@ours.network/fleet 0.10.3 → 0.11.0

package/dist/watchdog/store.js

@@ -0,0 +1,226 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, } from 'node:fs';
+import { join } from 'node:path';
+import { watchdogsRoot } from '../paths.js';
+// store.ts imports config.ts (ROLE_NAME_RE) but not the reverse — config.ts's
+// import graph (config-yaml, isolation/policy, harness/registry, watchdog/config)
+// never reaches back into watchdog/store.ts, so this does not create a cycle.
+import { ROLE_NAME_RE } from '../config.js';
+const RUN_ID_RE = /^\d{8}T\d{6}Z$/;
+const REPORT_FILE_RE = /^\d{8}T\d{6}Z\.json$/;
+/**
+ * A lock directory briefly exists before acquireRunLock can rename its
+ * prewritten owner.json into it. Missing/corrupt owner metadata is therefore
+ * reclaimable only after this grace period, never while that acquisition
+ * window may still be in progress.
+ */
+export const RUN_LOCK_OWNER_GRACE_MS = 10_000;
+/**
+ * mkdirSync's `mode` is masked by the process umask and ignored outright when
+ * the directory already exists, so an explicit chmod after mkdir is the only
+ * way to guarantee 0700 regardless of umask or prior state.
+ */
+function ensureDir(dir) {
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    chmodSync(dir, 0o700);
+    return dir;
+}
+/**
+ * Choke point every other helper in this module goes through to reach a
+ * watchdog's on-disk state. Validates `name` BEFORE any join/mkdir (defense
+ * in depth, finding #1): a caller that forgets its own ROLE_NAME_RE guard
+ * (as the CLI's `watchdogKnown` once did) must not be able to turn an
+ * unvalidated `name` into `join(watchdogsRoot(), '../../victim')` and mkdir
+ * an arbitrary path on disk.
+ */
+export function watchdogDir(name) {
+    if (!ROLE_NAME_RE.test(name))
+        throw new Error(`invalid watchdog name '${name}'`);
+    return ensureDir(join(watchdogsRoot(), name));
+}
+export function reportsDir(name) {
+    return ensureDir(join(watchdogDir(name), 'reports'));
+}
+function runLockPath(name) {
+    return join(watchdogDir(name), '.run-lock');
+}
+function runLockOwnerPath(name) {
+    return join(runLockPath(name), 'owner.json');
+}
+/**
+ * mkdir-as-mutex: atomic across processes, unlike a lock file (open+O_EXCL
+ * would work too, but a directory needs no cleanup of file contents and
+ * can't be partially written). EEXIST means another run holds it.
+ *
+ * Stamps `owner.json` with our pid (finding #2): ownership metadata is what
+ * lets a later `reclaimStaleRunLock` tell a lock abandoned by a dead process
+ * apart from one genuinely held by a live run. A naive "mkdir, then
+ * writeFileSync(owner.json)" leaves an unnecessarily wide window —
+ * between the mkdir succeeding and the write landing — where the lock dir
+ * exists but owner.json doesn't yet. A `reclaimStaleRunLock` call from
+ * another process landing in exactly that window would see a lock with no
+ * (or corrupt) owner metadata and treat a genuinely live lock as a legacy
+ * one, reclaiming it out from under us. Do all slow work (building the JSON,
+ * writing it, chmod) to a per-pid temp file BEFORE mkdir, then publish it with
+ * one rename. There is still an unavoidable interval between those two
+ * syscalls; reclaimStaleRunLock protects it by treating a fresh ownerless lock
+ * as held for RUN_LOCK_OWNER_GRACE_MS. The temp file is unique per-pid (this
+ * function is synchronous, so there's no same-process concurrent-call hazard
+ * either) and is cleaned up if mkdir loses the race.
+ */
+export function acquireRunLock(name) {
+    const dir = watchdogDir(name);
+    const owner = { pid: process.pid, at: new Date().toISOString() };
+    const tempOwnerPath = join(dir, `.owner.${process.pid}.tmp`);
+    writeFileSync(tempOwnerPath, JSON.stringify(owner), { mode: 0o600 });
+    chmodSync(tempOwnerPath, 0o600);
+    try {
+        mkdirSync(runLockPath(name));
+    }
+    catch (e) {
+        try {
+            unlinkSync(tempOwnerPath);
+        }
+        catch { /* best effort cleanup */ }
+        if (e.code === 'EEXIST')
+            return false;
+        throw e;
+    }
+    renameSync(tempOwnerPath, runLockOwnerPath(name));
+    return true;
+}
+/**
+ * Release-tolerant of absence: a lock already gone (or never acquired) is not
+ * an error. Recursive because the lock dir now holds `owner.json` alongside
+ * the mkdir mutex itself (finding #2) — a plain rmdir would fail ENOTEMPTY.
+ */
+export function releaseRunLock(name) {
+    try {
+        rmSync(runLockPath(name), { recursive: true });
+    }
+    catch (e) {
+        if (e.code === 'ENOENT')
+            return;
+        throw e;
+    }
+}
+/** Reads a run lock's owner metadata; missing or corrupt yields undefined. */
+export function readRunLockOwner(name) {
+    try {
+        const raw = JSON.parse(readFileSync(runLockOwnerPath(name), 'utf8'));
+        if (!Number.isInteger(raw.pid) || raw.pid <= 0 || typeof raw.at !== 'string')
+            return undefined;
+        return { pid: raw.pid, at: raw.at };
+    }
+    catch {
+        return undefined;
+    }
+}
+/** True iff `pid` names a live process. EPERM means the process exists but we can't signal it — still alive. */
+function pidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (e) {
+        return e.code === 'EPERM';
+    }
+}
+/**
+ * Owner-mandated (finding #2): only a DEMONSTRABLY stale run lock may be
+ * reclaimed — a lock is stale iff it isn't held at all, its owner metadata
+ * names a dead pid, or its owner metadata is missing/corrupt AND the lock dir
+ * is older than RUN_LOCK_OWNER_GRACE_MS. The age gate closes the interprocess
+ * interval between acquireRunLock's mkdir and owner.json rename: a concurrent
+ * scheduler sees a fresh ownerless lock as held, not stale. A live owner (a
+ * foreground `watchdog-run`, another scheduler instance, an in-progress run)
+ * is left strictly alone: reclaiming it would let two runs share the same temp
+ * dir.
+ * Returns true when the lock is (now) not held — whether because it was
+ * already absent or because a stale lock was just removed; false when a live
+ * lock was found and deliberately left in place.
+ */
+export function reclaimStaleRunLock(name) {
+    const path = runLockPath(name);
+    if (!existsSync(path))
+        return true;
+    const owner = readRunLockOwner(name);
+    if (owner !== undefined && pidAlive(owner.pid))
+        return false;
+    if (owner === undefined) {
+        try {
+            if (Date.now() - statSync(path).mtimeMs < RUN_LOCK_OWNER_GRACE_MS)
+                return false;
+        }
+        catch (e) {
+            // The holder may have released between existsSync and statSync.
+            if (e.code === 'ENOENT')
+                return true;
+            throw e;
+        }
+    }
+    releaseRunLock(name);
+    return true;
+}
+/** Lexical-chronological UTC run id, e.g. '20260731T115000Z'. */
+export function formatRunId(d) {
+    return d.toISOString().replace(/\.\d{3}Z$/, 'Z').replace(/[-:]/g, '');
+}
+const CORRUPT_SUMMARY = { checked: 0, healthy: 0, idle: 0, anomalies: 0 };
+function reportPath(name, runId) {
+    return join(reportsDir(name), `${runId}.json`);
+}
+/** Newest-first run ids currently on disk, derived from filenames alone. */
+function runIdsDesc(name) {
+    return readdirSync(reportsDir(name))
+        .filter(f => REPORT_FILE_RE.test(f))
+        .sort()
+        .reverse()
+        .map(f => f.slice(0, -'.json'.length));
+}
+export function writeReport(name, report) {
+    const path = reportPath(name, report.run_id);
+    writeFileSync(path, JSON.stringify(report, null, 2) + '\n', { mode: 0o600 });
+    chmodSync(path, 0o600);
+    return path;
+}
+/** Newest-first run listing; a corrupt report file yields a synthetic 'error' entry rather than throwing. */
+export function listRuns(name) {
+    return runIdsDesc(name).map((runId) => {
+        try {
+            const report = JSON.parse(readFileSync(reportPath(name, runId), 'utf8'));
+            return {
+                runId, status: report.status, startedAt: report.started_at, finishedAt: report.finished_at,
+                summary: report.summary, error: report.error,
+            };
+        }
+        catch {
+            return { runId, status: 'error', startedAt: '', finishedAt: '', summary: CORRUPT_SUMMARY, error: 'unreadable report file' };
+        }
+    });
+}
+/** Reads one run's full report. Rejects non-conforming runIds (path-traversal guard) and corrupt files by returning undefined. */
+export function readReport(name, runId) {
+    if (!RUN_ID_RE.test(runId))
+        return undefined;
+    try {
+        return JSON.parse(readFileSync(reportPath(name, runId), 'utf8'));
+    }
+    catch {
+        return undefined;
+    }
+}
+export function latestReport(name) {
+    const [newest] = runIdsDesc(name);
+    return newest === undefined ? undefined : readReport(name, newest);
+}
+/** Deletes all but the `keep` newest reports (oldest first); returns the number pruned. */
+export function pruneReports(name, keep) {
+    const stale = runIdsDesc(name).slice(keep);
+    for (const runId of stale) {
+        try {
+            unlinkSync(reportPath(name, runId));
+        }
+        catch { /* best effort */ }
+    }
+    return stale.length;
+}

package/dist/web/audit.d.ts

@@ -0,0 +1,22 @@
+export interface AuditEvent {
+    at?: string;
+    requestId?: string;
+    browser?: string;
+    roleId?: string;
+    action: string;
+    result: string;
+    errorCode?: string;
+    latencyMs?: number;
+    bytes?: number;
+    digest?: string;
+}
+export declare class AuditSink {
+    readonly dir: string;
+    private readonly file;
+    private readonly memory;
+    degraded?: string;
+    constructor(dir?: string);
+    record(event: AuditEvent): Promise<void>;
+    list(limit?: number): AuditEvent[];
+    private prune;
+}

package/dist/web/audit.js

@@ -0,0 +1,54 @@
+import { mkdirSync, statSync } from 'node:fs';
+import { appendFile, chmod, readdir, rename, unlink } from 'node:fs/promises';
+import { join } from 'node:path';
+import { stateRoot } from '../paths.js';
+import { safeLine } from '../application/errors.js';
+export class AuditSink {
+    dir;
+    file;
+    memory = [];
+    degraded;
+    constructor(dir = join(stateRoot(), 'web', 'audit')) {
+        this.dir = dir;
+        this.file = join(dir, 'audit.jsonl');
+        try {
+            mkdirSync(dir, { recursive: true, mode: 0o700 });
+        }
+        catch (error) {
+            this.degraded = error.message;
+        }
+    }
+    async record(event) {
+        const safe = {
+            at: event.at ?? new Date().toISOString(),
+            requestId: event.requestId, browser: event.browser?.slice(0, 12),
+            roleId: event.roleId, action: safeLine(event.action, 128),
+            result: safeLine(event.result, 128), errorCode: event.errorCode,
+            latencyMs: event.latencyMs, bytes: event.bytes, digest: event.digest,
+        };
+        this.memory.push(safe);
+        if (this.memory.length > 1_000)
+            this.memory.shift();
+        if (this.degraded)
+            return;
+        try {
+            try {
+                if (statSync(this.file).size > 2 * 1024 * 1024)
+                    await rename(this.file, join(this.dir, `audit-${Date.now()}.jsonl`));
+            }
+            catch { /* first write */ }
+            await appendFile(this.file, JSON.stringify(safe) + '\n', { mode: 0o600 });
+            await chmod(this.file, 0o600);
+            await this.prune();
+        }
+        catch (error) {
+            this.degraded = error.message;
+        }
+    }
+    list(limit = 200) { return this.memory.slice(-Math.min(limit, 1_000)).reverse(); }
+    async prune() {
+        const files = (await readdir(this.dir)).filter(file => /^audit-\d+\.jsonl$/.test(file)).sort();
+        for (const file of files.slice(0, -10))
+            await unlink(join(this.dir, file)).catch(() => undefined);
+    }
+}

package/dist/web/auth.d.ts

@@ -0,0 +1,61 @@
+import type { FastifyRequest } from 'fastify';
+import type { WebSocket } from 'ws';
+import { TrustedDeviceStore, type TrustedDeviceIssue } from './device-store.js';
+export interface BrowserSession {
+    id: string;
+    csrf: string;
+    createdAt: number;
+    lastSeenAt: number;
+    absoluteExpiresAt: number;
+}
+export interface AuthResult {
+    session: BrowserSession;
+    device: TrustedDeviceIssue;
+}
+interface Ticket {
+    value: string;
+    sessionId: string;
+    purpose: 'events' | 'terminal';
+    roleId?: string;
+    expiresAt: number;
+}
+export declare class WebAuth {
+    private _origin;
+    private _host;
+    private readonly now;
+    private readonly devices;
+    private _bootstrapSecret;
+    private bootstrapExpiresAt;
+    private bootstrapUsed;
+    private readonly sessions;
+    private readonly sessionDevices;
+    private readonly tickets;
+    private readonly rates;
+    private readonly sockets;
+    constructor(_origin: string, _host: string, now?: () => number, devices?: TrustedDeviceStore);
+    get bootstrapSecret(): string;
+    get origin(): string;
+    get host(): string;
+    setBoundary(origin: string, host: string): void;
+    /** Mint a replacement for an operator-triggered reauthentication ceremony. */
+    mintBootstrap(): string;
+    validateBoundary(request: FastifyRequest, requireOrigin: boolean): void;
+    exchange(request: FastifyRequest): AuthResult;
+    resume(request: FastifyRequest): AuthResult;
+    authenticate(request: FastifyRequest, mutation?: boolean): BrowserSession;
+    logout(request: FastifyRequest): void;
+    mintTicket(request: FastifyRequest, purpose: Ticket['purpose'], roleId?: string): {
+        ticket: string;
+        expiresAt: string;
+    };
+    consumeTicket(request: FastifyRequest, value: string, purpose: Ticket['purpose'], roleId?: string): BrowserSession;
+    bindSocket(sessionId: string, socket: WebSocket): void;
+    clearSessions(): void;
+    revokeAllTrustedDevices(): number;
+    shutdown(): void;
+    private createSession;
+    private removeSession;
+    private consumeRate;
+}
+export declare function parseCookies(cookie: string): Record<string, string>;
+export {};

package/dist/web/auth.js

@@ -0,0 +1,186 @@
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { FleetError } from '../application/errors.js';
+import { TrustedDeviceStore } from './device-store.js';
+const token = (bytes = 32) => randomBytes(bytes).toString('base64url');
+const same = (a, b) => {
+    const left = Buffer.from(a);
+    const right = Buffer.from(b);
+    return left.length === right.length && timingSafeEqual(left, right);
+};
+export class WebAuth {
+    _origin;
+    _host;
+    now;
+    devices;
+    _bootstrapSecret = token(32);
+    bootstrapExpiresAt = Date.now() + 5 * 60_000;
+    bootstrapUsed = false;
+    sessions = new Map();
+    sessionDevices = new Map();
+    tickets = new Map();
+    rates = new Map();
+    sockets = new Map();
+    constructor(_origin, _host, now = Date.now, devices = new TrustedDeviceStore()) {
+        this._origin = _origin;
+        this._host = _host;
+        this.now = now;
+        this.devices = devices;
+    }
+    get bootstrapSecret() { return this._bootstrapSecret; }
+    get origin() { return this._origin; }
+    get host() { return this._host; }
+    setBoundary(origin, host) {
+        this._origin = origin;
+        this._host = host;
+    }
+    /** Mint a replacement for an operator-triggered reauthentication ceremony. */
+    mintBootstrap() {
+        this._bootstrapSecret = token(32);
+        this.bootstrapExpiresAt = this.now() + 5 * 60_000;
+        this.bootstrapUsed = false;
+        return this._bootstrapSecret;
+    }
+    validateBoundary(request, requireOrigin) {
+        const host = request.headers.host;
+        if (host !== this.host)
+            throw new FleetError('forbidden', 'invalid Host header');
+        if (requireOrigin && request.headers.origin !== this.origin)
+            throw new FleetError('forbidden', 'invalid Origin header');
+        const fetchSite = request.headers['sec-fetch-site'];
+        if (fetchSite && !['same-origin', 'none'].includes(String(fetchSite)))
+            throw new FleetError('forbidden', 'cross-site request rejected');
+    }
+    exchange(request) {
+        this.validateBoundary(request, true);
+        this.consumeRate('bootstrap', 10, 60_000);
+        const authorization = request.headers.authorization ?? '';
+        const supplied = authorization.startsWith('Bootstrap ') ? authorization.slice(10) : '';
+        if (this.bootstrapUsed || this.now() > this.bootstrapExpiresAt || !same(this._bootstrapSecret, supplied))
+            throw new FleetError('unauthorized', 'bootstrap credential is invalid or expired');
+        this.bootstrapUsed = true;
+        const device = this.devices.issue();
+        return { session: this.createSession(device.id), device };
+    }
+    resume(request) {
+        this.validateBoundary(request, true);
+        this.consumeRate('device-resume', 30, 60_000);
+        const current = parseCookies(request.headers.cookie ?? '').ofs_device;
+        const device = current ? this.devices.rotate(current) : undefined;
+        if (!device)
+            throw new FleetError('unauthorized', 'trusted device is missing, expired, or revoked');
+        return { session: this.createSession(device.id), device };
+    }
+    authenticate(request, mutation = false) {
+        this.validateBoundary(request, mutation);
+        const id = parseCookies(request.headers.cookie ?? '').ofs_session;
+        const session = id ? this.sessions.get(id) : undefined;
+        const now = this.now();
+        if (!session || now > session.absoluteExpiresAt || now - session.lastSeenAt > 30 * 60_000) {
+            if (id)
+                this.removeSession(id);
+            throw new FleetError('unauthorized', 'browser session is missing or expired');
+        }
+        if (mutation) {
+            const supplied = String(request.headers['x-csrf-token'] ?? '');
+            if (!same(session.csrf, supplied))
+                throw new FleetError('forbidden', 'invalid CSRF token');
+            this.consumeRate(`mutation:${session.id}`, 120, 60_000);
+        }
+        session.lastSeenAt = now;
+        return session;
+    }
+    logout(request) {
+        const session = this.authenticate(request, true);
+        const deviceId = this.sessionDevices.get(session.id);
+        if (deviceId)
+            this.devices.revokeId(deviceId);
+        this.removeSession(session.id);
+    }
+    mintTicket(request, purpose, roleId) {
+        const session = this.authenticate(request, true);
+        const value = token();
+        const ticket = {
+            value, sessionId: session.id, purpose, roleId,
+            expiresAt: this.now() + 30_000,
+        };
+        this.tickets.set(value, ticket);
+        return { ticket: value, expiresAt: new Date(ticket.expiresAt).toISOString() };
+    }
+    consumeTicket(request, value, purpose, roleId) {
+        this.validateBoundary(request, true);
+        const ticket = this.tickets.get(value);
+        this.tickets.delete(value);
+        if (!ticket || ticket.expiresAt < this.now() || ticket.purpose !== purpose
+            || ticket.roleId !== roleId)
+            throw new FleetError('unauthorized', 'WebSocket ticket is invalid, expired, or already used');
+        const session = this.sessions.get(ticket.sessionId);
+        if (!session)
+            throw new FleetError('unauthorized', 'browser session expired');
+        return session;
+    }
+    bindSocket(sessionId, socket) {
+        let sockets = this.sockets.get(sessionId);
+        if (!sockets) {
+            sockets = new Set();
+            this.sockets.set(sessionId, sockets);
+        }
+        sockets.add(socket);
+        socket.once('close', () => sockets?.delete(socket));
+    }
+    clearSessions() {
+        for (const sockets of this.sockets.values())
+            for (const socket of sockets)
+                socket.close(4401, 'authentication revoked');
+        this.sockets.clear();
+        this.sessions.clear();
+        this.sessionDevices.clear();
+        this.tickets.clear();
+    }
+    revokeAllTrustedDevices() {
+        const count = this.devices.revokeAll();
+        this.clearSessions();
+        return count;
+    }
+    shutdown() { this.clearSessions(); }
+    createSession(deviceId) {
+        const now = this.now();
+        const session = {
+            id: token(), csrf: token(), createdAt: now, lastSeenAt: now,
+            absoluteExpiresAt: now + 8 * 60 * 60_000,
+        };
+        this.sessions.set(session.id, session);
+        this.sessionDevices.set(session.id, deviceId);
+        return session;
+    }
+    removeSession(id) {
+        this.sessions.delete(id);
+        this.sessionDevices.delete(id);
+        for (const [ticket, value] of this.tickets)
+            if (value.sessionId === id)
+                this.tickets.delete(ticket);
+        for (const socket of this.sockets.get(id) ?? [])
+            socket.close(4401, 'authentication revoked');
+        this.sockets.delete(id);
+    }
+    consumeRate(key, limit, windowMs) {
+        const now = this.now();
+        let rate = this.rates.get(key);
+        if (!rate || rate.resetAt <= now) {
+            rate = { count: 0, resetAt: now + windowMs };
+            this.rates.set(key, rate);
+        }
+        rate.count++;
+        if (rate.count > limit)
+            throw new FleetError('rate_limited', 'request rate limit exceeded', {
+                retryable: true, details: { retryAfterMs: rate.resetAt - now },
+            });
+    }
+}
+export function parseCookies(cookie) {
+    return Object.fromEntries(cookie.split(';').flatMap(part => {
+        const index = part.indexOf('=');
+        if (index < 0)
+            return [];
+        return [[part.slice(0, index).trim(), decodeURIComponent(part.slice(index + 1).trim())]];
+    }));
+}

package/dist/web/control.d.ts

@@ -0,0 +1,14 @@
+export type WebControlCommand = 'open' | 'revoke-all';
+export declare const webControlPath: (dir?: string) => string;
+export interface WebControlServer {
+    path: string;
+    close(): Promise<void>;
+}
+export declare function startWebControlServer(options: {
+    dir?: string;
+    onOpen(): void | Promise<void>;
+    onRevokeAll(): void | Promise<void>;
+    now?: () => number;
+    rateLimit?: number;
+}): Promise<WebControlServer>;
+export declare function requestWebControl(command: WebControlCommand, path?: string, timeoutMs?: number): Promise<void>;

package/dist/web/control.js

@@ -0,0 +1,110 @@
+import { chmodSync, mkdirSync, rmSync } from 'node:fs';
+import { createConnection, createServer } from 'node:net';
+import { join } from 'node:path';
+import { FleetError, safeLine } from '../application/errors.js';
+import { stateRoot } from '../paths.js';
+export const webControlPath = (dir = join(stateRoot(), 'web')) => join(dir, 'control.sock');
+export async function startWebControlServer(options) {
+    const dir = options.dir ?? join(stateRoot(), 'web');
+    const path = webControlPath(dir);
+    const now = options.now ?? Date.now;
+    const rateLimit = options.rateLimit ?? 10;
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    chmodSync(dir, 0o700);
+    rmSync(path, { force: true });
+    let windowStart = now();
+    let used = 0;
+    const server = createServer(socket => {
+        let body = '';
+        socket.setTimeout(5_000, () => socket.destroy());
+        socket.on('data', chunk => {
+            body += chunk.toString('utf8');
+            if (body.length > 4_096)
+                return socket.destroy();
+            if (!body.includes('\n'))
+                return;
+            socket.pause();
+            void (async () => {
+                try {
+                    if (now() - windowStart >= 60_000) {
+                        windowStart = now();
+                        used = 0;
+                    }
+                    used++;
+                    if (used > rateLimit)
+                        throw new FleetError('rate_limited', 'local web control rate limit exceeded');
+                    const parsed = JSON.parse(body.slice(0, body.indexOf('\n')));
+                    if (parsed.command === 'open')
+                        await options.onOpen();
+                    else if (parsed.command === 'revoke-all')
+                        await options.onRevokeAll();
+                    else
+                        throw new FleetError('invalid_request', 'unknown local web control command');
+                    socket.end(JSON.stringify({ ok: true }) + '\n');
+                }
+                catch (error) {
+                    const code = error instanceof FleetError ? error.code : 'internal';
+                    const message = safeLine(error instanceof Error ? error.message : String(error));
+                    socket.end(JSON.stringify({ ok: false, error: { code, message } }) + '\n');
+                }
+            })();
+        });
+    });
+    await listen(server, path);
+    chmodSync(path, 0o600);
+    let closed = false;
+    return {
+        path,
+        async close() {
+            if (closed)
+                return;
+            closed = true;
+            await new Promise(resolve => server.close(() => resolve()));
+            rmSync(path, { force: true });
+        },
+    };
+}
+export async function requestWebControl(command, path = webControlPath(), timeoutMs = 5_000) {
+    await new Promise((resolve, reject) => {
+        const socket = createConnection(path);
+        let response = '';
+        let settled = false;
+        const timer = setTimeout(() => {
+            socket.destroy();
+            reject(new FleetError('timeout', 'local web control request timed out'));
+        }, timeoutMs);
+        const finish = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            if (error)
+                reject(error);
+            else
+                resolve();
+        };
+        socket.once('connect', () => socket.write(JSON.stringify({ command }) + '\n'));
+        socket.on('data', chunk => { response += chunk.toString('utf8'); });
+        socket.once('error', error => finish(new FleetError('control_unavailable', `running web console control is unavailable: ${safeLine(error.message)}`)));
+        socket.once('end', () => {
+            try {
+                const parsed = JSON.parse(response);
+                if (!parsed.ok)
+                    throw new FleetError(parsed.error?.code === 'rate_limited' ? 'rate_limited' : 'rejected', parsed.error?.message ?? 'local web control request was rejected');
+                finish();
+            }
+            catch (error) {
+                finish(error);
+            }
+        });
+    });
+}
+function listen(server, path) {
+    return new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(path, () => {
+            server.off('error', reject);
+            resolve();
+        });
+    });
+}