stim 1.15.0 → 1.17.0

package/dist/machine-usage-D_YYMzfR.mjs

@@ -1,283 +0,0 @@
-import { t as getExecutor } from "./exec-CaErVv7t.mjs";
-import { basename, dirname, join } from "node:path";
-import { compiledHelper, configDir } from "@stim-cli/core";
-import { MACHINE_OWNER_KINDS } from "@stim-cli/core/state";
-import { fileURLToPath } from "node:url";
-//#region src/footprint.ts
-const SOURCE = "stim-footprint.swift";
-const COMPILE_TIMEOUT_MS = 12e4;
-const READ_TIMEOUT_MS = 5e3;
-function helperSource() {
-	const here = fileURLToPath(import.meta.url);
-	if (basename(dirname(here)) === "src") return fileURLToPath(new URL(`../helper/${SOURCE}`, import.meta.url));
-	return join(dirname(here), SOURCE);
-}
-async function buildHelper() {
-	const exec = getExecutor();
-	if (!exec.runFileQuiet("xcode-select", ["-p"], { timeoutMs: READ_TIMEOUT_MS })) return null;
-	const source = helperSource();
-	try {
-		return await compiledHelper({
-			dir: join(configDir(), "helpers"),
-			name: "stim-footprint",
-			inputs: [source],
-			version: "",
-			compile: async (output) => {
-				await exec.runFileAsync("xcrun", [
-					"swiftc",
-					"-O",
-					"-swift-version",
-					"5",
-					"-o",
-					output,
-					source
-				], { timeoutMs: COMPILE_TIMEOUT_MS });
-			}
-		});
-	} catch {
-		return null;
-	}
-}
-const RETRY_BACKOFF_INITIAL_MS = 1e4;
-const RETRY_BACKOFF_MAX_MS = 6e5;
-let built = null;
-let failure = null;
-/** The `stim-footprint` helper, compiled on first use. A success is kept for the process's life; a failure retries after a doubling backoff instead of being pinned forever. */
-function footprintHelper() {
-	const home = configDir();
-	if (built?.home === home) return built.promise;
-	if (failure?.home === home && Date.now() < failure.nextRetryAt) return Promise.resolve(null);
-	const promise = buildHelper().then((helper) => {
-		if (helper === null) {
-			const backoffMs = failure?.home === home ? Math.min(failure.backoffMs * 2, RETRY_BACKOFF_MAX_MS) : RETRY_BACKOFF_INITIAL_MS;
-			failure = {
-				home,
-				nextRetryAt: Date.now() + backoffMs,
-				backoffMs
-			};
-			if (built?.promise === promise) built = null;
-			return null;
-		}
-		return helper;
-	});
-	built = {
-		home,
-		promise
-	};
-	return promise;
-}
-/** Parses the helper's `<pid> <bytes>` lines into footprint bytes by pid. */
-function parseFootprints(output) {
-	const footprints = /* @__PURE__ */ new Map();
-	for (const line of output.split("\n")) {
-		const match = /^(\d+) (\d+)$/.exec(line.trim());
-		if (match) footprints.set(Number(match[1]), Number(match[2]));
-	}
-	return footprints;
-}
-/** Every readable process's physical footprint in bytes, or null when the helper is unavailable or fails. */
-async function readFootprints() {
-	const helper = await footprintHelper();
-	const output = helper ? getExecutor().runFileQuiet(helper, [], { timeoutMs: READ_TIMEOUT_MS }) : null;
-	return output === null ? null : parseFootprints(output);
-}
-//#endregion
-//#region src/machine-usage.ts
-const SHARED = [
-	{
-		name: "CoreSimulator services",
-		pattern: /\/CoreSimulator\.framework\/|\/Simulator\.app\/Contents\/MacOS\//
-	},
-	{
-		name: "adb server",
-		pattern: /(^|\/)adb\s.*\bfork-server\b/
-	},
-	{
-		name: "Android emulator services",
-		pattern: /\/emulator\/netsimd(\s|$)/
-	},
-	{
-		name: "Gradle daemon",
-		pattern: /\borg\.gradle\.launcher\.daemon\.bootstrap\.GradleDaemon\b/
-	},
-	{
-		name: "Kotlin daemon",
-		pattern: /\bKotlinCompileDaemon\b/
-	},
-	{
-		name: "Watchman",
-		pattern: /(^|\/)watchman(\s|$)/
-	}
-];
-const STIM_SERVER_COMMAND = /(^|[\s/])stim-server(\.mjs)?(\s|$)/;
-const LAUNCHD_SIM = /^launchd_sim\s.*\/Devices\/([^/\s]+)\//;
-const MAX_DEPTH = 64;
-const EMULATOR = /(?:^|\/)(?:qemu-system-[^\s/]+|emulator)(?:\s.*)?\s(?:-avd\s+|@)(\S+)/;
-function emulatorAvd(command) {
-	return EMULATOR.exec(command)?.[1] ?? null;
-}
-function workspaceOwner(kind, env, name, id) {
-	return {
-		kind,
-		name,
-		workspace: env.path,
-		id,
-		owned: true
-	};
-}
-function rank(owner) {
-	return MACHINE_OWNER_KINDS.indexOf(owner.kind);
-}
-/**
-* Attributes every process in `processes` to at most one owner: the owner of its nearest ancestor (itself included)
-* that is a root. Roots are each booted simulator's `launchd_sim`, each emulator launcher and qemu process, and each
-* workspace's verified supervisor and Metro, running build and Chrome. Only a process under none of those falls back
-* to stim-server or a machine-wide service in `SHARED`, so a `simctl` a workspace's log collector runs stays with the
-* workspace. An emulator counts in the workspace that records its AVD whenever its process runs, including while adb
-* does not list it. A process with no root ancestor is left out. `footprints` holds physical footprint bytes by pid,
-* or is null when they could not be read, and the owners' `memoryMb` then sums resident sizes. A process missing from
-* `footprints`, another user's or one that exited between the two reads, counts its resident size.
-*/
-function attributeMachineUsage({ processes, footprints, environments, roots, simNames }) {
-	const owners = /* @__PURE__ */ new Map();
-	const rootOf = /* @__PURE__ */ new Map();
-	const fallbackOf = /* @__PURE__ */ new Map();
-	const claim = (pid, key, owner, into = rootOf) => {
-		if (!owners.has(key)) owners.set(key, owner);
-		into.set(pid, key);
-	};
-	const sims = /* @__PURE__ */ new Map();
-	const emulators = /* @__PURE__ */ new Map();
-	for (const env of environments) for (const device of [{
-		slot: "default",
-		ios: env.ios,
-		android: env.android
-	}, ...env.slots ?? []]) {
-		const slot = device.slot === "default" ? {} : { slot: device.slot };
-		if (device.ios?.state === "Booted") sims.set(device.ios.udid.toUpperCase(), {
-			kind: "simulator",
-			name: device.ios.name ?? device.ios.udid,
-			workspace: env.path,
-			...slot,
-			id: device.ios.udid,
-			owned: device.ios.owned
-		});
-		if (device.android?.name && !device.android.physical) emulators.set(device.android.name, {
-			kind: "emulator",
-			name: device.android.name,
-			workspace: env.path,
-			...slot,
-			id: device.android.name,
-			owned: device.android.owned
-		});
-	}
-	for (const p of processes) {
-		const shared = SHARED.find(({ pattern }) => pattern.test(p.command));
-		if (shared) {
-			const owner = {
-				kind: "shared",
-				name: shared.name,
-				workspace: null,
-				id: null,
-				owned: false
-			};
-			claim(p.pid, `shared:${shared.name}`, owner, fallbackOf);
-			continue;
-		}
-		if (STIM_SERVER_COMMAND.test(p.command)) {
-			claim(p.pid, "server", {
-				kind: "server",
-				name: "stim-server",
-				workspace: null,
-				id: null,
-				owned: false
-			}, fallbackOf);
-			continue;
-		}
-		const udid = LAUNCHD_SIM.exec(p.command)?.[1]?.toUpperCase();
-		if (udid) {
-			const owner = sims.get(udid) ?? {
-				kind: "simulator",
-				name: simNames[udid] ?? udid,
-				workspace: null,
-				id: udid,
-				owned: false
-			};
-			claim(p.pid, `simulator:${udid}`, owner);
-			continue;
-		}
-		const avd = emulatorAvd(p.command);
-		if (avd) {
-			const owner = emulators.get(avd) ?? {
-				kind: "emulator",
-				name: avd,
-				workspace: null,
-				id: avd,
-				owned: false
-			};
-			claim(p.pid, `emulator:${avd}`, owner);
-		}
-	}
-	const present = new Set(processes.map((p) => p.pid));
-	const byPath = new Map(environments.map((env) => [env.path, env]));
-	for (const root of roots) {
-		const env = byPath.get(root.path);
-		if (!env) continue;
-		const metroPids = [root.supervisorPid, env.metro?.running ? env.metro.pid : null];
-		for (const pid of metroPids) if (pid && present.has(pid)) {
-			const port = env.metro?.port ?? null;
-			claim(pid, `metro:${env.path}`, workspaceOwner("metro", env, port ? `Metro :${port}` : "Metro", port ? String(port) : null));
-		}
-		if (root.build && present.has(root.build.pid)) {
-			const label = root.build.platform === "ios" ? "iOS build" : "Android build";
-			claim(root.build.pid, `build:${env.path}`, workspaceOwner("build", env, label, root.build.platform));
-		}
-		for (const pid of root.macosPids ?? []) if (present.has(pid)) claim(pid, `macos:${env.path}`, workspaceOwner("macos", env, env.macos?.product ?? "macOS app", null));
-		for (const pid of root.browserPids) if (present.has(pid)) claim(pid, `browser:${env.path}`, workspaceOwner("browser", env, "Chrome", null));
-	}
-	const parentOf = new Map(processes.map((p) => [p.pid, p.ppid]));
-	const totals = /* @__PURE__ */ new Map();
-	for (const p of processes) {
-		let pid = p.pid;
-		let key;
-		let fallback;
-		for (let depth = 0; pid !== void 0 && pid > 1 && depth < MAX_DEPTH; depth++) {
-			key = rootOf.get(pid);
-			if (key) break;
-			fallback ??= fallbackOf.get(pid);
-			pid = parentOf.get(pid);
-		}
-		key ??= fallback;
-		if (!key) continue;
-		const total = totals.get(key) ?? {
-			rssKb: 0,
-			memoryKb: 0,
-			cpu: 0,
-			processes: 0
-		};
-		total.rssKb += p.rssKb;
-		const footprint = footprints?.get(p.pid);
-		total.memoryKb += footprint === void 0 ? p.rssKb : footprint / 1024;
-		total.cpu += p.cpuPercent;
-		total.processes += 1;
-		totals.set(key, total);
-	}
-	const list = [];
-	for (const [key, owner] of owners) {
-		const total = totals.get(key);
-		if (total) list.push({
-			...owner,
-			cpuPercent: Math.round(total.cpu),
-			residentMb: Math.round(total.rssKb / 1024),
-			memoryMb: Math.round(total.memoryKb / 1024),
-			processes: total.processes
-		});
-	}
-	list.sort((x, y) => rank(x) - rank(y) || (x.workspace ?? "~").localeCompare(y.workspace ?? "~") || x.name.localeCompare(y.name));
-	return {
-		memorySource: footprints ? "footprint" : "rss",
-		owners: list
-	};
-}
-//#endregion
-export { attributeMachineUsage as n, readFootprints as r, STIM_SERVER_COMMAND as t };

package/dist/machines-CYtOCqcj.mjs

@@ -1,259 +0,0 @@
-import { _ as loadConfig$1, d as getConfigDir } from "./config-D0DbpZtM.mjs";
-import { E as withDirLock } from "./workspace-state-CL2V2Ons.mjs";
-import { _ as findPeer, b as realIo, g as endpoint, v as parseMachine$1 } from "./client-C2IS36Qf.mjs";
-import { mkdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
-import { acceptsShape, deviceHostMachinesClaims, deviceHostMachinesFile, deviceHostMachinesLock, isJsonObject, readDeviceHostMachines, settingDefinition } from "@stim-cli/core/state";
-import { releaseClaim, tryAcquireClaim } from "@stim-cli/core/ownership-claim";
-import { hostname } from "node:os";
-//#region src/device-host/machines.ts
-function note(title, detail, fix = null) {
-	return {
-		code: "device-host-machine",
-		level: "note",
-		title,
-		detail,
-		fix
-	};
-}
-const approval = (machine, id) => `A person on ${machine} approves it with \`stim-server devices grant ${id} --device-host\`.`;
-function configuredMachines() {
-	const hosting = loadConfig$1()?.hosting;
-	if (hosting !== void 0 && !isJsonObject(hosting)) return null;
-	const machines = hosting?.machines;
-	if (machines === void 0) return [];
-	return acceptsShape(settingDefinition("hosting.machines"), machines) ? machines : null;
-}
-function store(machines) {
-	withDirLock(deviceHostMachinesLock(), () => {
-		const file = deviceHostMachinesFile();
-		const tmp = `${file}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
-		try {
-			writeFileSync(tmp, `${JSON.stringify({
-				version: 1,
-				machines
-			}, null, 2)}\n`, { mode: 384 });
-			renameSync(tmp, file);
-		} finally {
-			rmSync(tmp, { force: true });
-		}
-	}, { ensureParent: () => mkdirSync(getConfigDir(), { recursive: true }) });
-}
-async function request(machine, peer, port, deviceName, io) {
-	const reply = await io.hello(endpoint(peer, port), {
-		request: "device-host",
-		deviceName
-	});
-	if (!("result" in reply) || reply.result?.approval?.state !== "pending" || typeof reply.result.deviceToken !== "string" || !reply.result.deviceToken || typeof reply.result.device?.id !== "string" || !reply.result.device.id || typeof reply.result.approval.expiresAt !== "string" || !reply.result.approval.expiresAt) return {
-		report: {
-			machine,
-			dnsName: peer.dnsName,
-			state: "unreachable"
-		},
-		finding: note(`Could not ask ${machine} for hosting access`, "The worker did not return a pending request.")
-	};
-	const credential = {
-		machine,
-		nodeId: peer.nodeId,
-		dnsName: peer.dnsName,
-		deviceId: reply.result.device.id,
-		deviceToken: reply.result.deviceToken,
-		state: "pending",
-		requestedAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-	return {
-		report: {
-			machine,
-			dnsName: peer.dnsName,
-			state: "pending",
-			deviceId: credential.deviceId,
-			requestedAt: credential.requestedAt
-		},
-		finding: note(`Asked ${machine} for hosting access`, `The request lapses at ${reply.result.approval.expiresAt}.`, approval(machine, credential.deviceId)),
-		credential
-	};
-}
-/** Reports separately approved hosting machines. Only --fix asks or forgets credentials; every token stays pinned. */
-async function inspectDeviceHostMachines({ fix }, io = realIo, entries = configuredMachines()) {
-	if (entries === null) return {
-		findings: [note("Invalid hosting.machines setting", "Use a hosting object with machines as an array of tailnet names. Existing hosting credentials and pinned nodes are preserved.", "Run `stim guide settings` and correct the setting before running doctor again.")],
-		machines: []
-	};
-	const unavailable = (state, finding) => ({
-		findings: [finding],
-		machines: entries.map((machine) => ({
-			machine,
-			state
-		}))
-	});
-	const unreadable = () => unavailable("credentials-unavailable", note("Hosting credentials are unreadable", `Stim preserves ${deviceHostMachinesFile()} and its pinned nodes.`, "Restore the existing file from a trusted backup or restore read access before running doctor again."));
-	if (!entries.length) {
-		if (!fix) return {
-			findings: [],
-			machines: []
-		};
-		try {
-			if (!readDeviceHostMachines().length) return {
-				findings: [],
-				machines: []
-			};
-		} catch {
-			return unreadable();
-		}
-	}
-	const claim = tryAcquireClaim({
-		root: deviceHostMachinesClaims(),
-		mode: "exclusive",
-		label: "hosting machine approval"
-	});
-	if (!claim.acquired) {
-		releaseClaim(claim.pending);
-		return unavailable("busy", note("Hosting machine approval is in use", "Another doctor run holds the hosting credential claim. Run doctor again after it finishes."));
-	}
-	try {
-		let credentials;
-		try {
-			credentials = readDeviceHostMachines();
-		} catch {
-			return unreadable();
-		}
-		if (fix) {
-			const kept = credentials.filter((each) => entries.includes(each.machine));
-			if (kept.length !== credentials.length) {
-				store(kept);
-				credentials = kept;
-			}
-		}
-		if (!entries.length) return {
-			findings: [],
-			machines: []
-		};
-		const status = io.status();
-		if (!isJsonObject(status)) return unavailable("tailscale-off", note("Hosting machines are unreachable", "hosting.machines names hosting machines, but Tailscale is not running."));
-		const self = isJsonObject(status.Self) ? status.Self : {};
-		const deviceName = (typeof self.HostName === "string" && self.HostName ? self.HostName : hostname()).replace(/[\p{Cc}\p{Cf}]/gu, "").trim().slice(0, 64) || "Mac";
-		const inspected = {
-			findings: [],
-			machines: []
-		};
-		const namedNodes = /* @__PURE__ */ new Set();
-		for (const machine of new Set(entries)) {
-			const parsed = parseMachine$1(machine);
-			if (!parsed) {
-				inspected.machines.push({
-					machine,
-					state: "invalid"
-				});
-				inspected.findings.push(note(`Hosting machine ${machine} is not a tailnet name`, "Expected `name` or `name:port`."));
-				continue;
-			}
-			const current = io.status();
-			if (!isJsonObject(current)) {
-				inspected.machines.push({
-					machine,
-					state: "tailscale-off"
-				});
-				inspected.findings.push(note(`Hosting machine ${machine} is unreachable`, "Tailscale stopped before this connection."));
-				continue;
-			}
-			const peer = findPeer(current, parsed.name);
-			if (peer === "missing" || peer === "ambiguous") {
-				inspected.machines.push({
-					machine,
-					state: "not-on-tailnet"
-				});
-				inspected.findings.push(note(`Hosting machine ${machine} is not on this tailnet`, peer === "missing" ? "No peer has that name." : "Several peers match that name."));
-				continue;
-			}
-			const nodeRoute = `${peer.nodeId}:${parsed.port}`;
-			if (namedNodes.has(nodeRoute)) {
-				inspected.machines.push({
-					machine,
-					dnsName: peer.dnsName,
-					state: "invalid"
-				});
-				inspected.findings.push(note(`Hosting machine ${machine} repeats a named node`, "Name each tailnet node and serve port only once in hosting.machines."));
-				continue;
-			}
-			namedNodes.add(nodeRoute);
-			const credential = credentials.find((each) => each.machine === machine);
-			const known = {
-				machine,
-				dnsName: peer.dnsName,
-				...credential ? {
-					deviceId: credential.deviceId,
-					requestedAt: credential.requestedAt
-				} : {}
-			};
-			if (credential && credential.nodeId !== peer.nodeId) {
-				inspected.machines.push({
-					...known,
-					state: "node-changed"
-				});
-				inspected.findings.push(note(`Hosting machine ${machine} is a different tailnet node`, "Stim refuses to connect or send the saved token.", `If that Mac was replaced, remove ${machine} from hosting.machines, run \`stim doctor --fix\`, then add it back and run \`stim doctor --fix\` again to request approval on the new node.`));
-				continue;
-			}
-			let ask = !credential && fix;
-			if (credential) {
-				const reply = await io.hello(endpoint(peer, parsed.port), { deviceToken: credential.deviceToken });
-				if ("result" in reply && reply.result?.device?.id === credential.deviceId && Array.isArray(reply.result.capabilities) && reply.result.capabilities.includes("device-host")) {
-					if (credential.state !== "approved") {
-						credentials = credentials.map((each) => each.machine === machine ? {
-							...each,
-							state: "approved"
-						} : each);
-						store(credentials);
-					}
-					const host = reply.result.host;
-					if (host && (host.screenRecording === false || host.accessibility === false)) {
-						const panes = [...host.screenRecording === false ? ["Screen & System Audio Recording (Screen Recording on macOS 14)"] : [], ...host.accessibility === false ? ["Device Control and Data Access (Accessibility on macOS 26 and earlier)"] : []];
-						const detail = [...host.screenRecording === false ? ["Viewing hosted macOS apps needs Screen Recording."] : [], ...host.accessibility === false ? ["Controlling them needs the control permission."] : []];
-						inspected.findings.push(note(`Hosting machine ${machine} needs ${panes.join(" and ")} for ${host.name}`, detail.join(" "), `On ${machine}, approve ${host.name} in System Settings > Privacy & Security, or run \`stim-server service install\` there again to show the requests.`));
-					}
-					inspected.machines.push({
-						...known,
-						state: "approved"
-					});
-					continue;
-				}
-				if ("error" in reply && reply.error?.code === "approval-pending") {
-					inspected.machines.push({
-						...known,
-						state: "pending"
-					});
-					inspected.findings.push(note(`Hosting machine ${machine} has not approved this Mac yet`, `Requested at ${credential.requestedAt}.`, approval(machine, credential.deviceId)));
-					continue;
-				}
-				const revoked = "error" in reply && reply.error?.code === "unauthorized";
-				ask = revoked && fix;
-				if (!ask) {
-					inspected.machines.push({
-						...known,
-						state: revoked ? "revoked" : "unreachable"
-					});
-					inspected.findings.push(note(`Hosting machine ${machine} ${revoked ? "no longer accepts this Mac" : "did not confirm hosting access"}`, "The saved token and pinned node are preserved.", revoked ? "Run `stim doctor --fix` to ask again." : `Check stim-server and its tailnet serve route on ${machine}, then run doctor again.`));
-					continue;
-				}
-			}
-			if (ask) {
-				const result = await request(machine, peer, parsed.port, deviceName, io);
-				if (result.credential) {
-					credentials = [...credentials.filter((each) => each.machine !== machine), result.credential];
-					store(credentials);
-				}
-				inspected.machines.push(result.report);
-				inspected.findings.push(result.finding);
-			} else {
-				inspected.machines.push({
-					...known,
-					state: "not-asked"
-				});
-				inspected.findings.push(note(`Hosting machine ${machine} has not approved this Mac`, "This Mac has not asked for hosting access.", "Run `stim doctor --fix` to ask."));
-			}
-		}
-		return inspected;
-	} finally {
-		releaseClaim(claim.acquired);
-	}
-}
-//#endregion
-export { inspectDeviceHostMachines as n, configuredMachines as t };