@yhyzgn/tikeo 0.1.911

package/dist/script/runtimeDirs.js

@@ -0,0 +1,81 @@
+import { mkdtempSync, mkdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+let sequence = 0;
+export class ScriptTaskRuntimeDirs {
+    root;
+    home;
+    config;
+    cache;
+    data;
+    modules;
+    dotnetHome;
+    powerShellCache;
+    tmp;
+    denoDir;
+    constructor(root) {
+        this.root = root;
+        this.home = join(root, "home");
+        this.config = join(root, "config");
+        this.cache = join(root, "cache");
+        this.data = join(root, "data");
+        this.modules = join(this.data, "powershell", "Modules");
+        this.dotnetHome = join(root, "dotnet");
+        this.powerShellCache = join(this.cache, "powershell");
+        this.tmp = join(root, "tmp");
+        this.denoDir = join(this.cache, "deno");
+    }
+    static create(prefix) {
+        const root = mkdtempSync(join(tmpdir(), `${prefix.trim()}-`));
+        const dirs = new ScriptTaskRuntimeDirs(root);
+        for (const dir of dirs.requiredDirectories())
+            mkdirSync(dir, { recursive: true, mode: 0o700 });
+        return dirs;
+    }
+    requiredDirectories() { return [this.root, this.home, this.config, this.cache, this.data, this.modules, this.dotnetHome, this.powerShellCache, this.tmp, this.denoDir]; }
+    writablePaths() { return this.requiredDirectories(); }
+    workingDir() { return this.home; }
+    scriptFile(extension) { return join(this.home, `script-${Date.now()}-${sequence++}.${extension}`); }
+    baseEnvironment(extraPath = []) {
+        const pathParts = dedupe([...extraPath.filter(Boolean), ...(process.env.PATH ?? "").split(process.platform === "win32" ? ";" : ":")]);
+        return {
+            HOME: this.home,
+            XDG_CONFIG_HOME: this.config,
+            XDG_CACHE_HOME: this.cache,
+            XDG_DATA_HOME: this.data,
+            TMPDIR: this.tmp,
+            TERM: "dumb",
+            NO_COLOR: "1",
+            PATH: pathParts.join(process.platform === "win32" ? ";" : ":"),
+        };
+    }
+    srtEnvironment(extraPath = []) {
+        return { ...this.baseEnvironment(extraPath), CLAUDE_CODE_TMPDIR: this.tmp, CLAUDE_TMPDIR: this.tmp };
+    }
+    powerShellEnvironment(env) {
+        return { ...env, PSModulePath: this.modules, DOTNET_CLI_HOME: this.dotnetHome, POWERSHELL_TELEMETRY_OPTOUT: "1", POWERSHELL_UPDATECHECK: "Off" };
+    }
+    denoEnvironment() {
+        return { ...this.baseEnvironment(), DENO_DIR: this.denoDir };
+    }
+    cleanup() { rmSync(this.root, { recursive: true, force: true }); }
+}
+export function appendAllowedUnmanagedEnv(env, allowed) {
+    const managed = new Set(["HOME", "XDG_CONFIG_HOME", "XDG_CACHE_HOME", "XDG_DATA_HOME", "TMPDIR", "TERM", "NO_COLOR", "CLAUDE_CODE_TMPDIR", "CLAUDE_TMPDIR", "PSModulePath", "DOTNET_CLI_HOME", "POWERSHELL_TELEMETRY_OPTOUT", "POWERSHELL_UPDATECHECK", "DENO_DIR"]);
+    for (const name of allowed) {
+        const key = name.trim();
+        if (key && !managed.has(key) && process.env[key] !== undefined)
+            env[key] = process.env[key];
+    }
+    return env;
+}
+function dedupe(values) {
+    const seen = new Set();
+    const out = [];
+    for (const value of values)
+        if (value && !seen.has(value)) {
+            seen.add(value);
+            out.push(value);
+        }
+    return out;
+}

package/dist/script/sandboxTools.d.ts

@@ -0,0 +1,22 @@
+export declare class SandboxToolResolver {
+    stateDir: string;
+    autoInstall: boolean;
+    installTimeoutMs: number;
+    constructor(stateDir?: string, autoInstall?: boolean, installTimeoutMs?: number);
+    resolveSrt(): [string, boolean];
+    resolveRipgrep(): [string, boolean];
+    resolveDeno(): [string, boolean];
+    resolveRhai(): [string, boolean];
+    resolvePowerShell(): [string, boolean];
+    resolveNode(): [string, boolean];
+    resolveNpm(): [string, boolean];
+    resolveInterpreter(binary: string): [string, boolean];
+    private resolveTool;
+    private installDir;
+    private managedBin;
+    private runInstaller;
+    private installPowerShell;
+    private commandWorks;
+    private toolWorks;
+    private rhaiWorks;
+}

package/dist/script/sandboxTools.js

@@ -0,0 +1,133 @@
+import { existsSync, mkdirSync, rmSync, chmodSync, symlinkSync, copyFileSync, writeFileSync, mkdtempSync } from "node:fs";
+import { homedir, platform, arch, tmpdir } from "node:os";
+import { join } from "node:path";
+import { spawnSync } from "node:child_process";
+export class SandboxToolResolver {
+    stateDir;
+    autoInstall;
+    installTimeoutMs;
+    constructor(stateDir = "", autoInstall = true, installTimeoutMs = 120_000) {
+        this.stateDir = stateDir;
+        this.autoInstall = autoInstall;
+        this.installTimeoutMs = installTimeoutMs;
+    }
+    resolveSrt() {
+        return this.resolveTool("srt", "srt", (dir) => this.runInstaller(this.managedBin(dir), "npm", ["install", "-g", "--prefix", dir, process.env.TIKEO_SRT_NPM_PACKAGE || "@anthropic-ai/sandbox-runtime"]));
+    }
+    resolveRipgrep() { return this.resolveTool("rg", "rg", (dir) => this.runInstaller(this.managedBin(dir), "cargo", ["install", "--root", dir, "ripgrep"])); }
+    resolveDeno() {
+        return this.resolveTool("deno", "deno", (dir) => {
+            if (process.platform === "win32")
+                this.runInstaller(this.managedBin(dir), "powershell", ["-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", "irm https://deno.land/install.ps1 | iex"]);
+            else
+                this.runInstaller(this.managedBin(dir), "sh", ["-c", `curl -fsSL https://deno.land/install.sh | DENO_INSTALL='${dir}' sh`]);
+        });
+    }
+    resolveRhai() { return this.resolveTool("rhai-run", "rhai-run", (dir) => this.runInstaller(this.managedBin(dir), "cargo", ["install", "--root", dir, "rhai", "--bins", "--features", "bin-features"])); }
+    resolvePowerShell() { return this.resolveTool("pwsh", "pwsh", (dir) => this.installPowerShell(dir)); }
+    resolveNode() { return this.resolveInterpreter("node"); }
+    resolveNpm() { return this.resolveInterpreter("npm"); }
+    resolveInterpreter(binary) {
+        const path = findOnPath(binary);
+        return path && this.commandWorks(path, ["--version"]) ? [path, true] : ["", false];
+    }
+    resolveTool(key, binary, installer) {
+        const found = findOnPath(binary);
+        if (found && this.toolWorks(binary, found))
+            return [found, true];
+        const dir = this.installDir(key);
+        const local = join(this.managedBin(dir), executableName(binary));
+        if (this.toolWorks(binary, local))
+            return [local, true];
+        if (!this.autoInstall)
+            return [local, false];
+        try {
+            installer(dir);
+        }
+        catch {
+            return [local, false];
+        }
+        return [local, this.toolWorks(binary, local)];
+    }
+    installDir(key) { return join(this.stateDir.trim() || join(homedir(), ".tikeo"), "sandbox-tools", key); }
+    managedBin(dir) { return join(dir, "bin"); }
+    runInstaller(managedBin, command, args) {
+        mkdirSync(managedBin, { recursive: true });
+        const env = { ...process.env, PATH: dedupe([managedBin, ...(process.env.PATH ?? "").split(process.platform === "win32" ? ";" : ":")]).join(process.platform === "win32" ? ";" : ":") };
+        const result = spawnSync(command, args, { stdio: "inherit", env, timeout: this.installTimeoutMs });
+        if (result.status !== 0)
+            throw new Error(`installer failed: ${command}`);
+    }
+    installPowerShell(dir) {
+        if (process.platform === "win32") {
+            this.runInstaller(this.managedBin(dir), "winget", ["install", "-e", "--id", "Microsoft.PowerShell"]);
+            return;
+        }
+        const key = powerShellArchivePlatform();
+        if (!key)
+            throw new Error(`PowerShell auto-install does not support ${platform()}/${arch()}`);
+        const version = process.env.TIKEO_POWERSHELL_VERSION || "7.5.4";
+        const name = `powershell-${version}-${key}.tar.gz`;
+        const url = process.env.TIKEO_POWERSHELL_DOWNLOAD_URL || `https://github.com/PowerShell/PowerShell/releases/download/v${version}/${name}`;
+        const bin = this.managedBin(dir);
+        const archivePath = join(dir, name);
+        const extract = join(dir, `powershell-${version}`);
+        mkdirSync(bin, { recursive: true });
+        mkdirSync(extract, { recursive: true });
+        this.runInstaller(bin, "curl", ["-fsSL", url, "-o", archivePath]);
+        this.runInstaller(bin, "tar", ["-xzf", archivePath, "-C", extract]);
+        rmSync(archivePath, { force: true });
+        const pwsh = join(extract, "pwsh");
+        chmodSync(pwsh, 0o755);
+        const link = join(bin, "pwsh");
+        rmSync(link, { force: true });
+        try {
+            symlinkSync(pwsh, link);
+        }
+        catch {
+            copyFileSync(pwsh, link);
+            chmodSync(link, 0o755);
+        }
+    }
+    commandWorks(command, args) {
+        if ((command.includes("/") || command.includes("\\")) && !existsSync(command))
+            return false;
+        const result = spawnSync(command, args, { stdio: "ignore", timeout: 2_000 });
+        return result.status === 0;
+    }
+    toolWorks(binary, command) {
+        if (binary === "srt")
+            return this.commandWorks(command, ["--version"]) || this.commandWorks(command, ["--help"]);
+        if (binary === "rhai-run")
+            return this.rhaiWorks(command);
+        return this.commandWorks(command, ["--version"]);
+    }
+    rhaiWorks(command) {
+        if ((command.includes("/") || command.includes("\\")) && !existsSync(command))
+            return false;
+        const dir = mkdtempSync(join(tmpdir(), "tikeo-rhai-probe-"));
+        const script = join(dir, "probe.rhai");
+        try {
+            writeFileSync(script, 'print("tikeo-rhai-probe");\n');
+            return this.commandWorks(command, [script]);
+        }
+        finally {
+            rmSync(dir, { recursive: true, force: true });
+        }
+    }
+}
+function executableName(binary) { return process.platform === "win32" ? `${binary}.exe` : binary; }
+function findOnPath(binary) {
+    const paths = (process.env.PATH ?? "").split(process.platform === "win32" ? ";" : ":");
+    for (const p of paths) {
+        const full = join(p, executableName(binary));
+        if (existsSync(full))
+            return full;
+    }
+    return undefined;
+}
+function powerShellArchivePlatform() {
+    const key = `${platform()}/${arch()}`;
+    return { "linux/x64": "linux-x64", "linux/arm64": "linux-arm64", "darwin/x64": "osx-x64", "darwin/arm64": "osx-arm64" }[key] ?? "";
+}
+function dedupe(values) { return [...new Set(values.filter(Boolean))]; }

package/dist/task.d.ts

@@ -0,0 +1,18 @@
+export type TaskLogSink = (level: string, message: string) => void;
+export declare class TaskContext {
+    instanceId: string;
+    jobId: string;
+    processorName: string;
+    payload: Uint8Array;
+    log?: TaskLogSink | undefined;
+    constructor(instanceId: string, jobId: string, processorName: string, payload?: Uint8Array, log?: TaskLogSink | undefined);
+    logInfo(message: string): void;
+    logError(message: string): void;
+}
+export interface TaskOutcome {
+    success: boolean;
+    message: string;
+}
+export type TaskProcessor = (task: TaskContext) => Promise<TaskOutcome> | TaskOutcome;
+export declare function succeeded(message?: string): TaskOutcome;
+export declare function failed(message: string): TaskOutcome;

package/dist/task.js

@@ -0,0 +1,18 @@
+export class TaskContext {
+    instanceId;
+    jobId;
+    processorName;
+    payload;
+    log;
+    constructor(instanceId, jobId, processorName, payload = new Uint8Array(), log) {
+        this.instanceId = instanceId;
+        this.jobId = jobId;
+        this.processorName = processorName;
+        this.payload = payload;
+        this.log = log;
+    }
+    logInfo(message) { this.log?.("info", message); }
+    logError(message) { this.log?.("error", message); }
+}
+export function succeeded(message = "") { return { success: true, message }; }
+export function failed(message) { return { success: false, message }; }

package/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "@yhyzgn/tikeo",
+  "version": "0.1.911",
+  "description": "Node.js Worker SDK for tikeo",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "bun": "./src/index.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src/proto/worker.proto",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json && mkdir -p dist/proto && cp src/proto/worker.proto dist/proto/worker.proto",
+    "test": "bun test"
+  },
+  "dependencies": {
+    "@grpc/grpc-js": "latest",
+    "@grpc/proto-loader": "latest"
+  },
+  "devDependencies": {
+    "@types/bun": "latest",
+    "@types/node": "latest",
+    "typescript": "latest"
+  },
+  "license": "Apache-2.0",
+  "author": "tikeo contributors",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/yhyzgn/tikeo.git",
+    "directory": "sdks/nodejs/tikeo"
+  },
+  "homepage": "https://github.com/yhyzgn/tikeo#readme",
+  "bugs": {
+    "url": "https://github.com/yhyzgn/tikeo/issues"
+  }
+}

package/src/proto/worker.proto

@@ -0,0 +1,188 @@
+syntax = "proto3";
+
+package tikeo.worker.v1;
+
+option go_package = "github.com/yhyzgn/tikeo/sdks/go/tikeo/internal/workerpb;workerpb";
+
+service WorkerTunnelService {
+  rpc OpenTunnel(stream WorkerMessage) returns (stream ServerMessage);
+  rpc SubscribeTaskLogs(SubscribeTaskLogsRequest) returns (stream TaskLog);
+}
+
+message WorkerMessage {
+  oneof kind {
+    RegisterWorker register = 1;
+    Heartbeat heartbeat = 2;
+    TaskResult task_result = 3;
+    TaskLog task_log = 4;
+    UnregisterWorker unregister = 5;
+    TaskCheckpoint task_checkpoint = 6;
+  }
+}
+
+message ServerMessage {
+  oneof kind {
+    WorkerRegistered registered = 1;
+    Ping ping = 2;
+    DispatchTask dispatch_task = 3;
+  }
+}
+
+message RegisterWorker {
+  // Optional client-side stable instance hint. The tikeo still assigns the authoritative worker_id.
+  string client_instance_id = 1;
+  string app = 2;
+  string namespace = 3;
+  string cluster = 4;
+  string region = 5;
+  // Legacy free-form labels/capabilities. New routing must use structured_capabilities.
+  repeated string capabilities = 6;
+  map<string, string> labels = 7;
+  WorkerCapabilities structured_capabilities = 8;
+  WorkerClusterElection election = 9;
+}
+
+message WorkerCapabilities {
+  // Human/operator tags such as java or spring-boot. Not used for dispatch routing.
+  repeated string tags = 1;
+  repeated SdkProcessorCapability sdk_processors = 2;
+  repeated ScriptRunnerCapability script_runners = 3;
+  repeated PluginProcessorCapability plugin_processors = 4;
+}
+
+message SdkProcessorCapability {
+  string name = 1;
+}
+
+message ScriptRunnerCapability {
+  string language = 1;
+  string sandbox_backend = 2;
+}
+
+message PluginProcessorCapability {
+  string type = 1;
+  repeated string processor_names = 2;
+}
+
+message WorkerClusterElection {
+  bool enabled = 1;
+  // Stable election domain. Empty means namespace/app/cluster/region.
+  string domain = 2;
+  // Optional deterministic priority. Lower values win ties after health checks.
+  uint32 priority = 3;
+}
+
+message Heartbeat {
+  string worker_id = 1;
+  uint64 sequence = 2;
+  uint64 generation = 3;
+  string fencing_token = 4;
+}
+
+message WorkerRegistered {
+  string worker_id = 1;
+  uint64 lease_seconds = 2;
+  uint64 generation = 3;
+  string fencing_token = 4;
+}
+
+message UnregisterWorker {
+  string worker_id = 1;
+  uint64 generation = 2;
+  string fencing_token = 3;
+}
+
+message Ping {
+  uint64 sequence = 1;
+}
+
+message DispatchTask {
+  string instance_id = 1;
+  string job_id = 2;
+  bytes payload = 3;
+  // Explicit processor key used by SDK adapters. Defaults to job_id for backwards compatibility.
+  string processor_name = 4;
+  // Optional dynamic processor metadata. Empty for normal SDK processors.
+  TaskProcessorBinding processor_binding = 5;
+  // Server-issued opaque assignment authority bound to worker session generation/fencing.
+  string assignment_token = 6;
+}
+
+message TaskProcessorBinding {
+  oneof kind {
+    WasmProcessorBinding wasm = 1;
+    ScriptProcessorBinding script = 2;
+  }
+}
+
+message ScriptProcessorBinding {
+  string script_id = 1;
+  string version = 2;
+  string language = 3;
+  bytes content = 4;
+  string version_id = 5;
+  uint64 version_number = 6;
+  string content_sha256 = 7;
+  uint64 timeout_ms = 8;
+  uint64 max_memory_bytes = 9;
+  uint64 max_output_bytes = 10;
+  bool allow_network = 11;
+  repeated string allowed_env_vars = 12;
+  repeated string read_only_paths = 13;
+  repeated string writable_paths = 14;
+  repeated string secret_refs = 15;
+  repeated string allowed_network_hosts = 16;
+  string sandbox_backend = 17;
+}
+
+message WasmProcessorBinding {
+  string script_id = 1;
+  string version = 2;
+  bytes module = 3;
+  string runtime = 4;
+  string entrypoint = 5;
+  uint64 timeout_ms = 6;
+  uint64 max_memory_bytes = 7;
+  uint64 fuel = 8;
+  bool allow_network = 9;
+  repeated string allowed_env_vars = 10;
+  // Immutable script version snapshot identifier when available.
+  string version_id = 11;
+  // Monotonic script version snapshot number when available.
+  uint64 version_number = 12;
+  // Lowercase hex SHA-256 digest of module bytes. Workers must verify when present.
+  string module_sha256 = 13;
+  // Reserved signature hook for future PKI-backed module verification.
+  string module_signature = 14;
+}
+
+message TaskResult {
+  string worker_id = 1;
+  string instance_id = 2;
+  bool success = 3;
+  string message = 4;
+  string assignment_token = 5;
+}
+
+message TaskLog {
+  string worker_id = 1;
+  string instance_id = 2;
+  string level = 3;
+  string message = 4;
+  int64 sequence = 5;
+  string assignment_token = 6;
+}
+
+message TaskCheckpoint {
+  string worker_id = 1;
+  string instance_id = 2;
+  string checkpoint_json = 3;
+  int64 sequence = 4;
+  string assignment_token = 5;
+}
+
+message SubscribeTaskLogsRequest {
+  string instance_id = 1;
+  int64 after_sequence = 2;
+  bool replay_existing = 3;
+}