@ricsam/r5d-worker 0.0.137 → 0.0.139

package/dist/mjs/personal/tcp.mjs

@@ -0,0 +1,217 @@
+import net from "node:net";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { closeSync, constants, lstatSync, openSync } from "node:fs";
+import { Database } from "bun:sqlite";
+import { z } from "zod";
+import { RuntimeId } from "@ricsam/r5d-api/runtime-protocol";
+import { privateDirectory } from "../runtime/storage.mjs";
+const Cursor = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
+const Command = z.discriminatedUnion("method", [
+  z.object({ method: z.literal("connect"), streamId: RuntimeId, id: RuntimeId.optional(), port: z.number().int().min(1).max(65535) }).strict(),
+  z.object({
+    method: z.literal("write"),
+    streamId: RuntimeId,
+    id: RuntimeId.optional(),
+    offset: Cursor,
+    base64: z.string().max(44e3),
+    end: z.boolean().optional()
+  }).strict(),
+  z.object({ method: z.literal("read"), streamId: RuntimeId, id: RuntimeId.optional(), after: Cursor }).strict(),
+  z.object({ method: z.literal("close"), streamId: RuntimeId, id: RuntimeId.optional() }).strict()
+]);
+class PersonalTcpError extends Error {
+  constructor(code) {
+    super(code);
+    this.code = code;
+  }
+  code;
+}
+class PersonalTcpManager {
+  constructor(directory, authorizeConnect) {
+    this.authorizeConnect = authorizeConnect;
+    privateDirectory(directory);
+    const file = path.join(directory, "streams.sqlite");
+    try {
+      closeSync(openSync(file, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW, 384));
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+    }
+    for (const candidate of [file, `${file}-wal`, `${file}-shm`]) {
+      try {
+        const stat = lstatSync(candidate);
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 || stat.uid !== process.getuid?.() || stat.mode & 63)
+          throw new PersonalTcpError("insecure_tcp_store");
+      } catch (error) {
+        if (error.code !== "ENOENT") throw error;
+      }
+    }
+    this.db = new Database(file);
+    this.db.exec(`PRAGMA journal_mode=WAL; PRAGMA synchronous=FULL;
+      CREATE TABLE IF NOT EXISTS streams(id TEXT PRIMARY KEY,session TEXT NOT NULL,port INTEGER NOT NULL,state TEXT NOT NULL,write_offset INTEGER NOT NULL DEFAULT 0,read_offset INTEGER NOT NULL DEFAULT 0,ack_offset INTEGER NOT NULL DEFAULT 0,eof INTEGER NOT NULL DEFAULT 0);
+      CREATE TABLE IF NOT EXISTS writes(stream TEXT NOT NULL,offset INTEGER NOT NULL,hash TEXT NOT NULL,next_offset INTEGER NOT NULL,state TEXT NOT NULL,PRIMARY KEY(stream,offset));
+      CREATE TABLE IF NOT EXISTS chunks(stream TEXT NOT NULL,offset INTEGER NOT NULL,data BLOB NOT NULL,PRIMARY KEY(stream,offset));
+      CREATE TABLE IF NOT EXISTS reads(id TEXT PRIMARY KEY,stream TEXT NOT NULL,after_offset INTEGER NOT NULL,result TEXT NOT NULL);
+      UPDATE streams SET state='unknown' WHERE state IN ('connecting','open');
+      UPDATE writes SET state='unknown' WHERE state='pending';`);
+  }
+  authorizeConnect;
+  db;
+  sockets = /* @__PURE__ */ new Map();
+  stream(sessionId, id) {
+    const row = this.db.query("SELECT * FROM streams WHERE id=?").get(id);
+    if (!row || row.session !== sessionId) throw new PersonalTcpError("tcp_stream_not_found");
+    return row;
+  }
+  async dispatch(sessionId, raw) {
+    RuntimeId.parse(sessionId);
+    const command = Command.parse(raw), id = command.streamId;
+    if (command.method === "connect") {
+      const previous2 = this.db.query("SELECT * FROM streams WHERE id=?").get(id);
+      if (previous2) {
+        if (previous2.session !== sessionId || previous2.port !== command.port) throw new PersonalTcpError("tcp_stream_identity_changed");
+        if (previous2.state !== "open" || !this.sockets.has(id)) throw new PersonalTcpError("tcp_stream_unknown_or_closed");
+        return { streamId: id, connected: true };
+      }
+      if (this.sockets.size >= 16) throw new PersonalTcpError("tcp_stream_capacity");
+      await this.authorizeConnect?.(sessionId, command.port);
+      if (this.db.query("SELECT id FROM streams WHERE id=?").get(id)) return this.dispatch(sessionId, raw);
+      this.db.query("INSERT INTO streams(id,session,port,state) VALUES(?,?,?,'connecting')").run(id, sessionId, command.port);
+      const socket = new net.Socket({ allowHalfOpen: true });
+      socket.setTimeout(5 * 60 * 1e3, () => socket.destroy(new PersonalTcpError("tcp_stream_idle")));
+      this.sockets.set(id, socket);
+      socket.on("data", (data) => {
+        const row2 = this.stream(sessionId, id);
+        if (row2.read_offset - row2.ack_offset + data.length > 8 * 1024 * 1024) {
+          this.db.query("UPDATE streams SET state='unknown' WHERE id=?").run(id);
+          socket.destroy();
+          return;
+        }
+        this.db.transaction(() => {
+          this.db.query("INSERT INTO chunks VALUES(?,?,?)").run(id, row2.read_offset, data);
+          this.db.query("UPDATE streams SET read_offset=read_offset+? WHERE id=?").run(data.length, id);
+        })();
+      });
+      socket.on("end", () => this.db.query("UPDATE streams SET eof=1 WHERE id=?").run(id));
+      socket.on("error", () => this.db.query("UPDATE streams SET state='unknown' WHERE id=?").run(id));
+      socket.on("close", () => {
+        this.sockets.delete(id);
+        this.db.query("UPDATE streams SET state=CASE WHEN state='unknown' THEN state ELSE 'closed' END,eof=1 WHERE id=?").run(id);
+      });
+      try {
+        await new Promise((resolve, reject) => {
+          const timer = setTimeout(() => {
+            socket.destroy();
+            reject(new PersonalTcpError("tcp_connect_timeout"));
+          }, 1e4);
+          socket.once("connect", () => {
+            clearTimeout(timer);
+            resolve();
+          });
+          socket.once("error", () => {
+            clearTimeout(timer);
+            reject(new PersonalTcpError("tcp_connect_failed"));
+          });
+          socket.connect({
+            host: "localhost",
+            port: command.port,
+            autoSelectFamily: true,
+            lookup: (_host, _options, callback) => callback(null, [
+              { address: "::1", family: 6 },
+              { address: "127.0.0.1", family: 4 }
+            ])
+          });
+        });
+        this.db.query("UPDATE streams SET state='open' WHERE id=?").run(id);
+        return { streamId: id, connected: true };
+      } catch (error) {
+        this.db.query("UPDATE streams SET state='unknown' WHERE id=?").run(id);
+        throw error;
+      }
+    }
+    const row = this.stream(sessionId, id);
+    if (command.method === "close") {
+      this.db.query("UPDATE streams SET state='closed',eof=1 WHERE id=?").run(id);
+      this.sockets.get(id)?.destroy();
+      return { closed: true };
+    }
+    if (command.method === "read") {
+      if (command.id) {
+        const previous2 = this.db.query("SELECT stream,after_offset,result FROM reads WHERE id=?").get(command.id);
+        if (previous2) {
+          if (previous2.stream !== id || previous2.after_offset !== command.after) throw new PersonalTcpError("tcp_read_identity_changed");
+          return JSON.parse(previous2.result);
+        }
+      }
+      if (command.after < row.ack_offset || command.after > row.read_offset) throw new PersonalTcpError("tcp_read_cursor_invalid");
+      const chunks = this.db.query("SELECT offset,data FROM chunks WHERE stream=? AND offset+length(data)>? ORDER BY offset").all(id, command.after);
+      let remaining = 32768;
+      const selected = [];
+      for (const chunk of chunks) {
+        const value = Buffer.from(chunk.data).subarray(
+          Math.max(0, command.after - chunk.offset),
+          Math.max(0, command.after - chunk.offset) + remaining
+        );
+        selected.push(value);
+        remaining -= value.length;
+        if (!remaining) break;
+      }
+      this.db.transaction(() => {
+        this.db.query("UPDATE streams SET ack_offset=? WHERE id=?").run(command.after, id);
+        this.db.query("DELETE FROM chunks WHERE stream=? AND offset+length(data)<=?").run(id, command.after);
+      })();
+      const data = Buffer.concat(selected), nextOffset2 = command.after + data.length;
+      if (row.state === "unknown" && !data.length) throw new PersonalTcpError("tcp_stream_unknown");
+      const result = { base64: data.toString("base64"), nextOffset: nextOffset2, eof: !!row.eof && nextOffset2 === row.read_offset };
+      if (command.id) this.db.query("INSERT INTO reads VALUES(?,?,?,?)").run(command.id, id, command.after, JSON.stringify(result));
+      return result;
+    }
+    const bytes = Buffer.from(command.base64, "base64");
+    if (bytes.length > 32768 || bytes.toString("base64") !== command.base64 || !bytes.length && !command.end)
+      throw new PersonalTcpError("tcp_invalid_bytes");
+    const hash = createHash("sha256").update(bytes).update(command.end ? ":end" : ":more").digest("hex");
+    const previous = this.db.query("SELECT * FROM writes WHERE stream=? AND offset=?").get(id, command.offset);
+    if (previous) {
+      if (previous.hash !== hash) throw new PersonalTcpError("tcp_write_identity_changed");
+      if (previous.state !== "completed") throw new PersonalTcpError("tcp_write_unknown");
+      return { nextOffset: previous.next_offset };
+    }
+    if (row.state !== "open" || !this.sockets.has(id)) throw new PersonalTcpError("tcp_stream_unknown_or_closed");
+    if (command.offset !== row.write_offset) throw new PersonalTcpError("tcp_write_cursor_invalid");
+    const nextOffset = command.offset + bytes.length;
+    this.db.query("INSERT INTO writes VALUES(?,?,?,?,'pending')").run(id, command.offset, hash, nextOffset);
+    try {
+      const socket = this.sockets.get(id);
+      await new Promise((resolve, reject) => {
+        socket.write(bytes, (error) => {
+          if (error) reject(new PersonalTcpError("tcp_write_unknown"));
+          else resolve();
+        });
+      });
+      if (command.end) socket.end();
+      this.db.transaction(() => {
+        this.db.query("UPDATE writes SET state='completed' WHERE stream=? AND offset=?").run(id, command.offset);
+        this.db.query("UPDATE streams SET write_offset=? WHERE id=?").run(nextOffset, id);
+      })();
+      return { nextOffset };
+    } catch (error) {
+      this.db.query("UPDATE writes SET state='unknown' WHERE stream=? AND offset=?").run(id, command.offset);
+      throw error;
+    }
+  }
+  async close() {
+    await Promise.all(
+      [...this.sockets.values()].map(
+        (socket) => new Promise((resolve) => {
+          socket.once("close", resolve);
+          socket.destroy();
+        })
+      )
+    );
+    this.db.close();
+  }
+}
+export {
+  PersonalTcpError,
+  PersonalTcpManager
+};

package/dist/mjs/runtime/adapter.mjs

@@ -0,0 +1,42 @@
+import { HostExecutorClient } from "./client.mjs";
+import { AdapterConfig, ExecutorCommand, ExecutorError, MAX_FRAME_BYTES } from "./protocol.mjs";
+import { readPrivateJson } from "./storage.mjs";
+if (import.meta.main) {
+  const path = process.argv[2];
+  if (!path || process.argv.length !== 3) throw new Error("Usage: bun adapter.ts /absolute/private/adapter-config.json");
+  const client = new HostExecutorClient(AdapterConfig.parse(readPrivateJson(path)));
+  let buffer = Buffer.alloc(0);
+  process.stdin.on("data", (chunk) => {
+    buffer = Buffer.concat([buffer, chunk]);
+    if (buffer.length > MAX_FRAME_BYTES) process.exit(1);
+    while (buffer.includes(10)) {
+      const newline = buffer.indexOf(10);
+      const line = buffer.subarray(0, newline);
+      buffer = buffer.subarray(newline + 1);
+      void (async () => {
+        let id;
+        let method;
+        try {
+          const message = JSON.parse(line.toString("utf8"));
+          if (typeof message.id !== "string" || message.id.length > 200) throw new ExecutorError("invalid_request");
+          id = message.id;
+          const command = ExecutorCommand.parse(message.command);
+          method = command.method;
+          const result = await client.request(command);
+          process.stdout.write(JSON.stringify({ id, ok: true, result }) + "\n");
+        } catch (error) {
+          process.stdout.write(
+            JSON.stringify({
+              id,
+              ok: false,
+              error: {
+                code: error instanceof ExecutorError ? error.code : "invalid_request",
+                ...method === "start" && error instanceof ExecutorError && error.rejectedBeforeAdmission && (error.code === "stale_fence" || error.code === "capacity_busy") ? { rejectedBeforeAdmission: true } : {}
+              }
+            }) + "\n"
+          );
+        }
+      })();
+    }
+  });
+}

package/dist/mjs/runtime/client.mjs

@@ -0,0 +1,95 @@
+import { randomUUID } from "node:crypto";
+import { lstatSync } from "node:fs";
+import { createConnection } from "node:net";
+import {
+  AdapterConfig,
+  ExecutorError,
+  isStartNonAdmissionCode,
+  MAX_FRAME_BYTES
+} from "./protocol.mjs";
+class HostExecutorClient {
+  config;
+  constructor(config) {
+    this.config = AdapterConfig.parse(config);
+  }
+  request(command) {
+    const stat = lstatSync(this.config.socketPath);
+    if (!stat.isSocket() || stat.uid !== process.getuid?.() || stat.mode & 63) throw new ExecutorError("insecure_socket");
+    const request = JSON.stringify({
+      protocol: 1,
+      requestId: randomUUID(),
+      auth: { principalId: this.config.principalId, token: this.config.token },
+      hello: this.config.hello,
+      command
+    }) + "\n";
+    if (Buffer.byteLength(request) > MAX_FRAME_BYTES) throw new ExecutorError("request_too_large");
+    return new Promise((resolve, reject) => {
+      const socket = createConnection(this.config.socketPath);
+      let buffer = Buffer.alloc(0);
+      let settled = false;
+      const finish = (error, value) => {
+        if (settled) return;
+        settled = true;
+        socket.destroy();
+        if (error) reject(error);
+        else resolve(value);
+      };
+      socket.setTimeout(this.config.timeoutMs, () => finish(new ExecutorError("transport_outcome_unknown")));
+      socket.once("connect", () => socket.write(request));
+      socket.on("error", () => finish(new ExecutorError("transport_outcome_unknown")));
+      socket.once("close", () => finish(new ExecutorError("transport_outcome_unknown")));
+      socket.on("data", (chunk) => {
+        buffer = Buffer.concat([buffer, chunk]);
+        if (buffer.length > MAX_FRAME_BYTES) {
+          finish(new ExecutorError("invalid_response"));
+          return;
+        }
+        if (!buffer.includes(10)) return;
+        try {
+          const response = JSON.parse(buffer.toString("utf8"));
+          if (response.ok === true) finish(void 0, response.result);
+          else
+            finish(
+              new ExecutorError(
+                response.error?.code ?? "invalid_response",
+                void 0,
+                response.ok === false && command.method === "start" && isStartNonAdmissionCode(response.error?.code) && response.error?.rejectedBeforeAdmission === true
+              )
+            );
+        } catch {
+          finish(new ExecutorError("invalid_response"));
+        }
+      });
+    });
+  }
+  status() {
+    return this.request({ method: "status" });
+  }
+  registerAdapter(grant) {
+    return this.request({ method: "adapter.register", grant });
+  }
+  retireAdapter(principalId) {
+    return this.request({ method: "adapter.retire", principalId });
+  }
+  setAuthority(fence, validUntil) {
+    return this.request({ method: "authority", fence, validUntil });
+  }
+  start(operation) {
+    return this.request({ method: "start", operation });
+  }
+  poll(run, stdoutOffset = 0, stderrOffset = 0, maxBytes = 32768) {
+    return this.request({ method: "poll", run, stdoutOffset, stderrOffset, maxBytes });
+  }
+  write(run, actionId, data, eof = false) {
+    return this.request({ method: "write", run, actionId, data, eof });
+  }
+  resize(run, actionId, cols, rows) {
+    return this.request({ method: "resize", run, actionId, cols, rows });
+  }
+  cancel(run, actionId) {
+    return this.request({ method: "cancel", run, actionId });
+  }
+}
+export {
+  HostExecutorClient
+};

package/dist/mjs/runtime/daemon.mjs

@@ -0,0 +1,131 @@
+import { chmodSync, lstatSync, unlinkSync } from "node:fs";
+import { createServer } from "node:net";
+import { join } from "node:path";
+import { HostExecutor } from "./executor.mjs";
+import { ExecutorConfig, ExecutorError, MAX_FRAME_BYTES } from "./protocol.mjs";
+import { readPrivateJson } from "./storage.mjs";
+import { preflightNativePty } from "./pty.mjs";
+async function startHostExecutor(input) {
+  if (process.platform === "win32") throw new ExecutorError("unsupported_platform");
+  const config = ExecutorConfig.parse(input);
+  let pty;
+  try {
+    pty = await import("node-pty");
+  } catch {
+  }
+  if (pty) preflightNativePty();
+  const executor = new HostExecutor(config, pty);
+  const socketPath = join(config.stateDir, "executor.sock");
+  const sockets = /* @__PURE__ */ new Set();
+  let closing;
+  let pending = 0;
+  const server = createServer((socket) => {
+    if (sockets.size >= 72) {
+      socket.destroy();
+      return;
+    }
+    sockets.add(socket);
+    socket.on("close", () => sockets.delete(socket));
+    socket.on("error", () => {
+    });
+    socket.setTimeout(1e4, () => socket.destroy());
+    let bytes = Buffer.alloc(0);
+    let received = false;
+    socket.on("data", (chunk) => {
+      if (received) {
+        socket.destroy();
+        return;
+      }
+      bytes = Buffer.concat([bytes, chunk]);
+      if (bytes.length > MAX_FRAME_BYTES) {
+        socket.destroy();
+        return;
+      }
+      const newline = bytes.indexOf(10);
+      if (newline < 0) return;
+      received = true;
+      if (newline !== bytes.length - 1) {
+        socket.destroy();
+        return;
+      }
+      let request;
+      try {
+        request = JSON.parse(bytes.subarray(0, newline).toString("utf8"));
+      } catch {
+        socket.end(JSON.stringify({ ok: false, error: { code: "invalid_request" } }) + "\n");
+        return;
+      }
+      const authorityHint = request?.command?.method === "authority";
+      if (pending >= 72 || pending >= 64 && !authorityHint) {
+        socket.end(JSON.stringify({ ok: false, error: { code: "ipc_busy" } }) + "\n");
+        return;
+      }
+      pending++;
+      void executor.handle(request).then(
+        (result) => socket.end(JSON.stringify({ ok: true, result }) + "\n"),
+        (error) => socket.end(
+          JSON.stringify({
+            ok: false,
+            error: {
+              code: error instanceof ExecutorError ? error.code : "invalid_request",
+              ...request?.command?.method === "start" && error instanceof ExecutorError && error.rejectedBeforeAdmission && (error.code === "stale_fence" || error.code === "capacity_busy") ? { rejectedBeforeAdmission: true } : {}
+            }
+          }) + "\n"
+        )
+      ).finally(() => {
+        pending--;
+      });
+    });
+  });
+  try {
+    try {
+      const stat = lstatSync(socketPath);
+      if (!stat.isSocket() || stat.uid !== process.getuid?.()) throw new ExecutorError("unsafe_socket_path");
+      unlinkSync(socketPath);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    await new Promise((resolve, reject) => {
+      server.once("error", reject);
+      server.listen(socketPath, () => {
+        server.removeListener("error", reject);
+        resolve();
+      });
+    });
+    chmodSync(socketPath, 384);
+  } catch (error) {
+    await executor.close();
+    throw error;
+  }
+  return {
+    executor,
+    socketPath,
+    close() {
+      return closing ??= (async () => {
+        for (const socket of sockets) socket.destroy();
+        await new Promise((resolve) => server.close(() => resolve()));
+        await executor.close();
+      })();
+    }
+  };
+}
+if (import.meta.main) {
+  const path = process.argv[2];
+  if (!path || process.argv.length !== 3) throw new Error("Usage: bun daemon.ts /absolute/private/executor-config.json");
+  const daemon = await startHostExecutor(ExecutorConfig.parse(readPrivateJson(path)));
+  process.stdout.write(JSON.stringify({ ready: true, pid: process.pid, protocol: 1 }) + "\n");
+  let stopping = false;
+  const stop = () => {
+    if (stopping) return;
+    stopping = true;
+    void daemon.close().then(
+      () => process.exit(0),
+      () => process.exit(1)
+    );
+  };
+  process.on("SIGTERM", stop);
+  process.on("SIGINT", stop);
+}
+export {
+  startHostExecutor
+};