charness 3.7.0 → 3.9.0

package/dist/remoteRun/ssh.js

@@ -36,7 +36,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.sshFailureExitCode = void 0;
 exports.getRemoteRunCacheDir = getRemoteRunCacheDir;
 exports.ensureRemoteRunCacheDir = ensureRemoteRunCacheDir;
+exports.checkIsSshPathQuotable = checkIsSshPathQuotable;
+exports.escapeSshTokens = escapeSshTokens;
+exports.quoteSshOptionPath = quoteSshOptionPath;
 exports.buildSshArgs = buildSshArgs;
+exports.checkIsPlainShellWord = checkIsPlainShellWord;
 exports.quoteShellWord = quoteShellWord;
 exports.joinShellWords = joinShellWords;
 exports.buildRsyncSshCommand = buildRsyncSshCommand;
@@ -53,6 +57,7 @@ const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const tmuxExec_1 = require("../utils/tmuxExec");
+const interrupts_1 = require("./interrupts");
 /**
  * @description Everything that touches ssh: the argument lists (pure, unit-tested), the quoting for the remote shell, and the process
  * helpers. Always non-interactive (`BatchMode`: a password or an unknown host key is an error, never a prompt), host keys checked as the
@@ -79,25 +84,52 @@ function ensureRemoteRunCacheDir(cacheDir) {
     fs.chmodSync(cacheDir, cacheDirectoryMode);
     fs.chmodSync(path.join(cacheDir, 'ssh'), cacheDirectoryMode);
 }
-/** @description The ssh options of every call to `runner` (without the destination): the operator's own first — ssh keeps the first value of an option — then ours. */
+/** A path that holds one of these cannot reach ssh's option parser AND rsync's `-e` parser as the same single word. */
+const unquotablePathPattern = /["'\\$`\r\n]/;
+/** @description Can `value` be put into an ssh option or a command line that ssh and rsync's `-e` both read back as one word? (Whitespace can; a quote, a backslash, a `$`, a backtick or a line break cannot.) */
+function checkIsSshPathQuotable(value) {
+    return !unquotablePathPattern.test(value);
+}
+/** @description ssh expands `%`-tokens in a ProxyCommand, an identity file, a known-hosts path and a ControlPath: a literal `%` is written `%%`. */
+function escapeSshTokens(value) {
+    return value.replace(/%/g, '%%');
+}
+/**
+ * @description A path as the VALUE of an `-o` option. ssh reads `-o` like a line of its config file: `UserKnownHostsFile` there is a LIST of
+ * files separated by whitespace and `ControlPath` takes one word followed by nothing, so `/home/my user/…` would be two words and ssh would
+ * fail or look in the wrong place. Double quotes keep one path one word (ssh_config(5): «arguments may optionally be enclosed in double
+ * quotes»); `-i` takes its path as a plain argument and needs none.
+ */
+function quoteSshOptionPath(value) {
+    return /\s/.test(value) ? `"${value}"` : value;
+}
+/**
+ * @description The ssh options of every call to `runner` (without the destination): the operator's own first — ssh keeps the first value of an
+ * option — then ours. The shared connection is an optimisation: a cache path that is too long for a unix socket, or holds a character that
+ * cannot be quoted, turns it off instead of failing the call.
+ */
 function buildSshArgs(runner, cacheDir) {
     const controlDirectory = path.join(cacheDir, 'ssh');
-    const isControlPathShortEnough = controlDirectory.length + 1 + controlPathHashLength <= unixSocketPathLimit;
+    const isControlPathUsable = controlDirectory.length + 1 + controlPathHashLength <= unixSocketPathLimit && checkIsSshPathQuotable(controlDirectory);
     return [
         ...(runner.sshOptions ?? []),
         '-o', 'BatchMode=yes',
         '-o', `ConnectTimeout=${connectTimeoutSeconds}`,
         '-o', `ServerAliveInterval=${serverAliveIntervalSeconds}`,
         '-o', `ServerAliveCountMax=${serverAliveCountMax}`,
-        ...(isControlPathShortEnough
-            ? ['-o', 'ControlMaster=auto', '-o', `ControlPath=${path.join(controlDirectory, '%C')}`, '-o', `ControlPersist=${controlPersistSeconds}`]
+        ...(isControlPathUsable
+            ? ['-o', 'ControlMaster=auto', '-o', `ControlPath=${quoteSshOptionPath(path.join(escapeSshTokens(controlDirectory), '%C'))}`, '-o', `ControlPersist=${controlPersistSeconds}`]
             : ['-o', 'ControlMaster=no']),
     ];
 }
 const safeWordPattern = /^[A-Za-z0-9_@%+=:,./-]+$/;
+/** @description Is `word` one that needs no quoting for a POSIX shell (and for ssh's and rsync's own parsers)? */
+function checkIsPlainShellWord(word) {
+    return safeWordPattern.test(word);
+}
 /** @description One word quoted for a POSIX shell (`shellSingleQuote`; an already plain word stays as it is, so the commands read well in a log). */
 function quoteShellWord(word) {
-    return word !== '' && safeWordPattern.test(word) ? word : (0, tmuxExec_1.shellSingleQuote)(word);
+    return word !== '' && checkIsPlainShellWord(word) ? word : (0, tmuxExec_1.shellSingleQuote)(word);
 }
 /** @description The words of an argument list as one string rsync's `-e` and a shell both read back as the same words. */
 function joinShellWords(words) {
@@ -173,9 +205,11 @@ function runSshCommand(params) {
             settle();
             resolve({ exitCode: exports.sshFailureExitCode, stdout, stderr: `${stderr}${error.message}\n`, isTimedOut });
         });
-        child.on('close', (exitCode) => {
+        // Once cut off, its `exit` is enough: after login this ssh is only a client of a ControlPersist master that holds its pipes, so `close` would
+        // come when the remote command ends (or the master gives up), not when the client is gone — the call, a probe's deadline or a Ctrl-C, would hang.
+        void (0, interrupts_1.waitForChildEnd)(child, () => isTimedOut).then((exitCode) => {
             settle();
-            resolve({ exitCode, stdout, stderr, isTimedOut });
+            resolve({ exitCode: isTimedOut ? null : exitCode, stdout, stderr, isTimedOut });
         });
         child.stdin.end(params.input ?? '');
     });

package/dist/remoteRun/ssh.js.map

@@ -1 +1 @@
-{"version":3,"file":"ssh.js","sourceRoot":"","sources":["../../src/remoteRun/ssh.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,oDAGC;AAGD,0DAIC;AAGD,oCAaC;AAKD,wCAEC;AAGD,wCAEC;AAGD,oDAEC;AAGD,0CAIC;AAYD,4DAOC;AAGD,4DAKC;AAED,4DAEC;AAUD,sDAEC;AAuBD,sCAgCC;AAGD,wCAEC;AAGD,wCAaC;AAlMD,iDAA2E;AAC3E,uCAAyB;AACzB,uCAAyB;AACzB,2CAA6B;AAC7B,gDAAqD;AAGrD;;;;;GAKG;AAEH,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACjC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AACtC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACjC,yGAAyG;AACzG,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,4DAA4D;AAC5D,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACjC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAEjC,mKAAmK;AACnK,SAAgB,oBAAoB,CAAC,MAAyB,OAAO,CAAC,GAAG,EAAE,UAAkB,EAAE,CAAC,OAAO,EAAE;IACvG,MAAM,SAAS,GAAG,GAAG,CAAC,cAAc,KAAK,SAAS,IAAI,GAAG,CAAC,cAAc,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACpI,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;AACxD,CAAC;AAED,wEAAwE;AACxE,SAAgB,uBAAuB,CAAC,QAAgB;IACtD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACxF,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAC3C,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,kBAAkB,CAAC,CAAC;AAC/D,CAAC;AAED,uKAAuK;AACvK,SAAgB,YAAY,CAAC,MAAwC,EAAE,QAAgB;IACrF,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,wBAAwB,GAAG,gBAAgB,CAAC,MAAM,GAAG,CAAC,GAAG,qBAAqB,IAAI,mBAAmB,CAAC;IAC5G,OAAO;QACL,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;QAC5B,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,kBAAkB,qBAAqB,EAAE;QAC/C,IAAI,EAAE,uBAAuB,0BAA0B,EAAE;QACzD,IAAI,EAAE,uBAAuB,mBAAmB,EAAE;QAClD,GAAG,CAAC,wBAAwB;YAC1B,CAAC,CAAC,CAAC,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,eAAe,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,kBAAkB,qBAAqB,EAAE,CAAC;YACzI,CAAC,CAAC,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;KAChC,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG,0BAA0B,CAAC;AAEnD,qJAAqJ;AACrJ,SAAgB,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI,KAAK,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAA,2BAAgB,EAAC,IAAI,CAAC,CAAC;AACnF,CAAC;AAED,0HAA0H;AAC1H,SAAgB,cAAc,CAAC,KAAwB;IACrD,OAAO,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,gIAAgI;AAChI,SAAgB,oBAAoB,CAAC,MAAwC,EAAE,QAAgB;IAC7F,OAAO,cAAc,CAAC,CAAC,KAAK,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,+GAA+G;AAC/G,SAAgB,eAAe,CAAC,UAAkB;IAChD,IAAI,UAAU,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC;IACnC,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,cAAc,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,OAAO,cAAc,CAAC,UAAU,CAAC,CAAC;AACpC,CAAC;AAWD,uJAAuJ;AACvJ,SAAgB,wBAAwB,CAAC,IAAsB;IAC7D,MAAM,WAAW,GAAG;QAClB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAgB,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;KAClH,CAAC;IACF,MAAM,UAAU,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;IACpF,OAAO,CAAC,GAAG,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACjJ,CAAC;AAED,6KAA6K;AAC7K,SAAgB,wBAAwB,CAAC,MAAqC,EAAE,UAAkB;IAChG,MAAM,YAAY,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;IAC9D,MAAM,MAAM,GAAG,GAAG,YAAY,IAAI,UAAU,EAAE,CAAC;IAC/C,MAAM,SAAS,GAAG,GAAG,YAAY,KAAK,UAAU,KAAK,CAAC;IACtD,OAAO,YAAY,YAAY,aAAa,SAAS,iBAAiB,SAAS,aAAa,SAAS,IAAI,MAAM,EAAE,CAAC;AACpH,CAAC;AAED,SAAgB,wBAAwB,CAAC,MAAqC,EAAE,UAAkB;IAChG,OAAO,WAAW,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,UAAU,EAAE,CAAC;AACxE,CAAC;AAED,4EAA4E;AAC/D,QAAA,kBAAkB,GAAG,GAAG,CAAC;AAEtC;;;;GAIG;AACH,SAAgB,qBAAqB,CAAC,QAAuB;IAC3D,OAAO,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,0BAAkB,CAAC;AAC9D,CAAC;AAsBD,0FAA0F;AAC1F,SAAgB,aAAa,CAAC,MAAoB;IAChD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,IAAA,qBAAK,EAAC,KAAK,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5J,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,MAAM,MAAM,GAAG,GAAS,EAAE;YACxB,UAAU,GAAG,IAAI,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI;YAAE,MAAM,EAAE,CAAC;;YACzC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,GAAS,EAAE;YACxB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACtD,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAoD,CAAC,CAAC,CAAC;QACpF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,MAAM,EAAE,CAAC;YACT,OAAO,CAAC,EAAE,QAAQ,EAAE,0BAAkB,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QACvG,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE;YAC7B,MAAM,EAAE,CAAC;YACT,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,iKAAiK;AACjK,SAAgB,cAAc,CAAC,MAAiD;IAC9E,OAAO,IAAA,qBAAK,EAAC,KAAK,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;AACvJ,CAAC;AAED,6KAA6K;AAC7K,SAAgB,cAAc,CAAC,MAAgD,EAAE,QAAgB;IAC/F,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,IAAA,qBAAK,EAAC,KAAK,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/G,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC,CAAC;QACpF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACrB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACrB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"ssh.js","sourceRoot":"","sources":["../../src/remoteRun/ssh.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,oDAGC;AAGD,0DAIC;AAMD,wDAEC;AAGD,0CAEC;AAQD,gDAEC;AAOD,oCAaC;AAKD,sDAEC;AAGD,wCAEC;AAGD,wCAEC;AAGD,oDAEC;AAGD,0CAIC;AAYD,4DAOC;AAGD,4DAKC;AAED,4DAEC;AAUD,sDAEC;AA0BD,sCAkCC;AAGD,wCAEC;AAGD,wCAaC;AAxOD,iDAA2E;AAC3E,uCAAyB;AACzB,uCAAyB;AACzB,2CAA6B;AAC7B,gDAAqD;AACrD,6CAA+C;AAG/C;;;;;GAKG;AAEH,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACjC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AACtC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACjC,yGAAyG;AACzG,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,4DAA4D;AAC5D,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACjC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAEjC,mKAAmK;AACnK,SAAgB,oBAAoB,CAAC,MAAyB,OAAO,CAAC,GAAG,EAAE,UAAkB,EAAE,CAAC,OAAO,EAAE;IACvG,MAAM,SAAS,GAAG,GAAG,CAAC,cAAc,KAAK,SAAS,IAAI,GAAG,CAAC,cAAc,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACpI,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;AACxD,CAAC;AAED,wEAAwE;AACxE,SAAgB,uBAAuB,CAAC,QAAgB;IACtD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACxF,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAC3C,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,kBAAkB,CAAC,CAAC;AAC/D,CAAC;AAED,uHAAuH;AACvH,MAAM,qBAAqB,GAAG,cAAc,CAAC;AAE7C,mNAAmN;AACnN,SAAgB,sBAAsB,CAAC,KAAa;IAClD,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,oJAAoJ;AACpJ,SAAgB,eAAe,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACnC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,KAAa;IAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAAC,MAAwC,EAAE,QAAgB;IACrF,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,MAAM,GAAG,CAAC,GAAG,qBAAqB,IAAI,mBAAmB,IAAI,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IACnJ,OAAO;QACL,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;QAC5B,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,kBAAkB,qBAAqB,EAAE;QAC/C,IAAI,EAAE,uBAAuB,0BAA0B,EAAE;QACzD,IAAI,EAAE,uBAAuB,mBAAmB,EAAE;QAClD,GAAG,CAAC,mBAAmB;YACrB,CAAC,CAAC,CAAC,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,eAAe,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,kBAAkB,qBAAqB,EAAE,CAAC;YAC9K,CAAC,CAAC,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;KAChC,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG,0BAA0B,CAAC;AAEnD,kHAAkH;AAClH,SAAgB,qBAAqB,CAAC,IAAY;IAChD,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,qJAAqJ;AACrJ,SAAgB,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI,KAAK,EAAE,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAA,2BAAgB,EAAC,IAAI,CAAC,CAAC;AACpF,CAAC;AAED,0HAA0H;AAC1H,SAAgB,cAAc,CAAC,KAAwB;IACrD,OAAO,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,gIAAgI;AAChI,SAAgB,oBAAoB,CAAC,MAAwC,EAAE,QAAgB;IAC7F,OAAO,cAAc,CAAC,CAAC,KAAK,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,+GAA+G;AAC/G,SAAgB,eAAe,CAAC,UAAkB;IAChD,IAAI,UAAU,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC;IACnC,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,cAAc,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,OAAO,cAAc,CAAC,UAAU,CAAC,CAAC;AACpC,CAAC;AAWD,uJAAuJ;AACvJ,SAAgB,wBAAwB,CAAC,IAAsB;IAC7D,MAAM,WAAW,GAAG;QAClB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAgB,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;KAClH,CAAC;IACF,MAAM,UAAU,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;IACpF,OAAO,CAAC,GAAG,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACjJ,CAAC;AAED,6KAA6K;AAC7K,SAAgB,wBAAwB,CAAC,MAAqC,EAAE,UAAkB;IAChG,MAAM,YAAY,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;IAC9D,MAAM,MAAM,GAAG,GAAG,YAAY,IAAI,UAAU,EAAE,CAAC;IAC/C,MAAM,SAAS,GAAG,GAAG,YAAY,KAAK,UAAU,KAAK,CAAC;IACtD,OAAO,YAAY,YAAY,aAAa,SAAS,iBAAiB,SAAS,aAAa,SAAS,IAAI,MAAM,EAAE,CAAC;AACpH,CAAC;AAED,SAAgB,wBAAwB,CAAC,MAAqC,EAAE,UAAkB;IAChG,OAAO,WAAW,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,UAAU,EAAE,CAAC;AACxE,CAAC;AAED,4EAA4E;AAC/D,QAAA,kBAAkB,GAAG,GAAG,CAAC;AAEtC;;;;GAIG;AACH,SAAgB,qBAAqB,CAAC,QAAuB;IAC3D,OAAO,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,0BAAkB,CAAC;AAC9D,CAAC;AAyBD,0FAA0F;AAC1F,SAAgB,aAAa,CAAC,MAAoB;IAChD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,IAAA,qBAAK,EAAC,KAAK,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5J,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,MAAM,MAAM,GAAG,GAAS,EAAE;YACxB,UAAU,GAAG,IAAI,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI;YAAE,MAAM,EAAE,CAAC;;YACzC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,GAAS,EAAE;YACxB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACtD,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAoD,CAAC,CAAC,CAAC;QACpF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,MAAM,EAAE,CAAC;YACT,OAAO,CAAC,EAAE,QAAQ,EAAE,0BAAkB,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QACvG,CAAC,CAAC,CAAC;QACH,8IAA8I;QAC9I,kJAAkJ;QAClJ,KAAK,IAAA,4BAAe,EAAC,KAAK,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;YAC9D,MAAM,EAAE,CAAC;YACT,OAAO,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,iKAAiK;AACjK,SAAgB,cAAc,CAAC,MAAiD;IAC9E,OAAO,IAAA,qBAAK,EAAC,KAAK,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;AACvJ,CAAC;AAED,6KAA6K;AAC7K,SAAgB,cAAc,CAAC,MAAgD,EAAE,QAAgB;IAC/F,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,IAAA,qBAAK,EAAC,KAAK,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/G,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC,CAAC;QACpF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACrB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACrB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/runnerUtility/adminCheck.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @description Is the account that runs the jobs an admin one? The agents' code runs with its rights, so a runner on an account that can
+ * `sudo` (or is root) gets a warning at pairing: make a standard user for it. macOS: member of the `admin` group; Linux: uid 0 or a
+ * member of `sudo`, `wheel` or `admin`.
+ */
+export declare const linuxAdminGroups: readonly string[];
+export declare const macAdminGroup = "admin";
+export interface AccountFacts {
+    platform: NodeJS.Platform;
+    uid: number;
+    groups: readonly string[];
+}
+export declare function checkIsAdminAccount(account: AccountFacts): boolean;
+/** @description The account's group names (`id -Gn`), empty when it cannot be asked. */
+export declare function readAccountGroups(): string[];
+export declare function readAccountFacts(): AccountFacts;
+export declare function formatAdminWarning(accountName: string): string[];
+//# sourceMappingURL=adminCheck.d.ts.map

package/dist/runnerUtility/adminCheck.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adminCheck.d.ts","sourceRoot":"","sources":["../../src/runnerUtility/adminCheck.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AAEH,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAA+B,CAAC;AAC9E,eAAO,MAAM,aAAa,UAAU,CAAC;AAErC,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3B;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAGlE;AAED,wFAAwF;AACxF,wBAAgB,iBAAiB,IAAI,MAAM,EAAE,CAG5C;AAED,wBAAgB,gBAAgB,IAAI,YAAY,CAE/C;AAED,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAKhE"}

package/dist/runnerUtility/adminCheck.js

@@ -0,0 +1,69 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.macAdminGroup = exports.linuxAdminGroups = void 0;
+exports.checkIsAdminAccount = checkIsAdminAccount;
+exports.readAccountGroups = readAccountGroups;
+exports.readAccountFacts = readAccountFacts;
+exports.formatAdminWarning = formatAdminWarning;
+const child_process_1 = require("child_process");
+const os = __importStar(require("os"));
+/**
+ * @description Is the account that runs the jobs an admin one? The agents' code runs with its rights, so a runner on an account that can
+ * `sudo` (or is root) gets a warning at pairing: make a standard user for it. macOS: member of the `admin` group; Linux: uid 0 or a
+ * member of `sudo`, `wheel` or `admin`.
+ */
+exports.linuxAdminGroups = ['sudo', 'wheel', 'admin'];
+exports.macAdminGroup = 'admin';
+function checkIsAdminAccount(account) {
+    if (account.platform === 'darwin')
+        return account.groups.includes(exports.macAdminGroup);
+    return account.uid === 0 || account.groups.some((group) => exports.linuxAdminGroups.includes(group));
+}
+/** @description The account's group names (`id -Gn`), empty when it cannot be asked. */
+function readAccountGroups() {
+    const result = (0, child_process_1.spawnSync)('id', ['-Gn'], { encoding: 'utf8', timeout: 4000 });
+    return result.status === 0 ? result.stdout.trim().split(/\s+/).filter((group) => group !== '') : [];
+}
+function readAccountFacts() {
+    return { platform: process.platform, uid: os.userInfo().uid, groups: readAccountGroups() };
+}
+function formatAdminWarning(accountName) {
+    return [
+        `⚠ «${accountName}» is an admin account: the agents' code would run with its rights.`,
+        '  Create a standard user for runs (System Settings → Users & Groups, or `adduser`) and run the line there.',
+    ];
+}
+//# sourceMappingURL=adminCheck.js.map

package/dist/runnerUtility/adminCheck.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adminCheck.js","sourceRoot":"","sources":["../../src/runnerUtility/adminCheck.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkBA,kDAGC;AAGD,8CAGC;AAED,4CAEC;AAED,gDAKC;AAtCD,iDAA0C;AAC1C,uCAAyB;AAEzB;;;;GAIG;AAEU,QAAA,gBAAgB,GAAsB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACjE,QAAA,aAAa,GAAG,OAAO,CAAC;AAQrC,SAAgB,mBAAmB,CAAC,OAAqB;IACvD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAa,CAAC,CAAC;IACjF,OAAO,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,wFAAwF;AACxF,SAAgB,iBAAiB;IAC/B,MAAM,MAAM,GAAG,IAAA,yBAAS,EAAC,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7E,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACtG,CAAC;AAED,SAAgB,gBAAgB;IAC9B,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,CAAC;AAC7F,CAAC;AAED,SAAgB,kBAAkB,CAAC,WAAmB;IACpD,OAAO;QACL,MAAM,WAAW,oEAAoE;QACrF,4GAA4G;KAC7G,CAAC;AACJ,CAAC"}

package/dist/runnerUtility/adminService.d.ts

@@ -0,0 +1,22 @@
+import { type CommandRunner } from '../selfUpdate/commandRunner';
+import { type ServiceResult, type TargetAccount } from './serviceCommon';
+export interface AdminServiceDeps {
+    runner: CommandRunner;
+    platform: NodeJS.Platform;
+    /** The uid of this process: the step is root's. */
+    uid: number;
+    /** The folder of the `node` that runs this step: the daemons' `PATH` starts with it, like the account's own services. */
+    nodeDir: string;
+    /** Where LaunchDaemons live (`/Library/LaunchDaemons`; a test's own folder). */
+    launchDaemonsDir: string;
+    /** Give a definition to root:wheel without following a link (`fs.lchownSync`; a test is not root). */
+    giveToRoot: (filePath: string, uid: number, gid: number) => void;
+    /** Who the account is, from the passwd database (never from the account's files); `null` when there is no such account. */
+    resolveAccount: (name: string) => Promise<TargetAccount | null>;
+    /** Wait between two looks at a starting user manager (a test does not wait). */
+    sleep: (ms: number) => Promise<void>;
+}
+export declare function createAdminServiceDeps(): AdminServiceDeps;
+/** @description Install the always-on service of `accountName`, an account that is already paired. Needs root; touches nothing of the account's but through the account. */
+export declare function installServiceForAccount(accountName: string, deps: AdminServiceDeps): Promise<ServiceResult>;
+//# sourceMappingURL=adminService.d.ts.map

package/dist/runnerUtility/adminService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adminService.d.ts","sourceRoot":"","sources":["../../src/runnerUtility/adminService.ts"],"names":[],"mappings":"AAGA,OAAO,EAA6B,KAAK,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5F,OAAO,EASL,KAAK,aAAa,EAClB,KAAK,aAAa,EACnB,MAAM,iBAAiB,CAAC;AA6BzB,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,aAAa,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC1B,mDAAmD;IACnD,GAAG,EAAE,MAAM,CAAC;IACZ,yHAAyH;IACzH,OAAO,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,gBAAgB,EAAE,MAAM,CAAC;IACzB,sGAAsG;IACtG,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACjE,2HAA2H;IAC3H,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAChE,gFAAgF;IAChF,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACtC;AAED,wBAAgB,sBAAsB,IAAI,gBAAgB,CAWzD;AAkDD,4KAA4K;AAC5K,wBAAsB,wBAAwB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,aAAa,CAAC,CAOlH"}

package/dist/runnerUtility/adminService.js

@@ -0,0 +1,145 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAdminServiceDeps = createAdminServiceDeps;
+exports.installServiceForAccount = installServiceForAccount;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const commandRunner_1 = require("../selfUpdate/commandRunner");
+const serviceCommon_1 = require("./serviceCommon");
+const runnerHome_1 = require("./runnerHome");
+const serviceUnits_1 = require("./serviceUnits");
+/**
+ * @description The ROOT step of the admin pairing line: install the always-on service of a runner account that the line has just paired.
+ * It runs from a root-owned copy of the package (`rootServiceCli.ts`, which has no dependencies — hence Node built-ins only here), never
+ * from the account's files: the account runs the agents' code, so root must not exec, read through or write into anything the account can
+ * change. Everything of the account's — Pueue, its configuration, the service record, the user service's own units — is therefore done by
+ * the account's OWN program run AS the account (`sudo -u <account> -H`); root only
+ *
+ *   macOS   writes the two LaunchDaemon definitions into `/Library/LaunchDaemons` (a folder only root can write), `chown`s them with
+ *           `lchown`, and calls `launchctl`. The definitions are rendered here from the account's name and home alone — the account's
+ *           answer to `system-step prepare` decides nothing about their text — and they run as the account (`UserName`), with no extra rights
+ *   Linux   switches lingering on for the account (`loginctl enable-linger`), waits for its user manager, and has the account install its
+ *           own user service — the same install it would run itself
+ *
+ * An account's tree is read by nobody here, so a planted link in it reaches nothing of root's.
+ */
+/** The install run as the account starts two services and may wait for each. */
+const installAsAccountTimeoutMs = 120 * 1000;
+/** After `enable-linger` the user manager takes a moment to come up: it is asked once a second, for this many tries. */
+const userManagerPollMs = 1000;
+const userManagerPollAttempts = 20;
+/** What `systemctl --user is-system-running` prints once the manager can take units (`degraded`: up, with some unit failed). */
+const userManagerReadyStates = ['running', 'degraded'];
+const freshLineText = 'paste a fresh admin line from /runners (it finds the account paired and only installs the service)';
+function createAdminServiceDeps() {
+    return {
+        runner: commandRunner_1.runCommand,
+        platform: process.platform,
+        uid: os.userInfo().uid,
+        nodeDir: path.dirname(process.execPath),
+        launchDaemonsDir: '/Library/LaunchDaemons',
+        giveToRoot: fs.lchownSync,
+        resolveAccount: (name) => (process.platform === 'darwin' ? (0, serviceCommon_1.resolveMacAccount)(name, commandRunner_1.runCommand) : (0, serviceCommon_1.resolveLinuxAccount)(name, commandRunner_1.runCommand)),
+        sleep: (ms) => new Promise((resolve) => { setTimeout(resolve, ms); }),
+    };
+}
+/** The arguments of `sudo` that run the account's own launcher AS the account. */
+function asAccountArgs(account) {
+    return ['-u', account.name, '-H'];
+}
+async function installDaemons(account, deps) {
+    const paths = (0, runnerHome_1.getRunnerHomePaths)(account.homeDir);
+    const stepArgs = (step) => [...asAccountArgs(account), paths.launcher, 'service', 'system-step', step];
+    const prepared = await deps.runner('sudo', stepArgs('prepare'), { timeoutMs: installAsAccountTimeoutMs });
+    const answer = (0, serviceCommon_1.parseSystemStepAnswer)(prepared.stdout);
+    if (answer === null)
+        return (0, serviceCommon_1.fail)(`The account ${account.name} gave no answer to its preparation (${(0, commandRunner_1.getOutputTail)(prepared, 2) || 'no output'}).`);
+    if (!answer.ok)
+        return (0, serviceCommon_1.fail)(...answer.lines);
+    const names = (0, serviceUnits_1.getServiceNames)(paths.root);
+    const accountJobs = (0, serviceUnits_1.planLaunchdJobs)(paths, names, account.name, deps.nodeDir, account.name);
+    const result = await (0, serviceCommon_1.installLaunchdJobs)({
+        runner: deps.runner,
+        domain: 'system',
+        files: (0, serviceCommon_1.getLaunchdFiles)(true, account.homeDir, names, deps.launchDaemonsDir),
+        names,
+        jobs: accountJobs,
+        hadService: answer.hadService,
+        isLogDirMade: false,
+        giveToRoot: deps.giveToRoot,
+        forgetFirstInstall: async () => { await deps.runner('sudo', stepArgs('abandon'), { timeoutMs: serviceCommon_1.commandTimeoutMs }); },
+        retryText: freshLineText,
+        render: serviceUnits_1.renderLaunchdPlist,
+    });
+    if (!result.ok)
+        return result;
+    return { ok: true, lines: [`Installed two LaunchDaemons (${names.launchdLink}, ${names.launchdPueued}) that run as ${account.name}: always on, also logged out.`] };
+}
+async function installUserServiceFor(account, deps) {
+    const paths = (0, runnerHome_1.getRunnerHomePaths)(account.homeDir);
+    const asAccount = [...asAccountArgs(account), 'env', `XDG_RUNTIME_DIR=/run/user/${account.uid}`];
+    const linger = await deps.runner('loginctl', ['enable-linger', account.name], { timeoutMs: serviceCommon_1.commandTimeoutMs });
+    if (!linger.ok)
+        return (0, serviceCommon_1.fail)(`\`loginctl enable-linger ${account.name}\` failed: ${(0, commandRunner_1.getOutputTail)(linger, 1) || 'no answer'}`);
+    for (let attempt = 1; attempt <= userManagerPollAttempts; attempt += 1) {
+        const state = await deps.runner('sudo', [...asAccount, 'systemctl', '--user', 'is-system-running'], { timeoutMs: serviceCommon_1.commandTimeoutMs });
+        if (userManagerReadyStates.includes(state.stdout.trim()))
+            break;
+        if (attempt === userManagerPollAttempts)
+            return (0, serviceCommon_1.fail)(`The user manager of ${account.name} did not come up within ${(userManagerPollAttempts * userManagerPollMs) / 1000} s after lingering was switched on.`);
+        await deps.sleep(userManagerPollMs);
+    }
+    const installed = await deps.runner('sudo', [...asAccount, paths.launcher, 'service', 'install'], { timeoutMs: installAsAccountTimeoutMs });
+    const lines = installed.stdout.split('\n').map((line) => line.trim()).filter((line) => line !== '');
+    if (installed.ok)
+        return { ok: true, lines };
+    return (0, serviceCommon_1.fail)(...lines, ...(lines.length === 0 ? [(0, commandRunner_1.getOutputTail)(installed) || 'the install gave no output'] : []));
+}
+/** @description Install the always-on service of `accountName`, an account that is already paired. Needs root; touches nothing of the account's but through the account. */
+async function installServiceForAccount(accountName, deps) {
+    if (deps.platform !== 'linux' && deps.platform !== 'darwin')
+        return (0, serviceCommon_1.fail)(`Services are supported on Linux (systemd) and macOS (launchd), not on ${deps.platform}.`);
+    if (deps.uid !== serviceCommon_1.rootUid)
+        return (0, serviceCommon_1.fail)('This step is root\'s: it is started by the admin pairing line from /runners, which asks for sudo.');
+    const account = await deps.resolveAccount(accountName);
+    if (account === null)
+        return (0, serviceCommon_1.fail)(`There is no account named «${accountName}», or its home folder cannot be read from the directory service.`);
+    if (account.uid === serviceCommon_1.rootUid)
+        return (0, serviceCommon_1.fail)('The service must run as a standard account, not as root.');
+    return deps.platform === 'darwin' ? installDaemons(account, deps) : installUserServiceFor(account, deps);
+}
+//# sourceMappingURL=adminService.js.map

package/dist/runnerUtility/adminService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adminService.js","sourceRoot":"","sources":["../../src/runnerUtility/adminService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6DA,wDAWC;AAmDD,4DAOC;AAlID,uCAAyB;AACzB,uCAAyB;AACzB,2CAA6B;AAC7B,+DAA4F;AAC5F,mDAWyB;AACzB,6CAAkD;AAClD,iDAAsF;AAEtF;;;;;;;;;;;;;;GAcG;AAEH,gFAAgF;AAChF,MAAM,yBAAyB,GAAG,GAAG,GAAG,IAAI,CAAC;AAC7C,wHAAwH;AACxH,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,MAAM,uBAAuB,GAAG,EAAE,CAAC;AACnC,gIAAgI;AAChI,MAAM,sBAAsB,GAAsB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAC1E,MAAM,aAAa,GAAG,oGAAoG,CAAC;AAmB3H,SAAgB,sBAAsB;IACpC,OAAO;QACL,MAAM,EAAE,0BAAU;QAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,GAAG,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG;QACtB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;QACvC,gBAAgB,EAAE,wBAAwB;QAC1C,UAAU,EAAE,EAAE,CAAC,UAAU;QACzB,cAAc,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAA,iCAAiB,EAAC,IAAI,EAAE,0BAAU,CAAC,CAAC,CAAC,CAAC,IAAA,mCAAmB,EAAC,IAAI,EAAE,0BAAU,CAAC,CAAC;QACvI,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;KACtE,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,SAAS,aAAa,CAAC,OAAsB;IAC3C,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,OAAsB,EAAE,IAAsB;IAC1E,MAAM,KAAK,GAAG,IAAA,+BAAkB,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,CAAC,IAA2B,EAAY,EAAE,CAAC,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;IACxI,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,yBAAyB,EAAE,CAAC,CAAC;IAC1G,MAAM,MAAM,GAAG,IAAA,qCAAqB,EAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAA,oBAAI,EAAC,eAAe,OAAO,CAAC,IAAI,uCAAuC,IAAA,6BAAa,EAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,WAAW,IAAI,CAAC,CAAC;IAClJ,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAA,oBAAI,EAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAA,8BAAe,EAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,IAAA,8BAAe,EAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F,MAAM,MAAM,GAAG,MAAM,IAAA,kCAAkB,EAAC;QACtC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,IAAA,+BAAe,EAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,gBAAgB,CAAC;QAC3E,KAAK;QACL,IAAI,EAAE,WAAW;QACjB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,YAAY,EAAE,KAAK;QACnB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,kBAAkB,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,gCAAgB,EAAE,CAAC,CAAC,CAAC,CAAC;QACpH,SAAS,EAAE,aAAa;QACxB,MAAM,EAAE,iCAAkB;KAC3B,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAC9B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,gCAAgC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,aAAa,iBAAiB,OAAO,CAAC,IAAI,+BAA+B,CAAC,EAAE,CAAC;AACtK,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,OAAsB,EAAE,IAAsB;IACjF,MAAM,KAAK,GAAG,IAAA,+BAAkB,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,6BAA6B,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACjG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,gCAAgB,EAAE,CAAC,CAAC;IAC/G,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAA,oBAAI,EAAC,4BAA4B,OAAO,CAAC,IAAI,cAAc,IAAA,6BAAa,EAAC,MAAM,EAAE,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC;IAC7H,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,uBAAuB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACvE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,mBAAmB,CAAC,EAAE,EAAE,SAAS,EAAE,gCAAgB,EAAE,CAAC,CAAC;QACrI,IAAI,sBAAsB,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAAE,MAAM;QAChE,IAAI,OAAO,KAAK,uBAAuB;YAAE,OAAO,IAAA,oBAAI,EAAC,uBAAuB,OAAO,CAAC,IAAI,2BAA2B,CAAC,uBAAuB,GAAG,iBAAiB,CAAC,GAAG,IAAI,qCAAqC,CAAC,CAAC;QAC9M,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,yBAAyB,EAAE,CAAC,CAAC;IAC5I,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;IACpG,IAAI,SAAS,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC7C,OAAO,IAAA,oBAAI,EAAC,GAAG,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAA,6BAAa,EAAC,SAAS,CAAC,IAAI,4BAA4B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACnH,CAAC;AAED,4KAA4K;AACrK,KAAK,UAAU,wBAAwB,CAAC,WAAmB,EAAE,IAAsB;IACxF,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAA,oBAAI,EAAC,yEAAyE,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;IACpK,IAAI,IAAI,CAAC,GAAG,KAAK,uBAAO;QAAE,OAAO,IAAA,oBAAI,EAAC,mGAAmG,CAAC,CAAC;IAC3I,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;IACvD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAA,oBAAI,EAAC,8BAA8B,WAAW,kEAAkE,CAAC,CAAC;IAC/I,IAAI,OAAO,CAAC,GAAG,KAAK,uBAAO;QAAE,OAAO,IAAA,oBAAI,EAAC,0DAA0D,CAAC,CAAC;IACrG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAC3G,CAAC"}

package/dist/runnerUtility/appInstall.d.ts

@@ -0,0 +1,25 @@
+import { type RunnerHomePaths } from './runnerHome';
+/**
+ * @description Installing a copy of the hub's charness package for the runner to run, and switching to it. BUILTINS ONLY: the first
+ * `charness-runner pair` is started from a package that has no `node_modules` yet, and this is the step that makes them.
+ *
+ * An app lives in `app.<random id>/` and is never renamed or changed once it runs; `current` is a symlink that is replaced whole. The
+ * launcher (`launcher.ts`) starts whatever `current` points at, so an update is: install next to the old one, point `current` at it,
+ * exit with {@link restartExitCode}.
+ */
+/** The exit code that asks the launcher to start the app again (EX_TEMPFAIL) — after an update. */
+export declare const restartExitCode = 75;
+/** Test seam, set only by a flow's environment: the folder to link as `node_modules` instead of running `npm install` (no registry in a flow). */
+export declare const testNodeModulesEnvName = "CHARNESS_TEST_RUNNER_NODE_MODULES";
+export declare function createAppId(): string;
+/** Install the production dependencies of the package in `appDir`; scripts are not run (nothing the runner needs builds). Throws with npm's last words. */
+export declare function installDependencies(appDir: string, env?: NodeJS.ProcessEnv): void;
+/** @description Copy an unpacked package into a new app folder and install its dependencies; returns the folder. Removes it again if the install fails. */
+export declare function installAppFromDirectory(sourceDir: string, paths: RunnerHomePaths): string;
+/** @description Unpack a gzip tar archive (the hub's package) into a new app folder with the system `tar`, and install its dependencies. */
+export declare function installAppFromArchive(archivePath: string, paths: RunnerHomePaths): string;
+/** @description Point `current` at `appDir` in one atomic step. */
+export declare function switchCurrentApp(paths: RunnerHomePaths, appDir: string): void;
+/** @description Remove old app folders: all but the one `current` points at and the newest other one (the previous version, in case the new one must be rolled back by hand). */
+export declare function removeOldApps(paths: RunnerHomePaths): void;
+//# sourceMappingURL=appInstall.d.ts.map

package/dist/runnerUtility/appInstall.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appInstall.d.ts","sourceRoot":"","sources":["../../src/runnerUtility/appInstall.ts"],"names":[],"mappings":"AAGA,OAAO,EAAiB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAEnE;;;;;;;GAOG;AAEH,mGAAmG;AACnG,eAAO,MAAM,eAAe,KAAK,CAAC;AAOlC,kJAAkJ;AAClJ,eAAO,MAAM,sBAAsB,sCAAsC,CAAC;AAE1E,wBAAgB,WAAW,IAAI,MAAM,CAIpC;AAOD,2JAA2J;AAC3J,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,IAAI,CAiB9F;AAED,2JAA2J;AAC3J,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM,CAWzF;AAED,4IAA4I;AAC5I,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM,CAYzF;AAED,mEAAmE;AACnE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAK7E;AAED,iLAAiL;AACjL,wBAAgB,aAAa,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAa1D"}

package/dist/runnerUtility/appInstall.js

@@ -0,0 +1,147 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.testNodeModulesEnvName = exports.restartExitCode = void 0;
+exports.createAppId = createAppId;
+exports.installDependencies = installDependencies;
+exports.installAppFromDirectory = installAppFromDirectory;
+exports.installAppFromArchive = installAppFromArchive;
+exports.switchCurrentApp = switchCurrentApp;
+exports.removeOldApps = removeOldApps;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const runnerHome_1 = require("./runnerHome");
+/**
+ * @description Installing a copy of the hub's charness package for the runner to run, and switching to it. BUILTINS ONLY: the first
+ * `charness-runner pair` is started from a package that has no `node_modules` yet, and this is the step that makes them.
+ *
+ * An app lives in `app.<random id>/` and is never renamed or changed once it runs; `current` is a symlink that is replaced whole. The
+ * launcher (`launcher.ts`) starts whatever `current` points at, so an update is: install next to the old one, point `current` at it,
+ * exit with {@link restartExitCode}.
+ */
+/** The exit code that asks the launcher to start the app again (EX_TEMPFAIL) — after an update. */
+exports.restartExitCode = 75;
+const npmInstallTimeoutMs = 10 * 60 * 1000;
+const appsToKeep = 2;
+const appDirPattern = /^app\.[0-9a-f]+$/;
+const randomIdBytes = 6;
+const maxBufferBytes = 64 * 1024 * 1024;
+/** Test seam, set only by a flow's environment: the folder to link as `node_modules` instead of running `npm install` (no registry in a flow). */
+exports.testNodeModulesEnvName = 'CHARNESS_TEST_RUNNER_NODE_MODULES';
+function createAppId() {
+    let id = '';
+    for (let index = 0; index < randomIdBytes; index += 1)
+        id += Math.floor(Math.random() * 256).toString(16).padStart(2, '0');
+    return id;
+}
+function findNpm() {
+    const besideNode = path.join(path.dirname(process.execPath), 'npm');
+    return fs.existsSync(besideNode) ? besideNode : 'npm';
+}
+/** Install the production dependencies of the package in `appDir`; scripts are not run (nothing the runner needs builds). Throws with npm's last words. */
+function installDependencies(appDir, env = process.env) {
+    const linked = env[exports.testNodeModulesEnvName];
+    if (linked !== undefined && linked !== '') {
+        fs.symlinkSync(linked, path.join(appDir, 'node_modules'), 'dir');
+        return;
+    }
+    const result = (0, child_process_1.spawnSync)(findNpm(), ['install', '--omit=dev', '--ignore-scripts', '--no-audit', '--no-fund', '--no-progress'], {
+        cwd: appDir,
+        encoding: 'utf8',
+        timeout: npmInstallTimeoutMs,
+        maxBuffer: maxBufferBytes,
+        env,
+    });
+    if (result.error !== undefined || result.status !== 0) {
+        const detail = `${result.stderr ?? ''}`.trim().split('\n').slice(-3).join(' | ');
+        throw new Error(`npm install failed${result.error === undefined ? '' : ` (${result.error.message})`}${detail === '' ? '' : `: ${detail}`}`);
+    }
+}
+/** @description Copy an unpacked package into a new app folder and install its dependencies; returns the folder. Removes it again if the install fails. */
+function installAppFromDirectory(sourceDir, paths) {
+    const appDir = (0, runnerHome_1.getAppDirPath)(paths, createAppId());
+    fs.mkdirSync(paths.root, { recursive: true, mode: 0o700 });
+    fs.cpSync(sourceDir, appDir, { recursive: true });
+    try {
+        installDependencies(appDir);
+    }
+    catch (error) {
+        fs.rmSync(appDir, { recursive: true, force: true });
+        throw error;
+    }
+    return appDir;
+}
+/** @description Unpack a gzip tar archive (the hub's package) into a new app folder with the system `tar`, and install its dependencies. */
+function installAppFromArchive(archivePath, paths) {
+    const appDir = (0, runnerHome_1.getAppDirPath)(paths, createAppId());
+    fs.mkdirSync(appDir, { recursive: true, mode: 0o700 });
+    try {
+        const unpacked = (0, child_process_1.spawnSync)('tar', ['-xzf', archivePath, '-C', appDir], { encoding: 'utf8' });
+        if (unpacked.status !== 0)
+            throw new Error(`could not unpack the package (tar exit ${unpacked.status ?? 'none'})`);
+        installDependencies(appDir);
+    }
+    catch (error) {
+        fs.rmSync(appDir, { recursive: true, force: true });
+        throw error;
+    }
+    return appDir;
+}
+/** @description Point `current` at `appDir` in one atomic step. */
+function switchCurrentApp(paths, appDir) {
+    const temporaryLink = `${paths.currentApp}.${process.pid}.tmp`;
+    fs.rmSync(temporaryLink, { force: true });
+    fs.symlinkSync(appDir, temporaryLink, 'dir');
+    fs.renameSync(temporaryLink, paths.currentApp);
+}
+/** @description Remove old app folders: all but the one `current` points at and the newest other one (the previous version, in case the new one must be rolled back by hand). */
+function removeOldApps(paths) {
+    let currentTarget = null;
+    try {
+        currentTarget = fs.realpathSync(paths.currentApp);
+    }
+    catch {
+        currentTarget = null;
+    }
+    const apps = fs.readdirSync(paths.root)
+        .filter((name) => appDirPattern.test(name))
+        .map((name) => ({ name, dir: path.join(paths.root, name), modifiedAt: fs.statSync(path.join(paths.root, name)).mtimeMs }))
+        .filter((app) => currentTarget === null || fs.realpathSync(app.dir) !== currentTarget)
+        .sort((left, right) => right.modifiedAt - left.modifiedAt);
+    for (const app of apps.slice(appsToKeep - 1))
+        fs.rmSync(app.dir, { recursive: true, force: true });
+}
+//# sourceMappingURL=appInstall.js.map

package/dist/runnerUtility/appInstall.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appInstall.js","sourceRoot":"","sources":["../../src/runnerUtility/appInstall.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,kCAIC;AAQD,kDAiBC;AAGD,0DAWC;AAGD,sDAYC;AAGD,4CAKC;AAGD,sCAaC;AA3GD,iDAA0C;AAC1C,uCAAyB;AACzB,2CAA6B;AAC7B,6CAAmE;AAEnE;;;;;;;GAOG;AAEH,mGAAmG;AACtF,QAAA,eAAe,GAAG,EAAE,CAAC;AAClC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3C,MAAM,UAAU,GAAG,CAAC,CAAC;AACrB,MAAM,aAAa,GAAG,kBAAkB,CAAC;AACzC,MAAM,aAAa,GAAG,CAAC,CAAC;AACxB,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAExC,kJAAkJ;AACrI,QAAA,sBAAsB,GAAG,mCAAmC,CAAC;AAE1E,SAAgB,WAAW;IACzB,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,aAAa,EAAE,KAAK,IAAI,CAAC;QAAE,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3H,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,OAAO;IACd,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;IACpE,OAAO,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;AACxD,CAAC;AAED,2JAA2J;AAC3J,SAAgB,mBAAmB,CAAC,MAAc,EAAE,MAAyB,OAAO,CAAC,GAAG;IACtF,MAAM,MAAM,GAAG,GAAG,CAAC,8BAAsB,CAAC,CAAC;IAC3C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1C,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,yBAAS,EAAC,OAAO,EAAE,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,CAAC,EAAE;QAC7H,GAAG,EAAE,MAAM;QACX,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,mBAAmB;QAC5B,SAAS,EAAE,cAAc;QACzB,GAAG;KACJ,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9I,CAAC;AACH,CAAC;AAED,2JAA2J;AAC3J,SAAgB,uBAAuB,CAAC,SAAiB,EAAE,KAAsB;IAC/E,MAAM,MAAM,GAAG,IAAA,0BAAa,EAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACnD,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,4IAA4I;AAC5I,SAAgB,qBAAqB,CAAC,WAAmB,EAAE,KAAsB;IAC/E,MAAM,MAAM,GAAG,IAAA,0BAAa,EAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACnD,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAA,yBAAS,EAAC,KAAK,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7F,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,CAAC;QACnH,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mEAAmE;AACnE,SAAgB,gBAAgB,CAAC,KAAsB,EAAE,MAAc;IACrE,MAAM,aAAa,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IAC/D,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;IAC7C,EAAE,CAAC,UAAU,CAAC,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;AACjD,CAAC;AAED,iLAAiL;AACjL,SAAgB,aAAa,CAAC,KAAsB;IAClD,IAAI,aAAa,GAAkB,IAAI,CAAC;IACxC,IAAI,CAAC;QACH,aAAa,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,aAAa,GAAG,IAAI,CAAC;IACvB,CAAC;IACD,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC;SACpC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SAC1C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;SACzH,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,KAAK,IAAI,IAAI,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,aAAa,CAAC;SACrF,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7D,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC;QAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACrG,CAAC"}