@runweave/server-linux-x64 0.1.19 → 0.1.20

package/payload/pty-host/index.cjs

@@ -14611,27 +14611,49 @@ function assertWindowsPrivatePath(file) {
   if (process.platform !== "win32") return;
   const script = `
 $ErrorActionPreference = 'Stop'
+try {
 # Use .NET directly: a parent pwsh may export a PSModulePath incompatible with Windows PowerShell.
 $acl = if ([IO.Directory]::Exists($env:RUNWEAVE_PRIVATE_PATH)) {
   [IO.Directory]::GetAccessControl($env:RUNWEAVE_PRIVATE_PATH)
 } else { [IO.File]::GetAccessControl($env:RUNWEAVE_PRIVATE_PATH) }
 $sid = [Security.Principal.WindowsIdentity]::GetCurrent().User
 $allowed = @($sid.Value, 'S-1-5-18', 'S-1-5-32-544')
-if ($acl.GetOwner([Security.Principal.SecurityIdentifier]).Value -notin $allowed) { throw 'owner' }
+if ($acl.GetOwner([Security.Principal.SecurityIdentifier]).Value -notin $allowed) { [Console]::Write('owner'); exit 0 }
 foreach ($rule in $acl.GetAccessRules($true, $true, [Security.Principal.SecurityIdentifier])) {
-  if ($rule.AccessControlType -eq 'Allow' -and $rule.IdentityReference.Value -notin $allowed) { throw 'access' }
+  if ($rule.AccessControlType -eq 'Allow' -and $rule.IdentityReference.Value -notin $allowed) { [Console]::Write('access'); exit 0 }
+}
+[Console]::Write('private')
+} catch {
+  [Console]::Write('check-failed:' + $_.Exception.GetType().FullName + ':' + $_.Exception.HResult)
 }
 `;
+  const startedAt = performance.now();
+  let result;
   try {
-    (0, import_node_child_process.execFileSync)("powershell.exe", ["-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], {
+    result = (0, import_node_child_process.execFileSync)("powershell.exe", ["-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], {
       env: { ...process.env, RUNWEAVE_PRIVATE_PATH: file },
-      stdio: "ignore",
+      stdio: ["ignore", "pipe", "pipe"],
+      encoding: "utf8",
+      maxBuffer: 64 * 1024,
       timeout: 1e4,
       windowsHide: true
-    });
-  } catch {
-    throw new ConfigurationError("CONFIG_WINDOWS_ACL_NOT_PRIVATE", [file]);
+    }).trim();
+  } catch (cause) {
+    const error = cause;
+    throw new ConfigurationError(
+      error.code === "ETIMEDOUT" ? "CONFIG_WINDOWS_ACL_CHECK_TIMEOUT" : "CONFIG_WINDOWS_ACL_CHECK_FAILED",
+      [
+        file,
+        `exit=${error.status ?? "none"}`,
+        `signal=${error.signal ?? "none"}`,
+        `code=${error.code ?? "none"}`,
+        `elapsedMs=${Math.round(performance.now() - startedAt)}`
+      ]
+    );
   }
+  if (result === "owner" || result === "access") throw new ConfigurationError("CONFIG_WINDOWS_ACL_NOT_PRIVATE", [file, result]);
+  if (/^check-failed:[A-Za-z0-9_.]+:-?\d+$/.test(result)) throw new ConfigurationError("CONFIG_WINDOWS_ACL_CHECK_FAILED", [file, result]);
+  if (result !== "private") throw new ConfigurationError("CONFIG_WINDOWS_ACL_CHECK_FAILED", [file, "invalid-result"]);
 }
 
 // packages/config-node/src/private-file.ts
@@ -19669,8 +19691,14 @@ var TerminalOutputScreen = class _TerminalOutputScreen {
     if (this.disposed) return;
     this.pendingBytes += frame.range.toOffset - frame.range.fromOffset;
     if (this.pendingBytes > RESUME_MAX_BYTES || this.queue.length >= 8192) {
+      const failure = {
+        code: this.pendingBytes > RESUME_MAX_BYTES ? "HOST_MIRROR_PENDING_LIMIT" : "HOST_MIRROR_QUEUE_LIMIT",
+        bufferedBytes: this.pendingBytes,
+        limitBytes: RESUME_MAX_BYTES,
+        queuedOperations: this.queue.length
+      };
       this.dispose();
-      this.onFailure();
+      this.onFailure(failure);
       return;
     }
     this.queue.push({ frame });
@@ -19775,8 +19803,14 @@ var TerminalOutputScreen = class _TerminalOutputScreen {
         this.writing = false;
         this.partialControlBytes = screenParserIsIdle(this.terminal) ? 0 : this.partialControlBytes + frame.range.toOffset - frame.range.fromOffset;
         if (this.partialControlBytes > RESUME_MAX_BYTES) {
+          const failure = {
+            code: "HOST_MIRROR_CONTROL_LIMIT",
+            bufferedBytes: this.partialControlBytes,
+            limitBytes: RESUME_MAX_BYTES,
+            queuedOperations: this.queue.length
+          };
           this.dispose();
-          this.onFailure();
+          this.onFailure(failure);
           return;
         }
         this.completeSnapshot?.();
@@ -19794,6 +19828,43 @@ var TERMINAL_LIVE_SCROLLBACK_BYTES = 512 * 1024;
 var TERMINAL_COMPACTED_SCROLLBACK_BYTES = 8 * 1024 * 1024;
 var TERMINAL_PERSISTED_SCROLLBACK_BYTES = 10 * 1024 * 1024;
 
+// packages/pty-host/src/diagnostics.ts
+function hostErrorCode(error) {
+  if (!(error instanceof Error)) return "HOST_OPERATION_FAILED";
+  const code = error.code;
+  if (code && /^(?:E[A-Z0-9_]+|HOST_[A-Z0-9_]+)$/.test(code)) return code;
+  return /^HOST_[A-Z0-9_]+$/.test(error.message) ? error.message : "HOST_OPERATION_FAILED";
+}
+var actions = /* @__PURE__ */ new Set([
+  "hello",
+  "claimWriter",
+  "listSessions",
+  "createSession",
+  "setUpstreams",
+  "freeze",
+  "stop",
+  "writeInput",
+  "getInputOperation",
+  "getSnapshot",
+  "readOutput",
+  "resize",
+  "signal",
+  "closeSession",
+  "attachSession"
+]);
+function diagnosticAction(action) {
+  return actions.has(action) ? action : "unknown";
+}
+function writeHostDiagnostic(diagnostic) {
+  process.stderr.write(JSON.stringify({ timestamp: (/* @__PURE__ */ new Date()).toISOString(), ...diagnostic }) + "\n");
+}
+function reportHostDiagnostic(sink, diagnostic) {
+  try {
+    sink(diagnostic);
+  } catch {
+  }
+}
+
 // packages/pty-host/src/sessions.ts
 var requireNative = (0, import_node_module.createRequire)((0, import_node_url.fileURLToPath)(__IMPORT_META_URL__));
 var HostSession = class {
@@ -19813,8 +19884,14 @@ var HostSession = class {
       rows: options.rows,
       nextSequence: 1
     };
-    this.screen = new TerminalOutputScreen(this.buffer.cursor, () => {
+    this.screen = new TerminalOutputScreen(this.buffer.cursor, (failure) => {
       this.degraded = true;
+      reportHostDiagnostic(writeHostDiagnostic, {
+        event: "pty-host.mirror.failed",
+        hostInstanceId,
+        terminalSessionId: options.terminalSessionId,
+        ...failure
+      });
     }, TERMINAL_CLIENT_SCROLLBACK_LINES);
     this.screen.resize(options.cols, options.rows);
     this.inputs = new InputOperations((data) => this.terminal.write(data), () => this.info.status === "running", () => this.processGeneration);
@@ -19943,12 +20020,20 @@ var HostSession = class {
 };
 
 // packages/pty-host/src/transport.ts
+var HostTransportError = class extends Error {
+  constructor(code, bufferedBytes, limitBytes = 4 * 1024 * 1024) {
+    super(code);
+    this.code = code;
+    this.bufferedBytes = bufferedBytes;
+    this.limitBytes = limitBytes;
+  }
+};
 function receiveJsonLines(socket, onMessage) {
   let source = "";
   socket.setEncoding("utf8");
   socket.on("data", (data) => {
     source += data;
-    if (Buffer.byteLength(source) > 4 * 1024 * 1024) return socket.destroy(new Error("HOST_MESSAGE_TOO_LARGE"));
+    if (Buffer.byteLength(source) > 4 * 1024 * 1024) return socket.destroy(new HostTransportError("HOST_MESSAGE_TOO_LARGE", Buffer.byteLength(source)));
     let end;
     while ((end = source.indexOf("\n")) !== -1) {
       const line = source.slice(0, end);
@@ -19965,7 +20050,7 @@ function receiveJsonLines(socket, onMessage) {
 function sendJson(socket, message) {
   if (socket.destroyed) return false;
   if (socket.writableLength > 4 * 1024 * 1024) {
-    socket.destroy(new Error("HOST_OUTPUT_GAP"));
+    socket.destroy(new HostTransportError("HOST_OUTPUT_GAP", socket.writableLength));
     return false;
   }
   socket.write(JSON.stringify(message) + "\n");
@@ -20030,10 +20115,21 @@ async function startHost(scope, release) {
   };
   const server = (0, import_node_net.createServer)((socket) => {
     sockets.add(socket);
-    socket.on("error", () => {
+    const connectionId = (0, import_node_crypto7.randomUUID)();
+    let socketError;
+    socket.on("error", (error) => {
+      socketError = error;
     });
     const subscriptions = /* @__PURE__ */ new Map();
     socket.on("close", () => {
+      reportHostDiagnostic(writeHostDiagnostic, {
+        event: "pty-host.connection.closed",
+        hostInstanceId,
+        connectionId,
+        code: socketError ? hostErrorCode(socketError) : "HOST_PEER_CLOSED",
+        writableBytes: socket.writableLength,
+        ...socketError instanceof HostTransportError ? { bufferedBytes: socketError.bufferedBytes, limitBytes: socketError.limitBytes } : {}
+      });
       sockets.delete(socket);
       for (const unsubscribe of subscriptions.values()) unsubscribe();
     });
@@ -20044,11 +20140,24 @@ async function startHost(scope, release) {
         return;
       }
       const request = parsed.data;
+      const startedAt = performance.now();
       const reply = (result) => sendJson(socket, { requestId: request.requestId, result });
-      const fail = (error) => sendJson(socket, {
-        requestId: request.requestId,
-        error: error instanceof external_exports.ZodError ? "HOST_MESSAGE_INVALID" : error.message
-      });
+      const fail = (error) => {
+        reportHostDiagnostic(writeHostDiagnostic, {
+          event: "pty-host.request.failed",
+          hostInstanceId,
+          connectionId,
+          requestId: request.requestId,
+          action: diagnosticAction(request.action),
+          code: error instanceof external_exports.ZodError ? "HOST_MESSAGE_INVALID" : hostErrorCode(error),
+          elapsedMs: Math.round(performance.now() - startedAt),
+          writableBytes: socket.writableLength
+        });
+        return sendJson(socket, {
+          requestId: request.requestId,
+          error: error instanceof external_exports.ZodError ? "HOST_MESSAGE_INVALID" : error.message
+        });
+      };
       if (!isGatewayCredential(request.token, token)) {
         fail(new Error("HOST_AUTH_FAILED"));
         socket.end();

package/payload/server/index.cjs

@@ -7354,27 +7354,49 @@ function assertWindowsPrivatePath(file) {
   if (process.platform !== "win32") return;
   const script = `
 $ErrorActionPreference = 'Stop'
+try {
 # Use .NET directly: a parent pwsh may export a PSModulePath incompatible with Windows PowerShell.
 $acl = if ([IO.Directory]::Exists($env:RUNWEAVE_PRIVATE_PATH)) {
   [IO.Directory]::GetAccessControl($env:RUNWEAVE_PRIVATE_PATH)
 } else { [IO.File]::GetAccessControl($env:RUNWEAVE_PRIVATE_PATH) }
 $sid = [Security.Principal.WindowsIdentity]::GetCurrent().User
 $allowed = @($sid.Value, 'S-1-5-18', 'S-1-5-32-544')
-if ($acl.GetOwner([Security.Principal.SecurityIdentifier]).Value -notin $allowed) { throw 'owner' }
+if ($acl.GetOwner([Security.Principal.SecurityIdentifier]).Value -notin $allowed) { [Console]::Write('owner'); exit 0 }
 foreach ($rule in $acl.GetAccessRules($true, $true, [Security.Principal.SecurityIdentifier])) {
-  if ($rule.AccessControlType -eq 'Allow' -and $rule.IdentityReference.Value -notin $allowed) { throw 'access' }
+  if ($rule.AccessControlType -eq 'Allow' -and $rule.IdentityReference.Value -notin $allowed) { [Console]::Write('access'); exit 0 }
+}
+[Console]::Write('private')
+} catch {
+  [Console]::Write('check-failed:' + $_.Exception.GetType().FullName + ':' + $_.Exception.HResult)
 }
 `;
+  const startedAt = performance.now();
+  let result;
   try {
-    (0, import_node_child_process.execFileSync)("powershell.exe", ["-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], {
+    result = (0, import_node_child_process.execFileSync)("powershell.exe", ["-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], {
       env: { ...process.env, RUNWEAVE_PRIVATE_PATH: file },
-      stdio: "ignore",
+      stdio: ["ignore", "pipe", "pipe"],
+      encoding: "utf8",
+      maxBuffer: 64 * 1024,
       timeout: 1e4,
       windowsHide: true
-    });
-  } catch {
-    throw new ConfigurationError("CONFIG_WINDOWS_ACL_NOT_PRIVATE", [file]);
+    }).trim();
+  } catch (cause) {
+    const error = cause;
+    throw new ConfigurationError(
+      error.code === "ETIMEDOUT" ? "CONFIG_WINDOWS_ACL_CHECK_TIMEOUT" : "CONFIG_WINDOWS_ACL_CHECK_FAILED",
+      [
+        file,
+        `exit=${error.status ?? "none"}`,
+        `signal=${error.signal ?? "none"}`,
+        `code=${error.code ?? "none"}`,
+        `elapsedMs=${Math.round(performance.now() - startedAt)}`
+      ]
+    );
   }
+  if (result === "owner" || result === "access") throw new ConfigurationError("CONFIG_WINDOWS_ACL_NOT_PRIVATE", [file, result]);
+  if (/^check-failed:[A-Za-z0-9_.]+:-?\d+$/.test(result)) throw new ConfigurationError("CONFIG_WINDOWS_ACL_CHECK_FAILED", [file, result]);
+  if (result !== "private") throw new ConfigurationError("CONFIG_WINDOWS_ACL_CHECK_FAILED", [file, "invalid-result"]);
 }
 
 // packages/config-node/src/private-file.ts