hyperbrane 0.1.2 → 0.2.0

package/dist/sandbox/providers/local/localService.js

@@ -0,0 +1,219 @@
+import { spawn } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import * as fs from "node:fs/promises";
+import { connect as netConnect, Socket } from "node:net";
+import { homedir, userInfo } from "node:os";
+import { basename, dirname, join, resolve } from "node:path";
+import { SandboxConnectionRefusedError, SandboxNotFoundError, } from "../../api.js";
+import { createDescriptor, getDescriptor, openDescriptor } from "../../storage/descriptors.js";
+import { createEndpoints } from "../../data-endpoints/dataEndpoints.js";
+import { firewalledPorts } from "../../data-endpoints/firewalledPorts.js";
+import { httpOver } from "../../lib/httpOverStream.js";
+import { createSandboxStorage } from "../../storage/sandboxStorage.js";
+function hostPath(path) {
+    return resolve("/", path);
+}
+async function notFoundAs(path, operation) {
+    try {
+        return await operation;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            throw new SandboxNotFoundError(`Not found: "${path}"`);
+        throw error;
+    }
+}
+async function writeTemp(full, data, mode = 0o666) {
+    await fs.mkdir(dirname(full), { recursive: true });
+    const tmp = join(dirname(full), `.${basename(full)}.${randomUUID()}.tmp`);
+    await fs.writeFile(tmp, data, { mode });
+    return tmp;
+}
+async function readFile(path) {
+    return new Uint8Array(await notFoundAs(path, fs.readFile(hostPath(path))));
+}
+async function readFileRange(path, start, end) {
+    const file = await notFoundAs(path, fs.open(hostPath(path), "r"));
+    try {
+        const buffer = new Uint8Array(Math.max(0, end - start));
+        let filled = 0;
+        while (filled < buffer.length) {
+            const { bytesRead } = await file.read(buffer, filled, buffer.length - filled, start + filled);
+            if (bytesRead === 0)
+                break;
+            filled += bytesRead;
+        }
+        return buffer.subarray(0, filled);
+    }
+    finally {
+        await file.close();
+    }
+}
+async function writeFile(path, data) {
+    const full = hostPath(path);
+    await fs.rename(await writeTemp(full, data), full);
+}
+async function writeFileExclusive(path, data) {
+    const full = hostPath(path);
+    const tmp = await writeTemp(full, data);
+    try {
+        await fs.link(tmp, full);
+        return true;
+    }
+    catch (error) {
+        if (error.code === "EEXIST")
+            return false;
+        throw error;
+    }
+    finally {
+        await fs.unlink(tmp);
+    }
+}
+async function removeFile(path) {
+    await fs.rm(hostPath(path), { force: true });
+}
+async function createDirectory(path) {
+    await fs.mkdir(hostPath(path), { recursive: true });
+}
+async function removeDirectory(path) {
+    await fs.rm(hostPath(path), { recursive: true, force: true });
+}
+async function listDirectory(path) {
+    return notFoundAs(path, fs.readdir(hostPath(path)));
+}
+async function stat(path) {
+    const stats = await notFoundAs(path, fs.stat(hostPath(path)));
+    const type = stats.isFile() ? "file" : stats.isDirectory() ? "directory" : "other";
+    return { type, uid: stats.uid, gid: stats.gid, size: stats.size };
+}
+async function homeDirectory() {
+    return process.env.HOME || homedir();
+}
+function runCommand(cmd, { cwd, env = {}, stdin } = {}) {
+    return new Promise((resolve, reject) => {
+        const [command, ...args] = cmd;
+        if (!command)
+            return reject(new Error("no command to run"));
+        const child = spawn(command, args, {
+            cwd: hostPath(cwd ?? "."),
+            env: { ...process.env, ...env },
+            stdio: [stdin === undefined ? "ignore" : "pipe", "pipe", "pipe"],
+        });
+        const stdout = [];
+        const stderr = [];
+        child.stdout.on("data", (chunk) => stdout.push(chunk));
+        child.stderr.on("data", (chunk) => stderr.push(chunk));
+        child.once("error", reject);
+        child.once("close", (code) => resolve({ exitCode: code ?? -1, stdout: Buffer.concat(stdout).toString(), stderr: Buffer.concat(stderr).toString() }));
+        if (stdin !== undefined)
+            child.stdin.end(stdin);
+    });
+}
+async function state() {
+    return "running";
+}
+async function start() { }
+async function destroy() { }
+function hasExpiration() {
+    return false;
+}
+async function getExpiration() {
+    return null;
+}
+async function setExpiration() {
+    return null;
+}
+function hasShell(ctx) {
+    return ctx.sshKey !== undefined;
+}
+async function sshEndpoint(ctx) {
+    if (ctx.sshKey === undefined)
+        throw new Error("this machine has no shell: its context has no SSH key (sshKey)");
+    return {
+        host: ctx.sshHost ?? "127.0.0.1",
+        port: ctx.sshPort ?? 22,
+        user: ctx.sshUser ?? userInfo().username,
+        privateKey: ctx.sshKey,
+    };
+}
+async function fetch(url, { unix, ...init } = {}) {
+    if (unix === undefined || "Bun" in globalThis)
+        return globalThis.fetch(url, { ...init, unix: unix === undefined ? undefined : hostPath(unix) });
+    return httpOver(url, () => netConnect(hostPath(unix)), init);
+}
+function connect(path) {
+    return new Promise((resolve, reject) => {
+        const socket = new Socket();
+        let markClosed;
+        const closed = new Promise((done) => (markClosed = done));
+        const listeners = [];
+        socket.on("data", (chunk) => {
+            for (const listener of listeners)
+                listener(new Uint8Array(chunk));
+        });
+        socket.once("close", () => markClosed());
+        socket.once("end", () => markClosed());
+        socket.on("error", (error) => {
+            markClosed();
+            const message = `connecting to ${path} failed: ${error.message}`;
+            reject(error.code === "ENOENT" || error.code === "ECONNREFUSED" ? new SandboxConnectionRefusedError(message) : new Error(message));
+        });
+        socket.once("connect", () => resolve({
+            write: (data) => void socket.write(data),
+            onData: (listener) => void listeners.push(listener),
+            closed,
+            close: () => socket.end(),
+        }));
+        socket.connect({ path: hostPath(path) });
+    });
+}
+export function createLocalService(ctx) {
+    const fileOps = {
+        readFile,
+        readFileRange,
+        writeFile,
+        writeFileExclusive,
+        removeFile,
+        createDirectory,
+        removeDirectory,
+        listDirectory,
+        stat,
+        homeDirectory,
+    };
+    const cmdOps = {
+        runCommand,
+    };
+    const netOps = {
+        fetch,
+        connect,
+    };
+    const machine = { ...fileOps, ...cmdOps, ...netOps };
+    const storage = createSandboxStorage(machine);
+    const lifecycleOps = {
+        create: (spec) => createDescriptor(ctx, storage, ctx.id ?? spec.name, spec),
+        open: () => openDescriptor(ctx, storage, ctx.id ?? "this machine"),
+        get: () => getDescriptor(storage, "this machine"),
+        state,
+        start,
+        destroy,
+    };
+    const dataOps = createEndpoints(machine, storage, firewalledPorts(machine, storage));
+    const expirationOps = {
+        hasExpiration,
+        getExpiration,
+        setExpiration,
+    };
+    const shellOps = {
+        hasShell: () => hasShell(ctx),
+        sshEndpoint: () => sshEndpoint(ctx),
+    };
+    return {
+        ...fileOps,
+        ...lifecycleOps,
+        ...cmdOps,
+        ...dataOps,
+        ...expirationOps,
+        ...shellOps,
+        ...netOps,
+    };
+}

package/dist/sandbox/providers/ssh/sshService.d.ts

@@ -0,0 +1,2 @@
+import type { SandboxAuthContext, SandboxService } from "../../api.ts";
+export declare function createSshService(ctx: SandboxAuthContext): SandboxService;

package/dist/sandbox/providers/ssh/sshService.js

@@ -0,0 +1,82 @@
+import { userInfo } from "node:os";
+import { commandFileOperations } from "../../lib/remoteFileOperations.js";
+import { createDescriptor, getDescriptor, openDescriptor } from "../../storage/descriptors.js";
+import { createEndpoints } from "../../data-endpoints/dataEndpoints.js";
+import { firewalledPorts } from "../../data-endpoints/firewalledPorts.js";
+import { createSandboxStorage } from "../../storage/sandboxStorage.js";
+import { sshCommand, sshConnect, sshFetch, sshMachine } from "./sshTransport.js";
+function target(ctx) {
+    if (!ctx.sshHost)
+        throw new Error("an SSH machine needs its host (sshHost)");
+    if (!ctx.sshKey)
+        throw new Error(`SSH to ${ctx.sshHost} needs a key (sshKey)`);
+    return { host: ctx.sshHost, port: ctx.sshPort ?? 22, user: ctx.sshUser ?? userInfo().username, privateKey: ctx.sshKey };
+}
+function where(ctx) {
+    return `SSH machine ${ctx.sshHost ?? "(no host)"}`;
+}
+async function create(ctx, storage, spec) {
+    return createDescriptor(ctx, storage, ctx.id ?? spec.name, spec);
+}
+async function open(ctx, storage) {
+    return openDescriptor(ctx, storage, ctx.id ?? ctx.sshHost ?? "ssh machine");
+}
+async function state() {
+    return "running";
+}
+async function start() { }
+async function destroy() { }
+function hasExpiration() {
+    return false;
+}
+async function getExpiration() {
+    return null;
+}
+async function setExpiration() {
+    return null;
+}
+function hasShell(ctx) {
+    return ctx.sshHost !== undefined && ctx.sshKey !== undefined;
+}
+async function sshEndpoint(ctx) {
+    return target(ctx);
+}
+export function createSshService(ctx) {
+    const fileOps = commandFileOperations(sshMachine(() => target(ctx)));
+    const cmdOps = {
+        runCommand: (cmd, options) => sshCommand(target(ctx), cmd, options),
+    };
+    const netOps = {
+        fetch: (url, init) => sshFetch(target(ctx), url, init),
+        connect: (path) => sshConnect(target(ctx), path),
+    };
+    const machine = { ...fileOps, ...cmdOps, ...netOps };
+    const storage = createSandboxStorage(machine);
+    const lifecycleOps = {
+        create: (spec) => create(ctx, storage, spec),
+        open: () => open(ctx, storage),
+        get: () => getDescriptor(storage, where(ctx)),
+        state,
+        start,
+        destroy,
+    };
+    const dataOps = createEndpoints(machine, storage, firewalledPorts(machine, storage));
+    const expirationOps = {
+        hasExpiration,
+        getExpiration,
+        setExpiration,
+    };
+    const shellOps = {
+        hasShell: () => hasShell(ctx),
+        sshEndpoint: () => sshEndpoint(ctx),
+    };
+    return {
+        ...fileOps,
+        ...lifecycleOps,
+        ...cmdOps,
+        ...dataOps,
+        ...expirationOps,
+        ...shellOps,
+        ...netOps,
+    };
+}

package/dist/sandbox/providers/ssh/sshTransport.d.ts

@@ -0,0 +1,12 @@
+import { type RunCommandOptions, type RunCommandResult, type SandboxConnection, type SandboxFetchInit } from "../../api.ts";
+import { type CommandMachine } from "../../lib/remoteFileOperations.ts";
+export type SshTarget = {
+    host: string;
+    port: number;
+    user: string;
+    privateKey: string;
+};
+export declare function sshCommand(target: SshTarget, cmd: string[], { cwd, env, stdin }?: RunCommandOptions): Promise<RunCommandResult>;
+export declare function sshMachine(target: () => SshTarget): CommandMachine;
+export declare function sshConnect(target: SshTarget, path: string): Promise<SandboxConnection>;
+export declare function sshFetch(target: SshTarget, url: string, { unix, ...init }?: SandboxFetchInit): Promise<Response>;

package/dist/sandbox/providers/ssh/sshTransport.js

@@ -0,0 +1,216 @@
+import { posix } from "node:path";
+import { Client } from "ssh2";
+import { SandboxConnectionRefusedError, SandboxNotFoundError } from "../../api.js";
+import { commandLine, quote } from "../../lib/shellCommand.js";
+import { MISSING, PUT_FILE, READ_BYTES } from "../../lib/remoteFileOperations.js";
+import { httpOver } from "../../lib/httpOverStream.js";
+import { sleep } from "../../../lib/sleep.js";
+const READY_TIMEOUT_MS = 15_000;
+const EXISTS = 45;
+const ATTEMPTS = 4;
+class NotRunError extends Error {
+}
+function where({ host, port, user }) {
+    return `${user}@${host}:${port}`;
+}
+function openClient(target) {
+    return new Promise((resolve, reject) => {
+        const client = new Client();
+        let ready = false;
+        client
+            .on("ready", () => {
+            ready = true;
+            resolve(client);
+        })
+            .on("error", (error) => {
+            if (!ready)
+                reject(new Error(`ssh to ${where(target)} failed: ${error.message}`));
+        })
+            .on("close", () => {
+            if (!ready)
+                reject(new Error(`ssh to ${where(target)} closed before it was ready`));
+        })
+            .connect({ host: target.host, port: target.port, username: target.user, privateKey: target.privateKey, readyTimeout: READY_TIMEOUT_MS });
+    });
+}
+async function withSsh(target, body) {
+    const client = await openClient(target);
+    try {
+        return await body(client);
+    }
+    finally {
+        client.end();
+    }
+}
+function exec(client, command, stdin) {
+    return new Promise((resolve, reject) => client.exec(command, (error, channel) => {
+        if (error)
+            return reject(error);
+        const stdout = [];
+        const stderr = [];
+        let exit;
+        channel.on("data", (chunk) => stdout.push(chunk));
+        channel.stderr.on("data", (chunk) => stderr.push(chunk));
+        channel.once("exit", (code, signal) => (exit = code ?? signal ?? "no status"));
+        channel.once("close", () => {
+            const said = stdout.length > 0 || stderr.length > 0;
+            if (exit === undefined && !said)
+                return reject(new NotRunError(`${command.slice(0, 80)} wasn't run: the channel closed with no exit code and no output`));
+            if (typeof exit !== "number")
+                return reject(new Error(`${command.slice(0, 80)} ended without an exit code (${exit ?? "the channel closed first"})`));
+            resolve({ exitCode: exit, stdout: Buffer.concat(stdout), stderr: Buffer.concat(stderr).toString() });
+        });
+        channel.end(stdin === undefined ? undefined : typeof stdin === "string" ? stdin : Buffer.from(stdin));
+    }));
+}
+async function run(target, command, stdin) {
+    for (let attempt = 1;; attempt++) {
+        try {
+            return await withSsh(target, (client) => exec(client, command, stdin));
+        }
+        catch (error) {
+            const again = error instanceof NotRunError || /Channel open failure/.test(error.message);
+            if (!again || attempt >= ATTEMPTS)
+                throw error;
+        }
+        await sleep(50 * 2 ** attempt);
+    }
+}
+export async function sshCommand(target, cmd, { cwd, env, stdin } = {}) {
+    const line = commandLine(cmd, { env, cwd: cwd === undefined ? undefined : posix.resolve("/", cwd) });
+    const { exitCode, stdout, stderr } = await run(target, line, stdin);
+    return { exitCode, stdout: stdout.toString(), stderr };
+}
+export function sshMachine(target) {
+    async function readBytes(path, start, end) {
+        const env = { MISSING: String(MISSING), START: start === undefined ? "" : String(start), END: end === undefined ? "" : String(end) };
+        const ran = await run(target(), commandLine(["sh", "-c", READ_BYTES, "sh", path], { env }));
+        if (ran.exitCode === MISSING)
+            throw new SandboxNotFoundError(`Not found: "${path}"`);
+        if (ran.exitCode !== 0)
+            throw new Error(`reading ${path} on ${where(target())} failed: ${ran.stderr.trim()}`);
+        return new Uint8Array(ran.stdout);
+    }
+    async function putFile(path, data, exclusive) {
+        const env = { EXCLUSIVE: exclusive ? "1" : "", EXISTS: String(EXISTS) };
+        const ran = await run(target(), commandLine(["sh", "-c", PUT_FILE, "sh", path], { env }), data);
+        if (ran.exitCode === EXISTS)
+            return false;
+        if (ran.exitCode !== 0)
+            throw new Error(`writing ${path} on ${where(target())} failed: ${ran.stderr.trim()}`);
+        return true;
+    }
+    return {
+        runCommand: (cmd, options) => sshCommand(target(), cmd, options),
+        readBytes,
+        putFile,
+    };
+}
+function relay(client, path) {
+    return new Promise((resolve, reject) => client.exec(`exec python3 -c ${quote(RELAY)} ${quote(path)}`, (error, channel) => {
+        if (error)
+            return reject(error);
+        let said = "";
+        const failed = () => reject(new Error(said.trim() || "the relay exited"));
+        const onStderr = (chunk) => {
+            said += chunk.toString();
+            if (!said.includes("\n"))
+                return;
+            channel.stderr.off("data", onStderr);
+            channel.off("close", failed);
+            if (said.startsWith("connected\n"))
+                resolve(channel);
+            else
+                failed();
+        };
+        channel.stderr.on("data", onStderr);
+        channel.once("close", failed);
+    }));
+}
+async function socketChannel(client, path) {
+    try {
+        return await new Promise((resolve, reject) => client.openssh_forwardOutStreamLocal(path, (error, channel) => (error ? reject(error) : resolve(channel))));
+    }
+    catch (forwarding) {
+        return relay(client, path).catch((error) => {
+            const message = `connecting to ${path} failed: ${forwarding.message}; through python3: ${error.message}`;
+            throw /^(ENOENT|ECONNREFUSED) /.test(error.message) ? new SandboxConnectionRefusedError(message) : new Error(message);
+        });
+    }
+}
+function tcpChannel(client, host, port) {
+    return new Promise((resolve, reject) => client.forwardOut("127.0.0.1", 0, host, port, (error, channel) => (error ? reject(error) : resolve(channel))));
+}
+function connectionOf(stream, onClosed) {
+    const listeners = [];
+    const early = [];
+    const closed = new Promise((done) => stream.once("close", done));
+    void closed.then(onClosed);
+    stream.on("data", (chunk) => {
+        const data = new Uint8Array(chunk);
+        if (listeners.length === 0)
+            early.push(data);
+        for (const listener of listeners)
+            listener(data);
+    });
+    stream.on("error", () => stream.destroy());
+    return {
+        write: (data) => void stream.write(data),
+        onData(listener) {
+            listeners.push(listener);
+            for (const data of early.splice(0))
+                listener(data);
+        },
+        closed,
+        close: () => void stream.end(),
+    };
+}
+export async function sshConnect(target, path) {
+    const client = await openClient(target);
+    try {
+        return connectionOf(await socketChannel(client, posix.resolve("/", path)), () => client.end());
+    }
+    catch (error) {
+        client.end();
+        const message = `connecting to ${path} on ${where(target)} failed: ${error.message}`;
+        throw error instanceof SandboxConnectionRefusedError ? new SandboxConnectionRefusedError(message) : new Error(message);
+    }
+}
+export async function sshFetch(target, url, { unix, ...init } = {}) {
+    const client = await openClient(target);
+    try {
+        const parsed = new URL(url);
+        const port = Number(parsed.port || (parsed.protocol === "https:" ? 443 : 80));
+        const channel = unix === undefined ? await tcpChannel(client, parsed.hostname, port) : await socketChannel(client, posix.resolve("/", unix));
+        channel.once("close", () => client.end());
+        return await httpOver(url, () => channel, init);
+    }
+    catch (error) {
+        client.end();
+        throw error;
+    }
+}
+const RELAY = `
+import errno, os, socket, sys, threading
+s = socket.socket(socket.AF_UNIX)
+try:
+    s.connect(sys.argv[1])
+except OSError as e:
+    sys.stderr.write(errno.errorcode.get(e.errno, "E?") + " " + e.strerror + "\\n")
+    sys.exit(1)
+sys.stderr.write("connected\\n")
+sys.stderr.flush()
+def up():
+    while True:
+        data = os.read(0, 65536)
+        if not data:
+            break
+        s.sendall(data)
+    s.shutdown(socket.SHUT_WR)
+threading.Thread(target=up, daemon=True).start()
+while True:
+    data = s.recv(65536)
+    if not data:
+        break
+    os.write(1, data)
+`;

package/dist/sandbox/service.d.ts

@@ -0,0 +1,2 @@
+import type { SandboxAuthContext, SandboxService } from "./api.ts";
+export declare function createSandboxService(ctx: SandboxAuthContext): SandboxService;

package/dist/sandbox/service.js

@@ -0,0 +1,18 @@
+import { createBoatService } from "./providers/boat/boatService.js";
+import { createExeDevService } from "./providers/exedev/exeDevService.js";
+import { createSshService } from "./providers/ssh/sshService.js";
+import { createLocalService } from "./providers/local/localService.js";
+export function createSandboxService(ctx) {
+    // Create service is a factory that initializes the specific sandbox operations client
+    // It does nothing, just creates the client
+    switch (ctx.kind) {
+        case "boat":
+            return createBoatService(ctx);
+        case "exe.dev":
+            return createExeDevService(ctx);
+        case "ssh":
+            return createSshService(ctx);
+        case "local":
+            return createLocalService(ctx);
+    }
+}

package/dist/sandbox/storage/descriptors.d.ts

@@ -0,0 +1,6 @@
+import type { SandboxAuthContext, SandboxDescriptor, SandboxSpec } from "../api.ts";
+import type { SandboxStorage } from "./sandboxStorage.ts";
+export declare function makeDescriptor(ctx: SandboxAuthContext, id: string, spec: SandboxSpec): SandboxDescriptor;
+export declare function createDescriptor(ctx: SandboxAuthContext, storage: SandboxStorage, id: string, spec: SandboxSpec): Promise<[SandboxAuthContext, SandboxDescriptor]>;
+export declare function openDescriptor(ctx: SandboxAuthContext, storage: SandboxStorage, id: string): Promise<SandboxDescriptor>;
+export declare function getDescriptor(storage: SandboxStorage, where: string): Promise<SandboxDescriptor>;

package/dist/sandbox/storage/descriptors.js

@@ -0,0 +1,25 @@
+export function makeDescriptor(ctx, id, spec) {
+    return {
+        id,
+        kind: ctx.kind,
+        name: spec.name,
+        ...(ctx.sshHost === undefined ? {} : { sshHost: ctx.sshHost }),
+        ...(ctx.sshUser === undefined ? {} : { sshUser: ctx.sshUser }),
+        ...(ctx.sshPort === undefined ? {} : { sshPort: ctx.sshPort }),
+        ...(spec.dataEndpointOptions === undefined ? {} : { dataEndpointOptions: spec.dataEndpointOptions }),
+    };
+}
+export async function createDescriptor(ctx, storage, id, spec) {
+    const descriptor = makeDescriptor(ctx, id, spec);
+    await storage.saveDescriptor(descriptor);
+    return [{ ...ctx, id }, descriptor];
+}
+export async function openDescriptor(ctx, storage, id) {
+    return (await storage.readDescriptor()) ?? storage.insertDescriptor(makeDescriptor(ctx, id, { name: id }));
+}
+export async function getDescriptor(storage, where) {
+    const descriptor = await storage.readDescriptor();
+    if (!descriptor)
+        throw new Error(`${where} has no descriptor: opening it saves one`);
+    return descriptor;
+}

package/dist/sandbox/storage/sandboxStorage.d.ts

@@ -0,0 +1,11 @@
+import type { Sandbox, SandboxDescriptor, SandboxEndpoint } from "../api.ts";
+export interface SandboxStorage {
+    readDescriptor(): Promise<SandboxDescriptor | null>;
+    insertDescriptor(descriptor: SandboxDescriptor): Promise<SandboxDescriptor>;
+    saveDescriptor(descriptor: SandboxDescriptor): Promise<void>;
+    readEndpoint(name: string): Promise<SandboxEndpoint | null>;
+    saveEndpoint(endpoint: SandboxEndpoint): Promise<void>;
+    removeEndpoint(name: string): Promise<void>;
+    listEndpoints(): Promise<SandboxEndpoint[]>;
+}
+export declare function createSandboxStorage(sandbox: Sandbox): SandboxStorage;

package/dist/sandbox/storage/sandboxStorage.js

@@ -0,0 +1,42 @@
+import { createJsonDirectory } from "../../lib/jsonDirectory.js";
+const DESCRIPTOR = "sandbox";
+export function createSandboxStorage(sandbox) {
+    const stateDirectory = async () => `${await sandbox.homeDirectory()}/.local/state/hyperbrane`;
+    const endpointsDirectory = async () => `${await stateDirectory()}/endpoints`;
+    const descriptors = createJsonDirectory(sandbox, stateDirectory);
+    const endpoints = createJsonDirectory(sandbox, endpointsDirectory);
+    async function readDescriptor() {
+        return descriptors.read(DESCRIPTOR);
+    }
+    async function insertDescriptor(descriptor) {
+        return descriptors.insert(DESCRIPTOR, descriptor);
+    }
+    async function saveDescriptor(descriptor) {
+        await descriptors.save(DESCRIPTOR, descriptor);
+    }
+    async function readEndpoint(name) {
+        return endpoints.read(name);
+    }
+    async function saveEndpoint(endpoint) {
+        const directory = await endpointsDirectory();
+        const made = await sandbox.runCommand(["sh", "-c", 'mkdir -p "$1" && chmod 700 "$1"', "sh", directory]);
+        if (made.exitCode !== 0)
+            throw new Error(`making ${directory} private failed: ${made.stderr.trim()}`);
+        await endpoints.save(endpoint.name, endpoint);
+    }
+    async function removeEndpoint(name) {
+        await endpoints.remove(name);
+    }
+    async function listEndpoints() {
+        return endpoints.list();
+    }
+    return {
+        readDescriptor,
+        insertDescriptor,
+        saveDescriptor,
+        readEndpoint,
+        saveEndpoint,
+        removeEndpoint,
+        listEndpoints,
+    };
+}

package/dist/upstreams/anthropic.d.ts

@@ -1,7 +1,2 @@
-/**
- * Claude: a Claude subscription through `claude auth login`, or an Anthropic API key. Once the
- * gateway holds a sign-in, `claude auth login` in any dimension completes with any pasted code in
- * claude's code#state format (e.g. "x#x"): the gateway answers the exchange itself.
- */
 declare const _default: import("../portal-gateway/upstream.ts").UpstreamDefinition;
 export default _default;

package/dist/upstreams/anthropic.js

@@ -1,17 +1,10 @@
-import { defineUpstream } from "../portal-gateway/upstream.js";
-/**
- * Claude: a Claude subscription through `claude auth login`, or an Anthropic API key. Once the
- * gateway holds a sign-in, `claude auth login` in any dimension completes with any pasted code in
- * claude's code#state format (e.g. "x#x"): the gateway answers the exchange itself.
- */
+import { defineUpstream } from "../portal-gateway/api.js";
 export default defineUpstream({
     name: "anthropic",
     modes: {
         oauth: {
-            // Every host claude presents its token to; one missing here would get the fake verbatim.
             hosts: ["api.anthropic.com", "mcp-proxy.anthropic.com", "platform.claude.com"],
             present: { header: "authorization", scheme: "Bearer" },
-            // Both the sign-in and the refresh go here, with JSON bodies.
             tokenUrl: "https://platform.claude.com/v1/oauth/token",
             fakes: {
                 access: { prefix: "sk-ant-oat01-" },