@timurproko/a1 0.2.6-dev.736 → 0.2.7-dev.1221

package/dist/foundation/process-containment/native-guardian-containment.js

@@ -1,152 +0,0 @@
-import { spawn } from "node:child_process";
-import { mkdir, readFile, rm } from "node:fs/promises";
-import { dirname, resolve } from "node:path";
-import { PRODUCT_IDENTITY } from "../../product-identity.js";
-/** Delegates one root runtime to the native guardian and exposes its verified containment identity. */
-export class NativeGuardianContainment {
-    #identity;
-    #helper = null;
-    #rootIdentity = null;
-    #outcome = null;
-    instanceId;
-    helperPath;
-    statusPath;
-    exitNoticePath;
-    constructor(instanceId, helperPath, statusPath, exitNoticePath = null) {
-        this.instanceId = instanceId;
-        this.helperPath = helperPath;
-        this.statusPath = statusPath;
-        this.exitNoticePath = exitNoticePath;
-        this.#identity = { provider: "native-guardian-pending", token: instanceId };
-    }
-    get identity() {
-        return this.#identity;
-    }
-    async spawn(executable, arguments_, options) {
-        if (this.#helper)
-            throw new Error("process containment already has a root runtime");
-        await mkdir(dirname(this.statusPath), { recursive: true, mode: 0o700 });
-        await rm(this.statusPath, { force: true });
-        if (this.exitNoticePath)
-            await rm(this.exitNoticePath, { force: true });
-        const helper = spawn(this.helperPath, [
-            "--parent-pid", String(process.pid),
-            "--instance", this.instanceId,
-            "--status-file", this.statusPath,
-            ...(this.exitNoticePath ? ["--exit-notice", this.exitNoticePath] : []),
-            "--", executable, ...arguments_,
-        ], {
-            cwd: options.cwd,
-            env: {
-                ...options.environment,
-                ...(options.terminalType ? { TERM: options.terminalType } : {}),
-                // Protocol: the runtime arms this notice and the guardian prints it if the runtime dies unclean.
-                ...(this.exitNoticePath ? { [PRODUCT_IDENTITY.environment.exitNoticePath]: this.exitNoticePath } : {}),
-            },
-            shell: false,
-            stdio: "inherit",
-            windowsHide: false,
-        });
-        this.#helper = helper;
-        this.#outcome = helperOutcome(helper);
-        const status = await waitForReadyStatus(this.statusPath, this.#outcome, 5_000);
-        this.#rootIdentity = { pid: status.pid, startIdentity: status.startIdentity };
-        this.#identity = { provider: status.containmentProvider, token: status.containmentToken };
-        return { identity: this.#rootIdentity, outcome: this.#outcome };
-    }
-    async contains(identity) {
-        return this.#rootIdentity !== null
-            && identity.pid === this.#rootIdentity.pid
-            && identity.startIdentity === this.#rootIdentity.startIdentity;
-    }
-    async stop(force) {
-        const root = this.#rootIdentity;
-        if (!root)
-            return;
-        try {
-            process.kill(root.pid, force ? "SIGKILL" : "SIGTERM");
-        }
-        catch { }
-    }
-    async waitForEmpty(timeoutMs) {
-        if (!this.#helper || this.#helper.exitCode !== null || this.#helper.signalCode !== null)
-            return true;
-        return await new Promise(resolvePromise => {
-            const timer = setTimeout(() => finish(false), timeoutMs);
-            timer.unref();
-            const finish = (empty) => {
-                clearTimeout(timer);
-                this.#helper?.off("close", onClose);
-                resolvePromise(empty);
-            };
-            const onClose = () => finish(true);
-            this.#helper?.once("close", onClose);
-        });
-    }
-    async close() {
-        const helper = this.#helper;
-        if (helper && helper.exitCode === null && helper.signalCode === null)
-            helper.kill("SIGKILL");
-        await this.waitForEmpty(1_500);
-        await rm(this.statusPath, { force: true });
-        if (this.exitNoticePath)
-            await rm(this.exitNoticePath, { force: true });
-    }
-}
-export function resolveProcessGuardianPath(releaseRoot, environment = process.env, platform = process.platform, architecture = process.arch) {
-    const override = environment[PRODUCT_IDENTITY.environment.processGuardianPath]?.trim();
-    if (override)
-        return resolve(override);
-    const executable = platform === "win32"
-        ? `${PRODUCT_IDENTITY.artifacts.processGuardianExecutable}.exe`
-        : PRODUCT_IDENTITY.artifacts.processGuardianExecutable;
-    return resolve(releaseRoot, "dist", "native", `${platform}-${architecture}`, executable);
-}
-function helperOutcome(helper) {
-    return new Promise(resolvePromise => {
-        let settled = false;
-        const settle = (outcome) => {
-            if (settled)
-                return;
-            settled = true;
-            resolvePromise(outcome);
-        };
-        helper.once("error", error => settle({ kind: "guardian-error", message: error.message, code: errorCode(error) }));
-        helper.once("close", (code, signal) => {
-            if (signal)
-                settle({ kind: "signaled", signal });
-            else
-                settle({ kind: "exited", exitCode: code ?? 1 });
-        });
-    });
-}
-async function waitForReadyStatus(path, outcome, timeoutMs) {
-    const deadline = Date.now() + timeoutMs;
-    let terminalOutcome = null;
-    void outcome.then(value => { terminalOutcome = value; });
-    while (Date.now() < deadline) {
-        try {
-            const value = JSON.parse(await readFile(path, "utf8"));
-            if (isReadyStatus(value))
-                return value;
-            throw new Error("process guardian published invalid ready status");
-        }
-        catch (error) {
-            if (!(error instanceof Error && "code" in error && error.code === "ENOENT"))
-                throw error;
-        }
-        if (terminalOutcome)
-            throw new Error(`process guardian exited before readiness: ${JSON.stringify(terminalOutcome)}`);
-        await new Promise(resolvePromise => setTimeout(resolvePromise, 20));
-    }
-    throw new Error(`process guardian did not publish readiness within ${timeoutMs}ms`);
-}
-function isReadyStatus(value) {
-    return Number.isSafeInteger(value.pid) && Number(value.pid) > 0
-        && typeof value.startIdentity === "string" && value.startIdentity.length > 0
-        && typeof value.containmentProvider === "string" && value.containmentProvider.length > 0
-        && typeof value.containmentToken === "string" && value.containmentToken.length > 0;
-}
-function errorCode(error) {
-    return "code" in error && typeof error.code === "string" ? error.code : null;
-}

package/dist/foundation/process-containment/windows-process-inspector.d.ts

@@ -1,19 +0,0 @@
-import type { NativeProcessIdentity } from "../lifecycle/index.js";
-import type { NativeProcessInspector } from "./contracts.js";
-export interface InspectorCommandResult {
-    readonly exitCode: number;
-    readonly stdout: string;
-    readonly stderr: string;
-}
-export interface InspectorCommandRunner {
-    run(executable: string, arguments_: readonly string[]): Promise<InspectorCommandResult>;
-}
-/** Verifies Windows process identity through the bounded process-guardian inspection command. */
-export declare class WindowsNativeProcessInspector implements NativeProcessInspector {
-    readonly helperPath: string;
-    private readonly runner;
-    private readonly identityPrefix;
-    constructor(helperPath: string, runner?: InspectorCommandRunner, identityPrefix?: string);
-    observe(pid: number): Promise<NativeProcessIdentity | null>;
-    matches(identity: NativeProcessIdentity): Promise<boolean>;
-}

package/dist/foundation/process-containment/windows-process-inspector.js

@@ -1,56 +0,0 @@
-import { execFile } from "node:child_process";
-/** Verifies Windows process identity through the bounded process-guardian inspection command. */
-export class WindowsNativeProcessInspector {
-    helperPath;
-    runner;
-    identityPrefix;
-    constructor(helperPath, runner = defaultRunner, identityPrefix = "windows-filetime:") {
-        this.helperPath = helperPath;
-        this.runner = runner;
-        this.identityPrefix = identityPrefix;
-        if (!helperPath || helperPath.includes("\0"))
-            throw new TypeError("process guardian helper path is invalid");
-    }
-    async observe(pid) {
-        if (!Number.isSafeInteger(pid) || pid <= 0)
-            throw new TypeError("inspected PID must be a positive safe integer");
-        const result = await this.runner.run(this.helperPath, ["--inspect-pid", String(pid)]);
-        if (result.exitCode === 3)
-            return null;
-        if (result.exitCode !== 0) {
-            const detail = result.stderr.trim() || `helper exited ${result.exitCode}`;
-            throw Object.assign(new Error(`cannot inspect native process identity: ${detail}`), { code: "PROCESS_INSPECTION_FAILED" });
-        }
-        let value;
-        try {
-            value = JSON.parse(result.stdout);
-        }
-        catch {
-            throw Object.assign(new Error("process guardian returned malformed identity data"), { code: "PROCESS_INSPECTION_INVALID" });
-        }
-        if (!isIdentity(value) || value.pid !== pid || !value.startIdentity.startsWith(this.identityPrefix)) {
-            throw Object.assign(new Error("process guardian returned mismatched identity data"), { code: "PROCESS_INSPECTION_INVALID" });
-        }
-        return value;
-    }
-    async matches(identity) {
-        const observed = await this.observe(identity.pid);
-        return observed !== null && observed.startIdentity === identity.startIdentity;
-    }
-}
-const defaultRunner = {
-    async run(executable, arguments_) {
-        return await new Promise(resolvePromise => {
-            execFile(executable, [...arguments_], { windowsHide: true, timeout: 2_000, maxBuffer: 8 * 1_024 }, (error, stdout, stderr) => {
-                const exitCode = error && "code" in error && typeof error.code === "number" ? error.code : error ? 1 : 0;
-                resolvePromise({ exitCode, stdout, stderr });
-            });
-        });
-    },
-};
-function isIdentity(value) {
-    return typeof value === "object" && value !== null
-        && "pid" in value && Number.isSafeInteger(value.pid) && Number(value.pid) > 0
-        && "startIdentity" in value && typeof value.startIdentity === "string"
-        && value.startIdentity.length > 0 && value.startIdentity.length <= 512 && !value.startIdentity.includes("\0");
-}