privateer-agent 0.15.4 → 0.15.6

package/dist-boot/c-7VHP3FLN.mjs

@@ -0,0 +1,376 @@
+import{createRequire as __pvCR}from"node:module";import{fileURLToPath as __pvF}from"node:url";import{dirname as __pvD}from"node:path";const require=__pvCR(import.meta.url);const __pvUrl=(r)=>new URL(r,import.meta.url).href;const __pvFile=(r)=>__pvF(new URL(r,import.meta.url));
+import {
+  __name
+} from "./c-CN77DCGF.mjs";
+
+// node_modules/pi-subagents/src/runs/shared/herdr-connection.js?ext=pi-subagents
+import { spawn, spawnSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as net from "node:net";
+import * as os from "node:os";
+import * as path from "node:path";
+var MAX_DISCOVERY_BYTES = 256 * 1024;
+var MAX_RPC_BYTES = 4 * 1024 * 1024;
+var SUBSCRIPTION_ACK_TIMEOUT_MS = 15e3;
+var HERDR_REMOTE_PATH = "$HOME/.local/bin:/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin";
+var HERDR_SSH_BASE = ["-T", "-o", "BatchMode=yes", "-o", "NumberOfPasswordPrompts=0", "-o", "StrictHostKeyChecking=yes", "-o", "ConnectTimeout=10", "-o", "ConnectionAttempts=1", "-o", "ForwardAgent=no", "-o", "ExitOnForwardFailure=yes", "-o", "ServerAliveInterval=15", "-o", "ServerAliveCountMax=4", "-o", "SendEnv=-*", "-o", "SetEnv=PI_SUBAGENTS_SSH_GUARD="];
+function hardenedSshEnv(source = process.env) {
+  return { PATH: process.platform === "win32" ? source.PATH : "/usr/bin:/bin:/usr/sbin:/sbin", ...source.SystemRoot ? { SystemRoot: source.SystemRoot } : {}, ...source.WINDIR ? { WINDIR: source.WINDIR } : {} };
+}
+__name(hardenedSshEnv, "hardenedSshEnv");
+function herdrSshArgs(source = process.env) {
+  return [...HERDR_SSH_BASE, ...source.SSH_AUTH_SOCK ? ["-o", `IdentityAgent=${source.SSH_AUTH_SOCK}`] : []];
+}
+__name(herdrSshArgs, "herdrSshArgs");
+var HerdrRpcError = class extends Error {
+  static {
+    __name(this, "HerdrRpcError");
+  }
+  code;
+  requestId;
+  constructor(message, requestId, code) {
+    super(message);
+    this.name = "HerdrRpcError";
+    this.requestId = requestId;
+    this.code = code;
+  }
+};
+var HerdrTransportError = class extends Error {
+  static {
+    __name(this, "HerdrTransportError");
+  }
+  constructor(message, options) {
+    super(message, options);
+    this.name = "HerdrTransportError";
+  }
+};
+function decodeHerdrJsonLine(line) {
+  try {
+    return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(line));
+  } catch {
+    throw new Error("Herdr emitted malformed JSON or UTF-8.");
+  }
+}
+__name(decodeHerdrJsonLine, "decodeHerdrJsonLine");
+function shellQuoteRemote(value) {
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
+__name(shellQuoteRemote, "shellQuoteRemote");
+function remoteShellCommand(script, args = []) {
+  return `sh -c ${shellQuoteRemote(`PATH="${HERDR_REMOTE_PATH}"; export PATH; ${script}`)} sh${args.map((arg) => ` ${shellQuoteRemote(arg)}`).join("")}`;
+}
+__name(remoteShellCommand, "remoteShellCommand");
+function canonicalHerdrSession(session) {
+  return session && session !== "default" ? session : null;
+}
+__name(canonicalHerdrSession, "canonicalHerdrSession");
+function sshEnvCommand(session, command) {
+  const selected = canonicalHerdrSession(session), assignment = selected ? ` HERDR_SESSION=${shellQuoteRemote(selected)}` : "";
+  return `/usr/bin/env -u HERDR_SOCKET_PATH -u HERDR_SESSION${assignment} ${remoteShellCommand(command)}`;
+}
+__name(sshEnvCommand, "sshEnvCommand");
+function runHerdrRemoteCommand(machine, command, options = {}) {
+  return spawnSync(options.sshBin ?? "ssh", [...herdrSshArgs(options.env), machine.target, command], { encoding: "utf8", env: hardenedSshEnv(options.env), timeout: options.timeout ?? 15e3, maxBuffer: options.maxBuffer ?? MAX_DISCOVERY_BYTES, windowsHide: true });
+}
+__name(runHerdrRemoteCommand, "runHerdrRemoteCommand");
+function runHerdrRemoteCommandAsync(machine, command, options = {}) {
+  return new Promise((resolve) => {
+    const child = spawn(options.sshBin ?? "ssh", [...herdrSshArgs(options.env), machine.target, command], { env: hardenedSshEnv(options.env), stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
+    const stdout = [], stderr = [], maxBuffer = options.maxBuffer ?? MAX_DISCOVERY_BYTES;
+    let stdoutBytes = 0, stderrBytes = 0, error, settled = false, escalation;
+    const finish = /* @__PURE__ */ __name((status, spawnError = error) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timer);
+      if (escalation)
+        clearTimeout(escalation);
+      resolve({ status, stdout: Buffer.concat(stdout).toString("utf8"), stderr: Buffer.concat(stderr).toString("utf8"), ...spawnError ? { error: spawnError } : {} });
+    }, "finish");
+    const terminate = /* @__PURE__ */ __name(() => {
+      child.kill("SIGTERM");
+      escalation ??= setTimeout(() => {
+        if (!settled) {
+          child.kill("SIGKILL");
+          finish(child.exitCode ?? null);
+        }
+      }, 1e3);
+      escalation.unref?.();
+    }, "terminate");
+    const collect = /* @__PURE__ */ __name((target, stream) => (chunk) => {
+      const bytes = stream === "stdout" ? stdoutBytes += chunk.byteLength : stderrBytes += chunk.byteLength;
+      if (bytes > maxBuffer) {
+        error ??= new Error(`${stream} maxBuffer length exceeded`);
+        terminate();
+      } else
+        target.push(chunk);
+    }, "collect");
+    child.stdout.on("data", collect(stdout, "stdout"));
+    child.stderr.on("data", collect(stderr, "stderr"));
+    child.once("error", (spawnError) => finish(null, spawnError));
+    child.once("close", (status) => finish(status));
+    const timer = setTimeout(terminate, options.timeout ?? 15e3);
+    timer.unref?.();
+  });
+}
+__name(runHerdrRemoteCommandAsync, "runHerdrRemoteCommandAsync");
+function parseHerdrEndpoint(value, expectedSession) {
+  let parsed;
+  try {
+    parsed = JSON.parse(value);
+  } catch {
+    throw new Error("Remote Herdr endpoint discovery returned malformed JSON.");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+    throw new Error("Remote Herdr endpoint discovery returned no endpoint.");
+  const p = parsed;
+  if (typeof p.socket !== "string" || !path.posix.isAbsolute(p.socket) || typeof p.version !== "string" || typeof p.protocol !== "number")
+    throw new Error("Remote Herdr endpoint discovery returned incomplete identity.");
+  const session = canonicalHerdrSession(typeof p.session === "string" ? p.session : null), expected = canonicalHerdrSession(expectedSession);
+  if (expected !== session)
+    throw new Error(`Remote Herdr session identity mismatch: expected ${expected ?? "default"}, received ${session ?? "default"}.`);
+  if (p.running !== true || p.compatible !== true || p.endpoint_compatible === false)
+    throw new Error("The selected remote Herdr session is stopped or incompatible.");
+  return { socket: p.socket, session, version: p.version, protocol: p.protocol, compatible: true, running: true };
+}
+__name(parseHerdrEndpoint, "parseHerdrEndpoint");
+async function discoverHerdrEndpoint(machine, options = {}) {
+  const discovery = 'herdr_path=$(command -v herdr) || exit 127; case "$herdr_path" in /*/herdr) ;; *) exit 126;; esac; exec "$herdr_path" status server --json';
+  const result = await runHerdrRemoteCommandAsync(machine, sshEnvCommand(machine.session, discovery), { ...options, timeout: 15e3, maxBuffer: MAX_DISCOVERY_BYTES });
+  if (result.error)
+    throw new Error(`Remote Herdr discovery failed: ${result.error.message}`);
+  if (result.status !== 0)
+    throw new Error(`Remote Herdr discovery failed with code ${result.status}: ${(result.stderr || result.stdout).trim()}`);
+  return parseHerdrEndpoint(result.stdout, machine.session);
+}
+__name(discoverHerdrEndpoint, "discoverHerdrEndpoint");
+var SocketRpcClient = class {
+  static {
+    __name(this, "SocketRpcClient");
+  }
+  #socketPath;
+  #subscriptionAckTimeoutMs;
+  #next = 0;
+  constructor(socketPath, subscriptionAckTimeoutMs = SUBSCRIPTION_ACK_TIMEOUT_MS) {
+    this.#socketPath = socketPath;
+    this.#subscriptionAckTimeoutMs = subscriptionAckTimeoutMs;
+  }
+  call(method, params = {}, timeoutMs = 15e3) {
+    return new Promise((resolve, reject) => {
+      const socket = net.createConnection(this.#socketPath);
+      let bytes = 0;
+      let data = Buffer.alloc(0);
+      let finished = false;
+      const id = String(++this.#next);
+      const timer = setTimeout(() => finish(new HerdrTransportError(`Herdr RPC '${method}' timed out.`)), timeoutMs);
+      timer.unref?.();
+      const finish = /* @__PURE__ */ __name((error, value) => {
+        if (finished)
+          return;
+        finished = true;
+        clearTimeout(timer);
+        socket.destroy();
+        error ? reject(error) : resolve(value);
+      }, "finish");
+      socket.on("connect", () => socket.write(`${JSON.stringify({ id, method, params })}
+`));
+      socket.on("data", (chunk) => {
+        bytes += chunk.byteLength;
+        if (bytes > MAX_RPC_BYTES) {
+          finish(new Error("Herdr RPC response exceeded its byte bound."));
+          return;
+        }
+        data = Buffer.concat([data, chunk]);
+        const newline = data.indexOf(10);
+        if (newline < 0)
+          return;
+        let frame;
+        try {
+          frame = decodeHerdrJsonLine(data.subarray(0, newline));
+        } catch {
+          finish(new Error("Herdr RPC returned malformed JSON or UTF-8."));
+          return;
+        }
+        const record = frame;
+        if (record.id !== id) {
+          finish(new Error("Herdr RPC response identity mismatch."));
+          return;
+        }
+        if (record.error)
+          finish(new HerdrRpcError(String(record.error.message ?? "Herdr RPC failed."), id, typeof record.error.code === "string" ? record.error.code : void 0));
+        else
+          finish(void 0, record.result);
+      });
+      socket.on("error", (error) => finish(new HerdrTransportError(error.message, { cause: error })));
+      socket.on("close", () => finish(new HerdrTransportError(`Herdr RPC '${method}' ended before a response.`)));
+    });
+  }
+  async subscribe(subscriptions, listener, onDisconnect) {
+    const socket = net.createConnection(this.#socketPath);
+    const id = String(++this.#next);
+    let buffer = Buffer.alloc(0), bytes = 0, acknowledged = false, intentional = false, notified = false, settled = false;
+    let resolveAck, rejectAck;
+    const acknowledgement = new Promise((resolve, reject) => {
+      resolveAck = resolve;
+      rejectAck = reject;
+    });
+    const failHandshake = /* @__PURE__ */ __name((error) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timer);
+      socket.destroy();
+      rejectAck(error);
+    }, "failHandshake");
+    const disconnect = /* @__PURE__ */ __name((error) => {
+      if (intentional || notified)
+        return;
+      notified = true;
+      if (!acknowledged)
+        failHandshake(error);
+      else
+        onDisconnect?.(error);
+    }, "disconnect");
+    const timer = setTimeout(() => failHandshake(new Error("Herdr subscription acknowledgement timed out.")), this.#subscriptionAckTimeoutMs);
+    timer.unref?.();
+    socket.on("data", (chunk) => {
+      bytes += chunk.byteLength;
+      if (bytes > (acknowledged ? MAX_RPC_BYTES * 32 : MAX_RPC_BYTES)) {
+        disconnect(new Error("Herdr subscription exceeded its byte bound."));
+        socket.destroy();
+        return;
+      }
+      buffer = Buffer.concat([buffer, chunk]);
+      for (; ; ) {
+        const i = buffer.indexOf(10);
+        if (i < 0)
+          break;
+        const line = buffer.subarray(0, i);
+        buffer = buffer.subarray(i + 1);
+        let value;
+        try {
+          value = decodeHerdrJsonLine(line);
+        } catch {
+          disconnect(new Error("Herdr subscription emitted malformed JSON or UTF-8."));
+          socket.destroy();
+          return;
+        }
+        const record = value;
+        if (!acknowledged) {
+          if (record.id === id) {
+            if (record.error) {
+              failHandshake(new HerdrRpcError(String(record.error.message ?? "Herdr subscription failed."), id, typeof record.error.code === "string" ? record.error.code : void 0));
+              return;
+            }
+            if (record.result?.type !== "subscription_started") {
+              failHandshake(new Error("Herdr subscription returned an invalid acknowledgement."));
+              return;
+            }
+            acknowledged = true;
+            settled = true;
+            clearTimeout(timer);
+            resolveAck();
+            continue;
+          }
+          if (record.id === "" && record.error && record.error.code === "invalid_request") {
+            failHandshake(new HerdrRpcError(String(record.error.message ?? "Herdr subscription request was invalid."), "", "invalid_request"));
+            return;
+          }
+          failHandshake(new Error("Herdr subscription emitted an event before acknowledgement."));
+          return;
+        }
+        if (record.error) {
+          disconnect(new HerdrRpcError(String(record.error.message ?? "Herdr subscription failed."), typeof record.id === "string" ? record.id : "", typeof record.error.code === "string" ? record.error.code : void 0));
+          socket.destroy();
+          return;
+        }
+        listener(value);
+      }
+    });
+    socket.on("error", (error) => disconnect(error));
+    socket.on("close", () => disconnect(new Error("Herdr subscription connection was lost.")));
+    socket.on("connect", () => socket.write(`${JSON.stringify({ id, method: "events.subscribe", params: { subscriptions } })}
+`));
+    await acknowledgement;
+    return () => {
+      intentional = true;
+      clearTimeout(timer);
+      socket.destroy();
+    };
+  }
+};
+async function waitForSocket(socketPath, child) {
+  for (let attempt = 0; attempt < 100; attempt++) {
+    if (child.exitCode !== null)
+      throw new Error(`SSH StreamLocal forwarding exited with code ${child.exitCode}.`);
+    try {
+      const stat = fs.lstatSync(socketPath);
+      if (stat.isSocket()) {
+        fs.chmodSync(socketPath, 384);
+        return;
+      }
+    } catch {
+    }
+    await new Promise((resolve) => setTimeout(resolve, 25));
+  }
+  throw new Error("SSH StreamLocal forwarding did not create its local socket.");
+}
+__name(waitForSocket, "waitForSocket");
+async function terminateChild(child) {
+  const wait = /* @__PURE__ */ __name((ms) => child.exitCode !== null || child.signalCode !== null ? Promise.resolve() : Promise.race([new Promise((resolve) => child.once("exit", () => resolve())), new Promise((resolve) => setTimeout(resolve, ms))]), "wait");
+  if (child.exitCode === null && child.signalCode === null)
+    child.kill("SIGTERM");
+  await wait(1e3);
+  if (child.exitCode === null && child.signalCode === null) {
+    child.kill("SIGKILL");
+    await wait(1e3);
+  }
+}
+__name(terminateChild, "terminateChild");
+async function connectHerdrMachine(machine, options = {}) {
+  if (process.platform === "win32")
+    throw new Error("Pane-native Herdr placement requires OpenSSH StreamLocal forwarding and is not supported on Windows.");
+  const endpoint = await discoverHerdrEndpoint(machine, options);
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "pi-subagents-herdr-"));
+  fs.chmodSync(dir, 448);
+  const children = /* @__PURE__ */ new Set();
+  const forward = /* @__PURE__ */ __name(async (remotePath, name) => {
+    if (!path.posix.isAbsolute(remotePath))
+      throw new Error("Remote socket path must be absolute.");
+    const local = path.join(dir, `${name}.sock`);
+    const child = spawn(options.sshBin ?? "ssh", [...herdrSshArgs(options.env), "-N", "-o", "StreamLocalBindUnlink=yes", "-L", `${local}:${remotePath}`, machine.target], { env: hardenedSshEnv(options.env), stdio: "ignore", windowsHide: true });
+    children.add(child);
+    const stop = /* @__PURE__ */ __name(async () => {
+      await terminateChild(child);
+      children.delete(child);
+      try {
+        fs.rmSync(local, { force: true });
+      } catch {
+      }
+    }, "stop");
+    try {
+      await waitForSocket(local, child);
+    } catch (error) {
+      await stop();
+      throw error;
+    }
+    return { socketPath: local, close: stop };
+  }, "forward");
+  const primary = await forward(endpoint.socket, "herdr").catch((error) => {
+    fs.rmSync(dir, { recursive: true, force: true });
+    throw error;
+  });
+  return { endpoint, socketPath: primary.socketPath, client: new SocketRpcClient(primary.socketPath), forwardRemoteSocket: forward, close: /* @__PURE__ */ __name(async () => {
+    await Promise.all([...children].map(terminateChild));
+    children.clear();
+    fs.rmSync(dir, { recursive: true, force: true });
+  }, "close") };
+}
+__name(connectHerdrMachine, "connectHerdrMachine");
+
+export {
+  remoteShellCommand,
+  runHerdrRemoteCommand,
+  runHerdrRemoteCommandAsync,
+  connectHerdrMachine
+};