maka-agent 0.2.0-dev.3.20260830 → 0.2.0-dev.5.20260830

package/packages/eval/dist/harbor-maka-subject.js

@@ -1,83 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import { mkdir, writeFile } from 'node:fs/promises';
-import { dirname, join } from 'node:path';
-import { runHostedExecution } from '@maka/runtime-host/client';
-import { captureMakaRuntimeArtifacts, writeMakaArtifactCollectionError } from './maka-artifacts.js';
-import { makaEvalRuntimePolicyDocument } from './maka-runtime-policy.js';
-import { takeRelayResultToken, writeRelayResult } from './relay-result-frame.js';
-const resultToken = takeRelayResultToken();
-const payload = JSON.parse(Buffer.from(process.argv[2] ?? '', 'base64url').toString());
-const abort = new AbortController();
-let artifactCapture = Promise.resolve();
-const captureArtifacts = (reason) => {
-    artifactCapture = artifactCapture.then(async () => {
-        try {
-            await captureMakaRuntimeArtifacts({
-                stateRoot: payload.rootPath,
-                destinationRoot: payload.artifactRoot,
-                reason,
-            });
-        }
-        catch (error) {
-            await writeMakaArtifactCollectionError(payload.artifactRoot, error).catch(() => undefined);
-        }
-    });
-    return artifactCapture;
-};
-const stop = () => {
-    abort.abort();
-    void captureArtifacts('signal');
-};
-process.once('SIGINT', stop);
-process.once('SIGTERM', stop);
-const runtimeHome = join(dirname(payload.rootPath), `${process.pid}-home`);
-await mkdir(payload.rootPath, { recursive: true });
-await mkdir(runtimeHome, { recursive: true, mode: 0o700 });
-await writeFile(join(payload.rootPath, 'runtime-policy.json'), `${JSON.stringify(makaEvalRuntimePolicyDocument(process.env.HTTPS_PROXY))}\n`, { flag: 'wx', mode: 0o600 });
-process.env.HOME = runtimeHome;
-process.env.DEEPSEEK_BASE_URL = payload.baseUrl;
-let result;
-try {
-    result = await runHostedExecution({
-        rootPath: payload.rootPath,
-        baseUrl: payload.baseUrl,
-        execution: payload.execution,
-        signal: abort.signal,
-        hostSettlementTimeoutMs: payload.hostSettlementTimeoutMs,
-    });
-}
-finally {
-    await captureArtifacts(abort.signal.aborted ? 'signal' : 'settled');
-    process.removeListener('SIGINT', stop);
-    process.removeListener('SIGTERM', stop);
-}
-const failureReason = result.failureReason;
-const framedResult = failureReason !== undefined && Buffer.byteLength(failureReason) > 768
-    ? {
-        ...result,
-        failureReason: new TextDecoder().decode(Buffer.from(failureReason).subarray(0, 768)),
-    }
-    : result;
-writeRelayResult(resultToken, framedResult);
-// Same projection as every other wrapper: the exit code reports what this
-// process did, so whatever can read only the exit code reads the status the
-// frame carries. Nothing decides the subject's fate from it while the frame is
-// readable, but the two must not be able to say different things.
-process.exitCode = result.kind === 'settled' && result.status === 'completed' ? 0 : 1;

package/packages/eval/dist/harness-environment.js

@@ -1,80 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import { realpath } from 'node:fs/promises';
-import { delimiter, dirname, isAbsolute, relative, resolve, sep } from 'node:path';
-import { fileURLToPath } from 'node:url';
-export const BUNDLED_HARNESS_RELAY_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '../harbor');
-export function createHarnessPreparationEnvironment(options) {
-    const allowed = new Set([
-        'HOME',
-        'PATH',
-        'TMPDIR',
-        'TMP',
-        'TEMP',
-        'LANG',
-        'LC_ALL',
-        'SSL_CERT_FILE',
-        'SSL_CERT_DIR',
-        'REQUESTS_CA_BUNDLE',
-        'CURL_CA_BUNDLE',
-        'XDG_CACHE_HOME',
-        ...options.declared,
-    ]);
-    const credentials = new Set(options.subjectCredentialNames);
-    const inherited = Object.fromEntries([...allowed].flatMap((name) => {
-        const value = process.env[name];
-        return value === undefined || credentials.has(name) ? [] : [[name, value]];
-    }));
-    return {
-        ...inherited,
-        PYTHONPATH: [BUNDLED_HARNESS_RELAY_ROOT, inherited.PYTHONPATH].filter(Boolean).join(delimiter),
-        ...(options.egress
-            ? {
-                MAKA_EVAL_EGRESS_REQUIRED: '1',
-                MAKA_EVAL_EGRESS_ALLOWED_HOST: options.egress.allowedHost,
-                MAKA_EVAL_NETWORK_POLICY_PATH: options.egress.networkPolicyPath,
-            }
-            : {}),
-    };
-}
-export function resolvePathWithinRoot(root, path, label) {
-    const resolved = resolve(root, path);
-    assertPathWithinRoot(root, resolved, label);
-    return resolved;
-}
-export async function resolveRealPathWithinRoot(root, path, label) {
-    const resolved = resolvePathWithinRoot(root, path, label);
-    let canonicalRoot;
-    let canonicalPath;
-    try {
-        [canonicalRoot, canonicalPath] = await Promise.all([realpath(root), realpath(resolved)]);
-    }
-    catch (error) {
-        const reason = error instanceof Error ? error.message : String(error);
-        throw new Error(`${label} cannot be resolved: ${reason}`, { cause: error });
-    }
-    assertPathWithinRoot(canonicalRoot, canonicalPath, label);
-    return canonicalPath;
-}
-function assertPathWithinRoot(root, path, label) {
-    const fromRoot = relative(root, path);
-    if (fromRoot === '..' || fromRoot.startsWith(`..${sep}`) || isAbsolute(fromRoot)) {
-        throw new Error(`${label} escapes its source root`);
-    }
-}