@nimbus-sh/worker 0.1.5 → 0.1.6

package/dist/runtime/wasm-runner.js

@@ -49,6 +49,7 @@
  *     workerd CSP rejects that path.
  */
 import { WASI_INSTANCE_PREAMBLE_SRC, WASI_IMPLEMENTED_FNS } from './wasi-instance.js';
+import { flushVfsDiff, snapshotVfs } from './vfs-snapshot.js';
 export const WASM_RUNNER_VERSION = '0.3.0';
 export const WASM_RUNNER_HELP = 'Usage: wasm-runner [options] <file.wasm> [exportName] [int args...]\n' +
     '       wasm-runner --version\n' +
@@ -123,166 +124,6 @@ function hasWasiImports(bytes) {
     }
     return false;
 }
-/**
- * Convert a Uint8Array to a base64 string. Used to encode VFS file
- * contents into the JSON-serializable `context` field of the loader
- * pool. Workerd's btoa is the standard one; we use it directly rather
- * than depending on Node's Buffer (which works in workerd via the
- * nodejs_compat polyfill but adds an import dependency).
- */
-function bytesToB64(bytes) {
-    let s = '';
-    for (let i = 0; i < bytes.length; i++)
-        s += String.fromCharCode(bytes[i]);
-    return btoa(s);
-}
-function b64ToBytes(b64) {
-    const bin = atob(b64);
-    const out = new Uint8Array(bin.length);
-    for (let i = 0; i < bin.length; i++)
-        out[i] = bin.charCodeAt(i);
-    return out;
-}
-/**
- * Snapshot a VFS subtree rooted at `vfsRoot` into a JSON-serializable
- * `WasiFsSnapshot`. Used by the WASI runner to ship the user's session
- * filesystem into the facet isolate.
- *
- * Bounded by:
- *   - 32 MiB total bytes. Bigger sessions need a streaming or incremental
- *     filesystem transport instead of a single snapshot.
- *   - 5000 file count.
- *
- * Returns null + a diagnostic if bounds are exceeded so the caller
- * can surface a clear error to the user.
- */
-function snapshotVfs(vfs, vfsRoot) {
-    const MAX_BYTES = 32 * 1024 * 1024;
-    const MAX_FILES = 5000;
-    const root = vfsRoot.replace(/^\/+/, '').replace(/\/+$/, '');
-    const files = {};
-    const dirs = [];
-    let totalBytes = 0;
-    let fileCount = 0;
-    const stack = [root];
-    if (!vfs.exists(root)) {
-        return { snapshot: { root, preopens: [], files: {}, dirs: [root] }, bytes: 0, files: 0 };
-    }
-    dirs.push(root);
-    // Directory prefixes to skip during snapshot. The user's `~/.nimbus`
-    // install root holds nimbus-managed runtime bundles (clang.wasm,
-    // lld.wasm, sysroot.tar, Pyodide, …) that easily exceed the
-    // 32 MiB per-snapshot cap and don't belong in the WASI sandbox
-    // anyway. node_modules is similar — large, irrelevant to user
-    // wasm execution.
-    const skipSubdirs = new Set(['.nimbus', 'node_modules', '.cache', '.npm']);
-    while (stack.length > 0) {
-        const dir = stack.pop();
-        let entries;
-        try {
-            entries = vfs.readdir(dir);
-        }
-        catch {
-            continue;
-        }
-        for (const e of entries) {
-            const childPath = dir + '/' + e.name;
-            if (e.type === 'directory') {
-                // Skip well-known large/irrelevant subdirs.
-                if (skipSubdirs.has(e.name))
-                    continue;
-                dirs.push(childPath);
-                stack.push(childPath);
-                continue;
-            }
-            let bytes;
-            try {
-                bytes = vfs.readFile(childPath);
-            }
-            catch {
-                continue;
-            }
-            totalBytes += bytes.length;
-            fileCount++;
-            if (totalBytes > MAX_BYTES) {
-                return { error: `WASI snapshot exceeded 32 MiB cap (current dir: ${dir})` };
-            }
-            if (fileCount > MAX_FILES) {
-                return { error: `WASI snapshot exceeded 5000 file cap` };
-            }
-            files[childPath] = bytesToB64(bytes);
-        }
-    }
-    return {
-        snapshot: { root, preopens: [], files, dirs },
-        bytes: totalBytes,
-        files: fileCount,
-    };
-}
-/**
- * Apply a WasiFsDiff produced by the facet back into the supervisor's
- * SqliteFS. Each operation is independent; failures on one path don't
- * abort the rest (we log to stderr and continue).
- */
-function flushVfsDiff(vfs, diff) {
-    let written = 0, deleted = 0, mkdirs = 0, rmdirs = 0;
-    let timesTouched = 0, symlinks = 0;
-    for (const path of diff.dirsCreated) {
-        try {
-            vfs.mkdir(path, { recursive: true });
-            mkdirs++;
-        }
-        catch { }
-    }
-    for (const [path, b64] of Object.entries(diff.filesWritten)) {
-        try {
-            const bytes = b64ToBytes(b64);
-            // ensure parent dirs exist
-            const lastSlash = path.lastIndexOf('/');
-            if (lastSlash > 0) {
-                const parent = path.substring(0, lastSlash);
-                try {
-                    vfs.mkdir(parent, { recursive: true });
-                }
-                catch { }
-            }
-            vfs.writeFile(path, bytes);
-            written++;
-        }
-        catch { }
-    }
-    for (const path of diff.filesDeleted) {
-        try {
-            vfs.unlink(path);
-            deleted++;
-        }
-        catch { }
-    }
-    for (const path of diff.dirsDeleted) {
-        try {
-            vfs.rmdir(path);
-            rmdirs++;
-        }
-        catch { }
-    }
-    // WASI socket and polling support B1+B3: count timesChanged / symlinks for diagnostics. The
-    // current SqliteVFS doesn't expose utime() or symlink() on its public
-    // surface, so we don't persist these across calls — they live only
-    // within the call (mtimes are read back correctly via stat→filestat_get
-    // before the snapshot returns). This is a documented v1 limitation.
-    if (diff.timesChanged) {
-        timesTouched = Object.keys(diff.timesChanged).length;
-        // Future hook: when SqliteVFS gains a utime() method, call it here:
-        //   for (const [path, t] of Object.entries(diff.timesChanged)) {
-        //     try { vfs.utime(path, Number(t.atime) / 1e9, Number(t.mtime) / 1e9); } catch {}
-        //   }
-    }
-    if (diff.symlinksCreated) {
-        symlinks = Object.keys(diff.symlinksCreated).length;
-        // Future hook: when SqliteVFS gains a symlink() method, call it here.
-    }
-    return { written, deleted, mkdirs, rmdirs, timesTouched, symlinks };
-}
 /**
  * Build a `run` function suitable for RuntimeSpec.run(). Parameterised
  * over the VFS, env (for env.LOADER), ctx (for the pool's doId-scoped

package/dist/session/agent.d.ts

@@ -0,0 +1,43 @@
+/**
+ * session/agent.ts - Nimbus session chat agent and Cloudflare OAuth flow.
+ *
+ * The agent lives in the session Durable Object because that is where the
+ * VFS, shell, process table, port registry, and runtime package manager
+ * already live. AI calls go through Cloudflare's account REST API so a
+ * connected user can spend their own Workers AI quota instead of the
+ * Nimbus deployment owner quota.
+ */
+interface AgentStorage {
+    get(key: string): Promise<unknown>;
+    put(key: string, value: unknown): Promise<void>;
+    delete(key: string): Promise<void>;
+}
+interface AgentVfs {
+    exists(path: string): boolean;
+    mkdir(path: string, options?: {
+        recursive?: boolean;
+    }): void;
+    readFileString(path: string): string;
+    readdir(path: string): Array<{
+        name: string;
+        type: string;
+    }>;
+    writeFile(path: string, content: string): void;
+}
+interface Host {
+    ctx: {
+        storage: AgentStorage;
+    };
+    env: Record<string, unknown>;
+    sqliteFs?: AgentVfs | null;
+}
+interface OAuthStatePayload {
+    v: 1;
+    nonce: string;
+    sessionId: string;
+    tenantSegment: string;
+}
+export declare function handleAgentRequest(self: Host, request: Request, url: URL): Promise<Response>;
+export declare function parseAgentOAuthStateParam(state: string | null): OAuthStatePayload | null;
+export {};
+//# sourceMappingURL=agent.d.ts.map

package/dist/session/agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../src/session/agent.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAmCH,UAAU,YAAY;IACpB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED,UAAU,QAAQ;IAChB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAC7D,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACrC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAChD;AAED,UAAU,IAAI;IACZ,GAAG,EAAE;QAAE,OAAO,EAAE,YAAY,CAAA;KAAE,CAAC;IAC/B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,QAAQ,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC;CAC5B;AAED,UAAU,iBAAiB;IACzB,CAAC,EAAE,CAAC,CAAC;IACL,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACvB;AA0FD,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwClG;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,iBAAiB,GAAG,IAAI,CAQxF"}