@rallycry/conveyor-k3 0.1.3

package/dist/vm-qemu.js

@@ -0,0 +1,1182 @@
+#!/usr/bin/env node
+
+// src/vm-qemu.ts
+import { readFileSync as readFileSync4 } from "fs";
+import { spawn as spawn3 } from "child_process";
+import { dirname, join as join5 } from "path";
+import { fileURLToPath } from "url";
+import { createHash } from "crypto";
+
+// src/vm/network.ts
+import { networkInterfaces } from "os";
+import { resolve4 as systemResolve4, resolveSrv as systemResolveSrv } from "dns/promises";
+var WORKER_SUBNET = "192.168.5.0/24";
+var WORKER_IP = "192.168.5.15";
+var MAX_NETWORK_FORWARDS = 100;
+function parseIPv4(address) {
+  const parts = address.split(".");
+  if (parts.length !== 4) return null;
+  let value = 0;
+  for (const part of parts) {
+    if (!/^\d{1,3}$/.test(part)) return null;
+    const octet = Number(part);
+    if (octet > 255) return null;
+    value = value << 8 | octet;
+  }
+  return value >>> 0;
+}
+function inCidr(value, base, mask) {
+  return (value & mask) === (base & mask);
+}
+function isGloballyRoutableIPv4(address) {
+  const value = parseIPv4(address);
+  if (value === null) return false;
+  return ![
+    ["0.0.0.0", 4278190080],
+    ["10.0.0.0", 4278190080],
+    ["100.64.0.0", 4290772992],
+    ["127.0.0.0", 4278190080],
+    ["169.254.0.0", 4294901760],
+    ["172.16.0.0", 4293918720],
+    ["192.0.0.0", 4294967040],
+    ["192.0.2.0", 4294967040],
+    ["192.88.99.0", 4294967040],
+    ["192.168.0.0", 4294901760],
+    ["198.18.0.0", 4294836224],
+    ["198.51.100.0", 4294967040],
+    ["203.0.113.0", 4294967040],
+    ["224.0.0.0", 4026531840],
+    ["240.0.0.0", 4026531840]
+  ].some(([base, mask]) => inCidr(value, parseIPv4(base), mask));
+}
+
+// src/vm/qemu-policy.ts
+var ALLOWED_PROBES = new Set(
+  [
+    ["-version"],
+    ["--version"],
+    ["-accel", "help"],
+    ["-M", "none", "-accel", "help"],
+    ["-M", "none", "-netdev", "help"],
+    ["-machine", "help"],
+    ["-cpu", "help", "-machine", "virt"],
+    ["-cpu", "help", "-machine", "q35"]
+  ].map((args) => args.join("\0"))
+);
+var TRUSTED_NC_PATH = /^\/(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+$/;
+var CONTROL_SOCKETS = /* @__PURE__ */ new Map([
+  ["char-serial", "serial.sock"],
+  ["char-serial-pci", "serialp.sock"],
+  ["char-serial-virtio", "serialv.sock"],
+  ["char-qmp", "qmp.sock"]
+]);
+var CONTROL_LOGS = /* @__PURE__ */ new Map([
+  ["char-serial", "serial.log"],
+  ["char-serial-pci", "serialp.log"],
+  ["char-serial-virtio", "serialv.log"]
+]);
+var REQUIRED_DEVICES = [
+  "qemu-xhci",
+  "virtio-blk-pci",
+  "virtio-scsi",
+  "scsi-cd",
+  "virtio-net-pci",
+  "virtio-rng-pci",
+  "virtio-serial-pci",
+  "virtconsole"
+];
+var REQUIRED_CONTROLS = [
+  "memory",
+  "cpu",
+  "smp",
+  "boot",
+  "audio",
+  "-display",
+  "-vga",
+  "-parallel",
+  "serial",
+  "qmp",
+  "name",
+  "pidfile",
+  "drive:firmware",
+  "drive:boot",
+  "drive:cidata"
+];
+var DISALLOWED_CONTROLS = /* @__PURE__ */ new Set(["-sandbox", "-no-user-config", "-nodefaults"]);
+var BOOT_DISK_BPS = "104857600";
+var BOOT_DISK_IOPS = "2000";
+function assertPort(port, field) {
+  if (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error(`Invalid ${field}`);
+}
+function isProbe(args) {
+  return ALLOWED_PROBES.has(args.join("\0"));
+}
+function rejectForbiddenArg(arg) {
+  const lower = arg.toLowerCase();
+  if (lower.includes("virtiofs") || lower.includes("9p") || lower.includes("usb-host") || lower.includes("vfio") || lower.includes("vhost-user") || lower.includes("-fsdev") || lower.includes("-virtfs") || lower.startsWith("-nic") || lower === "-net" || lower.startsWith("-net=") || lower === "-smb" || lower === "-redir") {
+    throw new Error(`QEMU argument is forbidden by worker isolation policy: ${arg}`);
+  }
+}
+function qemuValue(args, index, name) {
+  const value = args[index + 1];
+  if (value === void 0 || value.startsWith("-")) throw new Error(`Missing QEMU ${name} value`);
+  return value;
+}
+function parseCommaFields(value, description) {
+  const parts = value.split(",");
+  const kind = parts.shift();
+  if (!kind) throw new Error(`Malformed ${description}`);
+  const fields = /* @__PURE__ */ new Map();
+  for (const part of parts) {
+    const separator = part.indexOf("=");
+    if (separator < 1) throw new Error(`Malformed ${description} option`);
+    const key = part.slice(0, separator);
+    const fieldValue = part.slice(separator + 1);
+    if (!key || !fieldValue || fields.has(key))
+      throw new Error(`Duplicate or empty ${description} option`);
+    fields.set(key, fieldValue);
+  }
+  return { kind, fields };
+}
+function parseKeyValueFields(value, description) {
+  const fields = /* @__PURE__ */ new Map();
+  for (const part of value.split(",")) {
+    const separator = part.indexOf("=");
+    if (separator < 1) throw new Error(`Malformed ${description} option`);
+    const key = part.slice(0, separator);
+    const fieldValue = part.slice(separator + 1);
+    if (!key || !fieldValue || fields.has(key))
+      throw new Error(`Duplicate or empty ${description} option`);
+    fields.set(key, fieldValue);
+  }
+  return fields;
+}
+function assertFields(fields, expected, description) {
+  if (fields.size !== Object.keys(expected).length)
+    throw new Error(`Unexpected ${description} options`);
+  for (const [key, expectedValue] of Object.entries(expected)) {
+    const value = fields.get(key);
+    if (!value || (typeof expectedValue === "string" ? value !== expectedValue : !expectedValue.test(value))) {
+      throw new Error(`Unexpected ${description} option: ${key}`);
+    }
+  }
+}
+function assertInstancePath(path, filename, context) {
+  if (!path.startsWith("/") || path.includes("\0") || path.split("/").includes("..")) {
+    throw new Error("QEMU path must be an absolute normalized path");
+  }
+  if (context.instanceDir) {
+    const root = context.instanceDir.endsWith("/") ? context.instanceDir.slice(0, -1) : context.instanceDir;
+    if (!root.startsWith("/") || root.includes("\0") || root.split("/").includes("..")) {
+      throw new Error("Invalid Lima instance directory");
+    }
+    if (path !== `${root}/${filename}`) throw new Error(`Unexpected Lima instance path: ${path}`);
+  } else if (path.slice(path.lastIndexOf("/") + 1) !== filename) {
+    throw new Error(`Unexpected Lima instance filename: ${path}`);
+  }
+}
+function validateLimaChardev(value, context) {
+  const { kind, fields } = parseCommaFields(value, "QEMU chardev");
+  if (kind !== "socket")
+    throw new Error("Only Lima Unix control sockets are allowed as QEMU chardevs");
+  const id = fields.get("id");
+  const filename = id ? CONTROL_SOCKETS.get(id) : void 0;
+  if (!id || !filename) throw new Error("Unexpected QEMU chardev socket");
+  const path = fields.get("path");
+  if (!path) throw new Error("Missing QEMU chardev path");
+  assertInstancePath(path, filename, context);
+  const logFilename = CONTROL_LOGS.get(id);
+  if (logFilename) {
+    assertFields(
+      fields,
+      { id, path: /.+/, server: "on", wait: "off", logfile: /.+/ },
+      "QEMU chardev"
+    );
+    const logfile = fields.get("logfile");
+    if (!logfile) throw new Error("Missing QEMU serial logfile");
+    assertInstancePath(logfile, logFilename, context);
+  } else {
+    assertFields(fields, { id, path: /.+/, server: "on", wait: "off" }, "QEMU chardev");
+  }
+  return `socket,id=${id},path=${path},server=on,wait=off`;
+}
+function validateMachine(value) {
+  const { kind, fields } = parseCommaFields(value, "QEMU machine");
+  if (!(/* @__PURE__ */ new Set(["virt", "q35"])).has(kind)) throw new Error("Unexpected QEMU machine type");
+  assertFields(fields, { accel: /^(?:hvf|kvm)$/ }, "QEMU machine");
+  return fields.get("accel");
+}
+function validateDrive(value, context) {
+  const fields = parseKeyValueFields(value, "QEMU drive");
+  const path = fields.get("file");
+  if (!path) throw new Error("QEMU drive is missing a file");
+  if (path.includes(":") || path.includes("//")) throw new Error("Remote QEMU disks are forbidden");
+  if (fields.get("if") === "pflash") {
+    assertFields(
+      fields,
+      { if: "pflash", format: "raw", readonly: "on", file: /.+/ },
+      "firmware drive"
+    );
+    assertInstancePath(path, "qemu-efi-code.fd", context);
+    return { kind: "firmware", value };
+  }
+  if (fields.get("id") === "boot-disk") {
+    for (const dangerousLimit of ["bps", "iops", "bps_rd", "bps_wr", "iops_rd", "iops_wr"]) {
+      if (fields.has(dangerousLimit)) throw new Error("Lima may not choose a boot-disk throttle");
+    }
+    assertFields(fields, { file: /.+/, if: "none", discard: "on", id: "boot-disk" }, "boot drive");
+    assertInstancePath(path, "disk", context);
+    return {
+      kind: "boot",
+      value: `${value},bps=${BOOT_DISK_BPS},iops=${BOOT_DISK_IOPS}`
+    };
+  }
+  if (fields.get("id") === "cdrom0") {
+    assertFields(
+      fields,
+      { id: "cdrom0", if: "none", format: "raw", readonly: "on", file: /.+/ },
+      "cloud-init drive"
+    );
+    assertInstancePath(path, "cidata.iso", context);
+    return { kind: "cidata", value };
+  }
+  throw new Error("Unexpected QEMU drive");
+}
+function validateLimaDevice(value) {
+  const { kind, fields } = parseCommaFields(value, "QEMU device");
+  const options = {
+    "qemu-xhci": { id: "usb-bus" },
+    "virtio-blk-pci": { drive: "boot-disk", bootindex: "1" },
+    "virtio-scsi": { id: "scsi0" },
+    "scsi-cd": { bus: "scsi0.0", drive: "cdrom0" },
+    "virtio-net-pci": { netdev: "net0", mac: /^(?:[0-9a-f]{2}:){5}[0-9a-f]{2}$/i },
+    "virtio-rng-pci": {},
+    "pci-serial": { chardev: "char-serial-pci" },
+    "virtio-serial-pci": { id: "virtio-serial0", max_ports: "1" },
+    virtconsole: { chardev: "char-serial-virtio", id: "console0" }
+  };
+  const expected = options[kind];
+  if (!expected) throw new Error(`Unexpected QEMU device: ${kind}`);
+  assertFields(fields, expected, `QEMU device ${kind}`);
+  return kind;
+}
+function parseOriginalUsernet(value, sshPort) {
+  const { kind, fields } = parseCommaFields(value, "QEMU user network");
+  if (kind !== "user") throw new Error("Expected QEMU user network");
+  assertFields(
+    fields,
+    {
+      id: "net0",
+      net: WORKER_SUBNET,
+      dhcpstart: WORKER_IP,
+      hostfwd: `tcp:127.0.0.1:${sshPort}-:22`
+    },
+    "Lima QEMU user network"
+  );
+}
+function restrictedUsernet(network, forwards, ncPath) {
+  const guestForwards = forwards.map(
+    (forward) => `guestfwd=tcp:${forward.guestIp}:${forward.port}-cmd:${ncPath} -4 -n -w 60 ${forward.address} ${forward.port}`
+  );
+  return [
+    "user",
+    "id=net0",
+    `net=${WORKER_SUBNET}`,
+    `dhcpstart=${WORKER_IP}`,
+    "restrict=on",
+    "ipv6=off",
+    `hostfwd=tcp:127.0.0.1:${network.sshPort}-:22`,
+    ...guestForwards
+  ].join(",");
+}
+function validateForwards(forwards) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const forward of forwards) {
+    assertPort(forward.port, "guest forwarding port");
+    const key = `${forward.guestIp}:${forward.port}`;
+    if (seen.has(key)) throw new Error("Duplicate QEMU guest forwarding rule");
+    seen.add(key);
+    if (!/^192\.168\.5\.(?:1\d\d)$/.test(forward.guestIp) || !isGloballyRoutableIPv4(forward.address) || !/^(?:[1-9]?\d|1\d\d|2[0-4]\d|25[0-5])(?:\.(?:[1-9]?\d|1\d\d|2[0-4]\d|25[0-5])){3}$/.test(
+      forward.address
+    )) {
+      throw new Error("Invalid pinned forwarding address");
+    }
+  }
+}
+function fixedControl(control, expected) {
+  return (value) => {
+    if (value !== expected) throw new Error(`Unexpected QEMU ${control}`);
+    return { value, control };
+  };
+}
+var SIMPLE_VALIDATORS = {
+  "-m": (value) => {
+    if (!/^\d{3,6}$/.test(value) || Number(value) < 512) throw new Error("Invalid QEMU memory");
+    return { value, control: "memory" };
+  },
+  "-cpu": (value) => {
+    if (!/^(?:max|host)$/.test(value)) throw new Error("Unexpected QEMU CPU model");
+    return { value, control: "cpu" };
+  },
+  "-machine": (value) => ({ value, control: `machine:${validateMachine(value)}` }),
+  "-smp": (value) => {
+    if (!/^\d+(?:,sockets=\d+,cores=\d+,threads=\d+)?$/.test(value))
+      throw new Error("Invalid QEMU SMP configuration");
+    return { value, control: "smp" };
+  },
+  "-drive": (value, context) => {
+    const drive = validateDrive(value, context);
+    return { value: drive.value, control: `drive:${drive.kind}` };
+  },
+  "-boot": fixedControl("boot", "order=c,splash-time=0,menu=on"),
+  "-audiodev": fixedControl("audio", "none,id=snd0"),
+  "-display": fixedControl("-display", "none"),
+  "-vga": fixedControl("-vga", "none"),
+  "-parallel": fixedControl("-parallel", "none"),
+  "-serial": fixedControl("serial", "chardev:char-serial"),
+  "-qmp": fixedControl("qmp", "chardev:char-qmp"),
+  "-name": fixedControl("name", "lima-conveyor"),
+  "-pidfile": (value, context) => {
+    assertInstancePath(value, "qemu.pid", context);
+    return { value, control: "pidfile" };
+  },
+  "-accel": (value) => {
+    if (!/^(?:hvf|kvm)$/.test(value)) throw new Error("Software QEMU acceleration is forbidden");
+    return { value, control: `accel:${value}` };
+  }
+};
+function validateSimpleArg(args, index, arg, context) {
+  const validator = SIMPLE_VALIDATORS[arg];
+  if (!validator) throw new Error(`Unsupported QEMU option: ${arg}`);
+  const value = qemuValue(args, index, arg);
+  rejectForbiddenArg(value);
+  return validator(value, context);
+}
+function appendSpecialArgument(args, index, network, forwards, ncPath, context, state, output) {
+  const arg = args[index];
+  if (arg === "-netdev") {
+    const value2 = qemuValue(args, index, "netdev");
+    state.usernetCount += 1;
+    if (state.usernetCount !== 1) throw new Error("Expected exactly one QEMU user network");
+    parseOriginalUsernet(value2, network.sshPort);
+    output.push("-netdev", restrictedUsernet(network, forwards, ncPath));
+    return index + 1;
+  }
+  if (arg === "-chardev") {
+    const value2 = qemuValue(args, index, "chardev");
+    const rewritten = validateLimaChardev(value2, context);
+    const id = parseCommaFields(value2, "QEMU chardev").fields.get("id");
+    if (state.chardevs.has(id)) throw new Error(`Duplicate QEMU chardev: ${id}`);
+    state.chardevs.add(id);
+    output.push(arg, rewritten);
+    return index + 1;
+  }
+  if (arg !== "-device") return void 0;
+  const value = qemuValue(args, index, "device");
+  rejectForbiddenArg(value);
+  const device = validateLimaDevice(value);
+  if (state.devices.has(device)) throw new Error(`Duplicate QEMU device: ${device}`);
+  state.devices.add(device);
+  output.push(arg, value);
+  return index + 1;
+}
+function recordControl(state, control) {
+  if (state.controls.has(control)) throw new Error(`Duplicate QEMU control: ${control}`);
+  state.controls.add(control);
+  if (control.startsWith("machine:")) state.machineAccel = control.slice("machine:".length);
+  if (control.startsWith("accel:")) state.explicitAccel = control.slice("accel:".length);
+}
+function assertCompleteProfile(state) {
+  if (state.usernetCount !== 1) throw new Error("Expected exactly one Lima QEMU user network");
+  if (!state.machineAccel || state.explicitAccel && state.explicitAccel !== state.machineAccel) {
+    throw new Error("QEMU hardware accelerator is missing or conflicts with machine configuration");
+  }
+  for (const control of REQUIRED_CONTROLS) {
+    if (!state.controls.has(control)) throw new Error(`Missing required QEMU control: ${control}`);
+  }
+  for (const device of REQUIRED_DEVICES) {
+    if (!state.devices.has(device)) throw new Error(`Missing required QEMU device: ${device}`);
+  }
+  for (const id of CONTROL_SOCKETS.keys()) {
+    if (id !== "char-serial-pci" && !state.chardevs.has(id)) {
+      throw new Error(`Missing required QEMU chardev: ${id}`);
+    }
+  }
+  if (state.devices.has("pci-serial") !== state.chardevs.has("char-serial-pci")) {
+    throw new Error("QEMU PCI serial device and chardev must appear together");
+  }
+}
+function rewriteQemuArgs(args, network, ncPath = "/usr/bin/nc", context = {}) {
+  if (isProbe(args)) return [...args];
+  assertPort(network.sshPort, "SSH port");
+  if (!TRUSTED_NC_PATH.test(ncPath)) throw new Error("Invalid netcat path");
+  const forwards = network.hosts.flatMap(
+    (host) => host.ports.map((port) => ({ guestIp: host.guestIp, address: host.address, port }))
+  );
+  if (forwards.length > MAX_NETWORK_FORWARDS) throw new Error("Too many QEMU forwarding rules");
+  validateForwards(forwards);
+  const output = [];
+  const state = {
+    controls: /* @__PURE__ */ new Set(),
+    devices: /* @__PURE__ */ new Set(),
+    chardevs: /* @__PURE__ */ new Set(),
+    usernetCount: 0
+  };
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === void 0) throw new Error("Missing QEMU argument");
+    rejectForbiddenArg(arg);
+    if (DISALLOWED_CONTROLS.has(arg))
+      throw new Error(`QEMU hardening flag is launcher-owned: ${arg}`);
+    if (arg.startsWith("-netdev") && arg !== "-netdev")
+      throw new Error("Unexpected QEMU netdev syntax");
+    const consumed = appendSpecialArgument(
+      args,
+      index,
+      network,
+      forwards,
+      ncPath,
+      context,
+      state,
+      output
+    );
+    if (consumed !== void 0) {
+      index = consumed;
+      continue;
+    }
+    const { value, control } = validateSimpleArg(args, index, arg, context);
+    recordControl(state, control);
+    output.push(arg, value);
+    index += 1;
+  }
+  assertCompleteProfile(state);
+  return output;
+}
+
+// src/vm/qemu-process.ts
+import { spawn as spawn2 } from "child_process";
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { join as join4 } from "path";
+
+// src/vm/resource-guard.ts
+import { lstatSync as lstatSync2, statfsSync, writeFileSync as writeFileSync2, renameSync, rmSync as rmSync2 } from "fs";
+import { randomUUID } from "crypto";
+import { execFileSync as execFileSync2 } from "child_process";
+import { join as join2 } from "path";
+
+// src/vm/relay.ts
+import { kill } from "process";
+import { execFileSync } from "child_process";
+import { lstatSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { join } from "path";
+import { Socket } from "net";
+var MAX_RELAYS = 16;
+var MAX_RELAY_BYTES = 1024 * 1024 * 1024;
+var RELAY_LIFETIME_MS = 6e4;
+var RELAY_IDLE_MS = 3e4;
+var GUARD_FRESH_MS = 6e3;
+var RELAY_PREFIX = "--conveyor-vm-relay";
+function validPid(value) {
+  return Number.isInteger(value) && value > 1 && value <= 4194304;
+}
+function validRunId(value) {
+  return typeof value === "string" && /^[a-f0-9-]{36}$/i.test(value);
+}
+function alive(pid) {
+  try {
+    kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function relayDirectory(root) {
+  return join(root, "relays");
+}
+function safeDirectory(path) {
+  mkdirSync(path, { recursive: true, mode: 448 });
+  const stat = lstatSync(path);
+  if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.()) {
+    throw new Error(`Refusing unsafe relay directory: ${path}`);
+  }
+}
+function readLiveGuard(root) {
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(join(root, "guard-state.json"), "utf8"));
+  } catch {
+    throw new Error("VM relay requires a live resource guard");
+  }
+  if (typeof parsed !== "object" || parsed === null)
+    throw new Error("VM relay requires a live resource guard");
+  const guard = parsed;
+  const checkedAt = typeof guard.lastCheckedAt === "string" ? Date.parse(guard.lastCheckedAt) : Number.NaN;
+  if (guard.schema !== 1 || guard.status !== "running" || !validRunId(guard.runId) || !validPid(guard.qemuPid) || !Number.isFinite(checkedAt) || Date.now() - checkedAt > GUARD_FRESH_MS || !alive(guard.qemuPid)) {
+    throw new Error("VM relay requires a fresh running resource guard");
+  }
+  return guard;
+}
+function readNetwork(root) {
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(join(root, "network.json"), "utf8"));
+  } catch {
+    throw new Error("VM relay cannot read the host network policy");
+  }
+  if (typeof parsed !== "object" || parsed === null)
+    throw new Error("VM relay network policy is invalid");
+  const network = parsed;
+  if (!Array.isArray(network.hosts)) throw new Error("VM relay network policy is invalid");
+  return network;
+}
+function assertApprovedDestination(root, invocation) {
+  const allowed = readNetwork(root).hosts.some(
+    (host) => host && host.address === invocation.address && Array.isArray(host.ports) && host.ports.includes(invocation.port)
+  );
+  if (!allowed) throw new Error("VM relay destination is not in the host network policy");
+}
+function recordPath(root, pid) {
+  return join(relayDirectory(root), `${pid}.json`);
+}
+function slotPath(root, slot) {
+  return join(relayDirectory(root), `slot-${slot}`);
+}
+function claimSlot(root) {
+  safeDirectory(relayDirectory(root));
+  for (let slot = 0; slot < MAX_RELAYS; slot += 1) {
+    try {
+      mkdirSync(slotPath(root, slot), { mode: 448 });
+      return slot;
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+    }
+  }
+  throw new Error(`VM relay limit reached (${MAX_RELAYS})`);
+}
+function registerRelay(root, runId) {
+  const slot = claimSlot(root);
+  const record = {
+    schema: 1,
+    pid: process.pid,
+    runId,
+    slot,
+    startedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  try {
+    writeFileSync(join(slotPath(root, slot), "owner.json"), JSON.stringify(record), {
+      mode: 384,
+      flag: "wx"
+    });
+    writeFileSync(recordPath(root, process.pid), JSON.stringify(record), {
+      mode: 384,
+      flag: "wx"
+    });
+    return record;
+  } catch (error) {
+    rmSync(recordPath(root, process.pid), { force: true });
+    rmSync(slotPath(root, slot), { recursive: true, force: true });
+    throw error;
+  }
+}
+function unregisterRelay(root, record) {
+  rmSync(recordPath(root, record.pid), { force: true });
+  rmSync(slotPath(root, record.slot), { recursive: true, force: true });
+}
+function parseRelayInvocation(args) {
+  if (args[0] !== RELAY_PREFIX) return null;
+  if (args.length !== 7 || args[1] !== "-4" || args[2] !== "-n" || args[3] !== "-w" || args[4] !== "60") {
+    throw new Error("Invalid VM relay invocation");
+  }
+  const address = args[5] ?? "";
+  const port = Number(args[6]);
+  if (!isGloballyRoutableIPv4(address) || !Number.isInteger(port) || port < 1 || port > 65535) {
+    throw new Error("Invalid VM relay destination");
+  }
+  return { address, port };
+}
+function parsePs(output) {
+  const result = /* @__PURE__ */ new Map();
+  for (const line of output.trim().split("\n")) {
+    if (!line.trim()) continue;
+    const match = /^(\d+)\s+(\d+)\s+(\d+)\s+(.+)$/.exec(line.trim());
+    if (!match) throw new Error("Invalid relay process measurement");
+    const [pidText, pgidText, rssText, command] = match.slice(1);
+    const pid = Number(pidText);
+    const pgid = Number(pgidText);
+    const rssKiB = Number(rssText);
+    if (![pid, pgid, rssKiB].every(Number.isSafeInteger) || pid < 0 || pgid < 0 || rssKiB < 0) {
+      throw new Error("Invalid relay process measurement");
+    }
+    result.set(pid, { pid, pgid, rssKiB, command: command ?? "" });
+  }
+  return result;
+}
+function listedRecords(root, runId) {
+  const records = [];
+  for (let slot = 0; slot < MAX_RELAYS; slot += 1) {
+    try {
+      const record = JSON.parse(
+        readFileSync(join(slotPath(root, slot), "owner.json"), "utf8")
+      );
+      if (record.schema === 1 && validPid(record.pid) && validRunId(record.runId) && record.runId === runId && record.slot === slot)
+        records.push(record);
+    } catch {
+    }
+  }
+  return records;
+}
+function sampleRelayProcesses(root, runId, psOutput) {
+  const processes = parsePs(psOutput);
+  const expectedCommand = `${join(root, "vm-qemu.js")} ${RELAY_PREFIX}`;
+  return listedRecords(root, runId).flatMap((record) => {
+    const process2 = processes.get(record.pid);
+    if (!process2 || process2.pgid !== process2.pid || !process2.command.includes(expectedCommand))
+      return [];
+    return [{ pid: process2.pid, pgid: process2.pgid, rssKiB: process2.rssKiB }];
+  });
+}
+function terminateRelayProcesses(root, runId, psOutput) {
+  const relays = sampleRelayProcesses(root, runId, psOutput);
+  for (const relay of relays) {
+    try {
+      kill(-relay.pgid, "SIGKILL");
+    } catch {
+    }
+  }
+  return relays.map((relay) => relay.pid);
+}
+function cleanupRelays(root, runId) {
+  try {
+    const psOutput = execFileSync("/bin/ps", ["-axo", "pid=,pgid=,rss=,command="], {
+      encoding: "utf8",
+      timeout: 1e3,
+      maxBuffer: 512 * 1024,
+      env: { PATH: "/usr/bin:/bin", LANG: "C" }
+    });
+    return terminateRelayProcesses(root, runId, psOutput);
+  } catch {
+    return [];
+  }
+}
+function currentGuardStillValid(root, runId) {
+  try {
+    return readLiveGuard(root).runId === runId;
+  } catch {
+    return false;
+  }
+}
+function runRelay(root, invocation) {
+  return Promise.resolve().then(() => runRelayNow(root, invocation));
+}
+function runRelayNow(root, invocation) {
+  const guard = readLiveGuard(root);
+  assertApprovedDestination(root, invocation);
+  const record = registerRelay(root, guard.runId);
+  return new Promise((resolve) => {
+    let finished = false;
+    let sent = 0;
+    let received = 0;
+    let guardTimer;
+    let lifetimeTimer;
+    const socket = new Socket();
+    const finish = (error) => {
+      if (finished) return;
+      finished = true;
+      if (guardTimer) clearInterval(guardTimer);
+      if (lifetimeTimer) clearTimeout(lifetimeTimer);
+      socket.destroy();
+      process.stdin.destroy();
+      try {
+        unregisterRelay(root, record);
+      } catch {
+      }
+      if (error) process.exitCode = 1;
+      resolve();
+    };
+    const exceedsLimit = (total) => total > MAX_RELAY_BYTES;
+    socket.setTimeout(RELAY_IDLE_MS, () => finish(new Error("VM relay idle timeout")));
+    socket.on("error", () => finish(new Error("VM relay connection failed")));
+    socket.on("close", () => finish());
+    socket.on("data", (chunk) => {
+      received += chunk.length;
+      if (exceedsLimit(received)) return finish(new Error("VM relay receive limit exceeded"));
+      if (!process.stdout.write(chunk)) socket.pause();
+    });
+    process.stdout.on("drain", () => socket.resume());
+    process.stdout.on("error", () => finish(new Error("VM relay output failed")));
+    process.stdin.on("data", (chunk) => {
+      sent += chunk.length;
+      if (exceedsLimit(sent)) return finish(new Error("VM relay send limit exceeded"));
+      if (!socket.write(chunk)) process.stdin.pause();
+    });
+    socket.on("drain", () => process.stdin.resume());
+    process.stdin.on("end", () => socket.end());
+    process.stdin.on("error", () => finish(new Error("VM relay input failed")));
+    guardTimer = setInterval(() => {
+      if (!currentGuardStillValid(root, record.runId))
+        finish(new Error("VM relay guard is no longer healthy"));
+    }, 2e3);
+    lifetimeTimer = setTimeout(
+      () => finish(new Error("VM relay lifetime exceeded")),
+      RELAY_LIFETIME_MS
+    );
+    socket.connect(invocation.port, invocation.address);
+  });
+}
+
+// src/vm/resource-guard.ts
+var GIB = 1024 ** 3;
+var GUARD_INTERVAL_MS = 2e3;
+function guardLimits(resources) {
+  if (!Number.isInteger(resources.memoryGiB) || resources.memoryGiB < 2 || resources.memoryGiB > 1024 || !Number.isInteger(resources.diskGiB) || resources.diskGiB < 20 || resources.diskGiB > 512) {
+    throw new Error("Invalid resource limits in host state");
+  }
+  return {
+    minFreeBytes: 10 * GIB,
+    maxRssKiB: (resources.memoryGiB + 1) * 1024 ** 2,
+    maxProcesses: 64,
+    maxOutputBytes: 1024 * 1024,
+    maxDiskBytes: (resources.diskGiB + 1) * GIB,
+    maxLogBytes: 8 * 1024 ** 2
+  };
+}
+function resourceViolation(sample, limits) {
+  if (Object.values(sample).some((value) => !Number.isFinite(value) || value < 0))
+    return "invalid resource measurement";
+  if (sample.freeBytes < limits.minFreeBytes) return "host free disk space below reserve";
+  if (sample.diskBytes > limits.maxDiskBytes) return "VM disk file exceeds its allocation";
+  if (sample.largestLogBytes > limits.maxLogBytes) return "VM host log exceeds its size limit";
+  if (sample.rssKiB > limits.maxRssKiB) return "VM process group exceeds its memory budget";
+  if (sample.processes > limits.maxProcesses) return "VM process group exceeds its process budget";
+  if (sample.processes < 1) return "QEMU process group is missing";
+  return null;
+}
+function parseProcessGroup(output, group) {
+  let rssKiB = 0;
+  let processes = 0;
+  for (const line of output.trim().split("\n")) {
+    const values = line.trim().split(/\s+/).map(Number);
+    if (values.length !== 3 || values.some((value) => !Number.isSafeInteger(value) || value < 0)) {
+      throw new Error("Invalid host process measurement");
+    }
+    if (values[0] === group) {
+      processes += 1;
+      rssKiB += values[2] ?? 0;
+    }
+  }
+  return { rssKiB, processes };
+}
+function regularFileSize(path) {
+  let stat;
+  try {
+    stat = lstatSync2(path);
+  } catch (error) {
+    if (error.code === "ENOENT") return 0;
+    throw error;
+  }
+  if (!stat.isFile() || stat.isSymbolicLink())
+    throw new Error("Unexpected VM disk or log file type");
+  return stat.size;
+}
+function hostPs(args) {
+  return execFileSync2("/bin/ps", args, {
+    encoding: "utf8",
+    // Allow scheduling delays during host builds, within the independent watchdog
+    // heartbeat deadline. A failed sample still shuts down the VM.
+    timeout: 3e3,
+    maxBuffer: 512 * 1024,
+    env: { PATH: "/usr/bin:/bin", LANG: "C" }
+  });
+}
+function sampleResources(root, qemuPid, runId) {
+  const fs = statfsSync(root);
+  const instance = join2(root, "lima", "conveyor");
+  const processes = parseProcessGroup(hostPs(["-axo", "pgid=,pid=,rss="]), qemuPid);
+  const relays = sampleRelayProcesses(root, runId, hostPs(["-axo", "pid=,pgid=,rss=,command="]));
+  return {
+    freeBytes: fs.bavail * fs.bsize,
+    rssKiB: processes.rssKiB + relays.reduce((total, relay) => total + relay.rssKiB, 0),
+    processes: processes.processes + relays.length,
+    relayProcesses: relays.length,
+    diskBytes: regularFileSize(join2(instance, "disk")),
+    largestLogBytes: Math.max(
+      ...["ha.stdout.log", "ha.stderr.log", "serial.log", "serialp.log", "serialv.log"].map(
+        (file) => regularFileSize(join2(instance, file))
+      )
+    )
+  };
+}
+function writeGuardEvidence(root, evidence) {
+  const path = join2(root, "guard-state.json");
+  const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    writeFileSync2(temporary, JSON.stringify(evidence), { mode: 384, flag: "wx" });
+    renameSync(temporary, path);
+  } finally {
+    rmSync2(temporary, { force: true });
+  }
+}
+function startResourceGuard(root, identity, limits, stop) {
+  const evidence = {
+    schema: 1,
+    ...identity,
+    status: "running",
+    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    lastCheckedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    limits
+  };
+  let finished = false;
+  function finish(status, reason) {
+    if (finished) return;
+    finished = true;
+    clearInterval(timer);
+    evidence.status = status;
+    evidence.reason = reason;
+    evidence.lastCheckedAt = (/* @__PURE__ */ new Date()).toISOString();
+    try {
+      writeGuardEvidence(root, evidence);
+    } catch {
+    }
+  }
+  function check() {
+    if (finished) return;
+    try {
+      evidence.observed = sampleResources(root, identity.qemuPid, identity.runId);
+      const violation = resourceViolation(evidence.observed, limits);
+      if (violation) throw new Error(violation);
+      evidence.lastCheckedAt = (/* @__PURE__ */ new Date()).toISOString();
+      writeGuardEvidence(root, evidence);
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : "resource guard failed";
+      finish("terminated", reason);
+      stop(reason);
+    }
+  }
+  const timer = setInterval(check, GUARD_INTERVAL_MS);
+  setImmediate(check);
+  return { finish };
+}
+
+// src/vm/watchdog.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { spawn } from "child_process";
+import { join as join3 } from "path";
+var WATCHDOG_ARG = "--conveyor-vm-watchdog";
+var HEARTBEAT_MAX_AGE_MS = 1e4;
+var HEARTBEAT_MAX_FUTURE_MS = 5e3;
+var STARTUP_GRACE_MS = 12e3;
+var WATCH_INTERVAL_MS = 1e3;
+function parseHeartbeat(value) {
+  if (typeof value !== "object" || value === null) return null;
+  const record = value;
+  if (record.schema !== 1 || typeof record.runId !== "string" || typeof record.wrapperPid !== "number" || typeof record.qemuPid !== "number" || typeof record.watchdogPid !== "number" || typeof record.networkHash !== "string" || record.status !== "running" || typeof record.lastCheckedAt !== "string")
+    return null;
+  return record;
+}
+function heartbeatFresh(value, now) {
+  const checkedAt = Date.parse(value.lastCheckedAt);
+  return Number.isFinite(checkedAt) && checkedAt >= now - HEARTBEAT_MAX_AGE_MS && checkedAt <= now + HEARTBEAT_MAX_FUTURE_MS;
+}
+function matchesIdentity(heartbeat, identity, watchdogPid) {
+  return heartbeat !== null && heartbeat.runId === identity.runId && heartbeat.wrapperPid === identity.wrapperPid && heartbeat.qemuPid === identity.qemuPid && heartbeat.watchdogPid === watchdogPid && heartbeat.networkHash === identity.networkHash;
+}
+function watchdogDecision(evidence, identity, watchdogPid, startedAt, now, wrapperAlive, qemuAlive) {
+  if (!qemuAlive) return "finished";
+  if (!wrapperAlive) return "terminate";
+  const heartbeat = parseHeartbeat(evidence);
+  if (matchesIdentity(heartbeat, identity, watchdogPid) && heartbeatFresh(heartbeat, now))
+    return "healthy";
+  return now < startedAt + STARTUP_GRACE_MS ? "wait" : "terminate";
+}
+function pidAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+function killQemuGroup(pid) {
+  try {
+    process.kill(-pid, "SIGKILL");
+  } catch (error) {
+    if (error.code === "ESRCH") return;
+    try {
+      process.kill(pid, "SIGKILL");
+    } catch {
+    }
+  }
+}
+function readHeartbeat(root) {
+  try {
+    return JSON.parse(readFileSync2(join3(root, "guard-state.json"), "utf8"));
+  } catch {
+    return null;
+  }
+}
+function persistWatchdogTermination(root, raw, identity, watchdogPid) {
+  try {
+    if (!matchesIdentity(parseHeartbeat(raw), identity, watchdogPid)) return;
+    const evidence = raw;
+    if (!evidence.limits || typeof evidence.startedAt !== "string") return;
+    writeGuardEvidence(root, {
+      ...evidence,
+      status: "terminated",
+      reason: "host watchdog detected a missing supervisor or invalid guard heartbeat",
+      lastCheckedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  } catch {
+  }
+}
+function runWatchdog(root, identity) {
+  const startedAt = Date.now();
+  let finished = false;
+  const finish = (code) => {
+    if (finished) return;
+    finished = true;
+    clearInterval(timer);
+    process.exitCode = code;
+  };
+  const check = () => {
+    const evidence = readHeartbeat(root);
+    const decision = watchdogDecision(
+      evidence,
+      identity,
+      process.pid,
+      startedAt,
+      Date.now(),
+      pidAlive(identity.wrapperPid),
+      pidAlive(identity.qemuPid)
+    );
+    if (decision === "finished") {
+      cleanupRelays(root, identity.runId);
+      finish(0);
+    } else if (decision === "terminate") {
+      persistWatchdogTermination(root, evidence, identity, process.pid);
+      killQemuGroup(identity.qemuPid);
+      cleanupRelays(root, identity.runId);
+      finish(1);
+    }
+  };
+  const timer = setInterval(check, WATCH_INTERVAL_MS);
+  for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"])
+    process.on(signal, () => finish(0));
+  check();
+}
+function encodedIdentity(identity) {
+  return JSON.stringify(identity);
+}
+function startWatchdog(root, identity, onUnexpectedExit) {
+  const child = spawn(
+    process.execPath,
+    [join3(root, "vm-qemu.js"), WATCHDOG_ARG, encodedIdentity(identity)],
+    {
+      detached: true,
+      stdio: "ignore",
+      env: process.env
+    }
+  );
+  child.unref();
+  child.on("error", onUnexpectedExit);
+  child.on("exit", () => onUnexpectedExit());
+  return child;
+}
+function parseWatchdogInvocation(args) {
+  if (args.length !== 2 || args[0] !== WATCHDOG_ARG) return null;
+  try {
+    const value = JSON.parse(args[1] ?? "");
+    if (typeof value.runId !== "string" || !/^[0-9a-f-]{36}$/i.test(value.runId) || !Number.isInteger(value.wrapperPid) || (value.wrapperPid ?? 0) <= 1 || !Number.isInteger(value.qemuPid) || (value.qemuPid ?? 0) <= 1 || typeof value.networkHash !== "string" || !/^[a-f0-9]{64}$/i.test(value.networkHash))
+      return null;
+    return value;
+  } catch {
+    return null;
+  }
+}
+
+// src/vm/qemu-process.ts
+function signalVmGroup(child, signal) {
+  if (!child.pid) return true;
+  try {
+    process.kill(-child.pid, signal);
+    return true;
+  } catch (error) {
+    if (error.code === "ESRCH") return true;
+    try {
+      return child.kill(signal);
+    } catch {
+      return false;
+    }
+  }
+}
+function watchdogExitNeedsTermination(qemuExited) {
+  return !qemuExited;
+}
+function stopWatchdog(watchdog) {
+  if (!watchdog?.pid) return;
+  try {
+    process.kill(-watchdog.pid, "SIGTERM");
+  } catch {
+    try {
+      watchdog.kill("SIGTERM");
+    } catch {
+    }
+  }
+}
+function startIdentity(root) {
+  const request = JSON.parse(readFileSync3(join4(root, "start-request.json"), "utf8"));
+  if (!request.runId || !/^[0-9a-f-]{36}$/i.test(request.runId))
+    throw new Error("Missing host startup identity");
+  return request.runId;
+}
+function attachBoundedOutput(child, limit, terminate) {
+  let bytes = 0;
+  let logged = 0;
+  const consume = (chunk) => {
+    bytes += chunk.length;
+    const remaining = Math.max(0, 64 * 1024 - logged);
+    if (remaining) {
+      const output = chunk.subarray(0, remaining);
+      process.stderr.write(output);
+      logged += output.length;
+    }
+    if (bytes > limit) terminate("QEMU diagnostic output exceeds its limit");
+  };
+  child.stdout?.on("data", consume);
+  child.stderr?.on("data", consume);
+}
+function runGuardedQemu(root, qemu, args, networkHash, resources) {
+  const runId = startIdentity(root);
+  const limits = guardLimits(resources);
+  const hardenedArgs = [...args, "-no-user-config", "-nodefaults"];
+  const child = spawn2(qemu, hardenedArgs, {
+    stdio: ["ignore", "pipe", "pipe"],
+    detached: true,
+    env: process.env
+  });
+  const qemuPid = child.pid;
+  if (!qemuPid) {
+    child.on("error", () => {
+      process.exitCode = 1;
+    });
+    return;
+  }
+  let stopping = false;
+  let qemuExited = false;
+  let killTimer;
+  let guard;
+  let watchdog;
+  const terminate = (reason) => {
+    if (stopping) return;
+    stopping = true;
+    guard?.finish("terminated", reason);
+    cleanupRelays(root, runId);
+    process.stderr.write(`[conveyor-vm] Stopping VM: ${reason}
+`);
+    signalVmGroup(child, "SIGTERM");
+    killTimer = setTimeout(() => signalVmGroup(child, "SIGKILL"), 2e3);
+    killTimer.unref();
+  };
+  const watchdogIdentity = { runId, wrapperPid: process.pid, qemuPid, networkHash };
+  const watchdogFailure = () => {
+    if (watchdogExitNeedsTermination(qemuExited)) terminate("host watchdog exited unexpectedly");
+  };
+  attachBoundedOutput(child, limits.maxOutputBytes, terminate);
+  for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"])
+    process.on(signal, () => terminate(`host received ${signal}`));
+  process.on("uncaughtException", () => terminate("host supervisor exception"));
+  process.on("unhandledRejection", () => terminate("host supervisor rejection"));
+  child.on("error", () => terminate("QEMU process error"));
+  child.on("exit", (code) => {
+    qemuExited = true;
+    if (killTimer) clearTimeout(killTimer);
+    stopWatchdog(watchdog);
+    cleanupRelays(root, runId);
+    signalVmGroup(child, "SIGKILL");
+    guard?.finish("stopped");
+    process.exitCode = stopping ? 1 : code ?? 1;
+  });
+  try {
+    watchdog = startWatchdog(root, watchdogIdentity, watchdogFailure);
+    if (!watchdog.pid) throw new Error("host watchdog did not start");
+    const identity = { ...watchdogIdentity, watchdogPid: watchdog.pid };
+    writeFileSync3(
+      join4(root, "applied-network.json"),
+      JSON.stringify({ ...identity, args: hardenedArgs, startedAt: (/* @__PURE__ */ new Date()).toISOString() }),
+      { mode: 384 }
+    );
+    guard = startResourceGuard(root, identity, limits, terminate);
+  } catch {
+    terminate("failed to record or start host resource supervision");
+  }
+}
+
+// src/vm-qemu.ts
+function main() {
+  const root = dirname(fileURLToPath(import.meta.url));
+  const watchdog = parseWatchdogInvocation(process.argv.slice(2));
+  if (watchdog) {
+    runWatchdog(root, watchdog);
+    return;
+  }
+  if (process.argv[2] === "--conveyor-vm-watchdog")
+    throw new Error("Invalid VM watchdog invocation");
+  const relay = parseRelayInvocation(process.argv.slice(2));
+  if (relay) {
+    void runRelay(root, relay).catch((error) => {
+      process.stderr.write(
+        `[conveyor-vm] ${error instanceof Error ? error.message : String(error)}
+`
+      );
+      process.exitCode = 1;
+    });
+    return;
+  }
+  const state = JSON.parse(readFileSync4(join5(root, "state.json"), "utf8"));
+  if (state.schema !== 1 || !state.qemu.startsWith("/") || state.qemu.includes("wrapper")) {
+    throw new Error("Invalid QEMU host state");
+  }
+  const networkText = readFileSync4(join5(root, "network.json"), "utf8");
+  const network = JSON.parse(networkText);
+  const args = process.argv.slice(2);
+  const original = args.find((arg) => arg.startsWith("user,"));
+  const sshPort = Number(
+    original?.match(/hostfwd=tcp:127\.0\.0\.1:(\d+)-(?:192\.168\.5\.15)?:22/)?.[1] ?? 0
+  );
+  const rewritten = rewriteQemuArgs(args, { ...network, sshPort }, join5(root, "qemu-relay"), {
+    instanceDir: join5(root, "lima", "conveyor")
+  });
+  if (original) {
+    const expected = process.platform === "darwin" ? "hvf" : "kvm";
+    if (!rewritten.some((arg) => arg.includes(`accel=${expected}`)) && !rewritten.some((arg, index) => arg === "-accel" && rewritten[index + 1] === expected)) {
+      throw new Error("Hardware virtualization is required; refusing emulation fallback");
+    }
+    runGuardedQemu(
+      root,
+      state.qemu,
+      rewritten,
+      createHash("sha256").update(networkText).digest("hex"),
+      state.resources
+    );
+    return;
+  }
+  const child = spawn3(state.qemu, rewritten, { stdio: "inherit", env: process.env });
+  for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) {
+    process.on(signal, () => {
+      child.kill(signal);
+    });
+  }
+  child.on("error", () => {
+    process.stderr.write("QEMU could not start.\n");
+    process.exitCode = 1;
+  });
+  child.on("exit", (code) => {
+    process.exitCode = code ?? 1;
+  });
+}
+try {
+  main();
+} catch (error) {
+  process.stderr.write(`[conveyor-vm] ${error instanceof Error ? error.message : String(error)}
+`);
+  process.exitCode = 1;
+}