2.socket) throw new Error("foreign_native_socket");
+  connection2.tmux([
+    "set-option",
+    "-p",
+    "-t",
+    paneId,
+    "@pmcp-owner",
+    intent2.owner
+  ]);
+  connection2.tmux([
+    "set-option",
+    "-p",
+    "-t",
+    paneId,
+    "@pmcp-session",
+    intent2.id
+  ]);
+  connection2.tmux([
+    "set-option",
+    "-p",
+    "-t",
+    paneId,
+    "@pmcp-launch",
+    intent2.nonce
+  ]);
+  const fields = connection2.tmux([
+    "display-message",
+    "-p",
+    "-t",
+    paneId,
+    "#{session_id}|#{window_id}|#{pane_id}|#{pane_pid}|#{pid}"
+  ]).trim().split("|");
+  return {
+    nonce: intent2.nonce,
+    runnerIdentity: processIdentity(process.pid),
+    session: {
+      id: intent2.id,
+      owner: intent2.owner,
+      socket: intent2.socket,
+      runtime: intent2.runtime,
+      cwd: intent2.cwd,
+      memoryMb: intent2.memoryMb,
+      tmuxSessionId: text(fields[0], "session"),
+      windowId: text(fields[1], "window"),
+      paneId: text(fields[2], "pane"),
+      panePid: integer(
+        Number(fields[3]),
+        "pane_process",
+        1,
+        Number.MAX_SAFE_INTEGER
+      ),
+      serverIdentity: processIdentity(Number(fields[4])),
+      unit: intent2.unit,
+      createdAt: intent2.createdAt,
+      ...intent2.resource ? { resource: intent2.resource } : {}
+    }
+  };
+}
+function assertProof(connection2, proof2) {
+  const record = proof2.session;
+  const fields = connection2.tmux([
+    "display-message",
+    "-p",
+    "-t",
+    record.paneId,
+    "#{pid}|#{session_id}|#{window_id}|#{pane_id}|#{pane_pid}|#{@pmcp-owner}|#{@pmcp-session}|#{@pmcp-launch}"
+  ]).trim().split("|");
+  if (processIdentity(Number(fields[0])) !== record.serverIdentity)
+    throw new Error("stale_launch_server");
+  if (fields[1] !== record.tmuxSessionId || fields[2] !== record.windowId || fields[3] !== record.paneId || Number(fields[4]) !== record.panePid)
+    throw new Error("stale_launch_pane");
+  if (fields[5] !== record.owner || fields[6] !== record.id || fields[7] !== proof2.nonce)
+    throw new Error("foreign_launch_pane");
+}
+
+// src/harness/launch/journal.ts
+import { createHash as createHash2 } from "crypto";
+import { existsSync, readdirSync as readdirSync2 } from "fs";
+import { join as join3 } from "path";
+var LaunchJournal = class {
+  constructor(records3, id2) {
+    this.records = records3;
+    this.id = id2;
+    runtimeUnit(id2);
+  }
+  records;
+  id;
+  path(kind) {
+    if (!["intent", "proof", "grant", "committed", "aborted"].includes(kind))
+      throw new Error("invalid_launch_artifact");
+    return join3(this.records.directory, `${this.id}.${kind}.json`);
+  }
+  intent() {
+    const value = object(readPrivateJson(this.path("intent")));
+    if (value.id !== this.id || value.owner !== this.records.owner || value.socket !== this.records.socket || value.unit !== runtimeUnit(this.id) || value.slice !== budgetSlice(this.records.owner))
+      throw new Error("foreign_launch_intent");
+    if (!/^\d+:\d+$/.test(text(value.controllerIdentity, "controller")))
+      throw new Error("invalid_launch_controller");
+    for (const field of ["groupId", "generation", "nonce"])
+      runtimeUnit(text(value[field], field));
+    if (value.role !== "main" && value.role !== "worker")
+      throw new Error("invalid_launch_role");
+    strings(value.argv, "argv");
+    text(value.cwd, "cwd");
+    text(value.runtime, "runtime");
+    text(value.createdAt, "created_at");
+    integer(value.memoryMb, "session_memory", 32, 1536);
+    if (value.resource !== void 0)
+      resourceClaim(value.resource, this.records.owner);
+    if (value.dockerCreation !== void 0) {
+      const creation2 = object(value.dockerCreation);
+      const config = object(creation2.configuration);
+      const labels = object(config.Labels);
+      if (creation2.egress !== void 0) egressPolicy(creation2.egress);
+      const bridge = creation2.egress === void 0 ? void 0 : egressPolicy(creation2.egress).bridgeExecutable;
+      if (bridge && !/^[a-f0-9]{64}$/.test(String(creation2.bridgeSha256)))
+        throw new Error("invalid_docker_bridge_digest");
+      if (!bridge && creation2.bridgeSha256 !== void 0)
+        throw new Error("ungranted_docker_bridge_digest");
+      const policy = new GroupStore(join3(this.records.directory, "group.json")).state.group.dockerPolicy;
+      const profile = selectedProfile(
+        policy,
+        creation2.privateProfile,
+        text(value.runtime, "runtime")
+      );
+      const expectedState = profile?.directory ?? join3(
+        this.records.directory,
+        "containers",
+        text(value.nonce, "nonce"),
+        "profile"
+      );
+      if (value.resource !== void 0 && object(value.resource).privateProfile !== creation2.privateProfile)
+        throw new Error("launch_private_profile_mismatch");
+      if (creation2.name !== containerName(this.records.owner, this.id) || creation2.nonce !== value.nonce || creation2.state !== expectedState || labels[containerLabels.owner] !== this.records.owner || labels[containerLabels.role] !== value.role || labels[containerLabels.nonce] !== value.nonce)
+        throw new Error("foreign_container_creation");
+    }
+    return value;
+  }
+  proof() {
+    const intent2 = this.intent();
+    const value = object(readPrivateJson(this.path("proof")));
+    const session = object(value.session);
+    if (value.nonce !== intent2.nonce || session.id !== intent2.id || session.owner !== intent2.owner || session.socket !== intent2.socket || session.unit !== intent2.unit || session.cwd !== intent2.cwd || session.memoryMb !== intent2.memoryMb || session.runtime !== intent2.runtime || session.createdAt !== intent2.createdAt || JSON.stringify(session.resource) !== JSON.stringify(intent2.resource))
+      throw new Error("foreign_launch_proof");
+    for (const [field, pattern] of [
+      ["paneId", /^%\d+$/],
+      ["windowId", /^@\d+$/],
+      ["tmuxSessionId", /^\$\d+$/],
+      ["serverIdentity", /^\d+:\d+$/]
+    ]) {
+      if (!pattern.test(text(session[field], field)))
+        throw new Error("invalid_launch_identity");
+    }
+    integer(session.panePid, "pane_process", 1, Number.MAX_SAFE_INTEGER);
+    if (!/^\d+:\d+$/.test(text(value.runnerIdentity, "runner")))
+      throw new Error("invalid_launch_runner");
+    return value;
+  }
+  grant() {
+    const intent2 = this.intent();
+    return {
+      id: intent2.id,
+      owner: intent2.owner,
+      groupId: intent2.groupId,
+      generation: intent2.generation,
+      nonce: intent2.nonce,
+      proofDigest: createHash2("sha256").update(JSON.stringify(this.proof())).digest("hex")
+    };
+  }
+  assertRegistered() {
+    const intent2 = this.intent();
+    const group = new GroupStore(join3(this.records.directory, "group.json")).state.group;
+    if (group.id !== intent2.groupId || group.generation !== intent2.generation)
+      throw new Error("launch_group_generation_mismatch");
+    if (intent2.dockerCreation && JSON.stringify(intent2.dockerCreation.egress) !== JSON.stringify(group.dockerPolicy?.egress))
+      throw new Error("launch_egress_grant_mismatch");
+    if (group.state !== "ready" || !group.allowedRuntimes.includes(intent2.runtime))
+      throw new Error("launch_group_not_ready");
+    if (!group.sessions.some(
+      (session) => session.id === intent2.id && session.role === intent2.role && !session.stopped
+    ))
+      throw new Error("launch_registration_missing");
+    const record = this.records.read(this.id);
+    if (JSON.stringify(record) !== JSON.stringify(this.proof().session))
+      throw new Error("launch_record_mismatch");
+  }
+  authorize() {
+    if (existsSync(this.path("aborted"))) throw new Error("launch_was_aborted");
+    this.assertRegistered();
+    privateJson(this.path("grant"), this.grant());
+  }
+  assertGrant() {
+    if (existsSync(this.path("aborted"))) throw new Error("launch_was_aborted");
+    const grant = object(readPrivateJson(this.path("grant")));
+    if (JSON.stringify(grant) !== JSON.stringify(this.grant()))
+      throw new Error("launch_grant_mismatch");
+  }
+  commit() {
+    this.assertRegistered();
+    this.assertGrant();
+    privateJson(this.path("committed"), this.grant());
+  }
+  assertCommitted() {
+    this.assertGrant();
+    const committed = object(readPrivateJson(this.path("committed")));
+    if (JSON.stringify(committed) !== JSON.stringify(this.grant()))
+      throw new Error("launch_commit_mismatch");
+  }
+  abortRecord() {
+    if (!existsSync(this.path("aborted"))) return;
+    const value = object(readPrivateJson(this.path("aborted")));
+    if (value.id !== this.id || value.owner !== this.records.owner || !["stopping", "stopped"].includes(String(value.state)))
+      throw new Error("foreign_launch_abort");
+    return value;
+  }
+};
+
+// src/harness/adapters/egress/server.ts
+import { createServer } from "net";
+
+// src/harness/adapters/egress/destination.ts
+import { BlockList, isIP } from "net";
+var denied = new BlockList();
+for (const [network, prefix] of [
+  ["0.0.0.0", 8],
+  ["10.0.0.0", 8],
+  ["100.64.0.0", 10],
+  ["127.0.0.0", 8],
+  ["169.254.0.0", 16],
+  ["172.16.0.0", 12],
+  ["192.0.0.0", 24],
+  ["192.0.2.0", 24],
+  ["192.88.99.0", 24],
+  ["192.168.0.0", 16],
+  ["198.18.0.0", 15],
+  ["198.51.100.0", 24],
+  ["203.0.113.0", 24],
+  ["224.0.0.0", 4],
+  ["240.0.0.0", 4]
+])
+  denied.addSubnet(network, prefix, "ipv4");
+function publicAddress(address) {
+  return isIP(address) === 4 && !denied.check(address, "ipv4");
+}
+function destination(header, hosts) {
+  if (header.some((value) => value > 127 || value === 0)) return;
+  const firstLine = header.toString("ascii").split("\r\n")[0] ?? "";
+  const match = /^CONNECT ([a-z0-9.-]+):443 HTTP\/1\.[01]$/i.exec(firstLine);
+  const host = match?.[1]?.toLowerCase();
+  if (!host || !hosts.includes(host)) return;
+  return host;
+}
+
+// src/harness/adapters/egress/socket.ts
+import { chmodSync, closeSync as closeSync2, constants as constants2, fstatSync as fstatSync2, openSync as openSync2 } from "fs";
+import { join as join4 } from "path";
+async function listenPrivateSocket(server, directory, name) {
+  if (!/^e[a-f0-9]{8}$/.test(name))
+    throw new Error("invalid_egress_socket_name");
+  const descriptor = openSync2(
+    directory,
+    constants2.O_RDONLY | constants2.O_DIRECTORY | constants2.O_NOFOLLOW
+  );
+  const stat = fstatSync2(descriptor);
+  if (stat.uid !== process.getuid?.() || (stat.mode & 63) !== 0) {
+    closeSync2(descriptor);
+    throw new Error("unsafe_egress_directory");
+  }
+  const path = join4(`/proc/self/fd/${descriptor}`, name);
+  try {
+    await new Promise((resolve, reject) => {
+      server.once("error", reject);
+      server.listen(path, resolve);
+    });
+    chmodSync(path, 384);
+  } catch (error) {
+    if (server.listening)
+      await new Promise((resolve) => server.close(() => resolve()));
+    closeSync2(descriptor);
+    throw error;
+  }
+  return () => closeSync2(descriptor);
+}
+
+// src/harness/adapters/egress/tunnel.ts
+import { lookup } from "dns/promises";
+import { connect } from "net";
+async function openTunnel(client, host, initial, sockets, record) {
+  let timer;
+  try {
+    const addresses = await Promise.race([
+      lookup(host, { family: 4, all: true }),
+      new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error("egress_dns_timeout")), 5e3);
+      })
+    ]);
+    if (client.destroyed) return;
+    if (!addresses.length || addresses.some((value) => !publicAddress(value.address)))
+      throw new Error("non_public_destination");
+    const upstream = connect({ host: addresses[0].address, port: 443 });
+    sockets.add(upstream);
+    upstream.once("close", () => sockets.delete(upstream));
+    upstream.setTimeout(6e4, () => upstream.destroy());
+    upstream.once("error", () => client.destroy());
+    client.once("close", () => upstream.destroy());
+    upstream.once("close", () => client.destroy());
+    upstream.once("connect", () => {
+      if (client.destroyed) {
+        upstream.destroy();
+        return;
+      }
+      record({ host, allowed: true });
+      client.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+      if (initial.length) upstream.write(initial);
+      client.pipe(upstream);
+      upstream.pipe(client);
+    });
+  } catch {
+    if (client.destroyed) return;
+    record({ host, allowed: false, reason: "destination_resolution_failed" });
+    client.end(
+      "HTTP/1.1 502 Bad Gateway\r\nContent-Length: 0\r\n\r\n",
+      () => client.destroy()
+    );
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+
+// src/harness/adapters/egress/server.ts
+async function createEgressProxy(directory, name, hosts, onEvent) {
+  const policy = egressPolicy({ hosts });
+  const sockets = /* @__PURE__ */ new Set();
+  const events = [];
+  const record = (event) => {
+    if (events.length >= 128) events.shift();
+    events.push(event);
+    onEvent([...events]);
+  };
+  const server = createServer((client) => {
+    if (sockets.size >= 16) {
+      client.destroy();
+      return;
+    }
+    sockets.add(client);
+    client.once("close", () => sockets.delete(client));
+    client.on("error", () => {
+    });
+    client.setTimeout(6e4, () => client.destroy());
+    let buffer = Buffer.alloc(0);
+    function headers(chunk) {
+      buffer = Buffer.concat([buffer, chunk]);
+      if (buffer.length > 16384) {
+        client.destroy();
+        return;
+      }
+      const boundary = buffer.indexOf("\r\n\r\n");
+      if (boundary < 0) return;
+      client.off("data", headers);
+      client.pause();
+      const host = destination(buffer.subarray(0, boundary), policy.hosts);
+      if (!host) {
+        record({ allowed: false, reason: "destination_not_allowed" });
+        client.end(
+          "HTTP/1.1 403 Forbidden\r\nContent-Length: 0\r\n\r\n",
+          () => client.destroy()
+        );
+        return;
+      }
+      void openTunnel(
+        client,
+        host,
+        buffer.subarray(boundary + 4),
+        sockets,
+        record
+      );
+    }
+    client.on("data", headers);
+  });
+  const release = await listenPrivateSocket(server, directory, name);
+  return {
+    async close() {
+      for (const socket of sockets) socket.destroy();
+      await new Promise(
+        (resolve, reject) => server.close((error) => error ? reject(error) : resolve())
+      );
+      release();
+    }
+  };
+}
+
+// src/harness/adapters/docker/bridge-artifact.ts
+import { createHash as createHash3 } from "crypto";
+import {
+  closeSync as closeSync4,
+  constants as constants4,
+  fstatSync as fstatSync4,
+  fsyncSync as fsyncSync2,
+  openSync as openSync4,
+  readFileSync as readFileSync3,
+  writeFileSync as writeFileSync3
+} from "fs";
+import { join as join6 } from "path";
+
+// src/harness/adapters/process/artifact.ts
+import { fileURLToPath } from "url";
+
+// src/harness/adapters/docker/private-profile.ts
+import { homedir as homedir2 } from "os";
+import {
+  closeSync as closeSync3,
+  constants as constants3,
+  existsSync as existsSync2,
+  fstatSync as fstatSync3,
+  lstatSync as lstatSync2,
+  openSync as openSync3,
+  realpathSync as realpathSync3,
+  statfsSync
+} from "fs";
+import { join as join5, relative } from "path";
+var privateProfileLock = "profile.lock";
+function overlap(left, right) {
+  const scope = relative(left, right);
+  return scope === "" || scope !== ".." && !scope.startsWith("../");
+}
+function profileIdentity(directory, projectRoot) {
+  if (directory === "/" || directory === realpathSync3(homedir2()) || overlap(directory, projectRoot) || overlap(projectRoot, directory) || realpathSync3(directory) !== directory)
+    throw new Error("private_profile_scope_not_admitted");
+  const stat = lstatSync2(directory);
+  if (!stat.isDirectory() || stat.uid !== process.getuid?.() || (stat.mode & 511) !== 448)
+    throw new Error("unsafe_private_profile_directory");
+  if ([26985, 4283649346, 4266872130].includes(statfsSync(directory).type))
+    throw new Error("remote_private_profile_not_admitted");
+  const lock = openSync3(
+    join5(directory, privateProfileLock),
+    constants3.O_RDONLY | constants3.O_NOFOLLOW
+  );
+  try {
+    const value = fstatSync3(lock);
+    if (!value.isFile() || value.nlink !== 1 || value.uid !== process.getuid?.() || (value.mode & 511) !== 384)
+      throw new Error("unsafe_private_profile_lock");
+    return `${stat.dev}:${stat.ino}:${value.dev}:${value.ino}`;
+  } finally {
+    closeSync3(lock);
+  }
+}
+function assertProfileIdentity(grant, projectRoot) {
+  if (!grant.identity || profileIdentity(grant.directory, projectRoot) !== grant.identity)
+    throw new Error("private_profile_identity_changed");
+}
+function assertProfileAvailable(grant, projectRoot) {
+  assertProfileIdentity(grant, projectRoot);
+  try {
+    command("flock", [
+      "--exclusive",
+      "--nonblock",
+      "--conflict-exit-code",
+      "73",
+      join5(grant.directory, privateProfileLock),
+      "true"
+    ]);
+  } catch (error) {
+    if (error.status === 73)
+      throw new Error("private_profile_busy");
+    throw error;
+  }
+}
+
+// src/harness/adapters/docker/entrypoint.ts
+function bridgeName(nonce) {
+  return `.pmcp-egress-${nonce.slice(0, 8)}.mjs`;
+}
+
+// src/harness/adapters/docker/bridge-artifact.ts
+function digest(value) {
+  return createHash3("sha256").update(value).digest("hex");
+}
+function assertBridge(creation2) {
+  if (!creation2.egress?.bridgeExecutable) return;
+  const descriptor = openSync4(
+    join6(creation2.state, bridgeName(creation2.nonce)),
+    constants4.O_RDONLY | constants4.O_NOFOLLOW
+  );
+  try {
+    const stat = fstatSync4(descriptor);
+    if (!stat.isFile() || stat.uid !== process.getuid?.() || stat.nlink !== 1 || (stat.mode & 63) !== 0 || stat.size > 2097152 || digest(readFileSync3(descriptor)) !== creation2.bridgeSha256)
+      throw new Error("docker_bridge_artifact_changed");
+  } finally {
+    closeSync4(descriptor);
+  }
+}
+
+// src/harness/adapters/docker/private-creation.ts
+function assertPrivateCreation(creation2, group, runtime) {
+  const profile = selectedProfile(
+    group.dockerPolicy,
+    creation2.privateProfile,
+    runtime
+  );
+  if (!profile) return;
+  if (creation2.state !== profile.directory)
+    throw new Error("foreign_container_state_directory");
+  assertProfileAvailable(profile, group.projectRoot);
+}
+
+// src/harness/adapters/process/launch-gate.ts
+var records2 = new RecordStore(text(process.argv[2], "directory"));
+var journal = new LaunchJournal(records2, text(process.argv[3], "session_id"));
+var connection = new Connection(records2);
+var intent = journal.intent();
+var proof = createProof(connection, intent);
+privateJson(journal.path("proof"), proof);
+var deadline = Date.now() + 15e3;
+while (!existsSync3(journal.path("grant"))) {
+  if (existsSync3(journal.path("aborted")))
+    throw new Error("launch_was_aborted");
+  if (Date.now() >= deadline) throw new Error("launch_grant_timeout");
+  await setTimeout2(25);
+}
+journal.assertRegistered();
+journal.assertGrant();
+assertProof(connection, proof);
+if (intent.resource) assertResourceFresh(intent.resource);
+var creation = intent.dockerCreation;
+if (creation) assertBridge(creation);
+if (creation)
+  assertPrivateCreation(
+    creation,
+    new GroupStore(join7(records2.directory, "group.json")).state.group,
+    intent.runtime
+  );
+var proxy = creation?.egress ? await createEgressProxy(
+  creation.state,
+  `e${intent.nonce.slice(0, 8)}`,
+  creation.egress.hosts,
+  (events) => privateJson(join7(records2.directory, `${intent.id}.egress.json`), {
+    id: intent.id,
+    events
+  })
+) : void 0;
+var witness = join7(records2.directory, `${intent.id}.process.json`);
+var startedAt = (/* @__PURE__ */ new Date()).toISOString();
+privateJson(witness, { id: intent.id, pid: process.pid, startedAt });
+var child = spawn(
+  text(intent.argv[0], "runtime_executable"),
+  intent.argv.slice(1),
+  {
+    cwd: intent.cwd,
+    stdio: "inherit",
+    env: process.env
+  }
+);
+process.on("SIGTERM", () => child.kill("SIGTERM"));
+process.on("SIGINT", () => {
+});
+child.on("error", async (error) => {
+  await proxy?.close();
+  privateJson(witness, {
+    id: intent.id,
+    startedAt,
+    exitedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    error: error.code
+  });
+  process.exitCode = 1;
+});
+child.on("exit", async (code, signal) => {
+  await proxy?.close();
+  privateJson(witness, {
+    id: intent.id,
+    startedAt,
+    exitedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    code,
+    signal
+  });
+  process.exitCode = code ?? 1;
+});
+//# sourceMappingURL=harness-launch-gate.js.map