vibe64 0.1.34 → 0.1.35
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
#!/opt/vibe64/runtime-packs/node26/bin/node
|
|
2
2
|
import { createRequire as __vibe64CreateRequire } from 'node:module';const require=__vibe64CreateRequire(import.meta.url);
|
|
3
|
-
import{spawn as Ye,spawnSync as
|
|
3
|
+
import{spawn as Ye,spawnSync as j}from"node:child_process";import{chmodSync as Je,chownSync as xe,closeSync as Ze,existsSync as _,
|
|
4
4
|
lstatSync as fe,mkdirSync as _e,openSync as Qe,readFileSync as h,readSync as et,realpathSync as te,renameSync as Ne,rmSync as Te,
|
|
5
|
-
unlinkSync as
|
|
5
|
+
unlinkSync as L,writeFileSync as oe}from"node:fs";import u from"node:path";import{createConnection as tt}from"node:net";
|
|
6
6
|
import w from"node:process";var Ie=1024*1024,rt=64*1024,nt=10,ot=15e3,it="vibe64.exec-helper.payload",st=1,at=new Set(["\
|
|
7
7
|
account-auth-terminal","account-status","codex-app-server","create-system-user","deployment-service","enable-system-user",
|
|
8
8
|
"github-api-command","github-toolchain","github-workflow-command","health-status","managed-execution","managed-service",
|
|
@@ -17,68 +17,68 @@ opt/vibe64/runtime-packs/python/bin","/opt/vibe64/runtime-packs/ruby/bin","/opt/
|
|
|
17
17
|
4/runtime-packs/java/bin","/opt/vibe64/runtime-packs/kotlin/bin","/opt/vibe64/runtime-packs/csharp/bin","/opt/vibe64/run\
|
|
18
18
|
time-packs/rust/bin","/opt/vibe64/runtime-packs/mariadb/bin","/opt/vibe64/runtime-packs/postgresql/bin","/opt/vibe64/run\
|
|
19
19
|
time-packs/sqlite/bin","/opt/vibe64/runtime-packs/playwright/bin","/opt/vibe64/runtime-packs/guard-bin","/usr/local/sbin",
|
|
20
|
-
"/usr/local/bin","/usr/sbin","/usr/bin","/sbin","/bin"].join(":"),
|
|
21
|
-
64d_",
|
|
20
|
+
"/usr/local/bin","/usr/sbin","/usr/bin","/sbin","/bin"].join(":"),lt=/^[a-z][a-z0-9_-]{0,61}[a-z0-9]$/u,$="vibe64",re="v\
|
|
21
|
+
64d_",mt="/var/lib/vibe64",dt=new Set(["root"]),pt=/^[a-f0-9]{8}-[a-f0-9]{4}-[1-8][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/iu,
|
|
22
22
|
ft=new Set(["assistant","browser","control","job","preview","service","terminal"]),wt=new Set(["capture","detached","pty"]),
|
|
23
23
|
F=64*1024*1024,$e=1024*1024*1024*1024,yt=256*1024*1024,we=1024*1024*1024*1024,de=8,pe=8192,gt=15e3;import.meta.main&&ht().
|
|
24
24
|
catch(e=>{w.stderr.write(`${String(e?.message||e)}
|
|
25
25
|
`),w.exit(2)});async function ht(){if(w.argv[2]==="run-managed"){await bt(w.argv[3]||"");return}if(w.argv[2]!=="execute")
|
|
26
|
-
throw new Error("Usage: vibe64-exec-helper execute [payload-json-file]");let e=Jt(w.argv[3]||"");
|
|
26
|
+
throw new Error("Usage: vibe64-exec-helper execute [payload-json-file]");let e=Jt(w.argv[3]||"");Gt(e);let t=String(e.operation||
|
|
27
27
|
"").trim();if(!at.has(t))throw new Error("Vibe64 exec helper rejected an unknown operation.");if(t==="deployment-service"){
|
|
28
|
-
Ht(e);return}if(t==="managed-service"){Kt(e);return}if(t==="managed-execution"){St(e,w.argv[3]||"");return}let r=
|
|
28
|
+
Ht(e);return}if(t==="managed-service"){Kt(e);return}if(t==="managed-execution"){St(e,w.argv[3]||"");return}let r=T(e.username);
|
|
29
29
|
if(t==="create-system-user"||t==="enable-system-user"){Wt(t,e,r);return}Se(r);let n=String(e.command||"").trim();if(!je.
|
|
30
30
|
has(n))throw new Error("Vibe64 exec helper rejected an unknown command.");let o=X(r);ne("uid",e.uid,o.uid),ne("gid",e.gid,
|
|
31
|
-
o.gid);let i=q();Ke(i,r),Ue(o.username
|
|
31
|
+
o.gid);let i=q();Ke(i,r),Ue(o.username,$);let s=Fe(e.cwd||"",i.username,{operation:t,targetUser:o}),a=be(e.env||{},o,i.username,
|
|
32
32
|
t),c=Array.isArray(e.args)?e.args.map(d=>String(d)):[],m=e.inputBase64?Buffer.from(String(e.inputBase64),"base64"):void 0;
|
|
33
|
-
w.umask(7);let
|
|
34
|
-
error)throw
|
|
33
|
+
w.umask(7);let l=Et(o,n,c,{cwd:s,env:a,...m===void 0?{stdio:"inherit"}:{input:m,stdio:["pipe","inherit","inherit"]}});if(l.
|
|
34
|
+
error)throw l.error;w.exit(typeof l.status=="number"?l.status:1)}function Et(e,t,r,n){return j("/usr/sbin/runuser",["-u",
|
|
35
35
|
e.username,"--","/usr/bin/env","--",`PATH=${n.env.PATH}`,t,...r],{...n,env:{...n.env,PATH:ie}})}function St(e={},t=""){let r=q();
|
|
36
|
-
vt(t,r),ae(
|
|
36
|
+
vt(t,r),ae($);let n=String(e.action||"").trim();if(n.startsWith("workflow-")){let O=Ot(e,r);w.stdout.write(`${JSON.stringify(
|
|
37
37
|
O)}
|
|
38
|
-
`),O.ok!==!0&&(w.exitCode=1);return}let o=W(e.executionId),i=De(o,r);if(n==="inspect"){Pt(i,o,r);return}if(n==="stop"){
|
|
38
|
+
`),O.ok!==!0&&(w.exitCode=1);return}let o=W(e.executionId),i=De(o,r);if(n==="inspect"){Pt(i,o,r);return}if(n==="stop"){Lt(
|
|
39
39
|
i,o,r);return}if(n!=="start")throw new Error("Vibe64 exec helper rejected an unknown managed execution action.");let s=It(
|
|
40
40
|
e.mode),a=Tt(e.kind),c=String(e.lifecycle||"").trim();if(c!==(s==="capture"?"finite":s==="pty"?"interactive":"service"))
|
|
41
|
-
throw new Error("Vibe64 exec helper rejected a managed execution lifecycle mismatch.");let
|
|
42
|
-
d=Nt(e,r),
|
|
41
|
+
throw new Error("Vibe64 exec helper rejected a managed execution lifecycle mismatch.");let l=Re(e.controllerLeaseName,c),
|
|
42
|
+
d=Nt(e,r),p=String(e.commandOperation||"").trim(),f=Fe(e.cwd||"",r.username,{operation:p,targetUser:d}),g=String(e.command||
|
|
43
43
|
"").trim();if(!g||/[\r\n]/u.test(g))throw new Error("Vibe64 exec helper rejected an invalid managed execution command.");
|
|
44
44
|
if(d.username!==r.username&&!je.has(u.basename(g)))throw new Error("Vibe64 exec helper rejected an unsupported real-user\
|
|
45
|
-
managed command.");let x=Array.isArray(e.args)?e.args.map(O=>String(O)):[],M=be(e.env||{},d,r.username,
|
|
45
|
+
managed command.");let x=Array.isArray(e.args)?e.args.map(O=>String(O)):[],M=be(e.env||{},d,r.username,p),y="";if(e.releaseEnvironmentFile){
|
|
46
46
|
if(s!=="capture"||d.username!==r.username)throw new Error("Release environment requires finite owner execution.");y=ee(e.
|
|
47
47
|
releaseEnvironmentFile,r,"environmentFile");let O=fe(y),B=u.join(u.dirname(u.dirname(y)),"workspace");if(u.basename(y)!==
|
|
48
48
|
"environment"||u.basename(u.dirname(y))!=="service"||!O.isFile()||O.uid!==r.uid||(O.mode&63)!==0||te(y)!==y||te(f)!==f||
|
|
49
|
-
f!==B&&
|
|
50
|
-
F,$e,"memory limit"),V=U(e.tasksMax,de,pe,"task limit"),H=U(e.workMemoryMaxBytes,yt,we,"work-slice memory limit"),
|
|
51
|
-
workTasksMax,de,pe,"work-slice task limit");if(D>H||V>
|
|
49
|
+
f!==B&&I(B,f).length===0)throw new Error("Release environment must belong to the selected private release.")}let D=U(e.memoryMaxBytes,
|
|
50
|
+
F,$e,"memory limit"),V=U(e.tasksMax,de,pe,"task limit"),H=U(e.workMemoryMaxBytes,yt,we,"work-slice memory limit"),b=U(e.
|
|
51
|
+
workTasksMax,de,pe,"work-slice task limit");if(D>H||V>b)throw new Error("Vibe64 exec helper rejected an execution limit \
|
|
52
52
|
above its work-slice limit.");let k=he(r);if(e.workflow){let O=Ce(e.workflow,r),B=P(O);if(B.activeState!=="active"||!B.controlGroup||
|
|
53
53
|
B.finishedAt)throw new Error("Vibe64 exec helper rejected an execution without its active workflow group.");if(D>B.memoryMaxBytes||
|
|
54
54
|
V>B.tasksMax)throw new Error("Vibe64 exec helper rejected an execution limit above its workflow limit.");k=O.unitName}else
|
|
55
|
-
Mt(r,{memoryMaxBytes:H,tasksMax:
|
|
56
|
-
uid,d.gid),oe(Z,`${JSON.stringify({args:x,command:g,controllerLeaseName:
|
|
55
|
+
Mt(r,{memoryMaxBytes:H,tasksMax:b});jt(r);let J=Ee(r,o),Z=u.join(J,"command.json");_e(J,{mode:448,recursive:!0}),xe(J,d.
|
|
56
|
+
uid,d.gid),oe(Z,`${JSON.stringify({args:x,command:g,controllerLeaseName:l,cwd:f,env:M,inputBase64:String(e.inputBase64||
|
|
57
57
|
""),inputPresent:e.inputPresent===!0,...y?{releaseEnvironment:!0}:{},executionId:o,schema:"vibe64.managed-execution.comm\
|
|
58
58
|
and",schemaVersion:1})}
|
|
59
59
|
`,{flag:"wx",mode:384}),Je(Z,384),xe(Z,d.uid,d.gid);let Xe=u.resolve(w.argv[1]),qe=["--quiet",`--unit=${i}`,"--service-t\
|
|
60
60
|
ype=exec",`--slice=${k}`,`--property=Description=Vibe64 ${a} execution`,`--property=User=${d.username}`,`--property=Grou\
|
|
61
|
-
p=${
|
|
61
|
+
p=${$}`,"--property=SupplementaryGroups=nix-users","--property=UMask=0007",`--property=WorkingDirectory=${f}`,...y?[`--p\
|
|
62
62
|
roperty=EnvironmentFile=${y}`]:[],"--property=KillMode=control-group","--property=ExitType=cgroup","--property=OOMPolicy\
|
|
63
63
|
=stop","--property=MemoryAccounting=yes","--property=IOAccounting=yes","--property=TasksAccounting=yes",`--property=Memo\
|
|
64
64
|
ryMax=${D}`,`--property=TasksMax=${V}`,"--property=TimeoutStopSec=10s",...s==="capture"?["--wait","--pipe"]:[],...s==="p\
|
|
65
|
-
ty"?["--wait","--pty"]:[],Xe,"run-managed",Z],
|
|
66
|
-
0)&&Te(J,{force:!0,recursive:!0}),
|
|
67
|
-
let r=String(e||"").trim();if(!r)return;let n=u.resolve(r),o=u.join(Y(t.username),"managed-execution-payloads");if(
|
|
68
|
-
length!==1)throw new Error("Vibe64 exec helper rejected an unsafe managed execution payload path.");
|
|
69
|
-
let t=u.resolve(String(e||"")),r=h(t,"utf8");
|
|
65
|
+
ty"?["--wait","--pty"]:[],Xe,"run-managed",Z],G=j("systemd-run",qe,{stdio:"inherit"});if((s!=="detached"||G.error||G.status!==
|
|
66
|
+
0)&&Te(J,{force:!0,recursive:!0}),G.error)throw G.error;w.exit(typeof G.status=="number"?G.status:1)}function vt(e="",t={}){
|
|
67
|
+
let r=String(e||"").trim();if(!r)return;let n=u.resolve(r),o=u.join(Y(t.username),"managed-execution-payloads");if(I(o,n).
|
|
68
|
+
length!==1)throw new Error("Vibe64 exec helper rejected an unsafe managed execution payload path.");L(n)}async function bt(e=""){
|
|
69
|
+
let t=u.resolve(String(e||"")),r=h(t,"utf8");L(t);let n=JSON.parse(r);if(n?.schema!=="vibe64.managed-execution.command"||
|
|
70
70
|
n?.schemaVersion!==1)throw new Error("Vibe64 managed execution runner rejected an invalid payload.");let o=String(n.command||
|
|
71
71
|
"").trim();if(!o||/[\r\n]/u.test(o))throw new Error("Vibe64 managed execution runner rejected an invalid command.");let i=Re(
|
|
72
|
-
n.controllerLeaseName,n.controllerLeaseName?"service":""),s=i?await xt(i):null;w.umask(7);let a=null,c=null,m=!1,
|
|
73
|
-
m=!0,a&&c===null&&(c=Me(a))};s?.once("close",
|
|
72
|
+
n.controllerLeaseName,n.controllerLeaseName?"service":""),s=i?await xt(i):null;w.umask(7);let a=null,c=null,m=!1,l=()=>{
|
|
73
|
+
m=!0,a&&c===null&&(c=Me(a))};s?.once("close",l);let d=new Date().toISOString();try{a=Ye(o,Array.isArray(n.args)?n.args.map(
|
|
74
74
|
String):[],{cwd:String(n.cwd||"/"),detached:!!s,env:n.releaseEnvironment===!0?be({...w.env,...n.env},{username:n.env.USER,
|
|
75
75
|
home:n.env.HOME},n.env.USER):n.env&&typeof n.env=="object"&&!Array.isArray(n.env)?n.env:{},stdio:n.inputPresent===!0?["p\
|
|
76
76
|
ipe","inherit","inherit"]:"inherit"}),n.inputPresent===!0&&a.stdin.end(Buffer.from(String(n.inputBase64||""),"base64")),
|
|
77
|
-
m&&(c=Me(a));let
|
|
78
|
-
a.once("close",(y,D)=>g({signal:D,status:y,exitObservedAt:M}))}),f=typeof
|
|
79
|
-
{...Dt(),executionId:W(n.executionId),startedAt:d,exitObservedAt:
|
|
80
|
-
execMainStatus:
|
|
81
|
-
exitCode=f}finally{c!==null&&clearTimeout(c),s?.off("close",
|
|
77
|
+
m&&(c=Me(a));let p=await new Promise((g,x)=>{let M="";a.once("exit",()=>{M=new Date().toISOString()}),a.once("error",x),
|
|
78
|
+
a.once("close",(y,D)=>g({signal:D,status:y,exitObservedAt:M}))}),f=typeof p.status=="number"?p.status:1;Ct(u.dirname(t),
|
|
79
|
+
{...Dt(),executionId:W(n.executionId),startedAt:d,exitObservedAt:p.exitObservedAt,execMainCode:p.signal?"killed":"exited",
|
|
80
|
+
execMainStatus:p.signal||String(f),result:p.signal?"signal":f===0?"success":"exit-code",signal:String(p.signal||"")}),w.
|
|
81
|
+
exitCode=f}finally{c!==null&&clearTimeout(c),s?.off("close",l),s?.destroy()}}function Re(e="",t=""){let r=String(e||"");
|
|
82
82
|
if(t!=="service"){if(r)throw new Error("Vibe64 exec helper rejected a controller lease on a finite execution.");return""}
|
|
83
83
|
if(!/^\0vibe64-resource-controller-[a-z][a-z0-9-]{0,62}$/u.test(r))throw new Error("Vibe64 exec helper rejected an inval\
|
|
84
84
|
id managed service controller lease.");return r}function xt(e=""){return new Promise((t,r)=>{let n=tt({path:e}),o=setTimeout(
|
|
@@ -88,11 +88,11 @@ clearTimeout(o),n.destroy(),r(new Error(`Vibe64 managed service controller lease
|
|
|
88
88
|
ke(e,"SIGTERM");let t=setTimeout(()=>ke(e,"SIGKILL"),5e3);return t.unref?.(),t}function ke(e=null,t="SIGTERM"){let r=Number(
|
|
89
89
|
e?.pid);if(!(!Number.isSafeInteger(r)||r<=1))try{w.kill(-r,t)}catch(n){if(n?.code==="ESRCH")return;try{e.kill(t)}catch(o){
|
|
90
90
|
o?.code!=="ESRCH"&&w.stderr.write(`Vibe64 managed service process tree could not be stopped.
|
|
91
|
-
`)}}}function Mt(e={},{memoryMaxBytes:t=0,tasksMax:r=0}={}){let n=he(e);
|
|
91
|
+
`)}}}function Mt(e={},{memoryMaxBytes:t=0,tasksMax:r=0}={}){let n=he(e);v("systemctl",["start",n]),v("systemctl",["set-p\
|
|
92
92
|
roperty","--runtime",n,`MemoryMax=${t}`,`TasksMax=${r}`,"MemoryAccounting=yes","IOAccounting=yes","TasksAccounting=yes"])}
|
|
93
93
|
function Ce(e={},t={}){let r=W(e.id);for(let a of[e.projectKey,e.sessionKey])if(typeof a!="string"||!/^[a-f0-9]{64}$/u.test(
|
|
94
|
-
a))throw new Error("Vibe64 exec helper rejected an invalid workflow accounting identity.");let n=
|
|
95
|
-
re))throw new Error("Managed workflow accounting requires a workspace daemon owner.");let o
|
|
94
|
+
a))throw new Error("Vibe64 exec helper rejected an invalid workflow accounting identity.");let n=T(t.username);if(!n.startsWith(
|
|
95
|
+
re))throw new Error("Managed workflow accounting requires a workspace daemon owner.");let o=R(n);if(!/^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$/u.
|
|
96
96
|
test(o))throw new Error("Invalid managed workflow workspace identity.");let i=`vibe64-${o}-work-p${e.projectKey}.slice`,
|
|
97
97
|
s=`${i.slice(0,-6)}-s${e.sessionKey}.slice`;return{id:r,workspace:o,projectKey:e.projectKey,sessionKey:e.sessionKey,projectUnit:i,
|
|
98
98
|
sessionUnit:s,unitName:`${s.slice(0,-6)}-w${r.replaceAll("-","")}.slice`}}function ye(e){return u.join("/run/vibe64-work\
|
|
@@ -102,92 +102,92 @@ if(t.code==="ENOENT")return null;throw t}}function At(e,t){let r=ye(e);for(let i
|
|
|
102
102
|
try{_e(i,{mode:448})}catch(a){if(a.code!=="EEXIST")throw a}let s=fe(i);if(!s.isDirectory()||s.isSymbolicLink()||s.uid!==
|
|
103
103
|
0||(s.mode&63)!==0)throw new Error("Unsafe managed workflow result directory.")}let n=`${r}.tmp-${w.pid}`,o=Qe(n,"wx",384);
|
|
104
104
|
try{try{oe(o,`${JSON.stringify({...t,schema:"vibe64.managed-workflow.result.v1"})}
|
|
105
|
-
`)}finally{Ze(o)}Ne(n,r)}catch(i){try{
|
|
105
|
+
`)}finally{Ze(o)}Ne(n,r)}catch(i){try{L(n)}catch(s){if(s.code!=="ENOENT")throw new AggregateError([i,s],"Workflow receip\
|
|
106
106
|
t write and cleanup failed.")}throw i}}function P(e){let t=A("systemctl",["show",e.unitName,"--no-pager","--property=Loa\
|
|
107
107
|
dState,ActiveState,ControlGroup,MemoryMax,TasksMax"]),r=Object.fromEntries(String(t.stdout||"").trim().split(`
|
|
108
108
|
`).map(s=>{let a=s.indexOf("=");return[s.slice(0,a),s.slice(a+1)]})),n=String(r.ControlGroup||"");if(n&&(u.posix.basename(
|
|
109
109
|
n)!==e.unitName||!n.includes(`/vibe64-${e.workspace}-work.slice/`)))throw new Error("Managed workflow group does not bel\
|
|
110
|
-
ong to its workspace.");let o={id:e.id,unitName:e.unitName,activeState:r.ActiveState||"unknown",controlGroup:n,memoryMaxBytes:
|
|
111
|
-
r.MemoryMax),tasksMax:
|
|
112
|
-
(o.scopeEmpty=!0);let i=kt(e);return i?{...i,activeState:o.activeState,controlGroup:o.controlGroup}:o}function
|
|
110
|
+
ong to its workspace.");let o={id:e.id,unitName:e.unitName,activeState:r.ActiveState||"unknown",controlGroup:n,memoryMaxBytes:S(
|
|
111
|
+
r.MemoryMax),tasksMax:S(r.TasksMax),...ge(n?u.join("/sys/fs/cgroup",n):"")};t.status===0&&r.ActiveState==="inactive"&&!n&&
|
|
112
|
+
(o.scopeEmpty=!0);let i=kt(e);return i?{...i,activeState:o.activeState,controlGroup:o.controlGroup}:o}function S(e){return typeof e==
|
|
113
113
|
"string"&&/^[0-9]+$/u.test(e.trim())&&Number.isSafeInteger(Number(e))?Number(e):null}function ge(e=""){function t(a){if(!e)
|
|
114
114
|
return"";try{return h(u.join(e,a),"utf8")}catch(c){if(c.code==="ENOENT"||c.code==="ENODEV")return"";throw c}}function r(a){
|
|
115
115
|
return Object.fromEntries(t(a).trim().split(`
|
|
116
|
-
`).map(c=>{let[m,
|
|
116
|
+
`).map(c=>{let[m,l]=c.trim().split(/\s+/u);return[m,S(l)]}))}let n=r("memory.events"),o=r("memory.stat"),i=r("cgroup.eve\
|
|
117
117
|
nts"),s=t("memory.pressure");return{sampledAt:new Date().toISOString(),sampledMonotonicMs:Number(w.hrtime.bigint()/1000000n),
|
|
118
|
-
scopeEmpty:i.populated===0?!0:i.populated===1?!1:null,memoryCurrentBytes:
|
|
119
|
-
ory.peak")),memorySwapCurrentBytes:
|
|
120
|
-
memoryKernelBytes:o.kernel??null,swapInPages:o.pswpin??null,swapOutPages:o.pswpout??null,memoryPressureSomeTotalUsec:
|
|
121
|
-
exec(s)?.[1]),oomCount:n.oom??null,oomKillCount:n.oom_kill??null,limitHitCount:n.max??null,reclaimCount:n.high??null,tasksCurrent:
|
|
118
|
+
scopeEmpty:i.populated===0?!0:i.populated===1?!1:null,memoryCurrentBytes:S(t("memory.current")),memoryPeakBytes:S(t("mem\
|
|
119
|
+
ory.peak")),memorySwapCurrentBytes:S(t("memory.swap.current")),memoryAnonBytes:o.anon??null,memoryFileBytes:o.file??null,
|
|
120
|
+
memoryKernelBytes:o.kernel??null,swapInPages:o.pswpin??null,swapOutPages:o.pswpout??null,memoryPressureSomeTotalUsec:S(/^some\s+.*\btotal=([0-9]+)(?:\s|$)/mu.
|
|
121
|
+
exec(s)?.[1]),oomCount:n.oom??null,oomKillCount:n.oom_kill??null,limitHitCount:n.max??null,reclaimCount:n.high??null,tasksCurrent:S(
|
|
122
122
|
t("pids.current")),peakScope:"workflow-lifetime"}}function Ot(e,t){let r=Ce(e.workflow,t),n=String(e.action||"");if(n===
|
|
123
123
|
"workflow-inspect")return{ok:!0,...P(r)};if(n==="workflow-grow"||n==="workflow-limits")return _t(e,r,t);if(n==="workflow\
|
|
124
124
|
-forget"){let o=P(r);if(o.scopeEmpty!==!0||o.activeState!=="inactive")throw new Error("Only a completed workflow receipt\
|
|
125
|
-
can be acknowledged.");try{
|
|
126
|
-
let o=U(e.memoryMaxBytes,F,we,"workflow memory limit"),i=U(e.tasksMax,de,pe,"workflow task limit"),s=
|
|
125
|
+
can be acknowledged.");try{L(ye(r))}catch(i){if(i.code!=="ENOENT")throw i}return{ok:!0,id:r.id}}if(n==="workflow-create"){
|
|
126
|
+
let o=U(e.memoryMaxBytes,F,we,"workflow memory limit"),i=U(e.tasksMax,de,pe,"workflow task limit"),s=S(v("systemctl",["s\
|
|
127
127
|
how",he(t),"--property=MemoryMax","--value"]));if(s===null||o>s)throw new Error("Vibe64 exec helper rejected a workflow \
|
|
128
128
|
above its proven work-slice memory limit.");let a=P(r);if(a.finishedAt)throw new Error("A completed workflow identity ca\
|
|
129
129
|
nnot be reused.");if(a.activeState==="active"){if(a.memoryMaxBytes!==o||a.tasksMax!==i)throw new Error("An active workfl\
|
|
130
|
-
ow cannot be reconfigured by retrying creation.");return{ok:!0,...a}}
|
|
130
|
+
ow cannot be reconfigured by retrying creation.");return{ok:!0,...a}}v("busctl",["--system","call","org.freedesktop.syst\
|
|
131
131
|
emd1","/org/freedesktop/systemd1","org.freedesktop.systemd1.Manager","StartTransientUnit","ssa(sv)a(sa(sv))",r.unitName,
|
|
132
132
|
"fail","5","MemoryMax","t",String(o),"TasksMax","t",String(i),"MemoryAccounting","b","true","IOAccounting","b","true","T\
|
|
133
|
-
asksAccounting","b","true","0"]),
|
|
133
|
+
asksAccounting","b","true","0"]),v("systemctl",["start",r.unitName]);let c=P(r);if(c.memoryMaxBytes!==o||c.tasksMax!==i||
|
|
134
134
|
c.scopeEmpty!==!0)throw new Error("Managed workflow creation could not prove its limits and empty accounting group.");return{
|
|
135
135
|
ok:!0,...c}}if(n==="workflow-finish"){let o=P(r);if(!o.finishedAt){if(o.scopeEmpty!==!0)return{ok:!1,code:"workflow_not_\
|
|
136
136
|
empty",...o};At(r,{...o,finishedAt:new Date().toISOString()})}let i=A("systemctl",["stop",r.unitName]),s=P(r);if(s.activeState!==
|
|
137
137
|
"inactive"||s.controlGroup||s.scopeEmpty!==!0)throw new Error(String(i.stderr||"Managed workflow group did not stop.").trim());
|
|
138
138
|
return{ok:!0,...s}}throw new Error("Vibe64 exec helper rejected an unknown workflow action.")}function ue(e,t,r,n){let o=Object.
|
|
139
|
-
fromEntries(
|
|
139
|
+
fromEntries(v("systemctl",["show",e,"--no-pager","--property=ActiveState,ControlGroup,MemoryMax"]).split(`
|
|
140
140
|
`).map(c=>{let m=c.indexOf("=");return[c.slice(0,m),c.slice(m+1)]}));if(o.ActiveState!=="active"||o.ControlGroup!==t)throw new Error(
|
|
141
|
-
"Memory growth requires the same active, owned accounting group.");let i=
|
|
142
|
-
f8")),s=
|
|
143
|
-
ied.");let a=h(u.join("/sys/fs/cgroup",t,"memory.high"),"utf8").trim();if(a!=="max"&&(
|
|
141
|
+
"Memory growth requires the same active, owned accounting group.");let i=S(h(u.join("/sys/fs/cgroup",t,"memory.max"),"ut\
|
|
142
|
+
f8")),s=S(o.MemoryMax);if(s===null||i!==Math.floor(s/r)*r)throw new Error("The effective memory limit could not be verif\
|
|
143
|
+
ied.");let a=h(u.join("/sys/fs/cgroup",t,"memory.high"),"utf8").trim();if(a!=="max"&&(S(a)===null||n>Number(a)))throw Object.
|
|
144
144
|
assign(new Error("Memory growth is blocked by the target's memory.high limit."),{limitingGroup:{controlGroup:t,limit:"me\
|
|
145
|
-
mory.high",maximumBytes:
|
|
146
|
-
memoryHighBytes:a==="max"?null:
|
|
145
|
+
mory.high",maximumBytes:S(a),requestedBytes:n??null}});return{unitName:e,controlGroup:t,memoryMaxBytes:s,effectiveMemoryMaxBytes:i,
|
|
146
|
+
memoryHighBytes:a==="max"?null:S(a)}}function le(e,t){let r=[];for(let n=u.posix.dirname(e);n!=="/";n=u.posix.dirname(n)){
|
|
147
147
|
let o={controlGroup:n};for(let[i,s]of[["memory.max","memoryMaxBytes"],["memory.high","memoryHighBytes"]]){let a=h(u.join(
|
|
148
|
-
"/sys/fs/cgroup",n,i),"utf8").trim(),c=a==="max"?null:
|
|
148
|
+
"/sys/fs/cgroup",n,i),"utf8").trim(),c=a==="max"?null:S(a);if(a!=="max"&&(c===null||t>c))throw Object.assign(new Error(`\
|
|
149
149
|
Memory growth is blocked by an ancestor ${i} limit.`),{limitingGroup:{controlGroup:n,limit:i,maximumBytes:c,requestedBytes:t}});
|
|
150
|
-
o[s]=c}r.push(o)}return r}function _t(e,t,r){let n=e.action==="workflow-limits",o=!1,i=[],s=[],a=[],c=[],m=null;try{let
|
|
151
|
-
t);if(
|
|
150
|
+
o[s]=c}r.push(o)}return r}function _t(e,t,r){let n=e.action==="workflow-limits",o=!1,i=[],s=[],a=[],c=[],m=null;try{let l=P(
|
|
151
|
+
t);if(l.activeState!=="active"||!l.controlGroup||l.finishedAt)throw new Error("Memory growth requires an active workflow\
|
|
152
152
|
.");let d=U(e.memoryMaxBytes,F,we,"workflow memory limit");if(!Array.isArray(e.executions)||e.executions.length>128)throw new Error(
|
|
153
|
-
"Memory growth requires a bounded list of owned executions.");if(m=
|
|
154
|
-
"The kernel memory limit granularity is unavailable.");a=[{unitName:t.unitName,controlGroup:
|
|
155
|
-
floor(d/m)*m,expectedMemoryMaxBytes:e.expectedMemoryMaxBytes}];for(let
|
|
156
|
-
unitName===f))throw new Error("Duplicate memory growth execution.");let g=U(
|
|
157
|
-
t");if(g>d)throw new Error("Execution memory growth exceeds its workflow allowance.");a.push({unitName:f,controlGroup:`${
|
|
158
|
-
controlGroup}/${f}`,memoryMaxBytes:Math.floor(g/m)*m,expectedMemoryMaxBytes:
|
|
159
|
-
|
|
160
|
-
|
|
161
|
-
throw new Error("Memory growth cannot lower a live limit or apply to stale limits.");c=
|
|
162
|
-
for(let[
|
|
163
|
-
`MemoryMax=${f.memoryMaxBytes}`]));if(s=a.map(
|
|
164
|
-
memoryMaxBytes),!s.every((
|
|
153
|
+
"Memory growth requires a bounded list of owned executions.");if(m=S(v("getconf",["PAGESIZE"])),!m||m>F)throw new Error(
|
|
154
|
+
"The kernel memory limit granularity is unavailable.");a=[{unitName:t.unitName,controlGroup:l.controlGroup,memoryMaxBytes:Math.
|
|
155
|
+
floor(d/m)*m,expectedMemoryMaxBytes:e.expectedMemoryMaxBytes}];for(let p of e.executions){let f=De(p?.id,r);if(a.some(x=>x.
|
|
156
|
+
unitName===f))throw new Error("Duplicate memory growth execution.");let g=U(p.memoryMaxBytes,F,$e,"execution memory limi\
|
|
157
|
+
t");if(g>d)throw new Error("Execution memory growth exceeds its workflow allowance.");a.push({unitName:f,controlGroup:`${l.
|
|
158
|
+
controlGroup}/${f}`,memoryMaxBytes:Math.floor(g/m)*m,expectedMemoryMaxBytes:p.expectedMemoryMaxBytes})}if(i=a.map(p=>ue(
|
|
159
|
+
p.unitName,p.controlGroup,m,n?void 0:p.memoryMaxBytes)),n)return{ok:!0,id:t.id,pageSizeBytes:m,before:i,after:i,ancestors:le(
|
|
160
|
+
l.controlGroup)};for(let[p,f]of a.entries())if(f.expectedMemoryMaxBytes!==i[p].memoryMaxBytes||f.memoryMaxBytes<i[p].effectiveMemoryMaxBytes)
|
|
161
|
+
throw new Error("Memory growth cannot lower a live limit or apply to stale limits.");c=le(l.controlGroup,a[0].memoryMaxBytes);
|
|
162
|
+
for(let[p,f]of a.entries())i[p].memoryMaxBytes!==f.memoryMaxBytes&&(o=!0,v("systemctl",["set-property","--runtime",f.unitName,
|
|
163
|
+
`MemoryMax=${f.memoryMaxBytes}`]));if(s=a.map(p=>ue(p.unitName,p.controlGroup,m,p.memoryMaxBytes)),c=le(l.controlGroup,a[0].
|
|
164
|
+
memoryMaxBytes),!s.every((p,f)=>p.memoryMaxBytes===a[f].memoryMaxBytes))throw new Error("Memory growth readback did not \
|
|
165
165
|
match the requested limits.");return{ok:!0,id:t.id,changeState:o?"applied":"unchanged",pageSizeBytes:m,before:i,after:s,
|
|
166
|
-
ancestors:c}}catch(
|
|
167
|
-
d=s.some(
|
|
168
|
-
id,code:"workflow_memory_growth_failed",changeState:d,error:String(
|
|
169
|
-
before:i,after:s,ancestors:c}}}function Nt(e={},t={}){let r=
|
|
170
|
-
ne("gid",e.gid,n.gid),n.username!==t.username&&(Se(n.username),Ke(t,n.username)),Ue(n.username
|
|
166
|
+
ancestors:c}}catch(l){let d="unchanged";return o&&(s=a.map(p=>{try{return ue(p.unitName,p.controlGroup,m)}catch{return null}}),
|
|
167
|
+
d=s.some(p=>p===null)?"unknown":s.every((p,f)=>p.memoryMaxBytes===i[f].memoryMaxBytes)?"unchanged":"partial"),{ok:!1,id:t.
|
|
168
|
+
id,code:"workflow_memory_growth_failed",changeState:d,error:String(l?.message||l),limitingGroup:l?.limitingGroup??null,pageSizeBytes:m,
|
|
169
|
+
before:i,after:s,ancestors:c}}}function Nt(e={},t={}){let r=T(e.username||t.username),n=X(r);return ne("uid",e.uid,n.uid),
|
|
170
|
+
ne("gid",e.gid,n.gid),n.username!==t.username&&(Se(n.username),Ke(t,n.username)),Ue(n.username,$),n}function W(e=""){let t=String(
|
|
171
171
|
e||"").trim();if(!pt.test(t))throw new Error("Vibe64 exec helper rejected an invalid managed execution id.");return t.toLowerCase()}
|
|
172
172
|
function Tt(e=""){let t=String(e||"").trim();if(!ft.has(t))throw new Error("Vibe64 exec helper rejected an unknown manag\
|
|
173
173
|
ed execution kind.");return t}function It(e=""){let t=String(e||"").trim();if(!wt.has(t))throw new Error("Vibe64 exec he\
|
|
174
174
|
lper rejected an unknown managed execution mode.");return t}function U(e,t,r,n="value"){let o=Number(e);if(!Number.isSafeInteger(
|
|
175
175
|
o)||o<t||o>r)throw new Error(`Vibe64 exec helper rejected an invalid managed execution ${n}.`);return o}function De(e="",t={}){
|
|
176
|
-
return`vibe64-exec-${
|
|
177
|
-
-work.slice`}function Ee(e={},t=""){return u.join(se(e),"executions",W(t))}function se(e={}){return`/run/vibe64-${
|
|
178
|
-
username))}`}function jt(e={}){let t=se(e);
|
|
176
|
+
return`vibe64-exec-${R(T(t.username))}-${W(e).replaceAll("-","")}.service`}function he(e={}){return`vibe64-${R(T(e.username))}\
|
|
177
|
+
-work.slice`}function Ee(e={},t=""){return u.join(se(e),"executions",W(t))}function se(e={}){return`/run/vibe64-${R(T(e.
|
|
178
|
+
username))}`}function jt(e={}){let t=se(e);v("install",["-d","-o",T(e.username),"-g",$,"-m","2750",t,u.join(t,"execution\
|
|
179
179
|
s")])}function $t(e={},t=""){return u.join(Ee(e,t),"result.json")}function Rt(e={},t=""){let r=$t(e,t);try{let n=JSON.parse(
|
|
180
180
|
h(r,"utf8"));return n?.schema==="vibe64.managed-execution.result"&&n.schemaVersion===1&&n.executionId===W(t)?n:{}}catch(n){
|
|
181
181
|
if(n?.code==="ENOENT"||n instanceof SyntaxError)return{};throw n}}function Ct(e="",t={}){let r=u.join(e,"result.json"),n=`${r}\
|
|
182
182
|
.tmp-${w.pid}`;oe(n,`${JSON.stringify({...t,schema:"vibe64.managed-execution.result",schemaVersion:1})}
|
|
183
183
|
`,{flag:"wx",mode:384}),Ne(n,r)}function Dt(){let e=String(h("/proc/self/cgroup","utf8")||"").split(`
|
|
184
|
-
`).find(s=>s.startsWith("0::")),t=String(e||"").slice(3).replace(/^\/+/,""),r=t?u.join("/sys/fs/cgroup",t):"";if(!r||!
|
|
184
|
+
`).find(s=>s.startsWith("0::")),t=String(e||"").slice(3).replace(/^\/+/,""),r=t?u.join("/sys/fs/cgroup",t):"";if(!r||!_(
|
|
185
185
|
r))return{};let n=Ae(u.join(r,"cpu.stat")),o=Ae(u.join(r,"memory.events")),i=Bt(u.join(r,"io.stat"));return{resourceCounters:ge(
|
|
186
186
|
r),cpuUsageNSec:String(Number(n.usage_usec||0)*1e3),ioReadBytes:String(i.readBytes),ioWriteBytes:String(i.writeBytes),memoryCurrent:z(
|
|
187
187
|
u.join(r,"memory.current")),memoryPeak:z(u.join(r,"memory.peak")),memorySwapCurrent:z(u.join(r,"memory.swap.current")),oomKillCount:String(
|
|
188
188
|
Number(o.oom_kill||0)),taskLimit:Be(r),tasksCurrent:z(u.join(r,"pids.current")),tasksPeak:z(u.join(r,"pids.peak"))}}function z(e=""){
|
|
189
189
|
try{let t=String(h(e,"utf8")||"0").trim();return/^[0-9]+$/u.test(t)?t:"0"}catch(t){if(t?.code==="ENOENT")return"0";throw t}}
|
|
190
|
-
function Be(e,t=h){if(!e)return null;try{let r=a=>{try{return
|
|
190
|
+
function Be(e,t=h){if(!e)return null;try{let r=a=>{try{return S(/^max\s+(\d+)$/mu.exec(t(u.join(e,a),"utf8"))?.[1])}catch{
|
|
191
191
|
return null}},n=r("pids.events.local"),o=r("pids.events"),i=n>0?n:o;if(!(i>0))return null;let s=t("/proc/self/mountinfo",
|
|
192
192
|
"utf8").split(`
|
|
193
193
|
`).find(a=>a.split(" ")[4]==="/sys/fs/cgroup"&&a.includes(" - cgroup2 "));return{source:"cgroup-pids-events",count:i,scope:n>
|
|
@@ -201,177 +201,180 @@ pager","--timestamp=us+utc","--property=LoadState,ActiveState,SubState,Result,Ex
|
|
|
201
201
|
imestamp,ExecMainExitTimestamp,MainPID,ControlGroup,MemoryCurrent,MemoryPeak,MemorySwapCurrent,TasksCurrent,TasksMax,CPU\
|
|
202
202
|
UsageNSec,IOReadBytes,IOWriteBytes"]),s={};for(let M of String(i.stdout||"").split(/\r?\n/u)){let y=M.indexOf("=");y>0&&
|
|
203
203
|
(s[M.slice(0,y)]=M.slice(y+1))}s.LoadState==="not-found"&&(s={LoadState:"not-found"});let a=String(s.ControlGroup||"").trim(),
|
|
204
|
-
c=a?u.join("/sys/fs/cgroup",a.replace(/^\/+/,"")):"",m=ge(c),
|
|
205
|
-
""),f=Number.isFinite(
|
|
204
|
+
c=a?u.join("/sys/fs/cgroup",a.replace(/^\/+/,"")):"",m=ge(c),l=c&&_(c)?m.scopeEmpty:!0,d=t?o(r,t):{},p=Date.parse(d.exitObservedAt||
|
|
205
|
+
""),f=Number.isFinite(p)?"runner":"systemd",g=Number.isFinite(p)?p:Date.parse(s.ExecMainExitTimestamp||""),x=Number.isFinite(
|
|
206
206
|
g)&&g>0&&g<=Date.now()?new Date(g).toISOString():"";return{resourceCounters:d.resourceCounters||m,activeState:String(s.ActiveState||
|
|
207
|
-
(d.executionId?"inactive":"unknown")),controlGroup:a,cpuUsageNSec:
|
|
207
|
+
(d.executionId?"inactive":"unknown")),controlGroup:a,cpuUsageNSec:C(s.CPUUsageNSec,d.cpuUsageNSec),execMainCode:String(s.
|
|
208
208
|
ExecMainCode||d.execMainCode||""),execMainStatus:String(s.ExecMainStatus||d.execMainStatus||""),exitObservedAt:x,exitTimeSource:x?
|
|
209
|
-
f:"",ioReadBytes:
|
|
210
|
-
s.LoadState!=="not-found"?s.LoadState:d.executionId?"recorded":"not-found"),mainPid:String(s.MainPID||"0"),memoryCurrent:
|
|
211
|
-
s.MemoryCurrent,d.memoryCurrent),memoryPeak:
|
|
212
|
-
oomKillCount:
|
|
213
|
-
""),scopeEmpty:
|
|
214
|
-
s.TasksCurrent,d.tasksCurrent),tasksPeak:
|
|
209
|
+
f:"",ioReadBytes:C(s.IOReadBytes,d.ioReadBytes),ioWriteBytes:C(s.IOWriteBytes,d.ioWriteBytes),loadState:String(s.LoadState&&
|
|
210
|
+
s.LoadState!=="not-found"?s.LoadState:d.executionId?"recorded":"not-found"),mainPid:String(s.MainPID||"0"),memoryCurrent:C(
|
|
211
|
+
s.MemoryCurrent,d.memoryCurrent),memoryPeak:C(s.MemoryPeak,d.memoryPeak),memorySwapCurrent:C(s.MemorySwapCurrent,d.memorySwapCurrent),
|
|
212
|
+
oomKillCount:C(d.oomKillCount),taskLimit:d.taskLimit||Be(c),result:String(s.Result||d.result||""),signal:String(d.signal||
|
|
213
|
+
""),scopeEmpty:l,startedAt:s.ExecMainStartTimestamp||d.startedAt||"",subState:String(s.SubState||"unknown"),tasksCurrent:C(
|
|
214
|
+
s.TasksCurrent,d.tasksCurrent),tasksPeak:C(d.tasksPeak),tasksMax:String(s.TasksMax||"0"),unitName:e}}function C(...e){return String(
|
|
215
215
|
e.reduce((t,r)=>{let n=Number(r);return Number.isFinite(n)&&n>t?n:t},0))}function Pt(e="",t="",r={}){let n=K(e,t,r),o=null,
|
|
216
216
|
i=n.taskLimit,s=Date.parse(n.startedAt),a=Date.parse(n.exitObservedAt);if((n.result==="oom-kill"||Number(n.oomKillCount)>
|
|
217
|
-
0)&&s>0&&a>=s){let c=Math.min(Date.now(),a+1e3),m=
|
|
217
|
+
0)&&s>0&&a>=s){let c=Math.min(Date.now(),a+1e3),m=j("journalctl",["-k","--boot=0","--no-pager","--output=json","--output\
|
|
218
218
|
-fields=__REALTIME_TIMESTAMP,__SEQNUM_ID,__SEQNUM,_BOOT_ID,_SOURCE_MONOTONIC_TIMESTAMP,MESSAGE","--lines=65","--case-sen\
|
|
219
219
|
sitive=yes",`--since=@${s/1e3}`,`--until=@${c/1e3}`,`--grep=^oom-kill:|^/[^,]*/${e.replaceAll(".","\\.")}(?:/[^,]*)?,tas\
|
|
220
|
-
k=`],{encoding:"utf8",timeout:2e3,maxBuffer:128*1024});!m.error&&m.status===0&&(o=Vt(m.stdout,{unitName:e,workspace
|
|
221
|
-
username),startedAt:s,until:c}))}if(!i&&n.result&&n.result!=="success"&&s>0&&a>=s){let c=Math.min(Date.now(),a+1e3),m=
|
|
220
|
+
k=`],{encoding:"utf8",timeout:2e3,maxBuffer:128*1024});!m.error&&m.status===0&&(o=Vt(m.stdout,{unitName:e,workspace:R(r.
|
|
221
|
+
username),startedAt:s,until:c}))}if(!i&&n.result&&n.result!=="success"&&s>0&&a>=s){let c=Math.min(Date.now(),a+1e3),m=j(
|
|
222
222
|
"journalctl",["-k","--boot=0","--no-pager","--output=json","--output-fields=__REALTIME_TIMESTAMP,MESSAGE","--lines=65","\
|
|
223
223
|
--case-sensitive=yes",`--since=@${s/1e3}`,`--until=@${c/1e3}`,`--grep=^cgroup: fork rejected by pids controller in /.*${e.
|
|
224
224
|
replaceAll(".","\\.")}(?:/|$)`],{encoding:"utf8",timeout:2e3,maxBuffer:128*1024});!m.error&&m.status===0&&(i=Ut(m.stdout,
|
|
225
|
-
{unitName:e,workspace
|
|
225
|
+
{unitName:e,workspace:R(r.username),startedAt:s,until:c}))}w.stdout.write(`${JSON.stringify({executionId:t,ok:!0,...n,oomBoundary:o,
|
|
226
226
|
taskLimit:i})}
|
|
227
227
|
`)}function Ut(e,{unitName:t,workspace:r,startedAt:n,until:o}){if(typeof e!="string"||Buffer.byteLength(e)>128*1024)return null;
|
|
228
228
|
let i=e.trim().split(/\r?\n/u);if(i.length>64)return null;for(let s of i){let a;try{a=JSON.parse(s)}catch{continue}let c=Number(
|
|
229
229
|
a?.__REALTIME_TIMESTAMP)/1e3;if(!Number.isFinite(c)||c<n||c>o)continue;let m=typeof a.MESSAGE=="string"&&/^cgroup: fork rejected by pids controller in (\/[a-zA-Z0-9_./-]{1,2048})$/u.
|
|
230
|
-
exec(a.MESSAGE)?.[1];if(!m)continue;let
|
|
231
|
-
d<2||
|
|
230
|
+
exec(a.MESSAGE)?.[1];if(!m)continue;let l=m.split("/"),d=l.indexOf(`vibe64-${r}-work.slice`);if(!(l[1]!=="vibe64.slice"||
|
|
231
|
+
d<2||l.indexOf(t)<=d||l.some((p,f)=>f>0&&(!p||p==="."||p===".."))))return{source:"kernel-journal",scope:"unknown",count:null,
|
|
232
232
|
recordedAt:new Date(c).toISOString()}}return null}function Vt(e,{unitName:t,workspace:r,startedAt:n,until:o}){if(typeof e!=
|
|
233
233
|
"string"||Buffer.byteLength(e)>128*1024)return null;let i=e.trim().split(/\r?\n/u);if(i.length>64)return null;let s=i.flatMap(
|
|
234
234
|
c=>{try{return[JSON.parse(c)]}catch{return[]}}),a=null;for(let c of s){let m=Number(c?.__REALTIME_TIMESTAMP)/1e3;if(!Number.
|
|
235
|
-
isFinite(m)||m<n||m>o)continue;let
|
|
236
|
-
=")){let
|
|
235
|
+
isFinite(m)||m<n||m>o)continue;let l=c.MESSAGE;if(typeof l=="string"&&l.startsWith("oom-kill:")&&l.endsWith(",task_memcg\
|
|
236
|
+
=")){let b=s.find(k=>/^[a-f0-9]{32}$/u.test(c.__SEQNUM_ID||"")&&k?.__SEQNUM_ID===c.__SEQNUM_ID&&k?._BOOT_ID===c._BOOT_ID&&
|
|
237
237
|
/^[a-f0-9]{32}$/u.test(c._BOOT_ID||"")&&Number.isSafeInteger(Number(c.__SEQNUM))&&Number(k.__SEQNUM)===Number(c.__SEQNUM)+
|
|
238
238
|
1&&Number(k._SOURCE_MONOTONIC_TIMESTAMP)>=Number(c._SOURCE_MONOTONIC_TIMESTAMP)&&Number(k._SOURCE_MONOTONIC_TIMESTAMP)-Number(
|
|
239
|
-
c._SOURCE_MONOTONIC_TIMESTAMP)<=1e6&&/^\/[a-zA-Z0-9_./-]+,task=[^,]+,pid=\d+,uid=\d+$/u.test(k.MESSAGE||""));
|
|
240
|
-
let d=typeof
|
|
241
|
-
if(!d)continue;let[,
|
|
242
|
-
ce"||y<2||D<=y||M.some((
|
|
243
|
-
_NONE"&&g)V="host";else if(
|
|
244
|
-
0,D+1).join("/");V=f===k||f.startsWith(`${k}/`)?"execution":
|
|
245
|
-
.slice`?"workspace":
|
|
246
|
-
rkflow":/-work-p[a-f0-9]{64}-s[a-f0-9]{64}\.slice$/u.test(
|
|
239
|
+
c._SOURCE_MONOTONIC_TIMESTAMP)<=1e6&&/^\/[a-zA-Z0-9_./-]+,task=[^,]+,pid=\d+,uid=\d+$/u.test(k.MESSAGE||""));b&&(l+=b.MESSAGE)}
|
|
240
|
+
let d=typeof l=="string"&&l.match(/^oom-kill:constraint=(CONSTRAINT_[A-Z_]+),.*?,(?:oom_memcg=(\/[^,]+)|(global_oom)),task_memcg=(\/[^,]+),task=/u);
|
|
241
|
+
if(!d)continue;let[,p,f,g,x]=d,M=x.split("/"),y=M.indexOf(`vibe64-${r}-work.slice`),D=M.indexOf(t);if(M[1]!=="vibe64.sli\
|
|
242
|
+
ce"||y<2||D<=y||M.some((b,k)=>k>0&&(b==="."||b===".."||!/^[a-zA-Z0-9_.-]+$/u.test(b))))continue;let V;if(p==="CONSTRAINT\
|
|
243
|
+
_NONE"&&g)V="host";else if(p==="CONSTRAINT_MEMCG"&&f&&(x===f||x.startsWith(`${f}/`))){let b=f.split("/").at(-1),k=M.slice(
|
|
244
|
+
0,D+1).join("/");V=f===k||f.startsWith(`${k}/`)?"execution":b===`vibe64-${r}-work.slice`?"workspace_work":b===`vibe64-${r}\
|
|
245
|
+
.slice`?"workspace":b==="vibe64.slice"?"platform":/-work-p[a-f0-9]{64}-s[a-f0-9]{64}-w[a-f0-9]{32}\.slice$/u.test(b)?"wo\
|
|
246
|
+
rkflow":/-work-p[a-f0-9]{64}-s[a-f0-9]{64}\.slice$/u.test(b)?"session":/-work-p[a-f0-9]{64}\.slice$/u.test(b)?"project":
|
|
247
247
|
"ancestor"}else return null;let H=f||"";if(a&&a.cgroup!==H)return null;(!a||m>Date.parse(a.recordedAt))&&(a={source:"ker\
|
|
248
|
-
nel-journal",scope:V,cgroup:H,recordedAt:new Date(m).toISOString()})}return a}function
|
|
248
|
+
nel-journal",scope:V,cgroup:H,recordedAt:new Date(m).toISOString()})}return a}function Lt(e="",t="",r={}){let n=K(e,t,r);
|
|
249
249
|
n.scopeEmpty||A("systemctl",["stop",e]);let o=Date.now()+gt,i=K(e,t,r),s=new Int32Array(new SharedArrayBuffer(4));for(;!i.
|
|
250
250
|
scopeEmpty&&Date.now()<o;)Atomics.wait(s,0,0,25),i=K(e,t,r);i.scopeEmpty||(A("systemctl",["kill","--kill-who=all","--sig\
|
|
251
251
|
nal=SIGKILL",e]),A("systemctl",["stop",e]),i=K(e,t,r)),i.scopeEmpty&&(Te(Ee(r,t),{force:!0,recursive:!0}),A("systemctl",
|
|
252
252
|
["reset-failed",e])),w.stdout.write(`${JSON.stringify({executionId:t,ok:i.scopeEmpty,scopeEmpty:i.scopeEmpty,stopped:n.scopeEmpty===
|
|
253
253
|
!1,...i})}
|
|
254
|
-
`),i.scopeEmpty||w.exit(1)}function
|
|
255
|
-
r rejected a non-normalized execution payload.")}function Wt(e="",t={},r=""){Se(r),q(),ae(
|
|
256
|
-
r,String(t.password||"")):X(r),rr(r
|
|
254
|
+
`),i.scopeEmpty||w.exit(1)}function Gt(e={}){if(e?.schema!==it||e?.schemaVersion!==st)throw new Error("Vibe64 exec helpe\
|
|
255
|
+
r rejected a non-normalized execution payload.")}function Wt(e="",t={},r=""){Se(r),q(),ae($),e==="create-system-user"?tr(
|
|
256
|
+
r,String(t.password||"")):X(r),rr(r,$)}function Ht(e={}){let t=q();ae($);let r=String(e.action||"").trim(),n=ce(e.unitName);
|
|
257
257
|
if(r==="inspect"){zt(n);return}if(r==="remove"){Yt(n);return}if(r!=="install-start")throw new Error("Vibe64 exec helper \
|
|
258
258
|
rejected an unknown deployment service action.");let o=ee(e.workingDirectory,t,"workingDirectory"),i=ee(e.environmentFile,
|
|
259
259
|
t,"environmentFile"),s=ee(e.startScript,t,"startScript"),a=[...new Set((Array.isArray(e.requiredUnits)?e.requiredUnits:[]).
|
|
260
|
-
map(
|
|
261
|
-
Pe({activation:"restart",unit:m,unitName:n,unitPath:c})}function zt(e=""){ce(e);let t=
|
|
260
|
+
map(l=>ve(l,t)))],c=We(n),m=sr({environmentFile:i,owner:t,requiredUnits:a,startScript:s,unitName:n,workingDirectory:o});
|
|
261
|
+
Pe({activation:"restart",unit:m,unitName:n,unitPath:c})}function zt(e=""){ce(e);let t=v("systemctl",["show",e,"--no-page\
|
|
262
262
|
r","--property=ActiveState,SubState,Result,ExecMainCode,ExecMainStatus,NRestarts"]),r=A("journalctl",["--unit",e,"--no-p\
|
|
263
263
|
ager","--output=cat","--lines=80"]),n=String(r.stdout||r.stderr||"").trim();w.stdout.write(["Service state:",t,...n?["",
|
|
264
264
|
"Recent service output:",n]:[]].join(`
|
|
265
265
|
`)+`
|
|
266
|
-
`)}function Kt(e={}){let t=q();ae(
|
|
266
|
+
`)}function Kt(e={}){let t=q();ae($);let r=String(e.action||"").trim(),n=ve(e.unitName,t);if(r!=="install-start")throw new Error(
|
|
267
267
|
"Vibe64 exec helper rejected an unknown managed service action.");let o=Oe(e.workingDirectory,t,"workingDirectory"),i=Oe(
|
|
268
|
-
e.startScript,t,"startScript"),s=
|
|
268
|
+
e.startScript,t,"startScript"),s=Ge(e.processModel),a=s==="forking"?Le(e.pidFile,t):"",c=ir(n,t),m=ar({owner:t,pidFile:a,
|
|
269
269
|
processModel:s,startScript:i,unitName:n,workingDirectory:o});Ft({owner:t,pidFile:a,unitName:n}),Pe({activation:"start",unit:m,
|
|
270
|
-
unitName:n,unitPath:c})}function Ft({owner:e={},pidFile:t="",unitName:r=""}={}){if(!t||!
|
|
270
|
+
unitName:n,unitPath:c})}function Ft({owner:e={},pidFile:t="",unitName:r=""}={}){if(!t||!_(t))return;let n=String(h(t,"ut\
|
|
271
271
|
f8")||"").trim();if(!/^[1-9][0-9]*$/u.test(n))throw new Error("Vibe64 managed service PID file is invalid.");let o=Number(
|
|
272
|
-
n);if(!Number.isSafeInteger(o)||o<=1)throw new Error("Vibe64 managed service PID is invalid.");if(!
|
|
272
|
+
n);if(!Number.isSafeInteger(o)||o<=1)throw new Error("Vibe64 managed service PID is invalid.");if(!me(o)){Q(t,n);return}
|
|
273
273
|
let i=Xt(o);if(i===null){Q(t,n);return}if(i!==e.uid)throw new Error("Vibe64 managed service PID belongs to another OS us\
|
|
274
274
|
er.");if(qt(o,r))return;try{w.kill(o,"SIGTERM")}catch(c){if(c?.code==="ESRCH"){Q(t,n);return}throw c}let s=Date.now()+3e4,
|
|
275
|
-
a=new Int32Array(new SharedArrayBuffer(4));for(;
|
|
276
|
-
ibe64 managed service process did not stop cleanly during ownership transfer.");Q(t,n)}function Q(e="",t=""){
|
|
277
|
-
h(e,"utf8")||"").trim()===t&&
|
|
275
|
+
a=new Int32Array(new SharedArrayBuffer(4));for(;me(o)&&Date.now()<s;)Atomics.wait(a,0,0,100);if(me(o))throw new Error("V\
|
|
276
|
+
ibe64 managed service process did not stop cleanly during ownership transfer.");Q(t,n)}function Q(e="",t=""){_(e)&&String(
|
|
277
|
+
h(e,"utf8")||"").trim()===t&&L(e)}function me(e=0){try{return w.kill(e,0),!0}catch(t){if(t?.code==="ESRCH")return!1;throw t}}
|
|
278
278
|
function Xt(e=0){let t="";try{t=h(`/proc/${e}/status`,"utf8")}catch(o){if(o?.code==="ENOENT")return null;throw o}let r=String(
|
|
279
279
|
t||"").match(/^Uid:\s+([0-9]+)/mu),n=Number(r?.[1]);if(!Number.isSafeInteger(n))throw new Error("Vibe64 managed service \
|
|
280
280
|
process UID is unavailable.");return n}function qt(e=0,t=""){let r=`/${t}`,n="";try{n=h(`/proc/${e}/cgroup`,"utf8")}catch(o){
|
|
281
281
|
if(o?.code==="ENOENT")return!1;throw o}return String(n||"").split(`
|
|
282
282
|
`).some(o=>o.trim().endsWith(r))}function Pe({activation:e="start",unit:t="",unitName:r="",unitPath:n=""}={}){if(e!=="st\
|
|
283
283
|
art"&&e!=="restart")throw new Error("Vibe64 exec helper rejected an unsupported systemd activation.");let o=`${n}.tmp-${w.
|
|
284
|
-
pid}`;oe(o,t,{mode:420});try{
|
|
285
|
-
l",["enable",r]),A("systemctl",["reset-failed",r]);try{
|
|
286
|
-
function Yt(e=""){ce(e),A("systemctl",["stop",e]),A("systemctl",["disable",e]),A("systemctl",["reset-failed",e]);try{
|
|
287
|
-
e))}catch(t){if(t?.code!=="ENOENT")throw t}
|
|
284
|
+
pid}`;oe(o,t,{mode:420});try{v("mv",[o,n])}catch(i){try{L(o)}catch{}throw i}v("systemctl",["daemon-reload"]),v("systemct\
|
|
285
|
+
l",["enable",r]),A("systemctl",["reset-failed",r]);try{v("systemctl",[e,r])}catch(i){throw A("systemctl",["stop",r]),i}}
|
|
286
|
+
function Yt(e=""){ce(e),A("systemctl",["stop",e]),A("systemctl",["disable",e]),A("systemctl",["reset-failed",e]);try{L(We(
|
|
287
|
+
e))}catch(t){if(t?.code!=="ENOENT")throw t}v("systemctl",["daemon-reload"])}function Jt(e=""){let t=e?h(u.resolve(e),"ut\
|
|
288
288
|
f8"):Zt();if(Buffer.byteLength(t,"utf8")>Ie)throw new Error("Vibe64 exec helper payload is too large.");let r=JSON.parse(
|
|
289
289
|
t);if(!r||typeof r!="object"||Array.isArray(r))throw new Error("Vibe64 exec helper payload must be a JSON object.");return r}
|
|
290
290
|
function Zt(){let e=[],t=Buffer.allocUnsafe(rt),r=new Int32Array(new SharedArrayBuffer(4)),n=Date.now()+ot,o=0;for(;;)try{
|
|
291
291
|
let i=et(0,t,0,t.length,null);if(i===0)break;if(o+=i,o>Ie)throw new Error("Vibe64 exec helper payload is too large.");e.
|
|
292
292
|
push(Buffer.from(t.subarray(0,i)))}catch(i){if(i?.code==="EINTR")continue;if((i?.code==="EAGAIN"||i?.code==="EWOULDBLOCK")&&
|
|
293
293
|
Date.now()<n){Atomics.wait(r,0,0,nt);continue}throw i?.code==="EAGAIN"||i?.code==="EWOULDBLOCK"?new Error("Vibe64 exec h\
|
|
294
|
-
elper timed out waiting for its payload."):i}return Buffer.concat(e,o).toString("utf8")}function
|
|
294
|
+
elper timed out waiting for its payload."):i}return Buffer.concat(e,o).toString("utf8")}function T(e=""){let t=String(e||
|
|
295
295
|
"").trim();if(!t||/[/:\\\r\n]/u.test(t))throw new Error("Vibe64 exec helper rejected an unsafe username.");return t}function Qt(e=""){
|
|
296
|
-
if(!
|
|
296
|
+
if(!lt.test(e))throw new Error("Vibe64 exec helper rejected an unsupported username.")}function Se(e=""){if(Qt(e),e.startsWith(
|
|
297
297
|
re))throw new Error("Vibe64 daemon Unix accounts cannot be managed as app users.");if(dt.has(e))throw new Error("Privile\
|
|
298
|
-
ged Unix accounts cannot be managed as Vibe64 app users.")}function X(e=""){let t=
|
|
298
|
+
ged Unix accounts cannot be managed as Vibe64 app users.")}function X(e=""){let t=j("getent",["passwd",e],{encoding:"utf\
|
|
299
299
|
8"});if(t.status!==0)throw new Error(`OS user was not found: ${e}`);let n=String(t.stdout||"").split(/\r?\n/u)[0].split(
|
|
300
300
|
":");if(n.length<7||n[0]!==e)throw new Error(`OS user was not found: ${e}`);let o=Number(n[2]),i=Number(n[3]);if(!Number.
|
|
301
301
|
isSafeInteger(o)||!Number.isSafeInteger(i))throw new Error(`OS user has invalid uid/gid: ${e}`);return{gid:i,home:n[5],uid:o,
|
|
302
|
-
username:e}}function q(){let e=
|
|
302
|
+
username:e}}function q(){let e=T(w.env.SUDO_USER||"");return X(e)}function Ue(e="",t=""){let r=j("id",["-nG",e],{encoding:"\
|
|
303
303
|
utf8"}),n=String(r.stdout||"").trim().split(/\s+/u);if(r.status!==0||!n.includes(t))throw new Error(`OS user is not enab\
|
|
304
|
-
led for the shared Vibe64 group: ${e}`)}function er(e=""){try{return X(e)}catch{return null}}function ae(e=""){if(
|
|
304
|
+
led for the shared Vibe64 group: ${e}`)}function er(e=""){try{return X(e)}catch{return null}}function ae(e=""){if(j("get\
|
|
305
305
|
ent",["group",e],{encoding:"utf8"}).status!==0)throw new Error(`Required OS group was not found: ${e}`)}function tr(e="",t=""){
|
|
306
306
|
if(er(e))throw new Error(`OS user already exists: ${e}`);if(!t||/[\r\n]/u.test(t))throw new Error("A valid initial passw\
|
|
307
|
-
ord is required to create an OS user.");
|
|
307
|
+
ord is required to create an OS user.");v("useradd",["--create-home","--user-group","--shell","/bin/bash",e]);let r=j("c\
|
|
308
308
|
hpasswd",{encoding:"utf8",input:`${e}:${t}
|
|
309
309
|
`});if(r.status!==0)throw new Error(String(r.stderr||r.stdout||"Could not set OS user password.").trim())}function rr(e="",t=""){
|
|
310
|
-
|
|
311
|
-
r.stderr||r.stdout||`${e} failed.`).trim());return String(r.stdout||"").trim()}function A(e="",t=[]){return
|
|
312
|
-
utf8"})}function ee(e="",t={},r="path"){let n=nr(e,t);if(!
|
|
313
|
-
exist.`);return n}function Oe(e="",t={},r="path"){let n=
|
|
314
|
-
es not exist.`);return n}function Ve(e={}){let t=
|
|
315
|
-
t resolve the managed service workspace.");return u.join("/var/lib/vibe64",r,"services")}function
|
|
316
|
-
e||"").trim();if(!r)throw new Error("Vibe64 exec helper rejected an empty managed service path.");let n=
|
|
317
|
-
if(
|
|
310
|
+
v("usermod",["-a","-G",t,e])}function v(e="",t=[]){let r=j(e,t,{encoding:"utf8"});if(r.status!==0)throw new Error(String(
|
|
311
|
+
r.stderr||r.stdout||`${e} failed.`).trim());return String(r.stdout||"").trim()}function A(e="",t=[]){return j(e,t,{encoding:"\
|
|
312
|
+
utf8"})}function ee(e="",t={},r="path"){let n=nr(e,t);if(!_(n))throw new Error(`Vibe64 deployment service ${r} does not \
|
|
313
|
+
exist.`);return n}function Oe(e="",t={},r="path"){let n=Le(e,t);if(!_(n))throw new Error(`Vibe64 managed service ${r} do\
|
|
314
|
+
es not exist.`);return n}function Ve(e={}){let t=T(e.username),r=R(t);if(!r)throw new Error("Vibe64 exec helper could no\
|
|
315
|
+
t resolve the managed service workspace.");return u.join("/var/lib/vibe64",r,"services")}function Le(e="",t={}){let r=String(
|
|
316
|
+
e||"").trim();if(!r)throw new Error("Vibe64 exec helper rejected an empty managed service path.");let n=E(r,{allowMissingLeaf:!0});
|
|
317
|
+
if(I(E(Ve(t)),n).length>0)return n;throw new Error("Vibe64 exec helper rejected a managed service path outside the works\
|
|
318
318
|
pace service root.")}function nr(e="",t={}){let r=String(e||"").trim();if(!r)throw new Error("Vibe64 exec helper rejecte\
|
|
319
|
-
d an empty deployment service path.");let n=
|
|
319
|
+
d an empty deployment service path.");let n=E(r),o=E(u.join(String(t.home||"").trim(),".local","state","vibe64","project\
|
|
320
320
|
s"));if(or(o,n))return n;throw new Error("Vibe64 exec helper rejected a deployment service path outside managed roots.")}
|
|
321
|
-
function or(e="",t=""){let r=
|
|
322
|
-
"service")}function
|
|
323
|
-
resolve(r),u.resolve(n));return!o||o.startsWith("..")||u.isAbsolute(o)?[]:o.split(u.sep).filter(Boolean)}function
|
|
321
|
+
function or(e="",t=""){let r=I(e,t);return r.length>=5&&r[1]==="deployments"&&r[2]==="releases"&&(r[4]==="artifact"||r[4]===
|
|
322
|
+
"service")}function I(e="",t=""){let r=String(e||"").trim(),n=String(t||"").trim();if(!r||!n)return[];let o=u.relative(u.
|
|
323
|
+
resolve(r),u.resolve(n));return!o||o.startsWith("..")||u.isAbsolute(o)?[]:o.split(u.sep).filter(Boolean)}function E(e,{allowMissingLeaf:t=!1}={}){
|
|
324
324
|
let r=u.resolve(e);if(t)try{fe(r)}catch(n){if(n.code!=="ENOENT")throw n;return u.join(te(u.dirname(r)),u.basename(r))}return te(
|
|
325
325
|
r)}function ce(e=""){let t=String(e||"").trim();if(!t.startsWith("vibe64-release-")||!t.endsWith(".service")||!/^[A-Za-z0-9_.@:-]+$/u.
|
|
326
326
|
test(t)||t.includes("/")||t.includes(".."))throw new Error("Vibe64 exec helper rejected an unsafe deployment service uni\
|
|
327
327
|
t name.");return t}function ve(e="",t={}){let r=String(e||"").trim(),n=u.basename(u.dirname(Ve(t)));if(!r.startsWith(`vi\
|
|
328
328
|
be64-managed-${n}-`)||!r.endsWith(".service")||!/^[A-Za-z0-9_.@:-]+$/u.test(r)||r.includes("/")||r.includes(".."))throw new Error(
|
|
329
|
-
"Vibe64 exec helper rejected an unsafe managed service unit name.");return r}function
|
|
329
|
+
"Vibe64 exec helper rejected an unsafe managed service unit name.");return r}function Ge(e=""){let t=String(e||"").trim();
|
|
330
330
|
if(t!=="forking"&&t!=="simple")throw new Error("Vibe64 exec helper rejected an unsupported managed service process model\
|
|
331
331
|
.");return t}function We(e=""){return u.join("/etc/systemd/system",ce(e))}function ir(e="",t={}){return u.join("/etc/sys\
|
|
332
|
-
temd/system",ve(e,t))}function He(e={}){return[`User=${
|
|
333
|
-
sk=0007"]}function ze(e={}){return[`Slice=vibe64-${
|
|
332
|
+
temd/system",ve(e,t))}function He(e={}){return[`User=${N(e.username)}`,`Group=${$}`,"SupplementaryGroups=nix-users","UMa\
|
|
333
|
+
sk=0007"]}function ze(e={}){return[`Slice=vibe64-${R(T(e.username))}-work.slice`,"MemoryAccounting=yes","IOAccounting=ye\
|
|
334
334
|
s","TasksAccounting=yes","KillMode=control-group","OOMPolicy=stop"]}function sr({environmentFile:e="",owner:t={},requiredUnits:r=[],
|
|
335
335
|
startScript:n="",unitName:o="",workingDirectory:i=""}={}){let s=Array.isArray(r)?r:[];return["[Unit]",`Description=Vibe6\
|
|
336
336
|
4 release service ${o}`,`After=${["network-online.target",...s].join(" ")}`,"Wants=network-online.target",...s.length>0?
|
|
337
337
|
[`Requires=${s.join(" ")}`]:[],"StartLimitIntervalSec=60","StartLimitBurst=5","","[Service]","Type=simple",...He(t),...ze(
|
|
338
|
-
t),`WorkingDirectory=${
|
|
339
|
-
`ExecStart=${
|
|
338
|
+
t),`WorkingDirectory=${N(i)}`,`EnvironmentFile=${N(e)}`,`Environment=PATH=${N(ie)}`,`Environment=TMPDIR=${N(Y(t.username))}`,
|
|
339
|
+
`ExecStart=${N(n)}`,"Restart=always","RestartSec=3","KillSignal=SIGTERM","TimeoutStopSec=30","","[Install]","WantedBy=mu\
|
|
340
340
|
lti-user.target",""].join(`
|
|
341
341
|
`)}function ar({owner:e={},pidFile:t="",processModel:r="simple",startScript:n="",unitName:o="",workingDirectory:i=""}={}){
|
|
342
|
-
let s=
|
|
343
|
-
e.target","","[Service]",`Type=${s}`,...He(e),...ze(e),`WorkingDirectory=${
|
|
344
|
-
nt=TMPDIR=${
|
|
342
|
+
let s=Ge(r);return["[Unit]",`Description=Vibe64 managed service ${o}`,"After=network-online.target","Wants=network-onlin\
|
|
343
|
+
e.target","","[Service]",`Type=${s}`,...He(e),...ze(e),`WorkingDirectory=${N(i)}`,`Environment=PATH=${N(ie)}`,`Environme\
|
|
344
|
+
nt=TMPDIR=${N(Y(e.username))}`,`ExecStart=${N(n)}`,...s==="forking"?[`PIDFile=${N(t)}`]:[],"Restart=on-failure","Restart\
|
|
345
345
|
Sec=3","TimeoutStartSec=90","TimeoutStopSec=30","","[Install]","WantedBy=multi-user.target",""].join(`
|
|
346
|
-
`)}function
|
|
346
|
+
`)}function N(e=""){let t=String(e||"").trim();if(!t||/[\r\n]/u.test(t))throw new Error("Vibe64 exec helper rejected an \
|
|
347
347
|
unsafe systemd value.");return t.replaceAll("\\","\\\\").replaceAll('"','\\"')}function ne(e="uid",t=null,r=null){if(!Number.
|
|
348
348
|
isSafeInteger(t)||t<0||t!==r)throw new Error(`Vibe64 exec helper ${e} mismatch.`)}function Ke(e={},t=""){let r=u.join(e.
|
|
349
349
|
home,".local","state","vibe64","users",`${t}.json`),n=JSON.parse(h(r,"utf8"));if(n?.username!==t||n?.status!=="active")throw new Error(
|
|
350
350
|
"OS user is not enabled for Vibe64.")}function Fe(e="",t="",{operation:r="",targetUser:n={}}={}){if(r==="health-status")
|
|
351
|
-
return Y(t);if(r==="workspace-cache-command"){let i=u.join(n.home,".local/state/vibe64/cache-maintenance"),s=
|
|
352
|
-
s);if(n.username!==t||
|
|
351
|
+
return Y(t);if(r==="workspace-cache-command"){let i=u.join(n.home,".local/state/vibe64/cache-maintenance"),s=E(e),a=I(i,
|
|
352
|
+
s);if(n.username!==t||E(i)!==i||s!==e||a.length!==1||!/^[a-z][a-z0-9-]*-[A-Za-z0-9]{6}$/u.test(a[0]))throw new Error("Ca\
|
|
353
353
|
che maintenance requires an owned workspace scratch directory.");return s}let o=String(e||"").trim();if(!o)return"/";if(r===
|
|
354
354
|
"account-auth-terminal"||r==="account-status"||r==="github-api-command")return ur(o,n);if(r==="vibe64-command"&&n.username===
|
|
355
|
-
t){let i=
|
|
356
|
-
sep}`))return i}let a=u.join(n.home,".local","state","vibe64","colleague");if(
|
|
357
|
-
test(
|
|
358
|
-
|
|
359
|
-
test(
|
|
360
|
-
|
|
361
|
-
|
|
362
|
-
|
|
363
|
-
(
|
|
364
|
-
|
|
365
|
-
|
|
366
|
-
|
|
367
|
-
|
|
368
|
-
|
|
369
|
-
|
|
370
|
-
|
|
371
|
-
|
|
372
|
-
|
|
373
|
-
|
|
374
|
-
|
|
375
|
-
|
|
355
|
+
t){let i=E(o),s=u.join(n.home,".local","state","vibe64","projects");if(_(s)){let l=E(s);if(i===l||i.startsWith(`${l}${u.
|
|
356
|
+
sep}`))return i}let a=u.join(n.home,".local","state","vibe64","colleague");if(_(a)){let l=I(E(a),i);if(l.length===2&&/^[A-Za-z0-9_-]+$/u.
|
|
357
|
+
test(l[0])&&/^colleague_[a-f0-9]{32}$/u.test(l[1]))return i}let c=u.join(n.home,".local","state","vibe64","training","us\
|
|
358
|
+
ers");if(_(c)){let l=I(E(c),i),d=/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/u;if(l.length===7&&/^[A-Za-z0-9_-]+$/u.
|
|
359
|
+
test(l[0])&&l[1]==="learning-sessions"&&d.test(l[2])&&l[3]==="sessions"&&l[4]==="active"&&l[5]===`learning-${l[2]}`&&l[6]===
|
|
360
|
+
"native")return i}let m=u.join(n.home,".local","state","vibe64","training-sources");if(_(m)){let l=I(E(m),i);if(l.length===
|
|
361
|
+
1&&/^(catalogue|topic)-[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/u.test(l[0]))return i}}if(r==="code\
|
|
362
|
+
x-app-server"||r==="opencode-app-server"){let i=E(o),s=Number(n.uid),a=[se({username:t})];Number.isSafeInteger(s)&&s>=0&&
|
|
363
|
+
a.push(u.join("/run/user",String(s)));for(let c of a){let m=u.join(c,"vibe64","agent-providers");if(!_(m))continue;let l=E(
|
|
364
|
+
m),d=I(l,i),p=d[0],f=r==="opencode-app-server"?p==="opencode":p==="codex-app-server"||/^codex-app-server-[a-f0-9]{12}$/u.
|
|
365
|
+
test(p),g=r==="codex-app-server"&&d.length===1,x=d.length===2&&d[1]==="workspace";if(f&&(g||x))return i}}return cr(o,t)}
|
|
366
|
+
function cr(e="",t=""){let r=String(e||"").trim();if(!r)throw new Error("Vibe64 exec helper rejected an empty managed pr\
|
|
367
|
+
oject path.");let n=E(r),o=E(u.join("/var/lib/vibe64",R(t),"projects"));if(n.startsWith(`${o}${u.sep}`))return n;throw new Error(
|
|
368
|
+
"Vibe64 exec helper rejected a command path outside the owner project root.")}function ur(e="",t={}){let r=String(e||"").
|
|
369
|
+
trim(),n=String(t.home||"").trim();if(!r||!n)throw new Error("Vibe64 exec helper rejected an empty user command path.");
|
|
370
|
+
let o=E(r),i=E(n);if(o===i||o.startsWith(`${i}${u.sep}`))return o;throw new Error("Vibe64 exec helper rejected a command\
|
|
371
|
+
path outside the target user home.")}function R(e=""){return e.startsWith(re)?e.slice(re.length):e}function Y(e=""){return u.
|
|
372
|
+
join(mt,R(T(e)),"tmp")}function be(e={},t={},r="",n=""){let o={PATH:ie,TERM:w.env.TERM||"xterm-256color"};for(let[i,s]of Object.
|
|
373
|
+
entries(e))!ct.test(i)||ut.has(i)||i.startsWith("LD_")||i.startsWith("DYLD_")||(o[i]=String(s));if(n==="opencode-app-ser\
|
|
374
|
+
ver"){let i=u.join(se({username:r}),"vibe64","agent-providers","opencode");for(let s of["HOME","XDG_CACHE_HOME","XDG_CON\
|
|
375
|
+
FIG_HOME","XDG_DATA_HOME","XDG_STATE_HOME"]){let a=String(e[s]||"").trim();if(!u.isAbsolute(a)||I(i,a).length===0)throw new Error(
|
|
376
|
+
`Vibe64 exec helper rejected OpenCode ${s} outside its provider runtime.`);o[s]=u.resolve(a)}}else o.HOME=t.home,o.XDG_CACHE_HOME=
|
|
377
|
+
u.join(t.home,".cache"),o.XDG_CONFIG_HOME=u.join(t.home,".config"),o.XDG_DATA_HOME=u.join(t.home,".local","share");return o.
|
|
378
|
+
LOGNAME=t.username,o.USER=t.username,o.TMPDIR=Y(r),o}export{ne as assertExpectedId,E as canonicalPath,be as helperChildEnv,Vt as managedExecutionOomBoundary,K as managedExecutionState,
|
|
376
379
|
Be as managedExecutionTaskLimitCounters,Ut as managedExecutionTaskLimitJournal,ge as managedWorkflowCounters,Ce as managedWorkflowIdentity,
|
|
377
380
|
Fe as resolveAllowedCwd,nr as resolveAllowedDeploymentServicePath,ur as resolveAllowedUserHomePath,Et as runUserCommand};
|