unfazed 0.9.0 → 0.10.0

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 0.10.0
+
+eve sandboxes on unfazed boxes: an eve app on unfazed gets a real sandbox (a
+browser through `@agent-browser/eve`, `bash`, files) backed by a box, with no
+stored secret.
+
+**Added**
+
+- `unfazed/eve-sandbox`: `UnfazedSandbox`, an eve sandbox provider
+  (`defineSandboxProvider`, eve 0.90 or newer, an optional peer).
+  `UnfazedSandbox.environment({ box: "<alias>" })` in `agent/sandbox.ts`.
+  - Every eve session gets its own Unix user, home and workspace on the box,
+    kept across restarts and redeploys until the session ends.
+  - The app authenticates with its workload identity token (audience: the
+    box's URL).
+  - Keyed MCP tool sessions keep their sandbox between calls.
+  - Build-time workspace and skill files travel in the eve artifact; a
+    `prepare` callback that runs commands at build time is refused (install
+    tools on the box instead).
+- `npx unfazed eve-sandbox setup|allow|deny|status|serve`, run as root inside
+  a box.
+  - `setup` installs the sandbox daemon on the box's `:3000`, agent-browser
+    and Chromium, and a boot hook that starts the daemon on every boot.
+  - Without `--allow`, every app of the box's own owner may use the box.
+  - Idle sessions lose their processes after 20 minutes (`--idle-minutes`);
+    sessions nobody used for 14 days are deleted (`--retention-days`).
+  - `--proxy <url>` routes the browsers through a proxy.
+
 ## 0.9.0
 
 Workload identity: an app gets OIDC tokens from the platform with its own

package/README.md

@@ -681,6 +681,63 @@ Errors are `UnfazedOIDCError`, with the platform's `error` as `code` and its
 | `not_in_app` | | `UNFZ_STATE_TOKEN` is not set |
 | `unreachable` | | network failures outlasted the retries |
 
+## eve sandboxes on a box: `unfazed/eve-sandbox`
+
+[eve](https://eve.dev) runs browsers, `bash` and file tools only inside a
+sandbox, and an unfazed service has no Docker. `unfazed/eve-sandbox` backs
+eve sandboxes with an unfazed **box** (a persistent Linux VM): every eve
+session gets its own Unix user, home and workspace there, which survive box
+restarts and app redeploys until the session ends.
+
+**1. Turn a box into a sandbox host.** Inside the box, as root (`ssh <box>@unfz.to`):
+
+```bash
+npx -y unfazed@latest eve-sandbox setup
+```
+
+This installs:
+
+- the sandbox daemon on the box's `:3000`, which serves the box's URL;
+- agent-browser and Chromium for every session;
+- a boot hook that starts the daemon on every boot.
+
+It then prints the line for your app. Who may use the box:
+
+- Without `--allow`, every app of the box's own owner.
+- `--allow <app-id>,owner:<id>` names apps explicitly, and `npx unfazed eve-sandbox allow|deny <id>` changes the list later.
+- A refused app's id is in the daemon's 403 answer.
+
+Other options:
+
+- `--proxy <url>` routes the browsers through a proxy, for sites that block datacenter IPs.
+- `--idle-minutes 20` sets how long an idle session keeps its processes.
+- `--retention-days 14` sets when an unused session is deleted.
+- `npx unfazed eve-sandbox status` shows the daemon, the allow list and the sessions.
+
+**2. Point the eve app at it** (`eve` 0.90 or newer, an optional peer):
+
+```ts
+// agent/sandbox.ts
+import { defineSandbox } from "eve/sandbox";
+import { UnfazedSandbox } from "unfazed/eve-sandbox";
+
+export const environment = UnfazedSandbox.environment({ box: "my-sandbox-box" });
+export default defineSandbox(() => environment.open());
+```
+
+With `@agent-browser/eve` mounted (`agent/extensions/browser.ts`), the
+agent's `browser__*` tools run in the box. The agent-browser that `setup`
+installs is `0.41.1`. Pass `--agent-browser <version>` to match another
+`@agent-browser/eve` minor.
+
+How it behaves:
+
+- **No stored secret.** The app authenticates with its workload identity token, audience the box's URL (see "Workload identity" above). The box checks the issuer, audience and allow list.
+- **Sessions are users.** A session's commands (`bash -lc`, streamed) and file operations run as its own Unix user, so sessions cannot read each other's files or browser profiles.
+- **Keyed MCP tool sessions** (`dev.eve/tool-sessions`) keep their sandbox between calls. A sandbox nobody used for the retention period is deleted.
+- **Templates.** The agent's workspace and skill files are captured at `eve build` and seeded into each new session. A sandbox `prepare` callback that runs commands is refused at build time: install tools on the box instead (it is yours, with root).
+- **Placement.** Put the box near the app (the same server or region): every sandbox call is an HTTPS round trip to the box.
+
 ## Durable workflows: `unfazed/workflow`
 
 [Workflow SDK](https://workflow-sdk.dev) runs durable functions: a

package/dist/cli/eve-sandbox.d.ts

@@ -0,0 +1,3 @@
+/** The agent-browser release `@agent-browser/eve` 0.41 drives; match the extension's minor. */
+export declare const DEFAULT_AGENT_BROWSER = "0.41.1";
+export declare function runEveSandbox(argv: readonly string[]): Promise<number>;

package/dist/cli/eve-sandbox.js

@@ -0,0 +1,268 @@
+/// <reference types="node" />
+/**
+ * `npx unfazed eve-sandbox <command>`, run as root inside an unfazed box:
+ * turns the box into a sandbox host for eve apps (`unfazed/eve-sandbox`).
+ *
+ *   setup [--allow <app-id|owner:id>,…] [--no-browser] [--agent-browser <version>]
+ *         [--proxy <url>] [--idle-minutes <n>] [--retention-days <n>]
+ *   allow <app-id|owner:id>      add to the allow list and restart the daemon
+ *   deny <app-id|owner:id>       remove from it and restart the daemon
+ *   status                       the daemon's health, allow list and sessions
+ *   serve                        run the daemon in the foreground
+ *
+ * `setup` copies the daemon to /data/eve-sandbox, writes its config and a box
+ * boot hook (/data/boot.d/50-eve-sandbox, run on every boot by the box's
+ * init), installs agent-browser and Chromium for every session, and (re)starts
+ * the daemon on :3000, which unfazed publishes at the box's URL. Without
+ * --allow, every app of the box's own owner may use it.
+ */
+import { execFileSync, spawn } from "node:child_process";
+import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, symlinkSync, writeFileSync, } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { parseArgs } from "node:util";
+/** The agent-browser release `@agent-browser/eve` 0.41 drives; match the extension's minor. */
+export const DEFAULT_AGENT_BROWSER = "0.41.1";
+const ROOT = "/data/eve-sandbox";
+const LIB = `${ROOT}/lib`;
+const CONFIG = `${ROOT}/config.json`;
+const HOOK = "/data/boot.d/50-eve-sandbox";
+const BROWSERS = "/opt/agent-browser/browsers";
+const HELP = `unfazed eve-sandbox — run eve sandboxes on this unfazed box (as root, inside the box)
+
+Usage:
+  npx unfazed eve-sandbox setup [--allow <app-id|owner:id>,…] [--no-browser]
+                                [--agent-browser <version>] [--proxy <url>]
+                                [--idle-minutes <n>] [--retention-days <n>]
+  npx unfazed eve-sandbox allow <app-id|owner:id>
+  npx unfazed eve-sandbox deny <app-id|owner:id>
+  npx unfazed eve-sandbox status
+  npx unfazed eve-sandbox serve
+
+setup installs the daemon (on :3000, the box's URL), agent-browser ${DEFAULT_AGENT_BROWSER}
+and Chromium, and a boot hook that starts the daemon on every boot. Without
+--allow, every app of this box's owner may use the box. An eve app then
+points its agent/sandbox.ts at it with UnfazedSandbox (unfazed/eve-sandbox):
+
+  export const environment = UnfazedSandbox.environment({ box: "<this box's alias>" });
+  export default defineSandbox(() => environment.open());
+`;
+function readConfig() {
+    if (!existsSync(CONFIG))
+        return { allow: [] };
+    const parsed = JSON.parse(readFileSync(CONFIG, "utf8"));
+    return { ...parsed, allow: Array.isArray(parsed.allow) ? parsed.allow : [] };
+}
+function writeConfig(config) {
+    const temp = `${CONFIG}.tmp`;
+    writeFileSync(temp, JSON.stringify(config, null, 2) + "\n", { mode: 0o600 });
+    renameSync(temp, CONFIG);
+}
+function sh(file, args, options = {}) {
+    return execFileSync(file, args, { encoding: "utf8", stdio: options.quiet ? ["ignore", "pipe", "pipe"] : ["ignore", "pipe", "inherit"] });
+}
+function requireBox() {
+    if (process.getuid?.() !== 0)
+        throw new Error("unfazed eve-sandbox: run this as root inside the box");
+    if (!existsSync("/sbin/unfazed-box-init") || !process.env["UNFZ_PUBLIC_URL"]) {
+        throw new Error("unfazed eve-sandbox: this is not an unfazed box (no /sbin/unfazed-box-init or UNFZ_PUBLIC_URL)");
+    }
+}
+/** The box's own owner, from its workload identity token: the default allow entry. */
+async function ownOwner() {
+    const state = process.env["UNFZ_STATE_TOKEN"];
+    const audience = process.env["UNFZ_PUBLIC_URL"];
+    if (!state)
+        throw new Error("unfazed eve-sandbox: UNFZ_STATE_TOKEN is not set; pass --allow");
+    const res = await fetch("https://unfazed.dev/oidc/token", {
+        method: "POST",
+        headers: { authorization: `Bearer ${state}`, "content-type": "application/json", "user-agent": "unfazed-eve-sandbox-setup" },
+        body: JSON.stringify({ audience }),
+    });
+    if (!res.ok)
+        throw new Error(`unfazed eve-sandbox: could not read the box's owner (${res.status}); pass --allow`);
+    const { token } = (await res.json());
+    const claims = JSON.parse(Buffer.from(token.split(".")[1].replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8"));
+    if (!claims.owner_id)
+        throw new Error("unfazed eve-sandbox: the box's token names no owner; pass --allow");
+    return `owner:${claims.owner_id}`;
+}
+function installDaemon() {
+    mkdirSync(LIB, { recursive: true });
+    chmodSync(ROOT, 0o755);
+    chmodSync(LIB, 0o755);
+    const source = join(dirname(fileURLToPath(import.meta.url)), "..", "eve-sandbox");
+    for (const file of ["daemon.js", "protocol.js"]) {
+        copyFileSync(join(source, file), join(LIB, file));
+        chmodSync(join(LIB, file), 0o644);
+    }
+    mkdirSync(dirname(HOOK), { recursive: true });
+    writeFileSync(HOOK, [
+        "#!/bin/sh",
+        "# eve sandbox daemon (unfazed/eve-sandbox) on :3000, restarted if it exits.",
+        `cd ${ROOT} || exit 1`,
+        "while true; do",
+        `  ${existsSync("/usr/local/bin/node") ? "/usr/local/bin/node" : process.execPath} ${LIB}/daemon.js serve --config ${CONFIG} >>${ROOT}/daemon.log 2>&1`,
+        "  sleep 2",
+        "done",
+        "",
+    ].join("\n"), { mode: 0o755 });
+}
+/** Installs agent-browser and Chromium once for every session; returns the Chromium binary. */
+function installBrowser(version) {
+    process.stderr.write(`installing agent-browser@${version} and Chromium (a few minutes the first time)…\n`);
+    const env = { ...process.env, DEBIAN_FRONTEND: "noninteractive" };
+    execFileSync("npm", ["install", "-g", "--silent", `agent-browser@${version}`], { stdio: "inherit", env });
+    // agent-browser keeps browsers in the installing user's home; sessions are
+    // other users. Root's browser directory becomes the shared one, so a
+    // browser already there is found and not downloaded again.
+    mkdirSync(BROWSERS, { recursive: true });
+    const own = join(process.env["HOME"] ?? "/root", ".agent-browser", "browsers");
+    mkdirSync(dirname(own), { recursive: true });
+    if (existsSync(own) && !lstatSync(own).isSymbolicLink()) {
+        for (const entry of readdirSync(own)) {
+            if (!existsSync(join(BROWSERS, entry)))
+                renameSync(join(own, entry), join(BROWSERS, entry));
+        }
+        rmSync(own, { recursive: true, force: true });
+    }
+    if (!existsSync(own))
+        symlinkSync(BROWSERS, own);
+    execFileSync("agent-browser", ["install", "--with-deps"], { stdio: "inherit", env });
+    sh("chmod", ["-R", "a+rX", "/opt/agent-browser"]);
+    const latest = readdirSync(BROWSERS)
+        .filter((e) => e.startsWith("chrome-"))
+        .sort((a, b) => a.localeCompare(b, undefined, { numeric: true }))
+        .at(-1);
+    const binary = latest ? join(BROWSERS, latest, "chrome") : "";
+    if (!binary || !existsSync(binary))
+        throw new Error("unfazed eve-sandbox: Chromium was not found after the install");
+    return binary;
+}
+function restartDaemon() {
+    // The boot hook's loop first (or it starts the old daemon again), then any
+    // daemon, wherever an earlier setup put it.
+    for (const pattern of ["[b]oot\\.d/50-eve-sandbox", "[e]ve-sandbox[^ ]*daemon[^ ]*\\.js serve"]) {
+        try {
+            sh("pkill", ["-f", pattern], { quiet: true });
+        }
+        catch {
+            // none running
+        }
+    }
+    execFileSync("sleep", ["1"]);
+    const child = spawn("setsid", [HOOK], { detached: true, stdio: "ignore" });
+    child.unref();
+}
+async function health() {
+    for (let i = 0; i < 20; i++) {
+        try {
+            const res = await fetch("http://127.0.0.1:3000/v1/health", { signal: AbortSignal.timeout(2000) });
+            if (res.ok)
+                return (await res.json());
+        }
+        catch {
+            // not up yet
+        }
+        await new Promise((resolve) => setTimeout(resolve, 500));
+    }
+    return { ok: false };
+}
+function sessionCount() {
+    return sh("getent", ["passwd"], { quiet: true })
+        .split("\n")
+        .filter((line) => /^eve[0-9a-f]{12}:/.test(line)).length;
+}
+export async function runEveSandbox(argv) {
+    const { values, positionals } = parseArgs({
+        args: [...argv],
+        allowPositionals: true,
+        options: {
+            allow: { type: "string" },
+            "no-browser": { type: "boolean" },
+            "agent-browser": { type: "string" },
+            proxy: { type: "string" },
+            "idle-minutes": { type: "string" },
+            "retention-days": { type: "string" },
+            config: { type: "string" },
+            help: { type: "boolean", short: "h" },
+        },
+    });
+    const [command, arg] = positionals;
+    if (values.help || command === undefined || command === "help") {
+        process.stdout.write(HELP);
+        return command === undefined ? 1 : 0;
+    }
+    if (command === "serve") {
+        const daemon = await import("../eve-sandbox/daemon.js");
+        const config = daemon.loadConfig(values.config ?? CONFIG);
+        await daemon.createDaemon(config).listen();
+        process.stdout.write(`eve sandbox daemon on :${config.port} for ${config.audience}\n`);
+        await new Promise(() => { });
+    }
+    requireBox();
+    const url = process.env["UNFZ_PUBLIC_URL"];
+    switch (command) {
+        case "setup": {
+            const config = readConfig();
+            const allow = values.allow
+                ? values.allow.split(",").map((s) => s.trim()).filter(Boolean)
+                : config.allow.length > 0
+                    ? []
+                    : [await ownOwner()];
+            config.allow = [...new Set([...config.allow, ...allow])];
+            const number = (flag, name) => {
+                if (flag === undefined)
+                    return undefined;
+                const n = Number(flag);
+                if (!Number.isInteger(n) || n < 0)
+                    throw new Error(`unfazed eve-sandbox: --${name} must be a whole number`);
+                return n;
+            };
+            config.idleMinutes = number(values["idle-minutes"], "idle-minutes") ?? config.idleMinutes ?? 20;
+            config.retentionDays = number(values["retention-days"], "retention-days") ?? config.retentionDays ?? 14;
+            config.env = { ...(config.env ?? {}) };
+            if (values.proxy)
+                config.env["AGENT_BROWSER_PROXY"] = values.proxy;
+            installDaemon();
+            if (!values["no-browser"])
+                config.env["AGENT_BROWSER_EXECUTABLE_PATH"] = installBrowser(values["agent-browser"] ?? DEFAULT_AGENT_BROWSER);
+            writeConfig(config);
+            restartDaemon();
+            const up = await health();
+            if (!up.ok)
+                throw new Error(`unfazed eve-sandbox: the daemon did not come up; see ${ROOT}/daemon.log`);
+            const alias = new URL(url).hostname.split(".")[0];
+            process.stdout.write(`eve sandbox ready at ${url} (daemon ${up.version}); allowed: ${config.allow.join(", ")}\n\n` +
+                `In the eve app:\n  export const environment = UnfazedSandbox.environment({ box: "${alias}" });\n`);
+            return 0;
+        }
+        case "allow":
+        case "deny": {
+            if (!arg)
+                throw new Error(`unfazed eve-sandbox: ${command} needs an app id or owner:<id>`);
+            const config = readConfig();
+            config.allow = command === "allow" ? [...new Set([...config.allow, arg])] : config.allow.filter((entry) => entry !== arg);
+            if (config.allow.length === 0)
+                throw new Error("unfazed eve-sandbox: that would allow nothing; allow another app first");
+            writeConfig(config);
+            restartDaemon();
+            const up = await health();
+            process.stdout.write(`${up.ok ? "restarted" : "NOT restarted (see daemon.log)"}; allowed: ${config.allow.join(", ")}\n`);
+            return up.ok ? 0 : 1;
+        }
+        case "status": {
+            const config = readConfig();
+            const up = await health();
+            process.stdout.write(`${url}: ${up.ok ? `up (daemon ${up.version})` : "DOWN"}\n` +
+                `allowed:  ${config.allow.join(", ") || "(none)"}\n` +
+                `sessions: ${sessionCount()}\n` +
+                `browser:  ${config.env?.["AGENT_BROWSER_EXECUTABLE_PATH"] ?? "(not installed)"}\n`);
+            return up.ok ? 0 : 1;
+        }
+        default:
+            process.stderr.write(HELP);
+            return 1;
+    }
+}
+//# sourceMappingURL=eve-sandbox.js.map

package/dist/cli/eve-sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eve-sandbox.js","sourceRoot":"","sources":["../../src/cli/eve-sandbox.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAC9B;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EACL,SAAS,EACT,YAAY,EACZ,UAAU,EACV,SAAS,EACT,SAAS,EACT,WAAW,EACX,YAAY,EACZ,UAAU,EACV,MAAM,EACN,WAAW,EACX,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,+FAA+F;AAC/F,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ,CAAC;AAE9C,MAAM,IAAI,GAAG,mBAAmB,CAAC;AACjC,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;AAC1B,MAAM,MAAM,GAAG,GAAG,IAAI,cAAc,CAAC;AACrC,MAAM,IAAI,GAAG,6BAA6B,CAAC;AAC3C,MAAM,QAAQ,GAAG,6BAA6B,CAAC;AAE/C,MAAM,IAAI,GAAG;;;;;;;;;;;qEAWwD,qBAAqB;;;;;;;CAOzF,CAAC;AAUF,SAAS,UAAU;IACjB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAW,CAAC;IAClE,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC/E,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,MAAM,IAAI,GAAG,GAAG,MAAM,MAAM,CAAC;IAC7B,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,EAAE,CAAC,IAAY,EAAE,IAAuB,EAAE,UAA+B,EAAE;IAClF,OAAO,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;AAC3I,CAAC;AAED,SAAS,UAAU;IACjB,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACtG,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,gGAAgG,CAAC,CAAC;IACpH,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,QAAQ;IACrB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAE,CAAC;IACjD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IAC9F,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,gCAAgC,EAAE;QACxD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,YAAY,EAAE,2BAA2B,EAAE;QAC5H,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;KACnC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,GAAG,CAAC,MAAM,iBAAiB,CAAC,CAAC;IAClH,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsB,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAE3H,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IAC3G,OAAO,SAAS,MAAM,CAAC,QAAQ,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,aAAa;IACpB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;IAClF,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,CAAC;QAChD,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAClD,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CACX,IAAI,EACJ;QACE,WAAW;QACX,6EAA6E;QAC7E,MAAM,IAAI,YAAY;QACtB,gBAAgB;QAChB,KAAK,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,GAAG,6BAA6B,MAAM,MAAM,IAAI,kBAAkB;QACvJ,WAAW;QACX,MAAM;QACN,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,SAAS,cAAc,CAAC,OAAe;IACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,OAAO,iDAAiD,CAAC,CAAC;IAC3G,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,eAAe,EAAE,gBAAgB,EAAE,CAAC;IAClE,YAAY,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,iBAAiB,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1G,2EAA2E;IAC3E,qEAAqE;IACrE,2DAA2D;IAC3D,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;IAC/E,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;QACxD,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAAE,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACjD,YAAY,CAAC,eAAe,EAAE,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IACrF,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC;SACjC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;SACtC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;SAChE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACV,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACrH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa;IACpB,2EAA2E;IAC3E,4CAA4C;IAC5C,KAAK,MAAM,OAAO,IAAI,CAAC,2BAA2B,EAAE,0CAA0C,CAAC,EAAE,CAAC;QAChG,IAAI,CAAC;YACH,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC;IACD,YAAY,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3E,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,MAAM;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClG,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsC,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,aAAa;QACf,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;SAC7C,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAuB;IACzD,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;QACxC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QACf,gBAAgB,EAAE,IAAI;QACtB,OAAO,EAAE;YACP,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACjC,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACnC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAClC,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACpC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;SACtC;KACF,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,WAAW,CAAC;IACnC,IAAI,MAAM,CAAC,IAAI,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC;QAC1D,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;QAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,MAAM,CAAC,IAAI,QAAQ,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;QACvF,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,UAAU,EAAE,CAAC;IACb,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAE,CAAC;IAC5C,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK;gBACxB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;gBAC9D,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;oBACvB,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,CAAC,MAAM,QAAQ,EAAE,CAAC,CAAC;YACzB,MAAM,CAAC,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACzD,MAAM,MAAM,GAAG,CAAC,IAAwB,EAAE,IAAY,EAAE,EAAE;gBACxD,IAAI,IAAI,KAAK,SAAS;oBAAE,OAAO,SAAS,CAAC;gBACzC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;gBACvB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,yBAAyB,CAAC,CAAC;gBAC5G,OAAO,CAAC,CAAC;YACX,CAAC,CAAC;YACF,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;YAChG,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC,IAAI,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;YACxG,MAAM,CAAC,GAAG,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;YACvC,IAAI,MAAM,CAAC,KAAK;gBAAE,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;YACnE,aAAa,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,+BAA+B,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,qBAAqB,CAAC,CAAC;YAC1I,WAAW,CAAC,MAAM,CAAC,CAAC;YACpB,aAAa,EAAE,CAAC;YAChB,MAAM,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC;YAC1B,IAAI,CAAC,EAAE,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,IAAI,aAAa,CAAC,CAAC;YACvG,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,wBAAwB,GAAG,YAAY,EAAE,CAAC,OAAO,eAAe,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;gBAC3F,oFAAoF,KAAK,SAAS,CACrG,CAAC;YACF,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,gCAAgC,CAAC,CAAC;YAC3F,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,MAAM,CAAC,KAAK,GAAG,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC;YAC1H,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;YACzH,WAAW,CAAC,MAAM,CAAC,CAAC;YACpB,aAAa,EAAE,CAAC;YAChB,MAAM,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC;YAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,gCAAgC,cAAc,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzH,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,MAAM,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC;YAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,GAAG,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI;gBACzD,aAAa,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,IAAI;gBACpD,aAAa,YAAY,EAAE,IAAI;gBAC/B,aAAa,MAAM,CAAC,GAAG,EAAE,CAAC,+BAA+B,CAAC,IAAI,iBAAiB,IAAI,CACtF,CAAC;YACF,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;QACD;YACE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC","sourcesContent":["/// <reference types=\"node\" />\n/**\n * `npx unfazed eve-sandbox <command>`, run as root inside an unfazed box:\n * turns the box into a sandbox host for eve apps (`unfazed/eve-sandbox`).\n *\n *   setup [--allow <app-id|owner:id>,…] [--no-browser] [--agent-browser <version>]\n *         [--proxy <url>] [--idle-minutes <n>] [--retention-days <n>]\n *   allow <app-id|owner:id>      add to the allow list and restart the daemon\n *   deny <app-id|owner:id>       remove from it and restart the daemon\n *   status                       the daemon's health, allow list and sessions\n *   serve                        run the daemon in the foreground\n *\n * `setup` copies the daemon to /data/eve-sandbox, writes its config and a box\n * boot hook (/data/boot.d/50-eve-sandbox, run on every boot by the box's\n * init), installs agent-browser and Chromium for every session, and (re)starts\n * the daemon on :3000, which unfazed publishes at the box's URL. Without\n * --allow, every app of the box's own owner may use it.\n */\nimport { execFileSync, spawn } from \"node:child_process\";\nimport {\n  chmodSync,\n  copyFileSync,\n  existsSync,\n  lstatSync,\n  mkdirSync,\n  readdirSync,\n  readFileSync,\n  renameSync,\n  rmSync,\n  symlinkSync,\n  writeFileSync,\n} from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { parseArgs } from \"node:util\";\n\n/** The agent-browser release `@agent-browser/eve` 0.41 drives; match the extension's minor. */\nexport const DEFAULT_AGENT_BROWSER = \"0.41.1\";\n\nconst ROOT = \"/data/eve-sandbox\";\nconst LIB = `${ROOT}/lib`;\nconst CONFIG = `${ROOT}/config.json`;\nconst HOOK = \"/data/boot.d/50-eve-sandbox\";\nconst BROWSERS = \"/opt/agent-browser/browsers\";\n\nconst HELP = `unfazed eve-sandbox — run eve sandboxes on this unfazed box (as root, inside the box)\n\nUsage:\n  npx unfazed eve-sandbox setup [--allow <app-id|owner:id>,…] [--no-browser]\n                                [--agent-browser <version>] [--proxy <url>]\n                                [--idle-minutes <n>] [--retention-days <n>]\n  npx unfazed eve-sandbox allow <app-id|owner:id>\n  npx unfazed eve-sandbox deny <app-id|owner:id>\n  npx unfazed eve-sandbox status\n  npx unfazed eve-sandbox serve\n\nsetup installs the daemon (on :3000, the box's URL), agent-browser ${DEFAULT_AGENT_BROWSER}\nand Chromium, and a boot hook that starts the daemon on every boot. Without\n--allow, every app of this box's owner may use the box. An eve app then\npoints its agent/sandbox.ts at it with UnfazedSandbox (unfazed/eve-sandbox):\n\n  export const environment = UnfazedSandbox.environment({ box: \"<this box's alias>\" });\n  export default defineSandbox(() => environment.open());\n`;\n\ninterface Config {\n  allow: string[];\n  idleMinutes?: number;\n  retentionDays?: number;\n  env?: Record<string, string>;\n  [key: string]: unknown;\n}\n\nfunction readConfig(): Config {\n  if (!existsSync(CONFIG)) return { allow: [] };\n  const parsed = JSON.parse(readFileSync(CONFIG, \"utf8\")) as Config;\n  return { ...parsed, allow: Array.isArray(parsed.allow) ? parsed.allow : [] };\n}\n\nfunction writeConfig(config: Config): void {\n  const temp = `${CONFIG}.tmp`;\n  writeFileSync(temp, JSON.stringify(config, null, 2) + \"\\n\", { mode: 0o600 });\n  renameSync(temp, CONFIG);\n}\n\nfunction sh(file: string, args: readonly string[], options: { quiet?: boolean } = {}): string {\n  return execFileSync(file, args, { encoding: \"utf8\", stdio: options.quiet ? [\"ignore\", \"pipe\", \"pipe\"] : [\"ignore\", \"pipe\", \"inherit\"] });\n}\n\nfunction requireBox(): void {\n  if (process.getuid?.() !== 0) throw new Error(\"unfazed eve-sandbox: run this as root inside the box\");\n  if (!existsSync(\"/sbin/unfazed-box-init\") || !process.env[\"UNFZ_PUBLIC_URL\"]) {\n    throw new Error(\"unfazed eve-sandbox: this is not an unfazed box (no /sbin/unfazed-box-init or UNFZ_PUBLIC_URL)\");\n  }\n}\n\n/** The box's own owner, from its workload identity token: the default allow entry. */\nasync function ownOwner(): Promise<string> {\n  const state = process.env[\"UNFZ_STATE_TOKEN\"];\n  const audience = process.env[\"UNFZ_PUBLIC_URL\"]!;\n  if (!state) throw new Error(\"unfazed eve-sandbox: UNFZ_STATE_TOKEN is not set; pass --allow\");\n  const res = await fetch(\"https://unfazed.dev/oidc/token\", {\n    method: \"POST\",\n    headers: { authorization: `Bearer ${state}`, \"content-type\": \"application/json\", \"user-agent\": \"unfazed-eve-sandbox-setup\" },\n    body: JSON.stringify({ audience }),\n  });\n  if (!res.ok) throw new Error(`unfazed eve-sandbox: could not read the box's owner (${res.status}); pass --allow`);\n  const { token } = (await res.json()) as { token: string };\n  const claims = JSON.parse(Buffer.from(token.split(\".\")[1]!.replace(/-/g, \"+\").replace(/_/g, \"/\"), \"base64\").toString(\"utf8\")) as {\n    owner_id?: string;\n  };\n  if (!claims.owner_id) throw new Error(\"unfazed eve-sandbox: the box's token names no owner; pass --allow\");\n  return `owner:${claims.owner_id}`;\n}\n\nfunction installDaemon(): void {\n  mkdirSync(LIB, { recursive: true });\n  chmodSync(ROOT, 0o755);\n  chmodSync(LIB, 0o755);\n  const source = join(dirname(fileURLToPath(import.meta.url)), \"..\", \"eve-sandbox\");\n  for (const file of [\"daemon.js\", \"protocol.js\"]) {\n    copyFileSync(join(source, file), join(LIB, file));\n    chmodSync(join(LIB, file), 0o644);\n  }\n  mkdirSync(dirname(HOOK), { recursive: true });\n  writeFileSync(\n    HOOK,\n    [\n      \"#!/bin/sh\",\n      \"# eve sandbox daemon (unfazed/eve-sandbox) on :3000, restarted if it exits.\",\n      `cd ${ROOT} || exit 1`,\n      \"while true; do\",\n      `  ${existsSync(\"/usr/local/bin/node\") ? \"/usr/local/bin/node\" : process.execPath} ${LIB}/daemon.js serve --config ${CONFIG} >>${ROOT}/daemon.log 2>&1`,\n      \"  sleep 2\",\n      \"done\",\n      \"\",\n    ].join(\"\\n\"),\n    { mode: 0o755 },\n  );\n}\n\n/** Installs agent-browser and Chromium once for every session; returns the Chromium binary. */\nfunction installBrowser(version: string): string {\n  process.stderr.write(`installing agent-browser@${version} and Chromium (a few minutes the first time)…\\n`);\n  const env = { ...process.env, DEBIAN_FRONTEND: \"noninteractive\" };\n  execFileSync(\"npm\", [\"install\", \"-g\", \"--silent\", `agent-browser@${version}`], { stdio: \"inherit\", env });\n  // agent-browser keeps browsers in the installing user's home; sessions are\n  // other users. Root's browser directory becomes the shared one, so a\n  // browser already there is found and not downloaded again.\n  mkdirSync(BROWSERS, { recursive: true });\n  const own = join(process.env[\"HOME\"] ?? \"/root\", \".agent-browser\", \"browsers\");\n  mkdirSync(dirname(own), { recursive: true });\n  if (existsSync(own) && !lstatSync(own).isSymbolicLink()) {\n    for (const entry of readdirSync(own)) {\n      if (!existsSync(join(BROWSERS, entry))) renameSync(join(own, entry), join(BROWSERS, entry));\n    }\n    rmSync(own, { recursive: true, force: true });\n  }\n  if (!existsSync(own)) symlinkSync(BROWSERS, own);\n  execFileSync(\"agent-browser\", [\"install\", \"--with-deps\"], { stdio: \"inherit\", env });\n  sh(\"chmod\", [\"-R\", \"a+rX\", \"/opt/agent-browser\"]);\n  const latest = readdirSync(BROWSERS)\n    .filter((e) => e.startsWith(\"chrome-\"))\n    .sort((a, b) => a.localeCompare(b, undefined, { numeric: true }))\n    .at(-1);\n  const binary = latest ? join(BROWSERS, latest, \"chrome\") : \"\";\n  if (!binary || !existsSync(binary)) throw new Error(\"unfazed eve-sandbox: Chromium was not found after the install\");\n  return binary;\n}\n\nfunction restartDaemon(): void {\n  // The boot hook's loop first (or it starts the old daemon again), then any\n  // daemon, wherever an earlier setup put it.\n  for (const pattern of [\"[b]oot\\\\.d/50-eve-sandbox\", \"[e]ve-sandbox[^ ]*daemon[^ ]*\\\\.js serve\"]) {\n    try {\n      sh(\"pkill\", [\"-f\", pattern], { quiet: true });\n    } catch {\n      // none running\n    }\n  }\n  execFileSync(\"sleep\", [\"1\"]);\n  const child = spawn(\"setsid\", [HOOK], { detached: true, stdio: \"ignore\" });\n  child.unref();\n}\n\nasync function health(): Promise<{ ok: boolean; version?: string }> {\n  for (let i = 0; i < 20; i++) {\n    try {\n      const res = await fetch(\"http://127.0.0.1:3000/v1/health\", { signal: AbortSignal.timeout(2000) });\n      if (res.ok) return (await res.json()) as { ok: boolean; version?: string };\n    } catch {\n      // not up yet\n    }\n    await new Promise((resolve) => setTimeout(resolve, 500));\n  }\n  return { ok: false };\n}\n\nfunction sessionCount(): number {\n  return sh(\"getent\", [\"passwd\"], { quiet: true })\n    .split(\"\\n\")\n    .filter((line) => /^eve[0-9a-f]{12}:/.test(line)).length;\n}\n\nexport async function runEveSandbox(argv: readonly string[]): Promise<number> {\n  const { values, positionals } = parseArgs({\n    args: [...argv],\n    allowPositionals: true,\n    options: {\n      allow: { type: \"string\" },\n      \"no-browser\": { type: \"boolean\" },\n      \"agent-browser\": { type: \"string\" },\n      proxy: { type: \"string\" },\n      \"idle-minutes\": { type: \"string\" },\n      \"retention-days\": { type: \"string\" },\n      config: { type: \"string\" },\n      help: { type: \"boolean\", short: \"h\" },\n    },\n  });\n  const [command, arg] = positionals;\n  if (values.help || command === undefined || command === \"help\") {\n    process.stdout.write(HELP);\n    return command === undefined ? 1 : 0;\n  }\n  if (command === \"serve\") {\n    const daemon = await import(\"../eve-sandbox/daemon.js\");\n    const config = daemon.loadConfig(values.config ?? CONFIG);\n    await daemon.createDaemon(config).listen();\n    process.stdout.write(`eve sandbox daemon on :${config.port} for ${config.audience}\\n`);\n    await new Promise(() => {});\n  }\n  requireBox();\n  const url = process.env[\"UNFZ_PUBLIC_URL\"]!;\n  switch (command) {\n    case \"setup\": {\n      const config = readConfig();\n      const allow = values.allow\n        ? values.allow.split(\",\").map((s) => s.trim()).filter(Boolean)\n        : config.allow.length > 0\n          ? []\n          : [await ownOwner()];\n      config.allow = [...new Set([...config.allow, ...allow])];\n      const number = (flag: string | undefined, name: string) => {\n        if (flag === undefined) return undefined;\n        const n = Number(flag);\n        if (!Number.isInteger(n) || n < 0) throw new Error(`unfazed eve-sandbox: --${name} must be a whole number`);\n        return n;\n      };\n      config.idleMinutes = number(values[\"idle-minutes\"], \"idle-minutes\") ?? config.idleMinutes ?? 20;\n      config.retentionDays = number(values[\"retention-days\"], \"retention-days\") ?? config.retentionDays ?? 14;\n      config.env = { ...(config.env ?? {}) };\n      if (values.proxy) config.env[\"AGENT_BROWSER_PROXY\"] = values.proxy;\n      installDaemon();\n      if (!values[\"no-browser\"]) config.env[\"AGENT_BROWSER_EXECUTABLE_PATH\"] = installBrowser(values[\"agent-browser\"] ?? DEFAULT_AGENT_BROWSER);\n      writeConfig(config);\n      restartDaemon();\n      const up = await health();\n      if (!up.ok) throw new Error(`unfazed eve-sandbox: the daemon did not come up; see ${ROOT}/daemon.log`);\n      const alias = new URL(url).hostname.split(\".\")[0];\n      process.stdout.write(\n        `eve sandbox ready at ${url} (daemon ${up.version}); allowed: ${config.allow.join(\", \")}\\n\\n` +\n          `In the eve app:\\n  export const environment = UnfazedSandbox.environment({ box: \"${alias}\" });\\n`,\n      );\n      return 0;\n    }\n    case \"allow\":\n    case \"deny\": {\n      if (!arg) throw new Error(`unfazed eve-sandbox: ${command} needs an app id or owner:<id>`);\n      const config = readConfig();\n      config.allow = command === \"allow\" ? [...new Set([...config.allow, arg])] : config.allow.filter((entry) => entry !== arg);\n      if (config.allow.length === 0) throw new Error(\"unfazed eve-sandbox: that would allow nothing; allow another app first\");\n      writeConfig(config);\n      restartDaemon();\n      const up = await health();\n      process.stdout.write(`${up.ok ? \"restarted\" : \"NOT restarted (see daemon.log)\"}; allowed: ${config.allow.join(\", \")}\\n`);\n      return up.ok ? 0 : 1;\n    }\n    case \"status\": {\n      const config = readConfig();\n      const up = await health();\n      process.stdout.write(\n        `${url}: ${up.ok ? `up (daemon ${up.version})` : \"DOWN\"}\\n` +\n          `allowed:  ${config.allow.join(\", \") || \"(none)\"}\\n` +\n          `sessions: ${sessionCount()}\\n` +\n          `browser:  ${config.env?.[\"AGENT_BROWSER_EXECUTABLE_PATH\"] ?? \"(not installed)\"}\\n`,\n      );\n      return up.ok ? 0 : 1;\n    }\n    default:\n      process.stderr.write(HELP);\n      return 1;\n  }\n}\n"]}

package/dist/cli/login.d.ts

@@ -1,6 +1,6 @@
 import { type StoredCredentials } from "../credentials.js";
 import { UnfazedError } from "../errors.js";
-export declare const USER_AGENT = "unfazed-cli/0.9.0 (+https://unfazed.dev/auth.md)";
+export declare const USER_AGENT = "unfazed-cli/0.10.0 (+https://unfazed.dev/auth.md)";
 /** What a login asks for: reading and deploying, like an MCP client. */
 export declare const DEFAULT_SCOPE = "unfz:read unfz:deploy";
 export declare const CLIENT_NAME = "unfazed CLI";

package/dist/cli.js

@@ -9,12 +9,15 @@
  *   npx unfazed logout    revoke (when the server offers it) and forget the login
  *   npx unfazed workflow inspect runs --app <alias>
  *                         Workflow SDK's CLI over an app, from any directory
+ *   npx unfazed eve-sandbox setup
+ *                         inside a box: host eve sandboxes there
  *
  * Nothing imports this file: `import "unfazed"` never loads the CLI.
  */
 import { parseArgs } from "node:util";
 import { VERSION } from "./client.js";
 import { DEFAULT_SCOPE, accountName, canOpenBrowser, login, logout, openBrowser, whoami } from "./cli/login.js";
+import { runEveSandbox } from "./cli/eve-sandbox.js";
 import { runWorkflow } from "./cli/workflow.js";
 const HELP = `unfazed ${VERSION} — sign in to unfazed from a terminal
 
@@ -23,6 +26,7 @@ Usage:
   npx unfazed whoami [--json]
   npx unfazed logout
   npx unfazed workflow <Workflow CLI arguments> [--app <alias>]
+  npx unfazed eve-sandbox setup|allow|deny|status   (inside a box, as root)
 
 Commands:
   login    Sign in to unfazed in the browser. The login is stored in
@@ -40,6 +44,9 @@ Commands:
            The app is --app, else UNFZ_APP, else ./unfazed.json; the token is
            the login (or UNFZ_API_TOKEN). Runs the project's own \`workflow\`
            (major 5) when installed, else \`npx -y workflow@5\`.
+  eve-sandbox Inside an unfazed box, as root: host eve sandboxes there for
+           \`unfazed/eve-sandbox\` (agent-browser + Chromium included). See
+           \`npx unfazed eve-sandbox --help\`.
 
 Options:
   --endpoint <url>  The platform: its origin or GraphQL URL
@@ -79,6 +86,10 @@ async function main(argv) {
         process.exitCode = await runWorkflow(argv.slice(1));
         return;
     }
+    if (argv[0] === "eve-sandbox") {
+        process.exitCode = await runEveSandbox(argv.slice(1));
+        return;
+    }
     let parsed;
     const parse = (args) => parseArgs({
         args,

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,8BAA8B;AAC9B;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAChH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,MAAM,IAAI,GAAG,WAAW,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;mDA4BoB,aAAa;;;;;CAK/D,CAAC;AAEF,+DAA+D;AAC/D,MAAM,IAAK,SAAQ,KAAK;CAAG;AAE3B;;;;GAIG;AACH,SAAS,IAAI,CAAC,IAAY;IACxB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IACxB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,IAAI,GAAG,GAAG,EAAE;QAChB,IAAI,EAAE,OAAO,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,IAAI,CAAC,OAAe;IAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC,CAAC,CAAC,CAAC;IACR,MAAM,IAAI,IAAI,EAAE,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAc;IAChC,iEAAiE;IACjE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;QAC3B,OAAO,CAAC,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,OAAO;IACT,CAAC;IACD,IAAI,MAAgC,CAAC;IACrC,MAAM,KAAK,GAAG,CAAC,IAAc,EAAE,EAAE,CAC/B,SAAS,CAAC;QACR,IAAI;QACJ,gBAAgB,EAAE,IAAI;QACtB,OAAO,EAAE;YACP,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACjC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACzB,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;YACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;SACzC;KACF,CAAC,CAAC;IACL,IAAI,CAAC;QACH,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,YAAa,KAAe,CAAC,OAAO,OAAO,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IACvC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACrC,OAAO;IACT,CAAC;IACD,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,WAAW,CAAC;IACvC,IAAI,MAAM,CAAC,IAAI,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,gCAAgC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAEhG,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,CAAC;gBACxC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChD,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,qEAAqE;gBACrE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzD,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kBAAkB,WAAW,CAAC,MAAM,OAAO,WAAW,CAAC,WAAW,CAAC,GAAG,IAAI,KAAK;gBAC7E,0BAA0B,IAAI,KAAK;gBACnC,iGAAiG,CACpG,CAAC;YACF,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;gBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wFAAwF,CAAC,CAAC;YAClJ,OAAO;QACT,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,MAAM,EAAE,CAAC;YAC9B,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;gBAC7D,OAAO;YACT,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;YACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,MAAM,KAAK;gBAC7D,eAAe,MAAM,CAAC,QAAQ,IAAI;gBAClC,eAAe,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,IAAI;gBACrD,eAAe,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,qBAAqB,MAAM,CAAC,IAAI,GAAG,IAAI,CACxG,CAAC;YACF,OAAO;QACT,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,MAAM,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;gBACzC,OAAO;YACT,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO;gBAC/B,CAAC,CAAC,0BAA0B;gBAC5B,CAAC,CAAC,MAAM,CAAC,mBAAmB;oBAC1B,CAAC,CAAC,iEAAiE;oBACnE,CAAC,CAAC,0FAA0F,CAAC;YACjG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,MAAM,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,CAAC;YACxE,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;gBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;YACxG,OAAO;QACT,CAAC;QACD;YACE,IAAI,CAAC,4BAA4B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAC9B,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EACvE,CAAC,KAAc,EAAE,EAAE;IACjB,IAAI,KAAK,YAAY,IAAI;QAAE,OAAO;IAClC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC/F,IAAI,CAAC,CAAC,CAAC,CAAC;AACV,CAAC,CACF,CAAC","sourcesContent":["#!/usr/bin/env node\n/// <reference types=\"node\" />\n/**\n * The `unfazed` bin:\n *\n *   npx unfazed login     sign in in the browser; the SDK and\n *                         `npx workflow … --backend unfazed` then use the login\n *   npx unfazed whoami    who the SDK acts as here\n *   npx unfazed logout    revoke (when the server offers it) and forget the login\n *   npx unfazed workflow inspect runs --app <alias>\n *                         Workflow SDK's CLI over an app, from any directory\n *\n * Nothing imports this file: `import \"unfazed\"` never loads the CLI.\n */\nimport { parseArgs } from \"node:util\";\nimport { VERSION } from \"./client.js\";\nimport { DEFAULT_SCOPE, accountName, canOpenBrowser, login, logout, openBrowser, whoami } from \"./cli/login.js\";\nimport { runWorkflow } from \"./cli/workflow.js\";\n\nconst HELP = `unfazed ${VERSION} — sign in to unfazed from a terminal\n\nUsage:\n  npx unfazed login [--endpoint <url>] [--scope \"<scopes>\"] [--no-browser]\n  npx unfazed whoami [--json]\n  npx unfazed logout\n  npx unfazed workflow <Workflow CLI arguments> [--app <alias>]\n\nCommands:\n  login    Sign in to unfazed in the browser. The login is stored in\n           \\${XDG_CONFIG_HOME:-~/.config}/unfazed/credentials.json (mode 0600);\n           the unfazed SDK and \\`npx workflow … --backend unfazed\\` use it\n           whenever UNFZ_API_TOKEN is unset, refreshing it as it expires.\n  whoami   Show who the SDK acts as here: UNFZ_API_TOKEN when set, else the login.\n  logout   Revoke the login's tokens when the server offers revocation, and\n           delete the stored login.\n  workflow Workflow SDK's CLI over an unfazed app, from any directory:\n             npx unfazed workflow inspect runs --app birthday-card\n             npx unfazed workflow inspect run <run-id> --app birthday-card\n             npx unfazed workflow cancel <run-id> --app birthday-card\n             npx unfazed workflow web --app birthday-card\n           The app is --app, else UNFZ_APP, else ./unfazed.json; the token is\n           the login (or UNFZ_API_TOKEN). Runs the project's own \\`workflow\\`\n           (major 5) when installed, else \\`npx -y workflow@5\\`.\n\nOptions:\n  --endpoint <url>  The platform: its origin or GraphQL URL\n                    (default: UNFZ_API_URL, else https://unfazed.dev)\n  --scope <scopes>  Scopes to ask for (default: \"${DEFAULT_SCOPE}\")\n  --no-browser      Print the sign-in URL instead of opening a browser\n  --json            whoami: print JSON\n  -h, --help        Show this help\n  -v, --version     Show the version\n`;\n\n/** Unwinds `main` once {@link fail} has scheduled the exit. */\nclass Exit extends Error {}\n\n/**\n * Exits once stdout and stderr are flushed (pipes are asynchronous on macOS),\n * so nothing a command started — a browser's keep-alive socket — holds the\n * terminal, and no output is cut.\n */\nfunction exit(code: number): void {\n  process.exitCode = code;\n  let pending = 2;\n  const done = () => {\n    if (--pending === 0) process.exit(code);\n  };\n  process.stdout.write(\"\", done);\n  process.stderr.write(\"\", done);\n}\n\nfunction fail(message: string): never {\n  process.stderr.write(message.replace(/\\s+$/, \"\") + \"\\n\");\n  exit(1);\n  throw new Exit();\n}\n\nasync function main(argv: string[]): Promise<void> {\n  // Everything after `workflow` is the Workflow CLI's (but --app).\n  if (argv[0] === \"workflow\") {\n    process.exitCode = await runWorkflow(argv.slice(1));\n    return;\n  }\n  let parsed: ReturnType<typeof parse>;\n  const parse = (args: string[]) =>\n    parseArgs({\n      args,\n      allowPositionals: true,\n      options: {\n        endpoint: { type: \"string\" },\n        scope: { type: \"string\" },\n        \"no-browser\": { type: \"boolean\" },\n        json: { type: \"boolean\" },\n        help: { type: \"boolean\", short: \"h\" },\n        version: { type: \"boolean\", short: \"v\" },\n      },\n    });\n  try {\n    parsed = parse(argv);\n  } catch (error) {\n    fail(`unfazed: ${(error as Error).message}\\n\\n${HELP}`);\n  }\n  const { values, positionals } = parsed;\n  if (values.version) {\n    process.stdout.write(`${VERSION}\\n`);\n    return;\n  }\n  const [command, ...rest] = positionals;\n  if (values.help || command === \"help\") {\n    process.stdout.write(HELP);\n    return;\n  }\n  if (command === undefined) fail(HELP);\n  if (rest.length > 0) fail(`unfazed: unexpected argument ${JSON.stringify(rest[0])}\\n\\n${HELP}`);\n\n  switch (command) {\n    case \"login\": {\n      const browser = !values[\"no-browser\"] && canOpenBrowser(process.env);\n      const { credentials, path } = await login({\n        ...(values.endpoint ? { endpoint: values.endpoint } : {}),\n        ...(values.scope ? { scope: values.scope } : {}),\n        ...(browser ? { openBrowser: (url: string) => openBrowser(url) } : {}),\n        // A browser on another machine: the person pastes where it ended up.\n        ...(process.stdin.isTTY ? { input: process.stdin } : {}),\n      });\n      const kind = credentials.account?.kind ? ` (${credentials.account.kind.toLowerCase()})` : \"\";\n      process.stderr.write(\n        `\\nSigned in to ${credentials.issuer} as ${accountName(credentials)}${kind}.\\n` +\n          `The login is stored in ${path}.\\n` +\n          `The unfazed SDK and \\`npx workflow … --backend unfazed\\` use it when UNFZ_API_TOKEN is unset.\\n`,\n      );\n      if (process.env[\"UNFZ_API_TOKEN\"]) process.stderr.write(\"UNFZ_API_TOKEN is set in this shell and takes precedence; unset it to use the login.\\n\");\n      return;\n    }\n    case \"whoami\": {\n      const result = await whoami();\n      if (values.json) {\n        process.stdout.write(JSON.stringify(result, null, 2) + \"\\n\");\n        return;\n      }\n      const { actor } = result;\n      process.stdout.write(\n        `${actor.name} (${actor.kind.toLowerCase()} ${actor.userID})\\n` +\n          `  endpoint  ${result.endpoint}\\n` +\n          `  scopes    ${actor.scopes.join(\" \") || \"(none)\"}\\n` +\n          `  via       ${result.source === \"token\" ? \"UNFZ_API_TOKEN\" : `the stored login (${result.path})`}\\n`,\n      );\n      return;\n    }\n    case \"logout\": {\n      const result = await logout();\n      if (!result.signedOut) {\n        process.stderr.write(\"Not signed in.\\n\");\n        return;\n      }\n      const revocation = result.revoked\n        ? \"The tokens were revoked.\"\n        : result.revocationSupported\n          ? \"Revoking the tokens failed; they stop working when they expire.\"\n          : \"The server offers no token revocation; the deleted tokens stop working when they expire.\";\n      process.stderr.write(`Signed out of ${result.issuer}. ${revocation}\\n`);\n      if (process.env[\"UNFZ_API_TOKEN\"]) process.stderr.write(\"UNFZ_API_TOKEN is still set in this shell.\\n\");\n      return;\n    }\n    default:\n      fail(`unfazed: unknown command ${JSON.stringify(command)}\\n\\n${HELP}`);\n  }\n}\n\nmain(process.argv.slice(2)).then(\n  () => exit(typeof process.exitCode === \"number\" ? process.exitCode : 0),\n  (error: unknown) => {\n    if (error instanceof Exit) return;\n    const message = error instanceof Error ? error.message : String(error);\n    process.stderr.write((message.startsWith(\"unfazed\") ? message : `unfazed: ${message}`) + \"\\n\");\n    exit(1);\n  },\n);\n"]}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,8BAA8B;AAC9B;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAChH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,MAAM,IAAI,GAAG,WAAW,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mDAgCoB,aAAa;;;;;CAK/D,CAAC;AAEF,+DAA+D;AAC/D,MAAM,IAAK,SAAQ,KAAK;CAAG;AAE3B;;;;GAIG;AACH,SAAS,IAAI,CAAC,IAAY;IACxB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IACxB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,IAAI,GAAG,GAAG,EAAE;QAChB,IAAI,EAAE,OAAO,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,IAAI,CAAC,OAAe;IAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC,CAAC,CAAC,CAAC;IACR,MAAM,IAAI,IAAI,EAAE,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAc;IAChC,iEAAiE;IACjE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;QAC3B,OAAO,CAAC,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,aAAa,EAAE,CAAC;QAC9B,OAAO,CAAC,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IACD,IAAI,MAAgC,CAAC;IACrC,MAAM,KAAK,GAAG,CAAC,IAAc,EAAE,EAAE,CAC/B,SAAS,CAAC;QACR,IAAI;QACJ,gBAAgB,EAAE,IAAI;QACtB,OAAO,EAAE;YACP,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACjC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACzB,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;YACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;SACzC;KACF,CAAC,CAAC;IACL,IAAI,CAAC;QACH,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,YAAa,KAAe,CAAC,OAAO,OAAO,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IACvC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACrC,OAAO;IACT,CAAC;IACD,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,WAAW,CAAC;IACvC,IAAI,MAAM,CAAC,IAAI,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,gCAAgC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAEhG,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,CAAC;gBACxC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChD,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,qEAAqE;gBACrE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzD,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kBAAkB,WAAW,CAAC,MAAM,OAAO,WAAW,CAAC,WAAW,CAAC,GAAG,IAAI,KAAK;gBAC7E,0BAA0B,IAAI,KAAK;gBACnC,iGAAiG,CACpG,CAAC;YACF,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;gBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wFAAwF,CAAC,CAAC;YAClJ,OAAO;QACT,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,MAAM,EAAE,CAAC;YAC9B,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;gBAC7D,OAAO;YACT,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;YACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,MAAM,KAAK;gBAC7D,eAAe,MAAM,CAAC,QAAQ,IAAI;gBAClC,eAAe,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,IAAI;gBACrD,eAAe,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,qBAAqB,MAAM,CAAC,IAAI,GAAG,IAAI,CACxG,CAAC;YACF,OAAO;QACT,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,MAAM,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;gBACzC,OAAO;YACT,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO;gBAC/B,CAAC,CAAC,0BAA0B;gBAC5B,CAAC,CAAC,MAAM,CAAC,mBAAmB;oBAC1B,CAAC,CAAC,iEAAiE;oBACnE,CAAC,CAAC,0FAA0F,CAAC;YACjG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,MAAM,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,CAAC;YACxE,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;gBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;YACxG,OAAO;QACT,CAAC;QACD;YACE,IAAI,CAAC,4BAA4B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAC9B,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EACvE,CAAC,KAAc,EAAE,EAAE;IACjB,IAAI,KAAK,YAAY,IAAI;QAAE,OAAO;IAClC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC/F,IAAI,CAAC,CAAC,CAAC,CAAC;AACV,CAAC,CACF,CAAC","sourcesContent":["#!/usr/bin/env node\n/// <reference types=\"node\" />\n/**\n * The `unfazed` bin:\n *\n *   npx unfazed login     sign in in the browser; the SDK and\n *                         `npx workflow … --backend unfazed` then use the login\n *   npx unfazed whoami    who the SDK acts as here\n *   npx unfazed logout    revoke (when the server offers it) and forget the login\n *   npx unfazed workflow inspect runs --app <alias>\n *                         Workflow SDK's CLI over an app, from any directory\n *   npx unfazed eve-sandbox setup\n *                         inside a box: host eve sandboxes there\n *\n * Nothing imports this file: `import \"unfazed\"` never loads the CLI.\n */\nimport { parseArgs } from \"node:util\";\nimport { VERSION } from \"./client.js\";\nimport { DEFAULT_SCOPE, accountName, canOpenBrowser, login, logout, openBrowser, whoami } from \"./cli/login.js\";\nimport { runEveSandbox } from \"./cli/eve-sandbox.js\";\nimport { runWorkflow } from \"./cli/workflow.js\";\n\nconst HELP = `unfazed ${VERSION} — sign in to unfazed from a terminal\n\nUsage:\n  npx unfazed login [--endpoint <url>] [--scope \"<scopes>\"] [--no-browser]\n  npx unfazed whoami [--json]\n  npx unfazed logout\n  npx unfazed workflow <Workflow CLI arguments> [--app <alias>]\n  npx unfazed eve-sandbox setup|allow|deny|status   (inside a box, as root)\n\nCommands:\n  login    Sign in to unfazed in the browser. The login is stored in\n           \\${XDG_CONFIG_HOME:-~/.config}/unfazed/credentials.json (mode 0600);\n           the unfazed SDK and \\`npx workflow … --backend unfazed\\` use it\n           whenever UNFZ_API_TOKEN is unset, refreshing it as it expires.\n  whoami   Show who the SDK acts as here: UNFZ_API_TOKEN when set, else the login.\n  logout   Revoke the login's tokens when the server offers revocation, and\n           delete the stored login.\n  workflow Workflow SDK's CLI over an unfazed app, from any directory:\n             npx unfazed workflow inspect runs --app birthday-card\n             npx unfazed workflow inspect run <run-id> --app birthday-card\n             npx unfazed workflow cancel <run-id> --app birthday-card\n             npx unfazed workflow web --app birthday-card\n           The app is --app, else UNFZ_APP, else ./unfazed.json; the token is\n           the login (or UNFZ_API_TOKEN). Runs the project's own \\`workflow\\`\n           (major 5) when installed, else \\`npx -y workflow@5\\`.\n  eve-sandbox Inside an unfazed box, as root: host eve sandboxes there for\n           \\`unfazed/eve-sandbox\\` (agent-browser + Chromium included). See\n           \\`npx unfazed eve-sandbox --help\\`.\n\nOptions:\n  --endpoint <url>  The platform: its origin or GraphQL URL\n                    (default: UNFZ_API_URL, else https://unfazed.dev)\n  --scope <scopes>  Scopes to ask for (default: \"${DEFAULT_SCOPE}\")\n  --no-browser      Print the sign-in URL instead of opening a browser\n  --json            whoami: print JSON\n  -h, --help        Show this help\n  -v, --version     Show the version\n`;\n\n/** Unwinds `main` once {@link fail} has scheduled the exit. */\nclass Exit extends Error {}\n\n/**\n * Exits once stdout and stderr are flushed (pipes are asynchronous on macOS),\n * so nothing a command started — a browser's keep-alive socket — holds the\n * terminal, and no output is cut.\n */\nfunction exit(code: number): void {\n  process.exitCode = code;\n  let pending = 2;\n  const done = () => {\n    if (--pending === 0) process.exit(code);\n  };\n  process.stdout.write(\"\", done);\n  process.stderr.write(\"\", done);\n}\n\nfunction fail(message: string): never {\n  process.stderr.write(message.replace(/\\s+$/, \"\") + \"\\n\");\n  exit(1);\n  throw new Exit();\n}\n\nasync function main(argv: string[]): Promise<void> {\n  // Everything after `workflow` is the Workflow CLI's (but --app).\n  if (argv[0] === \"workflow\") {\n    process.exitCode = await runWorkflow(argv.slice(1));\n    return;\n  }\n  if (argv[0] === \"eve-sandbox\") {\n    process.exitCode = await runEveSandbox(argv.slice(1));\n    return;\n  }\n  let parsed: ReturnType<typeof parse>;\n  const parse = (args: string[]) =>\n    parseArgs({\n      args,\n      allowPositionals: true,\n      options: {\n        endpoint: { type: \"string\" },\n        scope: { type: \"string\" },\n        \"no-browser\": { type: \"boolean\" },\n        json: { type: \"boolean\" },\n        help: { type: \"boolean\", short: \"h\" },\n        version: { type: \"boolean\", short: \"v\" },\n      },\n    });\n  try {\n    parsed = parse(argv);\n  } catch (error) {\n    fail(`unfazed: ${(error as Error).message}\\n\\n${HELP}`);\n  }\n  const { values, positionals } = parsed;\n  if (values.version) {\n    process.stdout.write(`${VERSION}\\n`);\n    return;\n  }\n  const [command, ...rest] = positionals;\n  if (values.help || command === \"help\") {\n    process.stdout.write(HELP);\n    return;\n  }\n  if (command === undefined) fail(HELP);\n  if (rest.length > 0) fail(`unfazed: unexpected argument ${JSON.stringify(rest[0])}\\n\\n${HELP}`);\n\n  switch (command) {\n    case \"login\": {\n      const browser = !values[\"no-browser\"] && canOpenBrowser(process.env);\n      const { credentials, path } = await login({\n        ...(values.endpoint ? { endpoint: values.endpoint } : {}),\n        ...(values.scope ? { scope: values.scope } : {}),\n        ...(browser ? { openBrowser: (url: string) => openBrowser(url) } : {}),\n        // A browser on another machine: the person pastes where it ended up.\n        ...(process.stdin.isTTY ? { input: process.stdin } : {}),\n      });\n      const kind = credentials.account?.kind ? ` (${credentials.account.kind.toLowerCase()})` : \"\";\n      process.stderr.write(\n        `\\nSigned in to ${credentials.issuer} as ${accountName(credentials)}${kind}.\\n` +\n          `The login is stored in ${path}.\\n` +\n          `The unfazed SDK and \\`npx workflow … --backend unfazed\\` use it when UNFZ_API_TOKEN is unset.\\n`,\n      );\n      if (process.env[\"UNFZ_API_TOKEN\"]) process.stderr.write(\"UNFZ_API_TOKEN is set in this shell and takes precedence; unset it to use the login.\\n\");\n      return;\n    }\n    case \"whoami\": {\n      const result = await whoami();\n      if (values.json) {\n        process.stdout.write(JSON.stringify(result, null, 2) + \"\\n\");\n        return;\n      }\n      const { actor } = result;\n      process.stdout.write(\n        `${actor.name} (${actor.kind.toLowerCase()} ${actor.userID})\\n` +\n          `  endpoint  ${result.endpoint}\\n` +\n          `  scopes    ${actor.scopes.join(\" \") || \"(none)\"}\\n` +\n          `  via       ${result.source === \"token\" ? \"UNFZ_API_TOKEN\" : `the stored login (${result.path})`}\\n`,\n      );\n      return;\n    }\n    case \"logout\": {\n      const result = await logout();\n      if (!result.signedOut) {\n        process.stderr.write(\"Not signed in.\\n\");\n        return;\n      }\n      const revocation = result.revoked\n        ? \"The tokens were revoked.\"\n        : result.revocationSupported\n          ? \"Revoking the tokens failed; they stop working when they expire.\"\n          : \"The server offers no token revocation; the deleted tokens stop working when they expire.\";\n      process.stderr.write(`Signed out of ${result.issuer}. ${revocation}\\n`);\n      if (process.env[\"UNFZ_API_TOKEN\"]) process.stderr.write(\"UNFZ_API_TOKEN is still set in this shell.\\n\");\n      return;\n    }\n    default:\n      fail(`unfazed: unknown command ${JSON.stringify(command)}\\n\\n${HELP}`);\n  }\n}\n\nmain(process.argv.slice(2)).then(\n  () => exit(typeof process.exitCode === \"number\" ? process.exitCode : 0),\n  (error: unknown) => {\n    if (error instanceof Exit) return;\n    const message = error instanceof Error ? error.message : String(error);\n    process.stderr.write((message.startsWith(\"unfazed\") ? message : `unfazed: ${message}`) + \"\\n\");\n    exit(1);\n  },\n);\n"]}

package/dist/client.d.ts

@@ -1,5 +1,5 @@
 /** SDK version, sent as the User-Agent. Keep in sync with package.json. */
-export declare const VERSION = "0.9.0";
+export declare const VERSION = "0.10.0";
 /**
  * Default GraphQL endpoint.
  *

package/dist/client.js

@@ -1,7 +1,7 @@
 import { LOGIN_COMMAND, openStoredLogin } from "./credentials.js";
 import { UnfazedAuthError, UnfazedConfigError, UnfazedGraphQLError, UnfazedHTTPError, UnfazedTimeoutError, } from "./errors.js";
 /** SDK version, sent as the User-Agent. Keep in sync with package.json. */
-export const VERSION = "0.9.0";
+export const VERSION = "0.10.0";
 /**
  * Default GraphQL endpoint.
  *