@north-light/cli 0.3.561 → 0.3.563

package/dist/core/runtime/revive.js

@@ -1,3 +1,3 @@
-var q=Object.defineProperty;var s=(e,r)=>q(e,"name",{value:r,configurable:!0});import{assertGranteeRunsHere as Q}from"./unsandboxed.js";import{existsSync as B}from"node:fs";import{conversationIdFromPath as h,conversationStore as d,ConversationNotFoundError as D}from"../conversation-store/index.js";import{isAbsolute as Z}from"node:path";import{findNodeBySessionFile as I,getNode as R,updateNode as E,beginExecution as ee,recordExecutionPid as re,abortExecution as S,endLiveExecution as ie,unbindSession as O,recordLaunch as te,setFrozen as ne,clearFrozen as oe,fullName as T}from"../canvas/index.js";import{emitEvent as ae}from"../events/emit.js";import{consumeDeadlineOnWake as se}from"../feed/messages.js";import{isParked as z,transition as x}from"./lifecycle.js";import{publishNotice as le}from"./close.js";import{InputError as $}from"../io.js";import{buildPiArgv as p}from"./launch.js";import{buildReviveKickoff as ce,drainBearings as ue,hasRetainedReports as fe,readGoal as k,readYieldMessage as we,RUNTIME_RESTART_CONTINUATION as de}from"./kickoff.js";import{readRoadmap as H}from"./roadmap.js";import{encodeKickoffOrigin as he,KICKOFF_ORIGIN_ENV as pe}from"./stamp/protocol.js";import{headlessBrokerHost as M}from"./host.js";import{appMemoryFull as ve,appMemoryTooSmall as me,boundFleet as U,brokerCapReached as _e,brokerThresholdsForDaemon as K}from"./fleet.js";import{admitBrokerMemory as ye}from"./memory-admission.js";import{beginBootFaultAttempt as ke,clearFault as ge,hasAdmittedTurn as be}from"../canvas/recovery.js";import{clearNodeLedger as G,forkNodeLedger as Re,noticeChangedWhileDone as Ee}from"./ledger.js";import{forkSourceNode as Se,rootOfSpine as xe}from"./nodes.js";import{checkStart as $e}from"./start-check.js";import{isReviewCompanionBound as Ce}from"../review/companion.js";import{assertProfileActive as Ne}from"../profiles/manifest.js";import{isPidAlive as Ae}from"../canvas/pid.js";import{crtrHome as Fe,jobDir as Pe}from"../canvas/paths.js";import{contextDir as Be,ensureNodeDirs as De,nodeAgentDir as Oe}from"../canvas/node-agent-paths.js";import{discoverLifecycleHookRegistry as Te}from"../command-hooks/discovery.js";import{invokeLifecycleHooks as ze}from"../command-hooks/transport/exec-lifecycle.js";async function He(e,r){const i=e.pi_session_file,t=i?h(i):null;if(t===null)return{};try{const n=await d().header(t);return r?{resumeSessionPath:n.path}:{resumeSessionPath:n.path,newCycle:!0}}catch(n){if(n instanceof D)return{};throw n}}s(He,"resumeArgs");async function L(e){const r=h(e);if(r===null)return!1;try{return await d().header(r),!0}catch(i){if(i instanceof D)return!1;throw i}}s(L,"conversationExists");async function Me(e){const r=h(e);return r===null?!0:(await d().read(r)).entries.some(i=>i.type==="message")}s(Me,"sessionHasConversation");async function Ue(e){const r=h(e);if(r===null)return!0;const i=(await d().header(r)).header.cwd;return typeof i!="string"||B(i)}s(Ue,"sessionCwdExists");async function Ke(e,r,i){const t=r.pi_session_file;if(!t||!await L(t))return{};const n=await I(t);return n!==null&&n.node_id!==e&&Ae(n.pi_pid)?{}:await Ue(t)?await He(r,i):{}}s(Ke,"resumableSessionArgs");async function Ge(e){return await H(e)===null&&await we(e)===null&&!await fe(e)}s(Ge,"isUnstartedBirth");async function kr(e){const r=await k(e);if(r!==null&&r.trim()!=="")return!0;const i=await H(e);return i!==null&&i.trim()!==""}s(kr,"hasFreshGroundState");async function gr(e,r){const i=await j(e,r,!0);if(i.parked)throw new Error(`reviveNode: internal parked decision for activating revive ${e}`);return i.result}s(gr,"reviveNode");async function br(e,r,i){return j(e,{...r,viewerAttach:!0},i)}s(br,"decideAttachRevive");async function j(e,r,i){let t=await R(e);if(t===null)throw new Error(`reviveNode: unknown node ${e}`);if(t=await R(e)??t,t.run_id&&(await R(t.run_id))?.deleting_at)throw new Error("run is deleting");if(t.final_report!==null)throw new Error(`reviveNode: refusing to revive ${e} \u2014 its finalization latch is set (final_report=${t.final_report}). A final landed between the caller's reopen-gate check and this revive; re-run with --reopen if this retask is still wanted.`);Ne(t.profile_id),Q(t.grantee);const n=U();if(!n.has(e)&&!n.isClaimed(e)&&r.wakeReason!=="runtime-restart-abort"&&r.viewerAttach!==!0&&!(!i&&t.lifecycle==="resident"&&z(t))&&await $e(t),n.has(e))return await x(e,t.intent==="refresh"?"refresh-launch":"revive"),{parked:!1,result:{window:null,session:t.tmux_session??null,resumed:!1,outcome:"already-live"}};if(n.isClaimed(e))return{parked:!1,result:{window:null,session:t.tmux_session??null,resumed:!1,outcome:"already-live"}};if(!i&&t.lifecycle==="resident"&&z(t))return{parked:!0};const l=n.reserveSlot(e);let a=null;if(l){try{a=await ye(e)}catch(u){throw n.releaseReservation(e),u}a.verdict!=="admitted"&&n.releaseReservation(e)}if(a?.verdict==="too_small")throw me(a);if(!l||a?.verdict==="denied"){if(r.capacity==="refuse")throw a?.verdict==="denied"?ve(a):_e(K().automaticReviveCap,n.size());return t.frozen_at==null&&(await ne(e,new Date().toISOString()),await ie(e,{reason:"frozen"}),ae({level:"info",event:"broker.frozen",node_id:e,fields:a?.verdict==="denied"?{reason:"app_memory",free_bytes:a.free_bytes,needed_bytes:a.needed_bytes}:{reason:"broker_cap",live_count:n.size(),hard_cap:K().automaticReviveCap}})),{parked:!1,result:{window:null,session:t.tmux_session??null,resumed:!1,outcome:"frozen"}}}try{return{parked:!1,result:await Le(e,t,r)}}finally{n.releaseReservation(e)}}s(j,"decideRevive");async function Le(e,r,i){if(!B(r.cwd)){const v=r.fork_from!=null?`Restore ${r.cwd}, then revive the fork normally with \`crtr node lifecycle revive ${e}\`.`:r.managed_worktree?.state==="open"?"Restore or reconcile the recorded checkout, then use the managed-worktree close or abandon recovery.":`Recreate ${r.cwd}, or repair it with \`crtr node config --cwd <path> --node ${e}\`; durable node work resumes in a fresh conversation. Then retry \`crtr node lifecycle revive ${e}\`.`;throw new $({error:"cwd_missing",message:`${e} cannot be revived \u2014 its recorded cwd no longer exists: ${r.cwd}`,next:v})}r.host_kind!=="broker"&&(await E(e,{host_kind:"broker"}),r.host_kind="broker"),r.review_binding!=null&&!await Ce(e)&&(r.pi_session_id!=null||r.pi_session_file!=null)&&(await O(e),r.pi_session_id=null,r.pi_session_file=null);const n=r.fork_from!=null&&r.pi_session_id==null,l=r.fork_source_file;if(n&&(typeof l!="string"||!Z(l)))throw new $({error:"fork_source_invalid",message:`${e} cannot be revived \u2014 its resolved fork source file is missing or invalid.`,next:`Restore the node's fork source metadata, then retry \`crtr node lifecycle revive ${e}\`.`});const a=n&&typeof l=="string";if(a&&!await L(l))throw new $({error:"fork_from_missing",message:`${e} cannot be revived \u2014 its fork source no longer exists: ${l}`,next:`Restore ${l}, or update the node's fork source, then retry \`crtr node lifecycle revive ${e}\`.`});const u=await ee(e,{daemonEpoch:U().epoch()});try{r.cycles=(r.cycles??0)+1,await E(e,{cycles:r.cycles});const W=r.intent==="refresh"||r.cycle_pending===!0?!1:i.resume,w=a?{}:await Ke(e,r,W),m=w.resumeSessionPath!==void 0,C=m&&w.newCycle===!0,_=m&&!C,N=!m&&(i.wakeReason===void 0||i.wakeReason==="runtime-restart-abort")&&await Ge(e),g=_&&(i.wakeReason===void 0||i.wakeReason==="runtime-restart-abort")&&!await be(e)&&!await Me(w.resumeSessionPath)?(await k(e))?.trim():void 0,A=g!==void 0&&g!=="",J=a||N||A,F=r.cycle_pending===!0||C;await E(e,{cycle_pending:F}),r.cycle_pending=F,!a&&!m&&(r.pi_session_id!=null||r.pi_session_file!=null)&&(await O(e),r.pi_session_id=null,r.pi_session_file=null);let c,f=null;const b=s(()=>({type:"runtime",kind:"kickoff",...r.spawned_by!=null&&r.spawned_by!==""?{spawnedBy:r.spawned_by}:{}}),"birthOrigin");if(a){const o=await k(e),P=h(l);if(P===null)throw new Error(`invalid fork source ${l}`);const Y=(await d().header(await d().fork(P,e))).path;c=p(r,{resumeSessionPath:Y,...o!=null&&o!==""?{prompt:o}:{}}),o!=null&&o!==""&&(f=b()),await Re(e,(await Se(l))?.node_id??null)}else if(A)c=p(r,{...w,prompt:g}),f=b();else if(_)c=p(r,{...w,...i.wakeReason==="runtime-restart-abort"?{prompt:de}:{}}),i.wakeReason==="runtime-restart-abort"&&(f={type:"runtime",kind:"restart-continuation"});else if(N){const o=(await k(e))?.trim();c=p(r,o!==void 0&&o!==""?{prompt:o}:{}),o!==void 0&&o!==""&&(f=b()),await G(e)}else{const o=await ue(r,u);c=p(r,{...w,prompt:await ce(r,o,i.wakeReason==="runtime-restart-abort"?void 0:i.wakeReason)}),r.run_id&&o.unreadMessageIds?.length&&(c.env.CRTR_KICKOFF_MESSAGE_IDS=JSON.stringify(o.unreadMessageIds)),f=i.wakeReason!==void 0&&i.wakeReason!=="runtime-restart-abort"?{type:"runtime",kind:"wake",wake:i.wakeReason}:{type:"runtime",kind:"revive",cycle:r.cycles??0},await G(e)}c.env={...c.env,CRTR_SUBTREE:await xe(e)},f!==null&&(c.env[pe]=he(f)),r.status==="done"&&r.last_settled_at!=null&&await Ee(e,r.last_settled_at),await x(e,r.intent==="refresh"?"refresh-launch":"revive"),await ge(e,{preserveEpisode:!0});const V=await ke(e);i.recovery!==!0&&i.viewerAttach!==!0&&await se(e),await De(e,r.grantee);const X=Te(r.cwd,r.profile_id).plans.get("node:start")??[];await ze(X,{node:{id:e,name:r.name,kind:r.kind,mode:r.mode,lifecycle:r.lifecycle,cwd:r.cwd,nodeDir:await Oe(e),contextDir:await Be(e),jobDir:Pe(e)},runtime:{isBirth:J,canvasHome:Fe(),profile:r.profile_id??null}}),c.env={...c.env,CRTR_EXECUTION_ID:u};let y;try{if(y=await M.launch(e,c,{cwd:r.cwd,name:T(r),resuming:_}),y.pid===null)throw new Error(`broker host returned no pid for ${e}`)}catch(o){try{await x(e,"crash",{reason:"launch_failed",outcome:{detail:{schema:"crtr.node-outcome-detail/v1",message:o instanceof Error?o.message:String(o)}}}),await le(e,"notice.crash",`Child crashed \u2014 ${T(r)} (${e}) failed to relaunch and is now dead: ${o.message}
+var re=Object.defineProperty;var l=(e,r)=>re(e,"name",{value:r,configurable:!0});import{assertGranteeRunsHere as ie}from"./unsandboxed.js";import{existsSync as L}from"node:fs";import{conversationIdFromPath as v,conversationStore as p,ConversationNotFoundError as H}from"../conversation-store/index.js";import{isAbsolute as te}from"node:path";import{findNodeBySessionFile as ne,getNode as E,updateNode as S,beginExecution as ae,ExecutionAlreadyLive as oe,recordExecutionPid as se,abortExecution as $,endLiveExecution as le,unbindSession as M,recordLaunch as ce,setFrozen as ue,clearFrozen as U,fullName as fe}from"../canvas/index.js";import{emitEvent as we}from"../events/emit.js";import{consumeDeadlineOnWake as de}from"../feed/messages.js";import{isParked as z,transition as N}from"./lifecycle.js";import{publishNotice as he}from"./close.js";import{InputError as C}from"../io.js";import{buildPiArgv as _}from"./launch.js";import{buildReviveKickoff as pe,drainBearings as me,hasRetainedReports as ve,readGoal as g,readYieldMessage as _e,RUNTIME_RESTART_CONTINUATION as ye}from"./kickoff.js";import{readRoadmap as K}from"./roadmap.js";import{encodeKickoffOrigin as ke,KICKOFF_ORIGIN_ENV as ge}from"./stamp/protocol.js";import{headlessBrokerHost as be,brokerLaunchJson as Re}from"./host.js";import{processRunner as xe}from"./runner/process.js";import{runnerForEnvironment as Ee}from"./runner/index.js";import{acceptedRelease as Se,blaxelEnvironmentOf as G,checkBilledWake as $e,EnvironmentImagePending as Ne,imageForWake as Ce}from"../../daemon/reconcilers/node-lifecycle/remote-wake.js";import{ExecutionCapReached as Fe,liveExecutionForNode as Ae,setExecutionLaunchJson as Pe}from"../canvas/executions.js";import{appMemoryFull as Be,appMemoryTooSmall as Oe,boundFleet as J,brokerCapReached as W,brokerThresholdsForDaemon as F}from"./fleet.js";import{admitBrokerMemory as De}from"./memory-admission.js";import{beginBootFaultAttempt as Te,clearFault as Le,hasAdmittedTurn as He}from"../canvas/recovery.js";import{clearNodeLedger as j,forkNodeLedger as Me,noticeChangedWhileDone as Ue}from"./ledger.js";import{forkSourceNode as ze,rootOfSpine as Ke}from"./nodes.js";import{checkStart as Ge}from"./start-check.js";import{isReviewCompanionBound as Je}from"../review/companion.js";import{assertProfileActive as We}from"../profiles/manifest.js";import{isPidAlive as je}from"../canvas/pid.js";import{crtrHome as Ve,jobDir as Xe}from"../canvas/paths.js";import{contextDir as Ye,ensureNodeDirs as qe,nodeAgentDir as Qe}from"../canvas/node-agent-paths.js";import{discoverLifecycleHookRegistry as Ze}from"../command-hooks/discovery.js";import{invokeLifecycleHooks as Ie}from"../command-hooks/transport/exec-lifecycle.js";async function er(e,r){const i=e.pi_session_file,t=i?v(i):null;if(t===null)return{};try{const a=await p().header(t);return r?{resumeSessionPath:a.path}:{resumeSessionPath:a.path,newCycle:!0}}catch(a){if(a instanceof H)return{};throw a}}l(er,"resumeArgs");async function V(e){const r=v(e);if(r===null)return!1;try{return await p().header(r),!0}catch(i){if(i instanceof H)return!1;throw i}}l(V,"conversationExists");async function rr(e){const r=v(e);return r===null?!0:(await p().read(r)).entries.some(i=>i.type==="message")}l(rr,"sessionHasConversation");async function ir(e){const r=v(e);if(r===null)return!0;const i=(await p().header(r)).header.cwd;return typeof i!="string"||L(i)}l(ir,"sessionCwdExists");async function tr(e,r,i,t){const a=r.pi_session_file;if(!a||!await V(a))return{};const u=await ne(a);return u!==null&&u.node_id!==e&&je(u.pi_pid)?{}:t&&!await ir(a)?{}:await er(r,i)}l(tr,"resumableSessionArgs");async function nr(e){return await K(e)===null&&await _e(e)===null&&!await ve(e)}l(nr,"isUnstartedBirth");async function Ur(e){const r=await g(e);if(r!==null&&r.trim()!=="")return!0;const i=await K(e);return i!==null&&i.trim()!==""}l(Ur,"hasFreshGroundState");async function zr(e,r){const i=await X(e,r,!0);if(i.parked)throw new Error(`reviveNode: internal parked decision for activating revive ${e}`);return i.result}l(zr,"reviveNode");async function Kr(e,r,i){return X(e,{...r,viewerAttach:!0},i)}l(Kr,"decideAttachRevive");async function X(e,r,i){let t=await E(e);if(t===null)throw new Error(`reviveNode: unknown node ${e}`);if(t=await E(e)??t,t.run_id&&(await E(t.run_id))?.deleting_at)throw new Error("run is deleting");if(t.final_report!==null)throw new Error(`reviveNode: refusing to revive ${e} \u2014 its finalization latch is set (final_report=${t.final_report}). A final landed between the caller's reopen-gate check and this revive; re-run with --reopen if this retask is still wanted.`);We(t.profile_id),ie(t.grantee);const a=J();if(!await a.has(e)&&!await a.isClaimed(e)&&r.wakeReason!=="runtime-restart-abort"&&r.viewerAttach!==!0&&!(!i&&t.lifecycle==="resident"&&z(t))&&(await Ge(t),await G(t.profile_id??null)!==null&&await $e(t)),await a.has(e))return await N(e,t.intent==="refresh"?"refresh-launch":"revive"),{parked:!1,result:{window:null,session:t.tmux_session??null,resumed:!1,outcome:"already-live"}};if(await a.isClaimed(e))return{parked:!1,result:{window:null,session:t.tmux_session??null,resumed:!1,outcome:"already-live"}};if(!i&&t.lifecycle==="resident"&&z(t))return{parked:!0};const u=await a.reserveSlot(e);let o=null;if(u){try{o=await De(e)}catch(w){throw a.releaseReservation(e),w}o.verdict!=="admitted"&&a.releaseReservation(e)}if(o?.verdict==="too_small")throw Oe(o);if(!u||o?.verdict==="denied"){if(r.capacity==="refuse")throw o?.verdict==="denied"?Be(o):W(F().automaticReviveCap,await a.occupancy());return t.frozen_at==null&&(await ue(e,new Date().toISOString()),await le(e,{reason:"frozen"}),we({level:"info",event:"broker.frozen",node_id:e,fields:o?.verdict==="denied"?{reason:"app_memory",free_bytes:o.free_bytes,needed_bytes:o.needed_bytes}:{reason:"broker_cap",live_count:await a.occupancy(),hard_cap:F().automaticReviveCap}})),{parked:!1,result:{window:null,session:t.tmux_session??null,resumed:!1,outcome:"frozen"}}}try{return{parked:!1,result:await ar(e,t,r)}}finally{a.releaseReservation(e)}}l(X,"decideRevive");async function ar(e,r,i){const t=await G(r.profile_id??null);if(t===null&&!L(r.cwd)){const s=r.fork_from!=null?`Restore ${r.cwd}, then revive the fork normally with \`crtr node lifecycle revive ${e}\`.`:r.managed_worktree?.state==="open"?"Restore or reconcile the recorded checkout, then use the managed-worktree close or abandon recovery.":`Recreate ${r.cwd}, or repair it with \`crtr node config --cwd <path> --node ${e}\`; durable node work resumes in a fresh conversation. Then retry \`crtr node lifecycle revive ${e}\`.`;throw new C({error:"cwd_missing",message:`${e} cannot be revived \u2014 its recorded cwd no longer exists: ${r.cwd}`,next:s})}r.host_kind!=="broker"&&(await S(e,{host_kind:"broker"}),r.host_kind="broker"),r.review_binding!=null&&!await Je(e)&&(r.pi_session_id!=null||r.pi_session_file!=null)&&(await M(e),r.pi_session_id=null,r.pi_session_file=null);const u=r.fork_from!=null&&r.pi_session_id==null,o=r.fork_source_file;if(u&&(typeof o!="string"||!te(o)))throw new C({error:"fork_source_invalid",message:`${e} cannot be revived \u2014 its resolved fork source file is missing or invalid.`,next:`Restore the node's fork source metadata, then retry \`crtr node lifecycle revive ${e}\`.`});const w=u&&typeof o=="string";if(w&&!await V(o))throw new C({error:"fork_from_missing",message:`${e} cannot be revived \u2014 its fork source no longer exists: ${o}`,next:`Restore ${o}, or update the node's fork source, then retry \`crtr node lifecycle revive ${e}\`.`});const{automaticReviveCap:Y}=F();if(t!==null){const s=await Ce(t);if(s.state==="pending")throw new Ne(t,s.error)}const q=t===null?xe:Ee("blaxel");let f;try{f=await ae(e,{daemonEpoch:J().epoch(),cap:Y,...t===null?{}:{runner:"blaxel",release:Se()}})}catch(s){if(s instanceof Fe)throw W(s.cap,s.live);if(s instanceof oe)return{window:null,session:r.tmux_session??null,resumed:!1,outcome:"already-live"};throw s}try{r.cycles=(r.cycles??0)+1,await S(e,{cycles:r.cycles});const Q=r.intent==="refresh"||r.cycle_pending===!0?!1:i.resume,h=w?{}:await tr(e,r,Q,t===null),y=h.resumeSessionPath!==void 0,A=y&&h.newCycle===!0,m=y&&!A,P=!y&&(i.wakeReason===void 0||i.wakeReason==="runtime-restart-abort")&&await nr(e),b=m&&(i.wakeReason===void 0||i.wakeReason==="runtime-restart-abort")&&!await He(e)&&!await rr(h.resumeSessionPath)?(await g(e))?.trim():void 0,B=b!==void 0&&b!=="",Z=w||P||B,O=r.cycle_pending===!0||A;await S(e,{cycle_pending:O}),r.cycle_pending=O,!w&&!y&&(r.pi_session_id!=null||r.pi_session_file!=null)&&(await M(e),r.pi_session_id=null,r.pi_session_file=null);let c,d=null;const R=l(()=>({type:"runtime",kind:"kickoff",...r.spawned_by!=null&&r.spawned_by!==""?{spawnedBy:r.spawned_by}:{}}),"birthOrigin");if(w){const n=await g(e),x=v(o);if(x===null)throw new Error(`invalid fork source ${o}`);const ee=(await p().header(await p().fork(x,e))).path;c=_(r,{resumeSessionPath:ee,...n!=null&&n!==""?{prompt:n}:{}}),n!=null&&n!==""&&(d=R()),await Me(e,(await ze(o))?.node_id??null)}else if(B)c=_(r,{...h,prompt:b}),d=R();else if(m)c=_(r,{...h,...i.wakeReason==="runtime-restart-abort"?{prompt:ye}:{}}),i.wakeReason==="runtime-restart-abort"&&(d={type:"runtime",kind:"restart-continuation"});else if(P){const n=(await g(e))?.trim();c=_(r,n!==void 0&&n!==""?{prompt:n}:{}),n!==void 0&&n!==""&&(d=R()),await j(e)}else{const n=await me(r,f);c=_(r,{...h,prompt:await pe(r,n,i.wakeReason==="runtime-restart-abort"?void 0:i.wakeReason)}),r.run_id&&n.unreadMessageIds?.length&&(c.env.CRTR_KICKOFF_MESSAGE_IDS=JSON.stringify(n.unreadMessageIds)),d=i.wakeReason!==void 0&&i.wakeReason!=="runtime-restart-abort"?{type:"runtime",kind:"wake",wake:i.wakeReason}:{type:"runtime",kind:"revive",cycle:r.cycles??0},await j(e)}c.env={...c.env,CRTR_SUBTREE:await Ke(e)},d!==null&&(c.env[ge]=ke(d)),r.status==="done"&&r.last_settled_at!=null&&await Ue(e,r.last_settled_at),await N(e,r.intent==="refresh"?"refresh-launch":"revive"),await Le(e,{preserveEpisode:!0});const D=await Te(e);i.recovery!==!0&&i.viewerAttach!==!0&&await de(e),await qe(e,r.grantee);const I=Ze(r.cwd,r.profile_id).plans.get("node:start")??[];await Ie(I,{node:{id:e,name:r.name,kind:r.kind,mode:r.mode,lifecycle:r.lifecycle,cwd:r.cwd,nodeDir:await Qe(e),contextDir:await Ye(e),jobDir:Xe(e)},runtime:{isBirth:Z,canvasHome:Ve(),profile:r.profile_id??null}}),c.env={...c.env,CRTR_EXECUTION_ID:f};const T=await Re(e,c,r.cwd);await Pe(f,T);let k;try{const n=await Ae(e);if(k=await q.start({executionId:f,nodeId:e,attempt:n?.attempt??1,sandboxName:n?.sandboxName??null,release:n?.release??"",launchJson:T,cwd:r.cwd,resuming:m}),t===null&&k.pid===null)throw new Error(`broker host returned no pid for ${e}`)}catch(n){try{await N(e,"crash",{reason:"launch_failed",outcome:{detail:{schema:"crtr.node-outcome-detail/v1",message:n instanceof Error?n.message:String(n)}}}),await he(e,"notice.crash",`Child crashed \u2014 ${fe(r)} (${e}) failed to relaunch and is now dead: ${n.message}
 
-It stays dead until you revive it \u2014 \`crtr node lifecycle revive ${e}\`.`,{reason:"child-crashed",child:e})}catch{}throw await S(u,{reason:"launch_failed"}),new Error(`[broker] refusing to revive ${e}: ${o.message}`)}if(await te(e,new Date().toISOString()),await re(u,e,y.pid)==="shutdown")throw await S(u,{reason:"superseded"}),M.teardown(e),new Error(`[broker] refusing to revive ${e}: execution was superseded during launch`);return await oe(e),{window:null,session:r.tmux_session??null,resumed:_,launch:y,faultExplanation:V.explanation,outcome:"launched"}}catch(v){throw await S(u,{reason:"launch_failed"}),v}}s(Le,"launchRevive");export{br as decideAttachRevive,kr as hasFreshGroundState,He as resumeArgs,gr as reviveNode};
+It stays dead until you revive it \u2014 \`crtr node lifecycle revive ${e}\`.`,{reason:"child-crashed",child:e})}catch{}throw await $(f,{reason:"launch_failed"}),new Error(`[broker] refusing to revive ${e}: ${n.message}`)}if(await ce(e,new Date().toISOString()),t!==null)return await U(e),{window:null,session:r.tmux_session??null,resumed:m,faultExplanation:D.explanation,outcome:"launched"};if(await se(f,e,k.pid)==="shutdown")throw await $(f,{reason:"superseded"}),be.teardown(e),new Error(`[broker] refusing to revive ${e}: execution was superseded during launch`);return await U(e),{window:null,session:r.tmux_session??null,resumed:m,launch:k,faultExplanation:D.explanation,outcome:"launched"}}catch(s){throw await $(f,{reason:"launch_failed"}),s}}l(ar,"launchRevive");export{Kr as decideAttachRevive,Ur as hasFreshGroundState,er as resumeArgs,zr as reviveNode};

package/dist/core/runtime/runner/blaxel/client.d.ts

@@ -0,0 +1,81 @@
+export interface BlaxelConfig {
+    apiKey: string;
+    workspace: string;
+    region: string;
+    /** Defaults to `https://api.blaxel.ai/v0`. */
+    controlUrl?: string;
+    fetch?: typeof fetch;
+}
+/** `BLAXEL_API_KEY`, `BLAXEL_WORKSPACE`, `BLAXEL_REGION` (H-1 names). Throws when one is missing. */
+export declare function blaxelConfigFromEnv(env?: NodeJS.ProcessEnv): BlaxelConfig;
+export declare class BlaxelApiError extends Error {
+    readonly status: number;
+    readonly code: string | null;
+    constructor(status: number, code: string | null, message: string);
+}
+export interface SandboxSpec {
+    name: string;
+    image: string;
+    memoryMb: number;
+    /** Extra ports beyond the sandbox API (8080), e.g. the broker's view port. */
+    ports?: Array<{
+        name: string;
+        target: number;
+    }>;
+}
+export interface SandboxInfo {
+    name: string;
+    /** Base URL of the sandbox API. */
+    url: string;
+    /** `RUNNING`, `STANDBY` (frozen), ...; reading it does not wake the sandbox. */
+    state: string | null;
+    status: string | null;
+}
+export type ProcessStatus = 'running' | 'completed' | 'failed' | 'killed' | 'stopped';
+export interface SandboxProcess {
+    name: string;
+    pid: string;
+    status: ProcessStatus;
+    exitCode: number;
+    command: string;
+    stdout: string;
+    stderr: string;
+    logs: string;
+}
+export interface StartProcessInput {
+    name: string;
+    command: string;
+    env?: Record<string, string>;
+    workingDir?: string;
+    waitForCompletion?: boolean;
+    /** Seconds, with `waitForCompletion`. */
+    timeout?: number;
+}
+export interface PreviewToken {
+    token: string;
+    expiresAt: string;
+}
+export interface BlaxelClient {
+    readonly config: BlaxelConfig;
+    /** Creates the sandbox; an existing one with that name is adopted (`created: false`). */
+    createSandbox(spec: SandboxSpec): Promise<SandboxInfo & {
+        created: boolean;
+    }>;
+    /** Null when the sandbox does not exist. */
+    getSandbox(name: string): Promise<SandboxInfo | null>;
+    /** Deleting an absent sandbox is not an error. */
+    deleteSandbox(name: string): Promise<void>;
+    startProcess(sandbox: SandboxInfo, input: StartProcessInput): Promise<SandboxProcess>;
+    /** Null when the sandbox API answers 404 for that process. */
+    getProcess(sandbox: SandboxInfo, name: string): Promise<SandboxProcess | null>;
+    /** SIGTERM. Stopping a stopped process is not an error. */
+    stopProcess(sandbox: SandboxInfo, name: string): Promise<void>;
+    killProcess(sandbox: SandboxInfo, name: string): Promise<void>;
+    /** Run a command to completion in the sandbox. */
+    exec(sandbox: SandboxInfo, name: string, command: string, timeoutS: number, env?: Record<string, string>): Promise<SandboxProcess>;
+    putFile(sandbox: SandboxInfo, path: string, content: string, permissions?: string): Promise<void>;
+    /** Creates (or adopts) a private preview on `port` and returns its URL. */
+    ensurePreview(sandboxName: string, previewName: string, port: number): Promise<string>;
+    createPreviewToken(sandboxName: string, previewName: string, expiresAt: Date): Promise<PreviewToken>;
+}
+export declare function createBlaxelClient(config: BlaxelConfig): BlaxelClient;

package/dist/core/runtime/runner/blaxel/client.js

@@ -0,0 +1 @@
+var w=Object.defineProperty;var p=(n,o)=>w(n,"name",{value:o,configurable:!0});function h(n=process.env){const o=p(i=>{const $=n[i];if(!$)throw new Error(`${i} is required for the Blaxel runner`);return $},"need");return{apiKey:o("BLAXEL_API_KEY"),workspace:o("BLAXEL_WORKSPACE"),region:o("BLAXEL_REGION")}}p(h,"blaxelConfigFromEnv");class E extends Error{static{p(this,"BlaxelApiError")}status;code;constructor(o,i,$){super($),this.status=o,this.code=i,this.name="BlaxelApiError"}}function f(n){const o=n.metadata.url;if(!o)throw new Error(`Blaxel sandbox ${n.metadata.name} has no url`);return{name:n.metadata.name,url:o,state:n.state??null,status:n.status??null}}p(f,"toInfo");function b(n){const o=n.fetch??fetch,i=n.controlUrl??"https://api.blaxel.ai/v0",$=p(()=>({authorization:`Bearer ${n.apiKey}`,"x-blaxel-workspace":n.workspace,"content-type":"application/json"}),"headers");async function c(e,t,s,r=[]){const a=await o(e,{method:t,headers:$(),...s===void 0?{}:{body:JSON.stringify(s)}}),l=await a.text();let x=null;if(l!=="")try{x=JSON.parse(l)}catch{x={raw:l}}if(!a.ok&&!r.includes(a.status)){const d=x??{},m=typeof d.message=="string"?d.message:typeof d.error=="string"?d.error:l.slice(0,300);throw new E(a.status,typeof d.code=="string"?d.code:null,`Blaxel ${t} ${e} failed (${a.status}): ${m}`)}return{status:a.status,json:x}}p(c,"call");const u=encodeURIComponent;return{config:n,async createSandbox(e){const t=[...e.ports??[]].map(l=>({name:l.name,target:l.target,protocol:"HTTP"})),s={metadata:{name:e.name},spec:{runtime:{image:e.image,memory:e.memoryMb,...t.length>0?{ports:t}:{}},region:n.region}},{status:r,json:a}=await c(`${i}/sandboxes`,"POST",s,[409]);if(r===409){const l=await this.getSandbox(e.name);if(l===null)throw new Error(`Blaxel sandbox ${e.name} reported as existing but cannot be read`);return{...l,created:!1}}return{...f(a),created:!0}},async getSandbox(e){const{status:t,json:s}=await c(`${i}/sandboxes/${u(e)}`,"GET",void 0,[404]);return t===404?null:f(s)},async deleteSandbox(e){await c(`${i}/sandboxes/${u(e)}`,"DELETE",void 0,[404])},async startProcess(e,t){const{json:s}=await c(`${e.url}/process`,"POST",t);return s},async getProcess(e,t){const{status:s,json:r}=await c(`${e.url}/process/${u(t)}`,"GET",void 0,[404]);return s===404?null:r},async stopProcess(e,t){await c(`${e.url}/process/${u(t)}`,"DELETE",void 0,[404])},async killProcess(e,t){await c(`${e.url}/process/${u(t)}/kill`,"DELETE",void 0,[404])},async exec(e,t,s,r,a){return await this.startProcess(e,{name:t,command:s,waitForCompletion:!0,timeout:r,...a?{env:a}:{}})},async putFile(e,t,s,r="0644"){await c(`${e.url}/filesystem/${t.replace(/^\/+/,"").split("/").map(u).join("/")}`,"PUT",{content:s,permissions:r})},async ensurePreview(e,t,s){const{json:r}=await c(`${i}/sandboxes/${u(e)}/previews`,"POST",{metadata:{name:t},spec:{port:s,public:!1}},[409]),a=r?.spec?.url;if(a)return a;const x=(await c(`${i}/sandboxes/${u(e)}/previews`,"GET")).json.find(d=>d.metadata.name===t);if(!x)throw new Error(`Blaxel preview ${t} of ${e} not found`);return x.spec.url},async createPreviewToken(e,t,s){const{json:r}=await c(`${i}/sandboxes/${u(e)}/previews/${u(t)}/tokens`,"POST",{spec:{expiresAt:s.toISOString()}}),a=r.spec;return{token:a.token,expiresAt:a.expiresAt}}}}p(b,"createBlaxelClient");export{E as BlaxelApiError,h as blaxelConfigFromEnv,b as createBlaxelClient};

package/dist/core/runtime/runner/blaxel/image-build.d.ts

@@ -0,0 +1,74 @@
+import { type BlaxelConfig } from './client.js';
+export interface RecipeRepository {
+    name: string;
+    github_full_name: string;
+    default_branch: string;
+}
+export interface Recipe {
+    repositories: RecipeRepository[];
+    setup_script: string | null;
+    /** pi package sources, one per line (the `environments.pi_packages` text). */
+    pi_packages: string | null;
+}
+export declare const NODE_BASE_IMAGE = "public.ecr.aws/docker/library/node:24-alpine";
+/** Where the image installs the recipe's pi packages: one pi agent dir of its own, not any app's. The start script (`sandbox-start.mjs`) links its
+ *  `npm`/`git` trees into, and merges its `packages` setting with, the agent dir of whichever app the node runs in. Keep the two in step. */
+export declare const RECIPE_PI_AGENT_DIR = "/var/lib/crtr/recipe-pi-agent";
+export declare const SETUP_SCRIPT_FILE = "recipe-setup.sh";
+export declare const REPOS_DIR = "repos";
+/** The Dockerfile for a recipe revision. Pure. It clones and fetches nothing: the repositories arrive by `COPY`, so a token cannot appear here. */
+export declare function recipeDockerfile(recipe: Recipe, revision: number): string;
+export type GitRunner = (args: string[], env: Record<string, string>, cwd: string) => Promise<void>;
+export interface PrepareBuildDirInput {
+    recipe: Recipe;
+    revision: number;
+    /** A GitHub installation token limited to the recipe's repositories, or null for a source that needs none. */
+    token: string | null;
+    /** An empty directory. */
+    dir: string;
+    git?: GitRunner;
+    /** The clone URL of a repository; the default is `https://github.com/<full name>.git`. */
+    cloneUrl?: (githubFullName: string) => string;
+}
+/** Clones each repository into `<dir>/repos/<name>` and writes the Dockerfile and the setup script beside it. */
+export declare function prepareBuildDir(input: PrepareBuildDirInput): Promise<void>;
+/** A zip of every file under `dir` (deflate, unix modes kept so scripts stay executable). Empty directories are not carried. */
+export declare function zipDirectory(dir: string): Buffer;
+export interface BuiltImage {
+    /** `sandbox/<name>:<tag>`, the value of `environments.image_ref` and of a sandbox's `runtime.image`. */
+    ref: string;
+    /** Milliseconds from the upload request to `BUILT`. */
+    buildMs: number;
+}
+export interface BuildImageOptions {
+    pollMs?: number;
+    /** Give up after this long in a non-terminal state. Default 20 minutes. */
+    timeoutMs?: number;
+    sleep?: (ms: number) => Promise<void>;
+}
+interface ImageDoc {
+    metadata?: {
+        status?: string;
+        events?: Array<{
+            message?: string;
+            status?: string;
+        }>;
+    };
+    spec?: {
+        tags?: Array<{
+            name?: string;
+            createdAt?: string;
+            updatedAt?: string;
+        }>;
+    };
+}
+export declare function getImage(config: BlaxelConfig, name: string): Promise<ImageDoc | null>;
+/** Deleting an absent image is not an error; an image a sandbox still uses is refused by Blaxel. */
+export declare function deleteImage(config: BlaxelConfig, name: string): Promise<void>;
+/** Uploads `dir` (Dockerfile and context) as a build of sandbox image `name` and waits for it. A failed build throws with Blaxel's last event message. */
+export declare function buildImage(config: BlaxelConfig, name: string, dir: string, options?: BuildImageOptions): Promise<BuiltImage>;
+/** The image name of an environment: every revision is a new tag of it. */
+export declare const environmentImageName: (environmentId: string) => string;
+/** Removes a build directory. */
+export declare function removeBuildDir(dir: string): void;
+export {};

package/dist/core/runtime/runner/blaxel/image-build.js

@@ -0,0 +1,5 @@
+var T=Object.defineProperty;var p=(t,e)=>T(t,"name",{value:e,configurable:!0});import{spawn as O}from"node:child_process";import{constants as L,lstatSync as v,mkdirSync as B,readFileSync as D,readdirSync as A,readlinkSync as P,rmSync as C,writeFileSync as R}from"node:fs";import{join as I,relative as G}from"node:path";import{crc32 as M,deflateRawSync as F}from"node:zlib";import{BlaxelApiError as j}from"./client.js";const Y="public.ecr.aws/docker/library/node:24-alpine",z="ghcr.io/blaxel-ai/sandbox:latest",E="crtr",y="/var/lib/crtr/recipe-pi-agent",K="1.1.0",U="recipe-setup.sh",$="repos",J=p(t=>`'${t.replace(/'/g,"'\\''")}'`,"shellQuote"),H=p(t=>(t??"").split(`
+`).map(e=>e.trim()).filter(e=>e!==""),"lines");function V(t,e){const s=H(t.pi_packages),n=[`FROM ${Y}`,"RUN apk add --no-cache bash git curl ripgrep",`COPY --from=${z} /sandbox-api /usr/local/bin/sandbox-api`,`RUN adduser -D -h /home/${E} -s /bin/sh ${E} && mkdir -p /work/.crtr ${y} && chown -R ${E} /work /var/lib/crtr`];t.repositories.length>0&&n.push(`COPY --chown=${E} ${$}/ /work/`),s.length>0&&n.push(`RUN npm install -g @earendil-works/pi-coding-agent@${K}`),t.setup_script!==null&&t.setup_script.trim()!==""&&n.push(`COPY ${U} /tmp/${U}`),n.push(`USER ${E}`,"WORKDIR /work");for(const r of s)n.push(`RUN HOME=/var/lib/crtr PI_CODING_AGENT_DIR=${y} pi install ${J(r)}`);return t.setup_script!==null&&t.setup_script.trim()!==""&&n.push(`RUN bash /tmp/${U}`),n.push(`RUN echo ${Math.trunc(e)} > /work/.crtr/recipe-revision`,"USER root",'ENTRYPOINT ["/usr/local/bin/sandbox-api"]',""),n.join(`
+`)}p(V,"recipeDockerfile");const W=p((t,e,s)=>new Promise((n,r)=>{const i=O("git",t,{cwd:s,env:{...process.env,...e,GIT_TERMINAL_PROMPT:"0"},stdio:["ignore","ignore","pipe"]});let o="";i.stderr.on("data",a=>{o+=a.toString()}),i.on("error",r),i.on("close",a=>{a===0?n():r(new Error(`git ${t[0]} failed (${a}): ${o.slice(0,300)}`))})}),"runGit");async function ot(t){const e=t.git??W,s=t.cloneUrl??(r=>`https://github.com/${r}.git`);B(I(t.dir,$),{recursive:!0});const n=t.token===null?{}:{GIT_CONFIG_COUNT:"1",GIT_CONFIG_KEY_0:"http.https://github.com/.extraheader",GIT_CONFIG_VALUE_0:`AUTHORIZATION: basic ${Buffer.from(`x-access-token:${t.token}`).toString("base64")}`};for(const r of t.recipe.repositories){if(!/^[A-Za-z0-9._-]+$/.test(r.name)||r.name==="."||r.name==="..")throw new Error(`repository name ${JSON.stringify(r.name)} is not a plain directory name`);await e(["clone","--quiet","--branch",r.default_branch,s(r.github_full_name),I($,r.name)],n,t.dir)}R(I(t.dir,"Dockerfile"),V(t.recipe,t.revision)),t.recipe.setup_script!==null&&t.recipe.setup_script.trim()!==""&&R(I(t.dir,U),t.recipe.setup_script.endsWith(`
+`)?t.recipe.setup_script:`${t.recipe.setup_script}
+`)}p(ot,"prepareBuildDir");function N(t,e,s){for(const n of A(e).sort()){const r=I(e,n),i=v(r),o=G(t,r).split("\\").join("/");i.isDirectory()?N(t,r,s):i.isSymbolicLink()?s.push({name:o,data:Buffer.from(P(r)),mode:L.S_IFLNK|511}):i.isFile()&&s.push({name:o,data:D(r),mode:L.S_IFREG|i.mode&511})}}p(N,"walk");function Z(t){const e=[];N(t,t,e);const s=[],n=[];let r=0;for(const a of e){const d=Buffer.from(a.name),h=F(a.data),w=M(a.data),c=Buffer.alloc(30);c.writeUInt32LE(67324752,0),c.writeUInt16LE(20,4),c.writeUInt16LE(2048,6),c.writeUInt16LE(8,8),c.writeUInt32LE(33,12),c.writeUInt32LE(w,14),c.writeUInt32LE(h.length,18),c.writeUInt32LE(a.data.length,22),c.writeUInt16LE(d.length,26),s.push(c,d,h);const l=Buffer.alloc(46);l.writeUInt32LE(33639248,0),l.writeUInt16LE(788,4),l.writeUInt16LE(20,6),l.writeUInt16LE(2048,8),l.writeUInt16LE(8,10),l.writeUInt32LE(33,14),l.writeUInt32LE(w,16),l.writeUInt32LE(h.length,20),l.writeUInt32LE(a.data.length,24),l.writeUInt16LE(d.length,28),l.writeUInt32LE(a.mode<<16>>>0,38),l.writeUInt32LE(r,42),n.push(l,d),r+=c.length+d.length+h.length}const i=Buffer.concat(n),o=Buffer.alloc(22);return o.writeUInt32LE(101010256,0),o.writeUInt16LE(e.length,8),o.writeUInt16LE(e.length,10),o.writeUInt32LE(i.length,12),o.writeUInt32LE(r,16),Buffer.concat([...s,i,o])}p(Z,"zipDirectory");async function x(t,e,s,n,r=[]){const i=`${t.controlUrl??"https://api.blaxel.ai/v0"}${s}`,o=await(t.fetch??fetch)(i,{method:e,headers:{authorization:`Bearer ${t.apiKey}`,"x-blaxel-workspace":t.workspace,"content-type":"application/json"},...n===void 0?{}:{body:JSON.stringify(n)}}),a=await o.text();let d=null;if(a!=="")try{d=JSON.parse(a)}catch{d={raw:a}}if(!o.ok&&!r.includes(o.status))throw new j(o.status,null,`Blaxel ${e} ${i} failed (${o.status}): ${a.slice(0,300)}`);return{status:o.status,headers:o.headers,json:d}}p(x,"api");async function S(t,e){const{status:s,json:n}=await x(t,"GET",`/images/sandbox/${encodeURIComponent(e)}`,void 0,[404]);return s===404?null:n}p(S,"getImage");async function st(t,e){await x(t,"DELETE",`/images/sandbox/${encodeURIComponent(e)}`,void 0,[404])}p(st,"deleteImage");async function at(t,e,s,n={}){const r=n.sleep??(u=>new Promise(f=>setTimeout(f,u))),i=Date.now(),o=await S(t,e),a=new Set((o?.spec?.tags??[]).map(u=>u.name)),d=o?.metadata?.events?.length??0,w=(await x(t,"POST","/images",{resourceType:"sandbox",name:e})).headers.get("x-blaxel-upload-url");if(w===null)throw new Error(`Blaxel gave no upload URL for image ${e}`);const c=await(t.fetch??fetch)(w,{method:"PUT",headers:{"content-type":"application/zip"},body:new Uint8Array(Z(s))});if(!c.ok)throw new Error(`uploading the build context of image ${e} failed (${c.status}): ${(await c.text()).slice(0,300)}`);const l=i+(n.timeoutMs??20*6e4);for(;;){const u=await S(t,e),f=u?.metadata?.status;if(f==="BUILT"&&(u?.metadata?.events?.length??0)>=d+2){const m=(u?.spec?.tags??[]).filter(g=>g.name!==void 0),_=m.filter(g=>!a.has(g.name)),b=(_.length>0?_:m).sort((g,k)=>(k.updatedAt??"").localeCompare(g.updatedAt??""))[0]?.name;if(b===void 0)throw new Error(`Blaxel built image ${e} but no new tag appeared`);return{ref:`sandbox/${e}:${b}`,buildMs:Date.now()-i}}if(f==="FAILED"||f==="TERMINATED"){const m=u?.metadata?.events??[];throw new Error(`building image ${e} ${f.toLowerCase()}: ${m[m.length-1]?.message??"no message"}`)}if(Date.now()>l)throw new Error(`building image ${e} did not finish within ${n.timeoutMs??20*6e4} ms (last status ${f??"none"})`);await r(n.pollMs??3e3)}}p(at,"buildImage");const it=p(t=>`env-${t}`,"environmentImageName");function ct(t){C(t,{recursive:!0,force:!0})}p(ct,"removeBuildDir");export{Y as NODE_BASE_IMAGE,y as RECIPE_PI_AGENT_DIR,$ as REPOS_DIR,U as SETUP_SCRIPT_FILE,at as buildImage,st as deleteImage,it as environmentImageName,S as getImage,ot as prepareBuildDir,V as recipeDockerfile,ct as removeBuildDir,Z as zipDirectory};

package/dist/core/runtime/runner/blaxel/runner.d.ts

@@ -0,0 +1,41 @@
+import type { Runner, RunnerExecution, RunnerStartInput } from '../types.js';
+import { BlaxelApiError, type BlaxelClient } from './client.js';
+/** The broker listens here inside the sandbox; the private preview forwards it (`wss://<preview>/view`). */
+export declare const BROKER_VIEW_PORT = 4180;
+/** Where the bootstrap keeps the newest release it installed; the wake script is run from here. */
+export declare const WAKE_COMMAND = "node /opt/crtr/current/scripts/sandbox-start.mjs --wake";
+/** `crtr-sandbox-start --wake` exits with this when no broker of the execution runs. */
+export declare const EXIT_NO_BROKER = 3;
+/** A failing start script prints a last line `crtr-sandbox-start: failed <reason>`; `status` reports the reason. */
+export declare const FAILURE_LINE: RegExp;
+export declare const brokerProcessName: (executionId: string) => string;
+export declare const sandboxNameFor: (execution: RunnerExecution) => string;
+/** What `start` needs from the control plane beyond the execution: the environment's image and size, the release object, the secrets. */
+export interface BlaxelLaunchContext {
+    /** `environments.image_ref` for a recipe environment, else `blaxel/base-image:latest`. */
+    image: string;
+    memoryMb: number;
+    /** `CRTR_API_URL` the broker reaches `/v1` at. */
+    apiUrl: string;
+    /** Signed GET of `releases/<version>/runtime.tar.gz` (15 min) and its sha256. */
+    releaseUrl: string;
+    releaseSha256: string;
+    /** The environment's secrets, opened at this call (Environment secrets resolution). Never `CRTR_*` or `HOME`. */
+    secrets: Record<string, string>;
+}
+export interface BlaxelRunnerDeps {
+    client: BlaxelClient;
+    launchContext(input: RunnerStartInput): Promise<BlaxelLaunchContext>;
+    /** Mints the execution's node token (the execution must be `launching` and have none). Default: `mintNodeToken`. */
+    mintToken?(input: RunnerStartInput): Promise<string>;
+    /** The bootstrap script text passed as the process command (`scripts/sandbox-bootstrap.sh`). */
+    bootstrap(): string;
+    /** Sandbox names that belong to a node, for `delete`. Default: the node's executions' `sandbox_name`. */
+    sandboxNamesForNode?(nodeId: string): Promise<string[]>;
+    /** Seconds `stop` waits after SIGTERM before the kill. */
+    stopGraceS?: number;
+}
+export declare function createBlaxelRunner(deps: BlaxelRunnerDeps): Runner & {
+    sandboxState(execution: RunnerExecution): Promise<string | null>;
+};
+export { BlaxelApiError };

package/dist/core/runtime/runner/blaxel/runner.js

@@ -0,0 +1,3 @@
+var _=Object.defineProperty;var o=(t,a)=>_(t,"name",{value:a,configurable:!0});import{withCanvasWrite as R,openDb as g}from"../../../canvas/db.js";import{mintNodeToken as I}from"../../../canvas/node-tokens.js";import{BlaxelApiError as k}from"./client.js";const x=4180,l="view",T="node /opt/crtr/current/scripts/sandbox-start.mjs --wake",S=3,C=/^crtr-sandbox-start: failed (\S+)/m,m=o(t=>`broker-${t}`,"brokerProcessName"),f=o(t=>t.sandboxName??`${t.nodeId}-${t.attempt}`,"sandboxNameFor"),N=o(async t=>await R(a=>I(a,t.executionId,t.nodeId,new Date().toISOString())),"defaultMint");async function y(t){return(await(await g()).prepare("SELECT DISTINCT sandbox_name FROM executions WHERE node_id = ? AND sandbox_name IS NOT NULL").all(t)).map(u=>u.sandbox_name)}o(y,"defaultSandboxNames");function P(t){const a=`${t.logs}
+${t.stderr}
+${t.stdout}`;return{state:"failed",reason:C.exec(a)?.[1]??"start_failed",code:t.exitCode}}o(P,"failureOf");function v(t){const{client:a}=t,u=(t.stopGraceS??10)*1e3,E=new Map;async function d(n){return await a.getSandbox(f(n))}return o(d,"sandboxOf"),{kind:"blaxel",async start(n){const r=await t.launchContext(n),e=f(n),s=await a.createSandbox({name:e,image:r.image,memoryMb:r.memoryMb,ports:[{name:l,target:x}]}),i=m(n.executionId);if((await a.getProcess(s,i))?.status==="running")return{pid:null,exited:null};await a.ensurePreview(e,l,x);const w=await(t.mintToken??N)(n),p={...r.secrets,CRTR_API_URL:r.apiUrl,CRTR_EXECUTION_ID:n.executionId,CRTR_NODE_TOKEN:w,CRTR_RELEASE:n.release,CRTR_RELEASE_URL:r.releaseUrl,CRTR_RELEASE_SHA256:r.releaseSha256};return await a.startProcess(s,{name:i,command:t.bootstrap(),env:p,waitForCompletion:!1}),{pid:null,exited:null}},async wake(n){const r=await d(n);if(r===null)return"no_broker";const e=await a.exec(r,`wake-${n.executionId}-${Date.now()}`,`${T} ${n.executionId}`,30);if(e.exitCode===0)return"signalled";if(e.exitCode===S)return"no_broker";throw new Error(`wake of ${n.executionId} failed (exit ${e.exitCode}): ${(e.stderr||e.logs).slice(0,300)}`)},async stop(n,r){try{const e=await d(n);if(e===null)return{confirmed:!0};const s=m(n.executionId),i=o(async()=>(await a.getProcess(e,s))?.status==="running","running");if(!await i())return{confirmed:!0};await a.stopProcess(e,s);const c=Date.now()+u;for(;Date.now()<c;){if(!await i())return{confirmed:!0};await new Promise(w=>setTimeout(w,250))}return await a.killProcess(e,s),{confirmed:!await i()}}catch(e){return{confirmed:!1,error:e instanceof Error?e:new Error(String(e))}}},async status(n){try{const r=await d(n);if(r===null)return{state:"gone"};const e=await a.getProcess(r,m(n.executionId));return e===null?{state:"gone"}:e.status==="running"?{state:"running",pid:null}:e.status==="failed"||e.status==="completed"&&e.exitCode!==0?P(e):{state:"gone"}}catch(r){return{state:"unknown",error:r instanceof Error?r.message:String(r)}}},async delete(n){for(const r of await(t.sandboxNamesForNode??y)(n))await a.deleteSandbox(r)},async viewerAddress(n){const r=f(n),e=E.get(r);if(e&&e.expiresAt-Date.now()>5*6e4)return b(e.url,e.token);const s=await a.ensurePreview(r,l,x),i=new Date(Date.now()+60*6e4),{token:c}=await a.createPreviewToken(r,l,i);return E.set(r,{url:s,token:c,expiresAt:i.getTime()}),b(s,c)},async sandboxState(n){return(await d(n))?.state??null}}}o(v,"createBlaxelRunner");function b(t,a){return{kind:"wss",url:`${t.replace(/^https:/,"wss:")}/view`,headers:{"x-blaxel-preview-token":a}}}o(b,"viewer");export{x as BROKER_VIEW_PORT,k as BlaxelApiError,S as EXIT_NO_BROKER,C as FAILURE_LINE,T as WAKE_COMMAND,m as brokerProcessName,v as createBlaxelRunner,f as sandboxNameFor};

package/dist/core/runtime/runner/index.d.ts

@@ -0,0 +1,8 @@
+import type { Runner, RunnerKind } from './types.js';
+/** The Blaxel implementation is installed by the cloud runner module. */
+export declare function registerBlaxelRunner(runner: Runner): void;
+export declare function runnerKindForEnvironment(kind: 'machine' | 'blaxel'): RunnerKind;
+export declare function runnerForEnvironment(kind: 'machine' | 'blaxel'): Runner;
+export declare function runnerForEnvironmentId(environmentId: string): Promise<Runner>;
+/** The runner that holds an execution row, by the row's `runner` column. */
+export declare function runnerForExecution(runner: RunnerKind): Runner;

package/dist/core/runtime/runner/index.js

@@ -0,0 +1 @@
+var i=Object.defineProperty;var r=(n,e)=>i(n,"name",{value:e,configurable:!0});import{openDb as u}from"../../canvas/db.js";import{processRunner as l}from"./process.js";let o=null;function x(n){if(n.kind!=="blaxel")throw new Error("expected a Blaxel runner");o=n}r(x,"registerBlaxelRunner");function f(n){return n==="machine"?"process":"blaxel"}r(f,"runnerKindForEnvironment");function t(n){if(n==="machine")return l;if(o===null)throw new Error("Blaxel runner is not registered");return o}r(t,"runnerForEnvironment");async function m(n){const e=await(await u()).prepare("SELECT kind FROM environments WHERE object = ?").get(n);if(!e)throw new Error(`environment ${n} not found`);return t(e.kind)}r(m,"runnerForEnvironmentId");function s(n){return t(n==="process"?"machine":"blaxel")}r(s,"runnerForExecution");export{x as registerBlaxelRunner,t as runnerForEnvironment,m as runnerForEnvironmentId,s as runnerForExecution,f as runnerKindForEnvironment};

package/dist/core/runtime/runner/process.d.ts

@@ -0,0 +1,11 @@
+import type { Runner, RunnerExit, RunnerStartInput } from './types.js';
+/** The local runner delegates process ownership to the existing detached broker host. */
+/** `start` narrows `exited` to non-null: the process runner always observes its child. */
+export declare const processRunner: Omit<Runner, 'start'> & {
+    start(input: RunnerStartInput): Promise<{
+        pid: number | null;
+        exited: Promise<RunnerExit>;
+    }>;
+} & {
+    kind: 'process';
+};

package/dist/core/runtime/runner/process.js

@@ -0,0 +1 @@
+var l=Object.defineProperty;var i=(e,r)=>l(e,"name",{value:r,configurable:!0});import{existsSync as w,mkdirSync as m}from"node:fs";import{join as u}from"node:path";import{InputError as f}from"../../io.js";import{getNode as c}from"../../canvas/index.js";import{liveExecutionForNode as p}from"../../canvas/executions.js";import{nodeRunDir as s,viewSocketPath as I}from"../../canvas/paths.js";import{capturePidIdentities as h,identitiesMatch as y,isPidAlive as g}from"../../canvas/pid.js";import{writeFileBeneath as v}from"../../spaces/open-beneath.js";import{headlessBrokerHost as a}from"../host.js";async function t(e){const r=await p(e.nodeId);if(r?.executionId!==e.executionId||r.pid===null||!g(r.pid))return null;const o=h([r.pid])?.get(r.pid);return r.processIdentity&&o&&y(o,r.processIdentity)?r.pid:null}i(t,"pidFor");const F={kind:"process",async start(e){if(!w(e.cwd))throw new f({error:"cwd_missing",message:`${e.nodeId} cannot be revived \u2014 its recorded cwd no longer exists: ${e.cwd}`,next:`Recreate ${e.cwd}, or repair it with \`crtr node config --cwd <path> --node ${e.nodeId}\`; then retry \`crtr node lifecycle revive ${e.nodeId}\`.`});const r=s(e.nodeId);m(r,{recursive:!0}),v(r,u(r,"broker-launch.json"),e.launchJson,{atomic:!0});const o=JSON.parse(e.launchJson),n=await c(e.nodeId);if(!n)throw new Error(`node ${e.nodeId} not found`);const d=await a.launch(e.nodeId,o,{cwd:e.cwd,name:n.name??e.nodeId,resuming:e.resuming,launchJson:e.launchJson});return{pid:d.pid,exited:d.exited}},async wake(e){const r=await t(e);if(r===null)return"no_broker";try{return process.kill(r,"SIGUSR1"),"signalled"}catch(o){if(o.code==="ESRCH")return"no_broker";throw o}},async stop(e,r){const o=await t(e);if(o===null)return{confirmed:!0};if((await c(e.nodeId))?.pi_pid!==o)throw new Error(`node ${e.nodeId} no longer points at execution ${e.executionId}`);return a.teardown(e.nodeId,{excludePid:r.excludePid})},async status(e){const r=await t(e);return r!==null?{state:"running",pid:r}:{state:"gone"}},async delete(e){const{rm:r}=await import("node:fs/promises");await r(s(e),{recursive:!0,force:!0})},async viewerAddress(e){return{kind:"unix",path:I(e.nodeId)}}};export{F as processRunner};

package/dist/core/runtime/runner/types.d.ts

@@ -0,0 +1,95 @@
+export type RunnerKind = 'process' | 'blaxel';
+/** The identity of one execution as the runner is asked about it. Rows already hold these. */
+export interface RunnerExecution {
+    executionId: string;
+    nodeId: string;
+    /** `executions.attempt`, the sandbox name suffix. */
+    attempt: number;
+    /** `executions.sandbox_name`, null for the process runner. */
+    sandboxName: string | null;
+}
+/** What `start` needs beyond the execution: the execution row's `launch_json` is the launch recipe. */
+export interface RunnerStartInput extends RunnerExecution {
+    /** The release the wake accepted (`executions.release`). */
+    release: string;
+    /** `executions.launch_json`: invocation argv and env, config snapshot, system prompt text, scopes. */
+    launchJson: string;
+    /** The working directory the broker starts in. */
+    cwd: string;
+    /** True when the broker resumes a saved session. */
+    resuming: boolean;
+}
+export interface RunnerStarted {
+    /** The broker's pid on a Mac; null where the runner cannot see one (Blaxel reports through `broker.started`). */
+    pid: number | null;
+    /** Resolves when the broker process ends, where the runner observes it (process runner); never for Blaxel. */
+    exited: Promise<RunnerExit> | null;
+}
+export interface RunnerExit {
+    code: number | null;
+    signal: NodeJS.Signals | null;
+    oomKilled?: boolean;
+}
+/** Process status of the named execution's broker. A frozen Blaxel broker reads `running`: the sandbox's own status is never the freeze signal. */
+export type RunnerStatus = {
+    state: 'running';
+    pid: number | null;
+}
+/** No process: the sandbox is absent, or present without the broker or start script. */
+ | {
+    state: 'gone';
+}
+/** The start script or broker ended non-zero; `reason` is the script's reason (`cwd_missing`, `extension_unavailable`, ...). */
+ | {
+    state: 'failed';
+    reason: string;
+    code: number | null;
+}
+/** The runner could not tell (a Blaxel API error). The caller leaves everything as it is and retries on the next claim. */
+ | {
+    state: 'unknown';
+    error: string;
+};
+export type RunnerWakeResult = 'signalled' | 'no_broker';
+export interface RunnerStopOptions {
+    /** Why: written to `executions.stop_reason` by the caller; carried here for the runner's diagnostics. */
+    reason: string;
+    /** A process whose tree is already known to the caller is excluded from the kill (the caller's own relay). */
+    excludePid?: number;
+}
+export interface RunnerStopResult {
+    /** False when the process could not be confirmed dead; the caller must not clean up what the broker owned. */
+    confirmed: boolean;
+    error?: Error;
+}
+/** Where a viewer connects. */
+export type RunnerViewerAddress = {
+    kind: 'unix';
+    path: string;
+} | {
+    kind: 'wss';
+    url: string;
+    headers: Record<string, string>;
+};
+export interface Runner {
+    readonly kind: RunnerKind;
+    /**
+     * Hand the execution to its environment and start the broker. The node token is minted INSIDE this call
+     * (`mintNodeToken` returns the raw token; the execution must be `launching` and have no token row) and
+     * handed over without being kept: fd 3 / unlinked file (process runner), process env (Blaxel). The process
+     * runner writes `broker-launch.json` from `launchJson` into the run dir and checks the cwd exists.
+     * Throws on refusal (cap, cwd missing, quota); the caller ends the execution `launch_failed`.
+     */
+    start(input: RunnerStartInput): Promise<RunnerStarted>;
+    /** Signal the execution's broker to look for mail again. `no_broker` when no process of that execution runs. Carries no token and starts nothing. */
+    wake(execution: RunnerExecution): Promise<RunnerWakeResult>;
+    /** Stop the execution's broker. Repeating it on a stopped execution confirms. */
+    stop(execution: RunnerExecution, options: RunnerStopOptions): Promise<RunnerStopResult>;
+    status(execution: RunnerExecution): Promise<RunnerStatus>;
+    /** Remove everything the runner holds for the node: the run dir (process) or the sandbox (Blaxel). */
+    delete(nodeId: string): Promise<void>;
+    /** Where a viewer reaches this execution's broker. */
+    viewerAddress(execution: RunnerExecution): Promise<RunnerViewerAddress>;
+}
+/** The runner for an environment kind: `machine` → process, `blaxel` → Blaxel. */
+export type RunnerForKind = (kind: 'machine' | 'blaxel') => Runner;

package/dist/core/runtime/situational-context.d.ts

@@ -11,9 +11,6 @@ export declare function formatSituationalProse(prose: string): string;
  *  one sanctioned writer for the sidecar, taking an ALREADY-RENDERED envelope.
  *  No-op for blank text, so a caller can pass through an optional/empty value
  *  with no guard at the call site. */
-export declare function appendSituationalContext(nodeId: string, text: string): void;
-/** The node's stored situational card, verbatim, or null when none is set.
- *  The ONE read of the sidecar. A sidecar written before the card cut holds
- *  bare prose; that single legacy branch lives here alone and self-clears on
- *  the next situation change. */
-export declare function situationalContextEnvelope(nodeId: string): string | null;
+export declare function appendSituationalContext(nodeId: string, text: string): Promise<void>;
+/** The node's latest situational card, never read from the control plane's disk. */
+export declare function situationalContextEnvelope(nodeId: string): Promise<string | null>;

package/dist/core/runtime/situational-context.js

@@ -1,2 +1,2 @@
-var a=Object.defineProperty;var n=(t,r)=>a(t,"name",{value:r,configurable:!0});import{mkdirSync as u}from"node:fs";import{readTextBeneathIfExists as m,writeFileBeneath as l}from"../spaces/open-beneath.js";import{situationalContextPath as o,nodeRunDir as i}from"../canvas/paths.js";import{formatCard as f,parseCard as p}from"../../shared/generated-context.js";import{shareRunFileWithBroker as c}from"./structured-output.js";import{SITUATIONAL_CONTEXT_CUSTOM_TYPE as b}from"../../shared/generated-context.js";function s(t){return t.trim()===""?"":f("situational",{},t)}n(s,"formatSituationalProse");function B(t,r){const e=r.trim();e!==""&&(u(i(t),{recursive:!0}),l(i(t),o(t),e+`
-`,{atomic:!0}),c(t,o(t)))}n(B,"appendSituationalContext");function x(t){const r=m(i(t),o(t))?.trim()??"";return r!==""?r:null}n(x,"readSituationalContext");function O(t){const r=x(t);return r===null?null:p({content:r})===null?s(r):r}n(O,"situationalContextEnvelope");export{b as SITUATIONAL_CONTEXT_CUSTOM_TYPE,B as appendSituationalContext,s as formatSituationalProse,O as situationalContextEnvelope};
+var i=Object.defineProperty;var a=(t,o)=>i(t,"name",{value:o,configurable:!0});import{openDb as r}from"../canvas/db.js";import{formatCard as e,parseCard as u}from"../../shared/generated-context.js";import{SITUATIONAL_CONTEXT_CUSTOM_TYPE as T}from"../../shared/generated-context.js";function p(t){return t.trim()===""?"":e("situational",{},t)}a(p,"formatSituationalProse");async function l(t,o){const n=o.trim();n!==""&&await(await r()).prepare("UPDATE nodes SET situational_card = ? WHERE node_id = ?").run(n+`
+`,t)}a(l,"appendSituationalContext");async function E(t){const n=(await(await r()).prepare("SELECT situational_card FROM nodes WHERE node_id = ?").get(t))?.situational_card?.trim()??"";return n===""?null:u({content:n})===null?p(n):n}a(E,"situationalContextEnvelope");export{T as SITUATIONAL_CONTEXT_CUSTOM_TYPE,l as appendSituationalContext,p as formatSituationalProse,E as situationalContextEnvelope};

package/dist/core/runtime/situational-live.js

@@ -1 +1 @@
-var i=Object.defineProperty;var n=(t,e)=>i(t,"name",{value:e,configurable:!0});import{getNode as a}from"../canvas/index.js";import{deliverCustomMessageLive as r}from"./deliver-live.js";import{appendSituationalContext as l,formatSituationalProse as u,situationalContextEnvelope as s,SITUATIONAL_CONTEXT_CUSTOM_TYPE as m}from"./situational-context.js";async function C(t,e){if(l(t,u(e)),await a(t)===null)throw new Error(`setSituationalContextLive: unknown node ${t}`);const o=s(t);o!==null&&await r(t,{customType:m,content:o,deliverAs:"nextTurn"})}n(C,"setSituationalContextLive");export{C as setSituationalContextLive};
+var n=Object.defineProperty;var i=(t,e)=>n(t,"name",{value:e,configurable:!0});import{getNode as a}from"../canvas/index.js";import{deliverCustomMessageLive as r}from"./deliver-live.js";import{appendSituationalContext as l,formatSituationalProse as u,situationalContextEnvelope as s,SITUATIONAL_CONTEXT_CUSTOM_TYPE as m}from"./situational-context.js";async function w(t,e){if(await l(t,u(e)),await a(t)===null)throw new Error(`setSituationalContextLive: unknown node ${t}`);const o=await s(t);o!==null&&await r(t,{customType:m,content:o,deliverAs:"nextTurn"})}i(w,"setSituationalContextLive");export{w as setSituationalContextLive};

package/dist/core/runtime/spawn-env-rows.d.ts

@@ -0,0 +1,5 @@
+import type { PiInvocation } from './invocation.js';
+/** The app process env for a launch: the secrets of the node's environment (the app's rows, the environment owner's profile rows, the deployment rows). */
+export declare function buildAppProcessEnv(targetCwd: string, targetProfileId: string | null, app: string): Promise<NodeJS.ProcessEnv>;
+/** The one authoritative broker child env; every broker launch funnels through `headlessBrokerHost.launch()`, which calls this. */
+export declare function buildBrokerEnv(inv: PiInvocation): Promise<NodeJS.ProcessEnv>;

package/dist/core/runtime/spawn-env-rows.js

@@ -0,0 +1 @@
+var c=Object.defineProperty;var e=(r,o)=>c(r,"name",{value:o,configurable:!0});import{localEnvironmentSecrets as s}from"../secrets/environment-owner.js";import{composeAppProcessEnv as p,overlayBrokerEnv as a}from"./spawn-env.js";async function E(r,o,n){return p(r,o,n,await s(o,n),{})}e(E,"buildAppProcessEnv");async function m(r){const o=r.env.CRTR_NODE_CWD??process.cwd(),n=r.env.CRTR_PROFILE_ID||null,t=r.env.CRTR_GRANTEE??"app:terminal";return a(r,await E(o,n,t))}e(m,"buildBrokerEnv");export{E as buildAppProcessEnv,m as buildBrokerEnv};

package/dist/core/runtime/spawn-env.d.ts

@@ -34,21 +34,7 @@ export declare function buildOperationalEnvBase(opts: {
  *  are readable back (`profile show`, ProfileDTO). Read straight off the
  *  manifest at every launch; never throws (a bad profile id yields `{}`). */
 export declare function profileMetadataEnv(profileId: string | null): NodeJS.ProcessEnv;
-/** The one authoritative broker child env: sources A–C (the operational
- *  base, resolved from the TARGET node's own cwd/profile — `inv.env`'s
- *  `CRTR_NODE_CWD`/`CRTR_PROFILE_ID`, never this process's ambient
- *  `process.cwd()`/`CRTR_PROFILE_ID`, which may be a launcher's or the
- *  daemon's own and belong to an unrelated scope), E — the TARGET profile's
- *  own `profile env` store (`readProfileEnvVars`, `core/profiles/env-store.ts`)
- *  read directly off disk only when the profile belongs to the launched app, regardless of the host env or any
- *  `spawnEnv.allow` entry (setting a value there IS the consent to cross this
- *  boundary), F — the TARGET profile's manifest metadata as
- *  `CRTR_PROFILE_META_*` (`profileMetadataEnv` above), plus D — the trusted,
- *  crtr-constructed `inv.env` overlay and the
- *  fork-bomb recursion guard `FRONT_DOOR_ENV=1`. D is layered last so crtr's
- *  own constructed env always wins a name collision with a stored profile
- *  value. Every broker launch (front-door root, managed child, `--root`,
- *  every revive/daemon relaunch) funnels through `headlessBrokerHost.launch()`,
- *  which calls this. */
-export declare function buildAppProcessEnv(targetCwd: string, targetProfileId: string | null, app: string): NodeJS.ProcessEnv;
-export declare function buildBrokerEnv(inv: PiInvocation): NodeJS.ProcessEnv;
+/** The app process env: the operational base, the app's and the target profile's stored rows (read by `spawn-env-rows.ts`), and the pins below. */
+export declare function composeAppProcessEnv(targetCwd: string, targetProfileId: string | null, app: string, appVars: Record<string, string>, profileVars: Record<string, string>): NodeJS.ProcessEnv;
+/** A broker's env: the trusted `inv.env` overlay on an app process env, plus the fork-bomb guard. */
+export declare function overlayBrokerEnv(inv: PiInvocation, base: NodeJS.ProcessEnv): NodeJS.ProcessEnv;

package/dist/core/runtime/spawn-env.js

@@ -1 +1 @@
-var E=Object.defineProperty;var c=(t,e)=>E(t,"name",{value:e,configurable:!0});import{statSync as _}from"node:fs";import{SANDBOX_RUNTIME_HOME as R}from"../spaces/runtime-home.js";import{appProcessHome as p,appSpace as d,layoutRoot as T,runtimeRoot as m}from"../layout.js";import{delimiter as O,join as A,resolve as P}from"node:path";import{readMergedLaunchConfig as H}from"../config.js";import{readProfileEnvVars as M}from"../profiles/env-store.js";import{readAppEnvVars as N}from"../profiles/app-env-store.js";import{loadProfileManifest as h,metadataEnvName as I,readProfileMetadata as C}from"../profiles/manifest.js";import{binShimDirFor as w}from"./bin-contributions.js";import{FRONT_DOOR_ENV as v}from"./front-door-env.js";const D=new Set(["HOME","PATH","SHELL","USER","LOGNAME","TMPDIR","TERM","TERMINFO","COLORTERM","LANG","LANGUAGE","TZ","NO_PROXY","no_proxy","SSH_AUTH_SOCK","CRTR_BASH_VALVE_MS"]),S=["LC_","XDG_","PI_"],l="CRTR_ADMITTED_HOST_PATH";function y(t,e,o){const r=e.PATH;if(r===void 0||r==="")return null;for(const s of r.split(O)){const i=P(o,s===""?".":s,t);try{const n=_(i);if(n.isFile()&&(n.mode&73)!==0)return i}catch{}}return null}c(y,"resolvePathExecutable");function q(t,e,o){const r=e[l]??e.PATH;if(r===void 0||r==="")throw new Error(`cannot resolve crouter-owned ${t}: the admitted host PATH is empty`);const s=y(t,{PATH:r},o);if(s!==null)return s;throw new Error(`cannot resolve crouter-owned ${t} from the admitted host PATH`)}c(q,"resolveAdmittedHostCommand");const x=["HTTP_PROXY","HTTPS_PROXY","http_proxy","https_proxy"],u={anthropic:"ANTHROPIC_API_KEY",openai:"OPENAI_API_KEY"};function L(t){let e;try{e=new URL(t)}catch{return!1}return!(e.protocol!=="http:"&&e.protocol!=="https:"||e.hostname===""||e.username!==""||e.password!=="")}c(L,"isCredentialFreeProxyValue");function b(t,e){if(!e.includes("*"))return t===e;const o=e.split("*").map(r=>r.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")).join(".*");return new RegExp(`^${o}$`).test(t)}c(b,"matchesAllowPattern");function G(t){const e=t.host??process.env,o={};for(const[n,a]of Object.entries(e))a!==void 0&&(D.has(n)||S.some(f=>n.startsWith(f)))&&(o[n]=a);o.PWD=t.targetCwd;for(const n of x){const a=e[n];a!==void 0&&L(a)&&(o[n]=a)}const r=t.skipSpawnAllow?[]:H(t.targetCwd,t.targetProfileId).spawnEnv.allow;if(r.length>0)for(const[n,a]of Object.entries(e))a!==void 0&&r.some(f=>b(n,f))&&(o[n]=a);const s=e[l]??o.PATH;s!==void 0&&s!==""&&(o[l]=s);const i=w(t.targetCwd,t.targetProfileId);if(i!==null){const n=o.PATH;o.PATH=n===void 0||n===""?i:`${i}:${n}`}return o}c(G,"buildOperationalEnvBase");function V(t){const e={};for(const[o,r]of Object.entries(C(t)))e[I(o)]=r;return e}c(V,"profileMetadataEnv");function g(t,e,o){const r=e===null?null:h(e).manifest,s=r!==null&&(r.grantee??"app:terminal")===o,i=G({targetCwd:t,targetProfileId:e,skipSpawnAllow:o!=="app:terminal"}),n={...i,...N(o),...r===null?{}:V(e),...s?M(e):{},HOME:p(o),PI_CODING_AGENT_DIR:A(d(o).home,".pi","agent"),[l]:i[l],...process.platform==="linux"?{CRTR_RUNTIME_HOME:R}:{CRTR_HOME:T(),CRTR_RUNTIME_HOME:process.env.CRTR_RUNTIME_HOME??m()}};for(const a of Object.values(u))delete n[a];return n}c(g,"buildAppProcessEnv");function z(t){const e=t.env.CRTR_NODE_CWD??process.cwd(),o=t.env.CRTR_PROFILE_ID||null,r=t.env.CRTR_GRANTEE??"app:terminal",s=g(e,o,r),i={...s,...t.env,HOME:s.HOME,PI_CODING_AGENT_DIR:s.PI_CODING_AGENT_DIR,[l]:s[l],CRTR_RUNTIME_HOME:s.CRTR_RUNTIME_HOME,[v]:"1"};for(const n of Object.values(u))delete i[n];return i}c(z,"buildBrokerEnv");export{l as ADMITTED_HOST_PATH_ENV,u as PROVIDER_ENV_KEYS,g as buildAppProcessEnv,z as buildBrokerEnv,G as buildOperationalEnvBase,V as profileMetadataEnv,q as resolveAdmittedHostCommand,y as resolvePathExecutable};
+var E=Object.defineProperty;var a=(e,t)=>E(e,"name",{value:t,configurable:!0});import{statSync as _}from"node:fs";import{SANDBOX_RUNTIME_HOME as p}from"../spaces/runtime-home.js";import{appProcessHome as T,appSpace as d,layoutRoot as R,runtimeRoot as m}from"../layout.js";import{delimiter as O,join as A,resolve as P}from"node:path";import{readMergedLaunchConfig as H}from"../config.js";import{loadProfileManifest as M,metadataEnvName as h,readProfileMetadata as N}from"../profiles/manifest.js";import{binShimDirFor as I}from"./bin-contributions.js";import{FRONT_DOOR_ENV as v}from"./front-door-env.js";const w=new Set(["HOME","PATH","SHELL","USER","LOGNAME","TMPDIR","TERM","TERMINFO","COLORTERM","LANG","LANGUAGE","TZ","NO_PROXY","no_proxy","SSH_AUTH_SOCK","CRTR_BASH_VALVE_MS"]),C=["LC_","XDG_","PI_"],l="CRTR_ADMITTED_HOST_PATH";function S(e,t,o){const r=t.PATH;if(r===void 0||r==="")return null;for(const s of r.split(O)){const c=P(o,s===""?".":s,e);try{const n=_(c);if(n.isFile()&&(n.mode&73)!==0)return c}catch{}}return null}a(S,"resolvePathExecutable");function b(e,t,o){const r=t[l]??t.PATH;if(r===void 0||r==="")throw new Error(`cannot resolve crouter-owned ${e}: the admitted host PATH is empty`);const s=S(e,{PATH:r},o);if(s!==null)return s;throw new Error(`cannot resolve crouter-owned ${e} from the admitted host PATH`)}a(b,"resolveAdmittedHostCommand");const D=["HTTP_PROXY","HTTPS_PROXY","http_proxy","https_proxy"],u={anthropic:"ANTHROPIC_API_KEY",openai:"OPENAI_API_KEY"};function y(e){let t;try{t=new URL(e)}catch{return!1}return!(t.protocol!=="http:"&&t.protocol!=="https:"||t.hostname===""||t.username!==""||t.password!=="")}a(y,"isCredentialFreeProxyValue");function x(e,t){if(!t.includes("*"))return e===t;const o=t.split("*").map(r=>r.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")).join(".*");return new RegExp(`^${o}$`).test(e)}a(x,"matchesAllowPattern");function L(e){const t=e.host??process.env,o={};for(const[n,i]of Object.entries(t))i!==void 0&&(w.has(n)||C.some(f=>n.startsWith(f)))&&(o[n]=i);o.PWD=e.targetCwd;for(const n of D){const i=t[n];i!==void 0&&y(i)&&(o[n]=i)}const r=e.skipSpawnAllow?[]:H(e.targetCwd,e.targetProfileId).spawnEnv.allow;if(r.length>0)for(const[n,i]of Object.entries(t))i!==void 0&&r.some(f=>x(n,f))&&(o[n]=i);const s=t[l]??o.PATH;s!==void 0&&s!==""&&(o[l]=s);const c=I(e.targetCwd,e.targetProfileId);if(c!==null){const n=o.PATH;o.PATH=n===void 0||n===""?c:`${c}:${n}`}return o}a(L,"buildOperationalEnvBase");function G(e){const t={};for(const[o,r]of Object.entries(N(e)))t[h(o)]=r;return t}a(G,"profileMetadataEnv");function B(e,t,o,r,s){const c=t===null?null:M(t).manifest,n=L({targetCwd:e,targetProfileId:t,skipSpawnAllow:o!=="app:terminal"}),i={...n,...r,...c===null?{}:G(t),...s,HOME:T(o),PI_CODING_AGENT_DIR:A(d(o).home,".pi","agent"),[l]:n[l],...process.platform==="linux"?{CRTR_RUNTIME_HOME:p}:{CRTR_HOME:R(),CRTR_RUNTIME_HOME:process.env.CRTR_RUNTIME_HOME??m()}};for(const f of Object.values(u))delete i[f];return i}a(B,"composeAppProcessEnv");function K(e,t){const o={...t,...e.env,HOME:t.HOME,PI_CODING_AGENT_DIR:t.PI_CODING_AGENT_DIR,[l]:t[l],CRTR_RUNTIME_HOME:t.CRTR_RUNTIME_HOME,[v]:"1"};for(const r of Object.values(u))delete o[r];return o}a(K,"overlayBrokerEnv");export{l as ADMITTED_HOST_PATH_ENV,u as PROVIDER_ENV_KEYS,L as buildOperationalEnvBase,B as composeAppProcessEnv,K as overlayBrokerEnv,G as profileMetadataEnv,b as resolveAdmittedHostCommand,S as resolvePathExecutable};