@sema-agent/server 7.146.0 → 7.148.0

package/dist/http/memory-control-plane-corrupt-reply.d.ts

@@ -1,25 +0,0 @@
-/**
- * core 的 `ControlPlaneCorruptError` ⇒ typed 500 `internal.memory_control_plane_corrupt` 的 **HTTP 映射** —— 唯一一处码字面量、唯一一处 `instanceof` 判别。
- *
- * ## 为什么是一只
- * 这是 core 的 fail-closed 信号:记忆引擎的控制面(账本 / 事务日志 / 清标账 / 治理账)说不清,它宁可不答,也不在一个说不清的账上拼一个答案。
- * 凡是会碰控制面的 operator 记忆口,对它的答法必须是同一句话:消费端按 `errorCode` 分支,运维有具体动作(修 / 重建账本后重试)。
- * 此前这条映射写在四个地方(导出 / 导入口、外源标记口、整理口、合规口),码字面量与判别各一份 = 第五个口加错码或漏一支的口子。
- * 同族的店形拒早已是一只(`sentMemoryStoreRefusal`,在 `memory-store-refusal-reply.ts`);本文件是第二只。挂在每一个**已分类收尾**上:
- * `routes/memory-bundle.ts`(导出 / 导入)· `routes/memory-origin.ts`(外源列表 / 清标 / 清标账列表 —— 清标账列表是纯控制面读,店形拒不挂在它上面,它的损坏信号走这一只)·
- * `routes/memory-consolidation.ts`(整理)· `memory-compliance-failure-reply.ts`(出处 / 抹除,两受众)。
- *
- * ## 文案按受众分(码与状态不分;与 `memory-compliance-failure-reply.ts` 同一条规则)
- *  · operator ⇒ 引擎原句上 wire(点名**哪一张**控制面账本坏了,运维下一步动作取决于它;原句带宿主路径,过了 operator 门的受众拿它不是泄露);
- *  · 会话所有者(自助抹除口,只有这一个口有这个受众)⇒ 一句固定指路,引擎原句整句交 `withheld` 落运维行 —— 不逐句判断哪句安全。
- *    固定句**一码两义都真**:操作前账本读不出 ⇒ 什么都没发生;落定后残留枚举失败 ⇒ 抹除已提交、重放收敛(core 原话)。两句都不许诺零删除,
- *    都指路「运维修好后用同一个 requestId 重发」。本层**不**嗅 core 文案去分辨哪一义(拿上游自由文本当判别式是第二真源)。
- *
- * 两处 `sendError` 的码都写**字面量**:错误码目录门(`test/error-code-catalog-live.test.ts`)与文案冻结门(`test/api-error-text-freeze.test.ts`,
- * 固定句是它冻的那一句)扫的是源码字面量,变量态的码 / 句对它们隐形。
- */
-import type { ServerResponse } from "node:http";
-import type { MemoryComplianceAudience } from "./memory-compliance-failure-reply.js";
-/** `err` 是 core 的控制面损坏 ⇒ 500 `internal.memory_control_plane_corrupt`(文案按受众),返回 true(已应答);否则 false,一个字节都不写。 */
-export declare function sentControlPlaneCorrupt(res: ServerResponse, err: unknown, audience: MemoryComplianceAudience): boolean;
-//# sourceMappingURL=memory-control-plane-corrupt-reply.d.ts.map

package/dist/http/memory-control-plane-corrupt-reply.js

@@ -1,19 +0,0 @@
-import { ControlPlaneCorruptError } from "@sema-agent/core";
-import { assertNever } from "./route-ctx.js";
-import { sendError } from "./send.js";
-export function sentControlPlaneCorrupt(res, err, audience) {
-    if (!(err instanceof ControlPlaneCorruptError))
-        return false;
-    switch (audience.kind) {
-        case "operator":
-            sendError(res, 500, "internal.memory_control_plane_corrupt", err.message);
-            return true;
-        case "session_owner":
-            audience.withheld(err.message);
-            sendError(res, 500, "internal.memory_control_plane_corrupt", "session memory erasure could not be completed — this deployment's memory control plane could not be read cleanly (depending on where it stopped, either nothing was changed or the deletions were already committed and a replay finishes them); ask the operator to repair it, then resend with the same requestId");
-            return true;
-        default:
-            return assertNever(audience);
-    }
-}
-//# sourceMappingURL=memory-control-plane-corrupt-reply.js.map

package/dist/http/memory-layer-reply.d.ts

@@ -1,30 +0,0 @@
-/**
- * 记忆动词的**层座**与「这次请求落不到一只记忆店」的拒 —— 两件的 HTTP 半场,唯一一处。
- *
- * ## 规则(店的那一半在 `src/memory-scope-stores.ts`)
- * 一次记忆请求只落一只店:请求点名的层住的那一只;不点名层的动词(条目 id / 店级账本)答在本部署点名的层与部署的店共处的那一只上,
- * 两只店分住时不猜、拒。会话 id 的两口不点名层时不拒:记忆状态读本部署的每一只店再折成一份,按会话抹除落部署的店(`memory-operator-faces.ts`)。
- * 不点名层的动词因此多一个可选的**层座** `scope`:GET 口在查询串(`?scope=<层键>`),POST 口在体里(`"scope": "<层键>"`);
- * 点名的层只用来定店,动词本身的语义不变。点名层的动词(导出 / 导入 / 外源列表 / 整理 / operator 抹除的 `select.scope` 与 `expectedScopes`)
- * 本来就点名,不加座。
- *
- * ## 层座的读法({@link readLayerSeat})
- * 缺席 ⇒ 没点名;在场 ⇒ 必须是非空串,否则 400 `request.field_invalid`、面一次都不调(空串与非串不是「没点名」—— 静默当缺席会把请求答在
- * 另一只店上)。
- *
- * ## 拒的映射({@link sentMemoryLayerRefusal})
- * `MemoryLayerRefusal` ⇒ 400 `request.memory_layer`:请求可以改对(点名层 / 按店拆成几次),服务器没坏,也不是盘形问题。
- * 文案按受众分(与 `memory-compliance-failure-reply.ts` 同一条规则):operator ⇒ 原句(点名部署配置的层、哪几层住在哪只店 —— 运维要的就是它);
- * 会话所有者 ⇒ 固定一句(只说怎么办),原句交 `withheld` 落运维行 —— 部署配置的层键不是这个受众的材料。
- */
-import type { ServerResponse } from "node:http";
-import type { MemoryLayerSeat } from "../memory-operator-faces.js";
-import type { MemoryComplianceAudience } from "./memory-compliance-failure-reply.js";
-/**
- * 层座:`present` = 键在不在(查询串 `has` / 体 `in`),`value` = 它的值。缺席 ⇒ `undefined`;非空串 ⇒ `{ layer }`;
- * 其余 ⇒ 已答 400 `request.field_invalid`,返回 `null`(调用方 `return`)。
- */
-export declare function readLayerSeat(res: ServerResponse, present: boolean, value: unknown): MemoryLayerSeat | undefined | null;
-/** `err` 是本服务的层拒 ⇒ 400 `request.memory_layer`(文案按受众),返回 true;否则 false,一个字节都不写。 */
-export declare function sentMemoryLayerRefusal(res: ServerResponse, err: unknown, audience: MemoryComplianceAudience): boolean;
-//# sourceMappingURL=memory-layer-reply.d.ts.map

package/dist/http/memory-layer-reply.js

@@ -1,24 +0,0 @@
-import { MemoryLayerRefusal } from "../memory-scope-stores.js";
-import { sendError } from "./send.js";
-export function readLayerSeat(res, present, value) {
-    if (!present)
-        return undefined;
-    if (typeof value === "string" && value.length > 0)
-        return { layer: value };
-    sendError(res, 400, "request.field_invalid", "scope must be a non-empty memory layer key when present — it names the layer whose memory store this request is answered on");
-    return null;
-}
-export function sentMemoryLayerRefusal(res, err, audience) {
-    if (!(err instanceof MemoryLayerRefusal))
-        return false;
-    switch (audience.kind) {
-        case "operator":
-            sendError(res, 400, "request.memory_layer", err.message);
-            return true;
-        case "session_owner":
-            audience.withheld(err.message);
-            sendError(res, 400, "request.memory_layer", "the memory store this request reaches cannot be told — the `scope` in the request is not a memory layer this deployment can read, or this deployment's own memory layer configuration cannot be read; resend without `scope` (or with a readable layer), or ask the operator");
-            return true;
-    }
-}
-//# sourceMappingURL=memory-layer-reply.js.map

package/dist/lsp/e2b-bridge.d.ts

@@ -1,57 +0,0 @@
-/**
- * Bridges WS ⇄ a language server's stdio. Server command from `LSP_CMD`, port `LSP_PORT`, and a per-session
- * **auth token** `LSP_TOKEN` (the endpoint is a public `wss://<port>-<id>.e2b.app` URL — the runner connects with
- * `?token=<secret>`; without it, anyone with the URL could read the workspace via LSP, council #4). Frame parsing
- * uses the unit-tested {@link FRAME_DECODER_JS} (council #1/#2/#5).
- *
- * redesign⑤ (#96 §DESIGN-V2 F4): the WS server now rides an explicit `http.createServer` instead of binding its
- * own socket (`new WebSocketServer({host,port})`) — the same port also answers `GET /healthz` (host-side liveness
- * probe, §DESIGN-V2 F2/C6) without a second port or dependency. The EADDRINUSE loud-exit handler MOVES with the
- * bind onto the http server (`server.on('error', …)`, same `lsp-bridge wss error` text + `exit 1` — test/lsp-e2b.test.ts
- * :256-269 pins this exact text/code); `ws` still forwards its underlying server's `'error'` to `wss`, so nothing
- * downstream (per-connection handling) changes.
- */
-export declare const BRIDGE_SOURCE: string;
-/** Bridge dir inside the sandbox(声明提前:tsserver 定值路径引用它)。 */
-export declare const BRIDGE_DIR = "/home/user/.lsp-bridge";
-/** tls 的 tsserver.js 定值路径(#96 真机门):install 腿保证在场,connect 腿经
- *  `initializationOptions.tsserver.path` 告知 tls(v4 起无 CLI 旗可用)。 */
-export declare const TSSERVER_JS_PATH = "/home/user/.lsp-bridge/node_modules/typescript/lib/tsserver.js";
-/** Language server command per languageId. P1 = typescript/javascript; dart/kotlin land with their template servers.
- *  `--stdio` only where the server needs it to pick stdio over its other transports (the node-based servers);
- *  gopls/jdtls/kotlin-language-server/sourcekit-lsp/`dart language-server` speak LSP over stdio by default.
- *  #96 真机门发现(E2B 真沙箱逐帧取证,test/lsp-e2b-bridge-live.test.ts):typescript-language-server
- *  **不自动发现全局 typescript**(只认 workspace 内 node_modules/typescript 或显式 tsserver 路径),
- *  `npm i -g … typescript` 装成之后 initialize 仍答 "Could not find a valid TypeScript installation";
- *  且 v4 起 `--tsserver-path` CLI 旗已移除(未知参数=进程退 1,第二轮真机实测)——路径只能走 LSP
- *  `initializationOptions.tsserver.path`(TSSERVER_JS_PATH,connectE2bLspBridge 对 ts/js 传入),
- *  typescript 本体由 lspInstallCommand 落进 BRIDGE_DIR 定值路径(烤好模板文件在场则秒过)。 */
-export declare const SERVER_CMD: Readonly<Record<string, string>>;
-/** npm packages a non-baked sandbox needs (on-the-fly install). Languages absent here (go) REQUIRE a baked template. */
-export declare const SERVER_NPM: Readonly<Record<string, string>>;
-/** One bridge process per language → distinct ports.(BRIDGE_DIR 声明已提前至 SERVER_CMD 上方。) */
-export declare function portForLanguage(language: string): number;
-/** FOREGROUND install (run via `env.exec` — must finish before the start). A baked template makes both checks
- *  skip instantly; a non-baked sandbox npm-installs the server + ws here (slow once per sandbox). */
-export declare function lspInstallCommand(language: string): string;
-/** Start the bridge — run as a TRUE background command (`env.startBackground`), NOT `&`-backgrounded inside a
- *  foreground run: E2B reaps the foreground process group on completion, killing an in-shell `&`/nohup child.
- *  So node is the FOREGROUND here and E2B keeps the background command alive. */
-export declare function lspStartCommand(language: string, port: number, token: string): string;
-/** Where the on-the-fly `npm i` output from {@link lspInstallCommand} lands — previously had zero readers
- *  (§DESIGN-V2 F7 bonus fix); an install failure now tails this for the `lastError`/event snippet. */
-export declare const LSP_SETUP_LOG = "/tmp/lsp-setup.log";
-/** BRIDGE_DIR-relative log the bridge process itself appends to (fatal errors, child exits) — §DESIGN-V2 C4. */
-export declare function bridgeLogFile(): string;
-/** Per-port pidfile the bridge writes ONLY after a confirmed bind (BRIDGE_SOURCE's `listen` callback) — see its
- *  header comment for why a losing (EADDRINUSE) second bridge must never clobber this. */
-export declare function bridgePidFile(port: number): string;
-/** §DESIGN-V2 F3: verify a prior bridge generation ACTUALLY stopped before the host mints a replacement.
- *  Exit 0 = confirmed dead (or the pidfile never existed — nothing was ever listening) → safe to start a new
- *  generation on this port. Exit 1 = still alive after the bound wait — the caller MUST NOT start a new bridge:
- *  an unconfirmed kill risks EADDRINUSE (the new generation's fresh token would then be permanently rejected by
- *  the still-listening old process, the token check in BRIDGE_SOURCE) — better to stay `dead` than double-burn
- *  the restart budget on a doomed attempt. POSIX `sh` only (no `seq`/bashisms — sandboxes vary in shell).
- *  Bound: 20 × 0.1s = 2s. */
-export declare function terminateBridgeCommand(port: number): string;
-//# sourceMappingURL=e2b-bridge.d.ts.map

package/dist/lsp/e2b-bridge.js

@@ -1,139 +0,0 @@
-import { FRAME_DECODER_JS } from "./lsp-frames.js";
-export const BRIDGE_SOURCE = FRAME_DECODER_JS +
-    String.raw `
-const { WebSocketServer } = require('ws');
-const { spawn } = require('child_process');
-const { URLSearchParams } = require('url');
-const http = require('http');
-const fs = require('fs');
-const PORT = Number(process.env.LSP_PORT || 8123);
-const CMD = (process.env.LSP_CMD || 'typescript-language-server --stdio').split(' ');
-const TOKEN = process.env.LSP_TOKEN || '';
-const MAX = 50 * 1024 * 1024;
-const HEARTBEAT_MS = Number(process.env.LSP_HEARTBEAT_MS || 30000);
-const START_MS = Date.now();
-// Per-port pidfile (BRIDGE_DIR-relative — lspStartCommand cd's there first): the host reads this to verify a
-// prior generation ACTUALLY stopped before minting a replacement (§DESIGN-V2 F3) — an unconfirmed kill risks a
-// new generation's token being permanently rejected by a still-listening old process (the token check below).
-// Written ONLY after a successful bind (inside the listen callback) — a SECOND bridge racing this same port
-// must NOT clobber the FIRST (still listening) bridge's pidfile with its own (about-to-die) pid.
-const PIDFILE = 'bridge-' + PORT + '.pid';
-const LOGFILE = 'bridge.log';
-function logLine(line) { try { fs.appendFileSync(LOGFILE, line + '\n'); } catch {} }
-// Process-fatal hardening (§DESIGN-V2 C1/C2): an uncaught exception/rejection anywhere in this process previously
-// died silently (no stderr line, no log) — the host's only signal was the WS going dead with no explanation.
-process.on('uncaughtException', (err) => { const m = 'lsp-bridge fatal ' + (err && err.message); console.error(m); logLine(m); process.exit(1); });
-process.on('unhandledRejection', (err) => { const m = 'lsp-bridge fatal ' + (err && err.message); console.error(m); logLine(m); process.exit(1); });
-function tokenOf(url) { return new URLSearchParams(((url || '').split('?')[1]) || '').get('token'); }
-const server = http.createServer((req, res) => {
-  const path = ((req && req.url) || '').split('?')[0];
-  if (path === '/healthz') {
-    // Same-origin auth as the WS gate below: TOKEN unset = open (dev/test), TOKEN set + mismatch = 401.
-    if (TOKEN && tokenOf(req.url) !== TOKEN) { res.writeHead(401); res.end(); return; }
-    const body = JSON.stringify({ pid: process.pid, uptimeMs: Date.now() - START_MS, connections: wss.clients.size, generationToken: TOKEN.slice(0, 8) });
-    res.writeHead(200, { 'Content-Type': 'application/json' });
-    res.end(body);
-    return;
-  }
-  const body = http.STATUS_CODES[426]; // preserves ws's own default "upgrade required" response for any other path
-  res.writeHead(426, { 'Content-Length': Buffer.byteLength(body), 'Content-Type': 'text/plain' });
-  res.end(body);
-});
-// A zero-listener 'error' on ANY EventEmitter throws and crashes the process (Node default). Without this, a
-// bind failure (e.g. EADDRINUSE — a second bridge start racing the same port) took down the WHOLE bridge
-// process, killing every language's LSP session in the sandbox, not just the one that failed to start (HRD-LSP-4).
-// Exit loud + explicit instead of an uncaught-exception dump so the failure is at least attributable.
-server.on('error', (err) => { const m = 'lsp-bridge wss error ' + (err && err.message); console.error(m); logLine(m); process.exit(1); });
-const wss = new WebSocketServer({ server });
-wss.on('connection', (ws, req) => {
-  // Same zero-listener 'error' hazard as wss above, but per-connection: registered FIRST, before anything else
-  // touches this socket. Close (don't crash) — the heartbeat reaper's own ws.terminate() below is a routine
-  // source of a socket 'error' on an already-half-open connection (HRD-LSP-4).
-  ws.on('error', () => { try { ws.terminate(); } catch {} });
-  const q = ((req && req.url) || '').split('?')[1] || '';
-  if (TOKEN && new URLSearchParams(q).get('token') !== TOKEN) { ws.close(); return; } // auth (council #4)
-  ws.isAlive = true;
-  ws.on('pong', () => { ws.isAlive = true; });
-  const child = spawn(CMD[0], CMD.slice(1), { stdio: ['pipe', 'pipe', 'inherit'] });
-  child.stdin.on('error', () => {}); // EPIPE on a write racing the server's exit must not crash the bridge
-  child.on('error', () => { try { ws.close(); } catch {} }); // spawn failure (missing binary) → close, don't crash
-  const decode = makeFrameDecoder(MAX);
-  child.stdout.on('data', (d) => { for (const f of decode(d)) ws.send(f); });
-  ws.on('message', (data) => { const p = Buffer.from(data.toString(), 'utf8'); child.stdin.write('Content-Length: ' + p.length + '\r\n\r\n'); child.stdin.write(p); });
-  // pid guard: the child 'error' handler above routes spawn FAILURES (missing binary — pid never assigned)
-  // through ws.close() → this 'close' handler. Killing a child whose pid was never assigned can signal the
-  // CALLER's process group instead of the (nonexistent) child (HRD-LSP-4; same hazard class as bake-runner's
-  // spawner, src/bake-runner/main.ts).
-  ws.on('close', () => { if (child.pid !== undefined) child.kill(); });
-  child.on('exit', (code, signal) => { logLine('lsp-bridge child exit code=' + code + ' signal=' + signal); try { ws.close(); } catch {} });
-});
-// Reap half-open connections: the E2B proxy kills a WS at ~60-75s and the kill can be SILENT on THIS side too —
-// no close frame, so the per-connection language server above would outlive its dead socket (one leaked server
-// per heal; a long task accumulates them until the sandbox OOMs). terminate() fires 'close' → child.kill().
-setInterval(() => {
-  for (const ws of wss.clients) {
-    if (ws.isAlive === false) { try { ws.terminate(); } catch {} continue; }
-    ws.isAlive = false;
-    try { ws.ping(); } catch {}
-  }
-}, HEARTBEAT_MS);
-server.listen(PORT, '0.0.0.0', () => {
-  try { fs.writeFileSync(PIDFILE, String(process.pid)); } catch (e) { logLine('lsp-bridge pidfile write failed ' + (e && e.message)); }
-  console.log('lsp-bridge listening', PORT);
-});
-`;
-export const BRIDGE_DIR = "/home/user/.lsp-bridge";
-export const TSSERVER_JS_PATH = `${BRIDGE_DIR}/node_modules/typescript/lib/tsserver.js`;
-export const SERVER_CMD = {
-    typescript: "typescript-language-server --stdio",
-    javascript: "typescript-language-server --stdio",
-    python: "pyright-langserver --stdio",
-    go: "gopls",
-    dart: "dart language-server",
-    kotlin: "kotlin-language-server",
-    java: "jdtls",
-    swift: "sourcekit-lsp",
-};
-export const SERVER_NPM = {
-    typescript: "typescript-language-server typescript",
-    javascript: "typescript-language-server typescript",
-    python: "pyright",
-};
-export function portForLanguage(language) {
-    const ports = { typescript: 8123, javascript: 8123, dart: 8124, kotlin: 8125, python: 8126, go: 8127, java: 8128, swift: 8129 };
-    return ports[language] ?? 8123;
-}
-export function lspInstallCommand(language) {
-    const cmd = SERVER_CMD[language];
-    const npm = SERVER_NPM[language];
-    return [
-        `mkdir -p ${BRIDGE_DIR}`,
-        `[ -f ${BRIDGE_DIR}/node_modules/ws/package.json ] || (cd ${BRIDGE_DIR} && echo '{}' > package.json && npm i ws >/tmp/lsp-setup.log 2>&1)`,
-        npm ? `command -v ${cmd.split(" ")[0]} >/dev/null || npm i -g ${npm} >>/tmp/lsp-setup.log 2>&1` : "true",
-        npm?.includes("typescript")
-            ? `[ -f ${TSSERVER_JS_PATH} ] || (cd ${BRIDGE_DIR} && npm i typescript@5 >>/tmp/lsp-setup.log 2>&1)`
-            : "true",
-    ].join(" && ");
-}
-export function lspStartCommand(language, port, token) {
-    return `cd ${BRIDGE_DIR} && LSP_PORT=${port} LSP_TOKEN='${token}' LSP_CMD='${SERVER_CMD[language]}' node bridge.cjs`;
-}
-export const LSP_SETUP_LOG = "/tmp/lsp-setup.log";
-export function bridgeLogFile() {
-    return `${BRIDGE_DIR}/bridge.log`;
-}
-export function bridgePidFile(port) {
-    return `${BRIDGE_DIR}/bridge-${port}.pid`;
-}
-export function terminateBridgeCommand(port) {
-    const pidfile = bridgePidFile(port);
-    return [
-        `[ -f ${pidfile} ] || exit 0`,
-        `PID=$(cat ${pidfile})`,
-        `kill "$PID" 2>/dev/null`,
-        `i=0`,
-        `while [ $i -lt 20 ]; do kill -0 "$PID" 2>/dev/null || exit 0; i=$((i+1)); sleep 0.1; done`,
-        `exit 1`,
-    ].join("; ");
-}
-//# sourceMappingURL=e2b-bridge.js.map

package/dist/lsp/e2b-manager.d.ts

@@ -1,93 +0,0 @@
-import { connectWsLspTransport } from "./ws-transport.js";
-import { E2bLspManager, type LspCapableEnv, type LspUnavailableReason } from "./manager.js";
-import type { LspTransport } from "./types.js";
-export interface E2bLspOptions {
-    /** Injectable for tests (no E2B/ws). */
-    connect?: typeof connectWsLspTransport;
-    retry?: {
-        attempts: number;
-        delayMs: number;
-    };
-    /** Bridge auth token override. The manager pins ONE token per env+PORT — the bridge RESOURCE, not the
-     *  language (`portForLanguage` maps several languages, e.g. typescript/javascript, onto the SAME port/process
-     *  — see `createE2bLspManager`). On a RE-open (transport heal after the E2B proxy idle-killed the WS) the
-     *  original bridge process is still listening with the FIRST token — a fresh random token would be rejected
-     *  and the reconnect would always fail. */
-    token?: string;
-    /** WS scheme for the bridge URL. E2B's `getHost` returns a public TLS proxy host → `wss` (default);
-     *  the k8s adapter returns a cluster-internal `podIP:port` → plain `ws` (no TLS on the pod network;
-     *  the per-session bridge token still gates access). */
-    scheme?: "ws" | "wss";
-    /** Observability hook (open/heal/degrade events) — prod wires the service logger. */
-    log?: (event: string, fields: Record<string, unknown>) => void;
-    /** §DESIGN-V2 F11: metrics registry (structural — matches the narrow surface remote-env-e2b.ts's `cfg.metrics`
-     *  already uses). `provider`/`generation`/`reason` labels are filled in by this module, never left freeform. */
-    metrics?: {
-        inc(name: string, labels?: Record<string, string>): void;
-    };
-    /** §DESIGN-V2 F11: the deployment lane feeding this manager (boot/execution-env.ts passes it explicitly —
-     *  "e2b" or "k8s" — rather than this module guessing it back out of `scheme`, which is a WS-protocol detail
-     *  that happens to correlate with the lane but isn't the same axis). Defaults to inferring from `scheme` only
-     *  so existing callers that don't pass it (tests) keep working. */
-    provider?: string;
-    /** §DESIGN-V2 F2/C6: health-probe override for tests (no real sandbox network). Defaults to a real
-     *  `GET /healthz` fetch (1s timeout) — `scheme` maps to the probe's URL scheme, F11 (`wss→https`, `ws→http`). */
-    probe?: (env: LspCapableEnv, port: number, token: string, scheme: "ws" | "wss") => Promise<boolean>;
-}
-/** Start (+ install on a non-baked template) the language server + bridge inside THIS env's sandbox, then connect.
- *  Every call starts (or re-starts) the bridge unconditionally — the one production caller is
- *  `createE2bLspManager`, which de-dupes per env+port before ever reaching here (see its doc). */
-export declare function openE2bLspTransport(language: string, env: LspCapableEnv, opts?: E2bLspOptions): Promise<LspTransport | undefined>;
-/** §DESIGN-V2 A: `starting` while the write+install+startBackground sequence is in flight; `ready` once at
- *  least one WS connect through this generation has succeeded; `dead` once this generation is confirmed (or
- *  presumed, per its own failure) unusable — the ONLY way out of `dead` is minting a new generation. */
-export type BridgeState = "starting" | "ready" | "dead";
-/**
- * §DESIGN-V2 A/F3/F6: one bridge RESOURCE per env+port (not per language — `portForLanguage` maps
- * typescript/javascript onto the SAME port/process off the same `SERVER_CMD`, HRD-LSP-4). A crashed/never-
- * booted bridge can be replaced by minting a new `generation` (bounded by `MAX_BRIDGE_GENERATIONS` — a
- * crash-loop must degrade the language, not burn the sandbox indefinitely); the NEW generation is only ever
- * minted after `terminateBridgeCommand` confirms the OLD one actually stopped (F3) — an unconfirmed kill risks
- * EADDRINUSE permanently rejecting the new generation's fresh token (the old process is still the one
- * listening, and its token check has no way to know a replacement was intended).
- */
-export interface E2bBridgeHandle {
-    readonly port: number;
-    /** Pinned once per generation — the shared bridge resource's auth secret. A per-LANGUAGE token would be
-     *  rejected by the one bridge process actually listening whenever two languages share a port (see the
-     *  module doc's HRD-LSP-4 reference): the second language mints a different token, the bridge only
-     *  recognizes whichever token started it, auth fails, retries exhaust, and that language is permanently
-     *  degraded to grep/read_file for the task. */
-    readonly token: string;
-    /** The `LSP_CMD` this generation's bridge process was launched with — identity documentation (ts/js sharing
-     *  one value/port/process is legitimate, §DESIGN-V2 "不做"); not read back by this module. */
-    readonly serverCmd: string;
-    /** 1 at first mint; +1 every restart. Bounds the restart budget (`MAX_BRIDGE_GENERATIONS`). */
-    readonly generation: number;
-    state: BridgeState;
-    /** The most recent human-readable diagnostic (write/install/start/connect failure, or a probe verdict) —
-     *  feeds `lastError`-style debugging; the MODEL-facing word is `deathReason` (via `unavailableReason`), not
-     *  this free-text string. */
-    lastError?: string;
-    /** The SPECIFIC reason THIS generation died (unset while starting/ready). `unavailableReason`-facing
-     *  reporting overrides this to `bridge-restart-budget-exhausted` once `generation >= MAX_BRIDGE_GENERATIONS`
-     *  — "further restarts won't help" is a different (and, once true, more useful) word than "what killed the
-     *  last one." */
-    deathReason?: LspUnavailableReason;
-    /** True once this generation has completed at least one real WS connect. Gates the fast healthz-probe heal
-     *  path (§DESIGN-V2 F2/F6): a generation that has never connected yet is still cold-starting, not dead —
-     *  treating an unreachable healthz as "dead" during that window would misjudge ordinary boot lag as a crash
-     *  and burn a restart generation for nothing. A generation that HAS connected before, though, really should
-     *  be reachable again quickly, so it skips the blind 6×1500ms retry loop and asks the bridge directly. */
-    everConnected: boolean;
-    /** Resolves once the write+install+startBackground sequence has been ATTEMPTED for this generation — `false`
-     *  (with `state` already flipped to `dead` + `deathReason`/`lastError` set) means it failed before ever
-     *  reaching a connect attempt. */
-    ready: Promise<boolean>;
-}
-/** A crash-loop must degrade the language, not retry the sandbox forever. 3 covers "an occasional OOM kill";
- *  a bridge that dies again immediately after 3 fresh starts is a standing failure, not a blip. */
-export declare const MAX_BRIDGE_GENERATIONS = 3;
-/** The single shared `LspServerManager` for the deployment (`RunnerDeps.lspManager`). */
-export declare function createE2bLspManager(opts?: E2bLspOptions): E2bLspManager;
-//# sourceMappingURL=e2b-manager.d.ts.map

package/dist/lsp/e2b-manager.js

@@ -1,178 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { connectWsLspTransport } from "./ws-transport.js";
-import { E2bLspManager } from "./manager.js";
-import { BRIDGE_DIR, BRIDGE_SOURCE, TSSERVER_JS_PATH, LSP_SETUP_LOG, bridgeLogFile, lspInstallCommand, lspStartCommand, portForLanguage, SERVER_CMD, terminateBridgeCommand, } from "./e2b-bridge.js";
-function describeErr(e) {
-    return e instanceof Error ? e.message : String(e);
-}
-async function tailLog(env, path, lines = 40, capBytes = 4096) {
-    const r = await env.exec(`tail -n ${lines} ${path} 2>/dev/null`).catch(() => undefined);
-    if (!r?.ok)
-        return undefined;
-    const out = r.value?.stdout ?? "";
-    return out.length > capBytes ? out.slice(-capBytes) : out;
-}
-function httpSchemeFor(scheme) {
-    return scheme === "wss" ? "https" : "http";
-}
-async function defaultProbeHealthz(env, port, token, scheme) {
-    const host = await env.getHost(port);
-    if (!host)
-        return false;
-    try {
-        const res = await fetch(`${httpSchemeFor(scheme)}://${host}/healthz?token=${token}`, { signal: AbortSignal.timeout(1000) });
-        return res.ok;
-    }
-    catch {
-        return false;
-    }
-}
-async function startE2bBridge(language, env, port, token) {
-    const wrote = await env.writeFile(`${BRIDGE_DIR}/bridge.cjs`, BRIDGE_SOURCE).catch((e) => ({ ok: false, error: e }));
-    if (!wrote.ok) {
-        const detail = "error" in wrote && wrote.error !== undefined ? `bridge.cjs write failed: ${describeErr(wrote.error)}` : "bridge.cjs write failed";
-        return { ok: false, reason: "bridge-start-failed", detail };
-    }
-    const installed = await env.exec(lspInstallCommand(language)).catch(() => undefined);
-    if (!installed || !installed.ok || installed.value?.exitCode !== 0) {
-        const snippet = await tailLog(env, LSP_SETUP_LOG);
-        return { ok: false, reason: "install-failed", detail: snippet ? `install failed: ${snippet}` : "install failed (no setup log)" };
-    }
-    try {
-        await env.startBackground(lspStartCommand(language, port, token));
-    }
-    catch (e) {
-        return { ok: false, reason: "bridge-start-failed", detail: `background start failed: ${describeErr(e)}` };
-    }
-    return { ok: true };
-}
-async function connectE2bLspBridge(env, port, token, opts, language) {
-    const connect = opts?.connect ?? connectWsLspTransport;
-    const retry = opts?.retry ?? { attempts: 6, delayMs: 1500 };
-    const root = env.workspaceHandle().mountPath;
-    const initOptions = language === "typescript" || language === "javascript" ? { tsserver: { path: TSSERVER_JS_PATH } } : undefined;
-    const scheme = opts?.scheme ?? "wss";
-    for (let attempt = 0; attempt < retry.attempts; attempt++) {
-        const host = await env.getHost(port);
-        if (host) {
-            const transport = await connect(`${scheme}://${host}/?token=${token}`, root, undefined, initOptions);
-            if (transport)
-                return transport;
-        }
-        await new Promise((r) => setTimeout(r, retry.delayMs));
-    }
-    return undefined;
-}
-export async function openE2bLspTransport(language, env, opts) {
-    if (!SERVER_CMD[language])
-        return undefined;
-    const port = portForLanguage(language);
-    const token = opts?.token ?? randomUUID();
-    const started = await startE2bBridge(language, env, port, token);
-    if (!started.ok)
-        return undefined;
-    return connectE2bLspBridge(env, port, token, opts, language);
-}
-export const MAX_BRIDGE_GENERATIONS = 3;
-export function createE2bLspManager(opts) {
-    const bridges = new WeakMap();
-    const scheme = opts?.scheme ?? "wss";
-    const provider = opts?.provider ?? (scheme === "ws" ? "k8s" : "e2b");
-    const log = opts?.log ?? (() => { });
-    const metrics = opts?.metrics;
-    const probe = opts?.probe ?? defaultProbeHealthz;
-    function reasonFor(handle) {
-        if (handle.generation >= MAX_BRIDGE_GENERATIONS)
-            return "bridge-restart-budget-exhausted";
-        return handle.deathReason ?? "bridge-connect-exhausted";
-    }
-    function markDead(handle, reason, detail) {
-        if (handle.state === "dead")
-            return reasonFor(handle);
-        handle.state = "dead";
-        handle.deathReason = reason;
-        handle.lastError = detail;
-        const reported = reasonFor(handle);
-        metrics?.inc("lsp_bridge_dead_total", { reason: reported });
-        log("lsp_bridge_dead", { port: handle.port, generation: handle.generation, reason: reported, detail });
-        return reported;
-    }
-    async function postmortem(env, port) {
-        const tail = await tailLog(env, bridgeLogFile());
-        if (tail !== undefined)
-            log("lsp_bridge_postmortem", { port, tail });
-    }
-    return new E2bLspManager({
-        log: opts?.log,
-        metrics,
-        hasServerCommand: (language) => Boolean(SERVER_CMD[language]),
-        transportFactory: async (language, env) => {
-            if (!SERVER_CMD[language])
-                return { ok: false, reason: "no-server-command" };
-            const port = portForLanguage(language);
-            let perPort = bridges.get(env);
-            if (!perPort) {
-                perPort = new Map();
-                bridges.set(env, perPort);
-            }
-            let handle = perPort.get(port);
-            if (!handle || handle.state === "dead") {
-                if (handle && handle.generation >= MAX_BRIDGE_GENERATIONS)
-                    return { ok: false, reason: reasonFor(handle) };
-                const priorHandle = handle;
-                const generation = handle ? handle.generation + 1 : 1;
-                const token = opts?.token ?? randomUUID();
-                const newHandle = {
-                    port,
-                    token,
-                    serverCmd: SERVER_CMD[language],
-                    generation,
-                    state: "starting",
-                    everConnected: false,
-                    ready: Promise.resolve(false),
-                };
-                newHandle.ready = (async () => {
-                    if (priorHandle) {
-                        const released = await env.exec(terminateBridgeCommand(port)).catch(() => undefined);
-                        if (!released?.ok || released.value?.exitCode !== 0) {
-                            markDead(newHandle, "bridge-start-failed", "previous generation could not be confirmed stopped — held back from starting to avoid a doomed EADDRINUSE race");
-                            log("lsp_bridge_restart_blocked", { port, generation });
-                            return false;
-                        }
-                    }
-                    const started = await startE2bBridge(language, env, port, token);
-                    if (!started.ok) {
-                        markDead(newHandle, started.reason ?? "bridge-start-failed", started.detail ?? "bridge start failed");
-                        return false;
-                    }
-                    metrics?.inc("lsp_bridge_start_total", { provider, generation: String(generation) });
-                    log("lsp_bridge_start", { port, generation });
-                    return true;
-                })();
-                perPort.set(port, newHandle);
-                handle = newHandle;
-            }
-            const started = await handle.ready;
-            if (!started)
-                return { ok: false, reason: reasonFor(handle) };
-            if (handle.everConnected) {
-                const alive = await probe(env, handle.port, handle.token, scheme);
-                if (!alive) {
-                    const reason = markDead(handle, "bridge-connect-exhausted", "healthz probe reported the bridge unreachable");
-                    await postmortem(env, port);
-                    return { ok: false, reason };
-                }
-            }
-            const transport = await connectE2bLspBridge(env, handle.port, handle.token, opts, language);
-            if (!transport) {
-                const reason = markDead(handle, "bridge-connect-exhausted", "bridge connect exhausted after all retries");
-                await postmortem(env, port);
-                return { ok: false, reason };
-            }
-            handle.everConnected = true;
-            handle.state = "ready";
-            return { ok: true, transport };
-        },
-    });
-}
-//# sourceMappingURL=e2b-manager.js.map

package/dist/lsp/lsp-frames.d.ts

@@ -1,14 +0,0 @@
-/**
- * The LSP stdio Content-Length frame decoder, as JS SOURCE — embedded verbatim into `BRIDGE_SOURCE` (which runs
- * inside the E2B sandbox, can't import TS) AND unit-tested here (test/lsp-frames.test.ts evals this same string).
- * So the in-sandbox parser is actually exercised (council #5: the untestable raw-string parser was the risk).
- *
- * Guards: a frame claiming a non-finite / negative / over-cap length is skipped instead of looping or waiting
- * forever (council #1 defense); the accumulator is dropped if it exceeds the cap with no complete frame (council
- * #2 — a server that never sends `\r\n\r\n`, or a huge Content-Length, can't grow the buffer without bound).
- * The runaway cap carries a `HEADER_SLACK` (core 1.196 #6 twin): a VALID frame whose PAYLOAD passes the
- * `len <= maxBytes` check but whose `Content-Length: <n>\r\n\r\n` header pushes header+payload just over `maxBytes`
- * must NOT be wiped mid-arrival (that silently dropped an in-window legal reply) — so cap at `maxBytes + 128`.
- */
-export declare const FRAME_DECODER_JS: string;
-//# sourceMappingURL=lsp-frames.d.ts.map

package/dist/lsp/lsp-frames.js

@@ -1,25 +0,0 @@
-export const FRAME_DECODER_JS = String.raw `
-function makeFrameDecoder(maxBytes) {
-  var HEADER_SLACK = 128; // room for "Content-Length: <n>\r\n\r\n" ON TOP of a max-size payload (core 1.196 #6 twin)
-  let buf = Buffer.alloc(0);
-  return function decode(chunk) {
-    const frames = [];
-    buf = Buffer.concat([buf, chunk]);
-    if (buf.length > maxBytes + HEADER_SLACK) buf = Buffer.alloc(0); // runaway / no delimiter → drop (council #2); +slack so a valid frame isn't wiped when its header pushes total past maxBytes (core #6)
-    for (;;) {
-      const he = buf.indexOf('\r\n\r\n');
-      if (he === -1) break;
-      const m = /Content-Length:\s*(\d+)/i.exec(buf.slice(0, he).toString('ascii'));
-      if (!m) { buf = buf.slice(he + 4); continue; }
-      const len = Number(m[1]);
-      if (!Number.isFinite(len) || len < 0 || len > maxBytes) { buf = buf.slice(he + 4); continue; } // skip bad frame (council #1/#2)
-      const start = he + 4;
-      if (buf.length < start + len) break; // wait for the rest of this frame
-      frames.push(buf.slice(start, start + len).toString('utf8'));
-      buf = buf.slice(start + len);
-    }
-    return frames;
-  };
-}
-`;
-//# sourceMappingURL=lsp-frames.js.map