@myagentroam/agent 0.11.35 → 0.11.37

package/dist/sandbox/linux/bubblewrap-launch.d.ts

@@ -0,0 +1,11 @@
+import { type ChildProcessWithoutNullStreams } from 'node:child_process';
+export interface LaunchSpec {
+    readonly executable: string;
+    readonly arguments: readonly string[];
+    readonly command: readonly string[];
+    readonly seccomp: Buffer;
+    readonly detached: boolean;
+    readonly signal?: AbortSignal;
+}
+/** Owns startup files, descriptors and the child until successful handoff. */
+export declare function launchBubblewrap(spec: LaunchSpec): Promise<ChildProcessWithoutNullStreams>;

package/dist/sandbox/linux/bubblewrap-launch.js

@@ -0,0 +1,202 @@
+import { spawn } from 'node:child_process';
+import { closeSync, openSync } from 'node:fs';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { AgentError } from '../../error.js';
+import { unavailable, withCleanupDiagnostics } from './sandbox-error.js';
+import { terminateSandboxChild } from './sandbox-process.js';
+/** Owns startup files, descriptors and the child until successful handoff. */
+export async function launchBubblewrap(spec) {
+    spec.signal?.throwIfAborted();
+    let directory;
+    let argumentFd;
+    let seccompFd;
+    let child;
+    let observedClose;
+    let detachObservers;
+    let childExited = false;
+    let childClosed = false;
+    let childError = false;
+    let failure;
+    let failed = false;
+    const cleanupFailures = [];
+    try {
+        directory = await mkdtemp(join(tmpdir(), 'mar-agent-bwrap-launch-'));
+        const argumentPath = join(directory, 'arguments');
+        const seccompPath = join(directory, 'seccomp.bpf');
+        const writes = await Promise.allSettled([
+            writeFile(argumentPath, `${spec.arguments.join('\0')}\0`, { mode: 0o600, flag: 'wx' }),
+            writeFile(seccompPath, spec.seccomp, { mode: 0o600, flag: 'wx' })
+        ]);
+        const rejected = writes.find((result) => result.status === 'rejected');
+        if (rejected?.status === 'rejected')
+            throw rejected.reason;
+        spec.signal?.throwIfAborted();
+        argumentFd = openSync(argumentPath, 'r');
+        seccompFd = openSync(seccompPath, 'r');
+        await rm(directory, { recursive: true, force: true });
+        directory = undefined;
+        spec.signal?.throwIfAborted();
+        const spawnedChild = spawn(spec.executable, ['--args', '3', '--', ...spec.command], {
+            cwd: '/',
+            shell: false,
+            stdio: ['pipe', 'pipe', 'pipe', argumentFd, seccompFd],
+            windowsHide: true,
+            detached: spec.detached,
+            env: { PATH: '/usr/bin:/bin', LANG: 'C.UTF-8', LC_ALL: 'C.UTF-8' }
+        });
+        child = spawnedChild;
+        let resolveClose;
+        observedClose = new Promise((resolve) => {
+            resolveClose = resolve;
+        });
+        const exited = () => {
+            childExited = true;
+        };
+        const closed = () => {
+            childExited = true;
+            childClosed = true;
+            resolveClose();
+        };
+        // Keep an error listener until ownership transfers, including after a spawn error.
+        const ignoreError = () => {
+            childError = true;
+        };
+        child.once('exit', exited);
+        child.once('close', closed);
+        child.on('error', ignoreError);
+        detachObservers = () => {
+            spawnedChild.off('exit', exited);
+            spawnedChild.off('close', closed);
+            spawnedChild.off('error', ignoreError);
+        };
+        await new Promise((resolve, reject) => {
+            const cleanup = () => {
+                spawnedChild.off('spawn', onSpawn);
+                spawnedChild.off('error', onError);
+                spawnedChild.off('exit', onExit);
+                spawnedChild.off('close', onExit);
+                spec.signal?.removeEventListener('abort', onAbort);
+            };
+            const onSpawn = () => {
+                cleanup();
+                resolve();
+            };
+            const onError = () => {
+                cleanup();
+                reject(unavailable());
+            };
+            const onExit = () => {
+                cleanup();
+                reject(unavailable());
+            };
+            const onAbort = () => {
+                cleanup();
+                reject(spec.signal?.reason);
+            };
+            spawnedChild.once('spawn', onSpawn);
+            spawnedChild.once('error', onError);
+            spawnedChild.once('exit', onExit);
+            spawnedChild.once('close', onExit);
+            spec.signal?.addEventListener('abort', onAbort, { once: true });
+            if (spec.signal?.aborted)
+                onAbort();
+        });
+        spec.signal?.throwIfAborted();
+        if (childExited || childError || child.exitCode !== null || child.signalCode !== null)
+            throw unavailable();
+    }
+    catch (error) {
+        failed = true;
+        failure = spec.signal?.aborted ? spec.signal.reason : unavailable();
+    }
+    for (const fd of [argumentFd, seccompFd]) {
+        if (fd === undefined)
+            continue;
+        try {
+            closeSync(fd);
+        }
+        catch {
+            cleanupFailures.push('close');
+        }
+    }
+    if (directory !== undefined) {
+        try {
+            await rm(directory, { recursive: true, force: true });
+        }
+        catch {
+            cleanupFailures.push('remove');
+        }
+    }
+    if (!failed && spec.signal?.aborted) {
+        failed = true;
+        failure = spec.signal.reason;
+    }
+    if (!failed && (childExited || childError)) {
+        failed = true;
+        failure = unavailable();
+    }
+    if (!failed && cleanupFailures.length > 0) {
+        failed = true;
+        failure = unavailable();
+    }
+    if (failed) {
+        try {
+            if (child !== undefined) {
+                // A non-detached child shares the caller's group, which we must not signal.
+                // Direct child termination cannot establish that its descendants exited.
+                if (!spec.detached)
+                    cleanupFailures.push('terminate');
+                try {
+                    if (!terminateSandboxChild(child, spec.detached))
+                        cleanupFailures.push('terminate');
+                }
+                catch {
+                    cleanupFailures.push('terminate');
+                }
+                for (const stream of [child.stdin, child.stdout, child.stderr]) {
+                    try {
+                        stream.destroy();
+                    }
+                    catch {
+                        cleanupFailures.push('close');
+                    }
+                }
+                if (!childClosed && observedClose !== undefined) {
+                    let timer;
+                    const exited = await Promise.race([
+                        observedClose.then(() => true),
+                        new Promise((resolve) => {
+                            timer = setTimeout(() => resolve(false), 1_000);
+                        })
+                    ]);
+                    if (timer !== undefined)
+                        clearTimeout(timer);
+                    if (!exited) {
+                        cleanupFailures.push('exit_timeout');
+                        try {
+                            child.unref();
+                        }
+                        catch {
+                            cleanupFailures.push('terminate');
+                        }
+                    }
+                }
+            }
+        }
+        finally {
+            detachObservers?.();
+            // A process that could not be confirmed dead may still emit an error after return.
+            if (child !== undefined && !childClosed)
+                child.on('error', () => { });
+        }
+        if (spec.signal?.aborted && failure === spec.signal.reason)
+            throw failure;
+        if (failure instanceof AgentError)
+            throw withCleanupDiagnostics(failure, cleanupFailures);
+        throw failure;
+    }
+    detachObservers?.();
+    return child;
+}

package/dist/sandbox/linux/bubblewrap-policy.d.ts

@@ -0,0 +1,5 @@
+import type { LocalProcessSpawnRequest } from '../../process/contracts.js';
+import type { LaunchSpec } from './bubblewrap-launch.js';
+import { type BubblewrapSandboxProfile, type BubblewrapSandboxExecutorOptions } from './profile.js';
+export declare function compileBubblewrapPolicy(options: BubblewrapSandboxExecutorOptions, bubblewrapPath: string, request: LocalProcessSpawnRequest): Promise<LaunchSpec>;
+export declare function snapshotSandboxProfile(inputProfile: BubblewrapSandboxProfile): BubblewrapSandboxProfile;

package/dist/sandbox/linux/bubblewrap-policy.js

@@ -0,0 +1,285 @@
+import { existsSync, lstatSync, readlinkSync } from 'node:fs';
+import { lstat } from 'node:fs/promises';
+import { isAbsolute, posix, relative, resolve, sep } from 'node:path';
+import { AgentError } from '../../error.js';
+import { prepareLocalShellProcess } from '../../host/local-shell.js';
+import { seccompFilter } from './bubblewrap-seccomp.js';
+import { policyInvalid, unavailable } from './sandbox-error.js';
+import { resolveMounts, workingDirectory, trustedRuntimeMounts, sandboxDirectoryArguments, within } from './sandbox-mounts.js';
+import { LINUX_BUBBLEWRAP_SANDBOX_POLICY_VERSION } from './profile.js';
+const SANDBOX_PATH = '/runtime/node/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin';
+const CURSOR_SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/u;
+const SANDBOX_CPU_SECONDS = 300;
+const SANDBOX_PROCESS_LIMIT = 64;
+const SANDBOX_OPEN_FILE_LIMIT = 256;
+const SANDBOX_FILE_SIZE_BYTES = 1024 * 1024 * 1024;
+const SAFE_ENVIRONMENT_NAME = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/u;
+// Fontconfig and LibreOffice resolve required host configuration through absolute /etc paths
+// and /usr symlinks. Keep this allowlist read-only and never broaden it to the full /etc tree.
+const READ_ONLY_SYSTEM_CONFIGURATION_DIRECTORIES = ['/etc/fonts', '/etc/libreoffice'];
+const FORBIDDEN_ENVIRONMENT_NAMES = new Set([
+    'PATH',
+    'HOME',
+    'TMPDIR',
+    'LD_PRELOAD',
+    'LD_LIBRARY_PATH',
+    'NODE_OPTIONS',
+    'PYTHONPATH',
+    'PYTHONHOME',
+    'BASH_ENV',
+    'ENV',
+    'SSH_AUTH_SOCK'
+]);
+export async function compileBubblewrapPolicy(options, bubblewrapPath, request) {
+    request.signal?.throwIfAborted();
+    if (process.platform !== 'linux')
+        throw unavailable();
+    const profile = snapshotSandboxProfile(options.profile);
+    request = {
+        ...request,
+        ...(request.args === undefined ? {} : { args: [...request.args] }),
+        ...(request.runtimeDirectories === undefined || !Array.isArray(request.runtimeDirectories)
+            ? {}
+            : { runtimeDirectories: [...request.runtimeDirectories] }),
+        ...(request.owner === undefined ? {} : { owner: { ...request.owner } })
+    };
+    // Apply the sandbox policy before creating private startup-override variables.
+    const environment = Object.fromEntries(explicitEnvironment(request));
+    const shellRequest = prepareLocalShellProcess({
+        ...request,
+        environment,
+        environmentKeys: Object.keys(environment),
+        environmentOverrides: Object.fromEntries(Object.entries(request.environmentOverrides ?? {})
+            .filter(([name, value]) => SAFE_ENVIRONMENT_NAME.test(name) &&
+            !FORBIDDEN_ENVIRONMENT_NAMES.has(name) &&
+            (value === undefined || Object.hasOwn(environment, name)))
+            .map(([name, value]) => [name, value === undefined ? undefined : environment[name]]))
+    });
+    await validateBackend(bubblewrapPath);
+    const mounts = await resolveMounts(profile);
+    const runtimeMounts = await trustedRuntimeMounts(request.runtimeDirectories ?? [], mounts);
+    const cwd = await workingDirectory(request, mounts, profile.workingDirectory);
+    const command = sandboxCommand(shellRequest, mounts);
+    return {
+        executable: bubblewrapPath,
+        arguments: compileArguments(profile, mounts, cwd, shellRequest, runtimeMounts),
+        command,
+        seccomp: seccompFilter(process.arch),
+        detached: request.detached,
+        ...(request.signal === undefined ? {} : { signal: request.signal })
+    };
+}
+export function snapshotSandboxProfile(inputProfile) {
+    validateProfile(inputProfile);
+    return {
+        ...inputProfile,
+        ...(inputProfile.mounts === undefined
+            ? {}
+            : { mounts: inputProfile.mounts.map((mount) => ({ ...mount })) }),
+        ...(inputProfile.temporaryDirectory === undefined
+            ? {}
+            : { temporaryDirectory: { ...inputProfile.temporaryDirectory } }),
+        ...(inputProfile.workingDirectory === undefined
+            ? {}
+            : { workingDirectory: { ...inputProfile.workingDirectory } })
+    };
+}
+function compileArguments(profile, mounts, cwd, request, runtimeMounts) {
+    const networkMode = profile.networkMode ?? 'NONE';
+    const temporaryDirectory = profile.temporaryDirectory ?? { kind: 'EPHEMERAL' };
+    const args = [
+        '--unshare-user',
+        '--unshare-pid',
+        ...(networkMode === 'UNRESTRICTED' ? [] : ['--unshare-net']),
+        '--unshare-uts',
+        '--unshare-ipc',
+        '--unshare-cgroup-try',
+        '--disable-userns',
+        '--die-with-parent',
+        '--new-session',
+        '--cap-drop',
+        'ALL',
+        '--hostname',
+        'mar-hosted',
+        '--clearenv',
+        '--setenv',
+        'PATH',
+        SANDBOX_PATH,
+        '--setenv',
+        'HOME',
+        '/home/mar',
+        '--setenv',
+        'LANG',
+        'C.UTF-8',
+        '--setenv',
+        'LC_ALL',
+        'C.UTF-8',
+        '--setenv',
+        'TMPDIR',
+        '/tmp',
+        '--tmpfs',
+        '/',
+        ...runtimeMountArguments(),
+        ...sandboxDirectoryArguments(runtimeMounts),
+        ...runtimeMounts.flatMap((mount) => ['--ro-bind', mount.source, mount.destination]),
+        ...sandboxDirectoryArguments(mounts),
+        ...(temporaryDirectory.kind === 'EPHEMERAL' ? ['--tmpfs', '/tmp'] : []),
+        '--proc',
+        '/proc',
+        '--dev',
+        '/dev',
+        '--tmpfs',
+        '/run'
+    ];
+    for (const mount of mounts)
+        args.push(mount.access === 'READ_WRITE' ? '--bind' : '--ro-bind', mount.source, mount.destination);
+    if (request.owner !== undefined) {
+        if (!CURSOR_SAFE_ID.test(request.owner.sessionId) ||
+            (request.owner.executionId !== undefined && !CURSOR_SAFE_ID.test(request.owner.executionId)))
+            throw policyInvalid();
+        args.push('--setenv', 'MAR_AGENT_SESSION_ID', request.owner.sessionId);
+        if (request.owner.executionId !== undefined)
+            args.push('--setenv', 'MAR_AGENT_EXECUTION_ID', request.owner.executionId);
+    }
+    for (const [name, value] of explicitEnvironment(request))
+        args.push('--setenv', name, value);
+    args.push('--seccomp', '4', '--chdir', cwd);
+    return args;
+}
+async function validateBackend(path) {
+    try {
+        const metadata = await lstat(path);
+        if (!metadata.isFile() || metadata.isSymbolicLink() || (metadata.mode & 0o111) === 0)
+            throw unavailable();
+    }
+    catch (error) {
+        if (error instanceof AgentError)
+            throw error;
+        throw unavailable(error);
+    }
+}
+function validateProfile(profile) {
+    if (profile === null ||
+        typeof profile !== 'object' ||
+        profile.policyVersion !== LINUX_BUBBLEWRAP_SANDBOX_POLICY_VERSION ||
+        (profile.networkMode !== undefined &&
+            profile.networkMode !== 'NONE' &&
+            profile.networkMode !== 'UNRESTRICTED') ||
+        (profile.mounts !== undefined && !Array.isArray(profile.mounts)))
+        throw policyInvalid();
+    for (const mount of profile.mounts ?? []) {
+        if (mount === null ||
+            typeof mount !== 'object' ||
+            typeof mount.source !== 'string' ||
+            typeof mount.destination !== 'string' ||
+            (mount.access !== 'READ_ONLY' && mount.access !== 'READ_WRITE'))
+            throw policyInvalid();
+    }
+    const temporaryDirectory = profile.temporaryDirectory;
+    if (temporaryDirectory !== undefined &&
+        (temporaryDirectory === null ||
+            typeof temporaryDirectory !== 'object' ||
+            (temporaryDirectory.kind !== 'EPHEMERAL' &&
+                (temporaryDirectory.kind !== 'MOUNT' || typeof temporaryDirectory.source !== 'string'))))
+        throw policyInvalid();
+    const workingDirectory = profile.workingDirectory;
+    if (workingDirectory !== undefined &&
+        (workingDirectory === null ||
+            typeof workingDirectory !== 'object' ||
+            (workingDirectory.kind !== 'REQUEST' &&
+                (workingDirectory.kind !== 'SANDBOX' || typeof workingDirectory.path !== 'string'))))
+        throw policyInvalid();
+}
+function sandboxCommand(request, mounts) {
+    const command = request.shell === undefined || request.shell === false
+        ? [sandboxExecutable(request.command, mounts), ...(request.args ?? [])]
+        : [
+            sandboxExecutable(typeof request.shell === 'string' ? request.shell : '/bin/sh', mounts),
+            '-c',
+            request.command,
+            ...(request.args ?? [])
+        ];
+    return [
+        '/usr/bin/prlimit',
+        `--cpu=${SANDBOX_CPU_SECONDS}:${SANDBOX_CPU_SECONDS}`,
+        `--nproc=${SANDBOX_PROCESS_LIMIT}:${SANDBOX_PROCESS_LIMIT}`,
+        `--nofile=${SANDBOX_OPEN_FILE_LIMIT}:${SANDBOX_OPEN_FILE_LIMIT}`,
+        `--fsize=${SANDBOX_FILE_SIZE_BYTES}:${SANDBOX_FILE_SIZE_BYTES}`,
+        '--',
+        ...command
+    ];
+}
+function sandboxExecutable(command, mounts) {
+    if (!isAbsolute(command))
+        return command;
+    const canonical = resolve(command);
+    const nodeRuntimeDirectory = resolve(process.execPath, '..', '..');
+    if (nodeRuntimeDirectory !== '/usr' &&
+        (canonical === nodeRuntimeDirectory || within(nodeRuntimeDirectory, canonical))) {
+        const suffix = relative(nodeRuntimeDirectory, canonical).split(sep).filter(Boolean);
+        return suffix.length === 0 ? '/runtime/node' : posix.join('/runtime/node', ...suffix);
+    }
+    const mount = [...mounts]
+        .sort((left, right) => right.source.length - left.source.length)
+        .find((candidate) => canonical === candidate.source || within(candidate.source, canonical));
+    if (mount !== undefined) {
+        const suffix = relative(mount.source, canonical).split(sep).filter(Boolean);
+        return suffix.length === 0 ? mount.destination : posix.join(mount.destination, ...suffix);
+    }
+    if (['/usr', '/bin', '/sbin', '/lib', '/lib64'].some((root) => canonical === root || within(root, canonical)))
+        return canonical;
+    throw policyInvalid();
+}
+function explicitEnvironment(request) {
+    const entries = [];
+    const seen = new Set();
+    for (const name of request.environmentKeys ?? []) {
+        if (seen.has(name))
+            continue;
+        seen.add(name);
+        if (!SAFE_ENVIRONMENT_NAME.test(name))
+            throw policyInvalid();
+        if (FORBIDDEN_ENVIRONMENT_NAMES.has(name))
+            continue;
+        const value = request.environment[name];
+        if (typeof value !== 'string' || value.includes('\0') || Buffer.byteLength(value) > 32_768)
+            throw policyInvalid();
+        entries.push([name, value]);
+    }
+    return entries;
+}
+function runtimeMountArguments() {
+    const args = [];
+    const nodeRuntimeDirectory = resolve(process.execPath, '..', '..');
+    if (nodeRuntimeDirectory !== '/usr')
+        args.push('--dir', '/runtime', '--dir', '/runtime/node', '--ro-bind', nodeRuntimeDirectory, '/runtime/node');
+    for (const path of ['/usr', '/bin', '/sbin', '/lib', '/lib64']) {
+        if (!existsSync(path))
+            continue;
+        const metadata = lstatSync(path);
+        if (metadata.isSymbolicLink())
+            args.push('--symlink', readlinkSync(path), path);
+        else if (metadata.isDirectory())
+            args.push('--ro-bind', path, path);
+    }
+    for (const path of READ_ONLY_SYSTEM_CONFIGURATION_DIRECTORIES) {
+        if (!existsSync(path) || !lstatSync(path).isDirectory())
+            continue;
+        args.push('--ro-bind', path, path);
+    }
+    for (const path of [
+        '/etc/host.conf',
+        '/etc/hosts',
+        '/etc/ld.so.cache',
+        '/etc/resolv.conf',
+        '/etc/passwd',
+        '/etc/group',
+        '/etc/nsswitch.conf',
+        '/etc/localtime',
+        '/etc/ssl/certs'
+    ]) {
+        if (existsSync(path))
+            args.push('--ro-bind', path, path);
+    }
+    return args;
+}

package/dist/sandbox/linux/bubblewrap-probe.d.ts

@@ -0,0 +1,11 @@
+import { type ChildProcessWithoutNullStreams } from 'node:child_process';
+import { type BubblewrapSandboxExecutorOptions } from './profile.js';
+export declare function probeBubblewrapSandbox(options?: {
+    readonly bubblewrapPath?: string;
+    readonly profile?: BubblewrapSandboxExecutorOptions['profile'];
+    readonly cwd?: string;
+}): Promise<{
+    readonly version: string;
+    readonly policyVersion: number;
+}>;
+export declare function waitForProbe(child: ChildProcessWithoutNullStreams): Promise<number | null>;

package/dist/sandbox/linux/bubblewrap-probe.js

@@ -0,0 +1,154 @@
+import { spawn } from 'node:child_process';
+import { BubblewrapSandboxExecutor } from './bubblewrap-sandbox-executor.js';
+import { snapshotSandboxProfile } from './bubblewrap-policy.js';
+import { LINUX_BUBBLEWRAP_SANDBOX_POLICY_VERSION } from './profile.js';
+import { policyInvalid, unavailable, withCleanupDiagnostics } from './sandbox-error.js';
+import { terminateSandboxChild } from './sandbox-process.js';
+const DEFAULT_BUBBLEWRAP_PATH = '/usr/bin/bwrap';
+export async function probeBubblewrapSandbox(options = {}) {
+    if (process.platform !== 'linux')
+        throw unavailable();
+    let bubblewrapPath;
+    let cwd;
+    let profile;
+    try {
+        bubblewrapPath = options.bubblewrapPath ?? DEFAULT_BUBBLEWRAP_PATH;
+        cwd = options.cwd ?? '/';
+        profile = snapshotSandboxProfile(options.profile ?? {
+            policyVersion: LINUX_BUBBLEWRAP_SANDBOX_POLICY_VERSION
+        });
+    }
+    catch {
+        throw policyInvalid();
+    }
+    const versionOutput = await probeVersion(bubblewrapPath);
+    const version = /^bubblewrap\s+([0-9]+(?:\.[0-9]+){1,3})\s*$/u.exec(versionOutput)?.[1];
+    if (version === undefined)
+        throw unavailable();
+    const executor = new BubblewrapSandboxExecutor({
+        bubblewrapPath,
+        profile
+    });
+    const child = await executor.spawn({
+        command: '/bin/true',
+        cwd,
+        shell: false,
+        environment: {},
+        detached: true,
+        owner: { sessionId: 'sandbox-probe', executionId: 'sandbox-probe' }
+    });
+    const result = await waitForProbe(child);
+    if (result !== 0)
+        throw unavailable();
+    return { version, policyVersion: LINUX_BUBBLEWRAP_SANDBOX_POLICY_VERSION };
+}
+async function probeVersion(path) {
+    let child;
+    try {
+        child = spawn(path, ['--version'], {
+            cwd: '/',
+            shell: false,
+            stdio: ['pipe', 'pipe', 'pipe'],
+            detached: true,
+            windowsHide: true,
+            env: { PATH: '/usr/bin:/bin', LANG: 'C.UTF-8', LC_ALL: 'C.UTF-8' }
+        });
+    }
+    catch {
+        throw unavailable();
+    }
+    const chunks = [];
+    let length = 0;
+    const onData = (chunk) => {
+        length += chunk.length;
+        if (length <= 4_096)
+            chunks.push(chunk);
+    };
+    child.stdout.on('data', onData);
+    try {
+        const result = await waitForProbe(child);
+        if (result !== 0 || length > 4_096)
+            throw unavailable();
+        return Buffer.concat(chunks).toString('utf8');
+    }
+    finally {
+        child.stdout.off('data', onData);
+    }
+}
+export async function waitForProbe(child) {
+    child.stdout.resume();
+    child.stderr.resume();
+    child.stdin.end();
+    return await new Promise((resolve, reject) => {
+        let failed = false;
+        let settled = false;
+        let deadline;
+        const cleanupFailures = [];
+        const finish = (code) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            if (deadline !== undefined)
+                clearTimeout(deadline);
+            child.off('error', onError);
+            child.off('close', onClose);
+            if (failed)
+                reject(withCleanupDiagnostics(unavailable(), cleanupFailures));
+            else
+                resolve(code);
+        };
+        const stop = () => {
+            if (failed || settled)
+                return;
+            failed = true;
+            deadline = setTimeout(() => {
+                cleanupFailures.push('exit_timeout');
+                for (const release of [
+                    () => child.stdin.destroy(),
+                    () => child.stdout.destroy(),
+                    () => child.stderr.destroy(),
+                    () => child.unref()
+                ]) {
+                    try {
+                        release();
+                    }
+                    catch {
+                        cleanupFailures.push('terminate');
+                    }
+                }
+                child.on('error', () => { });
+                finish(null);
+            }, 1_000);
+            try {
+                if (!terminateSandboxChild(child, true))
+                    cleanupFailures.push('terminate');
+            }
+            catch {
+                cleanupFailures.push('terminate');
+            }
+        };
+        const timer = setTimeout(() => {
+            stop();
+        }, 5_000);
+        timer.unref();
+        const onError = () => stop();
+        const onClose = (code) => {
+            if (!failed) {
+                try {
+                    if (!terminateSandboxChild(child, true)) {
+                        failed = true;
+                        cleanupFailures.push('terminate');
+                    }
+                }
+                catch {
+                    failed = true;
+                    cleanupFailures.push('terminate');
+                }
+            }
+            finish(code);
+        };
+        child.on('error', onError);
+        child.once('close', onClose);
+    });
+}