@north-light/cli 0.0.0 → 0.3.413

package/dist/launcher/limits/manager.d.ts

@@ -0,0 +1,82 @@
+import { Cgroups } from './cgroup.js';
+import { type AppBudget, type PurgeMode, type TmpfsSizes } from './policy.js';
+import type { PurgeResult } from './purge-worker.js';
+import { ProjectQuota } from './quota.js';
+import type { LimitEvent, LimitsReport } from '../spec.js';
+export interface RunPlan {
+    /** The run's cgroup directory, or null when per-app memory limits are off. */
+    cgroupDir: string | null;
+    app: string;
+    nodeId: string;
+    budget: AppBudget;
+    tmpfs: TmpfsSizes;
+}
+export interface CachePassEntry {
+    app: string;
+    mode: PurgeMode;
+    files: number;
+    bytes: number;
+}
+export interface AppRegistry {
+    appFor(uid: number): string | undefined;
+    entries(): Array<{
+        app: string;
+        uid: number;
+    }>;
+}
+export interface ManagerOptions {
+    runtimeRoot: string;
+    appsRoot: string;
+    /** Directory for the once-per-app tagging markers; inside the runtime directory, which no sandbox mounts. */
+    stateDir: string;
+    dataGid: number;
+    users: AppRegistry;
+    cgroups?: Cgroups;
+    quota?: ProjectQuota;
+    /** Runs one purge as the app's own user. */
+    purge?: (cacheDir: string, mode: PurgeMode, uid: number, gid: number, now: number) => Promise<PurgeResult>;
+    /** Fraction of the apps volume in use. */
+    diskUsedFraction?: () => number;
+    setOom?: (pid: number, value: number) => void;
+    now?: () => number;
+}
+export declare function spawnPurge(cacheDir: string, mode: PurgeMode, uid: number, gid: number, now: number): Promise<PurgeResult>;
+export declare class LimitsManager {
+    private readonly options;
+    readonly cgroups: Cgroups;
+    readonly quota: ProjectQuota;
+    private readonly events;
+    private readonly appliedMemory;
+    private readonly appliedDisk;
+    private readonly purging;
+    private readonly purge;
+    private readonly diskUsedFraction;
+    private readonly setOom;
+    private readonly now;
+    constructor(options: ManagerOptions);
+    /** Queue an event for the daemon to emit with the next reply. */
+    note(event: LimitEvent): void;
+    takeEvents(): LimitEvent[];
+    init(): void;
+    budget(app: string): AppBudget;
+    /** Write the app's memory cap and disk quota when they differ from what was last applied. */
+    applyApp(app: string, uid: number, force?: boolean): AppBudget;
+    /** Everything a launch needs: the app's limits applied, a fresh run group, the sandbox tmpfs sizes. */
+    prepareRun(uid: number, nodeId: string): RunPlan;
+    /** An app already past 80 % of its quota loses its cache before the sandbox starts. */
+    private purgeIfNearQuota;
+    /** Called when the sandbox's first process exists (its pid is bwrap's). */
+    confirmStarted(plan: RunPlan, pid: number): void;
+    /** Called when the sandbox's first process has exited. Returns whether the kernel OOM-killed the run. */
+    finishRun(plan: RunPlan): {
+        oomKilled: boolean;
+    };
+    /** SIGKILL of a whole run, so no child escapes through a double fork. */
+    killRun(plan: RunPlan | null): void;
+    /** crtrd must outlive every sandbox when memory runs out. */
+    protectDaemon(pid: number, value: number): void;
+    show(): LimitsReport;
+    purgeApp(app: string, uid: number, mode: PurgeMode): Promise<CachePassEntry | null>;
+    /** One cache pass over every registered app. */
+    cachePass(): Promise<CachePassEntry[]>;
+}

package/dist/launcher/limits/manager.js

@@ -0,0 +1 @@
+var y=Object.defineProperty;var u=(l,e)=>y(l,"name",{value:e,configurable:!0});import{spawn as v}from"node:child_process";import{randomBytes as b}from"node:crypto";import{existsSync as k,statfsSync as w}from"node:fs";import{dirname as S,join as g}from"node:path";import{fileURLToPath as B}from"node:url";import{Cgroups as _,setOomScoreAdj as q}from"./cgroup.js";import{APP_QUOTA_CLEANUP_FRACTION as D,CONVERSATIONS_DISK_BYTES as A,appProjectId as c,bareApp as h,budgetFor as P,conversationsProjectId as O,passesFraction as N,runGroupName as R,selectCachePurges as F,tmpfsSizes as I}from"./policy.js";import{ProjectQuota as M}from"./quota.js";import{readSettings as U}from"./settings.js";function x(l,e,t,i,s){const r=g(S(B(import.meta.url)),"purge-worker.js");return new Promise((o,n)=>{const a=v("/bin/setpriv",["--reuid",String(t),"--regid",String(i),"--groups",String(i),"--no-new-privs","--",process.execPath,r,l,e,String(s)],{stdio:["ignore","pipe","pipe"]});let d="",m="";a.stdout.on("data",p=>{d+=String(p)}),a.stderr.on("data",p=>{m+=String(p)}),a.once("error",n),a.once("close",p=>{if(p!==0)return n(new Error(`purge worker exited ${p}: ${m.trim().slice(0,200)}`));try{o(JSON.parse(d))}catch(f){n(f)}})})}u(x,"spawnPurge");function T(l){const e=w(l),t=Number(e.blocks);return t>0?1-Number(e.bavail)/t:0}u(T,"appsDiskUsedFraction");class V{static{u(this,"LimitsManager")}options;cgroups;quota;events=[];appliedMemory=new Map;appliedDisk=new Map;purging=new Set;purge;diskUsedFraction;setOom;now;constructor(e){this.options=e,this.cgroups=e.cgroups??new _,this.quota=e.quota??new M(e.appsRoot,e.stateDir),this.purge=e.purge??x,this.diskUsedFraction=e.diskUsedFraction??(()=>T(e.appsRoot)),this.setOom=e.setOom??q,this.now=e.now??Date.now}note(e){this.events.push(e),this.events.length>200&&this.events.splice(0,this.events.length-200)}takeEvents(){return this.events.splice(0,this.events.length)}init(){this.cgroups.init()?this.cgroups.sweep():this.note({level:"warn",event:"limits.memory.unavailable",fields:{reason:this.cgroups.unavailable}}),this.quota.init()||this.note({level:"warn",event:"limits.disk.unavailable",fields:{reason:this.quota.unavailable}})}budget(e){return P(e,U(this.options.runtimeRoot))}applyApp(e,t,i=!1){const s=this.budget(e),r=h(e);if(this.cgroups.unavailable===null){const o=JSON.stringify([s.memoryBytes,s.pids]);if(i||this.appliedMemory.get(r)!==o)try{this.cgroups.applyApp(r,s),this.appliedMemory.set(r,o),this.note({level:"info",event:"limits.memory.applied",fields:{app:r,memory_bytes:s.memoryBytes,pids:s.pids}})}catch(n){this.note({level:"warn",event:"limits.memory.failed",fields:{app:r,error:String(n)}})}}if(this.quota.unavailable===null)try{if(this.quota.tag(r,t,{uid:0,gid:0})){const o=String(s.diskBytes);(i||this.appliedDisk.get(t)!==o)&&(this.quota.setLimit(c(t),s.diskBytes),this.quota.setLimit(O(t),A),this.appliedDisk.set(t,o),this.note({level:"info",event:"limits.disk.applied",fields:{app:r,disk_bytes:s.diskBytes}}))}}catch(o){this.note({level:"warn",event:"limits.disk.failed",fields:{app:r,error:String(o)}})}return s}prepareRun(e,t){const i=this.options.users.appFor(e)??String(e),s=this.applyApp(i,e);let r=null;if(this.cgroups.unavailable===null)try{r=this.cgroups.createRun(i,R(t,b(4).toString("hex")))}catch(o){this.note({level:"warn",event:"limits.memory.failed",nodeId:t,fields:{app:i,error:String(o)}})}return this.purgeIfNearQuota(i,e,s),{cgroupDir:r,app:h(i),nodeId:t,budget:s,tmpfs:I(s)}}purgeIfNearQuota(e,t,i){if(this.quota.unavailable!==null||i.diskBytes===null)return;const s=this.quota.usage().get(c(t))?.usedBytes??0;N(s,i.diskBytes,D)&&this.purgeApp(e,t,"all").catch(()=>{})}confirmStarted(e,t){e.cgroupDir!==null&&!this.cgroups.contains(e.cgroupDir,t)&&this.note({level:"warn",event:"limits.memory.not_joined",nodeId:e.nodeId,fields:{app:e.app,pid:t}})}finishRun(e){if(e.cgroupDir===null)return{oomKilled:!1};const t=e.cgroupDir,i=this.cgroups.oomKilled(t);this.cgroups.kill(t),i&&this.note({level:"warn",event:"run.oom_killed",nodeId:e.nodeId,fields:{app:e.app,memory_bytes:e.budget.memoryBytes}});let s=0;const r=u(()=>{this.cgroups.remove(t)||++s>=20||setTimeout(r,100).unref()},"retry");return r(),{oomKilled:i}}killRun(e){e?.cgroupDir&&this.cgroups.kill(e.cgroupDir)}protectDaemon(e,t){try{this.setOom(e,t)}catch(i){this.note({level:"warn",event:"limits.oom_score.failed",fields:{pid:e,error:String(i)}})}}show(){const e=this.quota.unavailable===null?this.quota.usage():new Map;return{memory:{available:this.cgroups.unavailable===null,reason:this.cgroups.unavailable},disk:{available:this.quota.unavailable===null,reason:this.quota.unavailable},apps:this.options.users.entries().map(({app:t,uid:i})=>{const s=this.budget(t);return{app:t,uid:i,memory_bytes:s.memoryBytes,disk_bytes:s.diskBytes,memory_source:s.memorySource,disk_source:s.diskSource,disk_used_bytes:e.get(c(i))?.usedBytes??null}})}}async purgeApp(e,t,i){const s=h(e),r=g(this.options.appsRoot,s,"cache");if(this.purging.has(s)||!k(r))return null;this.purging.add(s);try{const o=await this.purge(r,i,t,this.options.dataGid,this.now());return this.note({level:"info",event:"app.cache.purged",fields:{app:s,mode:i,files:o.files,bytes:o.bytes,dirs:o.dirs}}),{app:s,mode:i,files:o.files,bytes:o.bytes}}catch(o){return this.note({level:"warn",event:"app.cache.purge_failed",fields:{app:s,mode:i,error:String(o)}}),null}finally{this.purging.delete(s)}}async cachePass(){const e=this.quota.unavailable===null?this.quota.usage():new Map;let t=0;try{t=this.diskUsedFraction()}catch{}const i=this.options.users.entries(),s=F(i.map(({app:n,uid:a})=>({app:n,usedBytes:e.get(c(a))?.usedBytes??0,limitBytes:this.budget(n).diskBytes})),t),r=new Map(i.map(n=>[n.app,n.uid]));return(await Promise.all(s.map(({app:n,mode:a})=>this.purgeApp(n,r.get(n),a)))).filter(n=>n!==null)}}export{V as LimitsManager,x as spawnPurge};

package/dist/launcher/limits/policy.d.ts

@@ -0,0 +1,98 @@
+export declare const GIB: number;
+export declare const MIB: number;
+/** The one app with no per-app cap by default (the person's own agent). */
+export declare const UNCAPPED_BY_DEFAULT_APP = "terminal";
+/** Memory kept for crtrd, the launcher and the RAM-backed root filesystem. */
+export declare const RUNTIME_RESERVE_BYTES: number;
+export declare const DEFAULT_APP_MEMORY_BYTES: number;
+export declare const DEFAULT_APP_DISK_BYTES: number;
+export declare const DEFAULT_APP_PIDS = 2048;
+/** Hard ceiling of the project that holds an app's `conversations/` folder. */
+export declare const CONVERSATIONS_DISK_BYTES: number;
+export declare const SANDBOX_ROOT_TMPFS_BYTES: number;
+export declare const SANDBOX_TMP_TMPFS_BYTES: number;
+export declare const CRTRD_OOM_SCORE_ADJ = -900;
+export declare const SANDBOX_OOM_SCORE_ADJ = 300;
+/** Project ids of `conversations/` folders; app uids stay below this. */
+export declare const CONVERSATIONS_PROJECT_OFFSET = 1000000;
+export declare const MIN_MEMORY_BYTES: number;
+export declare const MIN_DISK_BYTES: number;
+/** `'unlimited'` removes the cap for that resource. */
+export type CapValue = number | 'unlimited';
+export interface AppOverride {
+    memory_bytes?: CapValue;
+    disk_bytes?: CapValue;
+}
+export interface LimitSettings {
+    version: 1;
+    apps: Record<string, AppOverride>;
+}
+export interface AppBudget {
+    /** null means no per-app cap (bounded only by the `apps/` parent). */
+    memoryBytes: number | null;
+    diskBytes: number | null;
+    pids: number | null;
+    memorySource: 'default' | 'override';
+    diskSource: 'default' | 'override';
+}
+/** The bare app id (`terminal`) for `app:terminal` or `terminal`. */
+export declare function bareApp(app: string): string;
+export declare function budgetFor(app: string, settings: LimitSettings): AppBudget;
+/** `apps/` memory.max: guest memory less the runtime reserve; a guest smaller than the reserve gives apps half. */
+export declare function appsMemoryMax(totalBytes: number, reserve?: number): number;
+/** An app's cgroup values. `memory.high` is left at `max` on purpose: with it set below `memory.max`, a process whose memory cannot be reclaimed (anonymous pages, no swap) is throttled in the kernel indefinitely instead of being OOM-killed at the cap. `memory.swap.max` is 0 so the cap bounds real memory, not memory plus the host's swap. */
+export interface CgroupValues {
+    memoryMax: string;
+    memoryHigh: 'max';
+    swapMax: string;
+    pidsMax: string;
+}
+export declare function appCgroupValues(budget: AppBudget): CgroupValues;
+export declare function appCgroupPath(root: string, app: string): string;
+export declare function runCgroupPath(root: string, app: string, run: string): string;
+export declare function runGroupName(nodeId: string, nonce: string): string;
+/** Project id of an app's space: the app uid. */
+export declare function appProjectId(uid: number): number;
+export declare function conversationsProjectId(uid: number): number;
+/** ext4 quota block limits are counted in 1 KiB blocks; 0 removes the limit. */
+export declare function quotaBlocks(bytes: number | null): number;
+/** Whether `used` passes `fraction` of `limit`; an uncapped app never does. */
+export declare function passesFraction(used: number, limit: number | null, fraction: number): boolean;
+export declare const APP_QUOTA_CLEANUP_FRACTION = 0.8;
+export declare const DISK_CLEANUP_FRACTION = 0.85;
+export interface MemoryEvents {
+    oomKill: number;
+    oomGroupKill: number;
+}
+export declare function parseMemoryEvents(text: string): MemoryEvents;
+/** Whether the kernel's OOM killer ended any process of the run. */
+export declare function wasOomKilled(events: MemoryEvents): boolean;
+/** The terminal reason a node ends with when its run was OOM-killed. */
+export declare const OUT_OF_MEMORY_REASON: "out_of_memory";
+export declare function exitReasonFor(oomKilled: boolean, ordinary: 'crashed' | 'boot_failed' | 'crash_looped'): 'out_of_memory' | typeof ordinary;
+export interface TmpfsSizes {
+    root: number;
+    tmp: number;
+}
+/** `/` holds only mount points; `/tmp` pages are charged to the run's cgroup, so a capped app gets at most a quarter of its memory there. */
+export declare function tmpfsSizes(budget: AppBudget): TmpfsSizes;
+export declare const CACHE_STALE_MS: number;
+export declare const CACHE_PASS_INTERVAL_MS: number;
+/** Whether a cache file has gone untouched (atime and mtime) for three days. */
+export declare function isStale(file: {
+    atimeMs: number;
+    mtimeMs: number;
+}, now: number): boolean;
+export interface AppUsage {
+    app: string;
+    usedBytes: number;
+    limitBytes: number | null;
+}
+export type PurgeMode = 'stale' | 'all';
+/** What the cache pass does for each app: an app past 80 % of its quota, or any app while the disk is past 85 %, loses its whole cache; the rest lose only stale files. */
+export declare function selectCachePurges(apps: readonly AppUsage[], diskUsedFraction: number): Array<{
+    app: string;
+    mode: PurgeMode;
+}>;
+/** At most one pass per hour of awake time; the first call (daemon boot) always runs. */
+export declare function cachePassDue(lastPassAt: number | null, now: number): boolean;

package/dist/launcher/limits/policy.js

@@ -0,0 +1 @@
+var m=Object.defineProperty;var r=(o,t)=>m(o,"name",{value:t,configurable:!0});const I=1073741824,R=1048576,S="terminal",f=1073741824,N=2147483648,y=1073741824,D=2048,F=536870912,C=67108864,d=536870912,Y=-900,h=300,U=1e6,L=67108864,K=16777216;function i(o){return o.startsWith("app:")?o.slice(4):o}r(i,"bareApp");function $(o,t){const e=i(o),n=t.apps[e]??{},s=e===S,_=r((u,E)=>u===void 0?{bytes:s?null:E,source:"default"}:{bytes:u==="unlimited"?null:u,source:"override"},"resolve"),c=_(n.memory_bytes,2147483648),p=_(n.disk_bytes,1073741824);return{memoryBytes:c.bytes,diskBytes:p.bytes,pids:s?null:2048,memorySource:c.source,diskSource:p.source}}r($,"budgetFor");function g(o,t=1073741824){return o>t?Math.floor(o-t):Math.max(67108864,Math.floor(o/2))}r(g,"appsMemoryMax");function k(o){return{memoryMax:o.memoryBytes===null?"max":String(o.memoryBytes),memoryHigh:"max",swapMax:o.memoryBytes===null?"max":"0",pidsMax:o.pids===null?"max":String(o.pids)}}r(k,"appCgroupValues");function x(o,t){return`${o}/apps/${i(t)}`}r(x,"appCgroupPath");function G(o,t,e){return`${x(o,t)}/${e}`}r(G,"runCgroupPath");const a=/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/;function V(o,t){const e=`${o}.${t}`;if(!a.test(e))throw new Error(`invalid run group name: ${e}`);return e}r(V,"runGroupName");function w(o){return o}r(w,"appProjectId");function X(o){return o+1e6}r(X,"conversationsProjectId");function J(o){return o===null?0:Math.ceil(o/1024)}r(J,"quotaBlocks");function M(o,t,e){return t!==null&&t>0&&o>t*e}r(M,"passesFraction");const l=.8,T=.85;function b(o){const t=r(e=>{const n=new RegExp(`^${e}\\s+(\\d+)\\s*$`,"m").exec(o);return n?Number(n[1]):0},"read");return{oomKill:t("oom_kill"),oomGroupKill:t("oom_group_kill")}}r(b,"parseMemoryEvents");function z(o){return o.oomKill>0||o.oomGroupKill>0}r(z,"wasOomKilled");const A="out_of_memory";function H(o,t){return o?A:t}r(H,"exitReasonFor");function j(o){return{root:67108864,tmp:o.memoryBytes===null?1073741824:Math.max(67108864,Math.min(536870912,Math.floor(o.memoryBytes/4)))}}r(j,"tmpfsSizes");const B=4320*6e4,O=60*6e4;function v(o,t){return t-Math.max(o.atimeMs,o.mtimeMs)>=B}r(v,"isStale");function Z(o,t){const e=t>T;return o.map(({app:n,usedBytes:s,limitBytes:_})=>({app:n,mode:e||M(s,_,l)?"all":"stale"}))}r(Z,"selectCachePurges");function q(o,t){return o===null||t-o>=O}r(q,"cachePassDue");export{l as APP_QUOTA_CLEANUP_FRACTION,O as CACHE_PASS_INTERVAL_MS,B as CACHE_STALE_MS,F as CONVERSATIONS_DISK_BYTES,U as CONVERSATIONS_PROJECT_OFFSET,Y as CRTRD_OOM_SCORE_ADJ,y as DEFAULT_APP_DISK_BYTES,N as DEFAULT_APP_MEMORY_BYTES,D as DEFAULT_APP_PIDS,T as DISK_CLEANUP_FRACTION,I as GIB,R as MIB,K as MIN_DISK_BYTES,L as MIN_MEMORY_BYTES,A as OUT_OF_MEMORY_REASON,f as RUNTIME_RESERVE_BYTES,h as SANDBOX_OOM_SCORE_ADJ,C as SANDBOX_ROOT_TMPFS_BYTES,d as SANDBOX_TMP_TMPFS_BYTES,S as UNCAPPED_BY_DEFAULT_APP,x as appCgroupPath,k as appCgroupValues,w as appProjectId,g as appsMemoryMax,i as bareApp,$ as budgetFor,q as cachePassDue,X as conversationsProjectId,H as exitReasonFor,v as isStale,b as parseMemoryEvents,M as passesFraction,J as quotaBlocks,G as runCgroupPath,V as runGroupName,Z as selectCachePurges,j as tmpfsSizes,z as wasOomKilled};

package/dist/launcher/limits/purge-worker.d.ts

@@ -0,0 +1,8 @@
+import { type PurgeMode } from './policy.js';
+export interface PurgeResult {
+    files: number;
+    bytes: number;
+    dirs: number;
+}
+/** Remove files per `mode`, then directories left empty. The root itself stays. */
+export declare function purgeTree(root: string, mode: PurgeMode, now: number): PurgeResult;

package/dist/launcher/limits/purge-worker.js

@@ -0,0 +1,2 @@
+var p=Object.defineProperty;var a=(r,e)=>p(r,"name",{value:e,configurable:!0});import{lstatSync as y,readdirSync as d,rmdirSync as g,unlinkSync as h}from"node:fs";import{join as w}from"node:path";import{isStale as S}from"./policy.js";function b(r,e,s){const o={files:0,bytes:0,dirs:0},c=a((i,u)=>{let t=!0,f;try{f=d(i)}catch{return!1}for(const m of f){const l=w(i,m);let n;try{n=y(l)}catch{continue}if(n.isDirectory())c(l,!1)||(t=!1);else if(e==="all"||S(n,s))try{h(l),o.files+=1,o.bytes+=n.size}catch{t=!1}else t=!1}if(u||!t)return t;try{return g(i),o.dirs+=1,!0}catch{return!1}},"walk");return c(r,!0),o}if(a(b,"purgeTree"),process.argv[1]!==void 0&&import.meta.url===new URL(`file://${process.argv[1]}`).href){const[r,e,s]=process.argv.slice(2);(!r||e!=="stale"&&e!=="all"||!s)&&(console.error("usage: purge-worker <cacheDir> <stale|all> <nowMs>"),process.exit(2)),process.stdout.write(`${JSON.stringify(b(r,e,Number(s)))}
+`)}export{b as purgeTree};

package/dist/launcher/limits/quota.d.ts

@@ -0,0 +1,48 @@
+import { type SpawnSyncReturns } from 'node:child_process';
+export type Exec = (command: string, args: string[], timeoutMs?: number) => Pick<SpawnSyncReturns<string>, 'status' | 'stdout' | 'stderr' | 'error'>;
+export declare const realExec: Exec;
+interface MountInfo {
+    majmin: string;
+    root: string;
+    mountPoint: string;
+    fsType: string;
+    source: string;
+    superOptions: string;
+}
+export declare function parseMountInfo(text: string): MountInfo[];
+/** The block device carrying `majmin` when it is ext4 mounted with project quota enforcement, else the reason it is not. */
+export declare function quotaDeviceFor(mounts: readonly MountInfo[], majmin: string): {
+    device: string;
+} | {
+    reason: string;
+};
+/** repquota -Pn rows: `#<id> -- <used KiB> <soft> <hard> ...`. */
+export declare function parseRepquota(text: string): Map<number, {
+    usedBytes: number;
+    hardBytes: number | null;
+}>;
+export declare class ProjectQuota {
+    private readonly appsRoot;
+    private readonly stateDir;
+    private readonly exec;
+    private readonly mountinfo;
+    /** Why disk quotas are off on this host, or null when they work. */
+    unavailable: string | null;
+    private device;
+    constructor(appsRoot: string, stateDir: string, exec?: Exec, mountinfo?: string);
+    init(): boolean;
+    private marker;
+    isTagged(uid: number): boolean;
+    /** Put the app's whole tree in its project (new files inherit it through +P), then `conversations/` in its own. Walks once per app uid. */
+    tag(app: string, uid: number, owner: {
+        uid: number;
+        gid: number;
+    }): boolean;
+    /** Hard block limit for one project; null removes the limit. */
+    setLimit(projectId: number, bytes: number | null): void;
+    usage(): Map<number, {
+        usedBytes: number;
+        hardBytes: number | null;
+    }>;
+}
+export {};

package/dist/launcher/limits/quota.js

@@ -0,0 +1,4 @@
+var m=Object.defineProperty;var o=(n,t)=>m(n,"name",{value:t,configurable:!0});import{spawnSync as h}from"node:child_process";import{existsSync as u,mkdirSync as d,chownSync as v,readFileSync as g,statSync as x,writeFileSync as S}from"node:fs";import{join as i}from"node:path";import{appProjectId as b,conversationsProjectId as y,quotaBlocks as w}from"./policy.js";const q=o((n,t,r=10*6e4)=>h(n,t,{encoding:"utf8",timeout:r}),"realExec");function j(n){const t=[];for(const r of n.split(`
+`)){const e=r.split(" "),s=e.indexOf("-");s<6||t.push({majmin:e[2],root:e[3],mountPoint:e[4],fsType:e[s+1],source:e[s+2],superOptions:e[s+3]??""})}return t}o(j,"parseMountInfo");function $(n,t){const r=n.find(e=>e.majmin===t);return r?r.fsType!=="ext4"?{reason:`apps volume is ${r.fsType}, not ext4`}:r.superOptions.split(",").includes("prjquota")?r.source.startsWith("/dev/")?{device:r.source}:{reason:`apps volume source ${r.source} is not a block device`}:{reason:"apps volume is not mounted with prjquota"}:{reason:"apps volume is not in the mount table"}}o($,"quotaDeviceFor");function k(n){const t=new Map;for(const r of n.split(`
+`)){const e=/^#(\d+)\s+\S+\s+(\d+)\s+(\d+)\s+(\d+)/.exec(r);e&&t.set(Number(e[1]),{usedBytes:Number(e[2])*1024,hardBytes:Number(e[4])===0?null:Number(e[4])*1024})}return t}o(k,"parseRepquota");class I{static{o(this,"ProjectQuota")}appsRoot;stateDir;exec;mountinfo;unavailable=null;device="";constructor(t,r,e=q,s="/proc/self/mountinfo"){this.appsRoot=t,this.stateDir=r,this.exec=e,this.mountinfo=s}init(){try{const t=x(this.appsRoot),r=`${Number(t.dev)>>8&4095}:${Number(t.dev)&255|Number(t.dev)>>12&1048320}`,e=$(j(g(this.mountinfo,"utf8")),r);if("reason"in e)return this.unavailable=e.reason,!1;for(const s of["chattr","setquota","repquota"])if(this.exec("which",[s],5e3).status!==0)return this.unavailable=`${s} is not installed`,!1;return this.device=e.device,this.unavailable=null,!0}catch(t){return this.unavailable=t.message,!1}}marker(t){return i(this.stateDir,"tagged",String(t))}isTagged(t){return u(this.marker(t))}tag(t,r,e){if(this.unavailable!==null||this.isTagged(r))return this.isTagged(r);const s=i(this.appsRoot,t),c=i(s,"conversations");if(!u(s)||!u(c))return!1;const p=[["chattr",["-R","-p",String(b(r)),s]],["find",[s,"-type","d","-exec","chattr","+P","{}","+"]],["chattr",["-R","-p",String(y(r)),c]]];for(const[f,l]of p){const a=this.exec(f,l);if(a.status!==0)throw new Error(`${f} failed: ${(a.stderr||String(a.error)).trim().slice(0,300)}`)}return d(i(this.stateDir,"tagged"),{recursive:!0,mode:448}),S(this.marker(r),`${new Date().toISOString()}
+`),v(this.marker(r),e.uid,e.gid),!0}setLimit(t,r){const e=this.exec("setquota",["-P",String(t),"0",String(w(r)),"0","0",this.device],3e4);if(e.status!==0)throw new Error(`setquota failed: ${(e.stderr||String(e.error)).trim().slice(0,300)}`)}usage(){if(this.unavailable!==null)return new Map;const t=this.exec("repquota",["-Pn",this.device],3e4);return t.status===0?k(t.stdout):new Map}}export{I as ProjectQuota,j as parseMountInfo,k as parseRepquota,$ as quotaDeviceFor,q as realExec};

package/dist/launcher/limits/settings.d.ts

@@ -0,0 +1,19 @@
+import { type CapValue, type LimitSettings } from './policy.js';
+export declare const SETTINGS_FILE = "limits.json";
+export declare function emptySettings(): LimitSettings;
+export declare function settingsPath(runtimeRoot: string): string;
+/** Keep only well-formed entries; a damaged file never blocks the launcher. */
+export declare function normalizeSettings(raw: unknown): LimitSettings;
+export declare function readSettings(runtimeRoot: string): LimitSettings;
+export declare function writeSettings(runtimeRoot: string, settings: LimitSettings): void;
+export declare class LimitInputError extends Error {
+}
+/** Merge a change into `settings` (pure). `undefined` leaves a field alone. */
+export declare function applyChange(settings: LimitSettings, app: string, change: {
+    memory_bytes?: CapValue;
+    disk_bytes?: CapValue;
+}): LimitSettings;
+/** Drop the named override fields (pure); an app left with none disappears. */
+export declare function removeOverride(settings: LimitSettings, app: string, fields: Array<'memory' | 'disk'>): LimitSettings;
+/** `2GiB`, `512MiB`, `1073741824` or `unlimited`. */
+export declare function parseSize(text: string): CapValue;

package/dist/launcher/limits/settings.js

@@ -0,0 +1,2 @@
+var _=Object.defineProperty;var o=(e,n)=>_(e,"name",{value:n,configurable:!0});import{mkdirSync as S,readFileSync as k,renameSync as x,writeFileSync as w}from"node:fs";import{dirname as N,join as g}from"node:path";import{bareApp as y,MIN_DISK_BYTES as p,MIN_MEMORY_BYTES as f}from"./policy.js";const E="limits.json",b=/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/;function c(){return{version:1,apps:{}}}o(c,"emptySettings");function a(e){return g(e,E)}o(a,"settingsPath");function u(e,n){if(e==="unlimited")return"unlimited";if(typeof e=="number"&&Number.isSafeInteger(e)&&e>=n)return e}o(u,"capValue");function I(e){const n=c(),t=e?.apps;if(t===null||typeof t!="object")return n;for(const[i,r]of Object.entries(t)){if(!b.test(i)||r===null||typeof r!="object")continue;const s=u(r.memory_bytes,f),d=u(r.disk_bytes,p);s===void 0&&d===void 0||(n.apps[i]={...s===void 0?{}:{memory_bytes:s},...d===void 0?{}:{disk_bytes:d}})}return n}o(I,"normalizeSettings");function M(e){try{return I(JSON.parse(k(a(e),"utf8")))}catch(n){return n.code==="ENOENT",c()}}o(M,"readSettings");function h(e,n){const t=a(e);S(N(t),{recursive:!0,mode:448});const i=`${t}.${process.pid}.tmp`;w(i,`${JSON.stringify(n,null,2)}
+`,{mode:384}),x(i,t)}o(h,"writeSettings");class m extends Error{static{o(this,"LimitInputError")}}function v(e,n,t){const i=y(n);if(!b.test(i))throw new m(`invalid app id: ${n}`);const r=t.memory_bytes===void 0?void 0:u(t.memory_bytes,f),s=t.disk_bytes===void 0?void 0:u(t.disk_bytes,p);if(t.memory_bytes!==void 0&&r===void 0)throw new m(`memory must be 'unlimited' or at least ${f} bytes`);if(t.disk_bytes!==void 0&&s===void 0)throw new m(`disk must be 'unlimited' or at least ${p} bytes`);const d={version:1,apps:{...e.apps}},l={...d.apps[i]??{},...r===void 0?{}:{memory_bytes:r},...s===void 0?{}:{disk_bytes:s}};return d.apps[i]=l,d}o(v,"applyChange");function A(e,n,t){const i=y(n),r={version:1,apps:{...e.apps}},s={...r.apps[i]??{}};return t.includes("memory")&&delete s.memory_bytes,t.includes("disk")&&delete s.disk_bytes,s.memory_bytes===void 0&&s.disk_bytes===void 0?delete r.apps[i]:r.apps[i]=s,r}o(A,"removeOverride");const $={b:1,kib:1024,mib:1024**2,gib:1024**3,tib:1024**4,k:1024,m:1024**2,g:1024**3,t:1024**4};function F(e){const n=e.trim().toLowerCase();if(n==="unlimited")return"unlimited";const t=/^(\d+(?:\.\d+)?)\s*(b|kib|mib|gib|tib|k|m|g|t)?$/.exec(n);if(!t)throw new m(`unrecognized size: ${e}`);return Math.floor(Number(t[1])*$[t[2]??"b"])}o(F,"parseSize");export{m as LimitInputError,E as SETTINGS_FILE,v as applyChange,c as emptySettings,I as normalizeSettings,F as parseSize,M as readSettings,A as removeOverride,a as settingsPath,h as writeSettings};

package/dist/launcher/main.d.ts

@@ -0,0 +1 @@
+export declare function runLauncher(): Promise<void>;

package/dist/launcher/main.js

@@ -0,0 +1,3 @@
+var q=Object.defineProperty;var h=(u,c)=>q(u,"name",{value:c,configurable:!0});import{spawn as V}from"node:child_process";import{createHash as z}from"node:crypto";import{chownSync as O,chmodSync as P,closeSync as Q,existsSync as W,mkdirSync as H,readFileSync as X,rmSync as Y,statSync as Z}from"node:fs";import{createServer as ee}from"node:net";import{dirname as A,join as _}from"node:path";import{fileURLToPath as te}from"node:url";import{loadLinuxNative as re}from"../native/linux.js";import{envHomeOverride as oe}from"../shared/env.js";import{launchSandbox as ne}from"./bwrap.js";import{installNetworkRule as se}from"./netrule.js";import{LAUNCHER_SOCKET as S,LaunchRefused as f}from"./spec.js";import{systemIdentity as ie,AppUsers as ae}from"./users.js";import{SourceValidator as de}from"./validate.js";import{prepareDaemonScopeDirectories as ce}from"./scope-directories.js";import{LimitsManager as ue}from"./limits/manager.js";import{CRTRD_OOM_SCORE_ADJ as le}from"./limits/policy.js";import{writeLimitsLog as pe}from"./limits/log.js";const B=re();function U(u){const c=u._handle?.fd;if(c===void 0||c<0)throw new Error("launcher socket fd unavailable");return c}h(U,"socketFd");async function fe(){if(process.platform!=="linux"||process.getuid?.()!==0||!B)throw new Error("launcher requires Linux root and its native addon");const{daemonUid:u,daemonGid:c,dataGid:T}=ie(),x=A(S);if(H(x,{recursive:!0,mode:493}),(Z(x).mode&511)!==493)throw new Error(`${x} must be mode 0755`);O(x,u,c),process.umask(7);const G=_(x,"nodes");H(G,{recursive:!0,mode:504}),O(G,0,c),P(G,504);const y=new de(oe()||"/",c);ce(_(y.root,"runtime"),u,c);const v=new ae(T);se();const l=new ue({runtimeRoot:y.runtime,appsRoot:_(y.root,"apps"),stateDir:_(y.runtime,"limits-state"),dataGid:T,users:v});l.init();const L=new Map,$=h(r=>{const d=l.takeEvents();for(const o of d)pe(o);return d.length===0?r:{...r,events:d}},"reply_"),b=new Map,k=new Map,F=h((r,d)=>{const o=d.capture,e=z("sha256"),i=h((a,s)=>{let g=0,I=!1;const R=[];return{take(M){s?.update(M);const C=Math.max(0,Math.min(M.length,a-g));C&&(R.push(M.subarray(0,C)),g+=C),C!==M.length&&(I=!0)},result:h(()=>({text:Buffer.concat(R).toString("utf8"),truncated:I}),"result")}},"chunks"),t=i(o.stdoutBytes,e),n=i(o.stderrBytes);let m=Buffer.alloc(0),p=0;return r.stdout?.on("data",a=>t.take(a)),r.stderr?.on("data",a=>{const s=a;o.stderrTail?(p+=s.length,m=s.length>=o.stderrBytes?s.subarray(s.length-o.stderrBytes):Buffer.concat([m,s]).subarray(Math.max(0,m.length+s.length-o.stderrBytes))):n.take(s)}),new Promise(a=>r.once("close",(s,g)=>{const I=t.result(),R=o.stderrTail?{text:m.toString("utf8"),truncated:p>o.stderrBytes}:n.result();a({exitCode:s,signal:g,stdout:I.text,stderr:R.text,stdoutTruncated:I.truncated,stderrTruncated:R.truncated,stdoutSha256:e.digest("hex")})}))},"captureExit"),J=h(r=>{const d=new Set;for(;r>1&&!d.has(r);){const o=b.get(r);if(o)return o;d.add(r);try{const e=X(`/proc/${r}/status`,"utf8");r=Number(/^PPid:\s*(\d+)/m.exec(e)?.[1]??0)}catch{return null}}return null},"sandboxForPid");let w,E=!1;const j=_(A(te(import.meta.url)),"../daemon/crtrd-cli.js"),D=h(()=>{E||(w=V("/bin/setpriv",["--reuid",String(u),"--regid",String(c),"--groups",String(T),"--",process.execPath,j,...process.argv.slice(2)],{stdio:"inherit",env:{...process.env,CRTR_LAUNCHER_SOCKET:S,CRTR_HOME:y.root}}),w.pid&&l.protectDaemon(w.pid,le),w.once("exit",()=>{w=void 0,E||D()}),w.once("error",r=>{console.error("crtrd spawn failed:",r),process.exitCode=1,E=!0}))},"startDaemon");W(S)&&Y(S);const N=ee({pauseOnConnect:!0},r=>{const d=[];(async()=>{try{if(B.peerCred(U(r)).uid!==u)throw new f("invalid_spec","launcher peer is not crtrd");let o;for(;;)try{o=B.recvFds(U(r));break}catch(t){if(t.code!=="EINTR")throw t}d.push(...o.fds);const e=JSON.parse(o.data);let i;switch(e.operation){case"launch":{if(d.length>1||!v.has(e.spec.uid))throw new f("invalid_uid","app uid is not registered");let t,n;const m=l.prepareRun(e.spec.uid,e.spec.nodeId);try{n=await ne(e.spec,d[0],y,T,p=>{if(!p.pid)throw new f("launch_failed","bwrap has no pid");t=p.pid;const a=p.pid;if(b.set(a,{child:p,uid:e.spec.uid,nodeId:e.spec.nodeId,mounts:e.spec.mounts,plan:m}),p.once("exit",()=>{b.delete(a);const s=l.finishRun(m);L.set(a,s.oomKilled),setTimeout(()=>L.delete(a),5*6e4).unref()}),e.spec.capture){const s=F(p,e.spec).then(g=>({...g,oomKilled:L.get(a)===!0}));k.set(a,s),s.then(()=>{setTimeout(()=>{k.get(a)===s&&k.delete(a)},3e5).unref()})}},m)}catch(p){throw t!==void 0?k.delete(t):l.finishRun(m),p}if(!n.pid)throw new f("launch_failed","bwrap has no pid");l.confirmStarted(m,n.pid),i={pid:n.pid};break}case"wait":{const t=k.get(e.pid);if(!t)throw new f("invalid_spec","unknown captured sandbox pid");const n=await t;k.delete(e.pid),i={result:n};break}case"stop":{const t=Number.isInteger(e.pid)?J(e.pid):null;if(!t||e.nodeId!==void 0&&t.nodeId!==e.nodeId)throw new f("invalid_spec","unknown sandbox pid");if(e.signal!==void 0&&e.signal!=="SIGTERM"&&e.signal!=="SIGKILL")throw new f("invalid_spec","invalid stop signal");const n=e.signal??"SIGKILL";t.child.kill(n),n==="SIGKILL"&&l.killRun(t.plan),i={ok:!0};break}case"user.create":i={uid:v.create(e.app,e.uid)};break;case"user.delete":{if([...b.values()].some(t=>t.uid===e.uid))throw new f("invalid_spec","stop this app\u2019s sandboxes before deleting its user");v.delete(e.uid),i={ok:!0};break}case"users.sync":v.sync(e.users),i={ok:!0};break;case"list":i={sandboxes:[...b].map(([t,n])=>({pid:t,uid:n.uid,nodeId:n.nodeId,mounts:n.mounts}))};break;case"limits.apply":{const t=v.entries().find(n=>n.app===e.app.replace(/^app:/,""));if(!t)throw new f("invalid_uid","app is not registered");l.applyApp(t.app,t.uid,!0),i={ok:!0};break}case"limits.show":i={limits:l.show()};break;case"cache.purge":i={purged:await l.cachePass()};break;case"exit.status":i={oomKilled:L.get(e.pid)===!0};break;case"daemon.handover":w?.kill("SIGTERM"),i={ok:!0};break;default:throw new f("invalid_spec","unknown launcher operation")}r.end(`${JSON.stringify($(i))}
+`)}catch(o){const e=o instanceof f?o.refusal:"launch_failed";console.error(`launcher refusal ${e}:`,o),r.end(`${JSON.stringify({refusal:e})}
+`)}finally{for(const o of d)Q(o)}})()});await new Promise((r,d)=>{N.once("error",d),N.listen(S,r)}),O(S,u,c),P(S,384);const K=h(()=>{E=!0,w?.kill("SIGTERM");for(const{child:r}of b.values())r.kill("SIGKILL");N.close(),y.close()},"shutdown");process.once("SIGTERM",K),process.once("SIGINT",K),D()}h(fe,"runLauncher"),await fe().catch(u=>{console.error(u),process.exitCode=1});export{fe as runLauncher};

package/dist/launcher/netrule.d.ts

@@ -0,0 +1 @@
+export declare function installNetworkRule(): void;

package/dist/launcher/netrule.js

@@ -0,0 +1 @@
+var l=Object.defineProperty;var i=(t,r)=>l(t,"name",{value:r,configurable:!0});import{spawnSync as f}from"node:child_process";import{networkInterfaces as c}from"node:os";import{APP_UID_MAX as d,APP_UID_MIN as a}from"./spec.js";function n(t,r){const s=["-w","-t","filter"],e=f(t,[...s,"-C","OUTPUT",...r],{encoding:"utf8"});if(e.status===0)return;if(e.status!==1)throw new Error(`${t} rule check failed: ${e.stderr}`);const o=f(t,[...s,"-I","OUTPUT","1",...r],{encoding:"utf8"});if(o.status!==0)throw new Error(`${t} rule install failed: ${o.stderr||o.error}`)}i(n,"rule");function $(){const t=["-m","owner","--uid-owner",`${a}-${d}`],r=new Set(["127.0.0.0/8"]),s=new Set(["::1/128"]);for(const e of Object.values(c()))for(const o of e??[])(o.family==="IPv4"?r:s).add(`${o.address.split("%")[0]}/${o.family==="IPv4"?32:128}`);for(const e of r)n("iptables",[...t,"-p","tcp","--dport","8080","-d",e,"-j","DROP"]);for(const e of s)n("ip6tables",[...t,"-p","tcp","--dport","8080","-d",e,"-j","DROP"]);n("iptables",[...t,"-d","169.254.169.254/32","-j","DROP"]),n("ip6tables",[...t,"-d","fd00:ec2::254/128","-j","DROP"])}i($,"installNetworkRule");export{$ as installNetworkRule};

package/dist/launcher/scope-directories.d.ts

@@ -0,0 +1,4 @@
+/** Root launcher prepares daemon-owned scope directories before dropping privileges.
+ * Repair only these two known directories, including an imported volume whose
+ * layout marker already exists. Never follow a symlink in the writable path. */
+export declare function prepareDaemonScopeDirectories(runtimeRoot: string, daemonUid: number, daemonGid: number): void;

package/dist/launcher/scope-directories.js

@@ -0,0 +1 @@
+var p=Object.defineProperty;var n=(t,r)=>p(t,"name",{value:r,configurable:!0});import{chownSync as a,chmodSync as f,lstatSync as y,mkdirSync as h}from"node:fs";import{join as i}from"node:path";function D(t,r,s){const c=i(t,"scope"),m=i(c,"tmp");for(const o of[c,m]){try{h(o,{mode:504})}catch(e){if(e.code!=="EEXIST")throw e}if(!y(o).isDirectory())throw new Error(`${o} must be a directory, not a symlink or file`);a(o,r,s),f(o,504)}}n(D,"prepareDaemonScopeDirectories");export{D as prepareDaemonScopeDirectories};

package/dist/launcher/seccomp.d.ts

@@ -0,0 +1 @@
+export declare function seccompFd(): number;

package/dist/launcher/seccomp.js

@@ -0,0 +1 @@
+var y=Object.defineProperty;var p=(s,o)=>y(s,"name",{value:o,configurable:!0});import{mkdtempSync as h,openSync as E,unlinkSync as k,writeFileSync as w,rmdirSync as S,constants as L}from"node:fs";const b={x64:{clone:56,clone3:435,unshare:272,setns:308,mount:165,umount2:166,ptrace:101,bpf:321,keyctl:250,add_key:248,request_key:249,init_module:175,finit_module:313,delete_module:176,pivot_root:155,open_tree:428,move_mount:429,fsopen:430,fsconfig:431,fsmount:432,mount_setattr:442},arm64:{clone:220,clone3:435,unshare:97,setns:268,mount:40,umount2:39,ptrace:117,bpf:280,keyctl:219,add_key:217,request_key:218,init_module:105,finit_module:273,delete_module:106,pivot_root:41,open_tree:428,move_mount:429,fsopen:430,fsconfig:431,fsmount:432,mount_setattr:442}},u=32,a=21,d=69,c=6,i=327681,O=327718,g=2147418112,N=268435456;function I(){const s=b[process.arch];if(!s)throw new Error(`unsupported seccomp architecture: ${process.arch}`);const o=[],e=p((t,n,f,l)=>o.push([t,n,f,l]),"push");e(u,0,0,4),e(a,1,0,process.arch==="x64"?3221225534:3221225655),e(c,0,0,i),e(u,0,0,0),process.arch==="x64"&&(e(d,0,1,1073741824),e(c,0,0,i));for(const[t,n]of Object.entries(s))t==="clone"||t==="unshare"?(e(a,0,3,n),e(u,0,0,16),e(d,0,1,N),e(c,0,0,i),e(u,0,0,0)):(e(a,0,1,n),e(c,0,0,t==="clone3"?O:i));e(c,0,0,g);const r=Buffer.alloc(o.length*8);for(let t=0;t<o.length;t++){const[n,f,l,x]=o[t];r.writeUInt16LE(n,t*8),r.writeUInt8(f,t*8+2),r.writeUInt8(l,t*8+3),r.writeUInt32LE(x,t*8+4)}const _=h("/run/crtr/seccomp-"),m=`${_}/filter`;try{return w(m,r,{mode:384,flag:"wx"}),E(m,L.O_RDONLY)}finally{k(m),S(_)}}p(I,"seccompFd");export{I as seccompFd};

package/dist/launcher/spec.d.ts

@@ -0,0 +1,149 @@
+export declare const APP_UID_MIN = 200000;
+export declare const APP_UID_MAX = 299999;
+export declare const LAUNCHER_SOCKET = "/run/crtr/launcher.sock";
+export interface LaunchSpec {
+    nodeId: string;
+    uid: number;
+    mounts: Array<{
+        source: string;
+        writable: boolean;
+    }>;
+    cwd: string;
+    /** Isolated runs receive a private network namespace. Omitted means shared network. */
+    network?: 'none';
+    env: Record<string, string>;
+    command: string[];
+    log: string;
+    /** Non-broker processes return bounded output and exit status through wait. */
+    capture?: {
+        stdoutBytes: number;
+        stderrBytes: number;
+        stderrTail?: boolean;
+        stdin?: string;
+    };
+    pluginRoot?: string;
+    token?: never;
+}
+export type LauncherRequest = {
+    operation: 'launch';
+    spec: LaunchSpec;
+} | {
+    operation: 'stop';
+    pid: number;
+    signal?: 'SIGTERM' | 'SIGKILL';
+    nodeId?: string;
+} | {
+    operation: 'wait';
+    pid: number;
+} | {
+    operation: 'user.create';
+    app: string;
+    uid: number;
+} | {
+    operation: 'user.delete';
+    uid: number;
+} | {
+    operation: 'users.sync';
+    users: Array<{
+        app: string;
+        uid: number;
+    }>;
+} | {
+    operation: 'daemon.handover';
+}
+/** Re-read the person's limit overrides for one app and write its memory cap and disk quota now. */
+ | {
+    operation: 'limits.apply';
+    app: string;
+} | {
+    operation: 'limits.show';
+}
+/** One cache pass over every app (stale files; whole cache for an app past 80 % of its quota or a disk past 85 %). */
+ | {
+    operation: 'cache.purge';
+}
+/** Whether the sandbox with this first-process pid ended because the kernel OOM-killed its run. */
+ | {
+    operation: 'exit.status';
+    pid: number;
+}
+/** Every live sandbox with the mounts it was launched with (runtime spec §15, R26 sweep). */
+ | {
+    operation: 'list';
+};
+/** A diagnostic the launcher has no event log for; the daemon emits it when the reply arrives. */
+export interface LimitEvent {
+    level: 'info' | 'warn';
+    event: string;
+    nodeId?: string;
+    fields?: Record<string, unknown>;
+}
+export interface LimitsReport {
+    memory: {
+        available: boolean;
+        reason: string | null;
+    };
+    disk: {
+        available: boolean;
+        reason: string | null;
+    };
+    apps: Array<{
+        app: string;
+        uid: number;
+        /** null means no cap */
+        memory_bytes: number | null;
+        disk_bytes: number | null;
+        memory_source: 'default' | 'override';
+        disk_source: 'default' | 'override';
+        disk_used_bytes: number | null;
+    }>;
+}
+export interface CachePurged {
+    app: string;
+    mode: 'stale' | 'all';
+    files: number;
+    bytes: number;
+}
+export interface SandboxRecord {
+    pid: number;
+    uid: number;
+    nodeId: string;
+    mounts: LaunchSpec['mounts'];
+}
+export interface CapturedExit {
+    exitCode: number | null;
+    signal: NodeJS.Signals | null;
+    stdout: string;
+    stderr: string;
+    stdoutTruncated: boolean;
+    stderrTruncated: boolean;
+    stdoutSha256: string;
+    /** The kernel OOM-killed this run's cgroup. */
+    oomKilled?: boolean;
+}
+export type LauncherReply = ({
+    pid: number;
+} | {
+    sandboxes: SandboxRecord[];
+} | {
+    result: CapturedExit;
+} | {
+    uid: number;
+} | {
+    ok: true;
+} | {
+    limits: LimitsReport;
+} | {
+    purged: CachePurged[];
+} | {
+    oomKilled: boolean;
+}) & {
+    events?: LimitEvent[];
+} | {
+    refusal: LauncherRefusal;
+};
+export type LauncherRefusal = 'invalid_spec' | 'invalid_uid' | 'runtime_source' | 'run_source' | 'writable_source' | 'symlink_source' | 'source_missing' | 'source_type' | 'log_refused' | 'launch_failed';
+export declare class LaunchRefused extends Error {
+    readonly refusal: LauncherRefusal;
+    constructor(refusal: LauncherRefusal, message: string);
+}

package/dist/launcher/spec.js

@@ -0,0 +1 @@
+var o=Object.defineProperty;var e=(s,r)=>o(s,"name",{value:r,configurable:!0});const n=2e5,u=299999,a="/run/crtr/launcher.sock";class p extends Error{static{e(this,"LaunchRefused")}refusal;constructor(r,t){super(t),this.refusal=r}}export{u as APP_UID_MAX,n as APP_UID_MIN,a as LAUNCHER_SOCKET,p as LaunchRefused};

package/dist/launcher/users.d.ts

@@ -0,0 +1,23 @@
+export declare function systemIdentity(): {
+    daemonUid: number;
+    daemonGid: number;
+    dataGid: number;
+};
+export declare class AppUsers {
+    private readonly dataGid;
+    private users;
+    constructor(dataGid: number);
+    sync(rows: Array<{
+        app: string;
+        uid: number;
+    }>): void;
+    create(app: string, uid: number): number;
+    delete(uid: number): void;
+    has(uid: number): boolean;
+    appFor(uid: number): string | undefined;
+    entries(): Array<{
+        app: string;
+        uid: number;
+    }>;
+    private write;
+}

package/dist/launcher/users.js

@@ -0,0 +1,7 @@
+var h=Object.defineProperty;var i=(n,t)=>h(n,"name",{value:t,configurable:!0});import{readFileSync as a,writeFileSync as l,renameSync as f,openSync as w,closeSync as m,fchmodSync as y,constants as u}from"node:fs";import{APP_UID_MAX as _,APP_UID_MIN as g,LaunchRefused as o}from"./spec.js";function N(){const n=a("/etc/passwd","utf8").split(`
+`).map(s=>s.split(":")),t=a("/etc/group","utf8").split(`
+`).map(s=>s.split(":")),e=n.find(s=>s[0]==="crtrd"),r=t.find(s=>s[0]==="crtr-data");if(!e||!r)throw new Error("crtrd user and crtr-data group must exist");return{daemonUid:Number(e[2]),daemonGid:Number(e[3]),dataGid:Number(r[2])}}i(N,"systemIdentity");const $=/^[a-z0-9][a-z0-9-]{0,62}$/;function d(n,t){if(!$.test(n)||!Number.isInteger(t)||t<g||t>_)throw new o("invalid_uid","invalid app or uid")}i(d,"check");class b{static{i(this,"AppUsers")}dataGid;users=new Map;constructor(t){this.dataGid=t}sync(t){const e=new Map,r=new Set;for(const s of t){if(d(s.app,s.uid),e.has(s.uid)||r.has(s.app))throw new o("invalid_uid","duplicate app or uid");e.set(s.uid,s.app),r.add(s.app)}this.users=e,this.write()}create(t,e){if(d(t,e),this.users.has(e)&&this.users.get(e)!==t||[...this.users.values()].includes(t)&&this.users.get(e)!==t)throw new o("invalid_uid","app uid conflict");return this.users.set(e,t),this.write(),e}delete(t){if(!this.users.has(t))throw new o("invalid_uid","unknown app uid");this.users.delete(t),this.write()}has(t){return this.users.has(t)}appFor(t){return this.users.get(t)}entries(){return[...this.users].map(([t,e])=>({app:e,uid:t}))}write(){const t=a("/etc/passwd","utf8").split(`
+`).filter(r=>r&&!/^nl-app-[a-z0-9-]+:/.test(r)),e=a("/etc/group","utf8").split(`
+`).filter(r=>r&&!/^nl-app-[a-z0-9-]+:/.test(r));for(const[r,s]of this.users)t.push(`nl-app-${s}:x:${r}:${this.dataGid}:crouter cloud app:/apps/${s}/home:/bin/sh`),e.push(`nl-app-${s}:x:${r}:`);for(const[r,s]of[["/etc/passwd",t],["/etc/group",e]]){const c=`${r}.launcher-${process.pid}`,p=w(c,u.O_WRONLY|u.O_CREAT|u.O_EXCL,420);try{l(p,`${s.join(`
+`)}
+`),y(p,420)}finally{m(p)}f(c,r)}}}export{b as AppUsers,N as systemIdentity};

package/dist/launcher/validate.d.ts

@@ -0,0 +1,22 @@
+import { type LaunchSpec } from './spec.js';
+export interface PinnedMount {
+    source: string;
+    writable: boolean;
+    fd: number;
+    kind: number;
+}
+export declare class SourceValidator {
+    private readonly daemonGid;
+    private readonly socketDir;
+    private readonly rootFd;
+    private readonly runtimeDev;
+    private readonly runtimeIno;
+    private readonly runtimeFd;
+    readonly root: string;
+    readonly runtime: string;
+    constructor(root: string, daemonGid?: number, socketDir?: string);
+    close(): void;
+    openLog(nodeId: string): number;
+    private isRuntimeAncestor;
+    pin(spec: LaunchSpec): PinnedMount[];
+}

package/dist/launcher/validate.js

@@ -0,0 +1 @@
+var R=Object.defineProperty;var h=(n,t)=>R(n,"name",{value:t,configurable:!0});import{chownSync as P,chmodSync as $,closeSync as l,constants as _,lstatSync as w,mkdirSync as O,openSync as E,realpathSync as A}from"node:fs";import{isAbsolute as G,join as e,relative as T,resolve as j,sep as L}from"node:path";import{loadLinuxNative as q,O_PATH as x,RESOLVE_BENEATH as z,RESOLVE_NO_SYMLINKS as V}from"../native/linux.js";import{APP_UID_MAX as W,APP_UID_MIN as Z,LaunchRefused as s}from"./spec.js";import{systemIdentity as S}from"./users.js";const a=q(),v=x|_.O_NOFOLLOW,g=z|V,M=32768,b=16384,F=49152;function c(n,t){return n===t||n.startsWith(t==="/"?"/":`${t}${L}`)}h(c,"within");function I(n){if(!G(n)||j(n)!==n||n.includes("\0")||n.split(L).includes(".."))throw new s("invalid_spec",`non-canonical source: ${n}`)}h(I,"assertPath");class Q{static{h(this,"SourceValidator")}daemonGid;socketDir;rootFd;runtimeDev;runtimeIno;runtimeFd;root;runtime;constructor(t,d=S().daemonGid,u="/run/crtr"){if(this.daemonGid=d,this.socketDir=u,!a)throw new Error("Linux native addon is required by the root launcher");this.root=A(t),this.runtime=A(e(this.root,"runtime")),this.rootFd=E("/",v),this.runtimeFd=E(this.runtime,v);const r=a.fstat(this.runtimeFd);this.runtimeDev=r.dev,this.runtimeIno=r.ino}close(){l(this.rootFd),l(this.runtimeFd)}openLog(t){if(!a)throw new Error("Linux native addon is required");return a.openat2(this.runtimeFd,`nodes/${t}/job/broker.log`,_.O_WRONLY|_.O_APPEND|_.O_NOFOLLOW,g)}isRuntimeAncestor(t){if(!a)throw new Error("Linux native addon is required");const d=t.split("/").filter(Boolean);for(let u=1;u<=d.length;u++){let r;try{r=a.openat2(this.rootFd,d.slice(0,u).join("/"),v,g)}catch{return!1}try{const m=a.fstat(r);if(m.dev===this.runtimeDev&&m.ino===this.runtimeIno)return!0}finally{l(r)}}return!1}pin(t){if(!a)throw new Error("Linux native addon is required");if(!Number.isInteger(t.uid)||t.uid<Z||t.uid>W)throw new s("invalid_uid","uid outside app range");if(!/^[a-zA-Z0-9][a-zA-Z0-9-]{0,127}$/.test(t.nodeId)||!Array.isArray(t.mounts)||!Array.isArray(t.command)||!t.command.length||!t.command.every(i=>typeof i=="string"&&i.length>0&&!i.includes("\0"))||!t.env||Object.entries(t.env).some(([i,o])=>!/^[A-Za-z_][A-Za-z0-9_]*$/.test(i)||typeof o!="string"||o.includes("\0")))throw new s("invalid_spec","invalid node id, command, environment or mount list");const d=e(this.socketDir,"nodes",t.nodeId),u=e(this.socketDir,"nodes");if(O(u,{recursive:!0,mode:493}),w(u).uid!==0||w(u).gid!==this.daemonGid||!w(u).isDirectory()||(w(u).mode&511)!==504)throw new s("run_source","nodes directory is not root-and-daemon-controlled");O(d,{recursive:!0,mode:504});const r=w(d);if(!r.isDirectory())throw new s("run_source","run folder is not a directory");if(r.uid===0||r.uid===S().daemonUid&&r.gid===this.daemonGid&&(r.mode&511)===504)P(d,t.uid,this.daemonGid),$(d,504);else if(r.uid!==t.uid||r.gid!==this.daemonGid||(r.mode&511)!==504)throw new s("run_source","run folder has wrong owner or mode");const m=[];try{for(const i of t.mounts){if(!i||typeof i.source!="string"||typeof i.writable!="boolean")throw new s("invalid_spec","invalid mount");const o=i.source;I(o);const p=t.pluginRoot===o&&!i.writable&&c(o,e(this.runtime,"plugins"))&&o!==e(this.runtime,"plugins");if(!p&&(c(o,this.runtime)||this.isRuntimeAncestor(o)))throw new s("runtime_source",o);const k=o===e(this.socketDir,"api.sock")||o===e(this.socketDir,"store.sock")||c(o,e(this.socketDir,"bin"))||o===d;if(c(o,this.socketDir)&&!k)throw new s("run_source",o);if(i.writable&&!c(o,e(this.root,"user"))&&!c(o,e(this.root,"apps"))&&o!==d&&o!==e(this.socketDir,"api.sock")&&o!==e(this.socketDir,"store.sock"))throw new s("writable_source",o);if(!c(o,e(this.root,"user"))&&!c(o,e(this.root,"apps"))&&!c(o,this.socketDir)&&!U(o)&&!p)throw new s("invalid_spec",`unknown read-only source: ${o}`);let f;try{f=a.openat2(this.rootFd,T("/",o)||".",v,g)}catch(D){const N=D.code;throw new s(N==="ENOENT"?"source_missing":"symlink_source",`${o}: ${String(D)}`)}const y=a.fstat(f).mode&61440;if(![M,b,F].includes(y)||y===F&&!k)throw l(f),new s(y===40960?"symlink_source":"source_type",o);m.push({source:o,writable:i.writable,fd:f,kind:y})}if(I(t.cwd),!m.some(i=>i.kind===b&&c(t.cwd,i.source)))throw new s("invalid_spec","cwd is not mounted");return m}catch(i){for(const o of m)l(o.fd);throw i}}}function U(n){return["/usr","/bin","/lib","/lib64","/opt/crouter","/etc/passwd","/etc/group","/etc/resolv.conf","/etc/hosts","/etc/ssl","/etc/ca-certificates"].some(t=>c(n,t))}h(U,"isSystemSource");export{Q as SourceValidator};

package/dist/migrations/004-canvas-documents/apply.d.ts

@@ -0,0 +1,10 @@
+import type { DatabaseSync } from 'node:sqlite';
+import type { ImportPlan, ImportReport } from './plan.js';
+/** The canvas_meta key whose presence means this home's legacy stores were imported. */
+export declare const IMPORT_DONE_KEY = "canvas-import";
+export declare const IMPORT_ID = "004-canvas-documents";
+export declare function readImportRecord(db: DatabaseSync): ImportReport | null;
+/** Store every revision body. Call before `applyPlan`, outside its transaction. */
+export declare function storePlanBodies(plan: ImportPlan): Map<string, string>;
+/** Run inside the caller's write transaction. Throws on any divergence from the plan. */
+export declare function applyPlan(db: DatabaseSync, plan: ImportPlan, hashes: ReadonlyMap<string, string>): void;

package/dist/migrations/004-canvas-documents/apply.js

@@ -0,0 +1 @@
+var x=Object.defineProperty;var d=(n,t)=>x(n,"name",{value:t,configurable:!0});import{put as N}from"../../core/graph/bodies.js";import{importDocument as O}from"../../core/graph/documents.js";import{linksIn as _}from"../../core/graph/documents.js";import{recordActedOn as M,setLinks as R}from"../../core/graph/edges.js";import{resolveName as $}from"../../core/graph/names.js";import{ensureOwner as y,nodeObject as k,ownerForGrantee as b}from"../../core/graph/objects.js";import{ensureRepo as S}from"../../core/graph/repo-sync/repos.js";import{recordWatch as T}from"../../core/graph/watches.js";const v="canvas-import",K="004-canvas-documents";function C(n){const t=n.prepare("SELECT value FROM canvas_meta WHERE key = ?").get(v);if(t===void 0)return null;const p=JSON.parse(t.value).report;return{...p,resolutions:p.resolutions??[]}}d(C,"readImportRecord");function G(n){const t=new Map;for(const p of n.documents)for(const i of p.revisions)t.has(i.body)||t.set(i.body,N(i.body));return t}d(G,"storePlanBodies");function U(n,t,p){const i=new Map(t.owners.map(e=>[e.key,e])),f=new Map,u=d(e=>{const o=f.get(e.key);if(o)return o;let r;switch(e.type){case"person":r=b(n,"user:local");break;case"app":r=y(n,"app","app",`app:${e.handle}`,e.handle);break;case"profile":{const c=i.get(e.ownerKey);if(!c)throw new Error(`import: profile ${e.key} names unplanned app ${e.ownerKey}`);r=y(n,"profile","profile",e.key.slice(8),e.handle,u(c));break}case"repo":r=S(n,{scheme:e.scheme,externalId:e.externalId,handleHint:e.handle},e.handle);break;case"node":r=k(n,e.handle);break}if(e.type!=="node"&&r.name!==e.handle)throw new Error(`import: owner ${e.key} holds handle ${r.name}, planned ${e.handle}`);return f.set(e.key,r),r},"ownerRow"),I={class:"person",person:u(i.get("person")??{key:"person",type:"person",handle:"user"})},h=new Map,m=d(e=>{let o=h.get(e);return o||h.set(e,o=k(n,e)),o},"node"),w=[];for(const e of t.documents){const o=u(i.get(e.ownerKey)),r=O(n,{owner:o,name:e.name,kind:e.kind,preview:e.preview,privacy:e.privacy,summary:e.summary,whyItExists:e.whyItExists,unlisted:e.unlisted,rules:e.rules,lintIgnore:e.lintIgnore,extensions:e.extensions,revisions:e.revisions.map(s=>({body_hash:p.get(s.body),author:s.authorNodeId===null?null:m(s.authorNodeId),rationale:s.rationale,created_at:s.createdAt}))}),c=new Set(e.revisions.flatMap(s=>s.authorNodeId===null?[]:[s.authorNodeId]));w.push({doc:r,owner:o,body:e.revisions[e.revisions.length-1].body,authors:c})}for(const{doc:e,owner:o,body:r,authors:c}of w){const s=[];for(const a of _(r)){const g=a.includes("/")?[a]:[`${o.type==="node"?o.id:o.name}/${a}`,a];for(const E of g){const l=$(n,I,E);if("object"in l){s.push({written_as:a,dst:l.object});break}if("deleted"in l){s.push({written_as:a,dst:l.deleted});break}}}R(n,e,s);for(const a of c)M(n,m(a),e),T(n,m(a),e,"write")}n.prepare("INSERT INTO canvas_meta (key, value) VALUES (?, ?)").run(v,JSON.stringify({id:K,report:t.report}))}d(U,"applyPlan");export{v as IMPORT_DONE_KEY,K as IMPORT_ID,U as applyPlan,C as readImportRecord,G as storePlanBodies};