rovloom 0.6.0 → 0.6.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +2 -2
- package/dist/src/admin/index.js +1 -1
- package/dist/src/{chunk-g27b2gmx.js → chunk-0e9gg4sg.js} +2 -2
- package/dist/src/chunk-1xer1ent.js +102 -0
- package/dist/src/{chunk-863tk45b.js → chunk-41fny9qm.js} +5 -5
- package/dist/src/{chunk-zjzrcc59.js → chunk-59h200cr.js} +139 -7
- package/dist/src/chunk-5w5srj3b.js +93 -0
- package/dist/src/{chunk-d4ejrtjq.js → chunk-6n6b1xpy.js} +1 -1
- package/dist/src/{chunk-ez7d5dac.js → chunk-6w4g9fw8.js} +4 -1
- package/dist/src/{chunk-0dqx2mmz.js → chunk-73aq2qkz.js} +1 -1
- package/dist/src/{chunk-n6wtjyfb.js → chunk-8c9yc0ge.js} +5 -5
- package/dist/src/{chunk-57ayxqnb.js → chunk-8fy8w7ds.js} +2 -23
- package/dist/src/{chunk-2tn0r64b.js → chunk-9h9x79bx.js} +5 -5
- package/dist/src/{chunk-qjh9x872.js → chunk-av31bx1e.js} +1 -1
- package/dist/src/{chunk-0xgpxdgc.js → chunk-bbdtsg4b.js} +7 -5
- package/dist/src/{chunk-q5pgbwb3.js → chunk-e7jgpxkf.js} +2 -2
- package/dist/src/{chunk-zj48jvfe.js → chunk-efty77sb.js} +3 -40
- package/dist/src/{chunk-gyvqqnjb.js → chunk-enj7s8cv.js} +49 -29
- package/dist/src/{chunk-jka7v3wb.js → chunk-ftpy8xx3.js} +311 -23
- package/dist/src/{chunk-zdxww7ms.js → chunk-h3xyq7zk.js} +1 -1
- package/dist/src/{chunk-ttsrctxg.js → chunk-hxmq28pg.js} +9 -7
- package/dist/src/{chunk-s3ydr65k.js → chunk-j59ac0xs.js} +2 -2
- package/dist/src/{chunk-5s2emvww.js → chunk-j6svdqr8.js} +10 -302
- package/dist/src/{chunk-9zkq0kc8.js → chunk-jkzfck98.js} +3 -3
- package/dist/src/{chunk-ssp57p43.js → chunk-m76cmkfy.js} +7 -5
- package/dist/src/{chunk-d2kz25f2.js → chunk-m96mbzcw.js} +674 -308
- package/dist/src/{chunk-yv9px0f5.js → chunk-n3z3jaxy.js} +20 -14
- package/dist/src/{chunk-jf4r0r44.js → chunk-ndj0ay2p.js} +19 -18
- package/dist/src/{chunk-5b8g62kw.js → chunk-pgs9jp6t.js} +61 -179
- package/dist/src/chunk-pksaqt9a.js +25 -0
- package/dist/src/{chunk-wxqhscsw.js → chunk-pnep7yhj.js} +7 -99
- package/dist/src/chunk-qn5xae7g.js +66 -0
- package/dist/src/{chunk-0pewfj89.js → chunk-qp8tgms2.js} +1 -1
- package/dist/src/{chunk-mg0fd6ph.js → chunk-rmgw8h27.js} +10 -8
- package/dist/src/{chunk-gbsbwssz.js → chunk-sf4ztxba.js} +3 -3
- package/dist/src/{chunk-x0td5wn4.js → chunk-shez7hkc.js} +1 -1
- package/dist/src/chunk-sqz614bh.js +30 -0
- package/dist/src/{chunk-09f9q26d.js → chunk-vdwzb63d.js} +2 -2
- package/dist/src/chunk-xtvgm6kf.js +48 -0
- package/dist/src/chunk-y8zm75jt.js +157 -0
- package/dist/src/chunk-yasqw2vj.js +756 -0
- package/dist/src/{chunk-srfbjwtk.js → chunk-z0qmfqvd.js} +3 -3
- package/dist/src/chunk-zm705snh.js +53 -0
- package/dist/src/cli/index.js +29 -28
- package/dist/src/cli/main.js +5 -5
- package/dist/src/connector/herdr/installation.js +4 -4
- package/dist/src/connector/herdr/provider.js +9 -9
- package/dist/src/connector/herdr/runtime.js +7 -7
- package/dist/src/connector/luvus/index.js +7 -6
- package/dist/src/mcp/index.js +16 -15
- package/dist/src/runtime/index.js +16 -15
- package/dist/src/service/index.js +2 -2
- package/dist/src/store.js +4 -4
- package/dist/src/transport/index.js +9 -9
- package/dist/src/webui/index.js +141 -939
- package/package.json +1 -1
- package/dist/src/chunk-0qgk7mhz.js +0 -52
- package/dist/src/chunk-3dvn33c4.js +0 -1299
- package/dist/src/chunk-5j0gj6w2.js +0 -7
- package/dist/src/chunk-vwcntax3.js +0 -228
- package/dist/src/chunk-ytpfmcp1.js +0 -25
- package/dist/src/chunk-zjkjjm81.js +0 -1114
package/README.md
CHANGED
|
@@ -45,12 +45,12 @@ always-on host runs the Gateway. Your AI client reaches the Gateway over MCP and
|
|
|
45
45
|
workstation's real sessions.
|
|
46
46
|
|
|
47
47
|
1. On the Gateway host: `rovloom gateway`.
|
|
48
|
-
2. On the workstation:
|
|
48
|
+
2. On the workstation: paste the join command the Gateway prints (`rovloom connector --join ws://…#code`).
|
|
49
49
|
3. Add the Gateway's MCP URL and Bearer to your AI client and ask it to list the workstation's workspaces.
|
|
50
50
|
|
|
51
51
|
## CLI language
|
|
52
52
|
|
|
53
|
-
CLI output (help,
|
|
53
|
+
CLI output (help, join messages, status hints) is English by default. Set `ROVLOOM_LANG=zh-CN`
|
|
54
54
|
to switch to Simplified Chinese; without it the CLI stays in English regardless of the system
|
|
55
55
|
locale (`LC_ALL`/`LANG` have no effect). Error and status codes (`config_valid`,
|
|
56
56
|
`pairing_required`, …) are stable identifiers and never change with the language. The management
|
package/dist/src/admin/index.js
CHANGED
|
@@ -2,8 +2,8 @@
|
|
|
2
2
|
import {
|
|
3
3
|
parseServiceCommand2,
|
|
4
4
|
handleServiceCommand2
|
|
5
|
-
} from "./chunk-
|
|
6
|
-
import"./chunk-
|
|
5
|
+
} from "./chunk-shez7hkc.js";
|
|
6
|
+
import"./chunk-pgs9jp6t.js";
|
|
7
7
|
export {
|
|
8
8
|
handleServiceCommand2 as handleServiceCommand,
|
|
9
9
|
parseServiceCommand2 as parseServiceCommand
|
|
@@ -0,0 +1,102 @@
|
|
|
1
|
+
// @bun
|
|
2
|
+
import {
|
|
3
|
+
boundedJson2
|
|
4
|
+
} from "./chunk-qt9m2kg2.js";
|
|
5
|
+
import {
|
|
6
|
+
readRuntimeJson
|
|
7
|
+
} from "./chunk-z7kkfrgz.js";
|
|
8
|
+
import {
|
|
9
|
+
CliError2
|
|
10
|
+
} from "./chunk-hpzr94hm.js";
|
|
11
|
+
import {
|
|
12
|
+
privatePath,
|
|
13
|
+
readPrivateBytes
|
|
14
|
+
} from "./chunk-0y5542k8.js";
|
|
15
|
+
|
|
16
|
+
// src/cli/setup-files.ts
|
|
17
|
+
import {
|
|
18
|
+
closeSync,
|
|
19
|
+
fsyncSync,
|
|
20
|
+
fchmodSync,
|
|
21
|
+
linkSync,
|
|
22
|
+
statSync,
|
|
23
|
+
openSync,
|
|
24
|
+
renameSync,
|
|
25
|
+
unlinkSync,
|
|
26
|
+
writeFileSync
|
|
27
|
+
} from "fs";
|
|
28
|
+
import { createHash, randomUUID } from "crypto";
|
|
29
|
+
import { dirname, join } from "path";
|
|
30
|
+
function setupFileStamp(path) {
|
|
31
|
+
const bytes = readPrivateBytes(path, 16777216);
|
|
32
|
+
try {
|
|
33
|
+
return createHash("sha256").update(bytes).digest("hex");
|
|
34
|
+
} finally {
|
|
35
|
+
bytes.fill(0);
|
|
36
|
+
}
|
|
37
|
+
}
|
|
38
|
+
function writeSetupFile(path, bytes, replace = false, expectedStamp) {
|
|
39
|
+
privatePath(path);
|
|
40
|
+
const previous = replace ? expectedStamp ?? setupFileStamp(path) : undefined;
|
|
41
|
+
if (replace && setupFileStamp(path) !== previous) {
|
|
42
|
+
throw new CliError2("config_changed");
|
|
43
|
+
}
|
|
44
|
+
const temporary = join(dirname(path), ".rovloom-setup-" + randomUUID() + ".tmp");
|
|
45
|
+
let fd;
|
|
46
|
+
let created = false;
|
|
47
|
+
try {
|
|
48
|
+
const mode = replace ? statSync(path).mode & 511 : 384;
|
|
49
|
+
fd = openSync(temporary, "wx", mode);
|
|
50
|
+
created = true;
|
|
51
|
+
if (replace && process.platform !== "win32") {
|
|
52
|
+
fchmodSync(fd, mode);
|
|
53
|
+
}
|
|
54
|
+
writeFileSync(fd, bytes);
|
|
55
|
+
fsyncSync(fd);
|
|
56
|
+
const complete = fd;
|
|
57
|
+
fd = undefined;
|
|
58
|
+
closeSync(complete);
|
|
59
|
+
if (replace) {
|
|
60
|
+
if (setupFileStamp(path) !== previous) {
|
|
61
|
+
throw new CliError2("config_changed");
|
|
62
|
+
}
|
|
63
|
+
renameSync(temporary, path);
|
|
64
|
+
} else {
|
|
65
|
+
linkSync(temporary, path);
|
|
66
|
+
unlinkSync(temporary);
|
|
67
|
+
}
|
|
68
|
+
created = false;
|
|
69
|
+
} catch (error) {
|
|
70
|
+
if (error instanceof CliError2) {
|
|
71
|
+
throw error;
|
|
72
|
+
}
|
|
73
|
+
throw new CliError2("config_unreadable");
|
|
74
|
+
} finally {
|
|
75
|
+
try {
|
|
76
|
+
if (fd !== undefined) {
|
|
77
|
+
closeSync(fd);
|
|
78
|
+
}
|
|
79
|
+
} finally {
|
|
80
|
+
if (created) {
|
|
81
|
+
unlinkSync(temporary);
|
|
82
|
+
}
|
|
83
|
+
}
|
|
84
|
+
}
|
|
85
|
+
}
|
|
86
|
+
function readSetupJson(path, maximum = 16384) {
|
|
87
|
+
try {
|
|
88
|
+
return readRuntimeJson(path, maximum);
|
|
89
|
+
} catch (error) {
|
|
90
|
+
if (error instanceof CliError2 && error.code === "backend_unavailable") {
|
|
91
|
+
return;
|
|
92
|
+
}
|
|
93
|
+
throw error;
|
|
94
|
+
}
|
|
95
|
+
}
|
|
96
|
+
function writeSetupJson(path, value, replace = false, maximum = 16384) {
|
|
97
|
+
writeSetupFile(path, boundedJson2(value, maximum), replace);
|
|
98
|
+
}
|
|
99
|
+
|
|
100
|
+
export { setupFileStamp, writeSetupFile, readSetupJson, writeSetupJson };
|
|
101
|
+
|
|
102
|
+
//# debugId=F153F55644C9BB1764756E2164756E21
|
|
@@ -10,9 +10,6 @@ import {
|
|
|
10
10
|
import {
|
|
11
11
|
compileHerdrSchemas2
|
|
12
12
|
} from "./chunk-5h82060k.js";
|
|
13
|
-
import {
|
|
14
|
-
ConnectorCapacityError
|
|
15
|
-
} from "./chunk-57ayxqnb.js";
|
|
16
13
|
import {
|
|
17
14
|
HerdrLocalError,
|
|
18
15
|
readHerdrPeer,
|
|
@@ -23,7 +20,10 @@ import {
|
|
|
23
20
|
measureHerdrInstallation,
|
|
24
21
|
verifyHerdrInstallation,
|
|
25
22
|
isHerdrInstanceBinding
|
|
26
|
-
} from "./chunk-
|
|
23
|
+
} from "./chunk-e7jgpxkf.js";
|
|
24
|
+
import {
|
|
25
|
+
ConnectorCapacityError
|
|
26
|
+
} from "./chunk-pksaqt9a.js";
|
|
27
27
|
|
|
28
28
|
// src/connector/herdr/io.ts
|
|
29
29
|
import { spawn } from "child_process";
|
|
@@ -430,4 +430,4 @@ function createHerdrHostServices2(installation, services) {
|
|
|
430
430
|
|
|
431
431
|
export { isStoppedHerdrCommandCancellation, checkHerdrSignal, herdrDeadline, runHerdrCommand, withHerdrSocket, exchangeHerdr, HerdrInstallation2, createHerdrHostServices2 };
|
|
432
432
|
|
|
433
|
-
//# debugId=
|
|
433
|
+
//# debugId=C2DD57901BB8C75064756E2164756E21
|
|
@@ -25,16 +25,16 @@ import {
|
|
|
25
25
|
decodeWireFrame2,
|
|
26
26
|
discardFencedWireFrame2
|
|
27
27
|
} from "./chunk-qt9m2kg2.js";
|
|
28
|
-
import {
|
|
29
|
-
LuvusAdapterError2,
|
|
30
|
-
ConnectorCapacityError
|
|
31
|
-
} from "./chunk-57ayxqnb.js";
|
|
32
28
|
import {
|
|
33
29
|
HerdrLocalError
|
|
34
|
-
} from "./chunk-
|
|
30
|
+
} from "./chunk-e7jgpxkf.js";
|
|
35
31
|
import {
|
|
36
32
|
createLuvusWireAdapter2
|
|
37
33
|
} from "./chunk-hz8pm6hz.js";
|
|
34
|
+
import {
|
|
35
|
+
LuvusAdapterError2,
|
|
36
|
+
ConnectorCapacityError
|
|
37
|
+
} from "./chunk-pksaqt9a.js";
|
|
38
38
|
|
|
39
39
|
// src/transport/gateway.ts
|
|
40
40
|
import { randomUUID as randomUUID2 } from "crypto";
|
|
@@ -1795,6 +1795,138 @@ function createConnector2(options) {
|
|
|
1795
1795
|
}
|
|
1796
1796
|
};
|
|
1797
1797
|
}
|
|
1798
|
+
// src/transport/pairing.ts
|
|
1799
|
+
class PairingAdmin2 {
|
|
1800
|
+
store;
|
|
1801
|
+
host;
|
|
1802
|
+
constructor(store, host) {
|
|
1803
|
+
this.store = store;
|
|
1804
|
+
this.host = host;
|
|
1805
|
+
}
|
|
1806
|
+
register(name) {
|
|
1807
|
+
if (this.host.authorize("register") !== undefined) {
|
|
1808
|
+
fail2("pairing_admin_forbidden");
|
|
1809
|
+
}
|
|
1810
|
+
return this.store.register(name);
|
|
1811
|
+
}
|
|
1812
|
+
issue(machine, ttlMs = 600000) {
|
|
1813
|
+
if (this.host.authorize("enroll", machine) !== undefined) {
|
|
1814
|
+
fail2("pairing_admin_forbidden");
|
|
1815
|
+
}
|
|
1816
|
+
return this.store.issueEnrollment(machine, ttlMs);
|
|
1817
|
+
}
|
|
1818
|
+
}
|
|
1819
|
+
// src/transport/custody.ts
|
|
1820
|
+
import { randomUUID as randomUUID4 } from "crypto";
|
|
1821
|
+
function createPairingDelivery2(options) {
|
|
1822
|
+
const timeout = options.timeout_ms ?? 5000;
|
|
1823
|
+
const concurrency = options.concurrency ?? 4;
|
|
1824
|
+
if (!Number.isSafeInteger(timeout) || timeout < 1 || timeout > 30000 || !Number.isSafeInteger(concurrency) || concurrency < 1 || concurrency > 64) {
|
|
1825
|
+
fail2("pairing_limit");
|
|
1826
|
+
}
|
|
1827
|
+
const pending = new Map;
|
|
1828
|
+
let closed = false;
|
|
1829
|
+
async function transfer(machine, operation, issue) {
|
|
1830
|
+
if (closed || pending.size >= concurrency) {
|
|
1831
|
+
fail2("pairing_unavailable");
|
|
1832
|
+
}
|
|
1833
|
+
id2(machine);
|
|
1834
|
+
const deliveryId = randomUUID4();
|
|
1835
|
+
let sink;
|
|
1836
|
+
try {
|
|
1837
|
+
sink = options.authorizeChannel({ machine_id: machine, delivery_id: deliveryId, operation });
|
|
1838
|
+
} catch {
|
|
1839
|
+
fail2("pairing_channel_forbidden");
|
|
1840
|
+
}
|
|
1841
|
+
if (!sink || typeof sink.deliver !== "function" || typeof sink.close !== "function") {
|
|
1842
|
+
fail2("pairing_channel_forbidden");
|
|
1843
|
+
}
|
|
1844
|
+
if (closed) {
|
|
1845
|
+
try {
|
|
1846
|
+
sink.close();
|
|
1847
|
+
} catch {}
|
|
1848
|
+
fail2("pairing_unavailable");
|
|
1849
|
+
}
|
|
1850
|
+
const controller = new AbortController;
|
|
1851
|
+
let rejectAbort;
|
|
1852
|
+
const aborted = new Promise((_, reject) => {
|
|
1853
|
+
rejectAbort = reject;
|
|
1854
|
+
});
|
|
1855
|
+
const closeSink = () => {
|
|
1856
|
+
controller.abort();
|
|
1857
|
+
try {
|
|
1858
|
+
sink.close();
|
|
1859
|
+
} catch {}
|
|
1860
|
+
};
|
|
1861
|
+
const abort = () => {
|
|
1862
|
+
closeSink();
|
|
1863
|
+
rejectAbort(new Error("pairing_delivery_unknown"));
|
|
1864
|
+
};
|
|
1865
|
+
const timer = setTimeout(abort, timeout);
|
|
1866
|
+
pending.set(deliveryId, { timer, abort });
|
|
1867
|
+
let installedDigest;
|
|
1868
|
+
let sending = false;
|
|
1869
|
+
try {
|
|
1870
|
+
const credential = issue();
|
|
1871
|
+
installedDigest = hash2(credential.credential);
|
|
1872
|
+
const generation = credential.recovery_generation;
|
|
1873
|
+
const revision = options.identities.credentialRevision(machine);
|
|
1874
|
+
sending = true;
|
|
1875
|
+
const delivered = Promise.resolve().then(() => sink.deliver(structuredClone(credential), controller.signal, { delivery_id: deliveryId, revision })).finally(() => {
|
|
1876
|
+
clearTimeout(timer);
|
|
1877
|
+
pending.delete(deliveryId);
|
|
1878
|
+
});
|
|
1879
|
+
const ack = await Promise.race([delivered, aborted]);
|
|
1880
|
+
if (!ack || ack.delivery_id !== deliveryId || ack.revision !== revision || ack.machine_id !== machine || ack.recovery_generation !== generation) {
|
|
1881
|
+
fail2("pairing_ack_mismatch");
|
|
1882
|
+
}
|
|
1883
|
+
if (closed || controller.signal.aborted) {
|
|
1884
|
+
fail2("pairing_delivery_unknown");
|
|
1885
|
+
}
|
|
1886
|
+
return { machine_id: machine, delivery_id: deliveryId, state: "delivered" };
|
|
1887
|
+
} catch {
|
|
1888
|
+
if (installedDigest !== undefined) {
|
|
1889
|
+
try {
|
|
1890
|
+
options.identities.rejectDelivery(machine, installedDigest);
|
|
1891
|
+
} catch {}
|
|
1892
|
+
}
|
|
1893
|
+
return fail2("pairing_delivery_unknown");
|
|
1894
|
+
} finally {
|
|
1895
|
+
clearTimeout(timer);
|
|
1896
|
+
closeSink();
|
|
1897
|
+
if (!sending) {
|
|
1898
|
+
pending.delete(deliveryId);
|
|
1899
|
+
}
|
|
1900
|
+
}
|
|
1901
|
+
}
|
|
1902
|
+
return {
|
|
1903
|
+
async redeem(request) {
|
|
1904
|
+
if (typeof request.enrollment !== "string" || !/^[A-Za-z0-9_-]{32,256}$/.test(request.enrollment)) {
|
|
1905
|
+
fail2("invalid_enrollment");
|
|
1906
|
+
}
|
|
1907
|
+
return transfer(request.registration_id, "enroll", () => {
|
|
1908
|
+
const device = options.backend.redeem(request.enrollment);
|
|
1909
|
+
if (device.machine_id !== request.registration_id) {
|
|
1910
|
+
fail2("pairing_target_mismatch");
|
|
1911
|
+
}
|
|
1912
|
+
return { ...device, recovery_generation: options.backend.generation() };
|
|
1913
|
+
});
|
|
1914
|
+
},
|
|
1915
|
+
status() {
|
|
1916
|
+
return { closed, pending: pending.size };
|
|
1917
|
+
},
|
|
1918
|
+
close() {
|
|
1919
|
+
if (closed) {
|
|
1920
|
+
return;
|
|
1921
|
+
}
|
|
1922
|
+
closed = true;
|
|
1923
|
+
for (const item of pending.values()) {
|
|
1924
|
+
clearTimeout(item.timer);
|
|
1925
|
+
item.abort();
|
|
1926
|
+
}
|
|
1927
|
+
}
|
|
1928
|
+
};
|
|
1929
|
+
}
|
|
1798
1930
|
// src/transport/lifecycle.ts
|
|
1799
1931
|
function createDeviceLifecycle2(store) {
|
|
1800
1932
|
function authenticate(machine, generation, credential) {
|
|
@@ -1864,6 +1996,6 @@ function createDeviceLifecycleAdapter2(lifecycle, channels, services) {
|
|
|
1864
1996
|
};
|
|
1865
1997
|
return { backend, adapter: createLuvusWireAdapter2(backend) };
|
|
1866
1998
|
}
|
|
1867
|
-
export { closeSession, OFFER, providerHealth, ready, ReceiveWindow, ChannelRegistry2, createGateway2, createConnector2, createDeviceLifecycle2, createDeviceLifecycleAdapter2 };
|
|
1999
|
+
export { closeSession, OFFER, providerHealth, ready, ReceiveWindow, ChannelRegistry2, createGateway2, createConnector2, PairingAdmin2, createPairingDelivery2, createDeviceLifecycle2, createDeviceLifecycleAdapter2 };
|
|
1868
2000
|
|
|
1869
|
-
//# debugId=
|
|
2001
|
+
//# debugId=1F0ADD524CEDDA6964756E2164756E21
|
|
@@ -0,0 +1,93 @@
|
|
|
1
|
+
// @bun
|
|
2
|
+
import {
|
|
3
|
+
fail2,
|
|
4
|
+
object2,
|
|
5
|
+
fields2,
|
|
6
|
+
id2,
|
|
7
|
+
boundedJson2
|
|
8
|
+
} from "./chunk-qt9m2kg2.js";
|
|
9
|
+
import {
|
|
10
|
+
privatePath,
|
|
11
|
+
privateFile,
|
|
12
|
+
createPrivate,
|
|
13
|
+
syncParentDirectory
|
|
14
|
+
} from "./chunk-0y5542k8.js";
|
|
15
|
+
|
|
16
|
+
// src/transport/credentials.ts
|
|
17
|
+
import { constants, closeSync, fstatSync, openSync, readFileSync, renameSync, unlinkSync } from "fs";
|
|
18
|
+
import { randomUUID } from "crypto";
|
|
19
|
+
function validate(value) {
|
|
20
|
+
const v = object2(value);
|
|
21
|
+
fields2(v, ["machine_id", "recovery_generation", "credential"]);
|
|
22
|
+
id2(v.machine_id);
|
|
23
|
+
id2(v.recovery_generation);
|
|
24
|
+
if (typeof v.credential !== "string" || !/^[A-Za-z0-9_-]{32,256}$/.test(v.credential)) {
|
|
25
|
+
fail2("invalid_device_credential");
|
|
26
|
+
}
|
|
27
|
+
return v;
|
|
28
|
+
}
|
|
29
|
+
function saveCredential2(path, input, replace = false) {
|
|
30
|
+
privatePath(path);
|
|
31
|
+
const raw = boundedJson2(validate(input), 4096);
|
|
32
|
+
if (!replace) {
|
|
33
|
+
createPrivate(path, raw);
|
|
34
|
+
syncParentDirectory(path, true);
|
|
35
|
+
return;
|
|
36
|
+
}
|
|
37
|
+
privateFile(path);
|
|
38
|
+
const temporary = path + "." + randomUUID();
|
|
39
|
+
try {
|
|
40
|
+
createPrivate(temporary, raw);
|
|
41
|
+
renameSync(temporary, path);
|
|
42
|
+
syncParentDirectory(path, true);
|
|
43
|
+
} finally {
|
|
44
|
+
try {
|
|
45
|
+
unlinkSync(temporary);
|
|
46
|
+
} catch {}
|
|
47
|
+
}
|
|
48
|
+
}
|
|
49
|
+
function createFileCredentialSink2(path, expected, replace = false) {
|
|
50
|
+
privatePath(path);
|
|
51
|
+
id2(expected.machine_id);
|
|
52
|
+
id2(expected.recovery_generation);
|
|
53
|
+
let closed = false;
|
|
54
|
+
let used = false;
|
|
55
|
+
return {
|
|
56
|
+
async deliver(input, signal, context) {
|
|
57
|
+
if (closed || used || signal.aborted) {
|
|
58
|
+
fail2("credential_sink_closed");
|
|
59
|
+
}
|
|
60
|
+
if (input.machine_id !== expected.machine_id || input.recovery_generation !== expected.recovery_generation) {
|
|
61
|
+
fail2("credential_sink_mismatch");
|
|
62
|
+
}
|
|
63
|
+
used = true;
|
|
64
|
+
saveCredential2(path, input, replace);
|
|
65
|
+
return { ...context, machine_id: input.machine_id, recovery_generation: input.recovery_generation };
|
|
66
|
+
},
|
|
67
|
+
close() {
|
|
68
|
+
closed = true;
|
|
69
|
+
}
|
|
70
|
+
};
|
|
71
|
+
}
|
|
72
|
+
function loadCredential2(path) {
|
|
73
|
+
privatePath(path);
|
|
74
|
+
privateFile(path);
|
|
75
|
+
const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
|
|
76
|
+
try {
|
|
77
|
+
const st = fstatSync(fd);
|
|
78
|
+
if (!st.isFile() || st.nlink !== 1 || process.platform !== "win32" && ((st.mode & 511) !== 384 || st.uid !== process.getuid?.()) || st.size > 4096) {
|
|
79
|
+
fail2("unsafe_storage_file");
|
|
80
|
+
}
|
|
81
|
+
try {
|
|
82
|
+
return validate(JSON.parse(readFileSync(fd, "utf8")));
|
|
83
|
+
} catch {
|
|
84
|
+
fail2("invalid_device_credential");
|
|
85
|
+
}
|
|
86
|
+
} finally {
|
|
87
|
+
closeSync(fd);
|
|
88
|
+
}
|
|
89
|
+
}
|
|
90
|
+
|
|
91
|
+
export { saveCredential2, createFileCredentialSink2, loadCredential2 };
|
|
92
|
+
|
|
93
|
+
//# debugId=CE63F3C4843F109E64756E2164756E21
|
|
@@ -973,6 +973,9 @@ function createManagementHandler2(options) {
|
|
|
973
973
|
"tokens_create",
|
|
974
974
|
"tokens_delete",
|
|
975
975
|
"tokens_rotate",
|
|
976
|
+
"pairing_codes_list",
|
|
977
|
+
"pairing_codes_create",
|
|
978
|
+
"pairing_codes_revoke",
|
|
976
979
|
"pairings_list",
|
|
977
980
|
"pairings_delete",
|
|
978
981
|
"devices_delete"
|
|
@@ -1193,4 +1196,4 @@ function createManagementSessionAdapter2(options) {
|
|
|
1193
1196
|
}
|
|
1194
1197
|
export { createManagementReadHandler2, startManagementReadListener2, startManagementListener2, loadManagementAssets2, ManagementServiceError2, StoreManagementWriteService2, createManagementHandler2, createManagementSessionAdapter2 };
|
|
1195
1198
|
|
|
1196
|
-
//# debugId=
|
|
1199
|
+
//# debugId=77B098389207C26664756E2164756E21
|
|
@@ -14,11 +14,11 @@ import {
|
|
|
14
14
|
assertUsage,
|
|
15
15
|
GATEWAY_LOCK_FORMAT2,
|
|
16
16
|
Store2
|
|
17
|
-
} from "./chunk-
|
|
18
|
-
import"./chunk-
|
|
17
|
+
} from "./chunk-av31bx1e.js";
|
|
18
|
+
import"./chunk-vdwzb63d.js";
|
|
19
19
|
import {
|
|
20
20
|
cliMessages2
|
|
21
|
-
} from "./chunk-
|
|
21
|
+
} from "./chunk-pgs9jp6t.js";
|
|
22
22
|
import {
|
|
23
23
|
readRuntimeConfig2
|
|
24
24
|
} from "./chunk-bspzg8er.js";
|
|
@@ -36,8 +36,8 @@ import {
|
|
|
36
36
|
import"./chunk-3nnahj0j.js";
|
|
37
37
|
import {
|
|
38
38
|
lockContent
|
|
39
|
-
} from "./chunk-
|
|
40
|
-
import"./chunk-
|
|
39
|
+
} from "./chunk-h3xyq7zk.js";
|
|
40
|
+
import"./chunk-qp8tgms2.js";
|
|
41
41
|
import {
|
|
42
42
|
privatePath,
|
|
43
43
|
databasePath,
|
|
@@ -3,27 +3,6 @@ import {
|
|
|
3
3
|
fail2
|
|
4
4
|
} from "./chunk-qt9m2kg2.js";
|
|
5
5
|
|
|
6
|
-
// src/connector/luvus/types.ts
|
|
7
|
-
class LuvusAdapterError2 extends Error {
|
|
8
|
-
code;
|
|
9
|
-
outcome;
|
|
10
|
-
constructor(code, outcome = "not_dispatched") {
|
|
11
|
-
super(code);
|
|
12
|
-
this.code = code;
|
|
13
|
-
this.outcome = outcome;
|
|
14
|
-
this.name = "LuvusAdapterError";
|
|
15
|
-
}
|
|
16
|
-
}
|
|
17
|
-
|
|
18
|
-
// src/connector/capacity.ts
|
|
19
|
-
class ConnectorCapacityError extends LuvusAdapterError2 {
|
|
20
|
-
capacity;
|
|
21
|
-
constructor(resource, reclaimAt) {
|
|
22
|
-
super(resource.startsWith("claim_") ? "claim_capacity" : "connector_attempt_capacity");
|
|
23
|
-
this.capacity = Object.freeze({ resource, reclaim_at: reclaimAt });
|
|
24
|
-
}
|
|
25
|
-
}
|
|
26
|
-
|
|
27
6
|
// src/connector/local/linux-peer.ts
|
|
28
7
|
import { createRequire } from "module";
|
|
29
8
|
import { Socket } from "net";
|
|
@@ -179,6 +158,6 @@ function assertTerminalExecutionAllowed(kind, request, enabled = false) {
|
|
|
179
158
|
}
|
|
180
159
|
}
|
|
181
160
|
|
|
182
|
-
export {
|
|
161
|
+
export { readLinuxPeer, pinTerminalExecution, terminalExecutionCatalog, assertTerminalExecutionAllowed };
|
|
183
162
|
|
|
184
|
-
//# debugId=
|
|
163
|
+
//# debugId=190A991502F4F00A64756E2164756E21
|
|
@@ -27,7 +27,7 @@ import {
|
|
|
27
27
|
ConnectorAttemptBook2,
|
|
28
28
|
createConnectorAdmissionBackend2,
|
|
29
29
|
connectorAdmissionAdapter
|
|
30
|
-
} from "./chunk-
|
|
30
|
+
} from "./chunk-6n6b1xpy.js";
|
|
31
31
|
import {
|
|
32
32
|
compileHerdrSchemas2
|
|
33
33
|
} from "./chunk-5h82060k.js";
|
|
@@ -35,11 +35,11 @@ import {
|
|
|
35
35
|
HerdrLocalError,
|
|
36
36
|
inspectHerdrPath,
|
|
37
37
|
pinHerdrConfig
|
|
38
|
-
} from "./chunk-
|
|
38
|
+
} from "./chunk-e7jgpxkf.js";
|
|
39
39
|
import {
|
|
40
40
|
HerdrInstallation2,
|
|
41
41
|
createHerdrHostServices2
|
|
42
|
-
} from "./chunk-
|
|
42
|
+
} from "./chunk-41fny9qm.js";
|
|
43
43
|
import {
|
|
44
44
|
createHerdrGatewaySourceOwner,
|
|
45
45
|
persistentHerdrBackend2,
|
|
@@ -48,13 +48,13 @@ import {
|
|
|
48
48
|
import {
|
|
49
49
|
createHerdrWireAdapter,
|
|
50
50
|
createHerdrRuntime2
|
|
51
|
-
} from "./chunk-
|
|
51
|
+
} from "./chunk-hxmq28pg.js";
|
|
52
52
|
import {
|
|
53
53
|
describeHerdrContract2
|
|
54
54
|
} from "./chunk-5svt6rwr.js";
|
|
55
55
|
import {
|
|
56
56
|
LuvusDispatchClaims2
|
|
57
|
-
} from "./chunk-
|
|
57
|
+
} from "./chunk-sf4ztxba.js";
|
|
58
58
|
import {
|
|
59
59
|
privateFile,
|
|
60
60
|
readPrivateBytes
|
|
@@ -29,17 +29,19 @@ import {
|
|
|
29
29
|
createLuvusWireAdapter2
|
|
30
30
|
} from "./chunk-hz8pm6hz.js";
|
|
31
31
|
import {
|
|
32
|
-
LuvusAdapterError2,
|
|
33
|
-
ConnectorCapacityError,
|
|
34
32
|
readLinuxPeer,
|
|
35
33
|
pinTerminalExecution,
|
|
36
34
|
assertTerminalExecutionAllowed
|
|
37
|
-
} from "./chunk-
|
|
35
|
+
} from "./chunk-8fy8w7ds.js";
|
|
38
36
|
import {
|
|
39
37
|
macosPeer,
|
|
40
38
|
windowsInspectPath,
|
|
41
39
|
windowsPipeServerPid
|
|
42
|
-
} from "./chunk-
|
|
40
|
+
} from "./chunk-vdwzb63d.js";
|
|
41
|
+
import {
|
|
42
|
+
LuvusAdapterError2,
|
|
43
|
+
ConnectorCapacityError
|
|
44
|
+
} from "./chunk-pksaqt9a.js";
|
|
43
45
|
import {
|
|
44
46
|
agentSearchPath
|
|
45
47
|
} from "./chunk-3nnahj0j.js";
|
|
@@ -1191,4 +1193,4 @@ function readLuvusPeer2(socket, endpoint) {
|
|
|
1191
1193
|
}
|
|
1192
1194
|
export { createProviderResultAccess2, WINDOWS_PIPE, LUVUS_ENDPOINT_TRANSPORT, localLimits, withPrivateUmask, pinConfig, measureLuvusInstallation, verifyInstallation, childEnvironment, inspectEndpoint, recheckEndpoint, aborted, deadline, runFixedProcess, runSocket, parseRpcFrame, LuvusRpcAdapter2, createLuvusCatalog2, createLuvusResultAccess2, readLinuxLuvusPeer2, readWindowsLuvusPeer2, readMacosLuvusPeer2, readLuvusPeer2 };
|
|
1193
1195
|
|
|
1194
|
-
//# debugId=
|
|
1196
|
+
//# debugId=E452FD0D21C4480664756E2164756E21
|
|
@@ -12,11 +12,11 @@ import {
|
|
|
12
12
|
windowsInspectPath,
|
|
13
13
|
windowsPipeServerPid,
|
|
14
14
|
windowsProcessFacts
|
|
15
|
-
} from "./chunk-
|
|
15
|
+
} from "./chunk-vdwzb63d.js";
|
|
16
16
|
import {
|
|
17
17
|
readLinuxPeer,
|
|
18
18
|
pinTerminalExecution
|
|
19
|
-
} from "./chunk-
|
|
19
|
+
} from "./chunk-8fy8w7ds.js";
|
|
20
20
|
import {
|
|
21
21
|
agentSearchPath
|
|
22
22
|
} from "./chunk-3nnahj0j.js";
|
|
@@ -1,9 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
2
|
import {
|
|
3
|
-
GatewayError2
|
|
4
|
-
} from "./chunk-d71r315c.js";
|
|
5
|
-
import {
|
|
6
|
-
createNativeValidator2,
|
|
7
3
|
LUVUS_OPERATION_READ,
|
|
8
4
|
LUVUS_OPERATION_WRITE,
|
|
9
5
|
luvusMethod2
|
|
@@ -15,7 +11,7 @@ import {
|
|
|
15
11
|
} from "./chunk-qt9m2kg2.js";
|
|
16
12
|
import {
|
|
17
13
|
LuvusAdapterError2
|
|
18
|
-
} from "./chunk-
|
|
14
|
+
} from "./chunk-pksaqt9a.js";
|
|
19
15
|
|
|
20
16
|
// src/runtime/luvus-operations.ts
|
|
21
17
|
var conditional = new Set(["pane.list", "agent.prompt", "agent.send", "agent.wait", "agent.keys"]);
|
|
@@ -269,39 +265,6 @@ function validateLuvusOperationParams2(method, input) {
|
|
|
269
265
|
}
|
|
270
266
|
}
|
|
271
267
|
|
|
272
|
-
|
|
273
|
-
class NativeRequestPreflightError extends GatewayError2 {
|
|
274
|
-
outcome = "not_dispatched";
|
|
275
|
-
constructor() {
|
|
276
|
-
super("native_request_invalid");
|
|
277
|
-
}
|
|
278
|
-
}
|
|
279
|
-
function createLuvusRequestPreflight(contract) {
|
|
280
|
-
const validator = createNativeValidator2(contract);
|
|
281
|
-
return (request) => {
|
|
282
|
-
const checked = validator.checkRequestShape(request);
|
|
283
|
-
if (!checked.ok) {
|
|
284
|
-
if (checked.error.code === "native_request_invalid") {
|
|
285
|
-
throw new NativeRequestPreflightError;
|
|
286
|
-
}
|
|
287
|
-
throw new GatewayError2(checked.error.code);
|
|
288
|
-
}
|
|
289
|
-
};
|
|
290
|
-
}
|
|
291
|
-
function luvusValidation(kind, request, options) {
|
|
292
|
-
if (kind !== "luvus" || !luvusOperationDescriptor2(request.method)) {
|
|
293
|
-
return options;
|
|
294
|
-
}
|
|
295
|
-
const required = luvusOperationValidation2(request.method);
|
|
296
|
-
if (options.validation === undefined) {
|
|
297
|
-
return { ...options, validation: required };
|
|
298
|
-
}
|
|
299
|
-
if (options.validation !== required) {
|
|
300
|
-
throw new NativeRequestPreflightError;
|
|
301
|
-
}
|
|
302
|
-
return options;
|
|
303
|
-
}
|
|
304
|
-
|
|
305
|
-
export { LUVUS_OPERATION_METHODS2, luvusOperationDescriptor2, luvusOperationValidation2, validateLuvusOperationParams2, NativeRequestPreflightError, createLuvusRequestPreflight, luvusValidation };
|
|
268
|
+
export { LUVUS_OPERATION_METHODS2, luvusOperationDescriptor2, luvusOperationValidation2, validateLuvusOperationParams2 };
|
|
306
269
|
|
|
307
|
-
//# debugId=
|
|
270
|
+
//# debugId=115949A0A756E47E64756E2164756E21
|