@relayflows/sdk 2.0.0

package/src/worker-cli.ts

@@ -0,0 +1,110 @@
+import { spawn } from 'node:child_process';
+import {
+  agentExecution,
+  cliAdapterKind,
+  type CliInvocation,
+} from './cli-adapter.js';
+import {
+  runWrapperSession,
+  type WrapperSessionLimits,
+} from './wrapper-session.js';
+import { wrapperEnvironment } from './wrapper-runtime.js';
+
+/** Present only when a dispatched agent step carries a journaled wake context. */
+export const WAKE_CONTEXT_ENV = 'RELAYFLOW_WAKE_CONTEXT';
+
+/**
+ * Private wrapper model variable name. Ambient values are scrubbed; a wrapper
+ * may set it inside the already-identified process from the session request.
+ * Raw Claude/Codex adapters receive provider-native model flags.
+ */
+export const MODEL_ENV = 'RELAYFLOW_MODEL';
+
+export interface WorkerCliResult {
+  exit_code: number | null;
+  stdout_tail: string;
+  stderr_tail: string;
+}
+
+export async function runAgentCli(
+  cli: string,
+  instruction: string,
+  wakeContext: unknown,
+  model?: string,
+  wrapperLimits?: Partial<WrapperSessionLimits>,
+): Promise<WorkerCliResult> {
+  const kind = cliAdapterKind(cli);
+
+  if (kind === 'relayflows-wrapper-v1') {
+    return runWrapperSession(
+      cli,
+      instruction,
+      wakeContext,
+      model,
+      wrapperEnvironment(process.env),
+      wrapperLimits,
+    );
+  }
+
+  const env: NodeJS.ProcessEnv = { ...process.env };
+  delete env[WAKE_CONTEXT_ENV];
+  delete env[MODEL_ENV];
+  const invocation = agentExecution(kind, instruction, model);
+
+  if (wakeContext !== undefined) {
+    try {
+      env[WAKE_CONTEXT_ENV] = JSON.stringify(wakeContext);
+    } catch (error) {
+      return {
+        exit_code: null,
+        stdout_tail: '',
+        stderr_tail: `wake_context could not be JSON-serialized for the CLI: ${String(error)}`,
+      };
+    }
+  }
+
+  if (invocation.modelEnv !== undefined) env[MODEL_ENV] = invocation.modelEnv;
+  return spawnInvocation(cli, invocation, env);
+}
+
+function spawnInvocation(
+  cli: string,
+  invocation: CliInvocation,
+  env: NodeJS.ProcessEnv,
+): Promise<WorkerCliResult> {
+  return new Promise((resolve) => {
+    const child = spawn(cli, invocation.args, { stdio: ['ignore', 'pipe', 'pipe'], env });
+    const stdout: Buffer[] = [];
+    const stderr: Buffer[] = [];
+    let settled = false;
+    let timer: NodeJS.Timeout | undefined;
+    const finish = (result: WorkerCliResult): void => {
+      if (settled) return;
+      settled = true;
+      if (timer !== undefined) clearTimeout(timer);
+      resolve(result);
+    };
+    child.stdout.on('data', (chunk: Buffer) => stdout.push(chunk));
+    child.stderr.on('data', (chunk: Buffer) => stderr.push(chunk));
+    child.once('error', (error) => finish({
+      exit_code: null,
+      stdout_tail: Buffer.concat(stdout).toString('utf8'),
+      stderr_tail: error.message,
+    }));
+    child.once('close', (code) => finish({
+      exit_code: code,
+      stdout_tail: Buffer.concat(stdout).toString('utf8'),
+      stderr_tail: Buffer.concat(stderr).toString('utf8'),
+    }));
+    if (invocation.timeoutMs > 0) {
+      timer = setTimeout(() => {
+        child.kill('SIGTERM');
+        finish({
+          exit_code: null,
+          stdout_tail: Buffer.concat(stdout).toString('utf8'),
+          stderr_tail: `CLI invocation timed out after ${invocation.timeoutMs}ms.`,
+        });
+      }, invocation.timeoutMs);
+    }
+  });
+}

package/src/worker.ts

@@ -0,0 +1,150 @@
+import { EventEmitter } from 'node:events';
+import type { JournalClient } from './journal-client.js';
+import type { Pins, StepDispatchEvent } from './protocol.js';
+import type { KernelAgentStep } from './spec.js';
+import { runAgentCli } from './worker-cli.js';
+
+export { MODEL_ENV, WAKE_CONTEXT_ENV } from './worker-cli.js';
+
+export interface AgentWorkerOptions {
+  workerId: string;
+  pins: Pins;
+  capacity?: number;
+}
+
+/**
+ * Executes dispatched agent steps using their declared CLI.
+ *
+ * Shutdown contract (close): async and drain-aware. The caller may await
+ * close() to guarantee every dispatch this worker started before close
+ * was called has either completed its stepComplete journal write or
+ * thrown out through the worker's `error` event. Dispatches that arrive
+ * AFTER close begins are ignored. Idempotent.
+ *
+ * Not implemented: releasing the worker registration with the kernel.
+ * `sdk/src/protocol.ts` has no `workerRelease` verb today, so on close()
+ * the kernel keeps this workerId in its registry until its lease expires.
+ * When workerRelease lands, add a client call at the top of close()
+ * (before the drain) so the kernel stops routing dispatches during
+ * shutdown.
+ */
+export class AgentWorker extends EventEmitter {
+  private attached = false;
+  private closing = false;
+  private readonly inFlight: Set<Promise<void>> = new Set();
+
+  constructor(
+    private readonly client: JournalClient,
+    private readonly options: AgentWorkerOptions,
+  ) {
+    super();
+  }
+
+  async attach(): Promise<void> {
+    if (this.attached) throw new Error('agent worker: already attached');
+    if (this.closing) throw new Error('agent worker: cannot attach a closed worker (construct a new one)');
+    this.client.on('step.dispatch', this.onDispatch);
+    try {
+      await this.client.workerAttach(
+        this.options.workerId,
+        ['agent'],
+        this.options.pins,
+        this.options.capacity,
+      );
+      this.attached = true;
+    } catch (error) {
+      this.client.off('step.dispatch', this.onDispatch);
+      throw error;
+    }
+  }
+
+  /**
+   * Async, drain-aware shutdown. Awaits every dispatch in-flight; ignores
+   * dispatches that arrive after close() begins. Idempotent.
+   *
+   * A prior synchronous close() did NOT drain, so a caller shutting
+   * mid-dispatch could silently lose an in-flight step's stepComplete
+   * journal write when the socket was immediately shut. This closes
+   * that hole.
+   */
+  async close(): Promise<void> {
+    if (this.closing) return;
+    this.closing = true;
+    this.client.off('step.dispatch', this.onDispatch);
+    const pending = Array.from(this.inFlight);
+    if (pending.length > 0) {
+      await Promise.allSettled(pending);
+    }
+    this.attached = false;
+  }
+
+  private readonly onDispatch = (dispatch: StepDispatchEvent): void => {
+    if (this.closing) return;
+    if (dispatch.step_type !== 'agent') return;
+    const running: Promise<void> = this.execute(dispatch).catch((error: unknown) => {
+      this.emit('error', error);
+    });
+    this.inFlight.add(running);
+    void running.finally(() => { this.inFlight.delete(running); });
+  };
+
+  private async execute(dispatch: StepDispatchEvent): Promise<void> {
+    const spec = dispatch.spec as Partial<KernelAgentStep>;
+    const result = typeof spec.cli === 'string' && typeof spec.instruction === 'string'
+      ? await runAgentCli(spec.cli, spec.instruction, dispatch.wake_context, spec.model)
+      : { exit_code: null, stdout_tail: '', stderr_tail: 'agent step has no declared CLI' };
+    const completionReason = result.exit_code === 0 ? 'success' : 'worker_error';
+
+    // Output shape: if the CLI's stdout parses as JSON, promote THAT
+    // as the step's `output` value so `json_schema` verification
+    // validates the analysis payload, not a wrapper around stdout.
+    // On the JSON path the CliResult (exit_code / stdout_tail /
+    // stderr_tail) is DISCARDED from `output` — the schema author
+    // wrote a shape for the analysis, not for the process wrapper.
+    // Non-JSON stdout falls back to the wrapper so text-emitting
+    // tools still round-trip usefully.
+    //
+    // Implicit contract: CLIs signal errors via non-zero exit, not by
+    // emitting an error JSON with exit 0. `completionReason` is
+    // derived from exit code, so a CLI that exits 0 while emitting
+    // `{"error":...}` will report success with an error payload.
+    const output = parseJsonOutput(result.stdout_tail) ?? result;
+
+    await this.client.stepComplete(
+      dispatch.run_id,
+      dispatch.step_id,
+      dispatch.attempt,
+      dispatch.idempotency_key,
+      completionReason,
+      {
+        output,
+        started_pins: dispatch.pins,
+        end_pins: dispatch.pins,
+      },
+    );
+  }
+}
+
+/**
+ * Return an object-shaped JSON payload parsed from `stdout`, or
+ * `null` when stdout is empty, non-JSON, or JSON-of-a-scalar/array.
+ * The object-only restriction matches how `json_schema` gates are
+ * authored — a scalar or array sneaking through would confuse both
+ * the schema and downstream readers who expect field lookups on
+ * `output`. Text-emitting tools and non-object JSON both fall
+ * through to the CliResult wrapper preserved by the caller.
+ */
+export function parseJsonOutput(stdout: string): Record<string, unknown> | null {
+  const trimmed = stdout.trim();
+  if (trimmed === '') return null;
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(trimmed);
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+    return null;
+  }
+  return parsed as Record<string, unknown>;
+}

package/src/wrapper-runtime.ts

@@ -0,0 +1,93 @@
+import { accessSync, constants, realpathSync, statSync } from 'node:fs';
+import { delimiter, isAbsolute, join, resolve } from 'node:path';
+
+const WRAPPER_ENV_ALLOWLIST = [
+  'PATH',
+  'HOME',
+  'TMPDIR',
+  'TMP',
+  'TEMP',
+  'SHELL',
+  'LANG',
+  'LC_ALL',
+  'LC_CTYPE',
+  'TZ',
+  'USER',
+  'LOGNAME',
+  'SystemRoot',
+  'ComSpec',
+  'PATHEXT',
+  'WINDIR',
+] as const;
+
+export interface WrapperIdentity {
+  executable: string;
+  fingerprint: string;
+}
+
+/** Build a wrapper environment from a closed list; ambient credentials never cross. */
+export function wrapperEnvironment(source: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
+  const env: NodeJS.ProcessEnv = {};
+  for (const name of WRAPPER_ENV_ALLOWLIST) {
+    const value = source[name];
+    if (value !== undefined) env[name] = value;
+  }
+  return env;
+}
+
+/** Resolve and fingerprint the exact executable that will enter the private protocol. */
+export function captureWrapperIdentity(
+  cli: string,
+  env: NodeJS.ProcessEnv,
+): WrapperIdentity {
+  const executable = realpathSync(resolveWrapperExecutable(cli, env));
+  accessSync(executable, constants.X_OK);
+  const stat = statSync(executable, { bigint: true });
+  if (!stat.isFile()) throw new Error('resolved wrapper is not a regular file');
+  return {
+    executable,
+    fingerprint: [
+      stat.dev,
+      stat.ino,
+      stat.mode,
+      stat.size,
+      stat.mtimeNs,
+      stat.ctimeNs,
+    ].join(':'),
+  };
+}
+
+export function sameWrapperIdentity(
+  cli: string,
+  env: NodeJS.ProcessEnv,
+  expected: WrapperIdentity,
+): boolean {
+  try {
+    const current = captureWrapperIdentity(cli, env);
+    return current.executable === expected.executable
+      && current.fingerprint === expected.fingerprint;
+  } catch {
+    return false;
+  }
+}
+
+function resolveWrapperExecutable(cli: string, env: NodeJS.ProcessEnv): string {
+  if (isAbsolute(cli) || cli.includes('/') || cli.includes('\\')) return resolve(cli);
+  const path = env.PATH;
+  if (path === undefined) throw new Error('PATH is unavailable while resolving the wrapper');
+  const extensions = process.platform === 'win32'
+    ? (env.PATHEXT ?? '.EXE;.CMD;.BAT;.COM').split(';')
+    : [''];
+  for (const directory of path.split(delimiter)) {
+    for (const extension of extensions) {
+      const candidate = join(directory || '.', `${cli}${extension}`);
+      try {
+        accessSync(candidate, constants.X_OK);
+        return candidate;
+      } catch {
+        // Continue through the deterministic PATH candidate list.
+      }
+    }
+  }
+  throw new Error(`wrapper executable ${JSON.stringify(cli)} was not found on PATH`);
+}

package/src/wrapper-session.ts

@@ -0,0 +1,287 @@
+import { spawn } from 'node:child_process';
+import {
+  WRAPPER_EXECUTE_TOKEN,
+  WRAPPER_IDENTIFY_ARG,
+  WRAPPER_IDENTIFY_TOKEN,
+} from './cli-adapter.js';
+import {
+  captureWrapperIdentity,
+  sameWrapperIdentity,
+  type WrapperIdentity,
+} from './wrapper-runtime.js';
+
+export interface WrapperSessionLimits {
+  handshakeTimeoutMs: number;
+  executionTimeoutMs: number;
+  maxOutputBytes: number;
+}
+
+export interface WrapperSessionResult {
+  exit_code: number | null;
+  stdout_tail: string;
+  stderr_tail: string;
+}
+
+const DEFAULT_LIMITS: WrapperSessionLimits = {
+  handshakeTimeoutMs: 10_000,
+  executionTimeoutMs: 300_000,
+  maxOutputBytes: 1_048_576,
+};
+const HANDSHAKE_OUTPUT_LIMIT = 8_192;
+const FORCE_KILL_DELAY_MS = 1_000;
+/**
+ * Grace after `SIGKILL` before the reader settles on its own. Node emits
+ * `'close'` only once every inherited stdio pipe is closed, which any
+ * descendant of the wrapper can withhold forever. Resolution therefore may
+ * not depend on `'close'`: past this point the reader settles regardless.
+ */
+const SETTLE_AFTER_KILL_MS = 250;
+
+/**
+ * Identify and execute a custom wrapper in one pinned process. No private
+ * request is written until its declared path still names the captured file.
+ */
+export function runWrapperSession(
+  cli: string,
+  instruction: string,
+  wakeContext: unknown,
+  model: string | undefined,
+  env: NodeJS.ProcessEnv,
+  overrides: Partial<WrapperSessionLimits> = {},
+): Promise<WrapperSessionResult> {
+  const limits = sessionLimits(overrides);
+  let request: string;
+  try {
+    request = JSON.stringify({
+      protocol: WRAPPER_IDENTIFY_TOKEN,
+      instruction,
+      ...(model !== undefined ? { model } : {}),
+      ...(wakeContext !== undefined ? { wakeContext } : {}),
+    });
+  } catch (error) {
+    return Promise.resolve(failure(
+      `wake_context could not be JSON-serialized for the CLI: ${String(error)}`,
+    ));
+  }
+  let identity: WrapperIdentity;
+  try {
+    identity = captureWrapperIdentity(cli, env);
+  } catch (error) {
+    return Promise.resolve(failure(
+      `CLI ${JSON.stringify(cli)} wrapper identity could not be pinned: ${String(error)}`,
+    ));
+  }
+
+  return executePinnedWrapper(cli, identity, request, env, limits);
+}
+
+function executePinnedWrapper(
+  cli: string,
+  identity: WrapperIdentity,
+  request: string,
+  env: NodeJS.ProcessEnv,
+  limits: WrapperSessionLimits,
+): Promise<WrapperSessionResult> {
+  return new Promise((resolve) => {
+    const child = spawn(identity.executable, [WRAPPER_IDENTIFY_ARG], {
+      stdio: ['pipe', 'pipe', 'pipe'],
+      env,
+    });
+    const stdout: string[] = [];
+    const stderr: Buffer[] = [];
+    let handshakePending = '';
+    let executionPending = '';
+    let capturedBytes = 0;
+    let phase: 'identity' | 'ack' | 'execute' = 'identity';
+    let protocolError: string | undefined;
+    let settled = false;
+    let lifecycleTimer: NodeJS.Timeout | undefined;
+    let killTimer: NodeJS.Timeout | undefined;
+    let settleTimer: NodeJS.Timeout | undefined;
+
+    const clearTimers = (): void => {
+      if (lifecycleTimer !== undefined) clearTimeout(lifecycleTimer);
+      if (killTimer !== undefined) clearTimeout(killTimer);
+      if (settleTimer !== undefined) clearTimeout(settleTimer);
+    };
+    const finish = (result: WrapperSessionResult): void => {
+      if (settled) return;
+      settled = true;
+      clearTimers();
+      resolve(result);
+    };
+    const terminate = (message: string): void => {
+      if (protocolError !== undefined) return;
+      protocolError = message;
+      if (lifecycleTimer !== undefined) clearTimeout(lifecycleTimer);
+      child.kill('SIGTERM');
+      killTimer = setTimeout(() => child.kill('SIGKILL'), FORCE_KILL_DELAY_MS);
+      killTimer.unref();
+      // The reader owns the bound. `'close'` is emitted only after every
+      // inherited stdio pipe closes, so a wrapper that leaves a descendant
+      // holding one withholds it forever and strands the step with no
+      // `completionReason` at all. Settle on our own deadline instead — the
+      // same shape `spawnInvocation` uses in worker-cli.ts, where the timer
+      // resolves rather than delegating to a child-controlled event. The
+      // result is byte-identical to the one the `'close'` path would build
+      // for this `protocolError`, so this changes only WHEN we settle.
+      settleTimer = setTimeout(
+        () => finish(failure(message)),
+        FORCE_KILL_DELAY_MS + SETTLE_AFTER_KILL_MS,
+      );
+    };
+    const startExecutionTimer = (): void => {
+      if (lifecycleTimer !== undefined) clearTimeout(lifecycleTimer);
+      lifecycleTimer = setTimeout(() => terminate(
+        `CLI ${JSON.stringify(cli)} execution timed out after ${limits.executionTimeoutMs}ms.`,
+      ), limits.executionTimeoutMs);
+    };
+    const exceedsOutputLimit = (additionalBytes: number): boolean => {
+      const pendingBytes = Buffer.byteLength(executionPending);
+      if (capturedBytes + pendingBytes + additionalBytes <= limits.maxOutputBytes) return false;
+      terminate(
+        `CLI ${JSON.stringify(cli)} exceeded the captured output limit of ${limits.maxOutputBytes} bytes.`,
+      );
+      return true;
+    };
+    const appendStdout = (value: string): void => {
+      const bytes = Buffer.byteLength(value);
+      capturedBytes += bytes;
+      stdout.push(value);
+    };
+    const acceptHandshakeLine = (line: string): void => {
+      const normalized = normalizeLine(line);
+      if (phase === 'identity') {
+        if (normalized !== WRAPPER_IDENTIFY_TOKEN) {
+          terminate(`CLI ${JSON.stringify(cli)} did not identify as ${WRAPPER_IDENTIFY_TOKEN} at worker execution.`);
+          return;
+        }
+        if (!sameWrapperIdentity(cli, env, identity)) {
+          terminate(`CLI ${JSON.stringify(cli)} wrapper identity changed before private request delivery.`);
+          return;
+        }
+        phase = 'ack';
+        child.stdin.end(`${request}\n`);
+        return;
+      }
+      if (phase === 'ack') {
+        if (normalized !== WRAPPER_EXECUTE_TOKEN) {
+          terminate(`CLI ${JSON.stringify(cli)} did not accept the ${WRAPPER_IDENTIFY_TOKEN} same-process execution request.`);
+          return;
+        }
+        phase = 'execute';
+        startExecutionTimer();
+      }
+    };
+    const acceptExecutionData = (chunk: string): void => {
+      executionPending += chunk;
+      if (exceedsOutputLimit(0)) return;
+      while (true) {
+        const newline = executionPending.indexOf('\n');
+        if (newline < 0) return;
+        const line = executionPending.slice(0, newline);
+        executionPending = executionPending.slice(newline + 1);
+        if (normalizeLine(line) === WRAPPER_EXECUTE_TOKEN) {
+          terminate(`CLI ${JSON.stringify(cli)} emitted a duplicate execute protocol frame.`);
+          return;
+        }
+        appendStdout(`${line}\n`);
+      }
+    };
+    const handshakeComplete = (): boolean => phase === 'execute';
+
+    lifecycleTimer = setTimeout(() => terminate(
+      `CLI ${JSON.stringify(cli)} did not identify as ${WRAPPER_IDENTIFY_TOKEN} within ${limits.handshakeTimeoutMs}ms.`,
+    ), limits.handshakeTimeoutMs);
+
+    child.stdout.setEncoding('utf8');
+    child.stdout.on('data', (chunk: string) => {
+      if (protocolError !== undefined) return;
+      if (phase === 'execute') {
+        acceptExecutionData(chunk);
+        return;
+      }
+      handshakePending += chunk;
+      // Drain every complete line FIRST. The handshake bound belongs to the
+      // handshake, and a line that is already terminated is no longer part
+      // of it: the execute token sitting at the front of this buffer ends
+      // the handshake, and the bytes behind it are execution output bound by
+      // `maxOutputBytes`. Measuring the whole buffer before draining capped a
+      // conforming wrapper's first result flush at HANDSHAKE_OUTPUT_LIMIT
+      // whenever the OS coalesced its writes, and named the wrong bound.
+      while (!handshakeComplete()) {
+        const newline = handshakePending.indexOf('\n');
+        if (newline < 0) break;
+        const line = handshakePending.slice(0, newline);
+        handshakePending = handshakePending.slice(newline + 1);
+        acceptHandshakeLine(line);
+        if (protocolError !== undefined) return;
+      }
+      if (handshakeComplete()) {
+        if (handshakePending.length > 0) {
+          const remainder = handshakePending;
+          handshakePending = '';
+          acceptExecutionData(remainder);
+        }
+        return;
+      }
+      // Still handshaking: bound the un-terminated residue, which is the only
+      // buffer the handshake still owns.
+      if (Buffer.byteLength(handshakePending) > HANDSHAKE_OUTPUT_LIMIT) {
+        terminate(
+          `CLI ${JSON.stringify(cli)} exceeded the wrapper handshake limit of ${HANDSHAKE_OUTPUT_LIMIT} bytes before completing the ${WRAPPER_IDENTIFY_TOKEN} handshake.`,
+        );
+      }
+    });
+    child.stderr.on('data', (chunk: Buffer) => {
+      if (protocolError !== undefined || exceedsOutputLimit(chunk.byteLength)) return;
+      capturedBytes += chunk.byteLength;
+      stderr.push(chunk);
+    });
+    child.stdin.on('error', () => {
+      // A child that closes stdin before acknowledgement is classified on close.
+    });
+    child.once('error', (error) => finish(failure(error.message)));
+    child.once('close', (code) => {
+      if (protocolError === undefined && phase === 'execute' && executionPending.length > 0) {
+        if (normalizeLine(executionPending) === WRAPPER_EXECUTE_TOKEN) {
+          protocolError = `CLI ${JSON.stringify(cli)} emitted a duplicate execute protocol frame.`;
+        } else if (!exceedsOutputLimit(0)) {
+          appendStdout(executionPending);
+        }
+      }
+      if (protocolError !== undefined || phase !== 'execute') {
+        finish(failure(
+          protocolError
+            ?? `CLI ${JSON.stringify(cli)} exited before completing the ${WRAPPER_IDENTIFY_TOKEN} same-process handshake.`,
+        ));
+        return;
+      }
+      finish({
+        exit_code: code,
+        stdout_tail: stdout.join(''),
+        stderr_tail: Buffer.concat(stderr).toString('utf8'),
+      });
+    });
+  });
+}
+
+function sessionLimits(overrides: Partial<WrapperSessionLimits>): WrapperSessionLimits {
+  return {
+    handshakeTimeoutMs: positiveLimit(overrides.handshakeTimeoutMs, DEFAULT_LIMITS.handshakeTimeoutMs),
+    executionTimeoutMs: positiveLimit(overrides.executionTimeoutMs, DEFAULT_LIMITS.executionTimeoutMs),
+    maxOutputBytes: positiveLimit(overrides.maxOutputBytes, DEFAULT_LIMITS.maxOutputBytes),
+  };
+}
+
+function positiveLimit(value: number | undefined, fallback: number): number {
+  return value !== undefined && Number.isSafeInteger(value) && value > 0 ? value : fallback;
+}
+
+function normalizeLine(line: string): string {
+  return line.endsWith('\r') ? line.slice(0, -1) : line;
+}
+
+function failure(stderr_tail: string): WrapperSessionResult {
+  return { exit_code: null, stdout_tail: '', stderr_tail };
+}