@sema-agent/server 1.314.0 → 1.316.0

package/dist/plugins/pg-workflow-run-store.js

@@ -1,221 +1,2 @@
-import { summarizeWorkflowRun, isTerminalWorkflowStatus, WorkflowRunStoreError } from "@sema-agent/core";
-import { foldKeyFamily, MAX_PENDING_PER_SESSION, PURGE_FENCE_MS, SERVED_FENCE_MS, } from "../orchestration/workflow-completion-inbox.js";
-import { MAX_RUN_BLOB_BYTES, slimOversizeRun } from "./tidb-workflow-run-store.js";
-export class PgWorkflowRunStore {
-    pool;
-    constructor(pool) {
-        this.pool = pool;
-    }
-    async put(id, run) {
-        const stored = { ...run, id, rev: run.rev ?? 0 };
-        try {
-            await this.pool.query("INSERT INTO workflow_run (id, scope, status, run, rev, created_at, ended_at) VALUES ($1,$2,$3,$4,$5,$6,$7)", [id, run.scope, run.status, JSON.stringify(stored), stored.rev, run.createdAt, run.endedAt ?? null]);
-        }
-        catch (e) {
-            if (e.code === "23505") {
-                throw new WorkflowRunStoreError("workflow_run.already_exists", "workflow run id already exists");
-            }
-            throw e;
-        }
-    }
-    async get(id) {
-        const res = await this.pool.query("SELECT run, rev FROM workflow_run WHERE id = $1", [id]);
-        const r = res.rows[0];
-        if (!r)
-            return null;
-        const run = JSON.parse(String(r.run));
-        run.rev = Number(r.rev);
-        return run;
-    }
-    async update(id, scope, run, expect) {
-        let blob = JSON.stringify({ ...run, id, scope });
-        if (Buffer.byteLength(blob) > MAX_RUN_BLOB_BYTES) {
-            const slim = slimOversizeRun({ ...run, id, scope }, MAX_RUN_BLOB_BYTES);
-            if (slim === null)
-                return false;
-            blob = slim;
-        }
-        const res = await this.pool.query(`UPDATE workflow_run SET run = $1, rev = rev + 1, status = $2, ended_at = $3 WHERE id = $4 AND scope = $5${expect !== undefined ? " AND rev = $6" : ""}`, expect !== undefined ? [blob, run.status, run.endedAt ?? null, id, scope, expect.rev] : [blob, run.status, run.endedAt ?? null, id, scope]);
-        return res.rowCount === 1;
-    }
-    async listByScope(scope, opts) {
-        const params = [scope];
-        let where = "scope = $1";
-        if (opts?.status !== undefined) {
-            params.push(opts.status);
-            where += ` AND status = $${params.length}`;
-        }
-        if (opts?.session !== undefined) {
-            params.push(opts.session);
-            where += ` AND run::json->>'originatingSessionId' = $${params.length}`;
-        }
-        let limit = "";
-        if (opts?.limit !== undefined) {
-            params.push(Math.max(0, opts.limit));
-            limit = ` LIMIT $${params.length}`;
-        }
-        const res = await this.pool.query(`SELECT run, rev FROM workflow_run WHERE ${where} ORDER BY created_at DESC, id DESC${limit}`, params);
-        return res.rows.map((r) => {
-            const run = JSON.parse(String(r.run));
-            run.rev = Number(r.rev);
-            return summarizeWorkflowRun(run);
-        });
-    }
-    async reapAllScopes(now, opts) {
-        const res = await this.pool.query("SELECT DISTINCT scope FROM workflow_run");
-        let total = 0;
-        for (const r of res.rows)
-            total += await this.reap(r.scope, now, opts);
-        return total;
-    }
-    async reap(scope, now, opts) {
-        if (opts?.maxAgeMs === undefined && opts?.keep === undefined)
-            return 0;
-        const res = await this.pool.query("SELECT id, status, created_at, ended_at FROM workflow_run WHERE scope = $1 ORDER BY created_at DESC, id DESC", [scope]);
-        const rows = res.rows;
-        const terminal = rows.filter((r) => isTerminalWorkflowStatus(r.status));
-        const doomed = [];
-        for (let i = 0; i < terminal.length; i++) {
-            const r = terminal[i];
-            const anchor = r.ended_at != null ? Number(r.ended_at) : Number(r.created_at);
-            const tooOld = opts.maxAgeMs !== undefined && anchor < now - opts.maxAgeMs;
-            const overKeep = opts.keep !== undefined && i >= opts.keep;
-            if (tooOld || overKeep)
-                doomed.push(r.id);
-        }
-        if (doomed.length === 0)
-            return 0;
-        const del = await this.pool.query(`DELETE FROM workflow_run WHERE scope = $1 AND id = ANY($2::text[])`, [scope, doomed]);
-        return del.rowCount ?? 0;
-    }
-}
-const KIND_SERVED = "served";
-const KIND_PURGE = "purge";
-export class PgWorkflowCompletionInbox {
-    pool;
-    onWarn;
-    constructor(pool, onWarn) {
-        this.pool = pool;
-        this.onWarn = onWarn;
-    }
-    async sweepFences(now) {
-        await this.pool.query("DELETE FROM workflow_inbox_fence WHERE until_ms < $1", [now]);
-    }
-    async enqueue(entry) {
-        const now = Date.now();
-        await this.sweepFences(now);
-        const served = await this.pool.query("SELECT 1 FROM workflow_inbox_fence WHERE session_id = $1 AND kind = $2 AND run_id IN ($3, $4) AND until_ms >= $5", [entry.sessionId, KIND_SERVED, entry.runId, foldKeyFamily(entry.runId), now]);
-        if ((served.rowCount ?? 0) > 0) {
-            this.onWarn?.("workflow_completion_enqueue_after_poll_served", { sessionId: entry.sessionId, runId: entry.runId });
-            return;
-        }
-        const purge = await this.pool.query("SELECT owner, owner_known FROM workflow_inbox_fence WHERE session_id = $1 AND kind = $2 AND run_id = '' AND until_ms >= $3", [entry.sessionId, KIND_PURGE, now]);
-        const pf = purge.rows[0];
-        if (pf && (Number(pf.owner_known) === 0 || (pf.owner === null ? entry.owner === null : pf.owner === entry.owner))) {
-            this.onWarn?.("workflow_completion_enqueue_after_purge", { sessionId: entry.sessionId, runId: entry.runId });
-            return;
-        }
-        await this.pool.query("INSERT INTO workflow_completion_inbox (session_id, run_id, owner, status, summary, enqueued_at, kind, payload) VALUES ($1,$2,$3,$4,$5,$6,$7,$8) " +
-            "ON CONFLICT (session_id, run_id) DO UPDATE SET seq = nextval(pg_get_serial_sequence('workflow_completion_inbox','seq')), " +
-            "owner = EXCLUDED.owner, status = EXCLUDED.status, summary = EXCLUDED.summary, enqueued_at = EXCLUDED.enqueued_at, kind = EXCLUDED.kind, payload = EXCLUDED.payload", [entry.sessionId, entry.runId, entry.owner, entry.status, entry.summary, entry.enqueuedAt, entry.kind ?? null, entry.payload ?? null]);
-        const confirm = await this.pool.query("SELECT kind, owner, owner_known FROM workflow_inbox_fence WHERE session_id = $1 AND until_ms >= $2 AND (run_id IN ($3, $4) OR (kind = $5 AND run_id = ''))", [entry.sessionId, now, entry.runId, foldKeyFamily(entry.runId), KIND_PURGE]);
-        for (const f of confirm.rows) {
-            const isServed = f.kind === KIND_SERVED;
-            const purgeFencesUs = !isServed && (Number(f.owner_known) === 0 || (f.owner === null ? entry.owner === null : f.owner === entry.owner));
-            if (isServed || purgeFencesUs) {
-                await this.ack(entry.sessionId, entry.runId);
-                this.onWarn?.(isServed ? "workflow_completion_enqueue_after_poll_served" : "workflow_completion_enqueue_after_purge", {
-                    sessionId: entry.sessionId,
-                    runId: entry.runId,
-                });
-                return;
-            }
-        }
-        const over = await this.pool.query("SELECT seq, run_id FROM workflow_completion_inbox WHERE session_id = $1 ORDER BY seq DESC OFFSET $2", [entry.sessionId, MAX_PENDING_PER_SESSION]);
-        const overRows = over.rows;
-        if (overRows.length > 0) {
-            await this.pool.query("DELETE FROM workflow_completion_inbox WHERE session_id = $1 AND seq = ANY($2::bigint[])", [
-                entry.sessionId,
-                overRows.map((r) => r.seq),
-            ]);
-            for (const r of overRows)
-                this.onWarn?.("workflow_completion_inbox_overflow", { sessionId: entry.sessionId, droppedRunId: r.run_id });
-        }
-    }
-    async pending(sessionId) {
-        const res = await this.pool.query("SELECT i.run_id, i.owner, i.status, i.summary, i.enqueued_at, i.kind, i.payload FROM workflow_completion_inbox i " +
-            "WHERE i.session_id = $1 AND NOT EXISTS (SELECT 1 FROM workflow_inbox_fence f WHERE f.session_id = i.session_id AND f.kind = $2 AND f.run_id IN (i.run_id, regexp_replace(i.run_id, '#[0-9]+$', '')) AND f.until_ms >= $3) " +
-            "ORDER BY i.seq ASC", [sessionId, KIND_SERVED, Date.now()]);
-        return res.rows.map((r) => ({
-            sessionId,
-            runId: r.run_id,
-            owner: r.owner,
-            status: r.status,
-            summary: r.summary,
-            enqueuedAt: Number(r.enqueued_at),
-            ...(r.kind != null ? { kind: r.kind } : {}),
-            ...(r.payload != null ? { payload: r.payload } : {}),
-        }));
-    }
-    async ack(sessionId, runId) {
-        await this.pool.query("DELETE FROM workflow_completion_inbox WHERE session_id = $1 AND run_id = $2", [sessionId, runId]);
-    }
-    async purge(sessionId, purgedOwner) {
-        const now = Date.now();
-        await this.sweepFences(now);
-        await this.pool.query("INSERT INTO workflow_inbox_fence (session_id, kind, run_id, owner, owner_known, until_ms) VALUES ($1,$2,'',$3,$4,$5) " +
-            "ON CONFLICT (session_id, kind, run_id) DO UPDATE SET owner = EXCLUDED.owner, owner_known = EXCLUDED.owner_known, until_ms = EXCLUDED.until_ms", [sessionId, KIND_PURGE, purgedOwner ?? null, purgedOwner !== undefined ? 1 : 0, now + PURGE_FENCE_MS]);
-        await this.pool.query("DELETE FROM workflow_completion_inbox WHERE session_id = $1", [sessionId]);
-    }
-    async markTerminalServed(sessionId, runId) {
-        const now = Date.now();
-        await this.sweepFences(now);
-        await this.pool.query("INSERT INTO workflow_inbox_fence (session_id, kind, run_id, owner, owner_known, until_ms) VALUES ($1,$2,$3,NULL,0,$4) " +
-            "ON CONFLICT (session_id, kind, run_id) DO UPDATE SET until_ms = EXCLUDED.until_ms", [sessionId, KIND_SERVED, runId, now + SERVED_FENCE_MS]);
-        await this.ack(sessionId, runId);
-        await this.pool.query("DELETE FROM workflow_completion_inbox WHERE session_id = $1 AND run_id <> $2 AND regexp_replace(run_id, '#[0-9]+$', '') = $3", [sessionId, runId, runId]);
-    }
-}
-export class PgWorkflowNotifyJournalStore {
-    pool;
-    constructor(pool) {
-        this.pool = pool;
-    }
-    async record(input) {
-        await this.pool.query("INSERT INTO workflow_notify_journal (run_id, scope, acked, source_task_id, principal, created_at) VALUES ($1,$2,0,$3,$4,$5) ON CONFLICT (run_id) DO NOTHING", [input.runId, input.scope, input.sourceTaskId ?? null, input.principal ?? null, input.createdAt]);
-    }
-    async ack(runId, ackedAt) {
-        await this.pool.query("UPDATE workflow_notify_journal SET acked = 1, acked_at = $1 WHERE run_id = $2 AND acked = 0", [ackedAt, runId]);
-    }
-    async listPending() {
-        const res = await this.pool.query("SELECT run_id, scope, source_task_id, principal, created_at FROM workflow_notify_journal WHERE acked = 0");
-        return res.rows.map((r) => ({
-            runId: r.run_id,
-            scope: r.scope,
-            acked: false,
-            ...(r.source_task_id != null ? { sourceTaskId: r.source_task_id } : {}),
-            ...(r.principal != null ? { principal: r.principal } : {}),
-            createdAt: Number(r.created_at),
-        }));
-    }
-    async reapAcked(before) {
-        const res = await this.pool.query("DELETE FROM workflow_notify_journal WHERE acked = 1 AND acked_at < $1", [before]);
-        return res.rowCount ?? 0;
-    }
-    async get(runId) {
-        const res = await this.pool.query("SELECT run_id, scope, acked, source_task_id, principal, created_at, acked_at FROM workflow_notify_journal WHERE run_id = $1", [runId]);
-        const r = res.rows[0];
-        if (!r)
-            return null;
-        return {
-            runId: r.run_id,
-            scope: r.scope,
-            acked: Number(r.acked) === 1,
-            ...(r.source_task_id != null ? { sourceTaskId: r.source_task_id } : {}),
-            ...(r.principal != null ? { principal: r.principal } : {}),
-            createdAt: Number(r.created_at),
-            ...(r.acked_at != null ? { ackedAt: Number(r.acked_at) } : {}),
-        };
-    }
-}
+export { PgWorkflowRunStore, PgWorkflowCompletionInbox, PgWorkflowNotifyJournalStore } from "./workflow-run-store-sql.js";
 //# sourceMappingURL=pg-workflow-run-store.js.map

package/dist/plugins/remote-env-k8s.d.ts

@@ -1,23 +1,7 @@
 import { FileError, ExecutionError, RemoteExecutionError, type ExecutionEnv, type RemoteExecutionEnv, type WorkspaceHandle, type FileInfo, type Result, type OutputChunk, type ExecStreamOptions, type RemoteConnectConfig, type SnapshotId, type SessionToken, type VmLifecycleOptions, type ExecutionEnvFactory, type BackgroundShellCapability, type BackgroundShellId, type BackgroundShellError, type BackgroundSpawnOptions, type BackgroundPoll } from "@sema-agent/core";
+import type { PodSpecPatch } from "./k8s-exec-protocol.js";
 type ExecOpts = Parameters<ExecutionEnv["exec"]>[1];
-export declare function buildBgRunnerScript(dir: string): string;
-export declare function buildBgLauncherScript(dir: string, cmdShB64: string, runnerShB64: string): string;
-export declare function buildBgPollScript(dir: string, stdoutCursor: number, stderrCursor: number, readCap: number): string;
-export declare function buildBgKillScript(dir: string): string;
-export declare function buildBgDisposeScript(dir: string): string;
-export declare function buildDetachCapableExec(dir: string, command: string): string;
-export interface ParsedBgPoll {
-    gone: boolean;
-    outTotal: number;
-    errTotal: number;
-    exitCode?: number;
-    alive: boolean;
-    stdout: string;
-    stdoutBytes: number;
-    stderr: string;
-    stderrBytes: number;
-}
-export declare function parseBgPollOutput(raw: string): ParsedBgPoll | undefined;
+export { buildBgRunnerScript, buildBgLauncherScript, buildBgPollScript, buildBgKillScript, buildBgDisposeScript, buildDetachCapableExec, parseBgPollOutput, type ParsedBgPoll, } from "./k8s-bg-scripts.js";
 export interface K8sEnvConfig {
     apiUrl?: string;
     token?: string;
@@ -51,19 +35,7 @@ export interface K8sEnvConfig {
     podSpecPatch?: PodSpecPatch;
     podEnv?: Record<string, string>;
 }
-export interface PodSpecPatch {
-    volumes?: unknown[];
-    volumeMounts?: unknown[];
-    podSecurityContext?: Record<string, unknown>;
-    containerSecurityContext?: Record<string, unknown>;
-    labels?: Record<string, string>;
-}
-export declare function applyPodSpecPatch(pod: {
-    metadata: {
-        labels?: Record<string, string>;
-    };
-    spec: Record<string, unknown>;
-}, patch: PodSpecPatch): void;
+export { type PodSpecPatch, applyPodSpecPatch } from "./k8s-exec-protocol.js";
 type ConnectResult = {
     ok: true;
     value: WorkspaceHandle;
@@ -87,13 +59,9 @@ export interface K8sEnvDeps {
     openExec?: (url: string, headers: Record<string, string>) => ExecSocket;
     connectOnce?: (signal?: AbortSignal) => Promise<ConnectResult>;
 }
-export declare function execSocketTlsOptions(ca: string | undefined, insecureTls: boolean): Record<string, unknown>;
+export { execSocketTlsOptions } from "./k8s-exec-protocol.js";
 export declare function errorMessageOf(e: unknown): string;
-export declare function exitCodeFromStatus(statusJson: string): {
-    exitCode: number;
-} | {
-    error: string;
-};
+export { exitCodeFromStatus } from "./k8s-exec-protocol.js";
 export declare class RemoteK8sExecutionEnv implements RemoteExecutionEnv, BackgroundShellCapability {
     readonly capabilities: {
         isolation: boolean;
@@ -207,5 +175,4 @@ export declare class RemoteK8sExecutionEnv implements RemoteExecutionEnv, Backgr
     private tempResult;
 }
 export declare function k8sExecutionEnvFactory(config: K8sEnvConfig): ExecutionEnvFactory;
-export {};
 //# sourceMappingURL=remote-env-k8s.d.ts.map

package/dist/plugins/remote-env-k8s.js

@@ -18,133 +18,8 @@ const K8S_BG_MAX_TIMEOUT_SEC = Math.max(K8S_BG_DEFAULT_TIMEOUT_SEC, Math.floor(N
 const K8S_BG_READ_CAP = Math.max(64 * 1024, Math.floor(Number(process.env.K8S_BG_READ_CAP ?? "")) || 1024 * 1024);
 const K8S_BG_FILE_CAP = Math.max(K8S_BG_READ_CAP, Math.floor(Number(process.env.K8S_BG_FILE_CAP ?? "")) || 64 * 1024 * 1024);
 const K8S_BG_MEM_CAP = Math.max(64 * 1024, Math.floor(Number(process.env.K8S_BG_MEM_CAP ?? "")) || 8 * 1024 * 1024);
-export function buildBgRunnerScript(dir) {
-    const q = (name) => shellQuote(`${dir}/${name}`);
-    return [
-        `echo $$ > ${q("pgid.tmp")} 2>/dev/null && mv ${q("pgid.tmp")} ${q("pgid")} 2>/dev/null`,
-        `sh ${q("cmd.sh")} > ${q("out")} 2> ${q("err")} < /dev/null`,
-        `__RC=$?`,
-        `echo $__RC > ${q("exit.tmp")} 2>/dev/null && mv ${q("exit.tmp")} ${q("exit")} 2>/dev/null`,
-    ].join("\n");
-}
-export function buildBgLauncherScript(dir, cmdShB64, runnerShB64) {
-    const d = shellQuote(dir);
-    const q = (name) => shellQuote(`${dir}/${name}`);
-    return [
-        `mkdir -p ${d} && chmod 700 ${d}`,
-        `printf %s '${cmdShB64}' | base64 -d > ${q("cmd.sh")}`,
-        `printf %s '${runnerShB64}' | base64 -d > ${q("runner.sh")}`,
-        `setsid sh ${q("runner.sh")} >/dev/null 2>&1 &`,
-        `__i=0; while [ ! -s ${q("pgid")} ] && [ $__i -lt 40 ]; do __i=$((__i+1)); sleep 0.05; done`,
-        `if [ -s ${q("pgid")} ]; then echo SEMABG_LAUNCHED; else echo SEMABG_NOPGID; fi`,
-    ].join("\n");
-}
-export function buildBgPollScript(dir, stdoutCursor, stderrCursor, readCap) {
-    const d = shellQuote(dir);
-    const slice = (file, cursor) => [
-        `__N=$((__T - ${cursor}))`,
-        `if [ "$__N" -gt 0 ]; then`,
-        `  if [ "$__N" -le ${readCap} ]; then tail -c +$(( ${cursor} + 1 )) ${d}/${file} 2>/dev/null | head -c "$__N" | base64;`,
-        `  else tail -c +$(( __T - ${readCap} + 1 )) ${d}/${file} 2>/dev/null | head -c ${readCap} | base64; fi`,
-        `fi`,
-    ].join("\n");
-    return [
-        `if [ ! -d ${d} ]; then echo SEMABG_GONE; exit 0; fi`,
-        `__OT=$(wc -c < ${d}/out 2>/dev/null); __OT=$(( \${__OT:-0} + 0 ))`,
-        `__ET=$(wc -c < ${d}/err 2>/dev/null); __ET=$(( \${__ET:-0} + 0 ))`,
-        `__EX=$( [ -f ${d}/exit ] && cat ${d}/exit 2>/dev/null || echo - )`,
-        `__PG=$(cat ${d}/pgid 2>/dev/null); __PG=\${__PG:--}`,
-        `if [ "$__PG" = "-" ]; then __AL=1; elif kill -0 -"$__PG" 2>/dev/null; then __AL=1; else __AL=0; fi`,
-        `echo "SEMABG_META o=$__OT e=$__ET x=$__EX a=$__AL"`,
-        `echo SEMABG_O`,
-        `__T=$__OT`,
-        slice("out", stdoutCursor),
-        `echo SEMABG_E`,
-        `__T=$__ET`,
-        slice("err", stderrCursor),
-        `echo SEMABG_X`,
-    ].join("\n");
-}
-export function buildBgKillScript(dir) {
-    const d = shellQuote(dir);
-    return [
-        `__i=0; while [ ! -s ${d}/pgid ] && [ $__i -lt 40 ]; do __i=$((__i+1)); sleep 0.05; done`,
-        `__PG=$(cat ${d}/pgid 2>/dev/null); __PG=\${__PG:--}`,
-        `if [ "$__PG" != "-" ]; then kill -TERM -"$__PG" 2>/dev/null || kill -TERM "$__PG" 2>/dev/null; sleep 1; kill -KILL -"$__PG" 2>/dev/null || kill -KILL "$__PG" 2>/dev/null; fi`,
-        `echo SEMABG_KILLED`,
-    ].join("\n");
-}
-export function buildBgDisposeScript(dir) {
-    const d = shellQuote(dir);
-    return [
-        `__PG=$(cat ${d}/pgid 2>/dev/null); __PG=\${__PG:--}`,
-        `if [ "$__PG" != "-" ]; then kill -KILL -"$__PG" 2>/dev/null || kill -KILL "$__PG" 2>/dev/null; fi`,
-        `rm -rf ${d} 2>/dev/null`,
-        `echo SEMABG_DISPOSED`,
-    ].join("\n");
-}
-export function buildDetachCapableExec(dir, command) {
-    const d = shellQuote(dir);
-    const q = (name) => shellQuote(`${dir}/${name}`);
-    const cmdB64 = Buffer.from(command, "utf8").toString("base64");
-    const writePgid = (val) => `printf %s ${val} > ${q("pgid.tmp")} 2>/dev/null && mv ${q("pgid.tmp")} ${q("pgid")} 2>/dev/null`;
-    return [
-        `__cmd=$(printf %s '${cmdB64}' | base64 -d)`,
-        `mkdir -p ${d} 2>/dev/null`,
-        `trap 'rm -rf ${d} 2>/dev/null' EXIT`,
-        `if command -v setsid >/dev/null 2>&1; then`,
-        `  setsid sh -c "$__cmd" &`,
-        `  __pg=$!`,
-        `  ${writePgid('"$__pg"')}`,
-        `  wait "$__pg"; __rc=$?`,
-        `else`,
-        `  ${writePgid('"$$"')}`,
-        `  sh -c "$__cmd"; __rc=$?`,
-        `fi`,
-        `exit $__rc`,
-    ].join("\n");
-}
-export function parseBgPollOutput(raw) {
-    if (raw.includes("SEMABG_GONE")) {
-        return { gone: true, outTotal: 0, errTotal: 0, alive: false, stdout: "", stdoutBytes: 0, stderr: "", stderrBytes: 0 };
-    }
-    const lines = raw.split("\n");
-    const metaIdx = lines.findIndex((l) => l.startsWith("SEMABG_META "));
-    if (metaIdx < 0)
-        return undefined;
-    const oIdx = lines.indexOf("SEMABG_O", metaIdx + 1);
-    const eIdx = oIdx >= 0 ? lines.indexOf("SEMABG_E", oIdx + 1) : -1;
-    const xIdx = eIdx >= 0 ? lines.indexOf("SEMABG_X", eIdx + 1) : -1;
-    if (oIdx < 0 || eIdx < 0 || xIdx < 0)
-        return undefined;
-    const m = /o=(\d+) e=(\d+) x=(\S+) a=([01])/.exec(lines[metaIdx].slice("SEMABG_META ".length));
-    if (!m)
-        return undefined;
-    const outTotal = parseInt(m[1], 10);
-    const errTotal = parseInt(m[2], 10);
-    const exTok = m[3];
-    const alive = m[4] === "1";
-    const exitParsed = exTok === "-" ? NaN : parseInt(exTok, 10);
-    const exitCode = Number.isFinite(exitParsed) ? exitParsed : undefined;
-    const decode = (from, to) => {
-        const b64 = lines.slice(from, to).join("").replace(/\s+/g, "");
-        const buf = Buffer.from(b64, "base64");
-        return { text: buf.toString("utf8"), bytes: buf.length };
-    };
-    const o = decode(oIdx + 1, eIdx);
-    const e = decode(eIdx + 1, xIdx);
-    return {
-        gone: false,
-        outTotal,
-        errTotal,
-        ...(exitCode !== undefined ? { exitCode } : {}),
-        alive,
-        stdout: o.text,
-        stdoutBytes: o.bytes,
-        stderr: e.text,
-        stderrBytes: e.bytes,
-    };
-}
+import { buildBgRunnerScript, buildBgLauncherScript, buildBgPollScript, buildBgKillScript, buildBgDisposeScript, buildDetachCapableExec, parseBgPollOutput, } from "./k8s-bg-scripts.js";
+export { buildBgRunnerScript, buildBgLauncherScript, buildBgPollScript, buildBgKillScript, buildBgDisposeScript, buildDetachCapableExec, parseBgPollOutput, } from "./k8s-bg-scripts.js";
 const ok = (value) => ({ ok: true, value });
 const unsupported = (op) => ({
     ok: false,
@@ -153,98 +28,17 @@ const unsupported = (op) => ({
 const SA_DIR = "/var/run/secrets/kubernetes.io/serviceaccount";
 const EXEC_SUBPROTOCOLS = ["v5.channel.k8s.io", "v4.channel.k8s.io"];
 const WRITE_CHUNK_BYTES = 64 * 1024;
-export function applyPodSpecPatch(pod, patch) {
-    assertHardeningOnly(patch.podSecurityContext, "podSecurityContext");
-    assertHardeningOnly(patch.containerSecurityContext, "containerSecurityContext");
-    if (patch.labels) {
-        const identity = {};
-        for (const k of ["app", "managed-by"]) {
-            const v = pod.metadata.labels?.[k];
-            if (v !== undefined)
-                identity[k] = v;
-        }
-        pod.metadata.labels = { ...pod.metadata.labels, ...patch.labels, ...identity };
-    }
-    const spec = pod.spec;
-    assertVolumesPodLocal(patch.volumes, "volumes");
-    if (patch.volumes?.length)
-        spec.volumes = [...(spec.volumes ?? []), ...patch.volumes];
-    if (patch.podSecurityContext)
-        spec.securityContext = { ...(spec.securityContext ?? {}), ...patch.podSecurityContext };
-    const container = spec.containers?.[0];
-    if (container) {
-        if (patch.volumeMounts?.length)
-            container.volumeMounts = [...(container.volumeMounts ?? []), ...patch.volumeMounts];
-        if (patch.containerSecurityContext)
-            container.securityContext = { ...(container.securityContext ?? {}), ...patch.containerSecurityContext };
-    }
-}
-function assertHardeningOnly(sc, where) {
-    if (!sc)
-        return;
-    const bad = (msg) => {
-        throw new Error(`podSpecPatch.${where} rejected — it may only HARDEN, never weaken isolation: ${msg}`);
-    };
-    if (sc.privileged === true)
-        bad("privileged:true");
-    if (sc.allowPrivilegeEscalation === true)
-        bad("allowPrivilegeEscalation:true");
-    if (sc.readOnlyRootFilesystem === false)
-        bad("readOnlyRootFilesystem:false");
-    if (sc.runAsNonRoot === false)
-        bad("runAsNonRoot:false");
-    if (sc.runAsUser === 0)
-        bad("runAsUser:0 (root)");
-    const caps = sc.capabilities;
-    if (caps && Array.isArray(caps.add) && caps.add.length > 0)
-        bad(`capabilities.add ${JSON.stringify(caps.add)} (a hardening patch may only .drop)`);
-    if (sc.procMount === "Unmasked")
-        bad('procMount:"Unmasked" (re-exposes masked /proc)');
-    const seccomp = sc.seccompProfile;
-    if (seccomp && seccomp.type === "Unconfined")
-        bad('seccompProfile.type:"Unconfined" (disables syscall filtering)');
-}
-function assertVolumesPodLocal(volumes, where) {
-    if (!volumes?.length)
-        return;
-    const POD_LOCAL = new Set(["emptyDir", "configMap", "secret", "projected", "downwardAPI", "ephemeral"]);
-    for (const v of volumes) {
-        const vol = v;
-        const sources = Object.keys(vol).filter((k) => k !== "name");
-        for (const src of sources) {
-            if (!POD_LOCAL.has(src)) {
-                throw new Error(`podSpecPatch.${where} rejected — volume source ${JSON.stringify(src)} is not pod-local (host-backed sources like hostPath/csi/flexVolume cross the Kata VM boundary into the node FS). Allowed: ${[...POD_LOCAL].join("/")}`);
-            }
-        }
-    }
-}
-export function execSocketTlsOptions(ca, insecureTls) {
-    const caList = ca ? [ca] : undefined;
-    return { ca: caList, rejectUnauthorized: !insecureTls, tls: { ca: caList, rejectUnauthorized: !insecureTls } };
-}
+import { applyPodSpecPatch } from "./k8s-exec-protocol.js";
+export { applyPodSpecPatch } from "./k8s-exec-protocol.js";
+import { execSocketTlsOptions, exitCodeFromStatus } from "./k8s-exec-protocol.js";
+export { execSocketTlsOptions } from "./k8s-exec-protocol.js";
 export function errorMessageOf(e) {
     if (e instanceof Error)
         return e.message;
     const m = e?.message;
     return typeof m === "string" && m ? m : String(e);
 }
-export function exitCodeFromStatus(statusJson) {
-    try {
-        const s = JSON.parse(statusJson);
-        if (s.status === "Success")
-            return { exitCode: 0 };
-        const cause = s.details?.causes?.find((c) => c.reason === "ExitCode");
-        if (cause?.message?.trim()) {
-            const code = Number(cause.message);
-            if (Number.isFinite(code))
-                return { exitCode: code };
-        }
-        return { error: s.message || s.reason || "exec failed without an exit code" };
-    }
-    catch {
-        return { error: `unparseable exec status: ${statusJson.slice(0, 200)}` };
-    }
-}
+export { exitCodeFromStatus } from "./k8s-exec-protocol.js";
 export class RemoteK8sExecutionEnv {
     capabilities;
     cwd;

package/dist/plugins/resume-anchor-store-sql.d.ts

@@ -0,0 +1,23 @@
+import type { Pool as MySqlPool } from "mysql2/promise";
+import type { Pool as PgPool } from "pg";
+import { type SqlDriver } from "./sql-driver.js";
+export declare class SqlResumeAnchorStore {
+    protected readonly db: SqlDriver;
+    constructor(db: SqlDriver);
+    private q;
+    put(sessionId: string, eventId: string, entryId: string, owner: string | null): Promise<void>;
+    resolve(sessionId: string, eventId: string, owner: string | null): Promise<string | undefined>;
+    listBySession(sessionId: string): Promise<Array<{
+        eventId: string;
+        entryId: string;
+        owner: string | null;
+    }>>;
+    deleteBySession(sessionId: string): Promise<number>;
+}
+export declare class TiDBResumeAnchorStore extends SqlResumeAnchorStore {
+    constructor(pool: MySqlPool);
+}
+export declare class PgResumeAnchorStore extends SqlResumeAnchorStore {
+    constructor(pool: PgPool);
+}
+//# sourceMappingURL=resume-anchor-store-sql.d.ts.map

package/dist/plugins/resume-anchor-store-sql.js

@@ -0,0 +1,38 @@
+import { mysqlDriver, pgDriver } from "./sql-driver.js";
+export class SqlResumeAnchorStore {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    q(tidb, pg) {
+        return this.db.dialect === "tidb" ? tidb : pg;
+    }
+    async put(sessionId, eventId, entryId, owner) {
+        await this.db.query(this.q("INSERT INTO resume_anchor (session_id, event_id, entry_id, owner, created_at) VALUES (?,?,?,?,?) " +
+            "ON DUPLICATE KEY UPDATE entry_id = VALUES(entry_id), owner = VALUES(owner)", "INSERT INTO resume_anchor (session_id, event_id, entry_id, owner, created_at) VALUES ($1,$2,$3,$4,$5) " +
+            "ON CONFLICT (session_id, event_id) DO UPDATE SET entry_id = EXCLUDED.entry_id, owner = EXCLUDED.owner"), [sessionId, eventId, entryId, owner, new Date()]);
+    }
+    async resolve(sessionId, eventId, owner) {
+        const { rows } = await this.db.query(this.q("SELECT entry_id FROM resume_anchor WHERE session_id = ? AND event_id = ? AND owner <=> ?", "SELECT entry_id FROM resume_anchor WHERE session_id = $1 AND event_id = $2 AND owner IS NOT DISTINCT FROM $3"), [sessionId, eventId, owner]);
+        return rows[0] ? String(rows[0].entry_id) : undefined;
+    }
+    async listBySession(sessionId) {
+        const { rows } = await this.db.query(this.q("SELECT event_id, entry_id, owner FROM resume_anchor WHERE session_id = ?", "SELECT event_id, entry_id, owner FROM resume_anchor WHERE session_id = $1"), [sessionId]);
+        return rows.map((r) => ({ eventId: String(r.event_id), entryId: String(r.entry_id), owner: r.owner == null ? null : String(r.owner) }));
+    }
+    async deleteBySession(sessionId) {
+        const res = await this.db.query(this.q("DELETE FROM resume_anchor WHERE session_id = ?", "DELETE FROM resume_anchor WHERE session_id = $1"), [sessionId]);
+        return res.affected;
+    }
+}
+export class TiDBResumeAnchorStore extends SqlResumeAnchorStore {
+    constructor(pool) {
+        super(mysqlDriver(pool));
+    }
+}
+export class PgResumeAnchorStore extends SqlResumeAnchorStore {
+    constructor(pool) {
+        super(pgDriver(pool));
+    }
+}
+//# sourceMappingURL=resume-anchor-store-sql.js.map