charness 3.6.1 → 3.8.0

package/dist/runnerUtility/runnerConfig.js

@@ -0,0 +1,153 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RunnerConfigError = exports.linkStates = void 0;
+exports.readRunnerConfig = readRunnerConfig;
+exports.writeRunnerConfig = writeRunnerConfig;
+exports.readRunnerStatus = readRunnerStatus;
+exports.writeRunnerStatus = writeRunnerStatus;
+exports.readPairingInProgress = readPairingInProgress;
+exports.writePairingInProgress = writePairingInProgress;
+exports.removePairingInProgress = removePairingInProgress;
+const fs = __importStar(require("fs"));
+const zod_1 = require("zod");
+const configDirFile_1 = require("../configDirFile");
+const hubIds_1 = require("../runners/hubIds");
+const sshKeys_1 = require("../runners/sshKeys");
+/**
+ * @description The runner's two files: `config.json` (who it serves — written once at pairing, changed only by an update's package id) and
+ * `status.json` (what the link is doing — written by `run`, read by `status`). Strict, and an invalid file names the problem without
+ * echoing a value.
+ */
+const fileMode = 0o600;
+const maxTextLength = 200;
+const runnerConfigSchema = zod_1.z.strictObject({
+    runnerId: hubIds_1.hubIdSchema,
+    name: zod_1.z.string().min(1).max(maxTextLength),
+    hub: zod_1.z.strictObject({
+        host: hubIds_1.hubHostSchema,
+        port: hubIds_1.hubPortSchema,
+        user: hubIds_1.hubSshUserSchema,
+        /** Pinned: the link and every call to the hub verify exactly this key. */
+        hostKey: hubIds_1.hubHostKeySchema,
+        /** The only key the built-in server accepts. */
+        publicKey: zod_1.z.string().refine(sshKeys_1.checkIsEd25519PublicKey, 'must be an ed25519 public key'),
+        /** Whose charness it is, as the hub named itself (`@ExampleBot`). */
+        label: zod_1.z.string().min(1).max(maxTextLength),
+    }),
+    /** The id of the hub package this runner runs; compared with the one the hub names at every link. */
+    packageId: zod_1.z.string().max(maxTextLength).nullable(),
+    pairedAtMs: zod_1.z.number().int().nonnegative(),
+});
+exports.linkStates = ['connecting', 'linked', 'removed', 'error'];
+const runnerStatusSchema = zod_1.z.strictObject({
+    pid: zod_1.z.number().int().positive(),
+    state: zod_1.z.enum(exports.linkStates),
+    /** When the state began. */
+    sinceMs: zod_1.z.number().int().nonnegative(),
+    updatedAtMs: zod_1.z.number().int().nonnegative(),
+    lastError: zod_1.z.string().max(maxTextLength * 2).nullable(),
+    activeJobs: zod_1.z.number().int().nonnegative(),
+    packageId: zod_1.z.string().max(maxTextLength).nullable(),
+});
+const pairingInProgressSchema = zod_1.z.strictObject({
+    pairId: hubIds_1.hubIdSchema,
+    host: hubIds_1.hubHostSchema,
+    port: hubIds_1.hubPortSchema,
+    user: hubIds_1.hubSshUserSchema,
+    hostKey: hubIds_1.hubHostKeySchema,
+    startedAtMs: zod_1.z.number().int().nonnegative(),
+    /** The id of the archive this runner installed from (told by the pasted line), kept for the config. */
+    packageId: zod_1.z.string().max(maxTextLength).nullable(),
+});
+class RunnerConfigError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'RunnerConfigError';
+    }
+}
+exports.RunnerConfigError = RunnerConfigError;
+function readJsonFile(filePath, fileName, schema) {
+    let text;
+    try {
+        text = fs.readFileSync(filePath, 'utf8');
+    }
+    catch (error) {
+        if ((0, configDirFile_1.getCaughtErrnoCode)(error) === 'ENOENT')
+            return null;
+        throw new RunnerConfigError(`${fileName} could not be read (${(0, configDirFile_1.getCaughtErrnoCode)(error)})`);
+    }
+    let parsedJson;
+    try {
+        parsedJson = JSON.parse(text);
+    }
+    catch {
+        throw new RunnerConfigError(`${fileName} is not valid JSON`);
+    }
+    const parsed = schema.safeParse(parsedJson);
+    if (parsed.success)
+        return parsed.data;
+    throw new RunnerConfigError(`${fileName} is invalid: ${parsed.error.issues.map((issue) => `${issue.path.join('.') || '(root)'} ${issue.message}`).join('; ')}`);
+}
+/** @description `config.json`, or `null` when this account is not paired. */
+function readRunnerConfig(paths) {
+    return readJsonFile(paths.config, 'config.json', runnerConfigSchema);
+}
+function writeRunnerConfig(paths, config) {
+    (0, configDirFile_1.writeJsonFileAtomically)(paths.config, runnerConfigSchema.parse(config), fileMode);
+}
+/** @description `status.json`, or `null` when `run` never wrote one (an unreadable one reads as none: it is only a report). */
+function readRunnerStatus(paths) {
+    try {
+        return readJsonFile(paths.status, 'status.json', runnerStatusSchema);
+    }
+    catch {
+        return null;
+    }
+}
+function writeRunnerStatus(paths, status) {
+    (0, configDirFile_1.writeJsonFileAtomically)(paths.status, runnerStatusSchema.parse(status), fileMode);
+}
+/** @description `pairing.json`, or `null` when no pairing is half done. */
+function readPairingInProgress(paths) {
+    return readJsonFile(paths.pairing, 'pairing.json', pairingInProgressSchema);
+}
+function writePairingInProgress(paths, pairing) {
+    (0, configDirFile_1.writeJsonFileAtomically)(paths.pairing, pairingInProgressSchema.parse(pairing), fileMode);
+}
+function removePairingInProgress(paths) {
+    fs.rmSync(paths.pairing, { force: true });
+}
+//# sourceMappingURL=runnerConfig.js.map

package/dist/runnerUtility/runnerConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runnerConfig.js","sourceRoot":"","sources":["../../src/runnerUtility/runnerConfig.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiGA,4CAEC;AAED,8CAEC;AAGD,4CAMC;AAED,8CAEC;AAGD,sDAEC;AAED,wDAEC;AAED,0DAEC;AAjID,uCAAyB;AACzB,6BAAwB;AACxB,oDAA+E;AAC/E,8CAAkH;AAClH,gDAA6D;AAG7D;;;;GAIG;AAEH,MAAM,QAAQ,GAAG,KAAK,CAAC;AACvB,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,MAAM,kBAAkB,GAAG,OAAC,CAAC,YAAY,CAAC;IACxC,QAAQ,EAAE,oBAAW;IACrB,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC;IAC1C,GAAG,EAAE,OAAC,CAAC,YAAY,CAAC;QAClB,IAAI,EAAE,sBAAa;QACnB,IAAI,EAAE,sBAAa;QACnB,IAAI,EAAE,yBAAgB;QACtB,0EAA0E;QAC1E,OAAO,EAAE,yBAAgB;QACzB,gDAAgD;QAChD,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,iCAAuB,EAAE,+BAA+B,CAAC;QACtF,qEAAqE;QACrE,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC;KAC5C,CAAC;IACF,qGAAqG;IACrG,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IACnD,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAC3C,CAAC,CAAC;AAKU,QAAA,UAAU,GAAG,CAAC,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAU,CAAC;AAIhF,MAAM,kBAAkB,GAAG,OAAC,CAAC,YAAY,CAAC;IACxC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,KAAK,EAAE,OAAC,CAAC,IAAI,CAAC,kBAAU,CAAC;IACzB,4BAA4B;IAC5B,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACvC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC3C,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvD,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC1C,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAKH,MAAM,uBAAuB,GAAG,OAAC,CAAC,YAAY,CAAC;IAC7C,MAAM,EAAE,oBAAW;IACnB,IAAI,EAAE,sBAAa;IACnB,IAAI,EAAE,sBAAa;IACnB,IAAI,EAAE,yBAAgB;IACtB,OAAO,EAAE,yBAAgB;IACzB,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC3C,uGAAuG;IACvG,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAKH,MAAa,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AALD,8CAKC;AAED,SAAS,YAAY,CAAQ,QAAgB,EAAE,QAAgB,EAAE,MAAwB;IACvF,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,IAAA,kCAAkB,EAAC,KAAK,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACxD,MAAM,IAAI,iBAAiB,CAAC,GAAG,QAAQ,uBAAuB,IAAA,kCAAkB,EAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,GAAG,QAAQ,oBAAoB,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IACvC,MAAM,IAAI,iBAAiB,CAAC,GAAG,QAAQ,gBAAgB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAClK,CAAC;AAED,6EAA6E;AAC7E,SAAgB,gBAAgB,CAAC,KAAsB;IACrD,OAAO,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,kBAAkB,CAAC,CAAC;AACvE,CAAC;AAED,SAAgB,iBAAiB,CAAC,KAAsB,EAAE,MAAoB;IAC5E,IAAA,uCAAuB,EAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC;AACpF,CAAC;AAED,+HAA+H;AAC/H,SAAgB,gBAAgB,CAAC,KAAsB;IACrD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,kBAAkB,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAgB,iBAAiB,CAAC,KAAsB,EAAE,MAAoB;IAC5E,IAAA,uCAAuB,EAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC;AACpF,CAAC;AAED,2EAA2E;AAC3E,SAAgB,qBAAqB,CAAC,KAAsB;IAC1D,OAAO,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE,uBAAuB,CAAC,CAAC;AAC9E,CAAC;AAED,SAAgB,sBAAsB,CAAC,KAAsB,EAAE,OAA0B;IACvF,IAAA,uCAAuB,EAAC,KAAK,CAAC,OAAO,EAAE,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC3F,CAAC;AAED,SAAgB,uBAAuB,CAAC,KAAsB;IAC5D,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5C,CAAC"}

package/dist/runnerUtility/runnerFlags.d.ts

@@ -0,0 +1,9 @@
+import type { RunnerHomePaths } from './runnerHome';
+/**
+ * @description The runner's own pause: an empty file, `~/.charness-runner/paused`. A paused runner stays linked but says so in its probe
+ * (`paused=1`), and `remote-run` never picks it for a job — the operator's way to take a machine out of rotation from the machine itself
+ * (the hub has its own pause for the same purpose, set from `/runners`).
+ */
+export declare function checkIsRunnerPaused(paths: RunnerHomePaths): boolean;
+export declare function setRunnerPaused(paths: RunnerHomePaths, isPaused: boolean): void;
+//# sourceMappingURL=runnerFlags.d.ts.map

package/dist/runnerUtility/runnerFlags.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runnerFlags.d.ts","sourceRoot":"","sources":["../../src/runnerUtility/runnerFlags.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD;;;;GAIG;AAEH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAEnE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,GAAG,IAAI,CAG/E"}

package/dist/runnerUtility/runnerFlags.js

@@ -0,0 +1,53 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkIsRunnerPaused = checkIsRunnerPaused;
+exports.setRunnerPaused = setRunnerPaused;
+const fs = __importStar(require("fs"));
+/**
+ * @description The runner's own pause: an empty file, `~/.charness-runner/paused`. A paused runner stays linked but says so in its probe
+ * (`paused=1`), and `remote-run` never picks it for a job — the operator's way to take a machine out of rotation from the machine itself
+ * (the hub has its own pause for the same purpose, set from `/runners`).
+ */
+function checkIsRunnerPaused(paths) {
+    return fs.existsSync(paths.pausedFlag);
+}
+function setRunnerPaused(paths, isPaused) {
+    if (isPaused)
+        fs.writeFileSync(paths.pausedFlag, '', { mode: 0o644 });
+    else
+        fs.rmSync(paths.pausedFlag, { force: true });
+}
+//# sourceMappingURL=runnerFlags.js.map

package/dist/runnerUtility/runnerFlags.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runnerFlags.js","sourceRoot":"","sources":["../../src/runnerUtility/runnerFlags.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AASA,kDAEC;AAED,0CAGC;AAhBD,uCAAyB;AAGzB;;;;GAIG;AAEH,SAAgB,mBAAmB,CAAC,KAAsB;IACxD,OAAO,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;AACzC,CAAC;AAED,SAAgB,eAAe,CAAC,KAAsB,EAAE,QAAiB;IACvE,IAAI,QAAQ;QAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;;QACjE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACpD,CAAC"}

package/dist/runnerUtility/runnerHome.d.ts

@@ -0,0 +1,30 @@
+export interface RunnerHomePaths {
+    homeDir: string;
+    root: string;
+    config: string;
+    status: string;
+    /** A pairing that was started and not finished (see `pairingRecovery.ts`). */
+    pairing: string;
+    /** An empty file: the operator paused this runner ("is this machine busy"). Read by `runner.sh probe` as `paused=`. */
+    pausedFlag: string;
+    /** One word, `user-service` or `system-service`, while a service is installed. Read by `runner.sh probe` as `service=`. */
+    serviceMarker: string;
+    /** The iOS Simulator boot check's last result (`iosCheck.ts`). Read by `runner.sh probe` as `ios_boot=`. */
+    iosCheck: string;
+    keysDir: string;
+    clientKey: string;
+    serverKey: string;
+    currentApp: string;
+    binDir: string;
+    launcher: string;
+    envFile: string;
+    workDir: string;
+    pueueDir: string;
+    pueueConfig: string;
+    logsDir: string;
+    buildDir: string;
+}
+export declare function getRunnerHomePaths(homeDir?: string): RunnerHomePaths;
+/** @description The folder of one installed copy of the package. */
+export declare function getAppDirPath(paths: RunnerHomePaths, appId: string): string;
+//# sourceMappingURL=runnerHome.d.ts.map

package/dist/runnerUtility/runnerHome.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runnerHome.d.ts","sourceRoot":"","sources":["../../src/runnerUtility/runnerHome.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,uHAAuH;IACvH,UAAU,EAAE,MAAM,CAAC;IACnB,2HAA2H;IAC3H,aAAa,EAAE,MAAM,CAAC;IACtB,4GAA4G;IAC5G,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,MAAqB,GAAG,eAAe,CAwBlF;AAED,oEAAoE;AACpE,wBAAgB,aAAa,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3E"}

package/dist/runnerUtility/runnerHome.js

@@ -0,0 +1,82 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getRunnerHomePaths = getRunnerHomePaths;
+exports.getAppDirPath = getAppDirPath;
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+/**
+ * @description Where the runner utility keeps its state: `~/.charness-runner/` (0700) of the account that runs the jobs. Builtins only:
+ * the very first step of a pairing (before any dependency is installed) already needs these paths.
+ *
+ *   config.json   who the runner serves (hub address and pinned host key, the hub's public key, its own id and name)
+ *   status.json   what the link is doing right now (written by `run`, read by `status`)
+ *   keys/         the runner's client key (logs in to the hub) and the host key of its built-in ssh server
+ *   app.<id>/     an installed copy of the hub's charness package; `current` points at the one in use
+ *   bin/          the `charness-runner` launcher, pueue, pueued, rsync when built
+ *   env           the operator's KEY=VALUE lines, added to every job's environment
+ *   work/         the work dir of remote-run (phase 1); pueue/ the private Pueue; logs/; build/ scratch for the rsync build
+ */
+const stateDirName = '.charness-runner';
+function getRunnerHomePaths(homeDir = os.homedir()) {
+    const root = path.join(homeDir, stateDirName);
+    return {
+        homeDir,
+        root,
+        config: path.join(root, 'config.json'),
+        status: path.join(root, 'status.json'),
+        pairing: path.join(root, 'pairing.json'),
+        pausedFlag: path.join(root, 'paused'),
+        serviceMarker: path.join(root, 'service'),
+        iosCheck: path.join(root, 'ios-check.json'),
+        keysDir: path.join(root, 'keys'),
+        clientKey: path.join(root, 'keys', 'client_ed25519'),
+        serverKey: path.join(root, 'keys', 'server_host_ed25519'),
+        currentApp: path.join(root, 'current'),
+        binDir: path.join(root, 'bin'),
+        launcher: path.join(root, 'bin', 'charness-runner'),
+        envFile: path.join(root, 'env'),
+        workDir: path.join(root, 'work'),
+        pueueDir: path.join(root, 'pueue'),
+        pueueConfig: path.join(root, 'pueue', 'pueue.yml'),
+        logsDir: path.join(root, 'logs'),
+        buildDir: path.join(root, 'build'),
+    };
+}
+/** @description The folder of one installed copy of the package. */
+function getAppDirPath(paths, appId) {
+    return path.join(paths.root, `app.${appId}`);
+}
+//# sourceMappingURL=runnerHome.js.map

package/dist/runnerUtility/runnerHome.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runnerHome.js","sourceRoot":"","sources":["../../src/runnerUtility/runnerHome.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,gDAwBC;AAGD,sCAEC;AA1ED,uCAAyB;AACzB,2CAA6B;AAE7B;;;;;;;;;;;GAWG;AAEH,MAAM,YAAY,GAAG,kBAAkB,CAAC;AA6BxC,SAAgB,kBAAkB,CAAC,UAAkB,EAAE,CAAC,OAAO,EAAE;IAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC9C,OAAO;QACL,OAAO;QACP,IAAI;QACJ,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;QACtC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;QACtC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC;QACxC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACrC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;QACzC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC;QAC3C,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QAChC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC;QACpD,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,qBAAqB,CAAC;QACzD,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;QACtC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC;QAC9B,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,iBAAiB,CAAC;QACnD,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC;QAC/B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QAChC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QAClC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC;QAClD,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QAChC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,SAAgB,aAAa,CAAC,KAAsB,EAAE,KAAa;IACjE,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,KAAK,EAAE,CAAC,CAAC;AAC/C,CAAC"}

package/dist/runnerUtility/runnerKeys.d.ts

@@ -0,0 +1,11 @@
+import { type SshKeyPair } from '../runners/sshKeys';
+import type { RunnerHomePaths } from './runnerHome';
+export interface RunnerKeys {
+    client: SshKeyPair;
+    server: SshKeyPair;
+}
+/** @description Both keys, made now when missing. */
+export declare function ensureRunnerKeys(paths: RunnerHomePaths): RunnerKeys;
+/** @description Both keys, or `null` when any is missing (not paired on this account). */
+export declare function readRunnerKeys(paths: RunnerHomePaths): RunnerKeys | null;
+//# sourceMappingURL=runnerKeys.d.ts.map

package/dist/runnerUtility/runnerKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runnerKeys.d.ts","sourceRoot":"","sources":["../../src/runnerUtility/runnerKeys.ts"],"names":[],"mappings":"AAEA,OAAO,EAA0B,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC7E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAgCpD,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,qDAAqD;AACrD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,eAAe,GAAG,UAAU,CAGnE;AAED,0FAA0F;AAC1F,wBAAgB,cAAc,CAAC,KAAK,EAAE,eAAe,GAAG,UAAU,GAAG,IAAI,CAIxE"}

package/dist/runnerUtility/runnerKeys.js

@@ -0,0 +1,80 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureRunnerKeys = ensureRunnerKeys;
+exports.readRunnerKeys = readRunnerKeys;
+const fs = __importStar(require("fs"));
+const configDirFile_1 = require("../configDirFile");
+const sshKeys_1 = require("../runners/sshKeys");
+/**
+ * @description The runner's two keys, made at pairing and never changed: the CLIENT key (the hub's `authorized_keys` line holds its
+ * public half — it is how the runner logs in and may do nothing but speak to the gate) and the HOST key of its built-in ssh server (the
+ * hub pins its public half, so nobody else can answer in the runner's name). Both are made with `generateEd25519KeyPair`, which
+ * reads every key back (ssh2's generator now and then writes a key nothing can read).
+ */
+const privateKeyMode = 0o600;
+const publicKeyMode = 0o644;
+const publicKeySuffix = '.pub';
+function readKeyPair(privatePath) {
+    try {
+        const privateKey = fs.readFileSync(privatePath, 'utf8');
+        const publicKey = fs.readFileSync(`${privatePath}${publicKeySuffix}`, 'utf8').trim().split(' ').slice(0, 2).join(' ');
+        return { privateKey, publicKey };
+    }
+    catch {
+        return null;
+    }
+}
+function ensureKeyPair(privatePath, comment) {
+    const existing = readKeyPair(privatePath);
+    if (existing !== null)
+        return existing;
+    const created = (0, sshKeys_1.generateEd25519KeyPair)(comment);
+    (0, configDirFile_1.writeTextFileAtomically)(privatePath, created.privateKey, privateKeyMode);
+    (0, configDirFile_1.writeTextFileAtomically)(`${privatePath}${publicKeySuffix}`, `${created.publicKey} ${comment}\n`, publicKeyMode);
+    return created;
+}
+/** @description Both keys, made now when missing. */
+function ensureRunnerKeys(paths) {
+    fs.mkdirSync(paths.keysDir, { recursive: true, mode: 0o700 });
+    return { client: ensureKeyPair(paths.clientKey, 'charness-runner-client'), server: ensureKeyPair(paths.serverKey, 'charness-runner-host') };
+}
+/** @description Both keys, or `null` when any is missing (not paired on this account). */
+function readRunnerKeys(paths) {
+    const client = readKeyPair(paths.clientKey);
+    const server = readKeyPair(paths.serverKey);
+    return client === null || server === null ? null : { client, server };
+}
+//# sourceMappingURL=runnerKeys.js.map

package/dist/runnerUtility/runnerKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runnerKeys.js","sourceRoot":"","sources":["../../src/runnerUtility/runnerKeys.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyCA,4CAGC;AAGD,wCAIC;AAnDD,uCAAyB;AACzB,oDAA2D;AAC3D,gDAA6E;AAG7E;;;;;GAKG;AAEH,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B,MAAM,aAAa,GAAG,KAAK,CAAC;AAC5B,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,SAAS,WAAW,CAAC,WAAmB;IACtC,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,WAAW,GAAG,eAAe,EAAE,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,WAAmB,EAAE,OAAe;IACzD,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACvC,MAAM,OAAO,GAAG,IAAA,gCAAsB,EAAC,OAAO,CAAC,CAAC;IAChD,IAAA,uCAAuB,EAAC,WAAW,EAAE,OAAO,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IACzE,IAAA,uCAAuB,EAAC,GAAG,WAAW,GAAG,eAAe,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,IAAI,EAAE,aAAa,CAAC,CAAC;IAChH,OAAO,OAAO,CAAC;AACjB,CAAC;AAOD,qDAAqD;AACrD,SAAgB,gBAAgB,CAAC,KAAsB;IACrD,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,wBAAwB,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,sBAAsB,CAAC,EAAE,CAAC;AAC9I,CAAC;AAED,0FAA0F;AAC1F,SAAgB,cAAc,CAAC,KAAsB;IACnD,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5C,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACxE,CAAC"}

package/dist/runnerUtility/runnerServers.d.ts

@@ -0,0 +1,40 @@
+import type { Duplex } from 'stream';
+import { type AuthContext } from 'ssh2';
+/**
+ * @description The runner's built-in ssh servers. There is no sshd on the runner and nothing listens: the hub's gate speaks ssh over the
+ * channel of the runner's own outbound connection, with the runner as the SERVER (see `src/runners/gateLink.ts`). Two servers, one inside
+ * the other:
+ *
+ *   link server     the ssh session of the gate itself; it accepts a `direct-tcpip` channel and hands that channel to
+ *   session server  an ordinary ssh server for the hub's stock `ssh` (ControlMaster, rsync, `exec`) — one channel per connection of the
+ *                   hub's socket
+ *
+ * Both accept ONE key — the hub's, checked with a real signature — and both refuse everything that is not an `exec`: no shell, no pty,
+ * no subsystem, no x11, no agent, no port or unix-socket forwarding in either direction. `env` requests are accepted and ignored: a job
+ * never gets variables from the hub's ssh client.
+ */
+export interface RunnerServersOptions {
+    /** The PEM/OpenSSH private key of the built-in server (its public half is pinned by the hub). */
+    serverPrivateKey: string;
+    /** `ssh-ed25519 <base64>`: the only key that may log in. */
+    hubPublicKey: string;
+    /** The environment for the next command; asked per command. */
+    readEnv: () => NodeJS.ProcessEnv;
+    cwd: string;
+    /** Called with the number of running commands whenever it changes. */
+    onActiveCountChange?: (activeCount: number) => void;
+}
+export interface RunnerServers {
+    /** Serve ssh over `stream` (the exec channel to the hub) as the link server. */
+    acceptLinkStream: (stream: Duplex) => void;
+    getActiveExecCount: () => number;
+}
+/**
+ * @description The check shared by both servers: the hub's key only — the blob AND the algorithm name it was offered under must be the
+ * pinned key's (a request that carries the right public key under another algorithm, say RSA-SHA2, makes `verify` return an Error) —
+ * and the signature must verify. `verify` answers `boolean | Error`: only `true` is a pass. The first, unsigned query only asks «would
+ * this key do?».
+ */
+export declare function createHubAuthenticator(hubPublicKey: string): (auth: AuthContext) => void;
+export declare function createRunnerServers(options: RunnerServersOptions): RunnerServers;
+//# sourceMappingURL=runnerServers.d.ts.map

package/dist/runnerUtility/runnerServers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runnerServers.d.ts","sourceRoot":"","sources":["../../src/runnerUtility/runnerServers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,MAAM,CAAC;AAKvD;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,oBAAoB;IACnC,iGAAiG;IACjG,gBAAgB,EAAE,MAAM,CAAC;IACzB,4DAA4D;IAC5D,YAAY,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,OAAO,EAAE,MAAM,MAAM,CAAC,UAAU,CAAC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,sEAAsE;IACtE,mBAAmB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,IAAI,CAAC;CACrD;AAED,MAAM,WAAW,aAAa;IAC5B,gFAAgF;IAChF,gBAAgB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C,kBAAkB,EAAE,MAAM,MAAM,CAAC;CAClC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,WAAW,KAAK,IAAI,CAgBxF;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa,CA6ChF"}

package/dist/runnerUtility/runnerServers.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createHubAuthenticator = createHubAuthenticator;
+exports.createRunnerServers = createRunnerServers;
+const ssh2_1 = require("ssh2");
+const sshKeys_1 = require("../runners/sshKeys");
+const execSession_1 = require("./execSession");
+const injectStream_1 = require("./injectStream");
+/**
+ * @description The check shared by both servers: the hub's key only — the blob AND the algorithm name it was offered under must be the
+ * pinned key's (a request that carries the right public key under another algorithm, say RSA-SHA2, makes `verify` return an Error) —
+ * and the signature must verify. `verify` answers `boolean | Error`: only `true` is a pass. The first, unsigned query only asks «would
+ * this key do?».
+ */
+function createHubAuthenticator(hubPublicKey) {
+    const hub = (0, sshKeys_1.parsePublicKey)(hubPublicKey);
+    const hubKey = ssh2_1.utils.parseKey(hubPublicKey);
+    if (hub === null || hubKey instanceof Error)
+        throw new Error('the hub key does not read as an ssh public key');
+    return (auth) => {
+        if (auth.method !== 'publickey' || auth.key.algo !== hub.type || !auth.key.data.equals(hub.blob)) {
+            auth.reject();
+            return;
+        }
+        if (auth.signature === undefined) {
+            auth.accept();
+            return;
+        }
+        if (auth.blob !== undefined && hubKey.verify(auth.blob, auth.signature, auth.hashAlgo) === true)
+            auth.accept();
+        else
+            auth.reject();
+    };
+}
+function createRunnerServers(options) {
+    const authenticate = createHubAuthenticator(options.hubPublicKey);
+    let activeExecCount = 0;
+    const tracker = {
+        started: () => {
+            activeExecCount += 1;
+            options.onActiveCountChange?.(activeExecCount);
+        },
+        ended: () => {
+            activeExecCount -= 1;
+            options.onActiveCountChange?.(activeExecCount);
+        },
+    };
+    const sessionServer = new ssh2_1.Server({ hostKeys: [options.serverPrivateKey] }, (connection) => {
+        connection.on('error', () => undefined);
+        connection.on('authentication', authenticate);
+        connection.on('request', (_accept, reject) => reject?.());
+        connection.on('tcpip', (_accept, reject) => reject());
+        connection.on('openssh.streamlocal', (_accept, reject) => reject());
+        connection.on('ready', () => {
+            connection.on('session', (acceptSession) => {
+                const session = acceptSession();
+                session.on('env', (accept) => accept?.());
+                for (const refused of ['pty', 'shell', 'subsystem', 'x11'])
+                    session.on(refused, (_accept, reject) => reject?.());
+                session.on('exec', (accept, _reject, info) => {
+                    (0, execSession_1.serveExec)(accept(), info.command, { env: options.readEnv(), cwd: options.cwd, tracker });
+                });
+            });
+        });
+    });
+    const linkServer = new ssh2_1.Server({ hostKeys: [options.serverPrivateKey] }, (connection) => {
+        connection.on('error', () => undefined);
+        connection.on('authentication', authenticate);
+        connection.on('request', (_accept, reject) => reject?.());
+        connection.on('ready', () => {
+            connection.on('tcpip', (accept) => (0, injectStream_1.injectStreamIntoSshServer)(sessionServer, accept()));
+        });
+    });
+    return {
+        acceptLinkStream: (stream) => (0, injectStream_1.injectStreamIntoSshServer)(linkServer, stream),
+        getActiveExecCount: () => activeExecCount,
+    };
+}
+//# sourceMappingURL=runnerServers.js.map

package/dist/runnerUtility/runnerServers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runnerServers.js","sourceRoot":"","sources":["../../src/runnerUtility/runnerServers.ts"],"names":[],"mappings":";;AA4CA,wDAgBC;AAED,kDA6CC;AA1GD,+BAAuD;AACvD,gDAAoD;AACpD,+CAA4D;AAC5D,iDAA2D;AAkC3D;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,YAAoB;IACzD,MAAM,GAAG,GAAG,IAAA,wBAAc,EAAC,YAAY,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,YAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,GAAG,KAAK,IAAI,IAAI,MAAM,YAAY,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAC/G,OAAO,CAAC,IAAI,EAAE,EAAE;QACd,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACjG,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI;YAAE,IAAI,CAAC,MAAM,EAAE,CAAC;;YAC1G,IAAI,CAAC,MAAM,EAAE,CAAC;IACrB,CAAC,CAAC;AACJ,CAAC;AAED,SAAgB,mBAAmB,CAAC,OAA6B;IAC/D,MAAM,YAAY,GAAG,sBAAsB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAClE,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,MAAM,OAAO,GAAgB;QAC3B,OAAO,EAAE,GAAG,EAAE;YACZ,eAAe,IAAI,CAAC,CAAC;YACrB,OAAO,CAAC,mBAAmB,EAAE,CAAC,eAAe,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,EAAE,GAAG,EAAE;YACV,eAAe,IAAI,CAAC,CAAC;YACrB,OAAO,CAAC,mBAAmB,EAAE,CAAC,eAAe,CAAC,CAAC;QACjD,CAAC;KACF,CAAC;IAEF,MAAM,aAAa,GAAG,IAAI,aAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,UAAU,EAAE,EAAE;QACxF,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACxC,UAAU,CAAC,EAAE,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAC9C,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1D,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QACtD,UAAU,CAAC,EAAE,CAAC,qBAAqB,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QACpE,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YAC1B,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,aAAa,EAAE,EAAE;gBACzC,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;gBAChC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC1C,KAAK,MAAM,OAAO,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,CAAU;oBAAE,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,OAAgB,EAAE,MAAmC,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAChK,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;oBAC3C,IAAA,uBAAS,EAAC,MAAM,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC3F,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,IAAI,aAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,UAAU,EAAE,EAAE;QACrF,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACxC,UAAU,CAAC,EAAE,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAC9C,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1D,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YAC1B,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAA,wCAAyB,EAAC,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACzF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,gBAAgB,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAA,wCAAyB,EAAC,UAAU,EAAE,MAAM,CAAC;QAC3E,kBAAkB,EAAE,GAAG,EAAE,CAAC,eAAe;KAC1C,CAAC;AACJ,CAAC"}

package/dist/runnerUtility/serviceManager.d.ts

@@ -0,0 +1,54 @@
+import { type CommandRunner } from '../selfUpdate/commandRunner';
+import { type RunnerHomePaths } from './runnerHome';
+export type ServiceKind = 'user-service' | 'system-service';
+export interface TargetAccount {
+    name: string;
+    uid: number;
+    gid: number;
+    homeDir: string;
+}
+export interface ServiceDeps {
+    runner: CommandRunner;
+    platform: NodeJS.Platform;
+    /** The uid of this process (a `--system` install must be root). */
+    uid: number;
+    /** Is `pid` the runner's link (alive and running `runnerCli.js run`)? A stale or reused pid in `status.json` is not. */
+    checkIsRunnerLink: (pid: number) => boolean;
+    /** The account that runs this process, and its home. */
+    accountName: string;
+    homeDir: string;
+    nodePath: string;
+    /** Where LaunchDaemons live (`/Library/LaunchDaemons`; a test's own folder). */
+    launchDaemonsDir: string;
+    /** Give a file to an account (`fs.chownSync`; a test is not root). */
+    chown: (filePath: string, uid: number, gid: number) => void;
+    /** Who `--user <name>` names; `null` when there is no such account. */
+    resolveAccount: (name: string) => Promise<TargetAccount | null>;
+}
+export interface ServiceRequest {
+    isSystem: boolean;
+    /** `--user`: required with `--system`. */
+    userName: string | null;
+}
+export interface ServiceResult {
+    ok: boolean;
+    lines: string[];
+}
+export type ServiceCommandParsing = {
+    ok: true;
+    action: 'install' | 'uninstall';
+    request: ServiceRequest;
+} | {
+    ok: false;
+    error: string;
+};
+/** @description `install|uninstall [--system --user <name>]`. */
+export declare function parseServiceCommand(args: readonly string[]): ServiceCommandParsing;
+export declare function createServiceDeps(): ServiceDeps;
+/** @description The kind written by the last install, or `null`. */
+export declare function readServiceKind(paths: RunnerHomePaths): ServiceKind | null;
+/** @description `service install` for `request`. */
+export declare function installService(request: ServiceRequest, deps: ServiceDeps): Promise<ServiceResult>;
+/** @description `service uninstall` for `request`. */
+export declare function uninstallService(request: ServiceRequest, deps: ServiceDeps): Promise<ServiceResult>;
+//# sourceMappingURL=serviceManager.d.ts.map