@p10i/create-nestbox 0.5.0 → 0.6.0

package/docker/control/host_bridge.py

@@ -1,205 +0,0 @@
-#!/usr/bin/env python3
-import http.client
-import json
-import signal
-import sys
-import threading
-import time
-from urllib.parse import quote
-
-PROTOCOL_VERSION = 1
-MAX_LINE_BYTES = 64 * 1024 * 1024
-HEARTBEAT_SECONDS = 4
-stopping = threading.Event()
-input_condition = threading.Condition()
-input_messages = []
-input_error = None
-input_eof = False
-connections = set()
-connections_lock = threading.Lock()
-
-
-def diagnostic(message):
-    sys.stderr.write(f"nestbox host bridge: {message}\n")
-    sys.stderr.flush()
-
-
-def stop_requests():
-    stopping.set()
-    with connections_lock:
-        active = list(connections)
-    for connection in active:
-        connection.close()
-    with input_condition:
-        input_condition.notify_all()
-
-
-def send(message):
-    data = json.dumps({"protocolVersion": PROTOCOL_VERSION, **message}, separators=(",", ":"))
-    sys.stdout.write(data + "\n")
-    sys.stdout.flush()
-
-
-def read_input():
-    global input_error, input_eof
-    try:
-        while True:
-            line = sys.stdin.buffer.readline(MAX_LINE_BYTES + 1)
-            if not line:
-                with input_condition:
-                    input_eof = True
-                    input_condition.notify_all()
-                stop_requests()
-                return
-            if len(line) > MAX_LINE_BYTES or not line.endswith(b"\n"):
-                raise ValueError("protocol line exceeds the limit")
-            value = json.loads(line)
-            if not isinstance(value, dict) or value.get("protocolVersion") != PROTOCOL_VERSION:
-                raise ValueError("unsupported protocol message")
-            with input_condition:
-                if len(input_messages) >= 2:
-                    raise ValueError("too many queued protocol messages")
-                input_messages.append(value)
-                input_condition.notify_all()
-    except Exception as error:
-        with input_condition:
-            input_error = error
-            input_condition.notify_all()
-        stop_requests()
-
-
-def receive():
-    with input_condition:
-        while not input_messages and not input_eof and input_error is None and not stopping.is_set():
-            input_condition.wait()
-        if input_error is not None:
-            raise input_error
-        if not input_messages:
-            raise EOFError
-        return input_messages.pop(0)
-
-
-def request(method, path, runner_id, session_id, body=None, timeout=35):
-    payload = json.dumps(body, separators=(",", ":")).encode() if body is not None else None
-    headers = {
-        "X-Nestbox-Runner-Id": runner_id,
-        "X-Nestbox-Session-Id": session_id,
-        "Content-Type": "application/json",
-    }
-    connection = http.client.HTTPConnection("127.0.0.1", 4089, timeout=timeout)
-    with connections_lock:
-        connections.add(connection)
-    try:
-        connection.request(method, path, body=payload, headers=headers)
-        response = connection.getresponse()
-        data = response.read(MAX_LINE_BYTES + 1)
-    finally:
-        connection.close()
-        with connections_lock:
-            connections.discard(connection)
-    if len(data) > MAX_LINE_BYTES:
-        raise RuntimeError("control response exceeds the limit")
-    value = json.loads(data) if data else None
-    return response.status, value
-
-
-def heartbeat(runner_id, session_id, metadata):
-    while not stopping.wait(HEARTBEAT_SECONDS):
-        try:
-            status, value = request("POST", "/host/heartbeat", runner_id, session_id, metadata, timeout=5)
-            if status == 409:
-                diagnostic((value or {}).get("error", "session was superseded"))
-                stop_requests()
-                return
-            if status >= 400:
-                diagnostic(f"heartbeat returned HTTP {status}")
-        except Exception as error:
-            if not stopping.is_set():
-                diagnostic(f"heartbeat failed: {error}")
-
-
-def deliver_result(runner_id, session_id, result):
-    job_id = result.get("jobId")
-    delay = 0.5
-    while not stopping.is_set():
-        try:
-            status, response = request("POST", f"/host/jobs/{quote(str(job_id), safe='')}/result", runner_id, session_id, result)
-            if status in (200, 202):
-                send({"type": "result.ack", "jobId": job_id, "duplicate": bool((response or {}).get("duplicate"))})
-                return
-            error = (response or {}).get("error", f"result returned HTTP {status}")
-            if status == 410:
-                send({"type": "gone", "jobId": job_id, "error": error})
-                return
-            if status == 409 and "session was superseded" in error.lower():
-                raise RuntimeError(error)
-            if status < 500:
-                send({"type": "result.rejected", "jobId": job_id, "error": error})
-                return
-        except (OSError, http.client.HTTPException) as error:
-            if stopping.is_set():
-                raise EOFError from error
-            diagnostic(f"result delivery failed: {error}; retrying")
-        stopping.wait(delay)
-        delay = min(10, delay * 2)
-
-
-def main():
-    threading.Thread(target=read_input, daemon=True).start()
-    hello = receive()
-    if hello.get("type") != "hello":
-        raise ValueError("first protocol message must be hello")
-    runner_id, session_id = hello.get("runnerId"), hello.get("sessionId")
-    metadata = hello.get("metadata") or {}
-    if not isinstance(runner_id, str) or not isinstance(session_id, str) or not isinstance(metadata, dict):
-        raise ValueError("invalid hello message")
-    status, value = request("POST", "/host/connect", runner_id, session_id, metadata)
-    if status >= 400:
-        raise RuntimeError(f"connect returned HTTP {status}: {(value or {}).get('error', value)}")
-    thread = threading.Thread(target=heartbeat, args=(runner_id, session_id, metadata), daemon=True)
-    thread.start()
-    retained_result = hello.get("retainedResult")
-    if retained_result is not None:
-        if not isinstance(retained_result, dict):
-            raise ValueError("invalid retained result")
-        deliver_result(runner_id, session_id, retained_result)
-        if stopping.is_set():
-            return
-    send({"type": "ready"})
-    while not stopping.is_set():
-        status, value = request("GET", "/host/jobs/next?timeout=25", runner_id, session_id, timeout=30)
-        if status == 204:
-            send({"type": "idle"})
-            continue
-        if status == 409:
-            raise RuntimeError((value or {}).get("error", "session was superseded"))
-        if status == 410:
-            send({"type": "gone", "jobId": (value or {}).get("jobId"), "error": (value or {}).get("error", "job is gone")})
-            continue
-        if status >= 400 or not isinstance(value, dict):
-            raise RuntimeError(f"next job returned HTTP {status}: {value}")
-        send({"type": "job", "job": value})
-        result = receive()
-        if result.get("type") != "result" or not isinstance(result.get("result"), dict):
-            raise ValueError("expected a result message")
-        job_id = result["result"].get("jobId")
-        if job_id != value.get("jobId"):
-            raise ValueError("result does not match the assigned job")
-        deliver_result(runner_id, session_id, result["result"])
-
-
-def stop(_signum, _frame):
-    stop_requests()
-
-
-if __name__ == "__main__":
-    signal.signal(signal.SIGTERM, stop)
-    signal.signal(signal.SIGINT, stop)
-    try:
-        main()
-    except EOFError:
-        pass
-    except Exception as error:
-        if not stopping.is_set():
-            diagnostic(str(error))
-            sys.exit(1)

package/host-runner.mjs

@@ -1,314 +0,0 @@
-import { spawn } from 'node:child_process';
-import { createHash, randomBytes, randomUUID } from 'node:crypto';
-import { hostname, platform } from 'node:os';
-import { basename, dirname, join, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { readFile, rename, unlink, writeFile } from 'node:fs/promises';
-
-const installDirectory = dirname(fileURLToPath(import.meta.url));
-const defaultWorkspace = basename(installDirectory) === '.nestbox' ? dirname(installDirectory) : installDirectory;
-const workspace = resolve(process.env.NESTBOX_HOST_WORKSPACE || defaultWorkspace);
-const hostPlatform = platform();
-const hostName = hostname();
-// Stable for this runner process; each Docker Compose exec gets a new session ID.
-const runnerId = `runner-${randomUUID()}`;
-const once = process.argv.slice(2).includes('--once');
-const jsonOutput = process.argv.slice(2).includes('--json');
-const dockerExecutable = process.env.NESTBOX_HOST_DOCKER || 'docker';
-const dockerPrefixArgs = process.env.NESTBOX_HOST_DOCKER_ARGS ? JSON.parse(process.env.NESTBOX_HOST_DOCKER_ARGS) : [];
-if (!Array.isArray(dockerPrefixArgs) || !dockerPrefixArgs.every(value => typeof value === 'string')) throw new Error('NESTBOX_HOST_DOCKER_ARGS must be a JSON string array.');
-const npmExecutable = process.env.NESTBOX_HOST_NPM || 'npm';
-const npmCli = process.env.npm_execpath || (!process.env.NESTBOX_HOST_NPM && process.platform === 'win32' ? join(dirname(process.execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js') : '');
-const maximumOutputBytes = Number(process.env.NESTBOX_HOST_MAX_OUTPUT_BYTES || 4 * 1024 * 1024);
-const approvalTtlMs = Number(process.env.NESTBOX_HOST_APPROVAL_TTL_MS || 5 * 60 * 1000);
-const approvalMaximumAttempts = Number(process.env.NESTBOX_HOST_APPROVAL_ATTEMPTS || 3);
-const maximumPendingApprovals = Number(process.env.NESTBOX_HOST_APPROVAL_MAX_PENDING || 20);
-const approvals = new Map();
-const activeChildren = new Set();
-let activeBridge;
-let stopping = false;
-let announced = false;
-let activeJobId;
-let activeJobPromise;
-let retainedResult;
-
-function emit(type, fields = {}) {
-  const event = { ...fields, type, timestamp: new Date().toISOString() };
-  if (jsonOutput) return process.stdout.write(`${JSON.stringify(event)}\n`);
-  if (type === 'runner.ready') console.log(`Nestbox host runner connected through Docker Compose for ${workspace}`);
-  else if (type === 'npm.scripts.confirmation_required') {
-    console.log(`\nApproval ${event.requestId}: ${event.operation} npm script "${event.name}"`);
-    if (event.command !== undefined) console.log(`Command: ${event.command}`);
-    console.log(`Confirmation code: ${event.code} (expires ${event.expiresAt})\n`);
-  } else if (type === 'npm.scripts.changed') console.log(`Approved ${event.operation} for npm script "${event.name}".`);
-  else if (type === 'runner.error') console.error(event.error);
-}
-
-async function packageText() { return readFile(join(workspace, 'package.json'), 'utf8'); }
-function parsePackageDocument(text) {
-  const document = JSON.parse(text);
-  if (!document || typeof document !== 'object' || Array.isArray(document)) throw new Error('package.json must contain a JSON object.');
-  if (document.scripts !== undefined && (!document.scripts || typeof document.scripts !== 'object' || Array.isArray(document.scripts))) throw new Error('package.json scripts must be an object.');
-  return document;
-}
-async function packageDocument() { return parsePackageDocument(await packageText()); }
-function hash(contents) { return createHash('sha256').update(contents).digest('hex'); }
-async function packageScripts() {
-  const document = await packageDocument();
-  if (document.scripts === undefined) return {};
-  if (!document.scripts || typeof document.scripts !== 'object' || Array.isArray(document.scripts)) throw new Error('package.json scripts must be an object.');
-  return document.scripts;
-}
-
-async function writePackageJson(document, expectedHash) {
-  const path = join(workspace, 'package.json');
-  const temporary = `${path}.${runnerId}.tmp`;
-  await writeFile(temporary, `${JSON.stringify(document, null, 2)}\n`, 'utf8');
-  if (hash(await packageText()) !== expectedHash) {
-    await unlink(temporary).catch(() => {});
-    throw new Error('package.json changed while the approved update was being prepared.');
-  }
-  try { await rename(temporary, path); }
-  catch (error) {
-    if (process.platform !== 'win32' || !['EEXIST', 'EPERM'].includes(error?.code)) throw error;
-    const backup = `${path}.${runnerId}.backup`;
-    await rename(path, backup);
-    try { await rename(temporary, path); await unlink(backup); }
-    catch (replaceError) { await rename(backup, path).catch(() => {}); throw replaceError; }
-  }
-}
-
-function validateScriptChange(job, scripts) {
-  if (!['add', 'edit', 'delete'].includes(job.operation)) throw new Error('Unsupported npm script operation.');
-  if (typeof job.name !== 'string' || !/^[A-Za-z0-9:_@./ -]{1,128}$/.test(job.name)) throw new Error('Invalid npm script name.');
-  if (job.name === 'host') throw new Error('The core host script cannot be changed.');
-  const exists = Object.hasOwn(scripts, job.name);
-  if (job.operation === 'add' && exists) throw new Error(`npm script already exists: ${job.name}`);
-  if (job.operation !== 'add' && !exists) throw new Error(`npm script is not defined: ${job.name}`);
-  if (job.operation !== 'delete' && (typeof job.command !== 'string' || !job.command.trim() || job.command.length > 8192)) throw new Error('A non-empty command of at most 8192 characters is required.');
-  if (job.operation === 'delete' && job.command !== undefined) throw new Error('Delete does not accept a command.');
-}
-
-function pruneApprovals() {
-  const now = Date.now();
-  for (const [requestId, approval] of approvals) if (approval.expiresAtMs <= now) approvals.delete(requestId);
-}
-
-async function requestScriptChange(job) {
-  if (typeof job.requestId !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$/.test(job.requestId)) throw new Error('A valid request ID is required.');
-  pruneApprovals();
-  if (approvals.has(job.requestId)) throw new Error('The request ID is already pending.');
-  if (approvals.size >= maximumPendingApprovals) throw new Error('Too many npm script approvals are pending.');
-  const text = await packageText();
-  const scripts = parsePackageDocument(text).scripts || {};
-  validateScriptChange(job, scripts);
-  const code = randomBytes(6).toString('base64url').slice(0, 8).toUpperCase();
-  const expiresAtMs = Date.now() + approvalTtlMs;
-  approvals.set(job.requestId, { ...job, expectedCommand: Object.hasOwn(scripts, job.name) ? String(scripts[job.name]) : null, expectedPackageHash: hash(text), code, attempts: 0, expiresAtMs });
-  const expiresAt = new Date(expiresAtMs).toISOString();
-  emit('npm.scripts.confirmation_required', { ...job, code, expiresAt });
-  return { jobId: job.jobId, status: 'confirmation_required', requestId: job.requestId, operation: job.operation, name: job.name, expiresAt };
-}
-
-async function confirmScriptChange(job) {
-  pruneApprovals();
-  const approval = approvals.get(job.requestId);
-  if (!approval) throw new Error('The npm script approval was not found or has expired.');
-  approval.attempts += 1;
-  if (String(job.code).trim().toUpperCase() !== approval.code) {
-    if (approval.attempts >= approvalMaximumAttempts) approvals.delete(job.requestId);
-    throw new Error(approval.attempts >= approvalMaximumAttempts ? 'Invalid confirmation code; the approval has been cancelled.' : 'Invalid confirmation code.');
-  }
-  const text = await packageText();
-  if (hash(text) !== approval.expectedPackageHash) { approvals.delete(job.requestId); throw new Error('package.json changed after approval was requested; request a new approval.'); }
-  const document = parsePackageDocument(text), scripts = document.scripts || {};
-  validateScriptChange(approval, scripts);
-  if (approval.operation === 'delete') delete scripts[approval.name]; else scripts[approval.name] = approval.command;
-  document.scripts = scripts;
-  await writePackageJson(document, approval.expectedPackageHash);
-  approvals.delete(job.requestId);
-  emit('npm.scripts.changed', approval);
-  return { jobId: job.jobId, status: 'success', requestId: approval.requestId, operation: approval.operation, name: approval.name };
-}
-
-function appendLimited(chunks, chunk, state) {
-  const buffer = Buffer.from(chunk); state.totalBytes += buffer.length;
-  const available = Math.max(0, maximumOutputBytes - state.bytes);
-  if (available) chunks.push(buffer.subarray(0, available));
-  state.bytes += Math.min(buffer.length, available); if (buffer.length > available) state.truncated = true;
-}
-
-async function runNpm(job) {
-  const scripts = await packageScripts();
-  if (typeof job.script !== 'string' || !Array.isArray(job.args) || !job.args.every(value => typeof value === 'string')) throw new Error('Invalid host npm job.');
-  if (job.script === 'host') throw new Error('The host bridge cannot invoke itself.');
-  if (!Object.hasOwn(scripts, job.script)) throw new Error(`npm script is not defined: ${job.script}`);
-  const args = ['run', job.script, ...(job.args.length ? ['--', ...job.args] : [])];
-  const executable = npmCli ? process.execPath : npmExecutable;
-  const executableArgs = npmCli ? [npmCli, ...args] : args;
-  const startedAt = new Date().toISOString();
-  return new Promise(resolveJob => {
-    const child = spawn(executable, executableArgs, { cwd: workspace, env: process.env, shell: false, windowsHide: true, detached: process.platform !== 'win32', stdio: ['ignore', 'pipe', 'pipe'] });
-    activeChildren.add(child);
-    const stdout = [], stderr = [], out = { bytes: 0, totalBytes: 0, truncated: false }, err = { bytes: 0, totalBytes: 0, truncated: false };
-    child.stdout.on('data', chunk => appendLimited(stdout, chunk, out)); child.stderr.on('data', chunk => appendLimited(stderr, chunk, err));
-    const finish = (exitCode, message = '') => resolveJob({ jobId: job.jobId, exitCode, stdout: Buffer.concat(stdout).toString('utf8'), stderr: message || Buffer.concat(stderr).toString('utf8'), pid: child.pid ?? null, hostPlatform, hostName, stdoutTruncated: out.truncated, stderrTruncated: err.truncated, stdoutTotalBytes: out.totalBytes, stderrTotalBytes: message ? Buffer.byteLength(message) : err.totalBytes, startedAt, completedAt: new Date().toISOString() });
-    child.on('error', error => { activeChildren.delete(child); finish(1, error.message); });
-    child.on('close', code => { activeChildren.delete(child); finish(Number.isInteger(code) ? code : 1); });
-  });
-}
-
-async function execute(job) {
-  if (job?.schemaVersion !== 1 || typeof job?.jobId !== 'string') throw new Error('Unsupported host job schema.');
-  if (job.type === 'npm.scripts.request') return requestScriptChange(job);
-  if (job.type === 'npm.scripts.confirm') return confirmScriptChange(job);
-  if (job.type === 'npm.run') return runNpm(job);
-  throw new Error('Unsupported host job type.');
-}
-
-async function stopChildren() {
-  await Promise.all([...activeChildren].map(child => new Promise(resolveStop => {
-    if (!child.pid) return resolveStop();
-    const done = () => resolveStop(); child.once('close', done);
-    if (process.platform === 'win32') { const killer = spawn('taskkill', ['/pid', String(child.pid), '/t', '/f'], { windowsHide: true, stdio: 'ignore' }); killer.once('close', done); killer.once('error', done); }
-    else { try { process.kill(-child.pid, 'SIGTERM'); } catch { return done(); } setTimeout(() => { try { process.kill(-child.pid, 'SIGKILL'); } catch {} }, 2000).unref(); }
-  })));
-}
-
-function sendBridge(child, message) {
-  if (!child.stdin.writable) throw new Error('The Docker Compose bridge input closed unexpectedly.');
-  child.stdin.write(`${JSON.stringify({ protocolVersion: 1, ...message })}\n`);
-}
-
-function bridgeSession() {
-  const sessionId = randomUUID();
-  const args = [...dockerPrefixArgs, 'compose', 'exec', '-T', 'control', '/usr/local/bin/nestbox-host-bridge'];
-  const child = spawn(dockerExecutable, args, { cwd: installDirectory, env: process.env, shell: false, windowsHide: true, detached: process.platform !== 'win32', stdio: ['pipe', 'pipe', 'pipe'] });
-  activeBridge = child;
-  let diagnostics = '', buffer = '', settled = false;
-  const finish = (resolveSession, rejectSession, error, value) => {
-    if (settled) return;
-    settled = true;
-    if (activeBridge === child) activeBridge = undefined;
-    error ? rejectSession(error) : resolveSession(value);
-  };
-  return new Promise((resolveSession, rejectSession) => {
-    child.stdin.on('error', () => {});
-    child.stderr.on('data', chunk => {
-      diagnostics = (diagnostics + chunk.toString('utf8')).slice(-65536);
-      if (!jsonOutput) process.stderr.write(chunk);
-    });
-    child.stdout.on('data', chunk => {
-      buffer += chunk.toString('utf8');
-      if (Buffer.byteLength(buffer) > 64 * 1024 * 1024) {
-        child.stdin.end();
-        finish(resolveSession, rejectSession, new Error('The host bridge protocol line exceeded 64 MiB.'));
-        return;
-      }
-      let newline;
-      while ((newline = buffer.indexOf('\n')) >= 0) {
-        const line = buffer.slice(0, newline); buffer = buffer.slice(newline + 1);
-        if (!line) continue;
-        let message;
-        try { message = JSON.parse(line); }
-        catch { finish(resolveSession, rejectSession, new Error('The host bridge returned invalid JSON.')); child.stdin.end(); return; }
-        if (message?.protocolVersion !== 1 || typeof message.type !== 'string') {
-          finish(resolveSession, rejectSession, new Error('The host bridge returned an unsupported protocol message.')); child.stdin.end(); return;
-        }
-        if (message.type === 'ready') {
-          if (!announced) {
-            announced = true;
-            emit('runner.ready', { workspace, pid: process.pid, platform: hostPlatform, hostname: hostName });
-          }
-        } else if (message.type === 'idle' && once && !retainedResult && !activeJobPromise) {
-          child.stdin.end();
-          finish(resolveSession, rejectSession, null, { done: true });
-        } else if (message.type === 'job') {
-          const job = message.job;
-          if (retainedResult) {
-            if (job?.jobId !== retainedResult.jobId) { finish(resolveSession, rejectSession, new Error('The bridge assigned new work before acknowledging the previous result.')); child.stdin.end(); }
-            else sendBridge(child, { type: 'result', result: retainedResult });
-            continue;
-          }
-          if (activeJobPromise && activeJobId !== job?.jobId) {
-            finish(resolveSession, rejectSession, new Error('The bridge assigned new work while another host job was still running.')); child.stdin.end(); continue;
-          }
-          if (!activeJobPromise) {
-            activeJobId = job?.jobId;
-            activeJobPromise = Promise.resolve().then(async () => {
-              if (stopping) {
-                const timestamp = new Date().toISOString();
-                return { jobId: job?.jobId, exitCode: 1, stdout: '', stderr: 'The host runner stopped before executing the assigned job.', pid: null, hostPlatform, hostName, interrupted: true, startedAt: timestamp, completedAt: timestamp };
-              }
-              try { return await execute(job); }
-              catch (error) { return { jobId: job?.jobId, exitCode: 1, stdout: '', stderr: error instanceof Error ? error.message : String(error), pid: null, hostPlatform, hostName, startedAt: new Date().toISOString(), completedAt: new Date().toISOString() }; }
-            }).then(result => {
-              retainedResult = result;
-              activeJobId = undefined;
-              activeJobPromise = undefined;
-              return result;
-            });
-          }
-          activeJobPromise.then(result => { if (!settled) sendBridge(child, { type: 'result', result }); }).catch(error => {
-            child.stdin.end();
-            finish(resolveSession, rejectSession, error);
-          });
-        } else if (message.type === 'result.ack') {
-          if (!retainedResult || message.jobId !== retainedResult.jobId) { finish(resolveSession, rejectSession, new Error('The bridge acknowledged an unknown result.')); child.stdin.end(); return; }
-          retainedResult = undefined;
-          if (once) { child.stdin.end(); finish(resolveSession, rejectSession, null, { done: true }); }
-        } else if (message.type === 'gone') {
-          if (retainedResult?.jobId === message.jobId) retainedResult = undefined;
-          emit('runner.error', { jobId: message.jobId, error: message.error || 'The assigned host job is no longer available.' });
-          if (once) { child.stdin.end(); finish(resolveSession, rejectSession, null, { done: true }); }
-        } else if (message.type === 'result.rejected') {
-          if (retainedResult?.jobId === message.jobId) retainedResult = undefined;
-          emit('runner.error', { jobId: message.jobId, error: message.error || 'Control rejected the retained host result.' });
-          if (once) { child.stdin.end(); finish(resolveSession, rejectSession, null, { done: true }); }
-        }
-      }
-    });
-    child.once('error', error => finish(resolveSession, rejectSession, new Error(`Unable to start Docker Compose: ${error.message}`)));
-    child.once('close', code => {
-      if (settled) return;
-      const stale = /nestbox-host-bridge|not found|no such file/i.test(diagnostics) || code === 126 || code === 127;
-      const message = stale
-        ? 'The control image is stale or missing the Nestbox host bridge. Run `docker compose build control` and `docker compose up -d control`, then retry.'
-        : `Docker Compose host bridge exited with code ${code}${diagnostics.trim() ? `: ${diagnostics.trim()}` : ''}`;
-      const error = new Error(message);
-      if (stale) error.code = 'STALE_CONTROL_IMAGE';
-      finish(resolveSession, rejectSession, stopping ? null : error, { done: stopping });
-    });
-    sendBridge(child, { type: 'hello', runnerId, sessionId, metadata: { pid: process.pid, platform: hostPlatform, hostname: hostName }, ...(retainedResult ? { retainedResult } : {}) });
-  });
-}
-
-async function main() {
-  let backoffMs = 500;
-  while (!stopping) {
-    try {
-      const session = bridgeSession();
-      const outcome = await session;
-      backoffMs = 500;
-      if (outcome?.done) break;
-    } catch (error) {
-      if (error.code === 'STALE_CONTROL_IMAGE') throw error;
-      emit('runner.error', { error: `${error.message}; reconnecting` });
-      await new Promise(resolveWait => setTimeout(resolveWait, backoffMs));
-      backoffMs = Math.min(10000, backoffMs * 2);
-    }
-  }
-}
-
-for (const signal of ['SIGINT', 'SIGTERM']) process.on(signal, () => {
-  if (stopping) return;
-  stopping = true;
-  activeBridge?.stdin.end();
-  const bridge = activeBridge;
-  if (bridge?.pid) setTimeout(() => {
-    if (process.platform === 'win32') spawn('taskkill', ['/pid', String(bridge.pid), '/t', '/f'], { windowsHide: true, stdio: 'ignore' });
-    else try { process.kill(-bridge.pid, 'SIGTERM'); } catch {}
-  }, 2000).unref();
-  stopChildren().catch(error => emit('runner.error', { error: error.message || String(error) }));
-});
-main().catch(error => { emit('runner.error', { error: error.message || String(error) }); stopChildren().finally(() => process.exit(1)); });

package/package.host.json

@@ -1,8 +0,0 @@
-{
-  "name": "nestbox-workspace",
-  "private": true,
-  "scripts": {
-    "host": "node .nestbox/host-runner.mjs",
-    "test:host": "node .nestbox/tests/host-runner.mjs"
-  }
-}