withruntime 0.8.4 → 0.10.0

package/dist/compat/core.d.ts

@@ -0,0 +1,40 @@
+import { Runtime, type CreateOptions, type RuntimeOptions } from "../client.js";
+import type { Sandbox } from "../sandbox.js";
+import type { CreateSandbox, ExecOptions } from "../types.js";
+import type { RequestOptions } from "../transport.js";
+export type ClientOptions = RuntimeOptions & {
+    client?: Runtime;
+};
+export declare const client: ({ client: supplied, ...options }?: ClientOptions) => Runtime;
+/** Reject before allocation: accepting an option that does nothing is not compatibility. */
+export declare class CompatibilityError extends Error {
+    readonly provider: string;
+    readonly feature: string;
+    readonly code = "unsupported_compatibility_option";
+    constructor(provider: string, feature: string);
+}
+export declare function only(provider: string, value: object, keys: readonly string[]): void;
+export declare function region(provider: string, value?: string | null): string | undefined;
+export declare const quote: (value: string) => string;
+export declare const pathAt: (path: string, cwd?: string) => string;
+export declare function environment(sandbox: Sandbox, options?: RequestOptions): Promise<Record<string, string>>;
+export declare function saveEnvironment(sandbox: Sandbox, env: Record<string, string>, options?: RequestOptions): Promise<void>;
+export declare function validateEnvironment(env: Record<string, string>): void;
+export declare function execOptions(sandbox: Sandbox, options?: ExecOptions, request?: RequestOptions): Promise<ExecOptions>;
+export declare function create(runtime: Runtime, provider: string, input: CreateSandbox, env?: Record<string, string> | undefined, setup?: (sandbox: Sandbox) => Promise<void>, options?: CreateOptions): Promise<Sandbox>;
+export declare function destroy(sandbox: Sandbox, options?: RequestOptions): Promise<void>;
+export declare function ready(sandbox: Sandbox): Promise<Sandbox>;
+export declare function lookup(runtime: Runtime, id: string, options?: RequestOptions): Promise<Sandbox>;
+export declare function all(runtime: Runtime, provider: string): Promise<Sandbox[]>;
+export declare function image(runtime: Runtime, ref: string): Promise<string>;
+export declare function checked(sandbox: Sandbox, argv: string[], options?: ExecOptions): Promise<void>;
+export declare function missing(path: string): never;
+/** Foreground commands share a resident Bash process. Background commands start
+ * from the last completed exported environment/cwd snapshot without blocking it. */
+export declare function shellCommand(sandbox: Sandbox, command: string, name?: string | null, overrides?: {
+    env?: Record<string, string>;
+    cwd?: string;
+    persist?: boolean;
+}, request?: RequestOptions): Promise<string | string[]>;
+export declare function closeShell(sandbox: Sandbox, name: string): Promise<void>;
+export declare function shellRoot(name: string): Promise<string>;

package/dist/compat/core.js

@@ -0,0 +1,238 @@
+import { Runtime } from "../client.js";
+import { RuntimeError, NotFoundError } from "../errors.js";
+import { SHELL_BROKER } from "./shell.js";
+export const client = ({ client: supplied, ...options } = {}) => {
+    if (supplied)
+        return supplied;
+    if (options.baseUrl && !options.fetch) {
+        const host = new URL(options.baseUrl).hostname;
+        if (host !== "withruntime.com" &&
+            !host.endsWith(".withruntime.com") &&
+            !["localhost", "127.0.0.1", "[::1]"].includes(host))
+            throw new CompatibilityError("Runtime", "a competitor API endpoint; configure the Runtime endpoint or inject a native Runtime client");
+    }
+    // Vendor credentials must never leave the caller's machine for Runtime.
+    const apiKey = options.apiKey?.startsWith("rtcloud_") ? options.apiKey : undefined;
+    return new Runtime({ ...options, apiKey });
+};
+/** Reject before allocation: accepting an option that does nothing is not compatibility. */
+export class CompatibilityError extends Error {
+    provider;
+    feature;
+    code = "unsupported_compatibility_option";
+    constructor(provider, feature) {
+        super(`${provider}: ${feature} is not supported by this Runtime compatibility adapter.`);
+        this.provider = provider;
+        this.feature = feature;
+        this.name = "CompatibilityError";
+    }
+}
+export function only(provider, value, keys) {
+    for (const [key, item] of Object.entries(value))
+        if (item !== undefined && item !== null && !keys.includes(key))
+            throw new CompatibilityError(provider, key);
+}
+export function region(provider, value) {
+    if (value && value !== "us-east")
+        throw new CompatibilityError(provider, `region ${value}; select Runtime's us-east region`);
+    return value ?? undefined;
+}
+export const quote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
+export const pathAt = (path, cwd = "/workspace") => path.startsWith("/") ? path : `${cwd.replace(/\/$/, "")}/${path}`;
+const ENV_PATH = "/workspace/.runtime-compat/environment.json";
+export async function environment(sandbox, options = {}) {
+    options.signal?.throwIfAborted();
+    try {
+        const text = await sandbox.files.readText(ENV_PATH, options);
+        options.signal?.throwIfAborted();
+        return JSON.parse(text);
+    }
+    catch (error) {
+        if (error instanceof NotFoundError)
+            return {};
+        throw error;
+    }
+}
+export async function saveEnvironment(sandbox, env, options = {}) {
+    options.signal?.throwIfAborted();
+    validateEnvironment(env);
+    await sandbox.files.write(ENV_PATH, JSON.stringify(env), {
+        mode: 0o600,
+        signal: options.signal,
+        timeoutMs: options.timeoutMs,
+    });
+}
+export function validateEnvironment(env) {
+    for (const key of Object.keys(env))
+        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
+            throw new TypeError(`Invalid environment variable: ${key}`);
+    for (const value of Object.values(env))
+        if (typeof value !== "string" || value.includes("\0"))
+            throw new TypeError("Environment values must be strings without NUL bytes");
+}
+export async function execOptions(sandbox, options = {}, request = {}) {
+    const requestOptions = { ...request, signal: request.signal ?? options.signal };
+    return { ...options, env: { ...(await environment(sandbox, requestOptions)), ...options.env } };
+}
+export async function create(runtime, provider, input, env = undefined, setup, options = {}) {
+    options.signal?.throwIfAborted();
+    if (env !== undefined)
+        validateEnvironment(env);
+    const sandbox = await runtime.sandboxes.create({
+        ...input,
+        labels: { ...input.labels, "compat.provider": provider },
+    }, options);
+    try {
+        options.signal?.throwIfAborted();
+        if (env !== undefined || !input.snapshot)
+            await saveEnvironment(sandbox, env ?? {}, options);
+        options.signal?.throwIfAborted();
+        await setup?.(sandbox);
+        options.signal?.throwIfAborted();
+        return sandbox;
+    }
+    catch (error) {
+        // Cancellation cannot authorize deleting a remote resource: the response
+        // may be a retry/reuse of a sandbox that already has somebody's work.
+        // Legacy failed-initialization rollback is limited to an ordinary create
+        // with a new SDK-generated mutation key and no replay/reuse marker.
+        if (options.signal?.aborted ||
+            (error instanceof RuntimeError && error.code === "timeout") ||
+            input.getOrCreate === true ||
+            options.idempotencyKey !== undefined ||
+            sandbox.info.replayed === true ||
+            sandbox.info.reused === true)
+            throw error;
+        try {
+            await destroy(sandbox);
+        }
+        catch (cleanup) {
+            throw new AggregateError([error, cleanup], `Initialization failed and sandbox ${sandbox.id} could not be cleaned up.`);
+        }
+        throw error;
+    }
+}
+export async function destroy(sandbox, options = {}) {
+    // Stop before releasing persistence: a paused sandbox cannot change its disk
+    // meter, and must never be woken solely to delete it. The stopped update queues
+    // disk destruction; see ARCHITECTURE.md section 10 and migration 0181.
+    options.signal?.throwIfAborted();
+    if (options.idempotencyKey !== undefined)
+        throw new CompatibilityError("Runtime", "caller idempotency keys for compound sandbox deletion");
+    await sandbox.stop(options);
+    if (sandbox.info.persistent)
+        await sandbox.update({ persistent: false }, options);
+}
+export async function ready(sandbox) {
+    if (sandbox.state === "paused")
+        await sandbox.wake();
+    else if (sandbox.state === "stopped")
+        await sandbox.restart();
+    else if (sandbox.state !== "running")
+        await sandbox.waitFor("running");
+    return sandbox;
+}
+export async function lookup(runtime, id, options = {}) {
+    options.signal?.throwIfAborted();
+    if (/^[a-f0-9-]{36}$/i.test(id))
+        return runtime.sandboxes.get(id, options);
+    const page = await runtime.sandboxes.list({ name: id, includeStopped: true }, options);
+    for await (const sandbox of page) {
+        options.signal?.throwIfAborted();
+        if (sandbox.info.name === id)
+            return sandbox;
+    }
+    // IDs are not necessarily UUIDs in local or self-hosted servers.
+    return runtime.sandboxes.get(id, options);
+}
+export async function all(runtime, provider) {
+    const result = [];
+    for await (const sandbox of await runtime.sandboxes.list({
+        labels: { "compat.provider": provider },
+        includeStopped: true,
+    }))
+        result.push(sandbox);
+    return result;
+}
+export async function image(runtime, ref) {
+    if (ref.startsWith("runtime:"))
+        return (await runtime.images.resolve(ref.slice(8))).id;
+    return (await runtime.images.build({ image: ref })).id;
+}
+export async function checked(sandbox, argv, options = {}) {
+    await sandbox.exec(argv, { ...options, check: true });
+}
+export function missing(path) {
+    throw new RuntimeError({
+        message: `${path} does not exist`,
+        code: "file_not_found",
+        status: 404,
+    });
+}
+/** Foreground commands share a resident Bash process. Background commands start
+ * from the last completed exported environment/cwd snapshot without blocking it. */
+export async function shellCommand(sandbox, command, name, overrides = {}, request = {}) {
+    request.signal?.throwIfAborted();
+    if (!name)
+        return command;
+    const root = await shellRoot(name);
+    await sandbox.files.mkdir(root, {
+        parents: true,
+        signal: request.signal,
+        timeoutMs: request.timeoutMs,
+    });
+    if (overrides.persist !== false) {
+        const script = "/workspace/.runtime-compat/shell.py";
+        await sandbox.files.write(script, SHELL_BROKER, {
+            mode: 0o600,
+            signal: request.signal,
+            timeoutMs: request.timeoutMs,
+        });
+        return [
+            "python3",
+            script,
+            "client",
+            root,
+            JSON.stringify({
+                command,
+                env: overrides.env ?? {},
+                cwd: overrides.cwd,
+                baseEnv: await environment(sandbox, request),
+            }),
+        ];
+    }
+    return [
+        ...(overrides.persist === false ? [] : ["flock", `${root}/lock`]),
+        "bash",
+        "-c",
+        'readonly __runtime_state="$1" __runtime_command="$2" __runtime_cwd="$3" __runtime_persist="$4"; shift 4; __runtime_env=(); for __runtime_key in "$@"; do __runtime_env+=("$__runtime_key=${!__runtime_key}"); done; if [ -f "$__runtime_state" ]; then source "$__runtime_state"; fi; for __runtime_entry in "${__runtime_env[@]}"; do export "$__runtime_entry"; done; if [ -n "$__runtime_cwd" ]; then cd -- "$__runtime_cwd" || exit; fi; if [ "$__runtime_persist" = yes ]; then trap \'__runtime_status=$?; (umask 077; export -p | sed "/^declare -x __runtime_/d" > "$__runtime_state.next"; printf "cd -- %q\\n" "$PWD" >> "$__runtime_state.next"; mv -- "$__runtime_state.next" "$__runtime_state"); exit "$__runtime_status"\' EXIT; fi; eval "$__runtime_command"',
+        "bash",
+        `${root}/state`,
+        command,
+        overrides.cwd ?? "",
+        overrides.persist === false ? "no" : "yes",
+        ...Object.keys(overrides.env ?? {}),
+    ];
+}
+export async function closeShell(sandbox, name) {
+    const root = await shellRoot(name);
+    const script = "/workspace/.runtime-compat/shell.py";
+    if (await sandbox.files.exists(script)) {
+        const result = await sandbox.exec([
+            "python3",
+            script,
+            "client",
+            root,
+            JSON.stringify({ action: "destroy" }),
+        ]);
+        if (result.exitCode !== 0)
+            throw new Error(`Could not close named shell: ${result.stderr}`);
+    }
+    if (await sandbox.files.exists(root))
+        await sandbox.files.remove(root, { recursive: true });
+}
+export async function shellRoot(name) {
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(name));
+    const key = Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("");
+    return `/workspace/.runtime-compat/shells/${key}`;
+}

package/dist/compat/files.d.ts

@@ -0,0 +1,26 @@
+import type { Sandbox } from "../sandbox.js";
+/** Guest operations use argv, never interpolated shell paths. */
+export declare class GuestFiles {
+    private readonly get;
+    readonly cwd: string;
+    constructor(get: () => Promise<Sandbox>, cwd?: string);
+    path(path: string): string;
+    readFile(path: string): Promise<Uint8Array>;
+    readTextFile(path: string): Promise<string>;
+    writeFile(path: string, content: string | Uint8Array, options?: {
+        mode?: number;
+        signal?: AbortSignal;
+    }): Promise<void>;
+    writeTextFile(path: string, content: string): Promise<void>;
+    mkdir(path: string, recursive?: boolean): Promise<void>;
+    remove(path: string, recursive?: boolean): Promise<void>;
+    rename(from: string, to: string, overwrite?: boolean): Promise<void>;
+    copy(from: string, to: string, recursive?: boolean, overwrite?: boolean): Promise<void>;
+    exists(path: string): Promise<boolean>;
+    stat(path: string): Promise<import("../types.js").FileEntry & {
+        exists: true;
+    }>;
+    readdir(path: string): Promise<import("../types.js").FileEntry[]>;
+    chmod(path: string, mode: number, recursive?: boolean): Promise<void>;
+    appendFile(path: string, content: string | Uint8Array): Promise<void>;
+}

package/dist/compat/files.js

@@ -0,0 +1,133 @@
+import { checked, missing, pathAt } from "./core.js";
+/** Guest operations use argv, never interpolated shell paths. */
+export class GuestFiles {
+    get;
+    cwd;
+    constructor(get, cwd = "/workspace") {
+        this.get = get;
+        this.cwd = cwd;
+    }
+    path(path) {
+        return pathAt(path, this.cwd);
+    }
+    async readFile(path) {
+        return (await this.get()).files.read(this.path(path));
+    }
+    async readTextFile(path) {
+        return (await this.get()).files.readText(this.path(path));
+    }
+    async writeFile(path, content, options = {}) {
+        const sandbox = await this.get();
+        const target = this.path(path);
+        const bytes = typeof content === "string" ? new TextEncoder().encode(content) : content;
+        if (bytes.length <= 1_048_576 || target.startsWith("/workspace/")) {
+            await sandbox.files.write(target, content, options);
+            return;
+        }
+        const staging = `/workspace/.runtime-compat/write-${crypto.randomUUID()}`;
+        try {
+            await sandbox.files.write(staging, bytes, { mode: 0o600, signal: options.signal });
+            await checked(sandbox, [
+                "bash",
+                "-c",
+                'set -e; mkdir -p -- "$(dirname -- "$2")"; temp="$2.runtime-$4"; trap \'rm -f -- "$temp"\' EXIT; cp -- "$1" "$temp"; chmod "$3" "$temp"; mv -f -- "$temp" "$2"',
+                "bash",
+                staging,
+                target,
+                (options.mode ?? 0o644).toString(8),
+                crypto.randomUUID(),
+            ], { signal: options.signal });
+        }
+        finally {
+            // Cleanup must preserve the write's outcome, including its original
+            // failure; a successful destination write must not invite a replay.
+            await sandbox.files.remove(staging).catch(() => undefined);
+        }
+    }
+    writeTextFile(path, content) {
+        return this.writeFile(path, content);
+    }
+    async mkdir(path, recursive = false) {
+        await (await this.get()).files.mkdir(this.path(path), { parents: recursive });
+    }
+    async remove(path, recursive = false) {
+        await (await this.get()).files.remove(this.path(path), { recursive });
+    }
+    async rename(from, to, overwrite = false) {
+        await (await this.get()).files.rename(this.path(from), this.path(to), { overwrite });
+    }
+    async copy(from, to, recursive = false, overwrite = false) {
+        const sandbox = await this.get();
+        if (!overwrite && (await sandbox.files.exists(this.path(to))))
+            throw new Error(`Destination exists: ${to}`);
+        if (!overwrite) {
+            // cp -n alone reports success when it skips a raced destination. Stage
+            // privately, then publish without replacement and verify it moved.
+            await checked(sandbox, [
+                "bash",
+                "-c",
+                'set -e; parent=$(dirname -- "$2"); stage="$parent/.runtime-copy-$4"; mkdir -m 700 -- "$stage"; trap \'rm -rf -- "$stage"\' EXIT; if [ "$3" = true ]; then cp -R -n -- "$1" "$stage/item"; else cp -n -- "$1" "$stage/item"; fi; mv -n -T -- "$stage/item" "$2"; if [ -e "$stage/item" ] || [ -L "$stage/item" ]; then printf "Destination exists: %s\\n" "$2" >&2; exit 73; fi',
+                "bash",
+                this.path(from),
+                this.path(to),
+                String(recursive),
+                crypto.randomUUID(),
+            ]);
+            return;
+        }
+        await checked(sandbox, [
+            "cp",
+            ...(recursive ? ["-R"] : []),
+            "--",
+            this.path(from),
+            this.path(to),
+        ]);
+    }
+    async exists(path) {
+        return (await this.get()).files.exists(this.path(path));
+    }
+    async stat(path) {
+        const entry = await (await this.get()).files.stat(this.path(path));
+        if (!entry.exists)
+            missing(path);
+        return entry;
+    }
+    async readdir(path) {
+        return (await this.get()).files.list(this.path(path), { hidden: true });
+    }
+    async chmod(path, mode, recursive = false) {
+        await checked(await this.get(), [
+            "chmod",
+            ...(recursive ? ["-R"] : []),
+            (mode & 0o7777).toString(8),
+            "--",
+            this.path(path),
+        ]);
+    }
+    async appendFile(path, content) {
+        const sandbox = await this.get();
+        const bytes = typeof content === "string" ? new TextEncoder().encode(content) : content;
+        if (bytes.byteLength <= 1_048_576) {
+            await checked(sandbox, ["bash", "-c", 'cat >> "$1"', "bash", this.path(path)], {
+                stdin: bytes,
+            });
+            return;
+        }
+        const staging = `/workspace/.runtime-compat/append-${crypto.randomUUID()}`;
+        try {
+            await sandbox.files.write(staging, bytes, { mode: 0o600 });
+            await checked(sandbox, [
+                "bash",
+                "-c",
+                'cat -- "$1" >> "$2"',
+                "bash",
+                staging,
+                this.path(path),
+            ]);
+        }
+        finally {
+            // A cleanup failure after success must not invite appending twice.
+            await sandbox.files.remove(staging).catch(() => undefined);
+        }
+    }
+}

package/dist/compat/shell.d.ts

@@ -0,0 +1,4 @@
+/** Guest-side resident shell. The socket is private to the sandbox user. Native
+ * sandbox leases bound its lifetime; cancellation closes the connection and
+ * kills the affected shell before another command may start. */
+export declare const SHELL_BROKER: string;

package/dist/compat/shell.js

@@ -0,0 +1,165 @@
+/** Guest-side resident shell. The socket is private to the sandbox user. Native
+ * sandbox leases bound its lifetime; cancellation closes the connection and
+ * kills the affected shell before another command may start. */
+export const SHELL_BROKER = String.raw `import base64, fcntl, json, os, select, selectors, shlex, signal, socket, subprocess, sys, time
+
+root = sys.argv[2]
+sockpath = os.path.join(root, 'socket')
+statepath = os.path.join(root, 'state')
+
+def send(conn, event):
+    conn.sendall((json.dumps(event) + '\n').encode())
+
+def stop_shell(shell):
+    if shell is not None:
+        try: os.killpg(shell.pid, signal.SIGKILL)
+        except ProcessLookupError: pass
+        shell.wait()
+
+def server():
+    os.umask(0o077)
+    try: os.unlink(sockpath)
+    except FileNotFoundError: pass
+    listener = socket.socket(socket.AF_UNIX)
+    listener.bind(sockpath)
+    listener.listen(32)
+    shell = None
+    status_read = None
+    baseline = {}
+    try:
+        while True:
+            conn, _ = listener.accept()
+            with conn:
+                try:
+                    data = b''
+                    while not data.endswith(b'\n'):
+                        chunk = conn.recv(65536)
+                        if not chunk: raise ConnectionError('Client disconnected before command')
+                        data += chunk
+                        if len(data) > 16 * 1024 * 1024: raise ValueError('Shell request exceeds 16 MiB')
+                    req = json.loads(data)
+                    if select.select([conn], [], [], 0)[0] and not conn.recv(1, socket.MSG_PEEK):
+                        raise ConnectionError('Client disconnected before execution')
+                    if req.get('action') == 'destroy':
+                        stop_shell(shell)
+                        shell = None
+                        send(conn, {'type':'exit', 'code':0})
+                        return
+                    if shell is None or shell.poll() is not None:
+                        if status_read is not None: os.close(status_read)
+                        status_read, status_write = os.pipe()
+                        env = req['initialEnv']
+                        shell = subprocess.Popen(['bash', '--noprofile', '--norc'], stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, env=env, cwd=req['initialCwd'], pass_fds=(status_write,), start_new_session=True)
+                        baseline = req['baseEnv']
+                        shell.stdin.write(b'shopt -s expand_aliases\n')
+                        # Export/cwd snapshots allow upgrades and background processes to reconnect.
+                        if os.path.exists(statepath):
+                            shell.stdin.write(('builtin source ' + shlex.quote(statepath) + '\n').encode())
+                        os.close(status_write)
+                    lines = ['builtin unset -- ' + shlex.quote(key) for key in baseline if key not in req['baseEnv']]
+                    for key, value in req['baseEnv'].items():
+                        if baseline.get(key) != value: lines.append('builtin export -- ' + shlex.quote(key + '=' + value))
+                    baseline = req['baseEnv']
+                    for key, value in req['env'].items(): lines.append('builtin export -- ' + shlex.quote(key + '=' + value))
+                    if req.get('cwd'): lines.append('builtin cd -- ' + shlex.quote(req['cwd']) + ' &&')
+                    commandpath = os.path.join(root, 'command')
+                    with open(commandpath, 'w') as source: source.write(req['command'] + '\n')
+                    lines.append('builtin source ' + shlex.quote(commandpath))
+                    # All bookkeeping happens after evaluation. No shell variables can
+                    # overwrite the requested command before it runs.
+                    script = '\n'.join(lines) + '\n__runtime_status=$?\n'
+                    script += '(builtin umask 077; builtin export -p | /usr/bin/sed "/^declare -x __runtime_/d" > ' + shlex.quote(statepath + '.next') + '; builtin printf "cd -- %q\\n" "$PWD" >> ' + shlex.quote(statepath + '.next') + '; /bin/mv -- ' + shlex.quote(statepath + '.next') + ' ' + shlex.quote(statepath) + ')\n'
+                    script += '(umask 077; builtin printf "%s" "$PWD" >| ' + shlex.quote(os.path.join(root, 'cwd')) + ')\n'
+                    script += 'builtin printf "%s\\n" "$__runtime_status" >&' + str(status_write) + '\n'
+                    shell.stdin.write(script.encode())
+                    shell.stdin.flush()
+                    status = b''
+                    with selectors.DefaultSelector() as sel:
+                        sel.register(shell.stdout, selectors.EVENT_READ, 'stdout')
+                        sel.register(shell.stderr, selectors.EVENT_READ, 'stderr')
+                        sel.register(status_read, selectors.EVENT_READ, 'status')
+                        sel.register(conn, selectors.EVENT_READ, 'client')
+                        while True:
+                            events = sel.select(0.1)
+                            # Drain output before acknowledging completion, even when
+                            # the completion pipe and output become readable together.
+                            for key, _ in sorted(events, key=lambda event: event[0].data == 'status'):
+                                kind = key.data
+                                if kind == 'client':
+                                    if not conn.recv(1, socket.MSG_PEEK): raise ConnectionError('Client disconnected')
+                                    continue
+                                chunk = os.read(key.fd, 65536)
+                                if not chunk:
+                                    sel.unregister(key.fileobj)
+                                    continue
+                                if kind == 'status': status += chunk
+                                else: send(conn, {'type':kind, 'base64':base64.b64encode(chunk).decode()})
+                            if b'\n' in status:
+                                # Pipe readiness can race: exhaust currently buffered output.
+                                for pipe, kind in [(shell.stdout,'stdout'),(shell.stderr,'stderr')]:
+                                    os.set_blocking(pipe.fileno(), False)
+                                    try:
+                                        while True:
+                                            chunk = os.read(pipe.fileno(), 65536)
+                                            if not chunk: break
+                                            send(conn, {'type':kind,'base64':base64.b64encode(chunk).decode()})
+                                    except BlockingIOError: pass
+                                    finally: os.set_blocking(pipe.fileno(), True)
+                                send(conn, {'type':'exit','code':int(status.split(b'\n')[0])})
+                                break
+                            if shell.poll() is not None:
+                                # A terminated shell starts fresh next time, not from old exports.
+                                for stale in (statepath, os.path.join(root, 'cwd')):
+                                    try: os.unlink(stale)
+                                    except FileNotFoundError: pass
+                                send(conn, {'type':'exit','code':shell.returncode if shell.returncode >= 0 else 128-shell.returncode, 'terminated':True})
+                                break
+                except (BrokenPipeError, ConnectionError, OSError):
+                    stop_shell(shell)
+                    shell = None
+                except Exception as error:
+                    stop_shell(shell)
+                    shell = None
+                    try: send(conn, {'type':'error','message':str(error)})
+                    except OSError: pass
+    finally:
+        stop_shell(shell)
+        listener.close()
+        try: os.unlink(sockpath)
+        except FileNotFoundError: pass
+
+if sys.argv[1] == 'server':
+    server()
+else:
+    os.makedirs(root, mode=0o700, exist_ok=True)
+    conn = socket.socket(socket.AF_UNIX)
+    with open(os.path.join(root, 'startup.lock'), 'a') as lock:
+        fcntl.flock(lock, fcntl.LOCK_EX)
+        try: conn.connect(sockpath)
+        except (FileNotFoundError, ConnectionRefusedError):
+            if json.loads(sys.argv[3]).get('action') == 'destroy': sys.exit(0)
+            with open(os.path.join(root, 'startup.log'), 'wb') as log:
+                daemon = subprocess.Popen([sys.executable, __file__, 'server', root], stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL, stderr=log, start_new_session=True)
+            for _ in range(300):
+                try:
+                    conn.connect(sockpath)
+                    break
+                except (FileNotFoundError, ConnectionRefusedError):
+                    if daemon.poll() is not None:
+                        with open(os.path.join(root, 'startup.log')) as log: raise RuntimeError('Resident shell startup: ' + log.read())
+                    time.sleep(0.01)
+            else: raise RuntimeError('Resident shell failed to start')
+    with conn:
+        req = json.loads(sys.argv[3])
+        req['initialEnv'] = dict(os.environ)
+        req['initialCwd'] = os.getcwd()
+        send(conn, req)
+        for line in conn.makefile('rb'):
+            event = json.loads(line)
+            if event['type'] == 'exit': sys.exit(event['code'])
+            if event['type'] == 'error': raise RuntimeError(event['message'])
+            target = sys.stdout.buffer if event['type'] == 'stdout' else sys.stderr.buffer
+            target.write(base64.b64decode(event['base64']))
+            target.flush()
+        raise RuntimeError('Resident shell disconnected without exit status')
+`;

package/dist/credentials.d.ts

@@ -14,6 +14,9 @@ export declare function connectionOrigins(env: NodeJS.ProcessEnv): {
     api: string;
     auth: string;
 };
+/** Browser-issued production credentials must only reach the production API.
+ * CLI and MCP share this boundary, including resumed device requests. */
+export declare function checkBrowserOrigins(origins: ReturnType<typeof connectionOrigins>): void;
 /** Private user storage, outside project files. Nothing reading this module
  * returns a secret to CLI output. Store names bind credentials to both origins. */
 export declare function connectionStore(env: NodeJS.ProcessEnv, directory?: string): {
@@ -27,7 +30,9 @@ export declare function connectionStore(env: NodeJS.ProcessEnv, directory?: stri
     /** Use another saved account's connection, by account id or name. The one
      * in use moves to the saved accounts. Null when none matches. */
     use(which: string): Promise<SavedConnection | null>;
-    remove(): Promise<void>;
+    /** Forget the expected credential after a remote revoke or refusal. A
+     * concurrent login may have saved another connection during that request. */
+    remove(expectedKey?: string): Promise<void>;
     /** A browser approval that was started and not yet answered, so a command
      * that was stopped while it waited picks up the same link and code rather
      * than asking the person to approve a new one. Unreadable or stale ones