@namzu/sandbox 23.0.1 → 25.0.0

package/dist/local-virtual-computer/index.js

@@ -0,0 +1,341 @@
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import { OperationDeadline } from '../backends/readiness.js';
+import { localComputerClients } from './client.js';
+import { containerIdQuery, ensureVolume, hardeningFlags, parsePublishedPorts, portsQuery, resourceFlags, } from './dialect.js';
+import { LocalCommandError, LocalComputerSetupError, resolveLocalEngine, } from './engine.js';
+import { resolveLocalPodmanEngine } from './podman-machine.js';
+import { LocalForwardCleanupError } from './ssh-forward.js';
+import { mapWslcFailure, resolveLocalWslcEngine, wslcSetupError } from './wslc-engine.js';
+export { LocalComputerSetupError, } from './engine.js';
+export const LOCAL_COMPUTER_IMAGE = 'namzu-local-computer:1';
+export const LOCAL_COMPUTER_PROTOCOL_LABEL = 'org.namzu.local-computer.protocol';
+const OWNER_LABEL = 'org.namzu.pal.owner';
+function dimension(value, fallback) {
+    const result = value ?? fallback;
+    if (!Number.isSafeInteger(result) || result < 320 || result > 3840)
+        throw new Error('The Pal display dimensions must be integers between 320 and 3840');
+    return result;
+}
+function ownerFor(palId) {
+    return createHash('sha256').update(palId).digest('hex');
+}
+/**
+ * One readiness probe must not outlive its turn: a published-port relay can
+ * accept a connection before the guest listens and then never answer it.
+ */
+const READINESS_ATTEMPT_MS = 3000;
+async function verifyImage(engine, image, signal) {
+    let images;
+    try {
+        images = JSON.parse(await engine.run(['image', 'inspect', image], { signal }));
+        if (engine.dialect === 'wslc' && images.length === 0)
+            throw wslcSetupError('image-missing');
+    }
+    catch (error) {
+        signal?.throwIfAborted();
+        if (engine.dialect === 'wslc') {
+            if (error instanceof LocalComputerSetupError)
+                throw error;
+            // A missing image makes `image inspect` exit non-zero carrying either
+            // the not-found code or no code at all (observed on wslc 3.0.1). Any
+            // other code (an HRESULT, a spawn errno) or a non-command failure
+            // surfaces as itself, so a crash is not mistaken for missing setup.
+            const mapped = mapWslcFailure(error);
+            if (mapped)
+                throw mapped;
+            if (error instanceof LocalCommandError &&
+                (error.errorCodes.length === 0 || error.errorCodes.includes('WSLC_E_IMAGE_NOT_FOUND')))
+                throw wslcSetupError('image-missing', error);
+            throw error;
+        }
+        throw new LocalComputerSetupError(`The ${image} image is not installed on this local engine. Build packages/sandbox/local-computer/Dockerfile explicitly; Namzu does not pull or build it automatically.`);
+    }
+    if (images[0]?.Os !== 'linux' ||
+        images[0]?.Config?.Labels?.[LOCAL_COMPUTER_PROTOCOL_LABEL] !== '1' ||
+        images[0]?.Config?.User !== '1001:1001')
+        throw new LocalComputerSetupError('The local Pal computer image must declare the Namzu desktop protocol and non-root guest user; rebuild the shipped Dockerfile');
+}
+function portFor(ports, port) {
+    const mappings = ports[`${port}/tcp`];
+    if (!mappings || mappings.length !== 1 || mappings[0]?.HostIp !== '127.0.0.1')
+        throw new Error('The Pal computer control port must be published on IPv4 loopback only');
+    const result = Number(mappings[0].HostPort);
+    if (!Number.isSafeInteger(result) || result < 1 || result > 65535)
+        throw new Error('The Pal computer control port was not allocated');
+    return result;
+}
+/**
+ * A separate guest desktop in a local Linux container. It does not provision
+ * a dedicated-kernel VM and never falls back to the operator's desktop.
+ */
+export function createLocalVirtualComputerProvider(options = {}) {
+    if (options.engine !== undefined &&
+        options.engine !== 'docker' &&
+        options.engine !== 'podman' &&
+        options.engine !== 'wslc')
+        throw new Error('Choose the Docker, Podman or wslc local computer engine');
+    const image = options.image ?? LOCAL_COMPUTER_IMAGE;
+    const normalExitPolicy = options.normalExitPolicy ?? 'computer-lifetime';
+    if (normalExitPolicy !== 'strict' && normalExitPolicy !== 'computer-lifetime')
+        throw new Error('Choose strict or computer-lifetime foreground execution ownership');
+    if (!/^[a-zA-Z0-9][a-zA-Z0-9_./:@-]*$/.test(image))
+        throw new Error('Invalid local Pal image reference');
+    const width = dimension(options.width, 1280);
+    const height = dimension(options.height, 800);
+    const timeout = options.readyTimeoutMs ?? 60_000;
+    if (!Number.isSafeInteger(timeout) || timeout <= 0 || timeout > 2_147_483_647)
+        throw new Error('Invalid Pal computer readiness timeout');
+    const holders = new Set();
+    const pendingCleanup = new Map();
+    let generation = 0;
+    const prepare = async (signal) => {
+        const engine = options.engine === 'podman'
+            ? await resolveLocalPodmanEngine(options, signal)
+            : options.engine === 'wslc'
+                ? await resolveLocalWslcEngine(options, signal)
+                : await resolveLocalEngine(options, signal);
+        await verifyImage(engine, image, signal);
+        return engine;
+    };
+    const dialectOf = (engine) => engine.dialect ?? options.engine ?? 'docker';
+    return {
+        async probe() {
+            try {
+                await new OperationDeadline(timeout, 'local Pal computer probe').run(async (signal) => await prepare(signal));
+                return { ready: true };
+            }
+            catch (error) {
+                return {
+                    ready: false,
+                    // The code lets an application choose its words by what failed, not
+                    // by matching the message. A failure that is not a setup error (a
+                    // timeout, say) carries no code: it is not known to be fixable by setup.
+                    setupCode: error instanceof LocalComputerSetupError ? error.code : undefined,
+                    reason: error instanceof LocalComputerSetupError
+                        ? error.message
+                        : options.engine === 'wslc'
+                            ? 'Linux container support and the Pal computer image are required. Namzu sets them up; finish the setup from the Pal computer and try again.'
+                            : `A local ${options.engine === 'podman' ? 'Podman machine' : 'Docker engine'} running Linux containers and the ${image} image are required. Build packages/sandbox/local-computer/Dockerfile explicitly; Namzu does not install or pull it automatically.`,
+                };
+            }
+        },
+        async acquire(request) {
+            request.signal?.throwIfAborted();
+            if (request.pal.paused)
+                throw new Error('This Pal is paused');
+            if (!request.pal.id || !request.conversationId)
+                throw new Error('A Pal and conversation identity are required');
+            const owner = ownerFor(request.pal.id);
+            if (holders.has(owner)) {
+                const cleanup = pendingCleanup.get(owner);
+                if (!cleanup)
+                    throw new Error('This Pal computer is already in use');
+                try {
+                    await new OperationDeadline(timeout, 'local Pal computer recovery', request.signal).run(async (signal) => await cleanup(signal));
+                }
+                catch {
+                    throw new Error('This Pal computer is already in use by an unconfirmed allocation; cleanup recovery is still required');
+                }
+                pendingCleanup.delete(owner);
+                holders.delete(owner);
+            }
+            holders.add(owner);
+            const name = `namzu-pal-${owner.slice(0, 24)}`;
+            const volume = `namzu-pal-data-${owner}`;
+            const environmentId = `local-container:${owner}`;
+            const token = randomBytes(32).toString('base64url');
+            const allocationId = randomUUID();
+            generation = Math.max(Date.now(), generation + 1);
+            const leaseGeneration = generation;
+            let engine;
+            let created = false;
+            let runAttempted = false;
+            let containerId;
+            let forwarding;
+            let clients;
+            const stop = async (signal) => {
+                if (!engine)
+                    return;
+                // Only the name we successfully created is removed. No volume is
+                // deleted; profile/files survive the next allocation.
+                if (created) {
+                    // Commit the browser profile before removing this allocation.
+                    // Forced removal remains the recovery path if graceful stop fails.
+                    try {
+                        await engine.run(['stop', '--time', '10', containerId ?? name], { signal });
+                    }
+                    catch {
+                        signal?.throwIfAborted();
+                    }
+                    await engine.run(['rm', '-f', containerId ?? name], { signal });
+                    created = false;
+                }
+                await forwarding?.close();
+                holders.delete(owner);
+            };
+            try {
+                const deadline = new OperationDeadline(timeout, 'local Pal computer startup', request.signal);
+                const connected = await deadline.run(async (signal) => {
+                    engine = await prepare(signal);
+                    const dialect = dialectOf(engine);
+                    const occupied = await engine.run(containerIdQuery(dialect, `name=^/${name}$`, { full: false }), { signal });
+                    if (occupied.trim())
+                        throw new Error('An earlier Pal computer allocation still exists; stop it explicitly before reconnecting');
+                    await ensureVolume(engine, dialect, volume, `${OWNER_LABEL}=${owner}`, signal);
+                    const volumes = JSON.parse(await engine.run(['volume', 'inspect', volume], { signal }));
+                    if (volumes[0]?.Labels?.[OWNER_LABEL] !== owner)
+                        throw new Error('The Pal data volume belongs to a different owner');
+                    runAttempted = true;
+                    const started = await engine.run([
+                        'run',
+                        '--detach',
+                        '--pull=never',
+                        // WSL machines can lack delegated cgroup controllers.
+                        // This adapter provides no per-container resource quotas.
+                        ...resourceFlags(dialect),
+                        '--name',
+                        name,
+                        '--label',
+                        `${OWNER_LABEL}=${owner}`,
+                        '--label',
+                        `org.namzu.pal.generation=${leaseGeneration}`,
+                        '--label',
+                        `org.namzu.pal.allocation=${allocationId}`,
+                        '--user',
+                        '1001:1001',
+                        ...hardeningFlags(dialect),
+                        '--network=bridge',
+                        '--shm-size=256m',
+                        '--tmpfs',
+                        '/tmp:rw,nosuid,nodev,size=512m,mode=1777',
+                        '--tmpfs',
+                        '/run:rw,nosuid,nodev,size=16m,mode=1777',
+                        '--mount',
+                        `type=volume,source=${volume},target=/home/namzu`,
+                        '--publish',
+                        '127.0.0.1::2024',
+                        '--publish',
+                        '127.0.0.1::2025',
+                        '--env',
+                        `NAMZU_SANDBOX_SCREEN_WIDTH=${width}`,
+                        '--env',
+                        `NAMZU_SANDBOX_SCREEN_HEIGHT=${height}`,
+                        '--env',
+                        'NAMZU_SANDBOX_TOKEN',
+                        image,
+                    ], { signal, env: { NAMZU_SANDBOX_TOKEN: token } });
+                    created = true;
+                    containerId = started.trim();
+                    if (!/^[0-9a-f]{64}$/.test(containerId))
+                        throw new Error('The Pal computer engine did not return a valid allocation identifier');
+                    const ports = parsePublishedPorts(dialect, await engine.run(portsQuery(dialect, name), { signal }));
+                    const guestPorts = [portFor(ports, 2024), portFor(ports, 2025)];
+                    forwarding = await engine.forwardPorts?.(guestPorts, {
+                        signal,
+                        onLost() {
+                            void clients?.sandbox.destroy().catch(() => {
+                                // Destroy fences calls first; its retained lease can retry recovery.
+                            });
+                        },
+                    });
+                    const localPorts = forwarding?.ports ?? guestPorts;
+                    const executionUrl = `http://127.0.0.1:${localPorts[0]}`;
+                    const desktopUrl = `http://127.0.0.1:${localPorts[1]}`;
+                    for (;;) {
+                        signal.throwIfAborted();
+                        forwarding?.assertAlive();
+                        const attempt = new AbortController();
+                        const attemptTimer = setTimeout(() => attempt.abort(), READINESS_ATTEMPT_MS);
+                        const attemptSignal = AbortSignal.any([signal, attempt.signal]);
+                        try {
+                            const response = await fetch(`${desktopUrl}/readyz`, {
+                                headers: { authorization: `Bearer ${token}` },
+                                signal: attemptSignal,
+                            });
+                            const desktop = response.ok
+                                ? (await response.json())
+                                : undefined;
+                            const execution = await fetch(`${executionUrl}/healthz`, { signal: attemptSignal });
+                            const worker = execution.ok
+                                ? (await execution.json())
+                                : undefined;
+                            if (desktop?.protocol === 1 &&
+                                desktop.width === width &&
+                                desktop.height === height &&
+                                desktop.browserReady === true &&
+                                worker?.protocolVersion === 2)
+                                return {
+                                    executionUrl,
+                                    desktopUrl,
+                                    screenStream: desktop.stream?.protocol === 'rfb',
+                                    heldKeyboard: desktop.heldKeyboard?.version === 1,
+                                };
+                        }
+                        catch {
+                            signal.throwIfAborted();
+                        }
+                        finally {
+                            clearTimeout(attemptTimer);
+                        }
+                        await new Promise((resolve, reject) => {
+                            const timer = setTimeout(() => {
+                                signal.removeEventListener('abort', abort);
+                                resolve();
+                            }, 200);
+                            const abort = () => {
+                                clearTimeout(timer);
+                                reject(signal.reason);
+                            };
+                            signal.addEventListener('abort', abort, { once: true });
+                        });
+                    }
+                });
+                request.signal?.throwIfAborted();
+                clients = localComputerClients({
+                    ...connected,
+                    normalExitPolicy,
+                    token,
+                    geometry: { width, height, scaleFactor: 1 },
+                    stop,
+                });
+                const admitted = clients;
+                return {
+                    palId: request.pal.id,
+                    environmentId,
+                    generation: leaseGeneration,
+                    ...admitted,
+                    release: () => admitted.sandbox.destroy(),
+                };
+            }
+            catch (error) {
+                if (error instanceof LocalForwardCleanupError)
+                    forwarding = error.forward;
+                if (runAttempted && engine) {
+                    const ownedEngine = engine;
+                    const cleanup = async (signal) => {
+                        // Reconcile an unacknowledged start by this attempt's unique
+                        // label, never by a name another process may have acquired.
+                        const owned = await ownedEngine.run(containerIdQuery(dialectOf(ownedEngine), `label=org.namzu.pal.allocation=${allocationId}`, { full: true }), { signal });
+                        for (const id of owned.trim().split(/\s+/).filter(Boolean)) {
+                            if (!/^[0-9a-f]{64}$/.test(id))
+                                throw new Error('Invalid owned allocation identifier');
+                            await ownedEngine.run(['rm', '-f', id], { signal });
+                        }
+                        created = false;
+                        await forwarding?.close();
+                    };
+                    try {
+                        await new OperationDeadline(timeout, 'local Pal computer cleanup').run(async (signal) => await cleanup(signal));
+                    }
+                    catch {
+                        pendingCleanup.set(owner, cleanup);
+                        throw new Error('Pal computer startup failed and cleanup could not be confirmed; the owned allocation requires operator recovery', { cause: error });
+                    }
+                }
+                holders.delete(owner);
+                throw error;
+            }
+        },
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/local-virtual-computer/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/local-virtual-computer/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAEjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EACN,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,UAAU,EACV,aAAa,GACb,MAAM,cAAc,CAAA;AACrB,OAAO,EAEN,iBAAiB,EAEjB,uBAAuB,EAGvB,kBAAkB,GAClB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAGzF,OAAO,EAEN,uBAAuB,GAEvB,MAAM,aAAa,CAAA;AAEpB,MAAM,CAAC,MAAM,oBAAoB,GAAG,wBAAwB,CAAA;AAC5D,MAAM,CAAC,MAAM,6BAA6B,GAAG,mCAAmC,CAAA;AAChF,MAAM,WAAW,GAAG,qBAAqB,CAAA;AA2BzC,SAAS,SAAS,CAAC,KAAyB,EAAE,QAAgB;IAC7D,MAAM,MAAM,GAAG,KAAK,IAAI,QAAQ,CAAA;IAChC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,GAAG,IAAI;QACjE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;IACpF,OAAO,MAAM,CAAA;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,oBAAoB,GAAG,IAAI,CAAA;AAEjC,KAAK,UAAU,WAAW,CACzB,MAAmB,EACnB,KAAa,EACb,MAAoB;IAEpB,IAAI,MAGD,CAAA;IACH,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAkB,CAAA;QAC/F,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,cAAc,CAAC,eAAe,CAAC,CAAA;IAC5F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAC/B,IAAI,KAAK,YAAY,uBAAuB;gBAAE,MAAM,KAAK,CAAA;YACzD,sEAAsE;YACtE,qEAAqE;YACrE,kEAAkE;YAClE,oEAAoE;YACpE,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;YACpC,IAAI,MAAM;gBAAE,MAAM,MAAM,CAAA;YACxB,IACC,KAAK,YAAY,iBAAiB;gBAClC,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC;gBAEtF,MAAM,cAAc,CAAC,eAAe,EAAE,KAAK,CAAC,CAAA;YAC7C,MAAM,KAAK,CAAA;QACZ,CAAC;QACD,MAAM,IAAI,uBAAuB,CAChC,OAAO,KAAK,2JAA2J,CACvK,CAAA;IACF,CAAC;IACD,IACC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,OAAO;QACzB,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,6BAA6B,CAAC,KAAK,GAAG;QAClE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,KAAK,WAAW;QAEvC,MAAM,IAAI,uBAAuB,CAChC,8HAA8H,CAC9H,CAAA;AACH,CAAC;AAED,SAAS,OAAO,CACf,KAA+D,EAC/D,IAAY;IAEZ,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,CAAA;IACrC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,WAAW;QAC5E,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAA;IACzF,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC3C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,KAAK;QAChE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IACnE,OAAO,MAAM,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kCAAkC,CACjD,UAAuC,EAAE;IAEzC,IACC,OAAO,CAAC,MAAM,KAAK,SAAS;QAC5B,OAAO,CAAC,MAAM,KAAK,QAAQ;QAC3B,OAAO,CAAC,MAAM,KAAK,QAAQ;QAC3B,OAAO,CAAC,MAAM,KAAK,MAAM;QAEzB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC3E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,oBAAoB,CAAA;IACnD,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,mBAAmB,CAAA;IACxE,IAAI,gBAAgB,KAAK,QAAQ,IAAI,gBAAgB,KAAK,mBAAmB;QAC5E,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAA;IACrF,IAAI,CAAC,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;IACrD,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,IAAI,MAAM,CAAA;IAChD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,OAAO,GAAG,aAAa;QAC5E,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC1D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IACjC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAmD,CAAA;IACjF,IAAI,UAAU,GAAG,CAAC,CAAA;IAClB,MAAM,OAAO,GAAG,KAAK,EAAE,MAAoB,EAAE,EAAE;QAC9C,MAAM,MAAM,GACX,OAAO,CAAC,MAAM,KAAK,QAAQ;YAC1B,CAAC,CAAC,MAAM,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC;YACjD,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM;gBAC1B,CAAC,CAAC,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC;gBAC/C,CAAC,CAAC,MAAM,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC9C,MAAM,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;QACxC,OAAO,MAAM,CAAA;IACd,CAAC,CAAA;IACD,MAAM,SAAS,GAAG,CAAC,MAAmB,EAAiB,EAAE,CACxD,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAA;IAC7C,OAAO;QACN,KAAK,CAAC,KAAK;YACV,IAAI,CAAC;gBACJ,MAAM,IAAI,iBAAiB,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC,GAAG,CACnE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CACvC,CAAA;gBACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;YACvB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,OAAO;oBACN,KAAK,EAAE,KAAK;oBACZ,oEAAoE;oBACpE,kEAAkE;oBAClE,yEAAyE;oBACzE,SAAS,EAAE,KAAK,YAAY,uBAAuB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;oBAC5E,MAAM,EACL,KAAK,YAAY,uBAAuB;wBACvC,CAAC,CAAC,KAAK,CAAC,OAAO;wBACf,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM;4BAC1B,CAAC,CAAC,4IAA4I;4BAC9I,CAAC,CAAC,WAAW,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,eAAe,qCAAqC,KAAK,oIAAoI;iBAC9P,CAAA;YACF,CAAC;QACF,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,OAA8B;YAC3C,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;YAChC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;YAC7D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc;gBAC7C,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;YAChE,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACtC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxB,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;gBACzC,IAAI,CAAC,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;gBACpE,IAAI,CAAC;oBACJ,MAAM,IAAI,iBAAiB,CAAC,OAAO,EAAE,6BAA6B,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CACtF,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CACvC,CAAA;gBACF,CAAC;gBAAC,MAAM,CAAC;oBACR,MAAM,IAAI,KAAK,CACd,sGAAsG,CACtG,CAAA;gBACF,CAAC;gBACD,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;gBAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACtB,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YAClB,MAAM,IAAI,GAAG,aAAa,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAA;YAC9C,MAAM,MAAM,GAAG,kBAAkB,KAAK,EAAE,CAAA;YACxC,MAAM,aAAa,GAAG,mBAAmB,KAAK,EAAE,CAAA;YAChD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;YACnD,MAAM,YAAY,GAAG,UAAU,EAAE,CAAA;YACjC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,UAAU,GAAG,CAAC,CAAC,CAAA;YACjD,MAAM,eAAe,GAAG,UAAU,CAAA;YAClC,IAAI,MAA+B,CAAA;YACnC,IAAI,OAAO,GAAG,KAAK,CAAA;YACnB,IAAI,YAAY,GAAG,KAAK,CAAA;YACxB,IAAI,WAA+B,CAAA;YACnC,IAAI,UAAwC,CAAA;YAC5C,IAAI,OAA4D,CAAA;YAChE,MAAM,IAAI,GAAG,KAAK,EAAE,MAAoB,EAAE,EAAE;gBAC3C,IAAI,CAAC,MAAM;oBAAE,OAAM;gBACnB,iEAAiE;gBACjE,sDAAsD;gBACtD,IAAI,OAAO,EAAE,CAAC;oBACb,8DAA8D;oBAC9D,mEAAmE;oBACnE,IAAI,CAAC;wBACJ,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,IAAI,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;oBAC5E,CAAC;oBAAC,MAAM,CAAC;wBACR,MAAM,EAAE,cAAc,EAAE,CAAA;oBACzB,CAAC;oBACD,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,IAAI,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;oBAC/D,OAAO,GAAG,KAAK,CAAA;gBAChB,CAAC;gBACD,MAAM,UAAU,EAAE,KAAK,EAAE,CAAA;gBACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACtB,CAAC,CAAA;YACD,IAAI,CAAC;gBACJ,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CACrC,OAAO,EACP,4BAA4B,EAC5B,OAAO,CAAC,MAAM,CACd,CAAA;gBACD,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;oBACrD,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;oBAC9B,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;oBACjC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAChC,gBAAgB,CAAC,OAAO,EAAE,UAAU,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAC7D,EAAE,MAAM,EAAE,CACV,CAAA;oBACD,IAAI,QAAQ,CAAC,IAAI,EAAE;wBAClB,MAAM,IAAI,KAAK,CACd,yFAAyF,CACzF,CAAA;oBACF,MAAM,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,WAAW,IAAI,KAAK,EAAE,EAAE,MAAM,CAAC,CAAA;oBAC9E,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACzB,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAClB,CAAA;oBAC1C,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,KAAK;wBAC9C,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;oBACpE,YAAY,GAAG,IAAI,CAAA;oBACnB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAC/B;wBACC,KAAK;wBACL,UAAU;wBACV,cAAc;wBACd,sDAAsD;wBACtD,0DAA0D;wBAC1D,GAAG,aAAa,CAAC,OAAO,CAAC;wBACzB,QAAQ;wBACR,IAAI;wBACJ,SAAS;wBACT,GAAG,WAAW,IAAI,KAAK,EAAE;wBACzB,SAAS;wBACT,4BAA4B,eAAe,EAAE;wBAC7C,SAAS;wBACT,4BAA4B,YAAY,EAAE;wBAC1C,QAAQ;wBACR,WAAW;wBACX,GAAG,cAAc,CAAC,OAAO,CAAC;wBAC1B,kBAAkB;wBAClB,iBAAiB;wBACjB,SAAS;wBACT,0CAA0C;wBAC1C,SAAS;wBACT,yCAAyC;wBACzC,SAAS;wBACT,sBAAsB,MAAM,qBAAqB;wBACjD,WAAW;wBACX,iBAAiB;wBACjB,WAAW;wBACX,iBAAiB;wBACjB,OAAO;wBACP,8BAA8B,KAAK,EAAE;wBACrC,OAAO;wBACP,+BAA+B,MAAM,EAAE;wBACvC,OAAO;wBACP,qBAAqB;wBACrB,KAAK;qBACL,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE,CAC/C,CAAA;oBACD,OAAO,GAAG,IAAI,CAAA;oBACd,WAAW,GAAG,OAAO,CAAC,IAAI,EAAE,CAAA;oBAC5B,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC;wBACtC,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAA;oBACxF,MAAM,KAAK,GAAG,mBAAmB,CAChC,OAAO,EACP,MAAM,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CACvD,CAAA;oBACD,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;oBAC/D,UAAU,GAAG,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE;wBACpD,MAAM;wBACN,MAAM;4BACL,KAAK,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gCAC1C,qEAAqE;4BACtE,CAAC,CAAC,CAAA;wBACH,CAAC;qBACD,CAAC,CAAA;oBACF,MAAM,UAAU,GAAG,UAAU,EAAE,KAAK,IAAI,UAAU,CAAA;oBAClD,MAAM,YAAY,GAAG,oBAAoB,UAAU,CAAC,CAAC,CAAC,EAAE,CAAA;oBACxD,MAAM,UAAU,GAAG,oBAAoB,UAAU,CAAC,CAAC,CAAC,EAAE,CAAA;oBACtD,SAAS,CAAC;wBACT,MAAM,CAAC,cAAc,EAAE,CAAA;wBACvB,UAAU,EAAE,WAAW,EAAE,CAAA;wBACzB,MAAM,OAAO,GAAG,IAAI,eAAe,EAAE,CAAA;wBACrC,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,oBAAoB,CAAC,CAAA;wBAC5E,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;wBAC/D,IAAI,CAAC;4BACJ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,SAAS,EAAE;gCACpD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;gCAC7C,MAAM,EAAE,aAAa;6BACrB,CAAC,CAAA;4BACF,MAAM,OAAO,GAAG,QAAQ,CAAC,EAAE;gCAC1B,CAAC,CAAE,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAOtB;gCACH,CAAC,CAAC,SAAS,CAAA;4BACZ,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,YAAY,UAAU,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAA;4BACnF,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE;gCAC1B,CAAC,CAAE,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAAkC;gCAC5D,CAAC,CAAC,SAAS,CAAA;4BACZ,IACC,OAAO,EAAE,QAAQ,KAAK,CAAC;gCACvB,OAAO,CAAC,KAAK,KAAK,KAAK;gCACvB,OAAO,CAAC,MAAM,KAAK,MAAM;gCACzB,OAAO,CAAC,YAAY,KAAK,IAAI;gCAC7B,MAAM,EAAE,eAAe,KAAK,CAAC;gCAE7B,OAAO;oCACN,YAAY;oCACZ,UAAU;oCACV,YAAY,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,KAAK,KAAK;oCAChD,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,OAAO,KAAK,CAAC;iCACjD,CAAA;wBACH,CAAC;wBAAC,MAAM,CAAC;4BACR,MAAM,CAAC,cAAc,EAAE,CAAA;wBACxB,CAAC;gCAAS,CAAC;4BACV,YAAY,CAAC,YAAY,CAAC,CAAA;wBAC3B,CAAC;wBACD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;4BAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gCAC7B,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;gCAC1C,OAAO,EAAE,CAAA;4BACV,CAAC,EAAE,GAAG,CAAC,CAAA;4BACP,MAAM,KAAK,GAAG,GAAG,EAAE;gCAClB,YAAY,CAAC,KAAK,CAAC,CAAA;gCACnB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;4BACtB,CAAC,CAAA;4BACD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;wBACxD,CAAC,CAAC,CAAA;oBACH,CAAC;gBACF,CAAC,CAAC,CAAA;gBACF,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;gBAChC,OAAO,GAAG,oBAAoB,CAAC;oBAC9B,GAAG,SAAS;oBACZ,gBAAgB;oBAChB,KAAK;oBACL,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE;oBAC3C,IAAI;iBACJ,CAAC,CAAA;gBACF,MAAM,QAAQ,GAAG,OAAO,CAAA;gBACxB,OAAO;oBACN,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE;oBACrB,aAAa;oBACb,UAAU,EAAE,eAAe;oBAC3B,GAAG,QAAQ;oBACX,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE;iBACzC,CAAA;YACF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,KAAK,YAAY,wBAAwB;oBAAE,UAAU,GAAG,KAAK,CAAC,OAAO,CAAA;gBACzE,IAAI,YAAY,IAAI,MAAM,EAAE,CAAC;oBAC5B,MAAM,WAAW,GAAG,MAAM,CAAA;oBAC1B,MAAM,OAAO,GAAG,KAAK,EAAE,MAAoB,EAAE,EAAE;wBAC9C,6DAA6D;wBAC7D,4DAA4D;wBAC5D,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,CAClC,gBAAgB,CACf,SAAS,CAAC,WAAW,CAAC,EACtB,kCAAkC,YAAY,EAAE,EAChD,EAAE,IAAI,EAAE,IAAI,EAAE,CACd,EACD,EAAE,MAAM,EAAE,CACV,CAAA;wBACD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;4BAC5D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;gCAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;4BACtF,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;wBACpD,CAAC;wBACD,OAAO,GAAG,KAAK,CAAA;wBACf,MAAM,UAAU,EAAE,KAAK,EAAE,CAAA;oBAC1B,CAAC,CAAA;oBACD,IAAI,CAAC;wBACJ,MAAM,IAAI,iBAAiB,CAAC,OAAO,EAAE,4BAA4B,CAAC,CAAC,GAAG,CACrE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CACvC,CAAA;oBACF,CAAC;oBAAC,MAAM,CAAC;wBACR,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;wBAClC,MAAM,IAAI,KAAK,CACd,iHAAiH,EACjH,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAA;oBACF,CAAC;gBACF,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;gBACrB,MAAM,KAAK,CAAA;YACZ,CAAC;QACF,CAAC;KACD,CAAA;AACF,CAAC"}

package/dist/local-virtual-computer/podman-machine.d.ts

@@ -0,0 +1,17 @@
+import { type LocalComputerCommandRunner, type LocalEngine } from './engine.js';
+interface PodmanMachineOptions {
+    readonly podmanBinary?: string;
+    readonly podmanMachine?: string;
+    readonly podmanConnection?: string;
+    readonly engineEndpoint?: string;
+    readonly runner?: LocalComputerCommandRunner;
+}
+/**
+ * Admit only a registered Windows WSL Podman machine. Its SSH connection is a
+ * local machine transport, not permission to select an arbitrary remote daemon.
+ * Capture its verified URL and identity so later named-connection edits cannot
+ * redirect an allocation. Never start, initialize or configure the machine.
+ */
+export declare function resolveLocalPodmanEngine(options: PodmanMachineOptions, signal?: AbortSignal, platform?: NodeJS.Platform): Promise<LocalEngine>;
+export {};
+//# sourceMappingURL=podman-machine.d.ts.map

package/dist/local-virtual-computer/podman-machine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"podman-machine.d.ts","sourceRoot":"","sources":["../../src/local-virtual-computer/podman-machine.ts"],"names":[],"mappings":"AAGA,OAAO,EACN,KAAK,0BAA0B,EAE/B,KAAK,WAAW,EAEhB,MAAM,aAAa,CAAA;AAGpB,UAAU,oBAAoB;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,0BAA0B,CAAA;CAC5C;AAiCD;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC7C,OAAO,EAAE,oBAAoB,EAC7B,MAAM,CAAC,EAAE,WAAW,EACpB,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC1C,OAAO,CAAC,WAAW,CAAC,CA2MtB"}

package/dist/local-virtual-computer/podman-machine.js

@@ -0,0 +1,181 @@
+import { lstat, realpath } from 'node:fs/promises';
+import { createConnection } from 'node:net';
+import { win32 } from 'node:path';
+import { LocalComputerSetupError, nodeCommandRunner, } from './engine.js';
+import { startLocalSshForward } from './ssh-forward.js';
+async function confirmLocalPipe(path, signal) {
+    signal?.throwIfAborted();
+    await new Promise((resolve, reject) => {
+        const socket = createConnection(path);
+        const abort = () => {
+            socket.destroy();
+            reject(signal?.reason);
+        };
+        const finish = (error) => {
+            signal?.removeEventListener('abort', abort);
+            socket.destroy();
+            if (error)
+                reject(new LocalComputerSetupError('The selected local Podman machine pipe is unavailable; start that machine explicitly'));
+            else
+                resolve();
+        };
+        socket.once('connect', () => finish());
+        socket.once('error', finish);
+        signal?.addEventListener('abort', abort, { once: true });
+        if (signal?.aborted)
+            abort();
+    });
+}
+function insideProfile(path, profile) {
+    const relative = win32.relative(profile, path);
+    return !win32.isAbsolute(relative) && relative !== '..' && !relative.startsWith('..\\');
+}
+/**
+ * Admit only a registered Windows WSL Podman machine. Its SSH connection is a
+ * local machine transport, not permission to select an arbitrary remote daemon.
+ * Capture its verified URL and identity so later named-connection edits cannot
+ * redirect an allocation. Never start, initialize or configure the machine.
+ */
+export async function resolveLocalPodmanEngine(options, signal, platform = process.platform) {
+    if (platform !== 'win32')
+        throw new LocalComputerSetupError('The Podman computer adapter requires a locally registered Windows WSL machine');
+    const machineName = options.podmanMachine;
+    const connectionName = options.podmanConnection;
+    if (!machineName ||
+        !connectionName ||
+        !/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/.test(machineName) ||
+        !/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/.test(connectionName))
+        throw new LocalComputerSetupError('Select an existing Podman machine and its registered connection explicitly');
+    if (options.engineEndpoint)
+        throw new LocalComputerSetupError('Podman machine transport is verified from local registration; an arbitrary engine endpoint is refused');
+    const selectedBinary = options.podmanBinary ?? 'podman';
+    const binary = /[\\/]|^[a-zA-Z]:/.test(selectedBinary)
+        ? win32.resolve(process.cwd(), selectedBinary)
+        : selectedBinary;
+    // Native Podman probes /proc/self/uid_map even in remote mode. A WSL UNC
+    // caller directory produces ERROR_DIRECTORY rather than a missing file,
+    // which Podman treats as fatal. Pin this transport to a native directory
+    // without changing the embedding application's working directory.
+    const profile = process.env.USERPROFILE;
+    if (!profile || !/^[a-zA-Z]:[\\/]/.test(profile))
+        throw new LocalComputerSetupError('The Podman machine requires an existing native Windows operator profile directory');
+    const realProfile = await realpath(profile);
+    if (!/^[a-zA-Z]:[\\/]/.test(realProfile) || !(await lstat(realProfile)).isDirectory())
+        throw new LocalComputerSetupError('The Podman machine requires an existing native Windows operator profile directory');
+    const runner = options.runner ?? nodeCommandRunner;
+    const machines = JSON.parse(await runner.run(binary, ['machine', 'list', '--format', 'json'], {
+        signal,
+        cwd: realProfile,
+    }));
+    if (machines.find((machine) => machine.Name === machineName)?.VMType !== 'wsl')
+        throw new LocalComputerSetupError('The selected Podman machine must be registered locally with the Windows WSL provider');
+    const inspected = JSON.parse(await runner.run(binary, ['machine', 'inspect', machineName, '--format', '{{json .}}'], {
+        signal,
+        cwd: realProfile,
+    }));
+    if (inspected.Name !== machineName || inspected.State !== 'running')
+        throw new LocalComputerSetupError('The selected Podman machine is stopped or unavailable; start it explicitly');
+    const registrations = await runner.run(win32.join(process.env.SystemRoot ?? 'C:\\Windows', 'System32', 'wsl.exe'), ['--list', '--quiet'], { signal, cwd: realProfile });
+    if (!registrations
+        .split(/\r?\n/)
+        .some((name) => name.trim().toLowerCase() === machineName.toLowerCase()))
+        throw new LocalComputerSetupError('The selected Podman machine is not a registered local WSL distribution');
+    const pipe = inspected.ConnectionInfo?.PodmanPipe?.Path;
+    if (pipe !== `\\\\.\\pipe\\${machineName}`)
+        throw new LocalComputerSetupError('The Podman machine must own its matching local Windows named pipe');
+    const identity = inspected.SSHConfig?.IdentityPath;
+    const configDir = inspected.ConfigDir?.Path;
+    if (!identity || !configDir || !win32.isAbsolute(identity) || !win32.isAbsolute(configDir))
+        throw new LocalComputerSetupError('The Podman machine must belong to the current Windows operator profile');
+    const [realIdentity, realConfig] = await Promise.all([
+        realpath(win32.normalize(identity)),
+        realpath(win32.normalize(configDir)),
+    ]);
+    if (!insideProfile(realIdentity, realProfile) ||
+        !insideProfile(realConfig, realProfile) ||
+        !(await lstat(realIdentity)).isFile())
+        throw new LocalComputerSetupError('The Podman machine identity and configuration must remain inside the current Windows operator profile');
+    const connections = JSON.parse(await runner.run(binary, ['system', 'connection', 'list', '--format', 'json'], {
+        signal,
+        cwd: realProfile,
+    }));
+    const connection = connections.find((candidate) => candidate.Name === connectionName);
+    let url;
+    try {
+        url = new URL(connection?.URI ?? '');
+    }
+    catch {
+        throw new LocalComputerSetupError('The selected Podman machine connection is invalid');
+    }
+    const expectedUser = inspected.Rootful ? 'root' : inspected.SSHConfig?.RemoteUsername;
+    const port = inspected.SSHConfig?.Port;
+    if (!connection?.IsMachine ||
+        connection.ReadWrite !== true ||
+        !connection.Identity ||
+        win32.normalize(connection.Identity).toLowerCase() !==
+            win32.normalize(realIdentity).toLowerCase() ||
+        !Number.isSafeInteger(port) ||
+        Number(port) < 1 ||
+        Number(port) > 65535 ||
+        url.protocol !== 'ssh:' ||
+        url.hostname !== '127.0.0.1' ||
+        Number(url.port) !== port ||
+        !expectedUser ||
+        url.username !== expectedUser ||
+        url.password ||
+        url.search ||
+        url.hash ||
+        (inspected.Rootful
+            ? url.pathname !== '/run/podman/podman.sock'
+            : !/^\/run\/user\/\d+\/podman\/podman\.sock$/.test(url.pathname)))
+        throw new LocalComputerSetupError('The Podman connection must match the selected local WSL machine identity, port, user and socket; remote connections are refused');
+    await confirmLocalPipe(pipe, signal);
+    const endpoint = `npipe:////./pipe/${machineName}`;
+    const run = (args, call) => {
+        const env = { ...process.env, ...call?.env };
+        for (const name of [
+            'CONTAINER_HOST',
+            'CONTAINER_CONNECTION',
+            'CONTAINER_SSHKEY',
+            'DOCKER_HOST',
+            'DOCKER_CONTEXT',
+        ])
+            env[name] = undefined;
+        return runner.run(binary, ['--url', url.href, '--identity', realIdentity, ...args], {
+            ...call,
+            env,
+            cwd: realProfile,
+        });
+    };
+    const info = JSON.parse(await run(['info', '--format', 'json'], { signal }));
+    if (info.host?.os !== 'linux')
+        throw new LocalComputerSetupError('The selected local Podman machine must run Linux containers');
+    return {
+        endpoint,
+        run,
+        async forwardPorts(ports, call) {
+            const key = (await runner.run(win32.join(process.env.SystemRoot ?? 'C:\\Windows', 'System32', 'wsl.exe'), [
+                '--distribution',
+                machineName,
+                '--user',
+                'root',
+                '--exec',
+                'cat',
+                '/etc/ssh/ssh_host_ed25519_key.pub',
+            ], { signal: call.signal, cwd: realProfile }))
+                .trim()
+                .split(/\s+/)
+                .slice(0, 2)
+                .join(' ');
+            return await startLocalSshForward({
+                identity: realIdentity,
+                port: Number(port),
+                user: expectedUser,
+                hostPublicKey: key,
+                ports,
+                ...call,
+            });
+        },
+    };
+}
+//# sourceMappingURL=podman-machine.js.map

package/dist/local-virtual-computer/podman-machine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"podman-machine.js","sourceRoot":"","sources":["../../src/local-virtual-computer/podman-machine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AACjC,OAAO,EAEN,uBAAuB,EAEvB,iBAAiB,GACjB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAUvD,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,MAAoB;IACjE,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;QACrC,MAAM,KAAK,GAAG,GAAG,EAAE;YAClB,MAAM,CAAC,OAAO,EAAE,CAAA;YAChB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACvB,CAAC,CAAA;QACD,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE;YAChC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YAC3C,MAAM,CAAC,OAAO,EAAE,CAAA;YAChB,IAAI,KAAK;gBACR,MAAM,CACL,IAAI,uBAAuB,CAC1B,sFAAsF,CACtF,CACD,CAAA;;gBACG,OAAO,EAAE,CAAA;QACf,CAAC,CAAA;QACD,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAA;QACtC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC5B,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACxD,IAAI,MAAM,EAAE,OAAO;YAAE,KAAK,EAAE,CAAA;IAC7B,CAAC,CAAC,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,OAAe;IACnD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAC9C,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AACxF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,OAA6B,EAC7B,MAAoB,EACpB,WAA4B,OAAO,CAAC,QAAQ;IAE5C,IAAI,QAAQ,KAAK,OAAO;QACvB,MAAM,IAAI,uBAAuB,CAChC,+EAA+E,CAC/E,CAAA;IACF,MAAM,WAAW,GAAG,OAAO,CAAC,aAAa,CAAA;IACzC,MAAM,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAA;IAC/C,IACC,CAAC,WAAW;QACZ,CAAC,cAAc;QACf,CAAC,oCAAoC,CAAC,IAAI,CAAC,WAAW,CAAC;QACvD,CAAC,oCAAoC,CAAC,IAAI,CAAC,cAAc,CAAC;QAE1D,MAAM,IAAI,uBAAuB,CAChC,4EAA4E,CAC5E,CAAA;IACF,IAAI,OAAO,CAAC,cAAc;QACzB,MAAM,IAAI,uBAAuB,CAChC,uGAAuG,CACvG,CAAA;IACF,MAAM,cAAc,GAAG,OAAO,CAAC,YAAY,IAAI,QAAQ,CAAA;IACvD,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,cAAc,CAAC;QACrD,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC;QAC9C,CAAC,CAAC,cAAc,CAAA;IACjB,yEAAyE;IACzE,wEAAwE;IACxE,yEAAyE;IACzE,kEAAkE;IAClE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAA;IACvC,IAAI,CAAC,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;QAC/C,MAAM,IAAI,uBAAuB,CAChC,mFAAmF,CACnF,CAAA;IACF,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC3C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,EAAE;QACpF,MAAM,IAAI,uBAAuB,CAChC,mFAAmF,CACnF,CAAA;IACF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,iBAAiB,CAAA;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAC1B,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE;QACjE,MAAM;QACN,GAAG,EAAE,WAAW;KAChB,CAAC,CACsC,CAAA;IACzC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC,EAAE,MAAM,KAAK,KAAK;QAC7E,MAAM,IAAI,uBAAuB,CAChC,sFAAsF,CACtF,CAAA;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAC3B,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,CAAC,EAAE;QACvF,MAAM;QACN,GAAG,EAAE,WAAW;KAChB,CAAC,CAQF,CAAA;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,WAAW,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS;QAClE,MAAM,IAAI,uBAAuB,CAChC,4EAA4E,CAC5E,CAAA;IACF,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,GAAG,CACrC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,EAAE,UAAU,EAAE,SAAS,CAAC,EAC1E,CAAC,QAAQ,EAAE,SAAS,CAAC,EACrB,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,CAC5B,CAAA;IACD,IACC,CAAC,aAAa;SACZ,KAAK,CAAC,OAAO,CAAC;SACd,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,CAAC;QAEzE,MAAM,IAAI,uBAAuB,CAChC,wEAAwE,CACxE,CAAA;IACF,MAAM,IAAI,GAAG,SAAS,CAAC,cAAc,EAAE,UAAU,EAAE,IAAI,CAAA;IACvD,IAAI,IAAI,KAAK,gBAAgB,WAAW,EAAE;QACzC,MAAM,IAAI,uBAAuB,CAChC,mEAAmE,CACnE,CAAA;IACF,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,EAAE,YAAY,CAAA;IAClD,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,EAAE,IAAI,CAAA;IAC3C,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QACzF,MAAM,IAAI,uBAAuB,CAChC,wEAAwE,CACxE,CAAA;IACF,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpD,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACnC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;KACpC,CAAC,CAAA;IACF,IACC,CAAC,aAAa,CAAC,YAAY,EAAE,WAAW,CAAC;QACzC,CAAC,aAAa,CAAC,UAAU,EAAE,WAAW,CAAC;QACvC,CAAC,CAAC,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE;QAErC,MAAM,IAAI,uBAAuB,CAChC,uGAAuG,CACvG,CAAA;IACF,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAC7B,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE;QAC9E,MAAM;QACN,GAAG,EAAE,WAAW;KAChB,CAAC,CAOA,CAAA;IACH,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,cAAc,CAAC,CAAA;IACrF,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,GAAG,IAAI,EAAE,CAAC,CAAA;IACrC,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,uBAAuB,CAAC,mDAAmD,CAAC,CAAA;IACvF,CAAC;IACD,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE,cAAc,CAAA;IACrF,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,EAAE,IAAI,CAAA;IACtC,IACC,CAAC,UAAU,EAAE,SAAS;QACtB,UAAU,CAAC,SAAS,KAAK,IAAI;QAC7B,CAAC,UAAU,CAAC,QAAQ;QACpB,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE;YACjD,KAAK,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE;QAC5C,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK;QACpB,GAAG,CAAC,QAAQ,KAAK,MAAM;QACvB,GAAG,CAAC,QAAQ,KAAK,WAAW;QAC5B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI;QACzB,CAAC,YAAY;QACb,GAAG,CAAC,QAAQ,KAAK,YAAY;QAC7B,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,IAAI;QACR,CAAC,SAAS,CAAC,OAAO;YACjB,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,yBAAyB;YAC5C,CAAC,CAAC,CAAC,0CAA0C,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAElE,MAAM,IAAI,uBAAuB,CAChC,iIAAiI,CACjI,CAAA;IACF,MAAM,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACpC,MAAM,QAAQ,GAAG,oBAAoB,WAAW,EAAE,CAAA;IAClD,MAAM,GAAG,GAAuB,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QAC9C,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,CAAA;QAC5C,KAAK,MAAM,IAAI,IAAI;YAClB,gBAAgB;YAChB,sBAAsB;YACtB,kBAAkB;YAClB,aAAa;YACb,gBAAgB;SAChB;YACA,GAAG,CAAC,IAAI,CAAC,GAAG,SAAS,CAAA;QACtB,OAAO,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,EAAE;YACnF,GAAG,IAAI;YACP,GAAG;YACH,GAAG,EAAE,WAAW;SAChB,CAAC,CAAA;IACH,CAAC,CAAA;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAE1E,CAAA;IACD,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,OAAO;QAC5B,MAAM,IAAI,uBAAuB,CAAC,6DAA6D,CAAC,CAAA;IACjG,OAAO;QACN,QAAQ;QACR,GAAG;QACH,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI;YAC7B,MAAM,GAAG,GAAG,CACX,MAAM,MAAM,CAAC,GAAG,CACf,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,EAAE,UAAU,EAAE,SAAS,CAAC,EAC1E;gBACC,gBAAgB;gBAChB,WAAW;gBACX,QAAQ;gBACR,MAAM;gBACN,QAAQ;gBACR,KAAK;gBACL,mCAAmC;aACnC,EACD,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,CACzC,CACD;iBACC,IAAI,EAAE;iBACN,KAAK,CAAC,KAAK,CAAC;iBACZ,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;iBACX,IAAI,CAAC,GAAG,CAAC,CAAA;YACX,OAAO,MAAM,oBAAoB,CAAC;gBACjC,QAAQ,EAAE,YAAY;gBACtB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;gBAClB,IAAI,EAAE,YAAY;gBAClB,aAAa,EAAE,GAAG;gBAClB,KAAK;gBACL,GAAG,IAAI;aACP,CAAC,CAAA;QACH,CAAC;KACD,CAAA;AACF,CAAC"}