verikun 0.4.1 → 0.7.0

package/dist/agent/remote.js

@@ -0,0 +1,166 @@
+"use strict";
+// The remote execution backend: `vk ai/suite/install --server <url>` run their
+// device work through a `vk server` sitting next to the device, over HTTP+JSON
+// (Node's global fetch — no SDK, zero runtime deps). One validated leaf command =
+// ONE round-trip: the server keeps the whole auto-wait/dump loop on its side.
+//
+// The step detail each exec produces (selector, tier, resolved element, failure
+// evidence) comes back in the response and is handed to `onStep`, which splices it
+// into the CALLER's local run — so a remote run archives a report identical to a
+// local one. Recording stays a caller concern: this module never touches ./.verikun.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pingServer = pingServer;
+exports.createRemoteBackend = createRemoteBackend;
+const node_fs_1 = require("node:fs");
+const node_crypto_1 = require("node:crypto");
+const node_path_1 = require("node:path");
+const errors_1 = require("../errors");
+const rpc_1 = require("../rpc");
+// Per-call ceilings. exec is generous: a single leaf may legitimately block for its
+// whole auto-wait window or an explicit `wait --timeout`, plus device time.
+const HEALTH_TIMEOUT_MS = 10_000;
+const ELEMENTS_TIMEOUT_MS = 60_000;
+const EXEC_TIMEOUT_MS = 10 * 60_000;
+const INSTALL_TIMEOUT_MS = 15 * 60_000;
+const trimUrl = (url) => url.replace(/\/+$/, '');
+function describeStatus(status, body, url) {
+    const detail = body?.error ? `: ${body.error}` : '';
+    if (status === 401) {
+        return new errors_1.CliError(`verikun server rejected the auth key (401)${detail}. Check --auth-key / VERIKUN_SERVER_AUTH_KEY.`, 3);
+    }
+    if (status === 409) {
+        return new errors_1.CliError(`verikun server device is busy (409)${detail || ' — another run holds the device; retry when it finishes'}.`, 3);
+    }
+    // The server sends the intended exit code (usage 2 / env 3) in the body; fall
+    // back on the HTTP class when it didn't.
+    const exitCode = body?.exitCode ?? (status === 400 || status === 404 || status === 413 ? 2 : 3);
+    return new errors_1.CliError(`verikun server error ${status} at ${url}${detail}`, exitCode);
+}
+async function readBody(res) {
+    try {
+        return (await res.json());
+    }
+    catch {
+        return null;
+    }
+}
+class RemoteTransport {
+    opts;
+    base;
+    /** One token per backend = one logical run holding the server's device lock. */
+    runToken = (0, node_crypto_1.randomUUID)();
+    constructor(opts) {
+        this.opts = opts;
+        this.base = trimUrl(opts.url);
+    }
+    headers(extra = {}) {
+        const h = { 'x-verikun-run': this.runToken, ...extra };
+        if (this.opts.authKey)
+            h.authorization = `Bearer ${this.opts.authKey}`;
+        return h;
+    }
+    async request(method, path, body, timeoutMs, extraHeaders = {}) {
+        const url = `${this.base}${path}`;
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), timeoutMs);
+        let res;
+        try {
+            res = await fetch(url, {
+                method,
+                headers: this.headers(extraHeaders),
+                body,
+                signal: controller.signal,
+            });
+        }
+        catch (e) {
+            const reason = e.name === 'AbortError' ? `timed out after ${Math.round(timeoutMs / 1000)}s` : e.message;
+            throw new errors_1.CliError(`cannot reach verikun server at ${url} (${reason})`, 3);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        if (!res.ok)
+            throw describeStatus(res.status, await readBody(res), url);
+        const parsed = await readBody(res);
+        if (parsed === null)
+            throw new errors_1.CliError(`verikun server at ${url} returned a non-JSON response`, 3);
+        return parsed;
+    }
+    postJson(path, payload, timeoutMs) {
+        return this.request('POST', path, JSON.stringify(payload), timeoutMs, { 'content-type': 'application/json' });
+    }
+}
+/** GET /v1/health — the `--server` preflight. Reachability, the server's platform +
+ *  serial (which become the run's context), and — when a key is supplied — an auth
+ *  check, so a bad key fails fast here instead of at the first step. */
+async function pingServer(opts) {
+    const t = new RemoteTransport(opts);
+    const health = await t.request('GET', '/v1/health', undefined, HEALTH_TIMEOUT_MS);
+    if (!health.ok || !health.platform) {
+        throw new errors_1.CliError(`'${trimUrl(opts.url)}' does not look like a verikun server (unexpected /v1/health payload).`, 3);
+    }
+    return health;
+}
+function decodeArtifacts(encoded) {
+    const out = {};
+    for (const [rel, b64] of Object.entries(encoded ?? {}))
+        out[rel] = Buffer.from(b64, 'base64');
+    return out;
+}
+function createRemoteBackend(opts, health) {
+    const t = new RemoteTransport(opts);
+    const execRaw = async (req, record) => {
+        const res = await t.postJson('/v1/exec', req, EXEC_TIMEOUT_MS);
+        if (record && res.step)
+            opts.onStep?.(res.step, decodeArtifacts(res.artifacts));
+        return { code: res.code, error: res.error ? (0, rpc_1.rebuildError)(res.error) : undefined };
+    };
+    return {
+        exec: (command, positionals, flags) => execRaw({ command, positionals, flags }, true),
+        async getElements() {
+            const res = await t.postJson('/v1/elements', {}, ELEMENTS_TIMEOUT_MS);
+            return res.elements;
+        },
+        async install(appPath) {
+            // v1 remote installs are single-file uploads; the extension is the only thing
+            // the client tells the server about the artifact (never a path).
+            const ext = (0, node_path_1.extname)(appPath).slice(1).toLowerCase();
+            if (ext !== 'apk' && ext !== 'ipa') {
+                throw new errors_1.CliError(`install --server accepts a single .apk or .ipa file; got '${appPath}'. (.app directories are local-only.)`, 2);
+            }
+            let buf;
+            try {
+                buf = (0, node_fs_1.readFileSync)(appPath);
+            }
+            catch (e) {
+                throw new errors_1.CliError(`install: cannot read '${appPath}' (${e.message})`, 2);
+            }
+            const sha256 = (0, node_crypto_1.createHash)('sha256').update(buf).digest('hex');
+            await t.request('POST', '/v1/install', buf, INSTALL_TIMEOUT_MS, {
+                'content-type': 'application/octet-stream',
+                'x-verikun-ext': ext,
+                'x-verikun-sha256': sha256,
+            });
+        },
+        async reset(appId) {
+            // Between-test housekeeping (vk suite): the step is deliberately NOT spliced
+            // into any run. iOS has no per-app data reset, so degrade to a force-stop —
+            // the same honest degrade the local backend applies.
+            const command = health.platform === 'ios' ? 'stop' : 'clear';
+            const { code, error } = await execRaw({ command, positionals: [appId], flags: {} }, false);
+            if (code !== 0)
+                throw error ?? new errors_1.CliError(`reset (${command} ${appId}) failed on the server (exit ${code})`, 3);
+        },
+        async close() {
+            // Free the server's device lock so the next command (a fresh run token, e.g.
+            // `vk install` then `vk suite` in one CI job) isn't 409'd until the idle
+            // takeover. Best-effort: a dead server just means the lock ages out.
+            try {
+                await t.postJson('/v1/release', {}, HEALTH_TIMEOUT_MS);
+            }
+            catch {
+                /* the idle takeover covers a lock we failed to release */
+            }
+        },
+    };
+}

package/dist/args.js

@@ -41,6 +41,8 @@ const BOOLEAN = new Set([
     'recompile',
     'no-cache',
     'no-restart',
+    'allow-install',
+    'allow-unsafe-anonymous',
 ]);
 function parseArgs(argv) {
     const positionals = [];