farming-code 2.2.30 → 2.2.32

package/extensions/computer/backend/computer-resource-manager.cjs

@@ -0,0 +1,1219 @@
+// Generated by scripts/build-backend-runtime.ts. Do not edit.
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var computer_resource_manager_exports = {};
+__export(computer_resource_manager_exports, {
+  ComputerResourceManager: () => ComputerResourceManager,
+  exactImageRef: () => exactImageRef
+});
+module.exports = __toCommonJS(computer_resource_manager_exports);
+var storageLayout = __toESM(require("../../../backend/storage-layout.cjs"));
+var import_computer_constants = require("./computer-constants.cjs");
+var import_computer_resource_store = require("./computer-resource-store.cjs");
+const { EventEmitter } = require("events");
+const { execFile } = require("child_process");
+const { promisify } = require("util");
+const crypto = require("crypto");
+const fs = require("fs");
+const http = require("http");
+const path = require("path");
+const WebSocket = require("ws");
+const execFileAsync = promisify(execFile);
+const INACTIVE_AGENT_STATUSES = /* @__PURE__ */ new Set(["dead", "error", "exited", "stopped"]);
+const CUA_TOOL_MANIFEST = require("./cua-tools.json");
+const SUPPORTED_UPSTREAM_TOOLS = new Set(
+  (CUA_TOOL_MANIFEST.tools || []).map((tool) => String(tool.upstreamName || "").trim()).filter(Boolean)
+);
+const READ_ONLY_TOOLS = new Set(
+  (CUA_TOOL_MANIFEST.tools || []).filter((tool) => tool.annotations?.readOnlyHint === true).map((tool) => String(tool.upstreamName || "").trim()).filter(Boolean)
+);
+const STATE_OBSERVATION_TOOLS = /* @__PURE__ */ new Set([
+  "get_accessibility_tree",
+  "get_browser_state",
+  "get_desktop_state",
+  "get_window_state"
+]);
+const SCREENSHOT_TOOLS = /* @__PURE__ */ new Set([
+  "get_browser_state",
+  "get_desktop_state",
+  "get_window_state",
+  "zoom"
+]);
+const DRIVER_CALL_TIMEOUT_MS = 45e3;
+const DOCKER_TIMEOUT_MS = 9e4;
+const START_TIMEOUT_MS = 45e3;
+const COMPUTER_BROWSER_CDP_PORT = "9223/tcp";
+const COMPUTER_BROWSER_MOUNT = "/opt/farming/chromium";
+const COMPUTER_BROWSER_RELAY_SCRIPT = [
+  "import select,socket",
+  "listener=socket.socket()",
+  "listener.setsockopt(socket.SOL_SOCKET,socket.SO_REUSEADDR,1)",
+  'listener.bind(("0.0.0.0",9223))',
+  "listener.listen(32)",
+  "while True:",
+  " client,_=listener.accept()",
+  ' upstream=socket.create_connection(("127.0.0.1",9222),timeout=5)',
+  " sockets=[client,upstream]",
+  " while sockets:",
+  "  readable,_,failed=select.select(sockets,[],sockets,30)",
+  "  if failed: break",
+  "  if not readable: continue",
+  "  for source in readable:",
+  "   data=source.recv(65536)",
+  "   if not data: sockets=[]; break",
+  "   (upstream if source is client else client).sendall(data)",
+  " client.close()",
+  " upstream.close()"
+].join("\n");
+function recordValue(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function pathInside(root, candidate) {
+  const relative = path.relative(path.resolve(root), path.resolve(candidate));
+  return relative === "" || !relative.startsWith("..") && !path.isAbsolute(relative);
+}
+function computerError(message, status, code, extra = {}) {
+  return Object.assign(new Error(message), { status, code, ...extra });
+}
+function randomPassword() {
+  return crypto.randomBytes(9).toString("base64url").slice(0, 12);
+}
+function exactImageRef(value) {
+  const requested = String(value || "").trim() || import_computer_constants.COMPUTER_IMAGE;
+  if (!requested.endsWith(`@${import_computer_constants.COMPUTER_IMAGE_INDEX_DIGEST}`)) {
+    throw computerError(
+      `Computer image must be pinned to ${import_computer_constants.COMPUTER_IMAGE_INDEX_DIGEST}`,
+      400,
+      "COMPUTER_IMAGE_NOT_PINNED"
+    );
+  }
+  return requested;
+}
+function safeNamePart(value) {
+  return value.toLowerCase().replace(/[^a-z0-9_.-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 42);
+}
+function parsePort(inspect) {
+  return parsePublishedPort(inspect, "6901/tcp");
+}
+function parsePublishedPort(inspect, containerPort) {
+  const networkSettings = recordValue(inspect.NetworkSettings);
+  const ports = recordValue(networkSettings.Ports);
+  const mappings = ports[containerPort];
+  if (!Array.isArray(mappings) || mappings.length !== 1) return 0;
+  const mapping = recordValue(mappings[0]);
+  if (mapping.HostIp !== "127.0.0.1") return 0;
+  const port = Number(mapping.HostPort);
+  return Number.isSafeInteger(port) && port > 0 && port <= 65535 ? port : 0;
+}
+function waitForHttpPath(port, requestPath, failureMessage, failureCode, timeoutMs = START_TIMEOUT_MS) {
+  const deadline = Date.now() + timeoutMs;
+  return new Promise((resolve, reject) => {
+    const attempt = () => {
+      if (Date.now() >= deadline) {
+        reject(computerError(failureMessage, 504, failureCode));
+        return;
+      }
+      let successfulResponse = false;
+      let attemptFinished = false;
+      const retry = () => {
+        if (attemptFinished) return;
+        attemptFinished = true;
+        setTimeout(attempt, 250);
+      };
+      const request = http.get({
+        hostname: "127.0.0.1",
+        port,
+        path: requestPath,
+        timeout: 2e3,
+        agent: false,
+        headers: { Connection: "close" }
+      }, (response) => {
+        response.resume();
+        if (Number(response.statusCode) >= 200 && Number(response.statusCode) < 500) {
+          successfulResponse = true;
+          return;
+        }
+      });
+      request.on("timeout", () => request.destroy());
+      request.on("error", () => {
+        if (!successfulResponse) retry();
+      });
+      request.on("close", () => {
+        if (attemptFinished) return;
+        attemptFinished = true;
+        if (successfulResponse) resolve();
+        else setTimeout(attempt, 250);
+      });
+    };
+    attempt();
+  });
+}
+function waitForHttp(port, timeoutMs = START_TIMEOUT_MS) {
+  return waitForHttpPath(
+    port,
+    "/vnc.html",
+    "Computer Viewer did not become ready in time",
+    "COMPUTER_VIEWER_TIMEOUT",
+    timeoutMs
+  );
+}
+function waitForCdp(port, timeoutMs = START_TIMEOUT_MS) {
+  return waitForHttpPath(
+    port,
+    "/json/version",
+    "Computer Chromium did not expose DevTools in time",
+    "COMPUTER_BROWSER_CDP_TIMEOUT",
+    timeoutMs
+  );
+}
+class ComputerResourceManager extends EventEmitter {
+  configDir;
+  isEnabled;
+  getSettings;
+  store;
+  docker;
+  configFingerprint;
+  operations = /* @__PURE__ */ new Map();
+  stopAdmissions = /* @__PURE__ */ new Map();
+  controlAdmissions = /* @__PURE__ */ new Map();
+  viewerSockets = /* @__PURE__ */ new Map();
+  browserLeases = /* @__PURE__ */ new Map();
+  capabilityCache = null;
+  preparePromise = null;
+  constructor(options) {
+    super();
+    this.configDir = options.configDir;
+    this.isEnabled = options.isEnabled || (() => false);
+    this.getSettings = options.getSettings || (() => ({}));
+    this.store = new import_computer_resource_store.ComputerResourceStore(options.configDir);
+    this.configFingerprint = crypto.createHash("sha256").update(options.configDir).digest("hex").slice(0, 12);
+    this.docker = options.dockerRunner || (async (args, runOptions = {}) => {
+      const result = await execFileAsync("docker", args, {
+        encoding: "utf8",
+        timeout: runOptions.timeoutMs || DOCKER_TIMEOUT_MS,
+        maxBuffer: runOptions.maxBuffer || 20 * 1024 * 1024
+      });
+      return {
+        stdout: String(result.stdout || ""),
+        stderr: String(result.stderr || "")
+      };
+    });
+  }
+  async init() {
+    this.store.init();
+    for (const resource of this.store.list()) {
+      if (!resource.containerId) {
+        if (resource.status !== "stopped") {
+          this.patch(resource.id, {
+            status: "failed",
+            error: "Owned Computer container identity is missing",
+            viewerPort: 0,
+            sessionId: ""
+          });
+        }
+        continue;
+      }
+      try {
+        const inspect = await this.inspectOwnedContainer(resource);
+        const running = recordValue(inspect.State).Running === true;
+        if (!running) {
+          this.patch(resource.id, {
+            status: "stopped",
+            viewerPort: 0,
+            sessionId: "",
+            error: ""
+          });
+          continue;
+        }
+        const viewerPort = parsePort(inspect);
+        if (!viewerPort) throw new Error("Computer container has no loopback Viewer port");
+        await this.ensureDriver(resource, resource.sessionId || this.sessionId(resource));
+        this.patch(resource.id, {
+          status: "running",
+          viewerPort,
+          sessionId: resource.sessionId || this.sessionId(resource),
+          error: ""
+        });
+      } catch (caught) {
+        const error = caught;
+        this.patch(resource.id, {
+          status: "failed",
+          viewerPort: 0,
+          sessionId: "",
+          error: error.message || "Computer recovery failed"
+        });
+      }
+    }
+  }
+  requireEnabled() {
+    if (!this.isEnabled()) {
+      throw computerError("Computer plugin is disabled", 409, "COMPUTER_DISABLED");
+    }
+  }
+  imageRef() {
+    return exactImageRef(this.getSettings().computerImage);
+  }
+  compatibilityMode() {
+    return this.getSettings().computerCompatibilityMode === true;
+  }
+  list() {
+    return this.store.snapshot();
+  }
+  get(id) {
+    const resource = this.store.get(id);
+    if (!resource) throw computerError("Computer Resource was not found", 404, "COMPUTER_NOT_FOUND");
+    return (0, import_computer_resource_store.publicResource)(resource, this.store.revision);
+  }
+  privateResource(id) {
+    const resource = this.store.get(id);
+    if (!resource) throw computerError("Computer Resource was not found", 404, "COMPUTER_NOT_FOUND");
+    return resource;
+  }
+  create(input) {
+    this.requireEnabled();
+    const existing = this.store.list().find(
+      (resource2) => resource2.ownerAgentId === input.ownerAgentId
+    );
+    if (existing) return (0, import_computer_resource_store.publicResource)(existing, this.store.revision);
+    const resource = this.store.create(input);
+    this.emitResource(resource);
+    return (0, import_computer_resource_store.publicResource)(resource, this.store.revision);
+  }
+  async acquireBrowser(input) {
+    this.requireEnabled();
+    const executablePath = this.browserExecutableInContainer(input.executablePath);
+    this.ensureBrowserCacheTraversal(input.executablePath);
+    const resource = this.create({
+      ownerAgentId: input.ownerAgentId,
+      projectRootId: input.projectRootId,
+      workspace: input.workspace,
+      name: "Desktop"
+    });
+    if (resource.projectRootId !== input.projectRootId || resource.workspace !== input.workspace) {
+      throw computerError(
+        "The Agent Computer belongs to a different Project workspace",
+        409,
+        "COMPUTER_BROWSER_OWNER_MISMATCH"
+      );
+    }
+    await this.ensureBrowserCacheMount(resource.id);
+    await this.start(resource.id);
+    const result = await this.enqueue(resource.id, async () => {
+      const current = this.privateResource(resource.id);
+      if (current.status !== "running" || !current.containerId) {
+        throw computerError(
+          "Computer stopped before Chromium could start",
+          409,
+          "COMPUTER_NOT_RUNNING"
+        );
+      }
+      const inspect = await this.inspectOwnedContainer(current);
+      const cdpPort = parsePublishedPort(inspect, COMPUTER_BROWSER_CDP_PORT);
+      if (!cdpPort) {
+        throw computerError(
+          "Computer container has no loopback DevTools port",
+          409,
+          "COMPUTER_BROWSER_PORT_MISSING"
+        );
+      }
+      try {
+        await waitForCdp(cdpPort, 500);
+      } catch {
+        const displayReady = await this.waitForContainer(current.containerId, [
+          "test",
+          "-S",
+          "/tmp/.X11-unix/X1"
+        ]);
+        if (!displayReady) {
+          throw computerError(
+            "Computer desktop did not become ready for Chromium",
+            504,
+            "COMPUTER_BROWSER_DISPLAY_TIMEOUT"
+          );
+        }
+        let chromiumReady = await this.waitForContainer(current.containerId, [
+          "python3",
+          "-c",
+          'import urllib.request; urllib.request.urlopen("http://127.0.0.1:9222/json/version", timeout=1)'
+        ], 500);
+        if (!chromiumReady) {
+          await this.docker([
+            "exec",
+            "-d",
+            "-u",
+            import_computer_constants.COMPUTER_USER,
+            "-e",
+            "HOME=/home/cua",
+            "-e",
+            "DISPLAY=:1",
+            current.containerId,
+            executablePath,
+            "--no-sandbox",
+            "--remote-debugging-port=9222",
+            "--user-data-dir=/home/cua/.farming-browser",
+            "--no-first-run",
+            "--no-default-browser-check",
+            "about:blank"
+          ], { timeoutMs: 1e4 });
+          chromiumReady = await this.waitForContainer(current.containerId, [
+            "python3",
+            "-c",
+            'import urllib.request; urllib.request.urlopen("http://127.0.0.1:9222/json/version", timeout=1)'
+          ]);
+        }
+        if (!chromiumReady) {
+          throw computerError(
+            "Chromium did not expose its internal DevTools endpoint",
+            504,
+            "COMPUTER_BROWSER_CHROMIUM_TIMEOUT"
+          );
+        }
+        await this.docker([
+          "exec",
+          "-d",
+          current.containerId,
+          "python3",
+          "-c",
+          COMPUTER_BROWSER_RELAY_SCRIPT
+        ], { timeoutMs: 1e4 });
+        await waitForCdp(cdpPort);
+      }
+      this.browserLeases.set(
+        resource.id,
+        (this.browserLeases.get(resource.id) || 0) + 1
+      );
+      return { cdpUrl: `http://127.0.0.1:${cdpPort}`, leaseKey: resource.id };
+    });
+    return result;
+  }
+  releaseBrowser(leaseKey) {
+    const current = this.browserLeases.get(leaseKey) || 0;
+    if (current <= 1) this.browserLeases.delete(leaseKey);
+    else this.browserLeases.set(leaseKey, current - 1);
+    return Promise.resolve();
+  }
+  async verifyBrowserExecutable(executablePath) {
+    const containerPath = this.browserExecutableInContainer(executablePath);
+    this.ensureBrowserCacheTraversal(executablePath);
+    const result = await this.docker([
+      "run",
+      "--rm",
+      "--label",
+      "farming.dev/kind=computer-browser-probe",
+      "--label",
+      `farming.dev/config=${this.configFingerprint}`,
+      ...this.compatibilityMode() ? ["--security-opt", "seccomp=unconfined"] : [],
+      "--user",
+      import_computer_constants.COMPUTER_USER,
+      "-e",
+      "HOME=/home/cua",
+      "--entrypoint",
+      containerPath,
+      "-v",
+      `${this.browserCacheRoot()}:${COMPUTER_BROWSER_MOUNT}:ro`,
+      this.imageRef(),
+      "--no-sandbox",
+      "--version"
+    ], { timeoutMs: 3e4 });
+    const version = result.stdout.trim() || result.stderr.trim();
+    if (!/(?:Google Chrome|Chromium)/i.test(version)) {
+      throw computerError(
+        `Computer Chromium verification returned an unexpected version: ${version}`,
+        409,
+        "COMPUTER_BROWSER_VERSION_MISMATCH"
+      );
+    }
+    return version;
+  }
+  rename(id, name) {
+    const normalized = String(name || "").trim().slice(0, 120);
+    if (!normalized) throw computerError("Computer name is required", 400, "COMPUTER_NAME_REQUIRED");
+    return this.patch(id, { name: normalized });
+  }
+  snapshot() {
+    return this.stateSnapshot();
+  }
+  stateSnapshot() {
+    return this.store.snapshot();
+  }
+  async capability(refresh = false) {
+    if (this.capabilityCache && !refresh) {
+      return { ...this.capabilityCache, enabled: this.isEnabled() };
+    }
+    const probe = await this.probeSettings(this.getSettings());
+    this.capabilityCache = {
+      available: probe.dockerAvailable && probe.imageReady,
+      enabled: this.isEnabled(),
+      ...probe,
+      imageDigest: import_computer_constants.COMPUTER_IMAGE_INDEX_DIGEST,
+      driverVersion: import_computer_constants.COMPUTER_DRIVER_VERSION,
+      compatibilityMode: this.compatibilityMode()
+    };
+    return this.capabilityCache;
+  }
+  async probeSettings(settings) {
+    const image = exactImageRef(settings.computerImage);
+    let dockerAvailable = false;
+    let imageReady = false;
+    let error = "";
+    try {
+      await this.docker(["version", "--format", "{{.Server.Version}}"], { timeoutMs: 8e3 });
+      dockerAvailable = true;
+      await this.docker(["image", "inspect", image, "--format", "{{.Id}}"], { timeoutMs: 8e3 });
+      imageReady = true;
+    } catch (caught) {
+      error = caught.message || String(caught);
+    }
+    return { dockerAvailable, imageReady, image, error };
+  }
+  prepare() {
+    if (this.preparePromise) return this.preparePromise;
+    this.preparePromise = (async () => {
+      await this.docker(["version", "--format", "{{.Server.Version}}"], { timeoutMs: 8e3 });
+      await this.docker(["pull", this.imageRef()], { timeoutMs: 20 * 6e4, maxBuffer: 64 * 1024 * 1024 });
+      const probeName = `farming-computer-probe-${this.configFingerprint}-${crypto.randomBytes(3).toString("hex")}`;
+      const args = [
+        "run",
+        "--rm",
+        "--name",
+        probeName,
+        "--label",
+        "farming.dev/kind=computer-probe",
+        "--label",
+        `farming.dev/config=${this.configFingerprint}`,
+        ...this.compatibilityMode() ? ["--security-opt", "seccomp=unconfined"] : [],
+        "--entrypoint",
+        "/bin/sh",
+        this.imageRef(),
+        "-lc",
+        `su -s /bin/sh -c 'HOME=/home/cua ${import_computer_constants.COMPUTER_DRIVER_BIN} --version' ${import_computer_constants.COMPUTER_USER}`
+      ];
+      try {
+        const result = await this.docker(args, { timeoutMs: 6e4 });
+        if (!result.stdout.includes(import_computer_constants.COMPUTER_DRIVER_VERSION)) {
+          throw computerError(
+            `Computer image contains an unexpected Cua Driver version: ${result.stdout.trim()}`,
+            409,
+            "COMPUTER_DRIVER_VERSION_MISMATCH"
+          );
+        }
+      } catch (caught) {
+        const message = caught.message || String(caught);
+        const compatibilityRequired = /operation not permitted|pthread_create|clone3/i.test(
+          `${message}
+${caught.stderr || ""}`
+        );
+        throw computerError(
+          compatibilityRequired ? "This Docker Engine requires explicit Computer compatibility mode" : `Computer runtime probe failed: ${message}`,
+          409,
+          compatibilityRequired ? "COMPUTER_COMPATIBILITY_REQUIRED" : "COMPUTER_PROBE_FAILED",
+          { compatibilityRequired }
+        );
+      }
+      this.capabilityCache = null;
+      return this.capability(true);
+    })().finally(() => {
+      this.preparePromise = null;
+    });
+    return this.preparePromise;
+  }
+  start(id) {
+    this.requireEnabled();
+    this.assertTransitionAdmissionOpen(id);
+    return this.enqueue(id, async () => {
+      this.assertTransitionAdmissionOpen(id);
+      let resource = this.privateResource(id);
+      if (resource.status === "running") return (0, import_computer_resource_store.publicResource)(resource, this.store.revision);
+      const generation = resource.generation + 1;
+      const password = resource.vncPassword || randomPassword();
+      const containerName = resource.containerName || this.containerName(resource);
+      resource = this.patch(id, {
+        status: "starting",
+        generation,
+        controlOwner: "agent",
+        controlEpoch: resource.controlEpoch + 1,
+        needsObserve: false,
+        vncPassword: password,
+        containerName,
+        viewerPort: 0,
+        sessionId: "",
+        error: ""
+      }, true);
+      try {
+        let containerId = resource.containerId;
+        if (containerId) {
+          await this.inspectOwnedContainer(resource);
+        } else {
+          const labels = this.containerLabels(resource);
+          const create = await this.docker([
+            "create",
+            "--name",
+            containerName,
+            ...labels.flatMap(([key, value]) => ["--label", `${key}=${value}`]),
+            "--cpus",
+            import_computer_constants.COMPUTER_CONTAINER_CPUS,
+            "--memory",
+            import_computer_constants.COMPUTER_CONTAINER_MEMORY,
+            "--shm-size",
+            import_computer_constants.COMPUTER_CONTAINER_SHM_SIZE,
+            "--pids-limit",
+            import_computer_constants.COMPUTER_CONTAINER_PIDS,
+            "--add-host",
+            "host.docker.internal:host-gateway",
+            "-p",
+            "127.0.0.1::6901",
+            "-p",
+            "127.0.0.1::9223",
+            "-v",
+            `${this.browserCacheRoot()}:${COMPUTER_BROWSER_MOUNT}:ro`,
+            "-e",
+            `VNC_PW=${password}`,
+            ...this.compatibilityMode() ? ["--security-opt", "seccomp=unconfined"] : [],
+            this.imageRef()
+          ]);
+          containerId = create.stdout.trim();
+          if (!/^[a-f0-9]{12,64}$/i.test(containerId)) {
+            throw new Error("Docker did not return an exact Computer container identity");
+          }
+          resource = this.patch(id, { containerId }, true);
+          await this.inspectOwnedContainer(resource);
+        }
+        await this.docker(["start", containerId]);
+        const inspect = await this.inspectOwnedContainer(this.privateResource(id));
+        const viewerPort = parsePort(inspect);
+        if (!viewerPort) throw new Error("Docker did not publish the Computer Viewer on loopback");
+        await waitForHttp(viewerPort);
+        const sessionId = this.sessionId(this.privateResource(id));
+        await this.ensureDriver(this.privateResource(id), sessionId);
+        return this.patch(id, {
+          status: "running",
+          viewerPort,
+          sessionId,
+          error: ""
+        });
+      } catch (caught) {
+        const error = caught;
+        this.patch(id, {
+          status: "failed",
+          viewerPort: 0,
+          sessionId: "",
+          error: error.message || "Computer start failed"
+        });
+        throw error;
+      }
+    });
+  }
+  stop(id, internal = false) {
+    if (!internal) this.requireEnabled();
+    if (!internal && (this.browserLeases.get(id) || 0) > 0) {
+      throw computerError(
+        "Stop the Agent Browsers using this Computer first",
+        409,
+        "COMPUTER_IN_USE_BY_BROWSER"
+      );
+    }
+    this.holdStopAdmission(id);
+    return this.enqueue(id, async () => {
+      const resource = this.privateResource(id);
+      if (!resource.containerId || resource.status === "stopped") {
+        return this.patch(id, {
+          status: "stopped",
+          viewerPort: 0,
+          sessionId: "",
+          controlOwner: "agent",
+          needsObserve: false,
+          error: ""
+        });
+      }
+      this.patch(id, { status: "stopping" });
+      this.closeViewers(id, 4e3, "Computer stopped");
+      try {
+        if (resource.sessionId) {
+          await this.driverCall(resource, "end_session", { session: resource.sessionId }).catch(() => null);
+        }
+        await this.inspectOwnedContainer(resource);
+        await this.docker(["stop", "--time", "10", resource.containerId], { timeoutMs: 3e4 });
+        return this.patch(id, {
+          status: "stopped",
+          viewerPort: 0,
+          sessionId: "",
+          controlOwner: "agent",
+          controlEpoch: resource.controlEpoch + 1,
+          needsObserve: false,
+          error: ""
+        });
+      } catch (caught) {
+        const error = caught;
+        this.patch(id, { status: "failed", error: error.message || "Computer stop failed" });
+        throw error;
+      }
+    }).finally(() => this.releaseStopAdmission(id));
+  }
+  async delete(id, internal = false) {
+    if (!internal) this.requireEnabled();
+    if (!internal && (this.browserLeases.get(id) || 0) > 0) {
+      throw computerError(
+        "Delete the Agent Browsers using this Computer first",
+        409,
+        "COMPUTER_IN_USE_BY_BROWSER"
+      );
+    }
+    this.holdStopAdmission(id);
+    try {
+      await this.stop(id, true);
+      return await this.enqueue(id, async () => {
+        const resource = this.privateResource(id);
+        if (resource.containerId) {
+          await this.inspectOwnedContainer(resource);
+          await this.docker(["rm", resource.containerId], { timeoutMs: 3e4 });
+        }
+        this.closeViewers(id, 4e3, "Computer deleted");
+        this.browserLeases.delete(id);
+        this.store.remove(id);
+        this.emit("deleted", { id, collectionRevision: this.store.revision });
+        return { id, collectionRevision: this.store.revision };
+      });
+    } finally {
+      this.releaseStopAdmission(id);
+    }
+  }
+  takeControl(id, owner) {
+    this.requireEnabled();
+    const resource = this.privateResource(id);
+    if (resource.status !== "running") {
+      throw computerError("Computer is not running", 409, "COMPUTER_NOT_RUNNING");
+    }
+    if (owner === resource.controlOwner) {
+      return Promise.resolve((0, import_computer_resource_store.publicResource)(resource, this.store.revision));
+    }
+    if (this.isStopping(id)) {
+      throw computerError("Computer is stopping", 409, "COMPUTER_STOPPING");
+    }
+    if (this.isControlChanging(id)) {
+      throw computerError("Computer control is changing", 409, "COMPUTER_CONTROL_CHANGING");
+    }
+    this.holdControlAdmission(id);
+    return this.enqueue(id, async () => {
+      const current = this.privateResource(id);
+      if (current.status !== "running") {
+        throw computerError("Computer is not running", 409, "COMPUTER_NOT_RUNNING");
+      }
+      if (owner === current.controlOwner) {
+        return (0, import_computer_resource_store.publicResource)(current, this.store.revision);
+      }
+      this.closeViewers(id, 4002, "Computer control changed");
+      return this.patch(id, {
+        controlOwner: owner,
+        controlEpoch: current.controlEpoch + 1,
+        needsObserve: owner === "agent"
+      });
+    }).finally(() => this.releaseControlAdmission(id));
+  }
+  callTool(id, tool, input, caller = "agent") {
+    this.requireEnabled();
+    if (!SUPPORTED_UPSTREAM_TOOLS.has(tool)) {
+      throw computerError(`Computer tool is not supported: ${tool}`, 400, "COMPUTER_TOOL_NOT_SUPPORTED");
+    }
+    const resource = this.privateResource(id);
+    if (this.isStopping(id)) {
+      throw computerError("Computer is stopping", 409, "COMPUTER_STOPPING");
+    }
+    if (this.isControlChanging(id)) {
+      throw computerError("Computer control is changing", 409, "COMPUTER_CONTROL_CHANGING");
+    }
+    if (resource.status !== "running") {
+      throw computerError("Computer is not running", 409, "COMPUTER_NOT_RUNNING");
+    }
+    if (resource.controlOwner !== caller) {
+      throw computerError(
+        caller === "agent" ? "A human currently controls this Computer" : "The Agent currently controls this Computer",
+        409,
+        "COMPUTER_CONTROL_OWNER_MISMATCH"
+      );
+    }
+    if (caller === "agent" && resource.needsObserve && !READ_ONLY_TOOLS.has(tool)) {
+      throw computerError(
+        "Observe the Computer after human control before sending another action",
+        409,
+        "COMPUTER_OBSERVE_REQUIRED"
+      );
+    }
+    const admittedGeneration = resource.generation;
+    const admittedEpoch = resource.controlEpoch;
+    return this.enqueue(id, async () => {
+      const current = this.privateResource(id);
+      if (current.generation !== admittedGeneration || current.controlEpoch !== admittedEpoch || current.status !== "running" || current.controlOwner !== caller) {
+        throw computerError("Computer ownership changed before this action ran", 409, "COMPUTER_STALE_ADMISSION");
+      }
+      const args = { ...input };
+      if ("session" in args || this.toolAcceptsSession(tool)) args.session = current.sessionId;
+      if (tool === "start_session") {
+        return { content: [{ type: "text", text: `Farming manages session ${current.sessionId}` }] };
+      }
+      if (tool === "end_session") {
+        return { content: [{ type: "text", text: "Farming keeps this Computer session alive until Stop." }] };
+      }
+      const screenshotPath = SCREENSHOT_TOOLS.has(tool) ? `/tmp/farming-${current.id}-${crypto.randomBytes(5).toString("hex")}.png` : "";
+      let result;
+      try {
+        result = await this.driverCall(current, tool, args, screenshotPath);
+      } catch (caught) {
+        const error = caught;
+        if (error.killed || error.signal || /timed out/i.test(error.message || "")) {
+          this.patch(id, { needsObserve: true, error: `Uncertain ${tool} outcome; observe before retrying` });
+          throw computerError(
+            `Computer action ${tool} timed out with an uncertain outcome; observe before retrying`,
+            504,
+            "COMPUTER_ACTION_UNCERTAIN",
+            { uncertain: true }
+          );
+        }
+        throw error;
+      }
+      const latest = this.privateResource(id);
+      if (caller === "agent" && STATE_OBSERVATION_TOOLS.has(tool) && latest.needsObserve) {
+        this.patch(id, { needsObserve: false, error: "" });
+      }
+      return result;
+    });
+  }
+  async reconcileAgentLifecycle(agentStates) {
+    const agents = new Map(agentStates.map((agent) => [String(agent.id || ""), agent]));
+    for (const resource of this.store.list()) {
+      const owner = agents.get(resource.ownerAgentId);
+      if (!owner) {
+        await this.delete(resource.id, true);
+        continue;
+      }
+      const operation = String(owner.lifecycleOperation?.type || "");
+      const preservesRuntime = ["permission-restart", "runtime-switch"].includes(operation);
+      const stopped = owner.archived === true || !preservesRuntime && INACTIVE_AGENT_STATUSES.has(String(owner.status || ""));
+      if (stopped && resource.status !== "stopped") {
+        await this.stop(resource.id, true);
+      }
+    }
+  }
+  async stopAll() {
+    for (const resource of this.store.list()) {
+      if (resource.status !== "stopped" || resource.containerId) {
+        await this.stop(resource.id, true);
+      }
+    }
+  }
+  async resetAllContainers() {
+    for (const candidate of this.store.list()) {
+      this.holdStopAdmission(candidate.id);
+      try {
+        await this.stop(candidate.id, true);
+        await this.enqueue(candidate.id, async () => {
+          const resource = this.privateResource(candidate.id);
+          if (resource.containerId) {
+            await this.inspectOwnedContainer(resource);
+            await this.docker(["rm", resource.containerId], { timeoutMs: 3e4 });
+          }
+          this.patch(resource.id, {
+            containerId: "",
+            containerName: "",
+            vncPassword: "",
+            viewerPort: 0,
+            sessionId: "",
+            status: "stopped",
+            error: ""
+          });
+        });
+      } finally {
+        this.releaseStopAdmission(candidate.id);
+      }
+    }
+  }
+  viewerConfig(id) {
+    const resource = this.privateResource(id);
+    if (resource.status !== "running" || !resource.viewerPort) {
+      throw computerError("Computer Viewer is not running", 409, "COMPUTER_NOT_RUNNING");
+    }
+    return {
+      host: "127.0.0.1",
+      port: resource.viewerPort,
+      password: resource.vncPassword,
+      viewOnly: resource.controlOwner !== "human",
+      generation: resource.generation,
+      controlEpoch: resource.controlEpoch
+    };
+  }
+  attachViewer(id, client) {
+    const config = this.viewerConfig(id);
+    const upstream = new WebSocket(`ws://127.0.0.1:${config.port}/websockify`);
+    const sockets = this.viewerSockets.get(id) || /* @__PURE__ */ new Set();
+    sockets.add(client);
+    this.viewerSockets.set(id, sockets);
+    const close = () => {
+      sockets.delete(client);
+      if (sockets.size === 0) this.viewerSockets.delete(id);
+      if (upstream.readyState === WebSocket.OPEN || upstream.readyState === WebSocket.CONNECTING) {
+        upstream.close();
+      }
+    };
+    upstream.on("message", (data, isBinary) => {
+      if (client.readyState === WebSocket.OPEN) client.send(data, { binary: isBinary });
+    });
+    client.on("message", (data, isBinary) => {
+      const latest = this.privateResource(id);
+      if (latest.generation !== config.generation || latest.controlEpoch !== config.controlEpoch) {
+        client.close(4003, "Computer Viewer is stale");
+        return;
+      }
+      if (upstream.readyState === WebSocket.OPEN) upstream.send(data, { binary: isBinary });
+    });
+    upstream.on("close", () => client.close(4e3, "Computer Viewer closed"));
+    upstream.on("error", () => client.close(4005, "Computer Viewer failed"));
+    client.on("close", close);
+    client.on("error", close);
+  }
+  closeViewers(id, code, reason) {
+    const sockets = this.viewerSockets.get(id);
+    if (!sockets) return;
+    this.viewerSockets.delete(id);
+    for (const socket of sockets) socket.close(code, reason);
+  }
+  containerName(resource) {
+    return safeNamePart(`farming-computer-${this.configFingerprint}-${resource.id.slice(-12)}`);
+  }
+  containerLabels(resource) {
+    return [
+      ["farming.dev/kind", "computer"],
+      ["farming.dev/config", this.configFingerprint],
+      ["farming.dev/resource", resource.id],
+      ["farming.dev/owner-agent", resource.ownerAgentId],
+      ["farming.dev/image-digest", import_computer_constants.COMPUTER_IMAGE_INDEX_DIGEST]
+    ];
+  }
+  browserCacheRoot() {
+    const root = storageLayout.managedChromiumRootDir(this.configDir);
+    fs.mkdirSync(root, { recursive: true, mode: 448 });
+    return root;
+  }
+  hasBrowserRuntimeWiring(inspect) {
+    const mounts = Array.isArray(inspect.Mounts) ? inspect.Mounts : [];
+    return mounts.some(
+      (mount) => recordValue(mount).Destination === COMPUTER_BROWSER_MOUNT && recordValue(mount).RW === false
+    ) && Boolean(recordValue(recordValue(inspect.HostConfig).PortBindings)[COMPUTER_BROWSER_CDP_PORT]);
+  }
+  async ensureBrowserCacheMount(id) {
+    const resource = this.privateResource(id);
+    if (!resource.containerId) return;
+    const inspect = await this.inspectOwnedContainer(resource);
+    if (this.hasBrowserRuntimeWiring(inspect)) return;
+    await this.resetContainer(id);
+  }
+  async resetContainer(id) {
+    await this.stop(id, true);
+    this.holdStopAdmission(id);
+    try {
+      await this.enqueue(id, async () => {
+        const resource = this.privateResource(id);
+        if (resource.containerId) {
+          await this.inspectOwnedContainer(resource);
+          await this.docker(["rm", resource.containerId], { timeoutMs: 3e4 });
+        }
+        this.patch(resource.id, {
+          containerId: "",
+          containerName: "",
+          vncPassword: "",
+          viewerPort: 0,
+          sessionId: "",
+          status: "stopped",
+          error: ""
+        });
+      });
+    } finally {
+      this.releaseStopAdmission(id);
+    }
+  }
+  browserExecutableInContainer(executablePath) {
+    const root = this.browserCacheRoot();
+    const resolved = path.resolve(String(executablePath || "").trim());
+    const relative = path.relative(root, resolved);
+    if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) {
+      throw computerError(
+        "Computer Chromium must come from Farming managed runtime storage",
+        400,
+        "COMPUTER_BROWSER_EXECUTABLE_INVALID"
+      );
+    }
+    return `${COMPUTER_BROWSER_MOUNT}/${relative.split(path.sep).join("/")}`;
+  }
+  ensureBrowserCacheTraversal(executablePath) {
+    const root = path.resolve(this.browserCacheRoot());
+    let current = path.dirname(path.resolve(String(executablePath || "").trim()));
+    while (current === root || pathInside(root, current)) {
+      const mode = fs.statSync(current).mode & 511;
+      if ((mode & 9) !== 9) fs.chmodSync(current, mode | 9);
+      if (current === root) return;
+      current = path.dirname(current);
+    }
+    throw computerError(
+      "Computer Chromium must come from Farming managed runtime storage",
+      400,
+      "COMPUTER_BROWSER_EXECUTABLE_INVALID"
+    );
+  }
+  async waitForContainer(containerId, command, timeoutMs = START_TIMEOUT_MS) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+      try {
+        await this.docker(["exec", containerId, ...command], { timeoutMs: 3e3 });
+        return true;
+      } catch {
+        await new Promise((resolve) => setTimeout(resolve, 250));
+      }
+    }
+    return false;
+  }
+  async inspectOwnedContainer(resource) {
+    if (!resource.containerId) {
+      throw computerError("Computer container identity is missing", 409, "COMPUTER_CONTAINER_IDENTITY_MISSING");
+    }
+    const result = await this.docker(["inspect", resource.containerId], { timeoutMs: 1e4 });
+    const parsed = JSON.parse(result.stdout);
+    const inspect = Array.isArray(parsed) ? recordValue(parsed[0]) : {};
+    if (!inspect.Id || String(inspect.Id) !== resource.containerId) {
+      throw computerError("Docker returned a different Computer container identity", 409, "COMPUTER_CONTAINER_MISMATCH");
+    }
+    const labels = recordValue(recordValue(inspect.Config).Labels);
+    for (const [key, value] of this.containerLabels(resource)) {
+      if (labels[key] !== value) {
+        throw computerError(`Computer container ownership label mismatch: ${key}`, 409, "COMPUTER_CONTAINER_OWNER_MISMATCH");
+      }
+    }
+    return inspect;
+  }
+  sessionId(resource) {
+    return `${resource.id}-g${resource.generation}`;
+  }
+  async ensureDriver(resource, sessionId) {
+    await this.docker([
+      "exec",
+      "-u",
+      import_computer_constants.COMPUTER_USER,
+      "-e",
+      "HOME=/home/cua",
+      resource.containerId,
+      import_computer_constants.COMPUTER_DRIVER_BIN,
+      "telemetry",
+      "disable"
+    ], { timeoutMs: 1e4 }).catch(() => null);
+    await this.docker([
+      "exec",
+      "-d",
+      "-u",
+      import_computer_constants.COMPUTER_USER,
+      "-e",
+      "HOME=/home/cua",
+      "-e",
+      "DISPLAY=:1",
+      resource.containerId,
+      import_computer_constants.COMPUTER_DRIVER_BIN,
+      "serve",
+      "--dangerously-bypass-approvals"
+    ], { timeoutMs: 1e4 }).catch(() => null);
+    const deadline = Date.now() + START_TIMEOUT_MS;
+    let lastError = null;
+    while (Date.now() < deadline) {
+      try {
+        const version = await this.docker([
+          "exec",
+          "-u",
+          import_computer_constants.COMPUTER_USER,
+          "-e",
+          "HOME=/home/cua",
+          "-e",
+          "DISPLAY=:1",
+          resource.containerId,
+          import_computer_constants.COMPUTER_DRIVER_BIN,
+          "--version"
+        ], { timeoutMs: 5e3 });
+        if (!version.stdout.includes(import_computer_constants.COMPUTER_DRIVER_VERSION)) {
+          throw new Error(`Expected Cua Driver ${import_computer_constants.COMPUTER_DRIVER_VERSION}, got ${version.stdout.trim()}`);
+        }
+        await this.driverCall(resource, "start_session", {
+          session: sessionId,
+          capture_scope: "desktop"
+        });
+        return;
+      } catch (caught) {
+        lastError = caught;
+        await new Promise((resolve) => setTimeout(resolve, 300));
+      }
+    }
+    throw lastError || new Error("Cua Driver did not become ready");
+  }
+  async driverCall(resource, tool, input, screenshotPath = "") {
+    const args = [
+      "exec",
+      "-u",
+      import_computer_constants.COMPUTER_USER,
+      "-e",
+      "HOME=/home/cua",
+      "-e",
+      "DISPLAY=:1",
+      resource.containerId,
+      import_computer_constants.COMPUTER_DRIVER_BIN,
+      "call",
+      tool,
+      JSON.stringify(input),
+      ...screenshotPath ? ["--screenshot-out-file", screenshotPath] : []
+    ];
+    const result = await this.docker(args, {
+      timeoutMs: DRIVER_CALL_TIMEOUT_MS,
+      maxBuffer: 32 * 1024 * 1024
+    });
+    let structuredContent;
+    const text = result.stdout.trim();
+    try {
+      structuredContent = JSON.parse(text);
+    } catch {
+      structuredContent = void 0;
+    }
+    const content = [{
+      type: "text",
+      text: text || result.stderr.trim() || `${tool} completed`
+    }];
+    if (screenshotPath) {
+      try {
+        await this.docker([
+          "exec",
+          "-u",
+          import_computer_constants.COMPUTER_USER,
+          resource.containerId,
+          "test",
+          "-s",
+          screenshotPath
+        ], { timeoutMs: 5e3 });
+        const image = await this.docker([
+          "exec",
+          "-u",
+          import_computer_constants.COMPUTER_USER,
+          resource.containerId,
+          "base64",
+          "-w",
+          "0",
+          screenshotPath
+        ], { timeoutMs: 1e4, maxBuffer: 24 * 1024 * 1024 });
+        if (image.stdout.trim()) content.push({
+          type: "image",
+          data: image.stdout.trim(),
+          mimeType: "image/png"
+        });
+      } catch {
+      } finally {
+        await this.docker([
+          "exec",
+          "-u",
+          import_computer_constants.COMPUTER_USER,
+          resource.containerId,
+          "rm",
+          "-f",
+          screenshotPath
+        ], { timeoutMs: 5e3 }).catch(() => null);
+      }
+    }
+    return {
+      content,
+      ...structuredContent === void 0 ? {} : { structuredContent }
+    };
+  }
+  toolAcceptsSession(tool) {
+    return ![
+      "check_for_update",
+      "check_permissions",
+      "get_config",
+      "health_report",
+      "install_ffmpeg",
+      "list_apps",
+      "list_windows",
+      "set_config",
+      "start_recording",
+      "stop_recording",
+      "get_recording_state",
+      "replay_trajectory"
+    ].includes(tool);
+  }
+  holdStopAdmission(id) {
+    this.stopAdmissions.set(id, (this.stopAdmissions.get(id) || 0) + 1);
+  }
+  releaseStopAdmission(id) {
+    const next = (this.stopAdmissions.get(id) || 1) - 1;
+    if (next <= 0) this.stopAdmissions.delete(id);
+    else this.stopAdmissions.set(id, next);
+  }
+  isStopping(id) {
+    return (this.stopAdmissions.get(id) || 0) > 0;
+  }
+  holdControlAdmission(id) {
+    this.controlAdmissions.set(id, (this.controlAdmissions.get(id) || 0) + 1);
+  }
+  releaseControlAdmission(id) {
+    const next = (this.controlAdmissions.get(id) || 1) - 1;
+    if (next <= 0) this.controlAdmissions.delete(id);
+    else this.controlAdmissions.set(id, next);
+  }
+  isControlChanging(id) {
+    return (this.controlAdmissions.get(id) || 0) > 0;
+  }
+  assertTransitionAdmissionOpen(id) {
+    if (this.isStopping(id)) {
+      throw computerError("Computer is stopping", 409, "COMPUTER_STOPPING");
+    }
+    if (this.isControlChanging(id)) {
+      throw computerError("Computer control is changing", 409, "COMPUTER_CONTROL_CHANGING");
+    }
+  }
+  enqueue(id, action) {
+    const previous = this.operations.get(id) || Promise.resolve();
+    const next = previous.catch(() => null).then(action);
+    this.operations.set(id, next);
+    return next.finally(() => {
+      if (this.operations.get(id) === next) this.operations.delete(id);
+    });
+  }
+  patch(id, patch, privateResult = false) {
+    const resource = this.store.patch(id, patch);
+    this.emitResource(resource);
+    return privateResult ? resource : (0, import_computer_resource_store.publicResource)(resource, this.store.revision);
+  }
+  emitResource(resource) {
+    this.emit("resource", (0, import_computer_resource_store.publicResource)(resource, this.store.revision));
+    this.emit("resources", this.store.snapshot());
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ComputerResourceManager,
+  exactImageRef
+});