stim 1.15.0 → 1.16.0

package/dist/hosted-macos-DwowNU7W.mjs

@@ -1,447 +0,0 @@
-import { t as getExecutor } from "./exec-CaErVv7t.mjs";
-import { r as createNdjsonWriter } from "./ndjson-CDY9IkVC.mjs";
-import { C as workspaceLogsDir } from "./workspace-state-CL2V2Ons.mjs";
-import { l as phaseLine } from "./command-output-CliHHn7a.mjs";
-import { t as macosDir } from "./state-BxCgeTQu.mjs";
-import { t as BuildConnection, v as parseMachine$1, y as pinnedEndpoint$1 } from "./client-C2IS36Qf.mjs";
-import { t as configuredMachines } from "./machines-CYtOCqcj.mjs";
-import { createHash, randomUUID } from "node:crypto";
-import { lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { LOG_ROTATE_BYTES, withDirLock } from "@stim-cli/core";
-import { HOSTED_APP_CHUNK_BYTES, hostedMacosAppSlot, hostedMacosBundleId, isJsonObject, parseHostedAgentGrant, parseHostedLogsCursor, parseHostedMacosDevice, readDeviceHostMachines, validHostedAppArguments } from "@stim-cli/core/state";
-//#region src/device-host/agent-connection.ts
-function canonical(path) {
-	try {
-		return realpathSync(path);
-	} catch {
-		return null;
-	}
-}
-function report(message) {
-	process.stderr.write(`${phaseLine("device", message.replace(/\s+/g, " "))}\n`);
-}
-function closeAgentConnection(remoteConfig) {
-	const exec = getExecutor();
-	const deadline = Date.now() + 3e4;
-	const run = (args) => {
-		const remaining = deadline - Date.now();
-		if (remaining <= 0) throw new Error("agent-device cleanup timed out");
-		const result = JSON.parse(exec.runFile("agent-device", [...args, "--json"], {
-			timeoutMs: Math.min(1e4, remaining),
-			killSignal: "SIGKILL"
-		}));
-		if (result?.success !== true) throw new Error("agent-device did not confirm the command");
-		return result.data;
-	};
-	try {
-		if (!exec.findExecutable("agent-device")) return;
-		const status = run(["connection", "status"]);
-		if (status?.connected !== true || typeof status.session !== "string" || typeof status.remoteConfig !== "string") return;
-		const config = canonical(remoteConfig);
-		if (config === null || canonical(status.remoteConfig) !== config) return;
-		const failures = [];
-		for (const args of [[
-			"close",
-			"--remote-config",
-			remoteConfig,
-			"--session",
-			status.session
-		], [
-			"disconnect",
-			"--session",
-			status.session
-		]]) try {
-			run(args);
-		} catch (error) {
-			failures.push(error.message);
-		}
-		report(failures.length ? `could not clean up agent-device connection for ${status.session}: ${failures.join("; ")}` : `closed agent-device connection for ${status.session}`);
-	} catch (error) {
-		report(`could not clean up agent-device connection: ${error.message}`);
-	}
-}
-//#endregion
-//#region src/device-host/hosted-logs.ts
-const MAX_PAGES = 64;
-const cursorFile = (root) => join(macosDir(root), "host-logs-cursor.json");
-const hostLogFile = (root) => join(workspaceLogsDir(root), "macos-host.ndjson");
-function readCursor(root, session) {
-	try {
-		const stored = JSON.parse(readFileSync(cursorFile(root), "utf8"));
-		if (isJsonObject(stored) && stored.session === session) return parseHostedLogsCursor(stored.cursor) ?? void 0;
-	} catch {}
-}
-const sameCursor = (a, b) => JSON.stringify(Object.entries(a ?? {}).toSorted()) === JSON.stringify(Object.entries(b ?? {}).toSorted());
-function commitPage(root, session, before, records, cursor) {
-	if (!records.length && sameCursor(before, cursor)) return;
-	const directory = macosDir(root);
-	withDirLock(join(directory, "host-logs.lock"), () => {
-		if (!sameCursor(readCursor(root, session), before)) return;
-		if (records.length) {
-			const writer = createNdjsonWriter(hostLogFile(root), { maxBytes: LOG_ROTATE_BYTES });
-			try {
-				for (const record of records) writer.write(record);
-			} finally {
-				writer.close();
-			}
-		}
-		const temporary = `${cursorFile(root)}.${process.pid}.tmp`;
-		try {
-			writeFileSync(temporary, JSON.stringify({
-				session,
-				cursor
-			}), { mode: 384 });
-			renameSync(temporary, cursorFile(root));
-		} finally {
-			rmSync(temporary, { force: true });
-		}
-	}, { ensureParent: () => mkdirSync(directory, { recursive: true }) });
-}
-async function pullHostedMacosLogs(root, placement, host) {
-	for (let page = 0; page < MAX_PAGES; page++) {
-		const before = readCursor(root, placement.session);
-		const reply = await host.connection.request("device-host.logs.query", {
-			session: placement.session,
-			...before ? { cursor: before } : {}
-		});
-		if ("error" in reply) throw Object.assign(/* @__PURE__ */ new Error(`${host.machine} refused device-host.logs.query: ${reply.error.message}`), { code: reply.error.code });
-		const result = reply.result;
-		const cursor = isJsonObject(result) ? parseHostedLogsCursor(result.cursor) : null;
-		if (!isJsonObject(result) || !cursor || !Array.isArray(result.records) || !result.records.every(isJsonObject) || typeof result.more !== "boolean") throw new Error(`${host.machine} answered device-host.logs.query with an unexpected result.`);
-		commitPage(root, placement.session, before, result.records, cursor);
-		if (!result.more || sameCursor(cursor, before)) return;
-	}
-}
-//#endregion
-//#region src/device-host/hosted-macos.ts
-const CONNECT_TIMEOUT_MS = 1e4;
-const POLL_MS = 500;
-const SESSION_TIMEOUT_MS = 12e4;
-const INSTALL_TIMEOUT_MS = 3e5;
-const HANDOFF_TIMEOUT_MS = 3e5;
-const sleep = (ms) => new Promise((done) => setTimeout(done, ms));
-const sha256 = (content) => createHash("sha256").update(content).digest("hex");
-function hostingCredential(machine) {
-	const configured = configuredMachines();
-	if (configured === null) throw new Error("hosting.machines is invalid. Run stim guide settings and correct it.");
-	if (!configured.includes(machine)) throw Object.assign(/* @__PURE__ */ new Error(`${machine} is not in hosting.machines. Add it with stim settings set hosting.machines, then run stim doctor --fix to ask it for hosting access.`), { code: "STIM_BAD_ARG" });
-	let credentials;
-	try {
-		credentials = readDeviceHostMachines();
-	} catch {
-		throw new Error("The hosting credentials are unreadable. Run stim doctor.");
-	}
-	const credential = credentials.find((each) => each.machine === machine);
-	if (!credential) throw new Error(`This Mac has not asked ${machine} for hosting access. Run stim doctor --fix.`);
-	if (credential.state !== "approved") throw new Error(`${machine} has not confirmed hosting access for this Mac. A person on ${machine} approves it with stim-server devices grant ${credential.deviceId} --device-host; then run stim doctor.`);
-	return credential;
-}
-/** Connects only to the pinned node of an approved hosting machine, and only when it grants `device-host`. */
-async function connectHost(machine, timeoutMs = CONNECT_TIMEOUT_MS) {
-	const credential = hostingCredential(machine);
-	const target = pinnedEndpoint$1(credential);
-	if (typeof target === "string") throw new Error(`Stim does not connect to ${machine}: ${target}.`);
-	const opened = await BuildConnection.open(target, credential.deviceToken, timeoutMs, "device-host");
-	if (!(opened instanceof BuildConnection)) throw new Error(opened.refused ? `${machine} refused this Mac: ${opened.failure}. Run stim doctor.` : `${machine} is unreachable: ${opened.failure}. Check stim-server and its tailnet serve route on ${machine}.`);
-	return {
-		machine,
-		credential,
-		connection: opened
-	};
-}
-async function call(host, method, params, timeoutMs) {
-	const reply = await host.connection.request(method, params, timeoutMs);
-	if ("error" in reply) throw Object.assign(/* @__PURE__ */ new Error(`${host.machine} refused ${method}: ${reply.error.message}`), { code: reply.error.code });
-	if (!isJsonObject(reply.result)) throw new Error(`${host.machine} answered ${method} without a result.`);
-	return reply.result;
-}
-function hostedSession(host, value) {
-	if (typeof value.id !== "string" || typeof value.state !== "string" || value.platform !== "macos") throw new Error(`${host.machine} answered with a session that is not a hosted macOS session.`);
-	return {
-		id: value.id,
-		state: value.state,
-		device: value.device,
-		...hostedMacosAppSlot(value.appSlot) ? { appSlot: value.appSlot } : {},
-		...typeof value.notice === "string" ? { notice: value.notice } : {}
-	};
-}
-const heldNoLonger = (error) => error instanceof Error && "code" in error && error.code === "unknown-session";
-async function attach(host, session, timeoutMs) {
-	return hostedSession(host, await call(host, "device-host.attach", { session }, timeoutMs));
-}
-const probeCache = /* @__PURE__ */ new Map();
-function probeHostedMacos(placement, { timeoutMs = 3e3, ttlMs = 1e4 } = {}) {
-	const key = JSON.stringify([placement.machine, placement.session]);
-	const cached = probeCache.get(key);
-	if (ttlMs > 0 && cached && cached.expiresAt > Date.now()) return cached.promise;
-	const promise = probeSession(placement, timeoutMs);
-	if (ttlMs > 0) {
-		const entry = {
-			expiresAt: Infinity,
-			promise
-		};
-		probeCache.delete(key);
-		probeCache.set(key, entry);
-		if (probeCache.size > 64) probeCache.delete(probeCache.keys().next().value);
-		promise.then((result) => {
-			entry.expiresAt = Date.now() + ttlMs;
-			return result;
-		});
-	}
-	return promise;
-}
-async function probeSession(placement, timeoutMs) {
-	let host;
-	try {
-		host = await connectHost(placement.machine, timeoutMs);
-		const session = await attach(host, placement.session, timeoutMs);
-		if (session.state === "ready" || session.state === "stopped") return { state: session.state };
-		return {
-			state: "unknown",
-			notice: session.state === "unknown" ? session.notice : `The hosted session ${session.id} on ${host.machine} is ${session.state}.${session.notice ? ` ${session.notice}` : ""}`
-		};
-	} catch (error) {
-		if (heldNoLonger(error)) return { state: "stopped" };
-		return {
-			state: "unreachable",
-			reason: error instanceof Error ? error.message : String(error)
-		};
-	} finally {
-		host?.connection.close();
-	}
-}
-async function settle(host, session, passing, timeoutMs) {
-	const deadline = Date.now() + timeoutMs;
-	while (passing.includes(session.state)) {
-		if (Date.now() > deadline) throw new Error(`The hosted session ${session.id} on ${host.machine} stayed ${session.state}.`);
-		await sleep(POLL_MS);
-		session = await attach(host, session.id);
-	}
-	return session;
-}
-function unknownSession(host, session) {
-	return /* @__PURE__ */ new Error(`The hosted session ${session.id} on ${host.machine} is in an unknown state${session.notice ? `: ${session.notice}` : ""}. Run stim stop to reconcile it.`);
-}
-function bundleManifest(bundle) {
-	const files = [];
-	const content = /* @__PURE__ */ new Map();
-	const walk = (dir, prefix) => {
-		for (const name of readdirSync(dir)) {
-			const absolute = join(dir, name);
-			const path = prefix ? `${prefix}/${name}` : name;
-			const stat = lstatSync(absolute);
-			let read;
-			let kind;
-			if (stat.isDirectory()) {
-				walk(absolute, path);
-				continue;
-			} else if (stat.isSymbolicLink()) {
-				read = () => Buffer.from(readlinkSync(absolute));
-				kind = "link";
-			} else if (stat.isFile()) {
-				read = () => readFileSync(absolute);
-				kind = stat.mode & 73 ? "exec" : "file";
-			} else continue;
-			const bytes = read();
-			const digest = sha256(bytes);
-			files.push({
-				path,
-				kind,
-				size: bytes.length,
-				sha256: digest
-			});
-			content.set(digest, read);
-		}
-	};
-	walk(bundle, "");
-	files.sort((a, b) => a.path.localeCompare(b.path));
-	return {
-		files,
-		content
-	};
-}
-async function upload(host, ids, missing, content) {
-	if (!Array.isArray(missing)) throw new Error(`${host.machine} answered device-host.app.offer without missing content.`);
-	for (const entry of missing) {
-		const read = isJsonObject(entry) && typeof entry.sha256 === "string" ? content.get(entry.sha256) : void 0;
-		if (!read || !isJsonObject(entry) || typeof entry.offset !== "number") throw new Error(`${host.machine} asked for content this app does not have.`);
-		const bytes = read();
-		let offset = entry.offset;
-		do {
-			const data = bytes.subarray(offset, offset + HOSTED_APP_CHUNK_BYTES).toString("base64");
-			const next = (await call(host, "device-host.app.chunk", {
-				...ids,
-				sha256: entry.sha256,
-				offset,
-				data
-			})).offset;
-			if (typeof next !== "number" || next <= offset && next !== bytes.length) throw new Error(`${host.machine} did not accept app content at byte ${offset}.`);
-			offset = next;
-		} while (offset < bytes.length);
-	}
-}
-const agentRemoteConfig = (root) => join(macosDir(root), "agent-device-remote.json");
-function agentAccess(root, credential, grant, note) {
-	const parsed = grant === void 0 ? null : parseHostedAgentGrant(grant);
-	if (grant !== void 0 && !parsed) note(`${credential.machine} offered agent control this Stim does not support.`);
-	const file = agentRemoteConfig(root);
-	if (!parsed || parsed.driver === "none") {
-		rmSync(file, { force: true });
-		return {
-			driver: "none",
-			setting: "hosting.agentDriver"
-		};
-	}
-	const port = parseMachine$1(credential.machine)?.port ?? 443;
-	const config = {
-		daemonBaseUrl: `https://${credential.dnsName}${port === 443 ? "" : `:${port}`}${parsed.path}`,
-		daemonAuthToken: parsed.token,
-		tenant: parsed.lease.tenant,
-		sessionIsolation: "tenant",
-		runId: parsed.lease.runId,
-		leaseId: parsed.scope,
-		leaseBackend: "macos-app",
-		leaseProvider: "proxy",
-		clientId: parsed.lease.clientId,
-		deviceKey: parsed.lease.deviceKey,
-		platform: "macos"
-	};
-	mkdirSync(macosDir(root), { recursive: true });
-	const tmp = `${file}.${process.pid}.tmp`;
-	try {
-		writeFileSync(tmp, `${JSON.stringify(config, null, 2)}\n`, { mode: 384 });
-		renameSync(tmp, file);
-	} finally {
-		rmSync(tmp, { force: true });
-	}
-	return {
-		driver: "agent-device",
-		remoteConfig: file,
-		command: `agent-device <command> --remote-config ${file}`
-	};
-}
-/**
-* Places a staged `.app` on `host`: reuses the recorded session when the host still holds it ready, else reserves one,
-* then delivers the bundle as a new app attempt, launches it and waits for the host to report it installed. `reserved`
-* records the placement as soon as a session exists, so `stim stop` can find it even if delivery fails.
-*/
-async function placeHostedMacos(host, { root, bundle, bundleId, handoff, arguments: requestedArguments, recorded, reserved, note }) {
-	let session = null;
-	if (recorded) {
-		try {
-			session = await settle(host, await attach(host, recorded.session), ["preparing", "stopping"], SESSION_TIMEOUT_MS);
-		} catch (error) {
-			if (!heldNoLonger(error)) throw error;
-		}
-		if (session?.state === "unknown") throw unknownSession(host, session);
-		if (session?.state === "stopped") session = null;
-	}
-	if (!session) {
-		note(`Reserving a macOS session on ${host.machine}`);
-		session = hostedSession(host, await call(host, "device-host.reserve", {
-			workspace: root,
-			slot: "default",
-			attempt: randomUUID(),
-			platform: "macos"
-		}));
-	}
-	const appSlot = session.appSlot;
-	if (appSlot === void 0) throw new Error(`${host.machine} reserved a session without a macOS app slot.`);
-	const appAttempt = randomUUID();
-	const placement = {
-		machine: host.machine,
-		session: session.id,
-		appSlot,
-		appAttempt,
-		bundleId: hostedMacosBundleId(bundleId, appSlot),
-		agent: {
-			driver: "none",
-			setting: "hosting.agentDriver"
-		}
-	};
-	reserved(placement);
-	session = await settle(host, session, ["preparing"], SESSION_TIMEOUT_MS);
-	if (session.state === "unknown") throw unknownSession(host, session);
-	if (session.state !== "ready") throw new Error(`The hosted session ${session.id} on ${host.machine} is ${session.state}.`);
-	const device = parseHostedMacosDevice(session.device);
-	if (!device || device.appSlot !== appSlot) throw new Error(`${host.machine} reported a ready session without its reserved macOS app slot.`);
-	const { files, content } = bundleManifest(bundle);
-	const manifest = Buffer.from(JSON.stringify(files));
-	content.set(sha256(manifest), () => manifest);
-	const ids = {
-		session: session.id,
-		attempt: appAttempt
-	};
-	const offer = {
-		...ids,
-		bundleId,
-		mode: "release",
-		...requestedArguments.length ? { arguments: requestedArguments } : {},
-		manifest: {
-			sha256: sha256(manifest),
-			size: manifest.length
-		}
-	};
-	note(`Delivering ${files.length} files to ${host.machine} (macOS ${device.macosVersion}, ${device.architecture})`);
-	await upload(host, ids, (await call(host, "device-host.app.offer", offer)).missing, content);
-	let missing = (await call(host, "device-host.app.offer", offer)).missing;
-	if (handoff && handoff.nodeId === host.credential.nodeId && Array.isArray(missing) && missing.length) {
-		try {
-			const taken = await call(host, "device-host.app.handoff", {
-				...ids,
-				build: {
-					handoff: handoff.token,
-					sha256: handoff.sha256
-				}
-			}, HANDOFF_TIMEOUT_MS);
-			if (taken.files) note(`${host.machine} took ${String(taken.files)} files from the build it ran`);
-		} catch (error) {
-			note(`${error instanceof Error ? error.message : String(error)}; uploading the app instead`);
-		}
-		missing = (await call(host, "device-host.app.offer", offer)).missing;
-	}
-	await upload(host, ids, missing, content);
-	note(`Launching on ${host.machine}`);
-	let delivery = await call(host, "device-host.app.launch", ids);
-	const deadline = Date.now() + INSTALL_TIMEOUT_MS;
-	while (delivery.state !== "installed") {
-		if (delivery.state === "unknown") throw new Error(`${host.machine} could not install or launch the app${typeof delivery.notice === "string" ? `: ${delivery.notice}` : ""}.`);
-		if (Date.now() > deadline) throw new Error(`${host.machine} did not finish installing the app.`);
-		await sleep(POLL_MS);
-		delivery = await call(host, "device-host.app.attach", ids);
-	}
-	const appliedArguments = validHostedAppArguments(delivery.arguments) ? delivery.arguments : [];
-	if (JSON.stringify(appliedArguments) !== JSON.stringify(requestedArguments)) note(`${host.machine} did not apply macos.arguments. Update stim-server on that host.`);
-	if (typeof delivery.notice === "string") note(delivery.notice);
-	return {
-		placement: {
-			...placement,
-			agent: agentAccess(root, host.credential, delivery.agent, note)
-		},
-		launched: delivery.launched === true ? true : "unverified",
-		arguments: appliedArguments
-	};
-}
-/** Stops a recorded hosted session and waits until the host confirms it stopped; anything else is a failure. */
-async function stopHostedMacos(root, placement) {
-	if (placement.agent.driver === "agent-device") closeAgentConnection(placement.agent.remoteConfig);
-	const host = await connectHost(placement.machine);
-	try {
-		try {
-			let session = hostedSession(host, await call(host, "device-host.stop", { session: placement.session }));
-			session = await settle(host, session, ["stopping"], SESSION_TIMEOUT_MS);
-			if (session.state !== "stopped") throw unknownSession(host, session);
-			await pullHostedMacosLogs(root, placement, host).catch((error) => {
-				process.stderr.write(`${phaseLine("device", `Could not copy the final logs from ${host.machine}: ${error.message}`)}\n`);
-			});
-		} catch (error) {
-			if (!heldNoLonger(error)) throw error;
-		}
-	} finally {
-		host.connection.close();
-	}
-	rmSync(agentRemoteConfig(root), { force: true });
-}
-//#endregion
-export { pullHostedMacosLogs as a, stopHostedMacos as i, placeHostedMacos as n, probeHostedMacos as r, connectHost as t };