agent-dev-env 0.1.0

package/dist/assets/guest/guest-agent-mac.js

@@ -0,0 +1,586 @@
+#!/usr/bin/env node
+
+// packages/guest-agent-mac/src/index.ts
+import { execFileSync, spawnSync } from "node:child_process";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { homedir } from "node:os";
+import { join as join2 } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// packages/bridge-core/src/index.ts
+import { rmSync, writeFileSync } from "node:fs";
+
+// packages/bridge-core/src/endpoints.ts
+var PIPE_PREFIX = "\\\\.\\pipe\\";
+function parseEndpoint(spec) {
+  const sep = spec.indexOf(":");
+  if (sep <= 0) {
+    throw new Error(`invalid endpoint '${spec}' (expected unix:|pipe:|tcp:)`);
+  }
+  const scheme = spec.slice(0, sep);
+  const rest = spec.slice(sep + 1);
+  switch (scheme) {
+    case "unix": {
+      if (!rest) {
+        throw new Error(`invalid unix endpoint '${spec}': missing path`);
+      }
+      return { kind: "unix", path: rest };
+    }
+    case "pipe": {
+      if (!rest) {
+        throw new Error(`invalid pipe endpoint '${spec}': missing name`);
+      }
+      const name = rest.startsWith(PIPE_PREFIX) ? rest : `${PIPE_PREFIX}${rest}`;
+      return { kind: "pipe", name };
+    }
+    case "tcp": {
+      const m = /^([^:]+):(\d+)$/.exec(rest);
+      const port = m ? Number(m[2]) : NaN;
+      if (!m || !Number.isInteger(port) || port < 1 || port > 65535) {
+        throw new Error(`invalid tcp endpoint '${spec}' (expected tcp:host:port, port 1-65535)`);
+      }
+      return { kind: "tcp", host: m[1], port };
+    }
+    default:
+      throw new Error(
+        `unknown endpoint scheme '${scheme}' in '${spec}' (expected unix:|pipe:|tcp:)`
+      );
+  }
+}
+function formatEndpoint(endpoint) {
+  switch (endpoint.kind) {
+    case "unix":
+      return `unix:${endpoint.path}`;
+    case "pipe":
+      return `pipe:${endpoint.name}`;
+    case "tcp":
+      return `tcp:${endpoint.host}:${endpoint.port}`;
+  }
+}
+
+// packages/bridge-core/src/forwarder.ts
+import net from "node:net";
+import { existsSync, unlinkSync } from "node:fs";
+function startForwarder(options) {
+  const sockets = /* @__PURE__ */ new Set();
+  const server = net.createServer((client) => {
+    sockets.add(client);
+    client.on("close", () => sockets.delete(client));
+    forwardConnection(client, options.forward, sockets);
+  });
+  return bind(server, options.listen).then(() => {
+    options.log?.(
+      `listening on ${formatEndpoint(options.listen)} \u2192 ${formatEndpoint(options.forward)}`
+    );
+    return {
+      close: () => closeForwarder(server, sockets, options.listen, options.log)
+    };
+  });
+}
+function forwardConnection(client, target, sockets) {
+  const upstream = connectTo(target);
+  sockets.add(upstream);
+  upstream.on("close", () => sockets.delete(upstream));
+  upstream.once("connect", () => {
+    client.pipe(upstream);
+    upstream.pipe(client);
+  });
+  const tearDown = () => {
+    client.destroy();
+    upstream.destroy();
+  };
+  upstream.once("error", tearDown);
+  client.once("error", () => {
+    upstream.destroy();
+  });
+}
+async function bind(server, endpoint) {
+  switch (endpoint.kind) {
+    case "unix":
+      if (existsSync(endpoint.path)) {
+        unlinkSync(endpoint.path);
+      }
+      await listen(server, endpoint.path);
+      break;
+    case "pipe":
+      await listen(server, endpoint.name);
+      break;
+    case "tcp":
+      await listen(server, { port: endpoint.port, host: endpoint.host });
+      break;
+  }
+}
+function listen(server, spec) {
+  return new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(spec, () => {
+      server.removeListener("error", reject);
+      resolve();
+    });
+  });
+}
+function connectTo(endpoint) {
+  switch (endpoint.kind) {
+    case "unix":
+      return net.connect({ path: endpoint.path });
+    case "pipe":
+      return net.connect({ path: endpoint.name });
+    case "tcp":
+      return net.connect({ port: endpoint.port, host: endpoint.host });
+  }
+}
+function closeForwarder(server, sockets, listen2, log) {
+  return new Promise((resolve) => {
+    for (const socket of sockets) {
+      socket.destroy();
+    }
+    server.close(() => {
+      if (listen2.kind === "unix" && existsSync(listen2.path)) {
+        unlinkSync(listen2.path);
+      }
+      log?.("closed");
+      resolve();
+    });
+  });
+}
+
+// packages/bridge-core/src/index.ts
+async function runBridge(options) {
+  const running = await startForwarder(options);
+  if (options.pidfile) {
+    writeFileSync(options.pidfile, `${process.pid}
+`);
+  }
+  await new Promise((resolve) => {
+    const stop = () => {
+      void running.close().then(() => {
+        if (options.pidfile) {
+          rmSync(options.pidfile, { force: true });
+        }
+        resolve();
+      });
+    };
+    process.on("SIGINT", stop);
+    process.on("SIGTERM", stop);
+  });
+  return 0;
+}
+
+// packages/bridge-core/src/probe.ts
+import net2 from "node:net";
+function canConnect(endpoint, timeoutMs = 500) {
+  return new Promise((resolve) => {
+    const socket = endpoint.kind === "tcp" ? net2.connect({ port: endpoint.port, host: endpoint.host }) : net2.connect({ path: endpoint.kind === "unix" ? endpoint.path : endpoint.name });
+    const done = (ok) => {
+      socket.destroy();
+      resolve(ok);
+    };
+    socket.once("connect", () => done(true));
+    socket.once("error", () => done(false));
+    setTimeout(() => done(false), timeoutMs);
+  });
+}
+
+// packages/guest-rules/src/rules.ts
+import { createHash } from "node:crypto";
+import { mkdirSync, readFileSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { join } from "node:path";
+function rulesPaths(home) {
+  return {
+    marker: join(home, ".config", "agent-dev-env", "agent-rules.sha256"),
+    targets: [
+      join(home, ".config", "opencode", "AGENTS.md"),
+      join(home, ".copilot", "copilot-instructions.md")
+    ]
+  };
+}
+function sha256(text) {
+  return createHash("sha256").update(text, "utf8").digest("hex");
+}
+function readMaybe(path) {
+  try {
+    return readFileSync(path, "utf8");
+  } catch {
+    return void 0;
+  }
+}
+function rulesAction(home, content) {
+  const { marker, targets } = rulesPaths(home);
+  const newSha = sha256(content);
+  const prevSha = readMaybe(marker)?.trim();
+  let conflict = false;
+  let install2 = false;
+  let update = false;
+  for (const target of targets) {
+    const current = readMaybe(target);
+    if (current === void 0) {
+      install2 = true;
+    } else if (sha256(current) === newSha) {
+    } else if (prevSha !== void 0 && sha256(current) === prevSha) {
+      update = true;
+    } else {
+      conflict = true;
+    }
+  }
+  if (conflict) return "conflict";
+  if (install2) return "install";
+  if (update) return "update";
+  return "uptodate";
+}
+function applyRules(home, content) {
+  const { marker, targets } = rulesPaths(home);
+  for (const target of targets) {
+    mkdirSync(join(target, ".."), { recursive: true });
+    writeFileSync2(target, content);
+  }
+  mkdirSync(join(marker, ".."), { recursive: true });
+  writeFileSync2(marker, `${sha256(content)}
+`);
+}
+
+// packages/guest-agent-mac/src/system.ts
+var LAUNCHD_LABELS = {
+  "ssh-agent": "dev.agent-sandbox.ssh-agent",
+  docker: "dev.agent-sandbox.docker"
+};
+var GUEST_AGENT_SOCKET = "/tmp/ssh-agent.sock";
+var ZPROFILE_MARKERS = {
+  agent: "# SSH agent bridge to the host (see docs/ssh-agent.md)",
+  env: "# Docker env vars for the host engine (testcontainers support, see docs/macos.md)"
+};
+var SSH_CONFIG_MARKER = "# SSH agent bridge to the host (see docs/ssh-agent.md)";
+function escapeXml(text) {
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+function launchdPlist(bridge, dockerSocketPath) {
+  const args = [
+    bridge.nodePath,
+    bridge.agentPath,
+    "bridge",
+    bridge.role,
+    "--port",
+    String(bridge.port),
+    "--host-alias",
+    bridge.hostAlias,
+    "--listen",
+    bridge.role === "ssh-agent" ? `unix:${GUEST_AGENT_SOCKET}` : `unix:${dockerSocketPath}`,
+    "--forward",
+    `tcp:${bridge.hostAlias}:${bridge.port}`
+  ];
+  return [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"',
+    '  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+    '<plist version="1.0">',
+    "<dict>",
+    `  <key>Label</key><string>${escapeXml(bridge.label)}</string>`,
+    "  <key>ProgramArguments</key>",
+    "  <array>",
+    ...args.map((a) => `    <string>${escapeXml(a)}</string>`),
+    "  </array>",
+    "  <key>RunAtLoad</key><true/>",
+    "  <key>KeepAlive</key><dict><key>SuccessfulExit</key><false/></dict>",
+    "  <key>EnvironmentVariables</key>",
+    "  <dict>",
+    "    <key>PATH</key><string>/opt/homebrew/bin:/usr/bin:/bin</string>",
+    "  </dict>",
+    "</dict>",
+    "</plist>",
+    ""
+  ].join("\n");
+}
+function zprofileAgentBlock() {
+  return [
+    "",
+    ZPROFILE_MARKERS.agent,
+    'if [ -z "${SSH_AUTH_SOCK:-}" ] || [ "$SSH_AUTH_SOCK" != "/tmp/ssh-agent.sock" ]; then',
+    "    export SSH_AUTH_SOCK=/tmp/ssh-agent.sock",
+    "fi",
+    "",
+    ""
+  ].join("\n");
+}
+function zprofileDockerBlock() {
+  return [
+    "",
+    ZPROFILE_MARKERS.env,
+    'export DOCKER_HOST="unix://$HOME/.docker/run/docker.sock"',
+    `export TESTCONTAINERS_HOST_OVERRIDE="$(netstat -nr | awk '/default/{print $2; exit}')"`,
+    "",
+    ""
+  ].join("\n");
+}
+function sshConfigBlock() {
+  return ["", SSH_CONFIG_MARKER, "Host *", "    IdentityAgent /tmp/ssh-agent.sock", "", ""].join(
+    "\n"
+  );
+}
+function dockerContextArgs(docker, sock) {
+  const endpoint = `host=unix://${sock}`;
+  return [
+    [docker, "context", "create", "host", "--docker", endpoint],
+    [docker, "context", "update", "host", "--docker", endpoint],
+    [docker, "context", "use", "host"]
+  ];
+}
+function appendBlockIfMissing(content, block, marker) {
+  return content.includes(marker) ? content : `${maybeNewline(content)}${block}`;
+}
+function removeBlock(content, marker) {
+  const lines = content.split("\n");
+  const markerIndex = lines.findIndex((line) => line === marker);
+  if (markerIndex === -1) {
+    return content;
+  }
+  const blockStart = markerIndex > 0 && lines[markerIndex - 1] === "" ? markerIndex - 1 : markerIndex;
+  let blockEnd = markerIndex + 1;
+  while (blockEnd < lines.length && lines[blockEnd] !== "") {
+    blockEnd += 1;
+  }
+  if (blockEnd < lines.length) {
+    blockEnd += 1;
+  }
+  return [...lines.slice(0, blockStart), ...lines.slice(blockEnd)].join("\n").replace(/\n{3,}/g, "\n\n");
+}
+function maybeNewline(content) {
+  return content.length === 0 || content.endsWith("\n") ? "" : "\n";
+}
+
+// packages/guest-agent-mac/src/index.ts
+var AGENT_PATH = fileURLToPath(import.meta.url);
+var NODE_PATH = process.execPath;
+var HOME = homedir();
+var LAUNCH_AGENTS_DIR = join2(HOME, "Library", "LaunchAgents");
+var DOCKER_SOCKET = join2(HOME, ".docker", "run", "docker.sock");
+var DEFAULTS = {
+  agentPort: 4100,
+  dockerPort: 4101
+};
+async function main(argv) {
+  const [cmd, ...rest] = argv;
+  try {
+    switch (cmd) {
+      case "install":
+        return install(rest);
+      case "bridge":
+        return bridgeCommand(rest);
+      case "status":
+        return status();
+      case "rules":
+        return rulesCommand(rest);
+      case "uninstall":
+        return uninstall();
+      default:
+        process.stderr.write(usage());
+        return 1;
+    }
+  } catch (err) {
+    process.stderr.write(`guest-agent-mac: ${err.message}
+`);
+    return 1;
+  }
+}
+function usage() {
+  return [
+    "usage: guest-agent-mac <install|bridge|status|rules|uninstall> [options]",
+    "  install [--agent-port N] [--docker-port N] [--host-alias A]",
+    "  bridge <ssh-agent|docker> [--listen EP] [--forward EP] [--port N] [--host-alias A]",
+    "  rules [--force]  (content on stdin)",
+    ""
+  ].join("\n");
+}
+function argValue(argv, flag) {
+  const index = argv.indexOf(flag);
+  return index === -1 ? void 0 : argv[index + 1];
+}
+function gatewayFromNetstat(output) {
+  for (const line of output.split("\n")) {
+    if (!/\sdefault\s/.test(line)) {
+      continue;
+    }
+    const fields = line.trim().split(/\s+/);
+    const gw = fields[1];
+    if (gw) {
+      return gw;
+    }
+  }
+  return void 0;
+}
+function defaultGateway() {
+  const res = execFileSync("netstat", ["-nr"], { encoding: "utf8" });
+  return gatewayFromNetstat(res);
+}
+function bridgeFor(role, port, hostAlias) {
+  return {
+    label: LAUNCHD_LABELS[role],
+    nodePath: NODE_PATH,
+    agentPath: AGENT_PATH,
+    role,
+    port,
+    hostAlias
+  };
+}
+function install(argv) {
+  const hostAlias = argValue(argv, "--host-alias") ?? defaultGateway() ?? (() => {
+    throw new Error("could not determine the host gateway (--host-alias)");
+  })();
+  const agentPort = Number(argValue(argv, "--agent-port") ?? DEFAULTS.agentPort);
+  const dockerPort = Number(argValue(argv, "--docker-port") ?? DEFAULTS.dockerPort);
+  mkdirSync2(LAUNCH_AGENTS_DIR, { recursive: true });
+  const uid = execFileSync("id", ["-u"], { encoding: "utf8" }).trim();
+  for (const [role, port] of [
+    ["ssh-agent", agentPort],
+    ["docker", dockerPort]
+  ]) {
+    const bridge = bridgeFor(role, port, hostAlias);
+    const plistPath = join2(LAUNCH_AGENTS_DIR, `${bridge.label}.plist`);
+    writeFileSync3(plistPath, launchdPlist(bridge, DOCKER_SOCKET));
+    reloadAgent(bridge.label, plistPath, uid);
+    process.stdout.write(`installed:${role} (${bridge.label}, port ${port})
+`);
+  }
+  appendZprofile();
+  appendSshConfig();
+  setupDockerContext();
+  return 0;
+}
+function reloadAgent(label, plistPath, uid) {
+  try {
+    execFileSync("launchctl", ["bootout", `gui/${uid}/${label}`], { stdio: "ignore" });
+  } catch {
+  }
+  loadAgent(label, plistPath, uid);
+}
+function loadAgent(label, plistPath, uid) {
+  try {
+    execFileSync("launchctl", ["bootstrap", `gui/${uid}`, plistPath], { stdio: "ignore" });
+  } catch {
+    try {
+      execFileSync("launchctl", ["load", plistPath], { stdio: "ignore" });
+    } catch {
+      process.stderr.write(`warning: could not load ${label}
+`);
+    }
+  }
+}
+function setupDockerContext() {
+  const docker = findDockerPath();
+  if (!docker) {
+    process.stderr.write("warning: docker CLI not found \u2014 skipping the docker context\n");
+    return;
+  }
+  const [create, update, use] = dockerContextArgs(docker, DOCKER_SOCKET);
+  const created = spawnSync(create[0], create.slice(1), { stdio: "ignore" });
+  if (created.status !== 0) {
+    spawnSync(update[0], update.slice(1), { stdio: "ignore" });
+  }
+  const used = spawnSync(use[0], use.slice(1), { stdio: "ignore" });
+  if (used.status === 0) {
+    process.stdout.write("installed:docker context host\n");
+  }
+}
+function findDockerPath() {
+  const res = spawnSync("sh", ["-lc", "command -v docker"], { encoding: "utf8" });
+  const docker = res.status === 0 ? res.stdout.trim() : "";
+  return docker && docker.startsWith("/") ? docker : void 0;
+}
+function appendZprofile() {
+  const zprofile = join2(HOME, ".zprofile");
+  let content = readMaybe2(zprofile);
+  content = appendBlockIfMissing(content, zprofileAgentBlock(), ZPROFILE_MARKERS.agent);
+  content = appendBlockIfMissing(content, zprofileDockerBlock(), ZPROFILE_MARKERS.env);
+  writeFileSync3(zprofile, content);
+}
+function appendSshConfig() {
+  const dir = join2(HOME, ".ssh");
+  mkdirSync2(dir, { recursive: true });
+  const config = join2(dir, "config");
+  const content = appendBlockIfMissing(
+    readMaybe2(config),
+    sshConfigBlock(),
+    "# SSH agent bridge to the host (see docs/ssh-agent.md)"
+  );
+  writeFileSync3(config, content);
+  execFileSync("chmod", ["700", dir]);
+  execFileSync("chmod", ["600", config]);
+}
+function bridgeCommand(argv) {
+  const role = argv[0];
+  if (role !== "ssh-agent" && role !== "docker") {
+    throw new Error(`unknown bridge role '${role}' (ssh-agent|docker)`);
+  }
+  const port = Number(
+    argValue(argv, "--port") ?? DEFAULTS[role === "ssh-agent" ? "agentPort" : "dockerPort"]
+  );
+  const hostAlias = argValue(argv, "--host-alias") ?? defaultGateway();
+  if (!hostAlias) {
+    throw new Error("could not determine the host gateway (--host-alias)");
+  }
+  const listen2 = argValue(argv, "--listen") ?? (role === "ssh-agent" ? `unix:${GUEST_AGENT_SOCKET}` : `unix:${join2(HOME, ".docker", "run", "docker.sock")}`);
+  const forward = argValue(argv, "--forward") ?? `tcp:${hostAlias}:${port}`;
+  return runBridge({
+    listen: parseEndpoint(listen2),
+    forward: parseEndpoint(forward),
+    log: (message) => process.stderr.write(`${message}
+`)
+  });
+}
+async function status() {
+  const agentUp = await canConnect(parseEndpoint(`unix:${GUEST_AGENT_SOCKET}`));
+  const dockerUp = await canConnect(
+    parseEndpoint(`unix:${join2(HOME, ".docker", "run", "docker.sock")}`)
+  );
+  process.stdout.write(`bridge-status:ssh-agent=${agentUp ? "up" : "down"}
+`);
+  process.stdout.write(`bridge-status:docker=${dockerUp ? "up" : "down"}
+`);
+  return 0;
+}
+function rulesCommand(argv) {
+  const content = readFileSync2(0, "utf8");
+  if (argv.includes("--force")) {
+    applyRules(HOME, content);
+    process.stdout.write("rules:overwritten\n");
+  } else {
+    process.stdout.write(`rules:probe=${rulesAction(HOME, content)}
+`);
+  }
+  return 0;
+}
+function uninstall() {
+  const uid = execFileSync("id", ["-u"], { encoding: "utf8" }).trim();
+  for (const label of Object.values(LAUNCHD_LABELS)) {
+    try {
+      execFileSync("launchctl", ["bootout", `gui/${uid}/${label}`], { stdio: "ignore" });
+    } catch {
+    }
+    rmSync2(join2(LAUNCH_AGENTS_DIR, `${label}.plist`), { force: true });
+  }
+  const zprofile = join2(HOME, ".zprofile");
+  const config = join2(HOME, ".ssh", "config");
+  writeFileSync3(zprofile, cleanupFile(readMaybe2(zprofile)));
+  writeFileSync3(config, cleanupFile(readMaybe2(config)));
+  process.stdout.write("uninstalled:ssh-agent,docker\n");
+  return 0;
+}
+function cleanupFile(content) {
+  let out = removeBlock(content, ZPROFILE_MARKERS.agent);
+  out = removeBlock(out, ZPROFILE_MARKERS.env);
+  out = removeBlock(out, "# SSH agent bridge to the host (see docs/ssh-agent.md)");
+  return out.replace(/\n{3,}/g, "\n\n");
+}
+function readMaybe2(path) {
+  try {
+    return readFileSync2(path, "utf8");
+  } catch {
+    return "";
+  }
+}
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+  void main(process.argv.slice(2)).then((code) => {
+    process.exit(code);
+  });
+}
+export {
+  gatewayFromNetstat
+};