@tokensmind/agent-network 0.1.0 → 0.1.3

package/skills/{tokensmind-agent-network-runtime → tokensmind-agent-network}/scripts/lib/api-client.js

@@ -12,7 +12,7 @@ const CLIENT_VERSION = '0.1.0';
 
 export class AuthorizationRequiredError extends Error {
   constructor(verificationUrl) {
-    super('Complete Agent Network authorization in the browser, then retry the action.');
+    super('Default browser handoff failed; resume the pending action to continue polling.');
     this.name = 'AuthorizationRequiredError';
     this.status = 'authorization_required';
     this.verificationUrl = verificationUrl;
@@ -54,7 +54,19 @@ export function createActionApi(options = {}) {
     baseUrl, stateDir, platform, env, homeDir, hostname, browser, http, store, writeEvent,
   } = resolveOptions(options);
   const origin = normalizeBaseUrl(baseUrl);
-  const resolvedStore = store || createCredentialStore({ stateDir, origin, platform, env, homeDir });
+  const resolvedStore = store || createCredentialStore({
+    stateDir,
+    origin,
+    platform,
+    env,
+    homeDir,
+    onFallback: ({ backend, directory, reason }) => writeEvent({
+      event: 'credential_store_fallback',
+      backend,
+      directory,
+      reason,
+    }),
+  });
   const workflowStore = createWorkflowStore({ stateDir, origin, platform, homeDir });
   const connector = createConnector({
     baseUrl: origin,

package/skills/{tokensmind-agent-network-runtime → tokensmind-agent-network}/scripts/lib/contact-action.js

@@ -19,7 +19,7 @@ async function resolveTarget(context) {
   const name = text(target.name);
   if (!name) requireInput(['target.id or target.name']);
   const agents = await context.get(
-    `/agent-network-api/agents?q=${encodeURIComponent(name)}&limit=20`,
+    `/agent-network-api/agents?q=${encodeURIComponent(name)}`,
   );
   if (!Array.isArray(agents) || agents.length === 0) {
     actionFailure('TARGET_AGENT_NOT_FOUND', `No Agent matched "${name}".`);

package/skills/tokensmind-agent-network/scripts/lib/memory-actions.js

@@ -0,0 +1,112 @@
+import { actionFailure, requireInput } from './action-errors.js';
+import { getMyAgent } from './agent-actions.js';
+import { isObject, optionalLimit, requiredId, requiredText, text } from './action-validation.js';
+
+const MEMORY_KINDS = new Set(['agent_experience', 'matching_preference']);
+const MEMORY_POLARITIES = new Set(['negative', 'positive']);
+const MEMORY_SCOPES = new Set(['contextual', 'global']);
+// platform_event 由服务端独占写入，客户端提交会被拒绝。
+const MEMORY_SOURCES = new Set(['model_inferred', 'user_explicit']);
+const MEMORY_STATUSES = new Set(['active', 'deleted', 'pending_review', 'rejected']);
+const MAX_INFERRED_CONFIDENCE = 0.6;
+
+function requireChoice(input, field, allowed) {
+  const value = text(input?.[field]).toLowerCase();
+  if (!allowed.has(value)) requireInput([field], `${field} has an unsupported value.`);
+  return value;
+}
+
+function optionalConfidence(value, sourceType) {
+  if (value === undefined || value === null || value === '') {
+    return sourceType === 'model_inferred' ? MAX_INFERRED_CONFIDENCE : 1;
+  }
+  const confidence = Number(value);
+  const inferredLimitExceeded = sourceType === 'model_inferred'
+    && confidence > MAX_INFERRED_CONFIDENCE;
+  if (!Number.isFinite(confidence) || confidence <= 0 || confidence > 1 || inferredLimitExceeded) {
+    requireInput(['confidence'], 'confidence must be above 0 and no more than 0.6 for inferred memory.');
+  }
+  return confidence;
+}
+
+async function ownedAgent(context) {
+  const agent = await getMyAgent(context);
+  if (!agent) actionFailure('AGENT_PROFILE_REQUIRED', 'Create the account Agent profile first.');
+  return agent;
+}
+
+function agentPath(agentId, suffix) {
+  return `/agent-network-api/agents/${encodeURIComponent(agentId)}/${suffix}`;
+}
+
+function optionalText(input, field) {
+  return Object.hasOwn(input, field) ? text(input[field]) || null : null;
+}
+
+function memoryBody(input) {
+  if (!isObject(input)) requireInput(['input']);
+  const sourceType = requireChoice(input, 'sourceType', MEMORY_SOURCES);
+  const scope = input.scope ? requireChoice(input, 'scope', MEMORY_SCOPES) : 'contextual';
+  const contextText = scope === 'global' ? '' : requiredText(input, 'contextText');
+  return {
+    clientMemoryId: requiredText(input, 'clientMemoryId'),
+    confidence: optionalConfidence(input.confidence, sourceType),
+    contextText,
+    conversationId: optionalText(input, 'conversationId'),
+    expiresAt: optionalText(input, 'expiresAt'),
+    kind: requireChoice(input, 'kind', MEMORY_KINDS),
+    polarity: requireChoice(input, 'polarity', MEMORY_POLARITIES),
+    requirementId: optionalText(input, 'requirementId'),
+    scope,
+    sourceType,
+    statement: requiredText(input, 'statement'),
+    targetAgentId: optionalText(input, 'targetAgentId'),
+  };
+}
+
+function listQuery(input) {
+  const params = new URLSearchParams({ limit: String(optionalLimit(input.limit)) });
+  if (input.offset !== undefined) {
+    const offset = Number(input.offset);
+    if (!Number.isInteger(offset) || offset < 0) requireInput(['offset']);
+    params.set('offset', String(offset));
+  }
+  if (input.status) params.set('status', requireChoice(input, 'status', MEMORY_STATUSES));
+  return params.toString();
+}
+
+export async function getMemorySettings(context) {
+  const agent = await ownedAgent(context);
+  return context.get(agentPath(agent.id, 'memory-settings'));
+}
+
+export async function proposeMemory(context) {
+  const body = memoryBody(context.input);
+  const agent = await ownedAgent(context);
+  const settings = await context.get(agentPath(agent.id, 'memory-settings'));
+  if (settings?.collectionEnabled !== true) {
+    actionFailure('MEMORY_COLLECTION_DISABLED', 'Memory collection is disabled for this Agent.');
+  }
+  return context.mutate({
+    method: 'POST',
+    path: agentPath(agent.id, 'memories'),
+    body,
+    label: 'memory:propose',
+  });
+}
+
+export async function listMemories(context) {
+  const query = listQuery(context.input);
+  const agent = await ownedAgent(context);
+  return context.get(`${agentPath(agent.id, 'memories')}?${query}`);
+}
+
+export async function deleteMemory(context) {
+  const memoryId = requiredId(context.input, 'memoryId');
+  const agent = await ownedAgent(context);
+  return context.mutate({
+    method: 'DELETE',
+    path: `${agentPath(agent.id, 'memories')}/${encodeURIComponent(memoryId)}`,
+    label: 'memory:delete',
+  });
+}

package/skills/{tokensmind-agent-network-runtime → tokensmind-agent-network}/scripts/lib/runtime/connector.js

@@ -8,7 +8,6 @@ import {
 } from './deviceAuthorization.js';
 import {
   buildBusinessUrl,
-  isPublicDiscoveryRequest,
   validateBusinessRequest,
 } from './requestPolicy.js';
 
@@ -47,15 +46,6 @@ function assertActiveCredential(active) {
   return active;
 }
 
-function authorizationPending(verificationUrl) {
-  const error = new Error(
-    'Complete Agent Network authorization in the browser, then retry the action.',
-  );
-  error.status = 'authorization_required';
-  error.verificationUrl = verificationUrl;
-  return error;
-}
-
 async function executeBusinessRequest({ operation, token, baseUrl, http, signal }) {
   return http.request({
     url: buildBusinessUrl(baseUrl, operation.path),
@@ -90,7 +80,6 @@ async function authorize({ operation, store, browser, baseUrl, http, client, sig
       pending = await createRemoteAuthorization({ pending, baseUrl, http, client, signal });
       await store.write('pending', pending);
       await browser.open(pending.authorization.verificationUrl);
-      throw authorizationPending(pending.authorization.verificationUrl);
     }
     if (pending.phase === 'authorizing') {
       await waitForApproval({ pending, baseUrl, http, signal });
@@ -131,6 +120,11 @@ function isInvalidAgentCredential(error) {
     ].includes(error.code);
 }
 
+function requiresAuthorization(error) {
+  return error instanceof AgentNetworkHttpError
+    && (error.status === 401 || isInvalidAgentCredential(error));
+}
+
 async function executeAndFinalize({ pending, active, dependencies }) {
   assertActiveCredential(active);
   try {
@@ -144,7 +138,7 @@ async function executeAndFinalize({ pending, active, dependencies }) {
   } catch (error) {
     if (error instanceof AgentNetworkHttpError && error.status < 500 && error.status !== 429) {
       await dependencies.store.remove('pending');
-      if (isInvalidAgentCredential(error)) await dependencies.store.remove('active');
+      if (requiresAuthorization(error)) await dependencies.store.remove('active');
     }
     throw error;
   }
@@ -170,7 +164,7 @@ export function createConnector({ store, browser, baseUrl, http, client }) {
     try {
       return await executeBusinessRequest({ operation, token: active.token, baseUrl, http, signal });
     } catch (error) {
-      if (!isInvalidAgentCredential(error)) throw error;
+      if (!requiresAuthorization(error)) throw error;
       await store.remove('active');
       return authorizeAndExecute(operation, signal);
     }
@@ -181,15 +175,10 @@ export function createConnector({ store, browser, baseUrl, http, client }) {
     const normalized = validateBusinessRequest(params);
     const operation = { ...normalized, body: params.body };
     const reauthorize = params.reauthorize === true;
+
     const pending = await store.read('pending');
     const active = await store.read('active');
-
     if (pending) return resumePending(pending, operation, signal);
-
-    if (isPublicDiscoveryRequest(operation) && !reauthorize) {
-      return executeBusinessRequest({ operation, baseUrl, http, signal });
-    }
-
     if (!active || reauthorize) return authorizeAndExecute(operation, signal);
     return executeWithActive(operation, active, signal);
   }

package/skills/{tokensmind-agent-network-runtime → tokensmind-agent-network}/scripts/lib/runtime/credentialStore.js

@@ -6,7 +6,10 @@ import {
   originNamespace,
   resolvePortableStateDir,
 } from './portableStore.js';
-import { resolveSystemCredentialStore } from './systemCredentialStore.js';
+import {
+  resolveSystemCredentialStore,
+  SystemCredentialStoreError,
+} from './systemCredentialStore.js';
 
 const RECORD_NAMES = Object.freeze(['instance', 'pending', 'active']);
 
@@ -122,6 +125,53 @@ function createFileStores({ directories, origin, platform, env, homeDir, fs, ran
   }));
 }
 
+async function validateSystemRecords(systemStore) {
+  for (const name of RECORD_NAMES) await systemStore.read(name);
+}
+
+async function initializeStore({
+  systemStore, fallback, fallbackDirectory, legacyDirectories, storeOptions, onFallback,
+}) {
+  const recordDirectory = path.join(
+    fallbackDirectory, originNamespace(storeOptions.origin),
+  );
+  const legacySources = createFileStores({
+    ...storeOptions, directories: legacyDirectories,
+  });
+  if (!systemStore) {
+    onFallback({
+      backend: null,
+      directory: recordDirectory,
+      reason: 'No supported system credential store is available',
+    });
+    await migrateCredentialStores({ target: fallback, sources: legacySources });
+    return fallback;
+  }
+  try {
+    if (typeof systemStore.verifyAvailability !== 'function') {
+      throw new SystemCredentialStoreError(
+        'System credential store does not support availability verification',
+      );
+    }
+    await systemStore.verifyAvailability();
+    await validateSystemRecords(systemStore);
+    const sources = createFileStores({
+      ...storeOptions, directories: [fallbackDirectory, ...legacyDirectories],
+    });
+    await migrateCredentialStores({ target: systemStore, sources });
+    return systemStore;
+  } catch (error) {
+    if (!(error instanceof SystemCredentialStoreError)) throw error;
+    onFallback({
+      backend: systemStore.backend,
+      directory: recordDirectory,
+      reason: error.message,
+    });
+    await migrateCredentialStores({ target: fallback, sources: legacySources });
+    return fallback;
+  }
+}
+
 export function createCredentialStore({
   stateDir,
   origin,
@@ -133,6 +183,7 @@ export function createCredentialStore({
   secureStore,
   resolveSecureStore = resolveSystemCredentialStore,
   run,
+  onFallback = () => {},
 } = {}) {
   if (stateDir) {
     return createPortableStore({ stateDir, origin, platform, env, homeDir, fs, randomId });
@@ -147,16 +198,14 @@ export function createCredentialStore({
         platform, namespace: originNamespace(origin), env, fs, run,
       })
       : secureStore;
-    const target = systemStore || fallback;
-    const sourceDirectories = [
-      ...(systemStore ? [fallbackDirectory] : []),
-      ...resolveLegacyStateDirs({ platform, env, homeDir }),
-    ];
-    const sources = createFileStores({
-      directories: [...new Set(sourceDirectories)],
-      origin, platform, env, homeDir, fs, randomId,
+    const legacyDirectories = resolveLegacyStateDirs({ platform, env, homeDir });
+    return initializeStore({
+      systemStore,
+      fallback,
+      fallbackDirectory,
+      legacyDirectories: [...new Set(legacyDirectories)],
+      storeOptions: { origin, platform, env, homeDir, fs, randomId },
+      onFallback,
     });
-    await migrateCredentialStores({ target, sources });
-    return target;
   });
 }

package/skills/{tokensmind-agent-network-runtime → tokensmind-agent-network}/scripts/lib/runtime/requestPolicy.js

@@ -1,8 +1,6 @@
 import { INTERNAL_PATH_PATTERNS, MUTATION_METHODS } from './constants.js';
 
 const SUPPORTED_METHODS = new Set(['GET', 'POST', 'PATCH', 'DELETE']);
-const PUBLIC_AGENT_DIRECTORY_PATH = '/agent-network-api/agents';
-
 export function normalizeBaseUrl(value) {
   const url = new URL(value);
   if (!['http:', 'https:'].includes(url.protocol)) {
@@ -44,12 +42,3 @@ export function buildBusinessUrl(baseUrl, path) {
   }
   return url.toString();
 }
-
-export function isPublicDiscoveryRequest({ method, path }) {
-  if (method !== 'GET') return false;
-  const url = new URL(path, 'https://tokensmind.invalid');
-  const mineRequested = [...url.searchParams.entries()]
-    .some(([key, value]) => key === 'mine' && value === '1');
-  return url.pathname === PUBLIC_AGENT_DIRECTORY_PATH
-    && !mineRequested;
-}

package/skills/tokensmind-agent-network/scripts/lib/runtime/systemCredentialStore.js

@@ -0,0 +1,245 @@
+import { isDeepStrictEqual } from 'node:util';
+import { randomUUID } from 'node:crypto';
+import { constants as fsConstants, promises as defaultFs } from 'node:fs';
+import path from 'node:path';
+import { validatePortableRecord } from './portableStore.js';
+import {
+  commandFailure,
+  createCommandRunner,
+  runCommand,
+  SystemCredentialStoreError,
+  verifyRoundTrip,
+} from './systemCredentialSupport.js';
+
+export { createCommandRunner, SystemCredentialStoreError } from './systemCredentialSupport.js';
+
+const SERVICE_NAME = 'TokensMind Agent Network';
+const APPLICATION_NAME = 'tokensmind-agent-network';
+const RECORD_NAMES = new Set(['active', 'pending', 'instance']);
+const MACOS_SECURITY_PATH = '/usr/bin/security';
+const MACOS_ITEM_NOT_FOUND = 44;
+const SYSTEM_STORE_PROBE_LENGTH = 1024;
+
+function validateRecordName(name) {
+  if (!RECORD_NAMES.has(name)) throw new Error(`Unsupported portable state record: ${name}`);
+}
+
+function credentialAccount(namespace, name) {
+  validateRecordName(name);
+  return `${namespace}:${name}`;
+}
+
+function parseRecord(name, source) {
+  let value;
+  try {
+    value = JSON.parse(source);
+  } catch (error) {
+    throw new SystemCredentialStoreError(
+      `System Agent Network ${name} credential is invalid JSON`,
+      { cause: error },
+    );
+  }
+  try {
+    validatePortableRecord(name, value);
+  } catch (error) {
+    throw new SystemCredentialStoreError(
+      `System Agent Network ${name} credential has an invalid structure`,
+      { cause: error },
+    );
+  }
+  return value;
+}
+
+function macPasswordInput(source) {
+  return `${source}\n${source}\n`;
+}
+
+function createProbeValue() {
+  return randomUUID().padEnd(SYSTEM_STORE_PROBE_LENGTH, 'x');
+}
+
+function createMacCommands(run) {
+  const backend = 'macOS Keychain';
+  async function readSource(account) {
+    const result = await runCommand({
+      run, backend, operation: 'read',
+      request: {
+        command: MACOS_SECURITY_PATH,
+        args: ['find-generic-password', '-a', account, '-s', SERVICE_NAME, '-w'],
+      },
+    });
+    if (result.code === MACOS_ITEM_NOT_FOUND) return null;
+    if (result.code !== 0) throw commandFailure(backend, 'read', result);
+    return result.stdout.trim();
+  }
+  async function writeSource(account, source) {
+    const result = await runCommand({
+      run, backend, operation: 'write',
+      request: {
+        command: MACOS_SECURITY_PATH,
+        args: ['add-generic-password', '-a', account, '-s', SERVICE_NAME, '-U', '-w'],
+        input: macPasswordInput(source),
+      },
+    });
+    if (result.code !== 0) throw commandFailure(backend, 'write', result);
+  }
+  async function removeAccount(account) {
+    const result = await runCommand({
+      run, backend, operation: 'remove',
+      request: {
+        command: MACOS_SECURITY_PATH,
+        args: ['delete-generic-password', '-a', account, '-s', SERVICE_NAME],
+      },
+    });
+    if (![0, MACOS_ITEM_NOT_FOUND].includes(result.code)) {
+      throw commandFailure(backend, 'remove', result);
+    }
+  }
+  return { readSource, writeSource, removeAccount };
+}
+
+function createMacOperations({ namespace, run }) {
+  const { readSource, writeSource, removeAccount } = createMacCommands(run);
+  async function readRecord(name) {
+    const source = await readSource(credentialAccount(namespace, name));
+    return source === null ? null : parseRecord(name, source);
+  }
+  return {
+    read: readRecord,
+    async write(name, value) {
+      validateRecordName(name);
+      validatePortableRecord(name, value);
+      const account = credentialAccount(namespace, name);
+      await writeSource(account, JSON.stringify(value));
+      const stored = await readRecord(name);
+      if (!isDeepStrictEqual(stored, value)) {
+        throw new SystemCredentialStoreError(`macOS Keychain ${name} write verification failed`);
+      }
+    },
+    async remove(name) {
+      await removeAccount(credentialAccount(namespace, name));
+    },
+    async verifyAvailability() {
+      const account = `${namespace}:probe:${randomUUID()}`;
+      const expected = createProbeValue();
+      await verifyRoundTrip({
+        expected,
+        write: (source) => writeSource(account, source),
+        read: () => readSource(account),
+        remove: () => removeAccount(account),
+      });
+    },
+    backend: 'macos-keychain',
+  };
+}
+
+function linuxAttributes(namespace, name) {
+  validateRecordName(name);
+  return ['application', APPLICATION_NAME, 'origin', namespace, 'record', name];
+}
+
+function createLinuxCommands({ command, run }) {
+  const backend = 'Linux Secret Service';
+  async function lookupSource(attributes) {
+    const result = await runCommand({
+      run, backend, operation: 'read',
+      request: { command, args: ['lookup', ...attributes] },
+    });
+    const missing = result.code === 1 && !result.stdout.trim() && !result.stderr.trim();
+    if (missing) return null;
+    if (result.code !== 0) throw commandFailure(backend, 'read', result);
+    return result.stdout.trim();
+  }
+  async function writeSource(attributes, source) {
+    const result = await runCommand({
+      run, backend, operation: 'write',
+      request: {
+        command,
+        args: ['store', `--label=${SERVICE_NAME}`, ...attributes],
+        input: `${source}\n`,
+      },
+    });
+    if (result.code !== 0) throw commandFailure(backend, 'write', result);
+  }
+  async function removeAttributes(attributes) {
+    if (await lookupSource(attributes) === null) return;
+    const result = await runCommand({
+      run, backend, operation: 'remove',
+      request: { command, args: ['clear', ...attributes] },
+    });
+    if (result.code !== 0) throw commandFailure(backend, 'remove', result);
+  }
+  return { lookupSource, writeSource, removeAttributes };
+}
+
+function createLinuxOperations({ namespace, command, run }) {
+  const { lookupSource, writeSource, removeAttributes } = createLinuxCommands({ command, run });
+  async function readRecord(name) {
+    const source = await lookupSource(linuxAttributes(namespace, name));
+    return source === null ? null : parseRecord(name, source);
+  }
+  return {
+    read: readRecord,
+    async write(name, value) {
+      validatePortableRecord(name, value);
+      const attributes = linuxAttributes(namespace, name);
+      await writeSource(attributes, JSON.stringify(value));
+      if (!isDeepStrictEqual(await readRecord(name), value)) {
+        throw new SystemCredentialStoreError(`Linux Secret Service ${name} write verification failed`);
+      }
+    },
+    async remove(name) {
+      await removeAttributes(linuxAttributes(namespace, name));
+    },
+    async verifyAvailability() {
+      const probeName = `probe-${randomUUID()}`;
+      const attributes = [
+        'application', APPLICATION_NAME, 'origin', namespace, 'record', probeName,
+      ];
+      const expected = createProbeValue();
+      await verifyRoundTrip({
+        expected,
+        write: (source) => writeSource(attributes, source),
+        read: () => lookupSource(attributes),
+        remove: () => removeAttributes(attributes),
+      });
+    },
+    backend: 'linux-secret-service',
+  };
+}
+
+async function isExecutable(fs, filePath) {
+  try {
+    await fs.access(filePath, fsConstants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function findExecutable({ name, env, fs }) {
+  const directories = String(env.PATH || '').split(path.delimiter).filter(Boolean);
+  for (const directory of directories) {
+    const candidate = path.join(directory, name);
+    if (await isExecutable(fs, candidate)) return candidate;
+  }
+  return null;
+}
+
+export async function resolveSystemCredentialStore({
+  platform,
+  namespace,
+  env = process.env,
+  fs = defaultFs,
+  run = createCommandRunner(),
+} = {}) {
+  if (platform === 'darwin') {
+    if (!await isExecutable(fs, MACOS_SECURITY_PATH)) return null;
+    return createMacOperations({ namespace, run });
+  }
+  if (platform === 'linux') {
+    const command = await findExecutable({ name: 'secret-tool', env, fs });
+    return command ? createLinuxOperations({ namespace, command, run }) : null;
+  }
+  return null;
+}

package/skills/tokensmind-agent-network/scripts/lib/runtime/systemCredentialSupport.js

@@ -0,0 +1,71 @@
+import { spawn as defaultSpawn } from 'node:child_process';
+
+export class SystemCredentialStoreError extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = 'SystemCredentialStoreError';
+    this.code = 'SYSTEM_CREDENTIAL_STORE_UNAVAILABLE';
+  }
+}
+
+export function commandFailure(backend, operation, result) {
+  return new SystemCredentialStoreError(
+    `${backend} ${operation} failed with exit code ${String(result.code)}`,
+  );
+}
+
+export async function runCommand({ run, backend, operation, request }) {
+  try {
+    return await run(request);
+  } catch (error) {
+    throw new SystemCredentialStoreError(`${backend} ${operation} failed`, { cause: error });
+  }
+}
+
+export async function verifyRoundTrip({ write, read, remove, expected }) {
+  let failure;
+  try {
+    await write(expected);
+    if (await read() !== expected) {
+      failure = new SystemCredentialStoreError('System credential store round-trip failed');
+    }
+  } catch (error) {
+    failure = error;
+  }
+  try {
+    await remove();
+  } catch (error) {
+    failure ||= error;
+  }
+  if (failure) throw failure;
+}
+
+export function createCommandRunner({ spawnImpl = defaultSpawn } = {}) {
+  return ({ command, args, input = '' }) => new Promise((resolve, reject) => {
+    const child = spawnImpl(command, args, { stdio: ['pipe', 'pipe', 'pipe'] });
+    const stdout = [];
+    const stderr = [];
+    let settled = false;
+    child.stdout.on('data', (chunk) => stdout.push(chunk));
+    child.stderr.on('data', (chunk) => stderr.push(chunk));
+    child.stdin.on('error', (error) => {
+      if (error.code === 'EPIPE' || settled) return;
+      settled = true;
+      reject(error);
+    });
+    child.on('error', (error) => {
+      if (settled) return;
+      settled = true;
+      reject(error);
+    });
+    child.on('close', (code) => {
+      if (settled) return;
+      resolve({
+        code,
+        stdout: Buffer.concat(stdout).toString('utf8'),
+        stderr: Buffer.concat(stderr).toString('utf8'),
+      });
+    });
+    child.stdin.end(input);
+  });
+}