@struktoai/mirage-dsh 0.0.1 → 0.0.6

package/dist/chunk-QTBMLMKT.js

@@ -0,0 +1,698 @@
+import {
+  TailBuffer,
+  tailCap
+} from "./chunk-2F2PJ7D7.js";
+
+// src/shell.ts
+import { DSH_ENV_PREFIX, ShellExecutor } from "@deepseek-ai/dsh-shell";
+import {
+  Channel as Channel2,
+  JobConsole,
+  KILLED_OUTCOME,
+  RAMConsoleStore,
+  exitOutcome
+} from "@struktoai/mirage-core/shell/console/index";
+import { setCwd } from "@struktoai/mirage-core/workspace/session/shell_dirs";
+import { sessionView } from "@struktoai/mirage-core/workspace/session/state";
+
+// src/spill.ts
+import { Channel } from "@struktoai/mirage-core/shell/console/index";
+async function ensureDirPath(dirs, dir) {
+  let path = "";
+  for (const part of dir.split("/").filter((p) => p !== "")) {
+    path += `/${part}`;
+    if (await dirs.exists(path)) continue;
+    try {
+      await dirs.mkdir(path);
+    } catch (err) {
+      if (!await dirs.exists(path)) throw err;
+    }
+  }
+}
+function totalLength(parts) {
+  return parts.reduce((sum, p) => sum + p.byteLength, 0);
+}
+function concat(parts) {
+  const out = new Uint8Array(totalLength(parts));
+  let at = 0;
+  for (const p of parts) {
+    out.set(p, at);
+    at += p.byteLength;
+  }
+  return out;
+}
+var SpillSink = class {
+  stdoutPath;
+  stderrPath;
+  target;
+  dir;
+  base;
+  onFailure;
+  started = false;
+  failed = false;
+  stdoutParts = [];
+  stderrParts = [];
+  constructor(target, dir, base, onFailure = () => void 0) {
+    this.target = target;
+    this.dir = dir;
+    this.base = base;
+    this.onFailure = onFailure;
+  }
+  /** Buffer a chunk before spill starts, or append it to the file after. */
+  async ingest(channel, data) {
+    if (this.failed) return;
+    if (!this.started) {
+      if (channel === Channel.STDERR) this.stderrParts.push(data);
+      else this.stdoutParts.push(data);
+      return;
+    }
+    await this.appendFile(channel, data);
+  }
+  /** Flush the buffered streams to files; called once, on the first overrun. */
+  async begin() {
+    if (this.started || this.failed) return;
+    try {
+      await this.target.ensureDir(this.dir);
+      if (totalLength(this.stdoutParts) > 0) {
+        this.stdoutPath = `${this.dir}/${this.base}.stdout`;
+        await this.target.write(this.stdoutPath, concat(this.stdoutParts));
+      }
+      if (totalLength(this.stderrParts) > 0) {
+        this.stderrPath = `${this.dir}/${this.base}.stderr`;
+        await this.target.write(this.stderrPath, concat(this.stderrParts));
+      }
+      this.started = true;
+      this.stdoutParts = [];
+      this.stderrParts = [];
+    } catch (err) {
+      this.onFailure(err);
+      this.disable();
+    }
+  }
+  async appendFile(channel, data) {
+    try {
+      if (channel === Channel.STDERR) {
+        if (this.stderrPath === void 0) {
+          this.stderrPath = `${this.dir}/${this.base}.stderr`;
+          await this.target.write(this.stderrPath, data);
+        } else {
+          await this.target.append(this.stderrPath, data);
+        }
+      } else {
+        if (this.stdoutPath === void 0) {
+          this.stdoutPath = `${this.dir}/${this.base}.stdout`;
+          await this.target.write(this.stdoutPath, data);
+        } else {
+          await this.target.append(this.stdoutPath, data);
+        }
+      }
+    } catch (err) {
+      this.onFailure(err);
+      this.disable();
+    }
+  }
+  /**
+   * Give up on spilling and report no path.
+   *
+   * Called on a write failure, and by a reader that discovers it lost
+   * bytes before they ever reached here: a file missing the middle of
+   * the stream is worse than no file, because the path presents it as
+   * the whole one.
+   */
+  disable() {
+    this.failed = true;
+    this.stdoutPath = void 0;
+    this.stderrPath = void 0;
+    this.stdoutParts = [];
+    this.stderrParts = [];
+  }
+};
+
+// src/shell.ts
+var DEFAULT_TIMEOUT_MS = 12e4;
+var MAX_TIMEOUT_MS = 6e5;
+var DEFAULT_STDOUT_MAX_BYTES = 2e5;
+var DEFAULT_STDERR_MAX_BYTES = 64e3;
+var STDERR_MARKER = new TextEncoder().encode("\n--- stderr ---\n");
+var CONSOLE_RETENTION_DELTAS = 5;
+var spillCounter = 0;
+var SINK_PREFIX = "/dev";
+var DENIAL_SIGNATURES = ["read-only mount at ", ": Permission denied", ": Read-only file system"];
+function collect(text, maxBytes) {
+  const capped = tailCap(text, maxBytes);
+  return { text: capped.text, truncated: capped.truncated };
+}
+function executeOptions(spec, workdir, signal, sessionId, bound, fallbackWorkdir, sink) {
+  const managed = spec.dshEnv ?? {};
+  const env = bound ? { ...spec.env ?? {} } : { ...spec.env ?? {}, ...managed };
+  const cwd = workdir !== "" ? workdir : bound ? void 0 : fallbackWorkdir;
+  return {
+    signal,
+    ...sessionId !== void 0 ? { sessionId } : {},
+    ...cwd !== void 0 ? { cwd } : {},
+    ...Object.keys(env).length > 0 ? { env } : {},
+    ...spec.stdin !== void 0 ? { stdin: new TextEncoder().encode(spec.stdin) } : {},
+    ...sink !== void 0 ? { sink } : {}
+  };
+}
+var MirageShellProcess = class {
+  status = "running";
+  exitCode = null;
+  signal = null;
+  sandbox;
+  done;
+  controller;
+  console;
+  budget;
+  spill;
+  sandboxInfo;
+  consumed;
+  pending;
+  lossy = false;
+  inStderr = false;
+  settled = false;
+  expectSeq = 0;
+  constructor(run, controller, console_, budget, spill, sandboxInfo) {
+    this.controller = controller;
+    this.console = console_;
+    this.budget = budget;
+    this.pending = new TailBuffer(budget);
+    this.spill = spill;
+    this.sandboxInfo = sandboxInfo;
+    this.consumed = this.consume();
+    this.done = run.then(
+      (result) => this.settle(result, null),
+      (err) => this.settle(null, err)
+    );
+  }
+  async consume() {
+    for await (const chunk of this.console.follow(0)) {
+      if (chunk.channel === Channel2.CONTROL) return;
+      if (chunk.seq !== this.expectSeq) {
+        this.lossy = true;
+        this.spill?.disable();
+      }
+      this.expectSeq = chunk.seq + 1;
+      await this.appendChunk(chunk);
+    }
+  }
+  async appendChunk(chunk) {
+    if (this.spill !== null) await this.spill.ingest(chunk.channel, chunk.data);
+    let dropped = false;
+    if (chunk.channel === Channel2.STDERR) {
+      if (!this.inStderr) {
+        dropped = this.pending.append(STDERR_MARKER);
+        this.inStderr = true;
+      }
+    } else {
+      this.inStderr = false;
+    }
+    dropped = this.pending.append(chunk.data) || dropped;
+    if (dropped) {
+      this.lossy = true;
+      if (this.spill !== null) await this.spill.begin();
+    }
+  }
+  async settle(result, err) {
+    this.settled = true;
+    if (this.sandboxInfo !== void 0) this.sandbox = this.sandboxInfo;
+    let outcome;
+    if (result !== null) {
+      this.status = "completed";
+      this.exitCode = result.exitCode;
+      outcome = exitOutcome(result.exitCode);
+    } else {
+      this.status = "killed";
+      this.signal = "SIGTERM";
+      const message = err instanceof Error ? err.message : String(err);
+      await this.console.emit(Channel2.STDERR, new TextEncoder().encode(message));
+      outcome = KILLED_OUTCOME;
+    }
+    await this.console.finish(outcome);
+    await this.consumed;
+  }
+  readOutput() {
+    const delta = this.pending.take();
+    const lossy = this.lossy;
+    this.lossy = false;
+    return {
+      delta,
+      lossy,
+      ...this.spill?.stdoutPath !== void 0 ? { stdoutSpillPath: this.spill.stdoutPath } : {},
+      ...this.spill?.stderrPath !== void 0 ? { stderrSpillPath: this.spill.stderrPath } : {}
+    };
+  }
+  kill() {
+    if (this.settled) return false;
+    this.controller.abort();
+    return true;
+  }
+};
+var MirageShellExecutor = class extends ShellExecutor {
+  static inject = ["mirage"];
+  workdir;
+  defaultTimeoutMs;
+  maxTimeoutMs;
+  stdoutMaxBytes;
+  stderrMaxBytes;
+  sessionId;
+  spillDir;
+  sessionReady = null;
+  readOnlyReady = null;
+  constructor(ctx, config = {}) {
+    super(ctx);
+    this.workdir = config.workdir ?? "/";
+    this.defaultTimeoutMs = config.defaultTimeoutMs ?? DEFAULT_TIMEOUT_MS;
+    this.maxTimeoutMs = config.maxTimeoutMs ?? MAX_TIMEOUT_MS;
+    this.stdoutMaxBytes = config.stdoutMaxBytes ?? DEFAULT_STDOUT_MAX_BYTES;
+    this.stderrMaxBytes = config.stderrMaxBytes ?? DEFAULT_STDERR_MAX_BYTES;
+    this.sessionId = config.sessionId;
+    this.spillDir = config.spillDir;
+  }
+  // The workspace may still be building (declarative mounts resolve
+  // asynchronously), so every execution awaits the service's `ready`.
+  workspace() {
+    return this.ctx.mirage.ready;
+  }
+  /**
+   * The directory this command actually runs in.
+   *
+   * dsh fills an unspecified workdir from the calling session's cwd (by
+   * way of the sandbox policy's workspace root), and that is a directory
+   * on the harness's own machine, which names nothing here. Running
+   * there leaves `pwd` reporting a path the agent cannot reach and every
+   * relative path failing, and, because a per-call cwd forks a subshell,
+   * it also defeats a bound session on every call. So a workdir that is
+   * not a directory in this world is treated as unset: the configured
+   * default when unbound, the session's own cwd when bound.
+   *
+   * @param spec the resolved spec whose workdir is being placed.
+   * @returns the workdir to execute under, `''` meaning the session's own.
+   */
+  async worldWorkdir(spec) {
+    if (spec.workdir === "") return "";
+    const ws = await this.workspace();
+    if (await ws.fs.isDir(spec.workdir)) return spec.workdir;
+    return this.sessionId === void 0 ? this.workdir : "";
+  }
+  // A spill sink for one background command, or null when no spill
+  // directory is configured. The target reaches the live workspace so
+  // the full stream lands on a mount the agent can read back.
+  newSpill() {
+    const dir = this.spillDir;
+    if (dir === void 0) return null;
+    const target = {
+      ensureDir: async (d) => {
+        const ws = await this.workspace();
+        await ensureDirPath({ exists: (p) => ws.fs.exists(p), mkdir: (p) => ws.fs.mkdir(p) }, d);
+      },
+      write: async (p, bytes) => {
+        const ws = await this.workspace();
+        await ws.fs.writeFile(p, bytes);
+      },
+      append: async (p, bytes) => {
+        const ws = await this.workspace();
+        await ws.fs.append(p, bytes);
+      }
+    };
+    spillCounter += 1;
+    const log = this.ctx.logger("mirage-dsh");
+    return new SpillSink(target, dir, `mirage-shell-${spillCounter.toString()}`, (err) => {
+      log.debug("spill to %s failed, output will not be recoverable: %o", dir, err);
+    });
+  }
+  /**
+   * With every runtime in the world reaching only the vfs
+   * (`ctx.mirage.vfsOnly`), the workspace dispatch is the single gate
+   * for anything a command can do, so this executor behaves like a
+   * workspace-write sandbox: reads and writes land only where mounts
+   * (and their modes) allow. Declaring it lets sandbox-aware plugins
+   * (dsh's permission presets) compose over this executor. A world
+   * holding a runtime with doors around the gate (the host `local`
+   * python, a remote sandbox) voids that claim, so this answers
+   * undefined then (the base contract's "does not sandbox") and those
+   * plugins refuse to compose instead of trusting a lie.
+   */
+  get sandboxMode() {
+    return this.ctx.mirage.vfsOnly ? "workspace-write" : void 0;
+  }
+  /**
+   * The mode this one call runs under: the policy the caller resolved
+   * for it, or this executor's own default when the call carried none.
+   * Undefined keeps the "no claim" answer for a world some runtime can
+   * act outside of, where no mode would be true.
+   *
+   * @param spec the resolved spec whose policy is being read.
+   * @returns the effective mode, or undefined when nothing is claimed.
+   */
+  modeFor(spec) {
+    const declared = this.sandboxMode;
+    if (declared === void 0) return void 0;
+    return spec.sandboxPolicy?.mode ?? declared;
+  }
+  /**
+   * The session this call runs in: the read-only twin when the policy
+   * confines it to reads, else this executor's own binding.
+   *
+   * `workspace-write` and `danger-full-access` both run in the ordinary
+   * session, because the mounts and their modes already are the
+   * workspace boundary and mirage has nothing wider to grant.
+   *
+   * @param spec the resolved spec whose policy selects the session.
+   * @returns the session id to execute under, or undefined for the default.
+   */
+  async sessionFor(spec) {
+    if (this.modeFor(spec) !== "read-only") return this.sessionId;
+    return this.readOnlySession();
+  }
+  /**
+   * The sandbox facts to stamp on this run's result and process handle,
+   * or undefined when the world is not fully workspace-bound (no claim).
+   *
+   * `enforcement` is 'full': when every runtime reaches only the vfs, the
+   * workspace gate cannot be bypassed, so unlike an OS sandbox on an older
+   * kernel there is no promised effect it fails to govern. `runnerFailed`
+   * is false because the workspace executor is the runner and a failure to
+   * run surfaces as a rejected/aborted execution, not a runner that never
+   * started.
+   *
+   * @param spec the resolved spec this run was built from.
+   * @param denied whether the run was refused a write by the narrowing.
+   * @returns the facts to stamp, or undefined when nothing is claimed.
+   */
+  sandboxInfo(spec, denied = false) {
+    const mode = this.modeFor(spec);
+    if (mode === void 0) return void 0;
+    return { mode, denied, enforcement: "full", runnerFailed: false };
+  }
+  /**
+   * The retention budget of a background command's console.
+   *
+   * Only the background path caps retention: there a follow loop drains
+   * the console while the command still runs, so the budget bounds what
+   * the loop has not reached yet, and a chunk lost to it is reported as
+   * a gap in the sequence. A foreground console is read once, after the
+   * fact, with nothing to bound.
+   *
+   * @param spec the resolved spec carrying the stdout budget.
+   * @returns the retention budget in bytes.
+   */
+  retentionFor(spec) {
+    return Math.max(spec.stdoutMaxBytes, this.stderrMaxBytes) * CONSOLE_RETENTION_DELTAS;
+  }
+  /**
+   * Take a finished run's two streams off its console, capped, and spill
+   * whichever one lost bytes.
+   *
+   * A foreground run streams into a console rather than returning its
+   * output whole, because mirage throws on abort: bytes a killed command
+   * had already printed are recoverable from a sink and nowhere else.
+   * Only a truncated stream spills, since an untruncated one is already
+   * whole in `text` and writing a file for it would put a copy of every
+   * command's output on a mount. The console this reads is untrimmed, so
+   * a spill is the whole stream rather than the tail of one.
+   *
+   * @param console_ the console this run streamed into.
+   * @param spec the resolved spec carrying the stdout budget.
+   * @returns the capped streams, each with a spill path when it lost bytes.
+   */
+  async collectFrom(console_, spec) {
+    const decoder = new TextDecoder();
+    const outBytes = await console_.snapshot(Channel2.STDOUT);
+    const errBytes = await console_.snapshot(Channel2.STDERR);
+    const stdout = collect(decoder.decode(outBytes), spec.stdoutMaxBytes);
+    const stderr = collect(decoder.decode(errBytes), this.stderrMaxBytes);
+    if (!stdout.truncated && !stderr.truncated) return { stdout, stderr };
+    const spill = this.newSpill();
+    if (spill === null) return { stdout, stderr };
+    if (stdout.truncated) await spill.ingest(Channel2.STDOUT, outBytes);
+    if (stderr.truncated) await spill.ingest(Channel2.STDERR, errBytes);
+    await spill.begin();
+    return {
+      stdout: {
+        ...stdout,
+        ...spill.stdoutPath !== void 0 ? { spillPath: spill.stdoutPath } : {}
+      },
+      stderr: {
+        ...stderr,
+        ...spill.stderrPath !== void 0 ? { spillPath: spill.stderrPath } : {}
+      }
+    };
+  }
+  /**
+   * Whether this run was refused, by the session's permission document
+   * or by the read-only narrowing.
+   *
+   * The document's refusals ride the result itself: a `Deny`, an
+   * unanswered ask and a policy that raised all leave `refusal` on the
+   * `ExecuteResult`, whatever the line did with its streams (`2>&1`, a
+   * trailing command that owns the status). That record is read for
+   * every call, because a role's `commands.deny` and `commands.ask`
+   * rules bind under `workspace-write` and `danger-full-access` alike:
+   * a mode says what the mounts allow, and says nothing about whether a
+   * rule forbids the line. The narrowing has no record, since it is
+   * EROFS/EACCES from the mounts, so its signatures are still read off
+   * stderr, and only for a call that ran read-only, where this executor
+   * is what imposed it.
+   *
+   * @param spec the resolved spec this run was built from.
+   * @param result what the workspace answered.
+   * @param stderr the run's captured standard error.
+   * @returns true when something refused the run.
+   */
+  wasDenied(spec, result, stderr) {
+    if (result.refusal !== null) return true;
+    if (this.modeFor(spec) !== "read-only") return false;
+    return DENIAL_SIGNATURES.some((signature) => stderr.includes(signature));
+  }
+  resolve(request) {
+    const workdir = request.workdir ?? (this.sessionId === void 0 ? this.workdir : "");
+    return {
+      command: request.command,
+      workdir,
+      timeoutMs: Math.min(request.timeoutMs ?? this.defaultTimeoutMs, this.maxTimeoutMs),
+      stdoutMaxBytes: request.stdoutMaxBytes ?? this.stdoutMaxBytes,
+      signal: request.signal,
+      stdin: request.stdin,
+      env: request.env,
+      dshEnv: request.dshEnv,
+      sandboxPolicy: request.sandboxPolicy
+    };
+  }
+  ensureSession() {
+    if (this.sessionId === void 0) return Promise.resolve();
+    this.sessionReady ??= this.provisionSession(this.sessionId).catch((err) => {
+      this.sessionReady = null;
+      throw err;
+    });
+    return this.sessionReady;
+  }
+  /**
+   * Seed this call's managed `DSH_*` snapshot into the bound session.
+   *
+   * These are harness facts about the session (its home, its id), not
+   * overrides for one command, and on a bound session they have to live
+   * in the session: handed over as a per-call `env` they would fork a
+   * subshell on every call, since dsh never sends an empty snapshot.
+   *
+   * The snapshot replaces rather than merges, per the seam's own rule
+   * that a fact absent from the current snapshot must not inherit a
+   * stale value from an earlier one. Only the managed namespace is
+   * touched, so a variable the agent exported itself is left alone.
+   *
+   * @param ws the live workspace holding the session.
+   * @param sessionId the session this call runs in.
+   * @param spec the resolved spec carrying the snapshot.
+   */
+  async applyManagedEnv(ws, sessionId, spec) {
+    const managed = spec.dshEnv;
+    if (managed === void 0) return;
+    const session = ws.getSession(sessionId);
+    const view = sessionView(session);
+    for (const key of Object.keys(session.env)) {
+      if (key.startsWith(DSH_ENV_PREFIX) && !(key in managed)) await view.unset(key);
+    }
+    for (const [key, value] of Object.entries(managed)) await view.set(key, value);
+  }
+  readOnlySession() {
+    this.readOnlyReady ??= this.provisionReadOnly().catch((err) => {
+      this.readOnlyReady = null;
+      throw err;
+    });
+    return this.readOnlyReady;
+  }
+  /**
+   * Create (once) the session a read-only call runs in: a twin of the
+   * session this executor would otherwise use, with every grant it holds
+   * narrowed to `read`, so mirage's own dispatch is what refuses the
+   * write rather than a second permission layer bolted on here.
+   *
+   * The twin narrows, never widens, and that takes every part of the
+   * source's view, which is what `narrow` in core stamps: modes, hidden
+   * paths, hidden variables, command rules. Its modes cover every mount
+   * at `read` (the one exception is the null sink, per
+   * {@link SINK_PREFIX}), which is at least as narrow as whatever the
+   * source held, since `read` is the weakest mode there is; naming a
+   * mount only narrows it, so a prefix the map omits would keep its own
+   * mode rather than disappear. The other three are copied from the
+   * source session rather than recompiled, because the profile it was
+   * created under is not something a session records.
+   *
+   * Leaving any of them behind widens. Hides are the obvious one: a
+   * binding confined to `/allowed` would read `/secret` in read-only
+   * mode although the same command is refused outside it. Command rules
+   * are the one modes cannot stand in for, because a mode bounds a
+   * mount and an account CLI reaches a service: a profile that denies
+   * `slack message send` or `git push` still denies it here, where
+   * every mount being `read` says nothing at all about it.
+   *
+   * The policy's `workspaceRoot` is deliberately not consulted anywhere:
+   * it is a directory on the harness's machine, so containment against
+   * it says nothing about this world. The mounts are the boundary.
+   *
+   * @returns the id of the read-only session.
+   */
+  async provisionReadOnly() {
+    const ws = await this.workspace();
+    const sessionId = `${this.sessionId ?? "mirage-dsh"}::read-only`;
+    await ws.ensureSessionsLoaded();
+    if (ws.listSessions().some((s) => s.sessionId === sessionId)) return sessionId;
+    const source = ws.getSession(this.sessionId ?? ws.defaultSessionId);
+    const grants = {};
+    for (const entry of ws.mounts()) {
+      grants[entry.prefix] = entry.prefix.replace(/\/+$/, "") === SINK_PREFIX ? "exec" : "read";
+    }
+    const hide = [...source.hiddenPaths?.paths ?? [], ...source.hiddenPaths?.patterns ?? []];
+    const twin = ws.createSession(sessionId, {
+      mounts: grants,
+      ...hide.length > 0 ? { permissions: { paths: { hide } } } : {}
+    });
+    twin.commands = source.commands;
+    twin.hiddenVars = source.hiddenVars;
+    setCwd(twin, this.workdir);
+    return sessionId;
+  }
+  async provisionSession(sessionId) {
+    const ws = await this.workspace();
+    await ws.ensureSessionsLoaded();
+    if (ws.listSessions().some((s) => s.sessionId === sessionId)) return;
+    setCwd(ws.createSession(sessionId), this.workdir);
+  }
+  async run(spec) {
+    const sandbox = this.sandboxInfo(spec);
+    if (spec.signal?.aborted === true) {
+      return {
+        exitCode: null,
+        signal: "SIGTERM",
+        timedOut: false,
+        aborted: true,
+        timeoutMs: spec.timeoutMs,
+        stdout: { text: "", truncated: false },
+        stderr: { text: "", truncated: false },
+        ...sandbox !== void 0 ? { sandbox } : {}
+      };
+    }
+    const controller = new AbortController();
+    const console_ = new JobConsole(new RAMConsoleStore(null));
+    let timedOut = false;
+    let aborted = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      controller.abort();
+    }, spec.timeoutMs);
+    const onAbort = () => {
+      if (!timedOut && !aborted) {
+        aborted = true;
+        controller.abort();
+      }
+    };
+    spec.signal?.addEventListener("abort", onAbort, { once: true });
+    try {
+      await this.ensureSession();
+      const ws = await this.workspace();
+      const sessionId = await this.sessionFor(spec);
+      const bound = this.sessionId !== void 0;
+      if (bound && sessionId !== void 0) await this.applyManagedEnv(ws, sessionId, spec);
+      const workdir = await this.worldWorkdir(spec);
+      const result = await ws.execute(
+        spec.command,
+        executeOptions(spec, workdir, controller.signal, sessionId, bound, this.workdir, console_)
+      );
+      const captured = await this.collectFrom(console_, spec);
+      const settled = this.sandboxInfo(spec, this.wasDenied(spec, result, captured.stderr.text));
+      return {
+        exitCode: result.exitCode,
+        signal: null,
+        timedOut: false,
+        aborted: false,
+        timeoutMs: spec.timeoutMs,
+        ...captured,
+        ...settled !== void 0 ? { sandbox: settled } : {}
+      };
+    } catch (err) {
+      if (!controller.signal.aborted) throw err;
+      return {
+        exitCode: null,
+        signal: "SIGTERM",
+        timedOut,
+        aborted,
+        timeoutMs: spec.timeoutMs,
+        // Whatever the command printed before the kill landed. GNU's own
+        // timeout keeps it, and a model that watched a build run for two
+        // minutes is owed the log rather than an empty string.
+        ...await this.collectFrom(console_, spec),
+        ...sandbox !== void 0 ? { sandbox } : {}
+      };
+    } finally {
+      clearTimeout(timer);
+      spec.signal?.removeEventListener("abort", onAbort);
+    }
+  }
+  start(spec) {
+    const sandbox = this.sandboxInfo(spec);
+    const controller = new AbortController();
+    const console_ = new JobConsole(new RAMConsoleStore(this.retentionFor(spec)));
+    const spill = this.newSpill();
+    if (spec.signal?.aborted === true) {
+      controller.abort();
+      return new MirageShellProcess(
+        Promise.reject(new Error("command aborted before start")),
+        controller,
+        console_,
+        spec.stdoutMaxBytes,
+        spill,
+        sandbox
+      );
+    }
+    const onAbort = () => {
+      controller.abort();
+    };
+    spec.signal?.addEventListener("abort", onAbort, { once: true });
+    const run = this.ensureSession().then(async () => {
+      const sessionId = await this.sessionFor(spec);
+      const ws = await this.workspace();
+      const bound = this.sessionId !== void 0;
+      if (bound && sessionId !== void 0) await this.applyManagedEnv(ws, sessionId, spec);
+      return { ws, sessionId, bound, workdir: await this.worldWorkdir(spec) };
+    }).then(
+      ({ ws, sessionId, bound, workdir }) => ws.execute(
+        spec.command,
+        executeOptions(
+          spec,
+          workdir,
+          controller.signal,
+          sessionId,
+          bound,
+          this.workdir,
+          console_
+        )
+      )
+    ).finally(() => spec.signal?.removeEventListener("abort", onAbort));
+    return new MirageShellProcess(run, controller, console_, spec.stdoutMaxBytes, spill, sandbox);
+  }
+};
+
+export {
+  MirageShellExecutor
+};
+//# sourceMappingURL=chunk-QTBMLMKT.js.map