@moxt-ai/mobius 0.0.195 → 0.0.196

package/dist/process/executable.js

@@ -1,414 +1,872 @@
+// src/process/executable.ts
 import { spawn } from "node:child_process";
+import { stat as stat2 } from "node:fs/promises";
+import { join as join5, resolve as resolve2 } from "node:path";
+
+// src/platform/linux.ts
+import { constants as constants2, readdirSync, readFileSync } from "node:fs";
+import { access as access2, readdir, readFile, realpath as realpath2, stat } from "node:fs/promises";
+import { join as join2 } from "node:path";
+
+// src/platform/posix.ts
+import { execFile } from "node:child_process";
 import { constants } from "node:fs";
-import { access, realpath, stat } from "node:fs/promises";
-import { join, resolve } from "node:path";
-import { platformSupportFor } from "../platform/index.js";
-const hostPlatform = platformSupportFor(process.platform);
-const DEFAULT_OUTPUT_LIMIT_BYTES = 16 * 1024;
-const PROCESS_GRACEFUL_STOP_TIMEOUT_MILLISECONDS = 1_000;
-const PROCESS_FORCED_STOP_TIMEOUT_MILLISECONDS = 5_000;
-const PROCESS_EXIT_CHECK_ATTEMPTS = 16;
-const GRACEFUL_STOP_SIGNAL = 15;
-const FORCED_STOP_SIGNAL = 9;
-export class ExecutableIdentity {
-    changedAtMilliseconds;
-    device;
-    inode;
-    realPath;
-    requestedPath;
-    size;
-    constructor(requestedPath, realPath_, device, inode, size, changedAtMilliseconds) {
-        this.changedAtMilliseconds = changedAtMilliseconds;
-        this.device = device;
-        this.inode = inode;
-        this.realPath = realPath_;
-        this.requestedPath = requestedPath;
-        this.size = size;
-    }
-    matches = (candidate) => this.requestedPath === candidate.requestedPath &&
-        this.realPath === candidate.realPath &&
-        this.device === candidate.device &&
-        this.inode === candidate.inode &&
-        this.size === candidate.size &&
-        this.changedAtMilliseconds === candidate.changedAtMilliseconds;
-}
-export class ResolvedExecutable {
-    identity;
-    path;
-    constructor(identity) {
-        this.identity = identity;
-        this.path = identity.realPath;
-    }
-}
-export class ProcessExecutionError extends Error {
-    code;
-    constructor(code, message, options = {}) {
-        super(message, options);
-        this.code = code;
-        this.name = "ProcessExecutionError";
-    }
-}
-export class ProcessResult {
-    stderr;
-    stdout;
-    constructor(stdout, stderr) {
-        this.stderr = stderr;
-        this.stdout = stdout;
-    }
-}
-function executableExtensions(executableName, environment, platform) {
-    if (platform !== "win32") {
-        return [""];
-    }
-    if (/\.[a-zA-Z0-9]+$/.test(executableName)) {
-        return [""];
-    }
-    const configured = environment["PATHEXT"] ?? ".COM;.EXE;.BAT;.CMD";
-    const extensions = configured
-        .split(";")
-        .map((extension) => extension.trim())
-        .filter((extension) => extension.length > 0)
-        .map((extension) => (extension.startsWith(".") ? extension : `.${extension}`));
-    return extensions.length > 0 ? extensions : [".EXE"];
-}
-export async function resolveExecutablePath(requestedPath, platform = process.platform) {
-    const absoluteRequestedPath = resolve(requestedPath);
+import { access, chmod, lstat, realpath, unlink } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+// src/filesystem/path-error.ts
+var LocalPathError = class extends Error {
+  code = "unsafe_local_path";
+  constructor(message, options = {}) {
+    super(message, options);
+    this.name = "LocalPathError";
+  }
+};
+
+// src/platform/posix.ts
+var PROCESS_TABLE_TIMEOUT_MILLISECONDS = 1e3;
+var PROCESS_TABLE_OUTPUT_LIMIT_BYTES = 1024 * 1024;
+function parseProcessTable(output) {
+  const entries = [];
+  for (const line of output.split("\n")) {
+    const groups = /^\s*(?<pid>\d+)\s+(?<ppid>\d+)\s+(?<pgid>\d+)\s*$/.exec(line)?.groups;
+    if (groups === void 0) {
+      continue;
+    }
+    const processId = Number(groups["pid"]);
+    const parentProcessId = Number(groups["ppid"]);
+    const processGroupId = Number(groups["pgid"]);
+    if (!Number.isSafeInteger(processId) || processId <= 0 || !Number.isSafeInteger(parentProcessId) || parentProcessId < 0 || !Number.isSafeInteger(processGroupId) || processGroupId <= 0) {
+      continue;
+    }
+    entries.push({ parentProcessId, processGroupId, processId });
+  }
+  return entries;
+}
+function readProcessTableWithPs(executable) {
+  return new Promise((resolveTable) => {
+    execFile(
+      executable,
+      ["-axo", "pid=,ppid=,pgid="],
+      {
+        encoding: "utf8",
+        maxBuffer: PROCESS_TABLE_OUTPUT_LIMIT_BYTES,
+        signal: AbortSignal.timeout(PROCESS_TABLE_TIMEOUT_MILLISECONDS),
+        timeout: PROCESS_TABLE_TIMEOUT_MILLISECONDS
+      },
+      (error, stdout) => {
+        resolveTable(error === null ? parseProcessTable(stdout) : []);
+      }
+    );
+  });
+}
+function processExists(processId) {
+  try {
+    process.kill(processId, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function signalCapturedProcesses(processes, rootProcessId, signal) {
+  const processIds = new Set(processes.map((identity) => identity.processId));
+  const signalledGroups = /* @__PURE__ */ new Set();
+  for (const identity of processes) {
+    const isRootProcessGroup = identity.processGroupId === rootProcessId;
+    if (!isRootProcessGroup && !processIds.has(identity.processGroupId) || signalledGroups.has(identity.processGroupId)) {
+      continue;
+    }
     try {
-        const resolvedPath = await realpath(absoluteRequestedPath);
-        const metadata = await stat(resolvedPath);
-        if (!metadata.isFile()) {
-            return null;
-        }
-        if (platform !== "win32") {
-            await access(resolvedPath, constants.X_OK);
-        }
-        return new ResolvedExecutable(new ExecutableIdentity(absoluteRequestedPath, resolvedPath, metadata.dev, metadata.ino, metadata.size, metadata.ctimeMs));
-    }
-    catch {
-        return null;
-    }
-}
-export async function findExecutableOnPath(executableName, environment, platform = process.platform) {
-    const encodedPath = environment["PATH"] ?? "";
-    const separator = platform === "win32" ? ";" : ":";
-    const extensions = executableExtensions(executableName, environment, platform);
-    for (const entry of encodedPath.split(separator)) {
-        if (entry.length === 0) {
-            continue;
-        }
-        for (const extension of extensions) {
-            const requestedPath = resolve(join(entry, `${executableName}${extension}`));
-            const executable = await resolveExecutablePath(requestedPath, platform);
-            if (executable !== null) {
-                return executable;
-            }
-        }
+      process.kill(-identity.processGroupId, signal);
+      signalledGroups.add(identity.processGroupId);
+    } catch {
     }
-    return null;
+  }
+  for (const identity of processes) {
+    if (identity.processId === rootProcessId || identity.processGroupId === rootProcessId || signalledGroups.has(identity.processGroupId)) {
+      continue;
+    }
+    try {
+      process.kill(identity.processId, signal);
+    } catch {
+    }
+  }
 }
-export async function revalidateExecutable(identity, platform = process.platform) {
-    const current = await resolveExecutablePath(identity.requestedPath, platform);
-    return current !== null && identity.matches(current.identity);
+function terminateProcess(child, signal) {
+  if (child.exitCode !== null || child.signalCode !== null || child.pid === void 0) {
+    return;
+  }
+  try {
+    process.kill(-child.pid, signal);
+    return;
+  } catch {
+  }
+  child.kill(signal);
 }
-function appendBounded(chunks, chunk, currentBytes, limitBytes) {
-    const nextBytes = currentBytes + chunk.byteLength;
-    if (nextBytes > limitBytes) {
-        throw new ProcessExecutionError("process_output_limit", "The executable produced too much output");
+async function removeControlSocket(path) {
+  try {
+    await unlink(path);
+  } catch (cause) {
+    if (!(cause instanceof Error) || !("code" in cause) || cause.code !== "ENOENT") {
+      throw cause;
+    }
+  }
+}
+var posixOperations = {
+  controlSocketPath: (installationHash) => join(tmpdir(), `mobius-${installationHash}.sock`),
+  prepareControlSocket: removeControlSocket,
+  secureControlSocket: async (path) => {
+    await chmod(path, 384);
+  },
+  removeControlSocket,
+  pathDelimiter: ":",
+  environmentValue: (environment, name) => environment[name],
+  executableExtensions: () => [""],
+  resolveExecutableTarget: async (path) => {
+    const target = await realpath(path);
+    await access(target, constants.X_OK);
+    return target;
+  },
+  executableLaunch: (command, args) => ({ command, arguments: args }),
+  spawnOptions: { detached: true, windowsHide: true },
+  signalCapturedProcesses,
+  terminateProcess,
+  validatePathPermissions: async (path, directory, privateAccess, signal) => {
+    signal.throwIfAborted();
+    const metadata = await lstat(path);
+    if (process.getuid === void 0 || metadata.uid !== process.getuid()) {
+      throw new LocalPathError("Path is not user-owned");
+    }
+    if (privateAccess) {
+      await chmod(path, directory ? 448 : 384);
+    }
+    signal.throwIfAborted();
+  }
+};
+
+// src/platform/linux.ts
+function appendLinuxProcessTableEntry(entries, processId, encoded) {
+  const closingParenthesis = encoded.lastIndexOf(")");
+  if (!encoded.startsWith(`${processId.toString()} (`) || closingParenthesis < 0) {
+    return;
+  }
+  const fields = encoded.slice(closingParenthesis + 1).trim().split(/\s+/);
+  const parentProcessId = Number(fields[1]);
+  const processGroupId = Number(fields[2]);
+  if (!Number.isSafeInteger(parentProcessId) || parentProcessId < 0 || !Number.isSafeInteger(processGroupId) || processGroupId <= 0) {
+    return;
+  }
+  entries.push({ parentProcessId, processGroupId, processId });
+}
+async function readLinuxProcessTable() {
+  const entries = [];
+  try {
+    const directories = await readdir("/proc", { withFileTypes: true });
+    for (const directory of directories) {
+      if (!directory.isDirectory() || !/^\d+$/.test(directory.name)) {
+        continue;
+      }
+      const processId = Number(directory.name);
+      if (!Number.isSafeInteger(processId) || processId <= 0) {
+        continue;
+      }
+      try {
+        appendLinuxProcessTableEntry(
+          entries,
+          processId,
+          await readFile(join2("/proc", directory.name, "stat"), "utf8")
+        );
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return entries;
+}
+function readLinuxProcessTableSynchronously() {
+  const entries = [];
+  try {
+    const directories = readdirSync("/proc", { withFileTypes: true });
+    for (const directory of directories) {
+      if (!directory.isDirectory() || !/^\d+$/.test(directory.name)) {
+        continue;
+      }
+      const processId = Number(directory.name);
+      if (!Number.isSafeInteger(processId) || processId <= 0) {
+        continue;
+      }
+      try {
+        appendLinuxProcessTableEntry(
+          entries,
+          processId,
+          readFileSync(join2("/proc", directory.name, "stat"), "utf8")
+        );
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return entries;
+}
+async function readLinuxProcessTableWithFallback() {
+  const procfsEntries = await readLinuxProcessTable();
+  if (procfsEntries.length > 0) {
+    return procfsEntries;
+  }
+  for (const candidate of ["/usr/bin/ps", "/bin/ps", "/run/current-system/sw/bin/ps"]) {
+    try {
+      const resolvedPath = await realpath2(candidate);
+      if (!(await stat(resolvedPath)).isFile()) {
+        continue;
+      }
+      await access2(resolvedPath, constants2.X_OK);
+    } catch {
+      continue;
+    }
+    const entries = await readProcessTableWithPs(candidate);
+    if (entries.length > 0) {
+      return entries;
     }
-    chunks.push(chunk);
-    return nextBytes;
+  }
+  return [];
+}
+function processExists2(processId) {
+  try {
+    const encoded = readFileSync(join2("/proc", processId.toString(), "stat"), "utf8");
+    const closingParenthesis = encoded.lastIndexOf(")");
+    if (closingParenthesis >= 0) {
+      const processState = encoded.slice(closingParenthesis + 1).trimStart().charAt(0);
+      if (processState === "Z" || processState === "X") {
+        return false;
+      }
+    }
+  } catch {
+  }
+  return processExists(processId);
+}
+var linuxPlatform = {
+  ...posixOperations,
+  readProcessTable: readLinuxProcessTableWithFallback,
+  readProcessTableSynchronously: readLinuxProcessTableSynchronously,
+  processExists: processExists2,
+  workBuddyExecutablePaths: () => [],
+  openCodeArchives: {
+    arm64: {
+      asset: "opencode-linux-arm64.tar.gz",
+      sha256: "70baf769395ca4e7a68924026530c390eace194f3b7e4919d4efcb2aa2eed3c0",
+      format: "tar.gz"
+    },
+    x64: {
+      asset: "opencode-linux-x64.tar.gz",
+      sha256: "ea800b7ff56226b70952126c9fc1e2517ca4c4b5682fd9d3f9e87449697a1194",
+      format: "tar.gz"
+    }
+  },
+  grokDependencies: {
+    arm64: {
+      name: "@xai-official/grok-linux-arm64",
+      integrity: "sha512-Jlwz9XtZPNKz/V/ydifC8OVu3hIZz7pmoStt8c4KCqkSWjWiZ/PBIC0iJiq8rvByhx5Z0EdSyq8ZXVwtocceGA==",
+      tarballUrl: "https://registry.npmjs.org/@xai-official/grok-linux-arm64/-/grok-linux-arm64-1.0.21.tgz"
+    },
+    x64: {
+      name: "@xai-official/grok-linux-x64",
+      integrity: "sha512-AjDV5ifEz5LFG2Jt5IlhAeEkJati/wOvCchVbR4eIj2ogjvmXoXlzBrYRXuAJpXBy5q0se/Yuez5FxDU9Ju81w==",
+      tarballUrl: "https://registry.npmjs.org/@xai-official/grok-linux-x64/-/grok-linux-x64-1.0.21.tgz"
+    }
+  }
+};
+
+// src/platform/macos.ts
+import { isAbsolute, join as join3 } from "node:path";
+var WORKBUDDY_MACOS_EXECUTABLE_PATH = Object.freeze([
+  "WorkBuddy.app",
+  "Contents",
+  "Resources",
+  "app.asar.unpacked",
+  "cli",
+  "bin",
+  "codebuddy"
+]);
+var macosPlatform = {
+  ...posixOperations,
+  readProcessTable: () => readProcessTableWithPs("/bin/ps"),
+  readProcessTableSynchronously: () => [],
+  processExists,
+  workBuddyExecutablePaths: (environment) => {
+    const paths = [join3("/Applications", ...WORKBUDDY_MACOS_EXECUTABLE_PATH)];
+    const homeDirectory = environment["HOME"];
+    if (homeDirectory !== void 0 && isAbsolute(homeDirectory)) {
+      paths.unshift(join3(homeDirectory, "Applications", ...WORKBUDDY_MACOS_EXECUTABLE_PATH));
+    }
+    return paths;
+  },
+  openCodeArchives: {
+    arm64: {
+      asset: "opencode-darwin-arm64.zip",
+      sha256: "fe764f7f360c584a83e18dd5f23fb1a6b2725f5ee8854b0252fe558f7798e946",
+      format: "zip"
+    },
+    x64: {
+      asset: "opencode-darwin-x64.zip",
+      sha256: "9858853e7bacdbbd22c2d70c377e009dc4b354dd04f5588705411e7afb89fd2d",
+      format: "zip"
+    }
+  },
+  grokDependencies: {
+    arm64: {
+      name: "@xai-official/grok-darwin-arm64",
+      integrity: "sha512-I4pKZGnR6Mv4MJOJsB9B/i2o0ODF4eZtp4jHN5feoTqKIeAUVg38OzBtE8aN/wZa7Xg+qhnf6Jd1tcAFvMoFtQ==",
+      tarballUrl: "https://registry.npmjs.org/@xai-official/grok-darwin-arm64/-/grok-darwin-arm64-1.0.21.tgz"
+    },
+    x64: {
+      name: "@xai-official/grok-darwin-x64",
+      integrity: "sha512-h0nFj3NZ9Kz8w6fQ6UDxxeSIhC1WjwwoRE92iNbG//tZy6YGkppR3s7oRVtt4Xl0CJANKUt0EusyIYnnAvKLzw==",
+      tarballUrl: "https://registry.npmjs.org/@xai-official/grok-darwin-x64/-/grok-darwin-x64-1.0.21.tgz"
+    }
+  }
+};
+
+// src/platform/windows.ts
+import { execFile as execFile2 } from "node:child_process";
+import { readFile as readFile2, realpath as realpath3 } from "node:fs/promises";
+import { dirname, extname, join as join4, resolve } from "node:path";
+import { promisify } from "node:util";
+
+// src/process/process-error.ts
+var ProcessExecutionError = class extends Error {
+  code;
+  constructor(code, message, options = {}) {
+    super(message, options);
+    this.code = code;
+    this.name = "ProcessExecutionError";
+  }
+};
+
+// src/platform/windows.ts
+var execute = promisify(execFile2);
+function environmentValue(environment, name) {
+  return Object.entries(environment).find(([key]) => key.toUpperCase() === name.toUpperCase())?.[1];
+}
+function executableExtensions(executableName, environment) {
+  if (/\.[a-zA-Z0-9]+$/.test(executableName)) {
+    return [""];
+  }
+  const configured = environmentValue(environment, "PATHEXT") ?? ".COM;.EXE;.BAT;.CMD";
+  const extensions = configured.split(";").map((extension) => extension.trim()).filter((extension) => extension.length > 0).map((extension) => extension.startsWith(".") ? extension : `.${extension}`);
+  return extensions.length > 0 ? extensions : [".EXE"];
+}
+async function resolveExecutableTarget(path) {
+  let resolvedPath;
+  try {
+    resolvedPath = await realpath3(extname(path) === "" ? `${path}.cmd` : path);
+  } catch (cause) {
+    if (extname(path) !== "" || !(cause instanceof Error) || !("code" in cause) || cause.code !== "ENOENT") {
+      throw cause;
+    }
+    resolvedPath = await realpath3(path);
+  }
+  if (extname(resolvedPath).toLowerCase() === ".cmd") {
+    const shim = await readFile2(resolvedPath, "utf8");
+    const script = /"%_prog%"\s+"%dp0%[\\/]([^"\r\n]+\.(?:js|mjs|cjs))"\s+%\*/iu.exec(shim)?.[1];
+    if (script !== void 0 && shim.includes("SET dp0=%~dp0")) {
+      resolvedPath = await realpath3(resolve(dirname(resolvedPath), script));
+    } else {
+      const pnpmScript = /^\s*node\s+"%~dp0[\\/]([^"\r\n]+\.(?:js|mjs|cjs))"\s+%\*\s*$/imu.exec(shim)?.[1];
+      if (pnpmScript === void 0 || !shim.includes("@SETLOCAL")) {
+        throw new ProcessExecutionError(
+          "process_unsupported_script",
+          "Use a native executable or a verified Node entrypoint"
+        );
+      }
+      resolvedPath = await realpath3(resolve(dirname(resolvedPath), pnpmScript));
+    }
+  }
+  return resolvedPath;
+}
+function executableLaunch(command, args) {
+  if (/\.(?:js|mjs|cjs)$/iu.test(command)) {
+    return { command: process.execPath, arguments: [command, ...args] };
+  }
+  if (/\.(?:cmd|bat)$/iu.test(command)) {
+    throw new ProcessExecutionError(
+      "process_unsupported_script",
+      "Use a native executable or a verified Node entrypoint"
+    );
+  }
+  return { command, arguments: args };
 }
 function readProcessTable() {
-    return hostPlatform.readProcessTable();
+  const systemRoot = environmentValue(process.env, "SystemRoot");
+  if (systemRoot === void 0) {
+    return Promise.resolve([]);
+  }
+  return new Promise((resolveTable) => {
+    execFile2(
+      join4(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe"),
+      [
+        "-NoLogo",
+        "-NoProfile",
+        "-NonInteractive",
+        "-Command",
+        "Get-CimInstance Win32_Process | ForEach-Object { '{0} {1} {0}' -f $_.ProcessId, $_.ParentProcessId }"
+      ],
+      {
+        encoding: "utf8",
+        windowsHide: true,
+        timeout: 1e4,
+        signal: AbortSignal.timeout(1e4),
+        maxBuffer: 1024 * 1024
+      },
+      (error, stdout) => resolveTable(error === null ? parseProcessTable(stdout) : [])
+    );
+  });
+}
+function signalCapturedProcesses2(processes, _rootProcessId, signal) {
+  for (const identity of [...processes].reverse()) {
+    try {
+      process.kill(identity.processId, signal);
+    } catch {
+    }
+  }
+}
+function terminateProcess2(child, signal) {
+  if (child.exitCode !== null || child.signalCode !== null || child.pid === void 0) {
+    return;
+  }
+  child.kill(signal);
+}
+var windowsPermissions = `
+$ErrorActionPreference = 'Stop'
+Import-Module (Join-Path $PSHOME 'Modules/Microsoft.PowerShell.Security/Microsoft.PowerShell.Security.psd1')
+$item = Get-Item -LiteralPath $env:MOBIUS_PERMISSION_PATH -Force
+if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'Unsafe path' }
+$sid = [Security.Principal.WindowsIdentity]::GetCurrent().User
+$acl = Get-Acl -LiteralPath $item.FullName
+$owner = $acl.GetOwner([Security.Principal.SecurityIdentifier])
+if ($owner -ne $sid -and -not ($owner.Value -eq 'S-1-5-32-544' -and ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator))) { throw 'Path is not user-owned' }
+if ($env:MOBIUS_PERMISSION_PRIVATE -eq '1') {
+    if ($item.PSIsContainer) {
+        $private = New-Object Security.AccessControl.DirectorySecurity
+        $rule = New-Object Security.AccessControl.FileSystemAccessRule($sid, 'FullControl', 'ContainerInherit,ObjectInherit', 'None', 'Allow')
+    } else {
+        $private = New-Object Security.AccessControl.FileSecurity
+        $rule = New-Object Security.AccessControl.FileSystemAccessRule($sid, 'FullControl', 'Allow')
+    }
+    $private.SetOwner($sid)
+    $private.SetAccessRuleProtection($true, $false)
+    $private.AddAccessRule($rule)
+    Set-Acl -LiteralPath $item.FullName -AclObject $private
+}
+`;
+async function validatePathPermissions(path, _directory, privateAccess, signal) {
+  signal.throwIfAborted();
+  const systemRoot = environmentValue(process.env, "SystemRoot");
+  if (systemRoot === void 0) {
+    throw new LocalPathError("Windows system directory is unavailable");
+  }
+  try {
+    await execute(
+      join4(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe"),
+      [
+        "-NoLogo",
+        "-NoProfile",
+        "-NonInteractive",
+        "-EncodedCommand",
+        Buffer.from(windowsPermissions, "utf16le").toString("base64")
+      ],
+      {
+        env: {
+          ...process.env,
+          MOBIUS_PERMISSION_PATH: path,
+          MOBIUS_PERMISSION_PRIVATE: privateAccess ? "1" : "0"
+        },
+        windowsHide: true,
+        signal: AbortSignal.any([signal, AbortSignal.timeout(1e4)]),
+        timeout: 1e4,
+        maxBuffer: 16384
+      }
+    );
+  } catch (cause) {
+    signal.throwIfAborted();
+    throw new LocalPathError("The local path permissions could not be secured", { cause });
+  }
+}
+var windowsPlatform = {
+  controlSocketPath: (installationHash) => `\\\\.\\pipe\\mobius-${installationHash}`,
+  prepareControlSocket: async () => {
+  },
+  secureControlSocket: async () => {
+  },
+  removeControlSocket: async () => {
+  },
+  pathDelimiter: ";",
+  environmentValue,
+  executableExtensions,
+  resolveExecutableTarget,
+  executableLaunch,
+  spawnOptions: { detached: false, windowsHide: true },
+  signalCapturedProcesses: signalCapturedProcesses2,
+  terminateProcess: terminateProcess2,
+  validatePathPermissions,
+  readProcessTable,
+  readProcessTableSynchronously: () => [],
+  processExists,
+  workBuddyExecutablePaths: () => [],
+  openCodeArchives: {},
+  grokDependencies: {}
+};
+
+// src/platform/index.ts
+var fallbackPlatform = {
+  ...posixOperations,
+  readProcessTable: () => readProcessTableWithPs("/usr/bin/ps"),
+  readProcessTableSynchronously: () => [],
+  processExists,
+  workBuddyExecutablePaths: () => [],
+  openCodeArchives: {},
+  grokDependencies: {}
+};
+var platforms = /* @__PURE__ */ new Map([
+  ["linux", linuxPlatform],
+  ["darwin", macosPlatform],
+  ["win32", windowsPlatform]
+]);
+function platformSupportFor(platform) {
+  return platforms.get(platform) ?? fallbackPlatform;
+}
+
+// src/process/executable.ts
+var hostPlatform = platformSupportFor(process.platform);
+var DEFAULT_OUTPUT_LIMIT_BYTES = 16 * 1024;
+var PROCESS_GRACEFUL_STOP_TIMEOUT_MILLISECONDS = 1e3;
+var PROCESS_FORCED_STOP_TIMEOUT_MILLISECONDS = 5e3;
+var PROCESS_EXIT_CHECK_ATTEMPTS = 16;
+var GRACEFUL_STOP_SIGNAL = 15;
+var FORCED_STOP_SIGNAL = 9;
+var ExecutableIdentity = class {
+  changedAtMilliseconds;
+  device;
+  inode;
+  realPath;
+  requestedPath;
+  size;
+  constructor(requestedPath, realPath_, device, inode, size, changedAtMilliseconds) {
+    this.changedAtMilliseconds = changedAtMilliseconds;
+    this.device = device;
+    this.inode = inode;
+    this.realPath = realPath_;
+    this.requestedPath = requestedPath;
+    this.size = size;
+  }
+  matches = (candidate) => this.requestedPath === candidate.requestedPath && this.realPath === candidate.realPath && this.device === candidate.device && this.inode === candidate.inode && this.size === candidate.size && this.changedAtMilliseconds === candidate.changedAtMilliseconds;
+};
+var ResolvedExecutable = class {
+  identity;
+  path;
+  constructor(identity) {
+    this.identity = identity;
+    this.path = identity.realPath;
+  }
+};
+var ProcessResult = class {
+  stderr;
+  stdout;
+  constructor(stdout, stderr) {
+    this.stderr = stderr;
+    this.stdout = stdout;
+  }
+};
+async function resolveExecutablePath(requestedPath, platform = process.platform) {
+  const absoluteRequestedPath = resolve2(requestedPath);
+  try {
+    const resolvedPath = await platformSupportFor(platform).resolveExecutableTarget(absoluteRequestedPath);
+    const metadata = await stat2(resolvedPath);
+    if (!metadata.isFile()) {
+      return null;
+    }
+    return new ResolvedExecutable(
+      new ExecutableIdentity(
+        absoluteRequestedPath,
+        resolvedPath,
+        metadata.dev,
+        metadata.ino,
+        metadata.size,
+        metadata.ctimeMs
+      )
+    );
+  } catch {
+    return null;
+  }
+}
+async function findExecutableOnPath(executableName, environment, platform = process.platform) {
+  const support = platformSupportFor(platform);
+  const encodedPath = support.environmentValue(environment, "PATH") ?? "";
+  const separator = support.pathDelimiter;
+  const extensions = support.executableExtensions(executableName, environment);
+  for (const entry of encodedPath.split(separator)) {
+    if (entry.length === 0) {
+      continue;
+    }
+    for (const extension of extensions) {
+      const requestedPath = resolve2(join5(entry, `${executableName}${extension}`));
+      const executable = await resolveExecutablePath(requestedPath, platform);
+      if (executable !== null) {
+        return executable;
+      }
+    }
+  }
+  return null;
+}
+async function revalidateExecutable(identity, platform = process.platform) {
+  const current = await resolveExecutablePath(identity.requestedPath, platform);
+  return current !== null && identity.matches(current.identity);
+}
+function appendBounded(chunks, chunk, currentBytes, limitBytes) {
+  const nextBytes = currentBytes + chunk.byteLength;
+  if (nextBytes > limitBytes) {
+    throw new ProcessExecutionError("process_output_limit", "The executable produced too much output");
+  }
+  chunks.push(chunk);
+  return nextBytes;
+}
+function readProcessTable2() {
+  return hostPlatform.readProcessTable();
 }
 function selectProcessTree(entries, rootProcessId) {
-    const processIds = new Set([rootProcessId]);
+  const processIds = /* @__PURE__ */ new Set([rootProcessId]);
+  for (const entry of entries) {
+    if (entry.processGroupId === rootProcessId) {
+      processIds.add(entry.processId);
+    }
+  }
+  let previousSize = 0;
+  while (previousSize !== processIds.size) {
+    previousSize = processIds.size;
     for (const entry of entries) {
-        if (entry.processGroupId === rootProcessId) {
-            processIds.add(entry.processId);
-        }
-    }
-    let previousSize = 0;
-    while (previousSize !== processIds.size) {
-        previousSize = processIds.size;
-        for (const entry of entries) {
-            if (processIds.has(entry.parentProcessId)) {
-                processIds.add(entry.processId);
-            }
-        }
-    }
-    return entries
-        .filter((entry) => processIds.has(entry.processId))
-        .map((entry) => ({
-        processGroupId: entry.processGroupId,
-        processId: entry.processId,
-    }));
+      if (processIds.has(entry.parentProcessId)) {
+        processIds.add(entry.processId);
+      }
+    }
+  }
+  return entries.filter((entry) => processIds.has(entry.processId)).map((entry) => ({
+    processGroupId: entry.processGroupId,
+    processId: entry.processId
+  }));
 }
 function mergeProcessTrees(captured, current) {
-    const processes = new Map();
-    for (const identity of captured) {
-        processes.set(identity.processId, identity);
-    }
-    for (const identity of current) {
-        processes.set(identity.processId, identity);
-    }
-    return [...processes.values()];
+  const processes = /* @__PURE__ */ new Map();
+  for (const identity of captured) {
+    processes.set(identity.processId, identity);
+  }
+  for (const identity of current) {
+    processes.set(identity.processId, identity);
+  }
+  return [...processes.values()];
 }
-export async function captureProcessTree(child) {
-    if (process.platform === "win32" || child.pid === undefined) {
-        return [];
-    }
-    const entries = hostPlatform.readProcessTableSynchronously();
-    if (entries.length > 0) {
-        return selectProcessTree(entries, child.pid);
-    }
-    return selectProcessTree(await readProcessTable(), child.pid);
-}
-function signalCapturedProcessGroups(processes, rootProcessId, signal) {
-    const processIds = new Set(processes.map((identity) => identity.processId));
-    const signalledGroups = new Set();
-    for (const identity of processes) {
-        const isRootProcessGroup = identity.processGroupId === rootProcessId;
-        if ((!isRootProcessGroup && !processIds.has(identity.processGroupId)) ||
-            signalledGroups.has(identity.processGroupId)) {
-            continue;
-        }
-        try {
-            process.kill(-identity.processGroupId, signal);
-            signalledGroups.add(identity.processGroupId);
-        }
-        catch {
-            // A concurrently exited group no longer needs cleanup.
-        }
-    }
-    for (const identity of processes) {
-        if (identity.processId === rootProcessId ||
-            identity.processGroupId === rootProcessId ||
-            signalledGroups.has(identity.processGroupId)) {
-            continue;
-        }
-        try {
-            process.kill(identity.processId, signal);
-        }
-        catch {
-            // A concurrently exited process no longer needs cleanup.
-        }
-    }
+async function captureProcessTree(child) {
+  if (child.pid === void 0) {
+    return [];
+  }
+  const entries = hostPlatform.readProcessTableSynchronously();
+  if (entries.length > 0) {
+    return selectProcessTree(entries, child.pid);
+  }
+  return selectProcessTree(await readProcessTable2(), child.pid);
 }
 async function waitForCapturedProcessesExit(processes, rootProcessId) {
-    const processIds = processes
-        .map((identity) => identity.processId)
-        .filter((processId) => processId !== rootProcessId);
-    for (let attempt = 0; attempt < PROCESS_EXIT_CHECK_ATTEMPTS; attempt += 1) {
-        if (processIds.every((processId) => !hostPlatform.processExists(processId))) {
-            return true;
-        }
-        await readProcessTable();
-    }
-    return processIds.every((processId) => !hostPlatform.processExists(processId));
-}
-function terminateProcess(child) {
-    if (child.exitCode !== null || child.signalCode !== null || child.pid === undefined) {
+  const processIds = processes.map((identity) => identity.processId).filter((processId) => processId !== rootProcessId);
+  for (let attempt = 0; attempt < PROCESS_EXIT_CHECK_ATTEMPTS; attempt += 1) {
+    if (processIds.every((processId) => !hostPlatform.processExists(processId))) {
+      return true;
+    }
+    await readProcessTable2();
+  }
+  return processIds.every((processId) => !hostPlatform.processExists(processId));
+}
+async function stopProcessTree(child, capturedProcesses = []) {
+  const childProcessId = child.pid;
+  if (childProcessId === void 0) {
+    return;
+  }
+  const childExited = child.exitCode !== null || child.signalCode !== null;
+  const processes = mergeProcessTrees(capturedProcesses, await captureProcessTree(child));
+  if (childExited && processes.length === 0) {
+    return;
+  }
+  hostPlatform.signalCapturedProcesses(processes, childProcessId, GRACEFUL_STOP_SIGNAL);
+  hostPlatform.terminateProcess(child, "SIGTERM");
+  const [exitedAfterTermination, descendantsExitedAfterTermination] = await Promise.all([
+    waitForProcessExit(child, PROCESS_GRACEFUL_STOP_TIMEOUT_MILLISECONDS),
+    waitForCapturedProcessesExit(processes, childProcessId)
+  ]);
+  if (exitedAfterTermination && descendantsExitedAfterTermination) {
+    return;
+  }
+  hostPlatform.signalCapturedProcesses(processes, childProcessId, FORCED_STOP_SIGNAL);
+  hostPlatform.terminateProcess(child, "SIGKILL");
+  const [exitedAfterForce, descendantsExitedAfterForce] = await Promise.all([
+    waitForProcessExit(child, PROCESS_FORCED_STOP_TIMEOUT_MILLISECONDS),
+    waitForCapturedProcessesExit(processes, childProcessId)
+  ]);
+  if (!exitedAfterForce || !descendantsExitedAfterForce) {
+    throw new ProcessExecutionError("process_termination_timeout", "The executable process could not be stopped");
+  }
+}
+function waitForProcessExit(child, timeoutMilliseconds) {
+  if (child.exitCode !== null || child.signalCode !== null) {
+    return Promise.resolve(true);
+  }
+  return new Promise((resolveExit) => {
+    let settled = false;
+    const finish = (exited) => {
+      if (settled) {
         return;
+      }
+      settled = true;
+      clearTimeout(timeout);
+      child.removeListener("exit", handleExit);
+      resolveExit(exited);
+    };
+    const handleExit = () => finish(true);
+    const timeout = setTimeout(() => finish(false), timeoutMilliseconds);
+    child.once("exit", handleExit);
+    if (child.exitCode !== null || child.signalCode !== null) {
+      finish(true);
     }
-    if (process.platform !== "win32") {
-        try {
-            process.kill(-child.pid, "SIGTERM");
-            return;
-        }
-        catch {
-            // Fall through when the process did not create a process group.
-        }
-    }
-    child.kill("SIGTERM");
+  });
 }
-function forceTerminateProcess(child) {
-    if (child.exitCode !== null || child.signalCode !== null || child.pid === undefined) {
-        return;
+async function runBoundedProcess(options) {
+  options.signal.throwIfAborted();
+  const outputLimitBytes = options.outputLimitBytes ?? DEFAULT_OUTPUT_LIMIT_BYTES;
+  const launch = executableLaunch2(options.command, options.arguments);
+  const child = spawn(launch.command, [...launch.arguments], {
+    cwd: options.cwd,
+    ...hostPlatform.spawnOptions,
+    env: { ...options.environment },
+    shell: false,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  const stdout = [];
+  const stderr = [];
+  let stdoutBytes = 0;
+  let stderrBytes = 0;
+  let interruptionFailure = null;
+  let interruptionCleanupFailure = null;
+  let stopping = false;
+  const interrupted = Promise.withResolvers();
+  const interrupt = (failure) => {
+    if (stopping) {
+      return;
+    }
+    stopping = true;
+    interruptionFailure = failure;
+    const stop = async () => {
+      try {
+        await stopProcessTree(child);
+      } catch (error) {
+        interruptionCleanupFailure = error instanceof ProcessExecutionError ? error : new ProcessExecutionError(
+          "process_termination_failed",
+          "The executable process could not be stopped",
+          { cause: error }
+        );
+      } finally {
+        interrupted.resolve();
+      }
+    };
+    void stop();
+  };
+  const collectStdout = (chunk) => {
+    if (interruptionFailure !== null) {
+      return;
     }
-    if (process.platform !== "win32") {
-        try {
-            process.kill(-child.pid, "SIGKILL");
-            return;
-        }
-        catch {
-            // Fall through when the process did not create a process group.
-        }
+    try {
+      stdoutBytes = appendBounded(stdout, chunk, stdoutBytes, outputLimitBytes);
+    } catch (error) {
+      const failure = error instanceof ProcessExecutionError ? error : new ProcessExecutionError("process_output_limit", "The executable produced too much output", {
+        cause: error
+      });
+      interrupt(failure);
+    }
+  };
+  const collectStderr = (chunk) => {
+    if (interruptionFailure !== null) {
+      return;
     }
-    child.kill("SIGKILL");
-}
-export async function stopProcessTree(child, capturedProcesses = []) {
-    const childProcessId = child.pid;
-    if (childProcessId === undefined) {
-        return;
+    try {
+      stderrBytes = appendBounded(stderr, chunk, stderrBytes, outputLimitBytes);
+    } catch (error) {
+      const failure = error instanceof ProcessExecutionError ? error : new ProcessExecutionError("process_output_limit", "The executable produced too much output", {
+        cause: error
+      });
+      interrupt(failure);
+    }
+  };
+  child.stdout?.on("data", collectStdout);
+  child.stderr?.on("data", collectStderr);
+  const timeout = setTimeout(() => {
+    interrupt(new ProcessExecutionError("process_timeout", "The executable probe timed out"));
+  }, options.timeoutMilliseconds);
+  const abort = () => interrupt(
+    new ProcessExecutionError("process_cancelled", "The executable probe was cancelled", {
+      cause: options.signal.reason
+    })
+  );
+  options.signal.addEventListener("abort", abort, { once: true });
+  if (options.signal.aborted) {
+    abort();
+  }
+  try {
+    const exit = new Promise((resolveExit, rejectExit) => {
+      child.once("error", rejectExit);
+      child.once("exit", (code) => resolveExit(code ?? 1));
+    });
+    const exitCode = await Promise.race([exit, interrupted.promise.then(() => -1)]);
+    if (interruptionCleanupFailure !== null) {
+      throw interruptionCleanupFailure;
     }
-    const childExited = child.exitCode !== null || child.signalCode !== null;
-    const processes = mergeProcessTrees(capturedProcesses, await captureProcessTree(child));
-    if (childExited && processes.length === 0) {
-        return;
+    if (interruptionFailure !== null) {
+      throw interruptionFailure;
     }
-    signalCapturedProcessGroups(processes, childProcessId, GRACEFUL_STOP_SIGNAL);
-    terminateProcess(child);
-    const [exitedAfterTermination, descendantsExitedAfterTermination] = await Promise.all([
-        waitForProcessExit(child, PROCESS_GRACEFUL_STOP_TIMEOUT_MILLISECONDS),
-        waitForCapturedProcessesExit(processes, childProcessId),
-    ]);
-    if (exitedAfterTermination && descendantsExitedAfterTermination) {
-        return;
+    if (exitCode !== 0) {
+      throw new ProcessExecutionError("process_exit_failed", "The executable probe failed");
     }
-    signalCapturedProcessGroups(processes, childProcessId, FORCED_STOP_SIGNAL);
-    forceTerminateProcess(child);
-    const [exitedAfterForce, descendantsExitedAfterForce] = await Promise.all([
-        waitForProcessExit(child, PROCESS_FORCED_STOP_TIMEOUT_MILLISECONDS),
-        waitForCapturedProcessesExit(processes, childProcessId),
-    ]);
-    if (!exitedAfterForce || !descendantsExitedAfterForce) {
-        throw new ProcessExecutionError("process_termination_timeout", "The executable process could not be stopped");
+    return new ProcessResult(Buffer.concat(stdout).toString("utf8"), Buffer.concat(stderr).toString("utf8"));
+  } catch (error) {
+    if (error instanceof ProcessExecutionError) {
+      throw error;
     }
-}
-function waitForProcessExit(child, timeoutMilliseconds) {
-    if (child.exitCode !== null || child.signalCode !== null) {
-        return Promise.resolve(true);
-    }
-    return new Promise((resolveExit) => {
-        let settled = false;
-        const finish = (exited) => {
-            if (settled) {
-                return;
-            }
-            settled = true;
-            clearTimeout(timeout);
-            child.removeListener("exit", handleExit);
-            resolveExit(exited);
-        };
-        const handleExit = () => finish(true);
-        const timeout = setTimeout(() => finish(false), timeoutMilliseconds);
-        child.once("exit", handleExit);
-        if (child.exitCode !== null || child.signalCode !== null) {
-            finish(true);
-        }
+    throw new ProcessExecutionError("process_spawn_failed", "The executable could not be started", {
+      cause: error
     });
+  } finally {
+    clearTimeout(timeout);
+    options.signal.removeEventListener("abort", abort);
+    child.stdout?.removeListener("data", collectStdout);
+    child.stderr?.removeListener("data", collectStderr);
+    if (stopping) {
+      await interrupted.promise;
+    } else {
+      await stopProcessTree(child);
+    }
+  }
 }
-export async function runBoundedProcess(options) {
-    options.signal.throwIfAborted();
-    const outputLimitBytes = options.outputLimitBytes ?? DEFAULT_OUTPUT_LIMIT_BYTES;
-    const child = spawn(options.command, [...options.arguments], {
-        cwd: options.cwd,
-        detached: process.platform !== "win32",
-        env: { ...options.environment },
-        shell: false,
-        stdio: ["ignore", "pipe", "pipe"],
-    });
-    const stdout = [];
-    const stderr = [];
-    let stdoutBytes = 0;
-    let stderrBytes = 0;
-    let interruptionFailure = null;
-    let interruptionCleanupFailure = null;
-    let stopping = false;
-    const interrupted = Promise.withResolvers();
-    const interrupt = (failure) => {
-        if (stopping) {
-            return;
-        }
-        stopping = true;
-        interruptionFailure = failure;
-        const stop = async () => {
-            try {
-                await stopProcessTree(child);
-            }
-            catch (error) {
-                interruptionCleanupFailure =
-                    error instanceof ProcessExecutionError
-                        ? error
-                        : new ProcessExecutionError("process_termination_failed", "The executable process could not be stopped", { cause: error });
-            }
-            finally {
-                interrupted.resolve();
-            }
-        };
-        void stop();
-    };
-    const collectStdout = (chunk) => {
-        if (interruptionFailure !== null) {
-            return;
-        }
-        try {
-            stdoutBytes = appendBounded(stdout, chunk, stdoutBytes, outputLimitBytes);
-        }
-        catch (error) {
-            const failure = error instanceof ProcessExecutionError
-                ? error
-                : new ProcessExecutionError("process_output_limit", "The executable produced too much output", {
-                    cause: error,
-                });
-            interrupt(failure);
-        }
-    };
-    const collectStderr = (chunk) => {
-        if (interruptionFailure !== null) {
-            return;
-        }
-        try {
-            stderrBytes = appendBounded(stderr, chunk, stderrBytes, outputLimitBytes);
-        }
-        catch (error) {
-            const failure = error instanceof ProcessExecutionError
-                ? error
-                : new ProcessExecutionError("process_output_limit", "The executable produced too much output", {
-                    cause: error,
-                });
-            interrupt(failure);
-        }
-    };
-    child.stdout?.on("data", collectStdout);
-    child.stderr?.on("data", collectStderr);
-    const timeout = setTimeout(() => {
-        interrupt(new ProcessExecutionError("process_timeout", "The executable probe timed out"));
-    }, options.timeoutMilliseconds);
-    const abort = () => interrupt(new ProcessExecutionError("process_cancelled", "The executable probe was cancelled", {
-        cause: options.signal.reason,
-    }));
-    options.signal.addEventListener("abort", abort, { once: true });
-    if (options.signal.aborted) {
-        abort();
-    }
-    try {
-        const exit = new Promise((resolveExit, rejectExit) => {
-            child.once("error", rejectExit);
-            child.once("exit", (code) => resolveExit(code ?? 1));
-        });
-        const exitCode = await Promise.race([exit, interrupted.promise.then(() => -1)]);
-        if (interruptionCleanupFailure !== null) {
-            throw interruptionCleanupFailure;
-        }
-        if (interruptionFailure !== null) {
-            throw interruptionFailure;
-        }
-        if (exitCode !== 0) {
-            throw new ProcessExecutionError("process_exit_failed", "The executable probe failed");
-        }
-        return new ProcessResult(Buffer.concat(stdout).toString("utf8"), Buffer.concat(stderr).toString("utf8"));
-    }
-    catch (error) {
-        if (error instanceof ProcessExecutionError) {
-            throw error;
-        }
-        throw new ProcessExecutionError("process_spawn_failed", "The executable could not be started", {
-            cause: error,
-        });
-    }
-    finally {
-        clearTimeout(timeout);
-        options.signal.removeEventListener("abort", abort);
-        child.stdout?.removeListener("data", collectStdout);
-        child.stderr?.removeListener("data", collectStderr);
-        if (stopping) {
-            await interrupted.promise;
-        }
-        else {
-            await stopProcessTree(child);
-        }
-    }
-}
-//# sourceMappingURL=executable.js.map
+function executableLaunch2(command, args) {
+  return hostPlatform.executableLaunch(command, args);
+}
+var platformSpawnOptions = hostPlatform.spawnOptions;
+export {
+  ExecutableIdentity,
+  ProcessExecutionError,
+  ProcessResult,
+  ResolvedExecutable,
+  captureProcessTree,
+  executableLaunch2 as executableLaunch,
+  findExecutableOnPath,
+  platformSpawnOptions,
+  resolveExecutablePath,
+  revalidateExecutable,
+  runBoundedProcess,
+  stopProcessTree
+};
+//# sourceMappingURL=executable.js.map