humanish 0.96.1 → 0.98.0

package/dist/guest-runtime-desktop.js

@@ -0,0 +1,231 @@
+import { spawn } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
+import { constants } from "node:fs";
+import { lstat, mkdir, open, rm } from "node:fs/promises";
+import { setTimeout as delay } from "node:timers/promises";
+import { chromium } from "playwright-core";
+import { createGuestDesktopNativeTools } from "./guest-desktop-native.js";
+import { createGuestChromiumText } from "./guest-chromium-text.js";
+import { createGuestBrowserTools } from "./guest-browser-tools.js";
+import { createGuestDesktopExecutor } from "./guest-desktop-executor.js";
+import { CuaExecutorError } from "./cua-executor-error.js";
+export const GUEST_RUNTIME_PATHS = Object.freeze({ root: "/opt/humanish/control", run: "/run/humanish", home: "/home/humanish" });
+export const GUEST_RUNTIME_ENV = Object.freeze({ PATH: "/usr/bin:/bin", HOME: "/home/humanish", USER: "humanish", LOGNAME: "humanish",
+    LANG: "C.UTF-8", LC_ALL: "C.UTF-8", DISPLAY: ":0", XAUTHORITY: "/run/humanish/Xauthority",
+    XDG_RUNTIME_DIR: "/run/humanish/xdg", XDG_CACHE_HOME: "/home/humanish/.cache", XDG_CONFIG_HOME: "/home/humanish/.config", TMPDIR: "/tmp" });
+const bad = () => new CuaExecutorError("execution_failed", "not_dispatched");
+const CONFIG_SHA = "4ae1c52eab748a3624b3948ce792647be258caba70c8c72038b9a43be6459552";
+/** Fixed guest layout. No caller paths, environment, command, page selector or URL. */
+export async function createGuestRuntimeDesktop(options) {
+    const controller = new AbortController();
+    const signal = AbortSignal.any([options.signal, controller.signal]);
+    const children = [];
+    let context;
+    let pendingContext;
+    let content;
+    let closing;
+    let stopping = false;
+    let phase = "layout";
+    const progress = (next) => { phase = next; options.onPhase?.(next); };
+    function check() { if (signal.aborted || stopping)
+        throw bad(); }
+    function child(binary, args, input, persistent = false) {
+        check();
+        const process = spawn(binary, args, { env: GUEST_RUNTIME_ENV, cwd: GUEST_RUNTIME_PATHS.home, stdio: ["pipe", "ignore", "pipe"] });
+        let finish;
+        const record = { child: process, closed: new Promise(resolve => { finish = resolve; }), exited: false };
+        children.push(record);
+        const done = new Promise((resolve, reject) => {
+            let count = 0, failed = false;
+            const fail = () => {
+                failed = true;
+                if (!record.exited)
+                    process.kill("SIGKILL");
+                if (persistent && !stopping)
+                    options.onTerminal();
+            };
+            const timer = persistent ? undefined : setTimeout(fail, 2000);
+            // Fixed helpers communicate success through exit status. In particular,
+            // xdpyinfo's normal display inventory is large and is not an error log.
+            const consume = (data) => {
+                count += data.length;
+                if (count > 16_384)
+                    fail();
+            };
+            process.stderr.on("data", consume);
+            process.on("error", fail);
+            process.stdin.on("error", fail);
+            process.once("exit", () => { record.exited = true; if (persistent && !stopping)
+                options.onTerminal(); });
+            process.once("close", code => {
+                record.exited = true;
+                clearTimeout(timer);
+                signal.removeEventListener("abort", fail);
+                finish();
+                if (persistent && !stopping)
+                    options.onTerminal();
+                if (failed || code !== 0)
+                    reject(bad());
+                else
+                    resolve();
+            });
+            signal.addEventListener("abort", fail, { once: true });
+            process.stdin.end(input);
+            if (signal.aborted)
+                fail();
+        });
+        void done.catch(() => { });
+        return { done, child: process };
+    }
+    function close() {
+        if (closing)
+            return closing;
+        stopping = true;
+        closing = Promise.resolve().then(async () => {
+            let complete = true, timer;
+            const work = async () => {
+                try {
+                    await content?.close();
+                }
+                catch {
+                    complete = false;
+                }
+                try {
+                    const browser = context ?? await pendingContext?.catch(() => undefined);
+                    if (browser)
+                        await browser.close();
+                }
+                catch {
+                    complete = false;
+                }
+                for (const record of children)
+                    if (!record.exited)
+                        record.child.kill("SIGKILL");
+                await Promise.all(children.map(record => record.closed));
+            };
+            try {
+                await Promise.race([work(), new Promise(resolve => { timer = setTimeout(() => { complete = false; resolve(); }, 4000); })]);
+            }
+            finally {
+                clearTimeout(timer);
+                for (const record of children)
+                    if (!record.exited) {
+                        complete = false;
+                        record.child.kill("SIGKILL");
+                    }
+                options.signal.removeEventListener("abort", abort);
+            }
+            return { complete };
+        });
+        controller.abort();
+        return closing;
+    }
+    const abort = () => { void close(); };
+    options.signal.addEventListener("abort", abort, { once: true });
+    try {
+        progress("layout");
+        check();
+        if (process.getuid?.() !== 1000 || process.getgid?.() !== 1000)
+            throw bad();
+        for (const path of [GUEST_RUNTIME_PATHS.run, GUEST_RUNTIME_PATHS.home]) {
+            const stat = await lstat(path);
+            check();
+            if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== 1000 || stat.gid !== 1000 || (stat.mode & 0o777) !== 0o700)
+                throw bad();
+        }
+        const configuration = await open(`${GUEST_RUNTIME_PATHS.root}/openbox.xml`, constants.O_RDONLY | constants.O_NOFOLLOW);
+        let config;
+        try {
+            const stat = await configuration.stat();
+            if (!stat.isFile() || stat.uid !== 0 || stat.gid !== 0 || stat.nlink !== 1 || stat.size > 4096 || (stat.mode & 0o777) !== 0o444)
+                throw bad();
+            config = await configuration.readFile();
+        }
+        finally {
+            await configuration.close();
+        }
+        if (createHash("sha256").update(config).digest("hex") !== CONFIG_SHA)
+            throw bad();
+        for (const path of [`${GUEST_RUNTIME_PATHS.run}/xdg`, `${GUEST_RUNTIME_PATHS.run}/capture`, `${GUEST_RUNTIME_PATHS.home}/.cache`, `${GUEST_RUNTIME_PATHS.home}/.config`]) {
+            check();
+            await mkdir(path, { mode: 0o700 });
+        }
+        progress("xauthority");
+        const auth = await open(GUEST_RUNTIME_ENV.XAUTHORITY, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW, 0o600);
+        await auth.close();
+        check();
+        await child("/usr/bin/xauth", ["-f", GUEST_RUNTIME_ENV.XAUTHORITY, "source", "-"], `add :0 . ${randomBytes(16).toString("hex")}\n`).done;
+        check();
+        progress("display");
+        child("/usr/bin/Xvfb", [":0", "-screen", "0", "960x720x24", "-nolisten", "tcp", "-auth", GUEST_RUNTIME_ENV.XAUTHORITY], undefined, true);
+        let displayReady = false;
+        for (let attempt = 0; attempt < 100; attempt++) {
+            check();
+            try {
+                await child("/usr/bin/xdpyinfo", []).done;
+                displayReady = true;
+                break;
+            }
+            catch {
+                await delay(50, undefined, { signal });
+            }
+        }
+        if (!displayReady)
+            throw bad();
+        progress("window_manager");
+        child("/usr/bin/openbox", ["--config-file", `${GUEST_RUNTIME_PATHS.root}/openbox.xml`], undefined, true);
+        check();
+        progress("browser");
+        pendingContext = chromium.launchPersistentContext(`${GUEST_RUNTIME_PATHS.home}/browser`, { executablePath: "/usr/bin/chromium",
+            headless: false, chromiumSandbox: true, viewport: null, env: GUEST_RUNTIME_ENV, timeout: 25_000,
+            args: ["--window-size=960,680", "--window-position=0,20", "--disable-background-networking", "--disable-component-update", "--no-first-run"] });
+        void pendingContext.then(browser => { if (stopping)
+            void browser.close().catch(() => { }); }, () => { });
+        context = await pendingContext;
+        check();
+        context.setDefaultTimeout(5000);
+        context.setDefaultNavigationTimeout(5000);
+        const page = context.pages()[0];
+        if (!page || context.pages().length !== 1)
+            throw bad();
+        progress("sandbox");
+        const diagnostic = await context.newPage();
+        check();
+        await diagnostic.goto("chrome://sandbox");
+        check();
+        const sandboxReport = await diagnostic.locator("body").innerText();
+        if (!["PID namespaces", "Network namespaces", "Seccomp-BPF sandbox"].every(label => new RegExp(label + "\\s+Yes").test(sandboxReport))
+            || !sandboxReport.includes("You are adequately sandboxed"))
+            throw bad();
+        await diagnostic.close();
+        check();
+        await page.bringToFront();
+        check();
+        progress("focus");
+        const native = createGuestDesktopNativeTools({ display: ":0", temporaryDirectory: `${GUEST_RUNTIME_PATHS.run}/capture`, xauthority: GUEST_RUNTIME_ENV.XAUTHORITY });
+        const window = await native.activeWindowId(signal);
+        check();
+        content = createGuestChromiumText({ context, page, assertFocusedWindow: async (actionSignal) => {
+                if (await native.activeWindowId(actionSignal) !== window)
+                    throw new CuaExecutorError("action_rejected", "not_dispatched");
+            } });
+        const tools = createGuestBrowserTools(native, content);
+        const executor = createGuestDesktopExecutor({ width: 960, height: 720, tools, authoritySignal: signal, onTerminal: options.onTerminal });
+        progress("fixture");
+        await page.goto(`file://${GUEST_RUNTIME_PATHS.root}/neutral.html`);
+        check();
+        await page.locator("#note").waitFor();
+        check();
+        return { executor, close, owner: { context, page, sandboxReport, configSha256: CONFIG_SHA } };
+    }
+    catch {
+        await close();
+        throw Object.assign(bad(), { phase });
+    }
+    finally {
+        // The fresh private state belongs to the guest owner. No recursive home removal.
+        if (stopping && children.every(record => record.exited))
+            await rm(`${GUEST_RUNTIME_PATHS.run}/capture`, { recursive: true, force: true }).catch(() => { });
+    }
+}
+//# sourceMappingURL=guest-runtime-desktop.js.map

package/dist/guest-runtime-desktop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guest-runtime-desktop.js","sourceRoot":"","sources":["../src/guest-runtime-desktop.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAkC,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAG3D,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;AAClI,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU;IACnI,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,0BAA0B;IACzF,eAAe,EAAE,mBAAmB,EAAE,cAAc,EAAE,uBAAuB,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AAC9I,MAAM,GAAG,GAAG,GAAqB,EAAE,CAAC,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC;AAC/F,MAAM,UAAU,GAAG,kEAAkE,CAAC;AAGtF,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAG/C;IACC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAsE,EAAE,CAAC;IACvF,IAAI,OAAmC,CAAC;IACxC,IAAI,cAAmD,CAAC;IACxD,IAAI,OAA+D,CAAC;IACpE,IAAI,OAAmD,CAAC;IACxD,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,KAAK,GAAsB,QAAQ,CAAC;IACxC,MAAM,QAAQ,GAAG,CAAC,IAAuB,EAAQ,EAAE,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,SAAS,KAAK,KAAW,IAAI,MAAM,CAAC,OAAO,IAAI,QAAQ;QAAE,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;IACvE,SAAS,KAAK,CAAC,MAAc,EAAE,IAAc,EAAE,KAAc,EAAE,UAAU,GAAG,KAAK;QAC/E,KAAK,EAAE,CAAC;QACR,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,EAAE,mBAAmB,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAClI,IAAI,MAAmB,CAAC;QACxB,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC9G,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACjD,IAAI,KAAK,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;YAC9B,MAAM,IAAI,GAAG,GAAS,EAAE;gBACtB,MAAM,GAAG,IAAI,CAAC;gBACd,IAAI,CAAC,MAAM,CAAC,MAAM;oBAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC5C,IAAI,UAAU,IAAI,CAAC,QAAQ;oBAAE,OAAO,CAAC,UAAU,EAAE,CAAC;YACpD,CAAC,CAAC;YACF,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC9D,wEAAwE;YACxE,wEAAwE;YACxE,MAAM,OAAO,GAAG,CAAC,IAAY,EAAQ,EAAE;gBACrC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC;gBACrB,IAAI,KAAK,GAAG,MAAM;oBAAE,IAAI,EAAE,CAAC;YAC7B,CAAC,CAAC;YACF,OAAO,CAAC,MAAO,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACpC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAAC,OAAO,CAAC,KAAM,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,IAAI,UAAU,IAAI,CAAC,QAAQ;gBAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACzG,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE;gBAC3B,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;gBAAC,YAAY,CAAC,KAAK,CAAC,CAAC;gBAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAAC,MAAM,EAAE,CAAC;gBAC/F,IAAI,UAAU,IAAI,CAAC,QAAQ;oBAAE,OAAO,CAAC,UAAU,EAAE,CAAC;gBAClD,IAAI,MAAM,IAAI,IAAI,KAAK,CAAC;oBAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;;oBAAM,OAAO,EAAE,CAAC;YAC1D,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,OAAO,CAAC,KAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAAC,IAAI,MAAM,CAAC,OAAO;gBAAE,IAAI,EAAE,CAAC;QACxD,CAAC,CAAC,CAAC;QACH,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAClC,CAAC;IACD,SAAS,KAAK;QACZ,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,QAAQ,GAAG,IAAI,CAAC;QAChB,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC1C,IAAI,QAAQ,GAAG,IAAI,EAAE,KAAiC,CAAC;YACvD,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;gBACrC,IAAI,CAAC;oBAAC,MAAM,OAAO,EAAE,KAAK,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,QAAQ,GAAG,KAAK,CAAC;gBAAC,CAAC;gBAC3D,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,OAAO,IAAI,MAAM,cAAc,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;oBACxE,IAAI,OAAO;wBAAE,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;gBACrC,CAAC;gBAAC,MAAM,CAAC;oBAAC,QAAQ,GAAG,KAAK,CAAC;gBAAC,CAAC;gBAC7B,KAAK,MAAM,MAAM,IAAI,QAAQ;oBAAE,IAAI,CAAC,MAAM,CAAC,MAAM;wBAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAChF,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YAC3D,CAAC,CAAC;YACF,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,GAAG,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpI,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,KAAK,MAAM,MAAM,IAAI,QAAQ;oBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;wBAAC,QAAQ,GAAG,KAAK,CAAC;wBAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBAAC,CAAC;gBACtG,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACrD,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,KAAK,GAAG,GAAS,EAAE,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5C,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,IAAI,CAAC;QACH,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnB,KAAK,EAAE,CAAC;QACR,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,KAAK,IAAI;YAAE,MAAM,GAAG,EAAE,CAAC;QAC5E,KAAK,MAAM,IAAI,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YAAC,KAAK,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK;gBAAE,MAAM,GAAG,EAAE,CAAC;QAC3I,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,GAAG,mBAAmB,CAAC,IAAI,cAAc,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACvH,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK;gBAAE,MAAM,GAAG,EAAE,CAAC;YAC7I,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,CAAC;QAC1C,CAAC;gBAAS,CAAC;YAAC,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;QAC1C,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,UAAU;YAAE,MAAM,GAAG,EAAE,CAAC;QAClF,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,mBAAmB,CAAC,GAAG,MAAM,EAAE,GAAG,mBAAmB,CAAC,GAAG,UAAU,EAAE,GAAG,mBAAmB,CAAC,IAAI,SAAS,EAAE,GAAG,mBAAmB,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC;YACzK,KAAK,EAAE,CAAC;YAAC,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9C,CAAC;QACD,QAAQ,CAAC,YAAY,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC/I,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAAC,KAAK,EAAE,CAAC;QAC5B,MAAM,KAAK,CAAC,gBAAgB,EAAE,CAAC,IAAI,EAAE,iBAAiB,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,YAAY,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;QACzI,KAAK,EAAE,CAAC;QAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAAC,KAAK,CAAC,eAAe,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QACvK,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC;YAC/C,KAAK,EAAE,CAAC;YACR,IAAI,CAAC;gBAAC,MAAM,KAAK,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC;gBAAC,YAAY,GAAG,IAAI,CAAC;gBAAC,MAAM;YAAC,CAAC;YAC9E,MAAM,CAAC;gBAAC,MAAM,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,YAAY;YAAE,MAAM,GAAG,EAAE,CAAC;QAC/B,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC,eAAe,EAAE,GAAG,mBAAmB,CAAC,IAAI,cAAc,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QACrI,KAAK,EAAE,CAAC;QACR,QAAQ,CAAC,SAAS,CAAC,CAAC;QAAC,cAAc,GAAG,QAAQ,CAAC,uBAAuB,CAAC,GAAG,mBAAmB,CAAC,IAAI,UAAU,EAAE,EAAE,cAAc,EAAE,mBAAmB;YACjJ,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM;YAC/F,IAAI,EAAE,CAAC,uBAAuB,EAAE,wBAAwB,EAAE,iCAAiC,EAAE,4BAA4B,EAAE,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAClJ,KAAK,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,QAAQ;YAAE,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvG,OAAO,GAAG,MAAM,cAAc,CAAC;QAAC,KAAK,EAAE,CAAC;QACxC,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QAAC,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,GAAG,EAAE,CAAC;QACxF,QAAQ,CAAC,SAAS,CAAC,CAAC;QAAC,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QAAC,KAAK,EAAE,CAAC;QACzE,MAAM,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAAC,KAAK,EAAE,CAAC;QACnD,MAAM,aAAa,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,CAAC;QACnE,IAAI,CAAC,CAAC,gBAAgB,EAAE,oBAAoB,EAAE,qBAAqB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,KAAK,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;eACjI,CAAC,aAAa,CAAC,QAAQ,CAAC,8BAA8B,CAAC;YAAE,MAAM,GAAG,EAAE,CAAC;QAC1E,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;QAAC,KAAK,EAAE,CAAC;QAAC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAAC,KAAK,EAAE,CAAC;QACtE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAAC,MAAM,MAAM,GAAG,6BAA6B,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,mBAAmB,CAAC,GAAG,UAAU,EAAE,UAAU,EAAE,iBAAiB,CAAC,UAAU,EAAE,CAAC,CAAC;QACvL,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAAC,KAAK,EAAE,CAAC;QAC5D,OAAO,GAAG,uBAAuB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAC,YAAY,EAAC,EAAE;gBAC3F,IAAI,MAAM,MAAM,CAAC,cAAc,CAAC,YAAY,CAAC,KAAK,MAAM;oBAAE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;YAC5H,CAAC,EAAE,CAAC,CAAC;QACL,MAAM,KAAK,GAAG,uBAAuB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,0BAA0B,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QACzI,QAAQ,CAAC,SAAS,CAAC,CAAC;QAAC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,mBAAmB,CAAC,IAAI,eAAe,CAAC,CAAC;QAAC,KAAK,EAAE,CAAC;QACjG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;QAAC,KAAK,EAAE,CAAC;QAC/C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,CAAC;IAChG,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,EAAE,CAAC;QAAC,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,CAAC;YAAS,CAAC;QACT,iFAAiF;QACjF,IAAI,QAAQ,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,MAAM,EAAE,CAAC,GAAG,mBAAmB,CAAC,GAAG,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC5J,CAAC;AACH,CAAC"}

package/dist/guest-runtime-main.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/guest-runtime-main.js

@@ -0,0 +1,31 @@
+import { writeSync } from "node:fs";
+import { Duplex } from "node:stream";
+import { runGuestRuntime } from "./guest-runtime.js";
+import { createGuestRuntimeDesktop } from "./guest-runtime-desktop.js";
+import { GUEST_RUNTIME_REVISION } from "./guest-runtime-revision.js";
+// Fixed packaged command only. Stdout is reserved for framed protocol bytes.
+const stop = new AbortController();
+process.on("SIGTERM", () => stop.abort());
+process.on("SIGINT", () => stop.abort());
+const transport = Duplex.from({ readable: process.stdin, writable: process.stdout });
+transport.on("error", () => stop.abort());
+try {
+    if (!/^guest-api1-[a-f0-9]{64}$/.test(GUEST_RUNTIME_REVISION))
+        throw new Error();
+    const markerFd = process.env.HUMANISH_GUEST_SUPERVISION_FD;
+    if (!markerFd || !/^[1-9][0-9]{0,3}$/.test(markerFd) || Number(markerFd) < 3 || Number(markerFd) > 4095)
+        throw new Error();
+    const runtime = await runGuestRuntime({ transport, revision: GUEST_RUNTIME_REVISION, signal: stop.signal,
+        marker: value => { if (writeSync(Number(markerFd), value) !== 1)
+            throw new Error(); },
+        createDesktop: (signal, onTerminal) => createGuestRuntimeDesktop({ signal, onTerminal }) });
+    const result = await runtime.closed;
+    process.exit(result.complete ? 0 : 1);
+}
+catch {
+    stop.abort();
+    transport.destroy();
+    process.stderr.write("humanish_guest_failed\n");
+    process.exitCode = 1;
+}
+//# sourceMappingURL=guest-runtime-main.js.map

package/dist/guest-runtime-main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guest-runtime-main.js","sourceRoot":"","sources":["../src/guest-runtime-main.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,6EAA6E;AAC7E,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;AACnC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;AAC1C,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;AACzC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AACrF,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;AAC1C,IAAI,CAAC;IACH,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,sBAAsB,CAAC;QAAE,MAAM,IAAI,KAAK,EAAE,CAAC;IACjF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;IAC3D,IAAI,CAAC,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI;QAAE,MAAM,IAAI,KAAK,EAAE,CAAC;IAC3H,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,sBAAsB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM;QACtG,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;QACrF,aAAa,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,yBAAyB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9F,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC;IACpC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxC,CAAC;AAAC,MAAM,CAAC;IACP,IAAI,CAAC,KAAK,EAAE,CAAC;IAAC,SAAS,CAAC,OAAO,EAAE,CAAC;IAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAChD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC"}

package/dist/guest-runtime-revision.d.ts

@@ -0,0 +1 @@
+export declare const GUEST_RUNTIME_REVISION = "development-unpackaged";

package/dist/guest-runtime-revision.js

@@ -0,0 +1,3 @@
+// Replaced only by the guest packager from its immutable, noncircular input digest.
+export const GUEST_RUNTIME_REVISION = "development-unpackaged";
+//# sourceMappingURL=guest-runtime-revision.js.map

package/dist/guest-runtime-revision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guest-runtime-revision.js","sourceRoot":"","sources":["../src/guest-runtime-revision.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,MAAM,CAAC,MAAM,sBAAsB,GAAG,wBAAwB,CAAC"}

package/dist/guest-runtime.d.ts

@@ -0,0 +1,25 @@
+import type { Duplex } from "node:stream";
+import type { CuaExecutor } from "./computer-use.js";
+export interface GuestRuntimeDesktop {
+    executor: CuaExecutor;
+    close(): Promise<{
+        complete: boolean;
+    }>;
+}
+export interface GuestRuntimeOptions {
+    transport: Duplex;
+    revision: string;
+    signal: AbortSignal;
+    /** Fixed private supervision channel, not browser-control output. */
+    marker(value: "A" | "R"): void;
+    createDesktop(signal: AbortSignal, onTerminal: () => void): Promise<GuestRuntimeDesktop>;
+}
+/** One admitted desktop and one dispatcher. The owner retains physical teardown. */
+export declare function runGuestRuntime(options: GuestRuntimeOptions): Promise<{
+    close(): Promise<{
+        complete: boolean;
+    }>;
+    closed: Promise<{
+        complete: boolean;
+    }>;
+}>;

package/dist/guest-runtime.js

@@ -0,0 +1,96 @@
+import { attachBrowserControlDispatcher } from "./browser-control-dispatcher.js";
+import { encodeGuestBootstrap, GuestBootstrapReader, GUEST_BOOTSTRAP_LIMITS } from "./guest-bootstrap.js";
+import { CuaExecutorError } from "./cua-executor-error.js";
+/** One admitted desktop and one dispatcher. The owner retains physical teardown. */
+export async function runGuestRuntime(options) {
+    const owner = new AbortController();
+    const authority = AbortSignal.any([owner.signal, options.signal]);
+    let desktop;
+    let dispatcher;
+    let reader;
+    let closing;
+    let preparing;
+    let resolveClosed;
+    const closed = new Promise(resolve => { resolveClosed = resolve; });
+    const timer = setTimeout(() => { void close(); }, GUEST_BOOTSTRAP_LIMITS.readyMs);
+    function terminal() { void close(); }
+    function close() {
+        if (closing)
+            return closing;
+        // Assign before reader/dispatcher teardown can synchronously reenter.
+        closing = Promise.resolve().then(async () => {
+            reader?.close();
+            dispatcher?.close();
+            options.transport.destroy();
+            let complete = true;
+            let deadline;
+            const reclaim = async () => {
+                try {
+                    if (!desktop && preparing)
+                        desktop = await preparing;
+                    if (desktop)
+                        complete = (await desktop.close()).complete;
+                }
+                catch {
+                    complete = false;
+                }
+            };
+            try {
+                await Promise.race([reclaim(), new Promise(resolve => { deadline = setTimeout(() => { complete = false; resolve(); }, 4000); })]);
+            }
+            finally {
+                clearTimeout(deadline);
+                options.signal.removeEventListener("abort", terminal);
+                options.transport.off("end", terminal);
+                options.transport.off("close", terminal);
+                // Keep the finite error listener through native close; never surface text.
+                if (options.transport.closed)
+                    options.transport.off("error", terminal);
+                const result = { complete };
+                resolveClosed(result);
+            }
+            return { complete };
+        });
+        owner.abort();
+        clearTimeout(timer);
+        return closing;
+    }
+    options.transport.on("error", terminal);
+    options.transport.on("end", terminal);
+    options.transport.on("close", terminal);
+    options.signal.addEventListener("abort", terminal, { once: true });
+    try {
+        reader = new GuestBootstrapReader(options.transport, options.revision, authority, false, terminal);
+        const identity = await reader.identity;
+        if (authority.aborted)
+            throw new CuaExecutorError("session_revoked", "not_dispatched");
+        options.marker("A");
+        preparing = options.createDesktop(authority, terminal);
+        desktop = await Promise.race([preparing, new Promise((_, reject) => {
+                const stop = () => reject(new CuaExecutorError("session_revoked", "not_dispatched"));
+                authority.addEventListener("abort", stop, { once: true });
+                void preparing.finally(() => authority.removeEventListener("abort", stop)).catch(() => { });
+                if (authority.aborted)
+                    stop();
+            })]);
+        if (authority.aborted)
+            throw new CuaExecutorError("session_revoked", "not_dispatched");
+        reader.handoff();
+        dispatcher = attachBrowserControlDispatcher({ transport: options.transport, identity, executor: desktop.executor,
+            authoritySignal: authority, isAuthorized: () => !authority.aborted });
+        // No await in this handoff: an immediate HELLO already has its sole receiver.
+        options.transport.write(encodeGuestBootstrap(identity, true), error => { if (error)
+            terminal(); });
+        options.transport.resume();
+        if (authority.aborted || options.transport.destroyed)
+            throw new CuaExecutorError("session_revoked", "not_dispatched");
+        options.marker("R");
+        clearTimeout(timer);
+        return { close, closed };
+    }
+    catch (error) {
+        await close();
+        throw error;
+    }
+}
+//# sourceMappingURL=guest-runtime.js.map

package/dist/guest-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guest-runtime.js","sourceRoot":"","sources":["../src/guest-runtime.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC1G,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAY3D,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAA4B;IAChE,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAClE,IAAI,OAAwC,CAAC;IAC7C,IAAI,UAAyE,CAAC;IAC9E,IAAI,MAAwC,CAAC;IAC7C,IAAI,OAAmD,CAAC;IACxD,IAAI,SAAmD,CAAC;IACxD,IAAI,aAAsD,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,OAAO,CAAwB,OAAO,CAAC,EAAE,GAAG,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAClF,SAAS,QAAQ,KAAW,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC;IAC3C,SAAS,KAAK;QACZ,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,sEAAsE;QACtE,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC1C,MAAM,EAAE,KAAK,EAAE,CAAC;YAAC,UAAU,EAAE,KAAK,EAAE,CAAC;YAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YAClE,IAAI,QAAQ,GAAG,IAAI,CAAC;YACpB,IAAI,QAAoC,CAAC;YACzC,MAAM,OAAO,GAAG,KAAK,IAAmB,EAAE;gBACxC,IAAI,CAAC;oBACH,IAAI,CAAC,OAAO,IAAI,SAAS;wBAAE,OAAO,GAAG,MAAM,SAAS,CAAC;oBACrD,IAAI,OAAO;wBAAE,QAAQ,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC;gBAC3D,CAAC;gBAAC,MAAM,CAAC;oBAAC,QAAQ,GAAG,KAAK,CAAC;gBAAC,CAAC;YAC/B,CAAC,CAAC;YACF,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,GAAG,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1I,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,QAAQ,CAAC,CAAC;gBACvB,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBACtD,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;gBAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBACjF,2EAA2E;gBAC3E,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM;oBAAE,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBACvE,MAAM,MAAM,GAAG,EAAE,QAAQ,EAAE,CAAC;gBAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YACrD,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,EAAE,CAAC;QAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACnC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACxH,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,oBAAoB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QACnG,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC;QACvC,IAAI,SAAS,CAAC,OAAO;YAAE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;QACvF,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpB,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACvD,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBACxE,MAAM,IAAI,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC,CAAC;gBAC3F,SAAS,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC1D,KAAK,SAAU,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAC5F,IAAI,SAAS,CAAC,OAAO;oBAAE,IAAI,EAAE,CAAC;YAChC,CAAC,CAAC,CAAC,CAAC,CAAC;QACL,IAAI,SAAS,CAAC,OAAO;YAAE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;QACvF,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,UAAU,GAAG,8BAA8B,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC9G,eAAe,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QACxE,8EAA8E;QAC9E,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,EAAE,GAAG,IAAI,KAAK;YAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACnG,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QAC3B,IAAI,SAAS,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC,SAAS;YAAE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;QACtH,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,KAAK,EAAE,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;AACjD,CAAC"}

package/dist/index.d.ts

@@ -6,7 +6,7 @@ export type { LabAnalysis, AutomaticAnalysisBudget } from "./automatic-analysis-
 export type { AutomaticAnalysisHooks, AutomaticAnalysisResult } from "./automatic-analysis-completion.js";
 export type { AutomaticStudyAnalysisDeps, AutomaticStudyAnalysisOutcome, AutomaticStudyAnalysisView, AutomaticStudyAnalysisCancellation } from "./automatic-study-analysis.js";
 export { STUDY_ANALYSIS_SCHEMA, STUDY_ANALYSIS_CORRECTION_SCHEMA } from "./study-analysis.js";
-export type { StudyAnalysisConfig, StudyAnalysisArtifact, StudyAnalysisResult, StudyAnalysisCorrection, AnalysisConcernReview, LoadedStudyAnalysis } from "./study-analysis.js";
+export type { StudyAnalysisConfig, OpenAIStudyAnalysisConfig, CodexStudyAnalysisConfig, CodexAnalysisIdentity, StudyAnalysisArtifact, StudyAnalysisResult, StudyAnalysisCorrection, AnalysisConcernReview, LoadedStudyAnalysis } from "./study-analysis.js";
 export { ACTOR_TRACE_SCHEMA, CODEX_APP_SERVER_CAPABILITIES, SCRIPTED_BROWSER_CAPABILITIES, TERMINAL_AGENT_CAPABILITIES, codexResultToActorTrace, codexStatusToCompletionReason } from "./actor-contract.js";
 export type { ActorCapabilities, ActorCompletionReason, ActorStopCause, ActorLane, ActorPersonaRef, ActorProtocol, ActorStatus, ActorTokenUsage, ActorTrace, ActorRuntimeProvenance, ActorTraceItem, ActorTraceItemKind, ParticipantClosingReport } from "./actor-contract.js";
 export { actorRegistry, getActor, isCuaActorDescriptor, isScriptedBrowserActorDescriptor, isTerminalActorDescriptor } from "./actor-registry.js";

package/dist/lab-config.js

@@ -1,3 +1,4 @@
+import { isLocalBrowserLab, localBrowserDefaults, localBrowserUnsupportedReason } from "./local-runtime-config.js";
 import { resolveAutomaticAnalysis } from "./automatic-analysis-config.js";
 // humanish.lab.v2 — a lab is a COMPOSITION over code primitives, not a hardcoded kind.
 //
@@ -233,8 +234,8 @@ export function parseLabConfig(raw) {
             }
         }
         else {
-            if (config.execution?.target !== "e2b-desktop") {
-                return invalid("app-url subjects require `execution.target: e2b-desktop` with a registered computer-use actor (the actor drives a hosted desktop browser), or a registered scripted-browser actor for local execution.");
+            if (config.execution?.target !== "e2b-desktop" && config.execution?.target !== "local") {
+                return invalid("app-url computer-use subjects require `execution.target: local` or `e2b-desktop`.");
             }
             if (!actorResolvesToComputerUse(type)) {
                 return invalid(`actors[0].type must be a registered computer-use actor for app-url × e2b-desktop labs (one of: ${registeredComputerUseActors().join(", ")}); for local scripted execution use a registered scripted-browser actor (${registeredScriptedBrowserActors().join(", ")}). Got "${type}".`);
@@ -414,7 +415,13 @@ export function parseLabConfig(raw) {
     const analysisReason = automaticAnalysisRouteReason(config);
     if (analysisReason)
         return invalid(analysisReason);
-    return { ok: true, config, warnings: forwardDeclaredWarnings(config) };
+    const normalized = localBrowserDefaults(config);
+    if (isLocalBrowserLab(normalized)) {
+        const reason = localBrowserUnsupportedReason(normalized);
+        if (reason)
+            return invalid(reason);
+    }
+    return { ok: true, config: normalized, warnings: forwardDeclaredWarnings(normalized) };
 }
 // The slug interpolates into an in-sandbox shell command; the strict shape is load-bearing.
 const REPO_SLUG_PATTERN = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;