@promigence/sdk 0.1.0-beta.15 → 0.1.0-beta.17

package/dist/cjs/command-errors.d.ts

@@ -18,6 +18,7 @@ export declare class CommandTimeoutError extends CommandExitError {
     readonly code: string;
     readonly fix: string;
     readonly guide: string;
+    readonly docs: string;
     constructor(result: CommandResult, timeoutMs: number | undefined);
 }
 /**

package/dist/cjs/command-errors.js

@@ -16,9 +16,11 @@ class CommandTimeoutError extends core_js_1.CommandExitError {
     code;
     fix;
     guide;
+    docs;
     constructor(result, timeoutMs) {
         super(result);
         this.code = "task_timeout";
+        this.docs = (0, core_js_1.errorsDocsFor)(this.code);
         this.timeoutMs = timeoutMs;
         this.message = timeoutMs === undefined
             ? `command timed out (killed at its timeout, exit ${result.exitCode})`

package/dist/cjs/context.d.ts

@@ -15,9 +15,11 @@
  * - Empty directories and permission bits travel as they are on disk; a set-user-ID or
  *   set-group-ID bit is cleared, with a note.
  * - Files that look like credentials (`.env`, private keys, cloud credentials, ...) are refused,
- *   by name, unless `allowSecrets` says otherwise. The check goes by file name: it is
- *   best-effort and cannot see what a file holds, so look over the list (`listContext`) before
- *   you send a directory.
+ *   by name, unless `allowSecretFiles` names them (each one) or `allowSecrets` says otherwise. The
+ *   check goes by file name and reads only two kinds of file, to clear the plain false
+ *   positives: a `.pem` holding certificates or public keys and no private key, and an `.npmrc`
+ *   with no token or password in it. It is best-effort, so look over the list (`listContext`)
+ *   before you send a directory.
  * - Symbolic links travel as links, never as the file they point at.
  */
 /** The prefix a packed directory travels under in `dockerfile.context`. */
@@ -65,9 +67,17 @@ export declare function dockerignoreMatcher(text: string): {
 /**
  * Does this path look like a credential (`.env`, a private key, cloud or registry credentials, a
  * token file, ...)? By name only: best-effort, it cannot see what a file holds. Templates such as
- * `.env.example` are not.
+ * `.env.example` are not. [`secretLikeFile`] also reads the few files whose contents can clear them.
  */
 export declare function secretLike(path: string): boolean;
+/** The most of a file [`secretLikeFile`] reads; a larger one is judged by its name alone. */
+export declare const CONTENT_CHECK_MAX_BYTES: number;
+/**
+ * [`secretLike`] for a file on disk at `abs` (`rel` is its path in the upload): a name that looks
+ * like a credential, unless what the file holds clears it ([`clearedByContent`]). A link, a file
+ * over [`CONTENT_CHECK_MAX_BYTES`] and a file that cannot be read keep the name's verdict.
+ */
+export declare function secretLikeFile(rel: string, abs: string): boolean;
 /** What a build context is packed from and sent with. */
 export interface ContextOptions {
     /**
@@ -84,6 +94,12 @@ export interface ContextOptions {
      * nothing is sent.
      */
     allowSecrets?: boolean;
+    /**
+     * Send these files that look like credentials, and only these: paths inside the context,
+     * `/`-separated, as `listContext` names them. Every other one is still refused, and a name that
+     * is no file of the context is refused too, so a mistyped or stale name is seen.
+     */
+    allowSecretFiles?: readonly string[];
     /** Called with each note: what was left out by default, or changed on the way. */
     onNote?: (note: string) => void;
 }

package/dist/cjs/context.js

@@ -1,9 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CREDENTIAL_CHECK_NOTE = exports.CONTEXT_SKIP = exports.CONTEXT_MAX_BYTES = exports.CONTEXT_TAR_PREFIX = void 0;
+exports.CREDENTIAL_CHECK_NOTE = exports.CONTENT_CHECK_MAX_BYTES = exports.CONTEXT_SKIP = exports.CONTEXT_MAX_BYTES = exports.CONTEXT_TAR_PREFIX = void 0;
 exports.parseDockerignore = parseDockerignore;
 exports.dockerignoreMatcher = dockerignoreMatcher;
 exports.secretLike = secretLike;
+exports.clearedByContent = clearedByContent;
+exports.secretLikeFile = secretLikeFile;
 exports.credentialRefusalMessage = credentialRefusalMessage;
 exports.listContext = listContext;
 exports.packContext = packContext;
@@ -397,6 +399,74 @@ function secretLike(path) {
         return false;
     return SECRET_NAMES.some((re) => re.test(name));
 }
+exports.CONTENT_CHECK_MAX_BYTES = 1024 * 1024;
+const PUBLIC_PEM = new Set([
+    "CERTIFICATE", "TRUSTED CERTIFICATE", "X509 CERTIFICATE", "X509 CRL", "CERTIFICATE REQUEST",
+    "NEW CERTIFICATE REQUEST", "PUBLIC KEY", "RSA PUBLIC KEY", "PKCS7", "CMS", "DH PARAMETERS",
+    "X9.42 DH PARAMETERS", "EC PARAMETERS",
+]);
+function publicPem(text) {
+    if (/private[\s_-]*key/i.test(text))
+        return false;
+    const types = [...text.matchAll(/-----BEGIN ([^\r\n-]+)-----/g)].map((m) => m[1].trim().toUpperCase());
+    if (types.length === 0 || !types.every((t) => PUBLIC_PEM.has(t)))
+        return false;
+    const outside = text.replace(/-----BEGIN ([^\r\n-]+)-----[\s\S]*?-----END \1-----/g, "");
+    if (/-----(BEGIN|END) /.test(outside))
+        return false;
+    return !outside.split(/\r?\n/).some((l) => /^(?=.*[A-Za-z0-9+/])[A-Za-z0-9+/=]{40,}$/.test(l.trim()));
+}
+const NPMRC_CREDENTIAL = /_auth|token|passw|secret|credential|certfile|keyfile|otp|username/i;
+function npmrcWithoutCredentials(text) {
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim().replace(/^[;#]+\s*/, "");
+        if (!line)
+            continue;
+        if (NPMRC_CREDENTIAL.test(line) || /:\/\/[^\s/]*@/.test(line))
+            return false;
+        const eq = line.indexOf("=");
+        const key = (eq < 0 ? line : line.slice(0, eq)).trim();
+        const own = key.startsWith("//") ? key.slice(key.lastIndexOf(":") + 1) : key;
+        if (/^(key|cert|email)$/i.test(own.trim()))
+            return false;
+    }
+    return true;
+}
+function clearedByContent(path, content) {
+    const name = path.split("/").filter(Boolean).pop() ?? "";
+    let text;
+    if (typeof content === "string") {
+        text = content;
+    }
+    else {
+        try {
+            text = new TextDecoder("utf-8", { fatal: true }).decode(content);
+        }
+        catch {
+            return false;
+        }
+    }
+    if (text.includes("\u0000"))
+        return false;
+    if (/\.pem$/i.test(name))
+        return publicPem(text);
+    if (/^\.npmrc$/i.test(name))
+        return npmrcWithoutCredentials(text);
+    return false;
+}
+function secretLikeFile(rel, abs) {
+    if (!secretLike(rel))
+        return false;
+    try {
+        const st = (0, node_fs_1.lstatSync)(abs);
+        if (!st.isFile() || st.size > exports.CONTENT_CHECK_MAX_BYTES)
+            return true;
+        return !clearedByContent(rel, (0, node_fs_1.readFileSync)(abs));
+    }
+    catch {
+        return true;
+    }
+}
 function namedList(items) {
     const more = items.length > NAMED ? ` and ${items.length - NAMED} more` : "";
     return items.slice(0, NAMED).join(", ") + more;
@@ -405,7 +475,7 @@ function credentialRefusalMessage(hits) {
     const one = hits.length === 1;
     return `${hits.length} file${one ? " looks" : "s look"} like ${one ? "a credential" : "credentials"} and ${one ? "was" : "were"} not uploaded: ${namedList(hits)}; nothing was created`;
 }
-exports.CREDENTIAL_CHECK_NOTE = "The check goes by file name and is best-effort: it cannot see what a file holds, so look over what you send.";
+exports.CREDENTIAL_CHECK_NOTE = "The check goes by file name and is best-effort: it reads only a .pem (one with no private key passes) and an .npmrc (one with no token or password passes), so look over what you send.";
 function insidePath(p) {
     return goClean(p.split(node_path_1.sep).join("/").replace(/^\.\/+/, ""));
 }
@@ -505,7 +575,7 @@ function collect(dir, opts) {
     if (special.length > 0) {
         notes.push(`Left out ${namedList(special)}: a socket, device or pipe; a build context holds only files, directories and links.`);
     }
-    const secrets = entries.filter((e) => e.kind === "file" && secretLike(e.rel)).map((e) => e.rel);
+    const secrets = entries.filter((e) => e.kind === "file" && secretLikeFile(e.rel, e.abs)).map((e) => e.rel);
     return { entries, bytes, notes, secrets, ignore };
 }
 function listContext(dir, opts = {}) {
@@ -524,12 +594,19 @@ function packContext(dir, opts = {}) {
     const c = collect(dir, opts);
     for (const n of c.notes)
         opts.onNote?.(n);
+    const files = new Set(c.entries.filter((e) => e.kind !== "dir").map((e) => e.rel));
+    const unknown = [...new Set((opts.allowSecretFiles ?? []).map(insidePath))].filter((p) => !files.has(p));
+    if (unknown.length > 0) {
+        throw new core_js_1.InvalidArgumentError(`allowSecretFiles ${unknown.join(", ")}: no such file in this upload`, 'Name each file as listContext names it (its path inside the context sent), e.g. { allowSecretFiles: ["certs/test.pem"] }.');
+    }
     if (c.bytes > max) {
         const ig = c.ignore?.file;
         throw new core_js_1.InvalidArgumentError(`the build context is over ${max} bytes${ig ? ` even without what its ${ig} excludes` : ""}`, `${ig ? `Exclude more in ${ig}` : "Add a .dockerignore"}, point --context at a smaller directory, or pass a git URL pinned to a full 40-character sha.`);
     }
-    if (c.secrets.length > 0 && !opts.allowSecrets) {
-        throw new core_js_1.InvalidArgumentError(credentialRefusalMessage(c.secrets), `A snapshot keeps every file it holds, and every sandbox started from it has them. Exclude them in ${c.ignore?.file ?? ".dockerignore"}, pass the values as secrets, or pass { allowSecrets: true } if they are not real credentials. ${exports.CREDENTIAL_CHECK_NOTE}`);
+    const allowed = new Set((opts.allowSecretFiles ?? []).map(insidePath));
+    const refused = c.secrets.filter((s) => !allowed.has(s));
+    if (refused.length > 0 && !opts.allowSecrets) {
+        throw new core_js_1.InvalidArgumentError(credentialRefusalMessage(refused), `A snapshot keeps every file it holds, and every sandbox started from it has them. Exclude them in ${c.ignore?.file ?? ".dockerignore"}, pass the values as secrets, or name each that is not a real credential in { allowSecretFiles: [...] } ({ allowSecrets: true } for all of them). ${exports.CREDENTIAL_CHECK_NOTE}`);
     }
     if (c.entries.length === 0) {
         throw new core_js_1.InvalidArgumentError(`the build context ${JSON.stringify(dir)} is empty`, "Point --context at the directory holding your Dockerfile.");

package/dist/cjs/core.d.ts

@@ -1,8 +1,10 @@
 /** Promigence SDK — constants, error hierarchy and shared types. */
-export declare const VERSION = "0.1.0-beta.15";
+export declare const VERSION = "0.1.0-beta.17";
 export declare const DOCS_URL = "https://promigence.ai";
 /** The error reference; each code is an anchor on it (the API's `docs` link has the same form). */
 export declare const ERRORS_DOCS_URL = "https://www.promigence.ai/docs/errors";
+/** The row of `code` in the error reference. */
+export declare function errorsDocsFor(code: string): string;
 export declare const DEFAULT_API_URL = "https://api.promigence.ai/v1";
 /** Where to write about a key. A key is self-serve: `promigence login` signs up or in and stores one. */
 export declare const KEY_CONTACT = "support@promigence.ai";
@@ -43,8 +45,8 @@ export interface PromigenceErrorInit {
     /** The API error's `retryable`: nothing ran and the same request, sent again as is, can succeed. */
     retryable?: boolean;
 }
-/** What a caller reads instead: a fact about this beta, not a mistake of theirs. */
-export declare const PREVIEWS_UNAVAILABLE = "preview URLs are not available in this beta yet";
+/** What a caller reads instead: a fact about their account, not a mistake of theirs. */
+export declare const PREVIEWS_UNAVAILABLE = "preview URLs are not turned on for this account";
 export declare function previewsFix(sandboxId?: string, port?: string | number): string;
 /**
  * A `fix` that opens by repeating the message says only what it adds: the API's `usage` fix is
@@ -97,7 +99,13 @@ export declare class PromigenceError extends Error {
         guide: string;
     };
 }
-/** Bad arguments (e.g. an unknown template, a missing spend cap). exit 2 */
+/**
+ * Bad arguments (e.g. an unknown template, a missing spend cap). exit 2
+ *
+ * `code` says who refused: `invalid_argument` is the SDK, before anything was sent; `usage` is the
+ * API, refusing what it was sent. Nothing ran and nothing was billed either way, so catch this
+ * class (or exit 2) to handle both.
+ */
 export declare class InvalidArgumentError extends PromigenceError {
     /**
      * `code` defaults to `invalid_argument` — what the SDK raises for a bad argument it catches
@@ -122,6 +130,26 @@ export declare function previewsOff(message: string): boolean;
 export declare class PreviewsUnavailableError extends InvalidArgumentError {
     constructor(sandboxId?: string, port?: string | number);
 }
+/** The sandbox and its state when an API message is the "has ended" refusal, else `undefined`. */
+export declare function sandboxEndedIn(message: string): {
+    sandboxId: string;
+    state: string;
+} | undefined;
+/** What a caller of this SDK does about an ended sandbox. */
+export declare const SANDBOX_ENDED_FIX = "Start a new sandbox: Sandbox.create(). This one's getInfo() says how it ended (`outcome`).";
+/**
+ * A call to a sandbox that has ended (`state` `ended` or `failed`): it does not come back. Still an
+ * `InvalidArgumentError` with code `usage` and exit 2, as the API answers it, so a catch written
+ * against earlier releases still catches it; catch this class to tell an ended sandbox from a bad
+ * argument. `sandboxId` and `state` name the sandbox and how it stands.
+ */
+export declare class SandboxEndedError extends InvalidArgumentError {
+    /** The sandbox that has ended. */
+    readonly sandboxId: string;
+    /** Its state: `ended`, or `failed` for one that ended on a failure. */
+    readonly state: string;
+    constructor(message: string, sandboxId: string, state: string, fix?: string);
+}
 /** The environment failed (our fault, never the task's). exit 3 */
 export declare class EnvFailedError extends PromigenceError {
     constructor(code: string, message: string, fix: string);
@@ -201,6 +229,20 @@ export declare class TimeoutError extends PromigenceError {
 export declare class ServiceRestartError extends PromigenceError {
     constructor(message: string, fix: string);
 }
+/**
+ * The connection dropped while a command was running (`sandboxes.exec`, `execStream`,
+ * `commands.run`), and the command could not be picked up again: no client came back for it in
+ * time, or the service no longer keeps it. The sandbox keeps running. `retryable` is `false`: the
+ * command may have done part of its work before it stopped, so run it again only if that is safe.
+ * exit 3
+ */
+export declare class ExecLostError extends PromigenceError {
+    /** The sandbox the command ran in. */
+    readonly sandboxId: string | undefined;
+    constructor(message: string, ids?: {
+        sandboxId?: string;
+    }, lost?: "gone" | "not_reattached" | "unreachable");
+}
 /** An API error with no more specific class (5xx, unknown code). exit from the table. */
 export declare class ApiError extends PromigenceError {
 }
@@ -238,6 +280,12 @@ export interface CommandResult {
     truncated?: boolean;
     /** `exec_id`, for `promigence exec output <exec_id>` / `GET /sandboxes/:id/execs/:exec_id`. */
     execId?: string;
+    /**
+     * `true` when the command was killed at its own time bound (see `timeoutMs`), `false` for any
+     * other exit. With `throwOnExit: false` this is how a result tells a timeout from any other
+     * exit 137, such as an out-of-memory kill or a `kill -9`. Set on every result the SDK returns.
+     */
+    timedOut?: boolean;
 }
 export interface CommandRunOpts {
     cwd?: string;
@@ -249,7 +297,10 @@ export interface CommandRunOpts {
      * (or the default 15 minutes).
      */
     timeoutMs?: number;
-    /** Throw `CommandExitError` on non-zero exit (default true). */
+    /**
+     * Throw `CommandExitError` on non-zero exit (default true). With `false`, a foreground command's
+     * result comes back instead, and its `timedOut` says whether it was killed at its time bound.
+     */
     throwOnExit?: boolean;
     /** Inline output budget; `truncated` beyond it (default 64 KiB). */
     maxOutputBytes?: number;

package/dist/cjs/core.js

@@ -1,15 +1,20 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EXIT_BY_CODE = exports.NotReleasedError = exports.ApiError = exports.ServiceRestartError = exports.TimeoutError = exports.RateLimitError = exports.UnreachableError = exports.NotFoundError = exports.AuthError = exports.NotVerifiedError = exports.SpendCapError = exports.CommandExitError = exports.EnvFailedError = exports.PreviewsUnavailableError = exports.UnsupportedError = exports.InvalidArgumentError = exports.PromigenceError = exports.PREVIEWS_UNAVAILABLE = exports.FILE_PUT_CHUNK_BYTES = exports.MAX_OUTPUT_BYTES_DEFAULT = exports.IMAGE_BUILD_LIST_PRICE = exports.IMAGE_BUILD_TIMEOUT_MS = exports.WAIT_TIMEOUT_MS = exports.KEY_CONTACT = exports.DEFAULT_API_URL = exports.ERRORS_DOCS_URL = exports.DOCS_URL = exports.VERSION = void 0;
+exports.EXIT_BY_CODE = exports.NotReleasedError = exports.ApiError = exports.ExecLostError = exports.ServiceRestartError = exports.TimeoutError = exports.RateLimitError = exports.UnreachableError = exports.NotFoundError = exports.AuthError = exports.NotVerifiedError = exports.SpendCapError = exports.CommandExitError = exports.EnvFailedError = exports.SandboxEndedError = exports.SANDBOX_ENDED_FIX = exports.PreviewsUnavailableError = exports.UnsupportedError = exports.InvalidArgumentError = exports.PromigenceError = exports.PREVIEWS_UNAVAILABLE = exports.FILE_PUT_CHUNK_BYTES = exports.MAX_OUTPUT_BYTES_DEFAULT = exports.IMAGE_BUILD_LIST_PRICE = exports.IMAGE_BUILD_TIMEOUT_MS = exports.WAIT_TIMEOUT_MS = exports.KEY_CONTACT = exports.DEFAULT_API_URL = exports.ERRORS_DOCS_URL = exports.DOCS_URL = exports.VERSION = void 0;
+exports.errorsDocsFor = errorsDocsFor;
 exports.previewsFix = previewsFix;
 exports.withPreviewsFix = withPreviewsFix;
 exports.fixBeyondMessage = fixBeyondMessage;
 exports.previewsOff = previewsOff;
+exports.sandboxEndedIn = sandboxEndedIn;
 exports.exitForCode = exitForCode;
 const hint_js_1 = require("./hint.js");
-exports.VERSION = "0.1.0-beta.15";
+exports.VERSION = "0.1.0-beta.17";
 exports.DOCS_URL = "https://promigence.ai";
 exports.ERRORS_DOCS_URL = "https://www.promigence.ai/docs/errors";
+function errorsDocsFor(code) {
+    return `${exports.ERRORS_DOCS_URL}#${code}`;
+}
 exports.DEFAULT_API_URL = "https://api.promigence.ai/v1";
 exports.KEY_CONTACT = "support@promigence.ai";
 exports.WAIT_TIMEOUT_MS = 100_000;
@@ -18,10 +23,11 @@ exports.IMAGE_BUILD_LIST_PRICE = 0.1656;
 exports.MAX_OUTPUT_BYTES_DEFAULT = 64 * 1024;
 exports.FILE_PUT_CHUNK_BYTES = 16 * 1024 * 1024;
 const PREVIEWS_OFF = /^previews are not enabled on this deployment\.?$/i;
-exports.PREVIEWS_UNAVAILABLE = "preview URLs are not available in this beta yet";
+exports.PREVIEWS_UNAVAILABLE = "preview URLs are not turned on for this account";
 function previewsFix(sandboxId = "SID", port = 8000) {
     return `Reach the port over SSH instead: \`promigence sandbox ssh ${(0, hint_js_1.hintArg)(sandboxId)} -- -N -L ${(0, hint_js_1.hintArg)(`${port}:localhost:${port}`)}\` ` +
-        `forwards http://localhost:${port} here to port ${port} in the sandbox until Ctrl-C.`;
+        `forwards http://localhost:${port} here to port ${port} in the sandbox until Ctrl-C. ` +
+        "Write to support@promigence.ai to have preview URLs turned on.";
 }
 async function withPreviewsFix(call, sandboxId, port = "PORT") {
     try {
@@ -60,7 +66,7 @@ class PromigenceError extends Error {
         this.name = new.target.name;
         this.code = code;
         this.fix = previewsOff ? previewsFix() : fixBeyondMessage(init.message, init.fix);
-        this.docs = init.docs ?? exports.DOCS_URL;
+        this.docs = init.docs ?? errorsDocsFor(code);
         this.exitCode = init.exitCode ?? 1;
         this.cliExit = init.exitCode ?? 1;
         this.guide = `promigence agent-guide --section errors --code ${(0, hint_js_1.hintArg)(code)}`;
@@ -111,6 +117,27 @@ class PreviewsUnavailableError extends InvalidArgumentError {
     }
 }
 exports.PreviewsUnavailableError = PreviewsUnavailableError;
+const SANDBOX_ENDED = /^sandbox (\S+) has ended \(`([a-z_]+)`\)/;
+const SANDBOX_EXPIRED = /^sandbox (\S+) reached its timeout and ended\b/;
+function sandboxEndedIn(message) {
+    const text = message.trim();
+    const m = SANDBOX_ENDED.exec(text);
+    if (m)
+        return { sandboxId: m[1], state: m[2] };
+    const x = SANDBOX_EXPIRED.exec(text);
+    return x ? { sandboxId: x[1], state: "ended" } : undefined;
+}
+exports.SANDBOX_ENDED_FIX = "Start a new sandbox: Sandbox.create(). This one's getInfo() says how it ended (`outcome`).";
+class SandboxEndedError extends InvalidArgumentError {
+    sandboxId;
+    state;
+    constructor(message, sandboxId, state, fix = exports.SANDBOX_ENDED_FIX) {
+        super(message, fix, "usage");
+        this.sandboxId = sandboxId;
+        this.state = state;
+    }
+}
+exports.SandboxEndedError = SandboxEndedError;
 class EnvFailedError extends PromigenceError {
     constructor(code, message, fix) {
         super({ code, message, fix, exitCode: 3 });
@@ -221,6 +248,21 @@ class ServiceRestartError extends PromigenceError {
     }
 }
 exports.ServiceRestartError = ServiceRestartError;
+const EXEC_LOST_FIX = "The sandbox is still running; the command was stopped, maybe after part of its work: run it again if that is safe. " +
+    "Billed unless the drop was ours: then email support@promigence.ai with the sandbox id.";
+class ExecLostError extends PromigenceError {
+    sandboxId;
+    lost;
+    constructor(message, ids = {}, lost = "gone") {
+        super({
+            code: "exec_lost", message, fix: EXEC_LOST_FIX, docs: `${exports.ERRORS_DOCS_URL}#exec_lost`,
+            exitCode: 3, category: "env", retryable: false,
+        });
+        this.sandboxId = ids.sandboxId;
+        this.lost = lost;
+    }
+}
+exports.ExecLostError = ExecLostError;
 class ApiError extends PromigenceError {
 }
 exports.ApiError = ApiError;
@@ -240,6 +282,8 @@ exports.EXIT_BY_CODE = {
     env_failed: 3, snapshot_rejected: 6, build_failed: 3, snapshot_failed: 4,
     not_connected: 7,
     service_restart: 3,
+    digest_mismatch: 4,
+    exec_lost: 3,
     fork_failed: 3, start_timeout: 3, readiness_failed: 3, verify_too_slow: 3,
     verify_each_failed: 3, toolchain_mismatch: 3, sandbox_unresponsive: 3, oom_within_tier: 3,
     disk_full_within_tier: 3, sandbox_interrupted: 3, integrity_mismatch: 3, egress_unavailable: 3,

package/dist/cjs/handles.js

@@ -114,9 +114,10 @@ class CommandHandle {
             stderr: this.stderr,
             truncated: Boolean(this.record.truncated),
             execId: this.pid,
+            timedOut: (0, command_errors_js_1.exitTimedOut)(this.record.exit, this.opts.timeoutMs),
         };
         if (result.exitCode !== 0) {
-            if ((0, command_errors_js_1.exitTimedOut)(this.record.exit, this.opts.timeoutMs))
+            if (result.timedOut)
                 throw new command_errors_js_1.CommandTimeoutError(result, this.opts.timeoutMs);
             throw new core_js_1.CommandExitError(result);
         }

package/dist/cjs/http2.d.ts

@@ -197,10 +197,18 @@ export declare const __http2Internals: {
         gapUs: number;
         pace: string;
     };
+    /** The offset that turns the thread's stamps into trace times (`clockOffset`), read from the two clocks given. */
+    clockOffset(hr: () => number, now: () => number): number;
     /** Tests: make the transport thread stop answering (it reads nothing more), as a stuck one would. */
     wedgeThreadForTest(): void;
     /** Tests: make the transport thread fail as a crash would. */
     crashThreadForTest(): void;
+    /**
+     * Tests: the transport thread gives no spaced request its turn until `releaseTurnsForTest`. Both go as messages, in order
+     * with the requests and their cancels, so what is sent between them reaches the thread while every spaced request waits.
+     */
+    holdTurnsForTest(): void;
+    releaseTurnsForTest(): void;
     /** The early lookup, for tests: start one with a platform, DNS servers and hosts file of the test's own. */
     early: {
         start(host: string): boolean;

package/dist/cjs/http2.js

@@ -41,6 +41,7 @@ const FETCH_AT_LOAD = globalThis.fetch;
 const PROXY_VARS = ["HTTPS_PROXY", "https_proxy", "HTTP_PROXY", "http_proxy", "ALL_PROXY", "all_proxy"];
 const OFF = new Set(["0", "false", "off", "no"]);
 const NOT_IN_H2 = new Set(["connection", "keep-alive", "proxy-connection", "transfer-encoding", "upgrade", "host", "te"]);
+const ACCEPT_ENCODING = "br, gzip";
 function http2Allowed(opt, env = process.env) {
     try {
         const envFlag = env["PROMIGENCE_HTTP2"]?.trim().toLowerCase();
@@ -1100,6 +1101,8 @@ function exchange(pool, entry, target, init, deadline) {
             if (!NOT_IN_H2.has(name))
                 headers[name] = init.headers[k];
         }
+        if (headers["accept-encoding"] === undefined)
+            headers["accept-encoding"] = ACCEPT_ENCODING;
         headers[http2.sensitiveHeaders] = ["authorization"];
         const body = init.body === undefined ? undefined : Buffer.from(init.body, "utf8");
         if (body !== undefined)
@@ -1351,6 +1354,12 @@ const THREAD_GRACE_MS = 1_000;
 const THREAD_SWEEP_MS = 250;
 const THREAD_MARKS = 4096;
 const THREAD_PHASES = ["w.got", "w.sent", "w.head", "w.end"];
+function clockOffset(hr = () => Number(process.hrtime.bigint()) / 1e6, now = () => performance.now(), n = 5) {
+    let best = -Infinity;
+    for (let i = 0; i < n; i++)
+        best = Math.max(best, hr() - now());
+    return best;
+}
 class TransportThread {
     origin;
     worker;
@@ -1376,7 +1385,7 @@ class TransportThread {
     posts = 0;
     answered = 0;
     pace = THREAD_DEFAULTS.pace;
-    hrOffset = Number(process.hrtime.bigint()) / 1e6 - performance.now();
+    hrOffset = clockOffset();
     constructor(origin, worker, port, acks) {
         this.origin = origin;
         this.worker = worker;
@@ -1657,6 +1666,8 @@ class TransportThread {
             if (!NOT_IN_H2.has(name))
                 headers[name] = init.headers[k];
         }
+        if (headers["accept-encoding"] === undefined)
+            headers["accept-encoding"] = ACCEPT_ENCODING;
         if (init.body !== undefined)
             headers["content-length"] = Buffer.byteLength(init.body, "utf8");
         const id = this.nextId++;
@@ -2066,6 +2077,9 @@ exports.__http2Internals = {
     threadKnobs(env) {
         return threadKnobs(env);
     },
+    clockOffset(hr, now) {
+        return clockOffset(hr, now);
+    },
     wedgeThreadForTest() {
         try {
             transportThread?.port.postMessage({ t: "wedge-for-test" });
@@ -2078,6 +2092,18 @@ exports.__http2Internals = {
         }
         catch { }
     },
+    holdTurnsForTest() {
+        try {
+            transportThread?.port.postMessage({ t: "hold-turns-for-test" });
+        }
+        catch { }
+    },
+    releaseTurnsForTest() {
+        try {
+            transportThread?.port.postMessage({ t: "release-turns-for-test" });
+        }
+        catch { }
+    },
     early: {
         start(host) {
             return earlyLookupFor(host.toLowerCase()) !== undefined;