@qvac/harness 0.3.1 → 0.3.3

package/dist/prebuilds-manifest.json

@@ -272,6 +272,14 @@
       "win32-arm64",
       "win32-x64"
     ],
+    "bare-tty/node_modules/bare-signals": [
+      "darwin-arm64",
+      "darwin-x64",
+      "linux-arm64",
+      "linux-x64",
+      "win32-arm64",
+      "win32-x64"
+    ],
     "bare-tty": [
       "darwin-arm64",
       "darwin-x64",

package/dist-lib/lib/capabilities/completion.d.ts

@@ -142,6 +142,7 @@ export interface ToolExecuteContext {
     uncappedResponse?: boolean | undefined;
     sandboxMode?: boolean | undefined;
     toolNames?: readonly string[] | undefined;
+    approval?: ToolDecision | undefined;
 }
 export interface RunBackendUse {
     tool: string;
@@ -181,7 +182,7 @@ export interface ToolDefinition {
     toolset: Toolset | null;
     validate?: (args: Record<string, unknown>, ctx?: ToolExecuteContext) => string | null;
     effect: (args: Record<string, unknown>, ctx?: ToolExecuteContext) => ToolEffect;
-    resource?: (args: Record<string, unknown>) => ResourceDescriptor | null;
+    resource?: (args: Record<string, unknown>, ctx?: ToolExecuteContext) => ResourceDescriptor | null;
     compiled?: true;
     execute: (args: Record<string, unknown>, ctx?: ToolExecuteContext) => Promise<unknown>;
 }

package/dist-lib/lib/capabilities/completion.js

@@ -29,7 +29,6 @@ import { NETWORK_TOOLSETS, permittedTools } from '../tools/toolsets.js';
 import { promptPrefixHash } from './prompt-prefix.js';
 import { logToolPrompt } from './tool-prompt-log.js';
 import { DIRECT_CALL_ID, loadedSkillFilesFrom, loadedSkillsFrom, TOOL_CONTINUATION_NUDGE, toolResultTurn, withoutSkillLoadTurns } from './tool-turns.js';
-import { projectVisionHistory, visionHistoryCacheKey } from './vision-history.js';
 export function imageSettingsFrom(agent) {
     if (!agent)
         return undefined;
@@ -273,7 +272,7 @@ async function executeCall(tool, args, ctx, { approve, signal, denied, sources =
             type: 'tool-activity',
             name: tool.name,
             args,
-            resource: tool.resource?.(args) ?? null,
+            resource: tool.resource?.(args, ctx) ?? null,
             effect: tool.effect(args, ctx),
             decision: 'blocked'
         });
@@ -285,7 +284,7 @@ async function executeCall(tool, args, ctx, { approve, signal, denied, sources =
         return deniedCall();
     }
     const effect = classified ?? tool.effect(args, ctx);
-    const resource = tool.resource?.(args) ?? null;
+    const resource = tool.resource?.(args, ctx) ?? null;
     const autoRun = effect === 'read' || tool.autoApprove === true || skipApprovals === true;
     hlog('tool decision', {
         tool: tool.name,
@@ -327,7 +326,7 @@ async function executeCall(tool, args, ctx, { approve, signal, denied, sources =
     let output;
     let outcome = { kind: 'success' };
     try {
-        output = await tool.execute(args, { ...ctx, signal });
+        output = await tool.execute(args, { ...ctx, signal, approval: decision });
         hlog('tool done', { tool: tool.name });
     }
     catch (err) {
@@ -545,7 +544,7 @@ async function* runRecoveredRoundWith(sdk, args, modelId) {
         const cacheable = candidate.history === args.history;
         const params = {
             modelId,
-            history: projectVisionHistory(candidate.history),
+            history: candidate.history,
             stream: true,
             tools: args.tools,
             generationParams: args.generationParams,
@@ -798,7 +797,7 @@ export async function* completion(sdk, { modelId, acquireRound, model, agent, ct
         }
         logSelection();
         let history = annotateLastUserTime(systemContent ? [{ role: 'system', content: systemContent }, ...turns] : turns);
-        let roundCacheKey = stubDropped ? undefined : visionHistoryCacheKey(cacheKey, history);
+        let roundCacheKey = stubDropped ? undefined : cacheKey;
         const runUsage = () => usageBreakdown(promptParts, stats.cacheTokens, model);
         const denied = new Set();
         const failed = new Map();

package/dist-lib/lib/tools/exec/adapters/adapter.d.ts

@@ -1,5 +1,5 @@
 import type { AbortSignal as BareAbortSignal } from 'bare-abort-controller';
-import type { AttachFn, FetchAttachmentFn, RunBudget } from '../../../capabilities/completion.ts';
+import type { AttachFn, FetchAttachmentFn, RunBudget, ToolDecision } from '../../../capabilities/completion.ts';
 import type { ExecResult } from '../runner.ts';
 export type ExecutionOptions = {
     readonly cwd?: string;
@@ -17,6 +17,8 @@ export type ExecutionContext = {
     readonly runBudget?: RunBudget;
     readonly sandboxMode?: boolean;
     readonly toolNames?: readonly string[];
+    readonly approval?: ToolDecision;
+    readonly confirmConnect?: (host: string) => Promise<boolean>;
 };
 export type ExecutionPlan = {
     run(options: ExecutionOptions): Promise<ExecResult> | ExecResult;

package/dist-lib/lib/tools/exec/adapters/python/guarded-fetch.d.ts

@@ -3,6 +3,11 @@ import type { NoRedirectFetchInit, NoRedirectFetchResponse } from '../../../../n
 export declare const MAX_RESPONSE_BYTES: number;
 type NoRedirectFetch = (url: URL, init?: NoRedirectFetchInit) => Promise<NoRedirectFetchResponse>;
 declare const GUARDED: unique symbol;
+export type ConnectPolicy = {
+    readonly named: readonly string[];
+    readonly ask: (host: string) => Promise<boolean>;
+};
+export declare function setConnectPolicy(next: ConnectPolicy | null): void;
 export declare function isGuardedFetch(fetch: unknown): boolean;
 type SignalLike = {
     readonly aborted: boolean;

package/dist-lib/lib/tools/exec/adapters/python/guarded-fetch.js

@@ -2,12 +2,27 @@ import { AbortController } from 'bare-abort-controller';
 import b4a from 'b4a';
 import defaultFetch from '#no-redirect-fetch';
 import { lookupHost } from '../../../../dns-lookup.js';
-import { resolveOutboundUrl } from '../../../url-guard.js';
+import { hostIsNamed } from './named-hosts.js';
+import { checkOutboundHost, resolveOutboundUrl } from '../../../url-guard.js';
 export const MAX_RESPONSE_BYTES = 100 * 1024 * 1024;
 const MAX_REDIRECTS = 10;
 const TIMEOUT_MS = 120_000;
 const CHUNK_BYTES = 1024 * 1024;
 const GUARDED = Symbol.for('qvac.harness.guardedFetch');
+let policy = null;
+const granted = new Set();
+export function setConnectPolicy(next) {
+    policy = next;
+    granted.clear();
+}
+async function mayConnect(host) {
+    if (!policy || granted.has(host) || hostIsNamed(host, policy.named))
+        return true;
+    const allowed = await policy.ask(host);
+    if (allowed)
+        granted.add(host);
+    return allowed;
+}
 export function isGuardedFetch(fetch) {
     return typeof fetch === 'function' && fetch[GUARDED] === true;
 }
@@ -154,6 +169,12 @@ export function createGuardedFetch(options = {}) {
                 if (url.protocol !== 'http:' && url.protocol !== 'https:') {
                     throw new TypeError(`fetch refused: unsupported protocol ${url.protocol}`);
                 }
+                const literal = checkOutboundHost(url);
+                if (literal)
+                    throw new TypeError(`fetch refused: ${literal}`);
+                if (!(await mayConnect(url.hostname))) {
+                    throw new TypeError(`fetch refused: ${url.hostname} was not approved for this run`);
+                }
                 const check = await resolveOutboundUrl(url, resolveHost, controller.signal);
                 if (check.blocked)
                     throw new TypeError(`fetch refused: ${check.blocked}`);
@@ -192,5 +213,10 @@ export function createGuardedFetch(options = {}) {
             clearTimeout(timer);
         }
     };
-    return Object.assign(guardedFetch, { [GUARDED]: true });
+    const fetch = (input, init) => {
+        const response = guardedFetch(input, init);
+        response.catch(() => { });
+        return response;
+    };
+    return Object.assign(fetch, { [GUARDED]: true });
 }

package/dist-lib/lib/tools/exec/adapters/python/interrupt-timer.d.ts

@@ -0,0 +1,5 @@
+export type InterruptTimer = {
+    readonly interrupt: Uint8Array;
+    disarm(): boolean;
+};
+export declare function startInterruptTimer(ms: number): InterruptTimer;

package/dist-lib/lib/tools/exec/adapters/python/interrupt-timer.js

@@ -0,0 +1,29 @@
+import { spawnInlineThread } from '#pyodide-worker-spawn';
+const ARMED = 0;
+const DISARMED = 1;
+const FIRED = 2;
+const SIGINT = 2;
+const RESEND_MS = 100;
+const SOURCE = `
+const state = new Int32Array(data.state)
+const interrupt = new Uint8Array(data.interrupt)
+Atomics.wait(state, 0, ${ARMED}, data.ms)
+if (Atomics.compareExchange(state, 0, ${ARMED}, ${FIRED}) === ${ARMED}) {
+  do Atomics.store(interrupt, 0, ${SIGINT})
+  while (Atomics.wait(state, 0, ${FIRED}, ${RESEND_MS}) === 'timed-out')
+}
+`;
+export function startInterruptTimer(ms) {
+    const state = new Int32Array(new SharedArrayBuffer(4));
+    const interrupt = new Uint8Array(new SharedArrayBuffer(1));
+    const reap = spawnInlineThread(SOURCE, { state: state.buffer, interrupt: interrupt.buffer, ms });
+    return {
+        interrupt,
+        disarm() {
+            const fired = Atomics.exchange(state, 0, DISARMED) === FIRED;
+            Atomics.notify(state, 0);
+            reap();
+            return fired;
+        }
+    };
+}

package/dist-lib/lib/tools/exec/adapters/python/named-hosts.d.ts

@@ -0,0 +1,2 @@
+export declare function namedHosts(source: string): string[];
+export declare function hostIsNamed(host: string, named: readonly string[]): boolean;

package/dist-lib/lib/tools/exec/adapters/python/named-hosts.js

@@ -0,0 +1,15 @@
+const URL_LITERAL = /https?:\/\/[^\s'"`\\<>(){}[\]]+/gi;
+export function namedHosts(source) {
+    const hosts = new Set();
+    for (const [match] of source.matchAll(URL_LITERAL)) {
+        try {
+            hosts.add(new URL(match).hostname.toLowerCase());
+        }
+        catch { }
+    }
+    return [...hosts];
+}
+export function hostIsNamed(host, named) {
+    const bare = (value) => value.toLowerCase().replace(/^www\./, '');
+    return named.some((name) => bare(name) === bare(host));
+}

package/dist-lib/lib/tools/exec/adapters/python/pyodide.d.ts

@@ -1,4 +1,4 @@
-import type { AbortSignal as BareAbortSignal } from 'bare-abort-controller';
+import { type AbortSignal as BareAbortSignal } from 'bare-abort-controller';
 import { pyodideLoadOptions } from './loader.ts';
 import { type LoadPyodideFn, type PyodideLike, type PythonRunResult } from './run-session.ts';
 export { pyodideLoadOptions };
@@ -16,5 +16,7 @@ export type RunPythonOptions = {
     readonly workdir?: string;
     readonly loadPyodide?: LoadPyodideFn;
     readonly network?: boolean;
+    readonly hosts?: readonly string[];
+    readonly askConnect?: (host: string) => Promise<boolean>;
 };
 export declare function runPython(code: string, options?: RunPythonOptions): Promise<PythonRunResult>;

package/dist-lib/lib/tools/exec/adapters/python/pyodide.js

@@ -1,8 +1,10 @@
+import { AbortController } from 'bare-abort-controller';
 import process from 'process';
 import ScopeLock from 'scope-lock';
 import { AbortedError, raceAbort } from '../../../../helpers/race-abort.js';
 import { hlog } from '../../../../log.js';
 import { MAX_OUTPUT_CHARS } from '../../runner.js';
+import { startInterruptTimer } from './interrupt-timer.js';
 import { defaultLoad, pyodideLoadOptions } from './loader.js';
 import { isPyodideFatal, performRun } from './run-session.js';
 import { runPythonInWorker } from './worker/client.js';
@@ -32,7 +34,11 @@ function getPyodide(load) {
 }
 const runLock = new ScopeLock();
 async function runInProcess(load, spec, options) {
+    const deadline = Date.now() + options.timeoutMs;
+    const timeoutMessage = `Command timed out after ${options.timeoutMs}ms`;
     let timedOut = false;
+    const stop = new AbortController();
+    const ask = options.askConnect;
     const run = (async () => {
         await runLock.lock();
         try {
@@ -40,12 +46,26 @@ async function runInProcess(load, spec, options) {
             if (isCancelled())
                 throw new AbortedError();
             const py = await getPyodide(load);
-            const { result, evict } = await performRun(py, spec, { isCancelled });
-            if (evict) {
+            const timer = startInterruptTimer(Math.max(0, deadline - Date.now()));
+            py.setInterruptBuffer(timer.interrupt);
+            let outcome;
+            try {
+                outcome = await performRun(py, spec, {
+                    isCancelled,
+                    askConnect: ask && ((host) => raceAbort(ask(host), stop.signal).catch(() => false))
+                });
+            }
+            finally {
+                if (timer.disarm())
+                    timedOut = true;
+            }
+            if (outcome.evict) {
                 cache.delete(load);
                 hlog('python: interpreter evicted; next run boots fresh');
             }
-            return result;
+            if (timedOut)
+                throw new Error(timeoutMessage);
+            return outcome.result;
         }
         catch (error) {
             if (isPyodideFatal(error))
@@ -60,7 +80,7 @@ async function runInProcess(load, spec, options) {
     const timeout = new Promise((_, reject) => {
         timer = setTimeout(() => {
             timedOut = true;
-            reject(new Error(`Command timed out after ${options.timeoutMs}ms`));
+            reject(new Error(timeoutMessage));
         }, options.timeoutMs);
     });
     try {
@@ -69,6 +89,7 @@ async function runInProcess(load, spec, options) {
     finally {
         if (timer)
             clearTimeout(timer);
+        stop.abort(undefined);
     }
 }
 function workerAvailable() {
@@ -89,20 +110,33 @@ export async function runPython(code, options = {}) {
         workdir: options.workdir,
         maxOutputChars: options.maxOutputChars ?? MAX_OUTPUT_CHARS,
         network: options.network === true,
+        hosts: options.hosts,
         installTimeoutMs: timeoutMs
     };
     if (options.loadPyodide) {
-        return runInProcess(options.loadPyodide, spec, { timeoutMs, signal: options.signal });
+        return runInProcess(options.loadPyodide, spec, {
+            timeoutMs,
+            signal: options.signal,
+            askConnect: options.askConnect
+        });
     }
     if (!workerAvailable()) {
         hlog('python: worker entry unavailable in this bundle; running in-process');
-        return runInProcess(defaultLoad, spec, { timeoutMs, signal: options.signal });
+        return runInProcess(defaultLoad, spec, {
+            timeoutMs,
+            signal: options.signal,
+            askConnect: options.askConnect
+        });
     }
     await runLock.lock();
     try {
         if (options.signal?.aborted)
             throw new AbortedError();
-        return await runPythonInWorker(spec, { timeoutMs, signal: options.signal });
+        return await runPythonInWorker(spec, {
+            timeoutMs,
+            signal: options.signal,
+            askConnect: options.askConnect
+        });
     }
     finally {
         runLock.unlock();

package/dist-lib/lib/tools/exec/adapters/python/python-adapter.js

@@ -4,6 +4,7 @@ import { checkFileName, checkOutputName, MAX_INPUTS, MAX_OUTPUTS } from './outpu
 import { runPython } from './pyodide.js';
 import { isTranscoder, TRANSCODE_ERROR, VIDEO_TOOLS_ERROR, videoTool } from '../../video-tools.js';
 import { moduleDistribution } from './distributions.js';
+import { namedHosts } from './named-hosts.js';
 import { normalizeDistribution, planVendoredInstall, vendoredSpec } from './wheels.js';
 export function isPythonLanguage(language) {
     return typeof language === 'string' && language.trim().toLowerCase() === 'python';
@@ -1063,7 +1064,7 @@ async function collect(result, declared, attach, runBudget, source) {
             }
         }
     }
-    const { attachments, missingOutputs, rejectedOutputs } = await attachOutputs(attach, result.files ?? new Map(), declared, runBudget);
+    const { attachments, missingOutputs, rejectedOutputs } = await attachOutputs(attach, (result.exitCode === 0 && result.files) || new Map(), declared, runBudget);
     const rejected = [...(result.rejected ?? []), ...rejectedOutputs];
     const stop = deckDeliveredStop(attachments, result.exitCode, source);
     if (stop && result.exitCode === 0) {
@@ -1098,7 +1099,10 @@ export function createPythonAdapter(disabled, loadPyodide, network = false) {
             const runBudget = ctx?.runBudget;
             const sandbox = ctx?.sandboxMode === true;
             const toolNames = ctx?.toolNames;
-            const reach = network && !sandbox;
+            const approved = ctx?.approval === 'allowed' || ctx?.approval === 'skip-all';
+            const reach = network && !sandbox && approved;
+            const gated = reach && ctx?.approval === 'allowed';
+            const confirmConnect = ctx?.confirmConnect;
             return {
                 async run(options) {
                     if (!command)
@@ -1153,7 +1157,9 @@ export function createPythonAdapter(disabled, loadPyodide, network = false) {
                         outputs: prepared.outputs,
                         workdir: prepared.workdir,
                         loadPyodide,
-                        network: reach
+                        network: reach,
+                        hosts: gated ? namedHosts(source) : undefined,
+                        askConnect: gated ? confirmConnect : undefined
                     });
                     const soft = softFailedDeckHint(result.stdout, result.exitCode, source);
                     if (soft)

package/dist-lib/lib/tools/exec/adapters/python/run-session.d.ts

@@ -65,6 +65,7 @@ export type RunSpec = {
     readonly maxOutputChars: number;
     readonly installTimeoutMs: number;
     readonly network?: boolean | undefined;
+    readonly hosts?: readonly string[] | undefined;
 };
 export type RunOutcome = {
     readonly result: PythonRunResult;
@@ -75,4 +76,5 @@ export declare function isPyodideFatal(error: unknown): boolean;
 export declare function repairDoubleEscapedSource(code: string, message: string): string | null;
 export declare function performRun(py: PyodideLike, spec: RunSpec, opts?: {
     readonly isCancelled?: () => boolean;
+    readonly askConnect?: ((host: string) => Promise<boolean>) | undefined;
 }): Promise<RunOutcome>;

package/dist-lib/lib/tools/exec/adapters/python/run-session.js

@@ -2,7 +2,7 @@ import { AbortedError } from '../../../../helpers/race-abort.js';
 import { hlog } from '../../../../log.js';
 import { TRUNCATED_OUTPUT_SUFFIX } from '../../runner.js';
 import { collectOutputs, openScratch, stageInputFiles } from './memfs.js';
-import { isGuardedFetch } from './guarded-fetch.js';
+import { isGuardedFetch, setConnectPolicy } from './guarded-fetch.js';
 import { NET_SHIM, pythonReachesNetwork } from './net-shim.js';
 import { planVendoredInstall, stageVendoredWheels } from './wheels.js';
 export function cap(text, limit) {
@@ -40,9 +40,9 @@ export function repairDoubleEscapedSource(code, message) {
     return repaired === code ? null : repaired;
 }
 const promisingEval = new WeakMap();
-async function enter(py, code, network) {
+async function enter(py, code, access) {
     const guarded = pythonReachesNetwork() && isGuardedFetch(globalThis.fetch);
-    if (!network || !guarded || py.ffi === undefined || py.pyimport === undefined) {
+    if (!access || !guarded || py.ffi === undefined || py.pyimport === undefined) {
         py.runPython(code);
         return;
     }
@@ -52,11 +52,17 @@ async function enter(py, code, network) {
         evalCode = py.pyimport('pyodide.code').eval_code;
         promisingEval.set(py, evalCode);
     }
-    await evalCode.callPromising(code, py.globals);
+    setConnectPolicy(access.policy);
+    try {
+        await evalCode.callPromising(code, py.globals);
+    }
+    finally {
+        setConnectPolicy(null);
+    }
 }
-async function attempt(py, code, output, maxOutputChars, network) {
+async function attempt(py, code, output, maxOutputChars, access) {
     try {
-        await enter(py, code, network);
+        await enter(py, code, access);
         return {
             result: {
                 stdout: cap(output.stdout, maxOutputChars),
@@ -80,14 +86,14 @@ async function attempt(py, code, output, maxOutputChars, network) {
         };
     }
 }
-async function runOnce(py, code, output, maxOutputChars, network) {
-    const first = await attempt(py, code, output, maxOutputChars, network);
+async function runOnce(py, code, output, maxOutputChars, access) {
+    const first = await attempt(py, code, output, maxOutputChars, access);
     if (first.error === null)
         return first;
     const repaired = repairDoubleEscapedSource(code, first.error);
     if (repaired === null)
         return first;
-    const retry = await attempt(py, repaired, output, maxOutputChars, network);
+    const retry = await attempt(py, repaired, output, maxOutputChars, access);
     if (retry.error !== null && retry.error.includes('SyntaxError'))
         return first;
     return retry;
@@ -213,6 +219,8 @@ function fitDecks(py, outputs) {
 }
 export async function performRun(py, spec, opts = {}) {
     const isCancelled = opts.isCancelled ?? (() => false);
+    const ask = opts.askConnect ?? (async () => false);
+    const access = spec.network === true ? { policy: spec.hosts ? { named: spec.hosts, ask } : null } : null;
     const output = { stdout: '', stderr: '' };
     py.setStdout({ batched: (chunk) => (output.stdout += chunk + '\n') });
     py.setStderr({ batched: (chunk) => (output.stderr += chunk + '\n') });
@@ -251,7 +259,7 @@ export async function performRun(py, spec, opts = {}) {
     if (!spec.inputs?.length && !spec.outputs?.length && !spec.workdir) {
         const cwd = py.FS.cwd();
         const before = listFiles(py, cwd);
-        const { result, fatal } = await runOnce(py, spec.code, output, spec.maxOutputChars, spec.network === true);
+        const { result, fatal } = await runOnce(py, spec.code, output, spec.maxOutputChars, access);
         if (result.exitCode !== 0)
             return { result, evict: fatal };
         const undeclared = newDeliverables(before, listFiles(py, cwd));
@@ -262,7 +270,7 @@ export async function performRun(py, spec, opts = {}) {
         py.FS.chdir(scratch.cwd);
         stageInputFiles(py.FS, scratch.cwd, spec.inputs ?? []);
         const before = listFiles(py, scratch.cwd);
-        const { result, fatal } = await runOnce(py, spec.code, output, spec.maxOutputChars, spec.network === true);
+        const { result, fatal } = await runOnce(py, spec.code, output, spec.maxOutputChars, access);
         let evict = fatal;
         if (result.exitCode === 0)
             evict = fitDecks(py, spec.outputs ?? []);

package/dist-lib/lib/tools/exec/adapters/python/worker/client.d.ts

@@ -1,7 +1,8 @@
-import type { AbortSignal as BareAbortSignal } from 'bare-abort-controller';
+import { type AbortSignal as BareAbortSignal } from 'bare-abort-controller';
 import type { PythonRunResult, RunSpec } from '../run-session.ts';
 export declare function runPythonInWorker(spec: RunSpec, opts: {
     readonly timeoutMs: number;
     readonly signal?: BareAbortSignal | undefined;
+    readonly askConnect?: ((host: string) => Promise<boolean>) | undefined;
 }): Promise<PythonRunResult>;
 export declare function closePythonWorker(): Promise<void>;

package/dist-lib/lib/tools/exec/adapters/python/worker/client.js

@@ -1,10 +1,12 @@
 import { spawnPythonWorker } from '#pyodide-worker-spawn';
+import { AbortController } from 'bare-abort-controller';
 import process from 'process';
 import { fileURLToPath } from 'url';
 import { AbortedError, raceAbort } from '../../../../../helpers/race-abort.js';
 import { harnessLogEnabled, hlog } from '../../../../../log.js';
 import { asWorkerMessage, fromWireResult } from './protocol.js';
 const SIGINT = 2;
+const RESEND_MS = 100;
 function interruptGraceMs() {
     const ms = Number(process.env.QVAC_PYODIDE_INTERRUPT_GRACE_MS);
     return ms > 0 ? ms : 30_000;
@@ -69,8 +71,13 @@ async function drainAndReap(worker) {
         timer.clear();
     }
 }
-async function resultFor(worker, id) {
-    const message = await readMessage(worker.link);
+async function resultFor(worker, id, askConnect) {
+    let message = await readMessage(worker.link);
+    while (message?.type === 'connect-ask') {
+        const allowed = askConnect ? await askConnect(message.host).catch(() => false) : false;
+        await worker.link.write({ type: 'connect-answer', allowed });
+        message = await readMessage(worker.link);
+    }
     if (message?.type === 'result') {
         if (message.id !== id)
             throw new Error('python worker answered a different run');
@@ -89,6 +96,7 @@ function grace(ms) {
 }
 async function interrupt(worker, outcome) {
     Atomics.store(worker.view, 0, SIGINT);
+    const resend = setInterval(() => Atomics.store(worker.view, 0, SIGINT), RESEND_MS);
     const graceMs = interruptGraceMs();
     const timer = grace(graceMs);
     try {
@@ -105,6 +113,7 @@ async function interrupt(worker, outcome) {
         }
     }
     finally {
+        clearInterval(resend);
         timer.clear();
     }
 }
@@ -116,13 +125,15 @@ export async function runPythonInWorker(spec, opts) {
         Atomics.store(worker.view, 0, 0);
         let cancelled = false;
         let sent = false;
+        const stop = new AbortController();
+        const ask = opts.askConnect;
         const outcome = (async () => {
             await worker.ready;
             if (cancelled)
                 throw new AbortedError();
             sent = true;
             await worker.link.write({ type: 'run', id, spec });
-            return resultFor(worker, id);
+            return resultFor(worker, id, ask && ((host) => raceAbort(ask(host), stop.signal)));
         })();
         let timer;
         const timeout = new Promise((resolve) => {
@@ -135,6 +146,7 @@ export async function runPythonInWorker(spec, opts) {
         catch (error) {
             if (error instanceof AbortedError) {
                 cancelled = true;
+                stop.abort(undefined);
                 if (sent)
                     await interrupt(worker, outcome);
                 else
@@ -150,6 +162,7 @@ export async function runPythonInWorker(spec, opts) {
         }
         if (first === 'timeout') {
             cancelled = true;
+            stop.abort(undefined);
             if (sent)
                 await interrupt(worker, outcome);
             else

package/dist-lib/lib/tools/exec/adapters/python/worker/entry.js

@@ -90,9 +90,22 @@ try {
         const message = asHostMessage(await port.read());
         if (!message || message.type === 'close')
             break;
-        const { result, evict } = await performRun(py, message.spec);
+        if (message.type === 'connect-answer')
+            continue;
+        let closing = false;
+        const askConnect = async (host) => {
+            if (closing)
+                return false;
+            port.write({ type: 'connect-ask', host });
+            const answer = asHostMessage(await port.read());
+            if (answer?.type === 'connect-answer')
+                return answer.allowed;
+            closing = true;
+            return false;
+        };
+        const { result, evict } = await performRun(py, message.spec, { askConnect });
         port.write({ type: 'result', id: message.id, result: toWireResult(result), evict });
-        if (evict)
+        if (evict || closing)
             break;
     }
 }

package/dist-lib/lib/tools/exec/adapters/python/worker/protocol.d.ts

@@ -5,6 +5,9 @@ export type HostMessage = {
     readonly spec: RunSpec;
 } | {
     readonly type: 'close';
+} | {
+    readonly type: 'connect-answer';
+    readonly allowed: boolean;
 };
 export type WireResult = {
     readonly stdout: string;
@@ -31,6 +34,9 @@ export type WorkerMessage = {
     readonly id: number;
     readonly result: WireResult;
     readonly evict: boolean;
+} | {
+    readonly type: 'connect-ask';
+    readonly host: string;
 };
 export declare function toWireResult(result: PythonRunResult): WireResult;
 export declare function fromWireResult(wire: WireResult): PythonRunResult;

package/dist-lib/lib/tools/exec/adapters/python/worker/protocol.js

@@ -28,13 +28,17 @@ function messageType(value) {
 }
 export function asHostMessage(value) {
     const type = messageType(value);
-    if (type === 'run' || type === 'close')
+    if (type === 'run' || type === 'close' || type === 'connect-answer')
         return value;
     return null;
 }
 export function asWorkerMessage(value) {
     const type = messageType(value);
-    if (type === 'log' || type === 'ready' || type === 'boot-error' || type === 'result') {
+    if (type === 'log' ||
+        type === 'ready' ||
+        type === 'boot-error' ||
+        type === 'result' ||
+        type === 'connect-ask') {
         return value;
     }
     return null;

package/dist-lib/lib/tools/exec/adapters/python/worker/spawn-bare.d.ts

@@ -1,2 +1,3 @@
 import type { WorkerData, WorkerLink } from './spawn-node.ts';
+export declare function spawnInlineThread(source: string, data: object): () => void;
 export declare function spawnPythonWorker(entry: string, data: WorkerData): WorkerLink;