You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@maka.apache.org by wy...@apache.org on 2026/09/03 11:16:36 UTC
(maka) branch refactor/runtime-host-operator-command updated (fa31401cd4 -> 4a81e0a56a)
This is an automated email from the ASF dual-hosted git repository.
M4n5ter pushed a change to branch refactor/runtime-host-operator-command
in repository https://gitbox.apache.org/repos/asf/maka.git
discard fa31401cd4 refactor(runtime-host): make operator control platform-neutral
new 4a81e0a56a refactor(runtime-host): make operator control platform-neutral
This update added new revisions after undoing existing revisions.
That is to say, some revisions that were in the old version of the
branch are not in the new version. This situation occurs
when a user --force pushes a change and generates a repository
containing something like this:
* -- * -- B -- O -- O -- O (fa31401cd4)
\
N -- N -- N refs/heads/refactor/runtime-host-operator-command (4a81e0a56a)
You should already have received notification emails for all of the O
revisions, and so the following emails describe only the N revisions
from the common base, B.
Any revisions marked "omit" are not gone; other references still
refer to them. Any revisions marked "discard" are gone forever.
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
packages/cli/src/runtime-host-lifecycle-transaction.ts | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org
(maka) 01/01: refactor(runtime-host): make operator control platform-neutral
Posted by wy...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
M4n5ter pushed a commit to branch refactor/runtime-host-operator-command
in repository https://gitbox.apache.org/repos/asf/maka.git
commit 4a81e0a56ac8a2ce8d5ced3eaa559b36c1f5f8a4
Author: M4n5ter <m4...@gmail.com>
AuthorDate: Thu Sep 3 18:56:58 2026 +0800
refactor(runtime-host): make operator control platform-neutral
Generated-by: OpenAI Codex
---
.../__tests__/runtime-host-local-operator.test.ts | 12 +-
.../runtime-host-local-remote-access.test.ts | 160 +++++++------------
.../runtime-host-managed-services.test.ts | 56 ++-----
.../main/__tests__/runtime-host-management.test.ts | 55 ++++---
.../main/__tests__/runtime-host-onboarding.test.ts | 30 ++--
.../__tests__/runtime-host-profile-service.test.ts | 10 +-
.../__tests__/runtime-host-ssh-terminal.test.ts | 113 +++++++++++---
.../__tests__/runtime-host-wsl-controller.test.ts | 16 +-
apps/desktop/src/main/runtime-host-boot.ts | 4 +-
.../src/main/runtime-host-local-management.ts | 8 +-
.../src/main/runtime-host-local-operator.ts | 71 ++++-----
.../src/main/runtime-host-local-remote-access.ts | 169 ++++++--------------
.../src/main/runtime-host-managed-services.ts | 115 ++------------
apps/desktop/src/main/runtime-host-management.ts | 39 ++---
apps/desktop/src/main/runtime-host-onboarding.ts | 27 ++--
.../src/main/runtime-host-peer-mesh-management.ts | 8 +-
apps/desktop/src/main/runtime-host-ssh-terminal.ts | 172 +++++++++++----------
.../src/main/runtime-host-wsl-controller.ts | 22 ++-
.../src/__tests__/runtime-host-cli-context.test.ts | 4 +-
.../__tests__/runtime-host-profile-command.test.ts | 4 +-
.../__tests__/runtime-host-service-manager.test.ts | 9 +-
.../cli/src/__tests__/runtime-host-setup.test.ts | 41 +++--
.../src/__tests__/runtime-host-tui-context.test.ts | 7 +-
packages/cli/src/cli-core.ts | 2 +-
packages/cli/src/runtime-host-cli.ts | 28 ++--
.../cli/src/runtime-host-lifecycle-transaction.ts | 7 +-
.../cli/src/runtime-host-managed-deployment.ts | 148 +++++++++++-------
packages/cli/src/runtime-host-profile-command.ts | 5 +-
packages/cli/src/runtime-host-setup-command.ts | 17 +-
packages/cli/src/runtime-host-update-command.ts | 22 ++-
.../src/__tests__/host-profile.test.ts | 32 ++--
.../src/__tests__/ssh-operator-activation.test.ts | 15 +-
.../src/__tests__/wsl-environment.test.ts | 16 +-
packages/runtime-host/src/client/host-profile.ts | 65 ++++----
packages/runtime-host/src/client/index.ts | 1 +
.../src/client/ssh-operator-activation.ts | 72 +++++++--
.../runtime-host/src/client/wsl-environment.ts | 25 ++-
packages/runtime-host/src/operator/index.ts | 7 +
.../runtime-host/src/operator/operator-command.ts | 97 ++++++++++++
packages/runtime-host/src/operator/setup-frame.ts | 15 +-
40 files changed, 928 insertions(+), 798 deletions(-)
diff --git a/apps/desktop/src/main/__tests__/runtime-host-local-operator.test.ts b/apps/desktop/src/main/__tests__/runtime-host-local-operator.test.ts
index 89ef5a27bc..7663076a0e 100644
--- a/apps/desktop/src/main/__tests__/runtime-host-local-operator.test.ts
+++ b/apps/desktop/src/main/__tests__/runtime-host-local-operator.test.ts
@@ -35,6 +35,13 @@ import {
runtimeHostLocalSetupCommand,
} from '../runtime-host-local-operator.js';
+const OPERATOR = {
+ kind: 'node' as const,
+ platform: 'posix' as const,
+ nodePath: '/usr/bin/node',
+ modulePath: '/tmp/maka/operator.mjs',
+};
+
test('local setup installs one managed service for the Desktop root with Direct peer enabled', () => {
assert.deepEqual(
runtimeHostLocalSetupCommand({
@@ -90,7 +97,7 @@ test('local setup forwards the exact development archive evidence', async (t) =>
version: '0.2.0-development',
serviceId: 'b'.repeat(64),
deploymentId: '00000000-0000-4000-8000-000000000001',
- operatorPath: '/tmp/maka/operator',
+ operator: OPERATOR,
rootPath: '/tmp/maka/root',
rootId: 'a'.repeat(64),
endpoint: 'ws://127.0.0.1:7443/runtime-host',
@@ -308,7 +315,7 @@ test('local Peer Mesh join keeps invitations off argv and accepts bounded large
const invitation = JSON.stringify({ secret: 'one-time-mesh-secret' });
const result = await operator.runPeerMesh({
- operatorPath: '/tmp/maka/operator',
+ operator: OPERATOR,
action: 'join',
target: {
serviceId: 'b'.repeat(64),
@@ -320,6 +327,7 @@ test('local Peer Mesh join keeps invitations off argv and accepts bounded large
});
assert.deepEqual(args, [
+ OPERATOR.modulePath,
'mesh', 'join', '--framed',
'--expected-service-id', 'b'.repeat(64),
'--expected-root-path', '/tmp/maka/root',
diff --git a/apps/desktop/src/main/__tests__/runtime-host-local-remote-access.test.ts b/apps/desktop/src/main/__tests__/runtime-host-local-remote-access.test.ts
index 5f48a4c904..469f70a778 100644
--- a/apps/desktop/src/main/__tests__/runtime-host-local-remote-access.test.ts
+++ b/apps/desktop/src/main/__tests__/runtime-host-local-remote-access.test.ts
@@ -35,6 +35,13 @@ const RECOVERY_DEPLOYMENT_ID = '33333333-3333-4333-8333-333333333333';
import { createDesktopLocalRuntimeHostRemoteAccess } from '../runtime-host-local-remote-access.js';
import type { createDesktopRuntimeHostLocalOperator } from '../runtime-host-local-operator.js';
+const testOperator = (modulePath: string) => ({
+ kind: 'node' as const,
+ platform: 'posix' as const,
+ nodePath: '/usr/bin/node',
+ modulePath,
+});
+
test('enabling remote access hands the same root to one managed service before Desktop resumes', async (t) => {
const base = await mkdtemp(join(tmpdir(), 'maka-local-remote-access-'));
t.after(() => rm(base, { recursive: true, force: true }));
@@ -92,7 +99,7 @@ test('enabling remote access hands the same root to one managed service before D
});
return {
serviceId: 'a'.repeat(64),
- operatorPath: join(base, 'operator'),
+ operator: testOperator(join(base, 'operator.mjs')),
rootPath,
rootId: 'a'.repeat(64),
deploymentId,
@@ -398,11 +405,11 @@ test('replaces a conflicting supervised Host with the requested active-work poli
kind: 'active',
lifecycleMode: 'supervised',
target: {
- schemaVersion: 1,
+ schemaVersion: 2,
serviceId: rootId,
rootPath,
rootId,
- operatorPath: join(base, 'operator'),
+ operator: testOperator(join(base, 'operator.mjs')),
deploymentId: RECOVERY_DEPLOYMENT_ID,
},
}),
@@ -506,122 +513,69 @@ test('does not persist recoverable setup authority before Desktop ownership comm
assert.equal(setupCalls, 0);
});
-test('adopts committed managed authority for every pending receipt without replaying setup', async (t) => {
+test('adopts committed managed authority from a pending setup without replaying it', async (t) => {
const base = await mkdtemp(join(tmpdir(), 'maka-local-remote-access-prestart-'));
t.after(() => rm(base, { recursive: true, force: true }));
- for (const state of ['handoff', 'setupPending'] as const) {
- const clientDataRoot = join(base, state);
- const rootPath = join(clientDataRoot, 'workspaces', 'default');
- const rootId = 'a'.repeat(64);
- const deploymentId = '22222222-2222-4222-8222-222222222222';
- const operatorPath = join(base, 'installed', 'operator');
- await mkdir(rootPath, { recursive: true });
- await writeFile(
- join(clientDataRoot, 'runtime-host-local-service.json'),
- `${JSON.stringify({
- schemaVersion: 1,
- state,
- rootPath,
- rootId,
- coordinationRelays: [],
- allowInterruptActiveTasks: true,
- })}\n`,
- );
- const service = createDesktopLocalRuntimeHostRemoteAccess({
- ipcMain: { handle() {}, removeHandler() {} },
- clientDataRoot,
- rootPath,
- rootId,
- directPeerAvailable: false,
- manager: () => assert.fail('pre-start reconciliation must not require the Local manager'),
- resolveManagedDeploymentAuthority: async () => ({
- kind: 'active',
- lifecycleMode: 'supervised',
- target: {
- schemaVersion: 1,
- serviceId: rootId,
- operatorPath,
- rootPath,
- rootId,
- deploymentId,
- },
- }),
- resolveSetupPackage: async () =>
- assert.fail('committed authority must not resolve a package'),
- operator: {
- async runSetup() {
- assert.fail('committed authority must not replay setup');
- },
- async close() {},
- } as unknown as ReturnType<typeof createDesktopRuntimeHostLocalOperator>,
- });
- t.after(() => service.close());
-
- assert.equal(await service.recoverBeforeLocalHostStart(), true);
- assert.deepEqual(
- JSON.parse(await readFile(join(clientDataRoot, 'runtime-host-local-service.json'), 'utf8')),
- {
- schemaVersion: 1,
- state: 'managed',
- serviceId: rootId,
- operatorPath,
- rootPath,
- rootId,
- deploymentId,
- },
- );
- }
-});
-
-test('discards a legacy handoff that belongs to an externally managed Host', async (t) => {
- const base = await mkdtemp(join(tmpdir(), 'maka-local-remote-access-legacy-external-'));
- t.after(() => rm(base, { recursive: true, force: true }));
const clientDataRoot = join(base, 'client');
const rootPath = join(clientDataRoot, 'workspaces', 'default');
const rootId = 'a'.repeat(64);
- const lifecyclePath = join(clientDataRoot, 'runtime-host-local-service.json');
+ const deploymentId = '22222222-2222-4222-8222-222222222222';
+ const installedOperator = testOperator(join(base, 'installed', 'operator.mjs'));
await mkdir(rootPath, { recursive: true });
await writeFile(
- lifecyclePath,
+ join(clientDataRoot, 'runtime-host-local-service.json'),
`${JSON.stringify({
- schemaVersion: 1,
- state: 'handoff',
+ schemaVersion: 2,
+ state: 'setupPending',
rootPath,
rootId,
coordinationRelays: [],
- allowInterruptActiveTasks: false,
+ allowInterruptActiveTasks: true,
})}\n`,
);
- let setupCalls = 0;
const service = createDesktopLocalRuntimeHostRemoteAccess({
ipcMain: { handle() {}, removeHandler() {} },
clientDataRoot,
rootPath,
rootId,
- directPeerAvailable: true,
- manager: () =>
- ({
- async retireOwnedLocalHost() {
- return { kind: 'not_owned' as const };
- },
- }) as unknown as RuntimeHostDesktopManager,
- resolveManagedDeploymentAuthority: async () => undefined,
- resolveSetupPackage: async () => ({ kind: 'npm', specifier: 'maka-agent@0.2.0' }),
+ directPeerAvailable: false,
+ manager: () => assert.fail('pre-start reconciliation must not require the Local manager'),
+ resolveManagedDeploymentAuthority: async () => ({
+ kind: 'active',
+ lifecycleMode: 'supervised',
+ target: {
+ schemaVersion: 2,
+ serviceId: rootId,
+ operator: installedOperator,
+ rootPath,
+ rootId,
+ deploymentId,
+ },
+ }),
+ resolveSetupPackage: async () =>
+ assert.fail('committed authority must not resolve a package'),
operator: {
async runSetup() {
- setupCalls += 1;
- throw new Error('setup must not replace an externally managed Host');
+ assert.fail('committed authority must not replay setup');
},
async close() {},
} as unknown as ReturnType<typeof createDesktopRuntimeHostLocalOperator>,
});
t.after(() => service.close());
- assert.equal(await service.recoverBeforeLocalHostStart(), false);
- await service.recover();
-
- assert.equal(setupCalls, 0);
- await assert.rejects(readFile(lifecyclePath, 'utf8'), { code: 'ENOENT' });
+ assert.equal(await service.recoverBeforeLocalHostStart(), true);
+ assert.deepEqual(
+ JSON.parse(await readFile(join(clientDataRoot, 'runtime-host-local-service.json'), 'utf8')),
+ {
+ schemaVersion: 2,
+ state: 'managed',
+ serviceId: rootId,
+ operator: installedOperator,
+ rootPath,
+ rootId,
+ deploymentId,
+ },
+ );
});
test('interrupted Local Host setup converges to its exact managed service', async (t) => {
@@ -634,7 +588,7 @@ test('interrupted Local Host setup converges to its exact managed service', asyn
await writeFile(
join(clientDataRoot, 'runtime-host-local-service.json'),
`${JSON.stringify({
- schemaVersion: 1,
+ schemaVersion: 2,
state: 'setupPending',
rootPath,
rootId,
@@ -668,7 +622,7 @@ test('interrupted Local Host setup converges to its exact managed service', asyn
setupCalls += 1;
return {
serviceId: rootId,
- operatorPath: join(base, 'operator'),
+ operator: testOperator(join(base, 'operator.mjs')),
rootPath,
rootId,
deploymentId: '22222222-2222-4222-8222-222222222222',
@@ -708,10 +662,10 @@ test('startup replays the persisted peer intent instead of gating recovery on st
await writeFile(
join(clientDataRoot, 'runtime-host-local-service.json'),
`${JSON.stringify({
- schemaVersion: 1,
+ schemaVersion: 2,
state: 'peerChanging',
serviceId: 'b'.repeat(64),
- operatorPath: join(clientDataRoot, 'operator'),
+ operator: testOperator(join(clientDataRoot, 'operator.mjs')),
rootPath,
rootId,
deploymentId: RECOVERY_DEPLOYMENT_ID,
@@ -835,10 +789,10 @@ test('pre-start recovery cleans a committed uninstall before an ephemeral Host c
await writeFile(
join(clientDataRoot, 'runtime-host-local-service.json'),
`${JSON.stringify({
- schemaVersion: 1,
+ schemaVersion: 2,
state: 'uninstalling',
serviceId: 'b'.repeat(64),
- operatorPath: join(base, 'operator'),
+ operator: testOperator(join(base, 'operator.mjs')),
rootPath,
rootId,
deploymentId: RECOVERY_DEPLOYMENT_ID,
@@ -897,10 +851,10 @@ test('pre-start recovery settles a canonical uninstall transition through its ex
await writeFile(
join(clientDataRoot, 'runtime-host-local-service.json'),
`${JSON.stringify({
- schemaVersion: 1,
+ schemaVersion: 2,
state: 'uninstalling',
serviceId: 'b'.repeat(64),
- operatorPath: join(base, 'operator'),
+ operator: testOperator(join(base, 'operator.mjs')),
rootPath,
rootId,
deploymentId: RECOVERY_DEPLOYMENT_ID,
@@ -955,10 +909,10 @@ async function writeManagedLifecycle(
await writeFile(
join(clientDataRoot, 'runtime-host-local-service.json'),
`${JSON.stringify({
- schemaVersion: 1,
+ schemaVersion: 2,
state: 'managed',
serviceId: 'b'.repeat(64),
- operatorPath: join(clientDataRoot, 'operator'),
+ operator: testOperator(join(clientDataRoot, 'operator.mjs')),
rootPath,
rootId,
deploymentId: RECOVERY_DEPLOYMENT_ID,
diff --git a/apps/desktop/src/main/__tests__/runtime-host-managed-services.test.ts b/apps/desktop/src/main/__tests__/runtime-host-managed-services.test.ts
index e6f0045d0c..7eaa045604 100644
--- a/apps/desktop/src/main/__tests__/runtime-host-managed-services.test.ts
+++ b/apps/desktop/src/main/__tests__/runtime-host-managed-services.test.ts
@@ -18,7 +18,7 @@
*/
import assert from "node:assert/strict";
-import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { mkdtemp, readFile, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { afterEach, test } from "node:test";
@@ -28,10 +28,6 @@ import {
findDesktopRuntimeHostManagedServiceBinding,
isDesktopRuntimeHostManagedSshServiceBinding,
} from "../runtime-host-managed-services.js";
-import {
- createDesktopRuntimeHostProfileService,
- resolveDesktopRuntimeHostStartup,
-} from "../runtime-host-profile-service.js";
const roots: string[] = [];
const profile = {
@@ -49,12 +45,17 @@ const profile = {
const service = {
id: "b".repeat(64),
rootPath: "/srv/maka",
- operatorPath: "/home/operator/.local/share/maka/operator",
+};
+const operator = {
+ kind: "node" as const,
+ platform: "posix" as const,
+ nodePath: "/usr/bin/node",
+ modulePath: "/home/operator/.local/share/maka/operator.mjs",
};
const deploymentId = "11111111-1111-4111-8111-111111111111";
const deployedService = {
deployment: { id: service.id, rootPath: service.rootPath, deploymentId },
- control: { kind: "ssh_operator" as const, operatorPath: service.operatorPath },
+ control: { kind: "ssh_operator" as const, operator },
};
afterEach(async () => {
@@ -67,47 +68,10 @@ test("keeps Desktop service bindings outside the shared profile catalog", async
const root = await mkdtemp(join(tmpdir(), "maka-managed-host-services-"));
roots.push(root);
const catalog = createClientRuntimeHostProfileCatalog(root);
- const legacyPath = join(root, "runtime-host-managed-services.json");
- const legacyDocument = `${JSON.stringify({
- schemaVersion: 1,
- bindings: [{ profile, service, state: "uninstalling" }],
- })}\n`;
- await writeFile(
- legacyPath,
- legacyDocument,
- );
const managedServices = createDesktopRuntimeHostManagedServiceStore(root);
const concurrentStore = createDesktopRuntimeHostManagedServiceStore(root);
await catalog.create(profile, "secret");
- assert.equal((await managedServices.read()).bindings[0]?.deployment.id, service.id);
- await assert.rejects(readFile(legacyPath, "utf8"), {
- code: "ENOENT",
- });
- await writeFile(legacyPath, legacyDocument);
- await managedServices.read();
- await assert.rejects(readFile(legacyPath, "utf8"), { code: "ENOENT" });
-
- const profileService = createDesktopRuntimeHostProfileService({
- clientDataRoot: root,
- startup: await resolveDesktopRuntimeHostStartup(root, { catalog }),
- catalog,
- managedServices,
- states: () => [],
- enable: async () => undefined,
- disable: async () => undefined,
- setDefault: () => undefined,
- finalizePairing: async () => undefined,
- });
- const legacyUninstall = await profileService.resolveManagedService(profile.id);
- assert.ok(legacyUninstall);
- assert.equal(legacyUninstall.deployment.deploymentId, undefined);
- assert.equal(legacyUninstall.state, "uninstalling");
- assert.equal(
- (await profileService.markManagedServiceUninstalling(legacyUninstall)).state,
- "uninstalling",
- );
-
await Promise.all([
managedServices.save(profile, deployedService),
concurrentStore.save(
@@ -135,7 +99,7 @@ test("keeps Desktop service bindings outside the shared profile catalog", async
{
profile: { ...profile, transport: { ...profile.transport } },
deployment: { id: service.id, rootPath: service.rootPath, deploymentId },
- control: { kind: "ssh_operator", operatorPath: service.operatorPath },
+ control: { kind: "ssh_operator", operator },
state: "active",
},
);
@@ -199,7 +163,7 @@ test("persists a WSL deployment through its environment control route", async ()
kind: "environment" as const,
provider: { kind: "wsl" as const, distribution: "Ubuntu-24.04" },
rootId: "a".repeat(64),
- operatorPath: "/home/operator/.local/share/maka/operator",
+ operator,
};
await store.save(environment, {
deployment: {
diff --git a/apps/desktop/src/main/__tests__/runtime-host-management.test.ts b/apps/desktop/src/main/__tests__/runtime-host-management.test.ts
index 572dfe59da..6693087b33 100644
--- a/apps/desktop/src/main/__tests__/runtime-host-management.test.ts
+++ b/apps/desktop/src/main/__tests__/runtime-host-management.test.ts
@@ -43,6 +43,12 @@ import type {
import type { DesktopRuntimeHostWslManagementInput } from '../runtime-host-wsl-controller.js';
const DEPLOYMENT_ID = '11111111-1111-4111-8111-111111111111';
+const OPERATOR = {
+ kind: 'node' as const,
+ platform: 'posix' as const,
+ nodePath: '/usr/bin/node',
+ modulePath: '/home/operator/.local/share/maka/operator.mjs',
+};
test('cancels a live Runtime Host Mesh status query', async () => {
const handlers = new Map<string, (...args: unknown[]) => unknown>();
@@ -194,7 +200,7 @@ test('routes WSL status and directory configuration through the persisted operat
kind: 'environment' as const,
provider: { kind: 'wsl' as const, distribution: 'Ubuntu-24.04' },
rootId: 'a'.repeat(64),
- operatorPath: '/home/operator/.local/share/maka/operator',
+ operator: OPERATOR,
};
const binding = {
profile,
@@ -247,16 +253,16 @@ test('routes WSL status and directory configuration through the persisted operat
false,
);
- assert.deepEqual(calls.map(({ action, distribution, operatorPath, expectedTarget }) => ({
+ assert.deepEqual(calls.map(({ action, distribution, operator, expectedTarget }) => ({
action,
distribution,
- operatorPath,
+ operator,
expectedTarget,
})), [
{
action: 'status',
distribution: 'Ubuntu-24.04',
- operatorPath: profile.operatorPath,
+ operator: profile.operator,
expectedTarget: {
serviceId: 'a'.repeat(64),
rootPath: '/home/operator/.config/Maka/workspaces/default',
@@ -267,7 +273,7 @@ test('routes WSL status and directory configuration through the persisted operat
{
action: 'configure',
distribution: 'Ubuntu-24.04',
- operatorPath: profile.operatorPath,
+ operator: profile.operator,
expectedTarget: {
serviceId: 'a'.repeat(64),
rootPath: '/home/operator/.config/Maka/workspaces/default',
@@ -296,7 +302,7 @@ test('identifies, rotates, and revokes managed credentials without exposing secr
const service = {
id: 'b'.repeat(64),
rootPath: '/srv/maka',
- operatorPath: '/home/operator/.local/share/maka/operator',
+ operator: OPERATOR,
};
const principalId = 'desktop:original-installation';
const replacement = 'maka_rh_replacement-secret';
@@ -349,7 +355,7 @@ test('identifies, rotates, and revokes managed credentials without exposing secr
});
assert.deepEqual(expected.control, {
kind: 'ssh_operator',
- operatorPath: service.operatorPath,
+ operator: service.operator,
});
assert.equal(expected.credentialFingerprint, currentFingerprint);
assert.equal(credential, replacement);
@@ -515,7 +521,7 @@ test('manages only the service identity bound by Desktop onboarding', async () =
const managedService = {
id: 'b'.repeat(64),
rootPath: '/srv/maka',
- operatorPath: '/home/operator/.local/share/maka/operator',
+ operator: OPERATOR,
};
const management = createDesktopRuntimeHostManagement({
...unusedUpdateDependencies(),
@@ -592,11 +598,11 @@ test('manages only the service identity bound by Desktop onboarding', async () =
const managementInput = managementInputs.at(-1);
assert.deepEqual(managementInput && {
destination: managementInput.destination,
- operatorPath: managementInput.operatorPath,
+ operator: managementInput.operator,
expectedTarget: managementInput.expectedTarget,
}, {
destination: 'operator@example.com',
- operatorPath: managedService.operatorPath,
+ operator: managedService.operator,
expectedTarget: {
serviceId: managedService.id,
rootPath: managedService.rootPath,
@@ -632,7 +638,7 @@ test('manages only the service identity bound by Desktop onboarding', async () =
assert.deepEqual(cleanupInputs, [
{
destination: managedProfile.transport.destination,
- operatorPath: managedService.operatorPath,
+ operator: managedService.operator,
expectedTarget: {
serviceId: managedService.id,
rootPath: managedService.rootPath,
@@ -642,7 +648,7 @@ test('manages only the service identity bound by Desktop onboarding', async () =
},
{
destination: managedProfile.transport.destination,
- operatorPath: managedService.operatorPath,
+ operator: managedService.operator,
expectedTarget: {
serviceId: managedService.id,
rootPath: managedService.rootPath,
@@ -679,7 +685,7 @@ test('publishes update progress and waits for the managed profile to reconnect',
const service = {
id: 'b'.repeat(64),
rootPath: '/srv/maka',
- operatorPath: '/home/operator/.local/share/maka/operator',
+ operator: OPERATOR,
};
createDesktopRuntimeHostManagement({
ipcMain: {
@@ -726,7 +732,7 @@ test('publishes update progress and waits for the managed profile to reconnect',
runUpdateReconciliation: async () =>
assert.fail('update reconciliation is not expected'),
setupPackageMode: 'published',
- resolveSshDevelopmentPeerTarget: async () =>
+ resolveSshPeerTarget: async () =>
assert.fail('published update must not inspect the development target'),
resolveUpdatePackage: () => ({ kind: 'npm', specifier: 'maka-agent@1.3.0' }),
currentHostEpoch: () => 'host-before-update',
@@ -746,6 +752,7 @@ test('publishes update progress and waits for the managed profile to reconnect',
assert.deepEqual(updates, [{
destination: profile.transport.destination,
setupPackage: { kind: 'npm', specifier: 'maka-agent@1.3.0' },
+ operator: service.operator,
expectedTarget: {
serviceId: service.id,
rootPath: service.rootPath,
@@ -802,7 +809,7 @@ test('configures Project roots with CAS and reconnects only after a committed cu
const service = {
id: 'b'.repeat(64),
rootPath: '/srv/maka',
- operatorPath: '/home/operator/.local/share/maka/operator',
+ operator: OPERATOR,
};
const fingerprint = `sha256:${'c'.repeat(64)}`;
const inputs: DesktopRuntimeHostSshManagementInput[] = [];
@@ -914,7 +921,7 @@ test('manages one Host update policy and reconciles it through the bound operato
const service = {
id: 'b'.repeat(64),
rootPath: '/srv/maka',
- operatorPath: '/home/operator/.local/share/maka/operator',
+ operator: OPERATOR,
};
createDesktopRuntimeHostManagement({
...unusedUpdateDependencies(),
@@ -1031,7 +1038,7 @@ test('manages one Host update policy and reconciles it through the bound operato
);
assert.deepEqual(reconciliationInputs, [{
destination: profile.transport.destination,
- operatorPath: service.operatorPath,
+ operator: service.operator,
expectedTarget: {
serviceId: service.id,
rootPath: service.rootPath,
@@ -1060,7 +1067,7 @@ test('retries acknowledged deployment cleanup without repeating uninstall', asyn
const service = {
id: 'b'.repeat(64),
rootPath: '/srv/maka',
- operatorPath: '/home/operator/.local/share/maka/operator',
+ operator: OPERATOR,
};
const calls: DesktopRuntimeHostSshManagementInput[] = [];
let clearAttempts = 0;
@@ -1143,7 +1150,7 @@ test('rechecks uninstall intent before retrying the remote service', async () =>
{
id: 'b'.repeat(64),
rootPath: '/srv/maka',
- operatorPath: '/home/operator/.local/share/maka/operator',
+ operator: OPERATOR,
},
'uninstalling',
);
@@ -1201,7 +1208,7 @@ test('keeps the SSH profile while adding and removing its managed Direct peer',
const service = {
id: 'b'.repeat(64),
rootPath: '/srv/maka',
- operatorPath: '/home/operator/.local/share/maka/operator',
+ operator: OPERATOR,
};
let peerProfileExists = false;
const actions: string[] = [];
@@ -1415,7 +1422,7 @@ function managedSshBinding() {
{
id: 'b'.repeat(64),
rootPath: '/srv/maka',
- operatorPath: '/home/operator/.local/share/maka/operator',
+ operator: OPERATOR,
},
'active',
);
@@ -1423,13 +1430,13 @@ function managedSshBinding() {
function managedBinding<
Profile,
- Service extends { readonly id: string; readonly rootPath: string; readonly operatorPath: string },
+ Service extends { readonly id: string; readonly rootPath: string; readonly operator: typeof OPERATOR },
State extends 'active' | 'uninstalling' | 'cleanup_pending',
>(profile: Profile, service: Service, state: State) {
return {
profile,
deployment: { id: service.id, rootPath: service.rootPath, deploymentId: DEPLOYMENT_ID },
- control: { kind: 'ssh_operator' as const, operatorPath: service.operatorPath },
+ control: { kind: 'ssh_operator' as const, operator: service.operator },
state,
};
}
@@ -1491,7 +1498,7 @@ function unusedUpdateDependencies() {
assert.fail('direct peer management is not expected'),
directPeerClientAvailable: false,
setupPackageMode: 'published' as const,
- resolveSshDevelopmentPeerTarget: async (): Promise<never> =>
+ resolveSshPeerTarget: async (): Promise<never> =>
assert.fail('published update must not inspect the development target'),
resolveUpdatePackage: () => ({ kind: 'npm', specifier: 'maka-agent@1.2.3' } as const),
currentHostEpoch: () => undefined,
diff --git a/apps/desktop/src/main/__tests__/runtime-host-onboarding.test.ts b/apps/desktop/src/main/__tests__/runtime-host-onboarding.test.ts
index 8d2b3302c0..5142b52d02 100644
--- a/apps/desktop/src/main/__tests__/runtime-host-onboarding.test.ts
+++ b/apps/desktop/src/main/__tests__/runtime-host-onboarding.test.ts
@@ -27,6 +27,13 @@ import type {
} from '../runtime-host-managed-services.js';
import { createDesktopRuntimeHostOnboarding } from '../runtime-host-onboarding.js';
+const OPERATOR = {
+ kind: 'node' as const,
+ platform: 'posix' as const,
+ nodePath: '/usr/bin/node',
+ modulePath: '/home/operator/.local/share/maka/operator.mjs',
+};
+
test('persists a verified on-demand SSH profile without endpoint or credential projection', async () => {
let setupInput: unknown;
let saved:
@@ -48,7 +55,7 @@ test('persists a verified on-demand SSH profile without endpoint or credential p
serviceId: 'b'.repeat(64),
deploymentId: '00000000-0000-4000-8000-000000000001',
rootPath: '/home/operator/.config/Maka/workspaces/default',
- operatorPath: '/home/operator/.local/share/maka/operator',
+ operator: OPERATOR,
rootId: 'a'.repeat(64),
endpoint: 'ws://127.0.0.1:7443/runtime-host',
credential: 'secret-access-token',
@@ -71,7 +78,7 @@ test('persists a verified on-demand SSH profile without endpoint or credential p
destination: 'operator@example.com',
activation: {
kind: 'ssh_operator',
- operatorPath: '/home/operator/.local/share/maka/operator',
+ operator: OPERATOR,
},
});
assert.deepEqual(saved?.managedService, {
@@ -82,7 +89,7 @@ test('persists a verified on-demand SSH profile without endpoint or credential p
},
control: {
kind: 'ssh_operator',
- operatorPath: '/home/operator/.local/share/maka/operator',
+ operator: OPERATOR,
},
});
assert.equal(saved?.credential, 'secret-access-token');
@@ -120,7 +127,7 @@ test('onboards WSL as a credential-free environment profile', async () => {
deploymentId: '00000000-0000-4000-8000-000000000001',
rootPath: '/home/operator/.config/Maka/workspaces/default',
rootId: 'a'.repeat(64),
- operatorPath: '/home/operator/.local/share/maka/operator',
+ operator: OPERATOR,
};
},
resolveSetupPackage: (peerTarget) => {
@@ -141,7 +148,7 @@ test('onboards WSL as a credential-free environment profile', async () => {
kind: 'environment',
provider: { kind: 'wsl', distribution: 'Ubuntu-24.04' },
rootId: 'a'.repeat(64),
- operatorPath: '/home/operator/.local/share/maka/operator',
+ operator: OPERATOR,
});
assert.deepEqual(saved?.managedService, {
deployment: {
@@ -222,7 +229,7 @@ test('finishes Host pairing after the cancellable SSH phase has completed', asyn
serviceId: string;
deploymentId: string;
rootPath: string;
- operatorPath: string;
+ operator: typeof OPERATOR;
rootId: string;
endpoint: string;
credential: string;
@@ -231,7 +238,7 @@ test('finishes Host pairing after the cancellable SSH phase has completed', asyn
serviceId: string;
deploymentId: string;
rootPath: string;
- operatorPath: string;
+ operator: typeof OPERATOR;
rootId: string;
endpoint: string;
credential: string;
@@ -263,7 +270,7 @@ test('finishes Host pairing after the cancellable SSH phase has completed', asyn
serviceId: 'b'.repeat(64),
deploymentId: '00000000-0000-4000-8000-000000000001',
rootPath: '/home/operator/.config/Maka/workspaces/default',
- operatorPath: '/home/operator/.local/share/maka/operator',
+ operator: OPERATOR,
rootId: 'a'.repeat(64),
endpoint: 'ws://127.0.0.1:7443/runtime-host',
credential: 'candidate-token',
@@ -271,7 +278,7 @@ test('finishes Host pairing after the cancellable SSH phase has completed', asyn
while (!pairingStarted) await Promise.resolve();
finishPairing({ profileId: 'office' });
- assert.deepEqual(await setup, { kind: 'complete', profileId: 'office', revision: 4 });
+ assert.deepEqual(await setup, { kind: 'complete', profileId: 'office', revision: 6 });
await harness.onboarding.close();
});
@@ -297,7 +304,7 @@ test('resolves the setup package only when onboarding starts', async () => {
{
kind: 'failed',
message: 'Desktop does not declare an exact Runtime Host setup package',
- revision: 2,
+ revision: 4,
},
);
assert.equal(resolutions, 1);
@@ -321,8 +328,7 @@ function createHarness(overrides: HarnessOverrides = {}) {
...profiles,
},
setupPackageMode: 'published',
- resolveSshDevelopmentPeerTarget: async () =>
- assert.fail('published setup must not inspect the development target'),
+ resolveSshPeerTarget: async () => 'linux-x64',
resolveSetupPackage: () => ({ kind: 'npm', specifier: 'maka-agent@0.2.0' }),
runSetup: async () => assert.fail('SSH must not start'),
runWslSetup: async () => assert.fail('WSL must not start'),
diff --git a/apps/desktop/src/main/__tests__/runtime-host-profile-service.test.ts b/apps/desktop/src/main/__tests__/runtime-host-profile-service.test.ts
index cd71890006..83cd71a2f4 100644
--- a/apps/desktop/src/main/__tests__/runtime-host-profile-service.test.ts
+++ b/apps/desktop/src/main/__tests__/runtime-host-profile-service.test.ts
@@ -56,6 +56,12 @@ import {
} from "../runtime-host-profile-service.js";
const ROOT_ID = "a".repeat(64);
+const OPERATOR = {
+ kind: "node" as const,
+ platform: "posix" as const,
+ nodePath: "/usr/bin/node",
+ modulePath: "/home/operator/.local/share/Maka/runtime-host-services/operator.mjs",
+};
const PROFILE = {
id: "office",
name: "Office",
@@ -81,7 +87,7 @@ const MANAGED_SERVICE = {
},
control: {
kind: "ssh_operator" as const,
- operatorPath: "/home/operator/.local/share/maka/operator",
+ operator: OPERATOR,
},
};
const READY_PROFILE = {
@@ -289,7 +295,7 @@ test("reuses the existing WSL profile when the same managed Host is added again"
kind: "environment" as const,
provider: { kind: "wsl" as const, distribution: "Ubuntu-24.04" },
rootId: ROOT_ID,
- operatorPath: "/home/operator/.local/share/Maka/runtime-host-services/operator",
+ operator: OPERATOR,
};
await catalog.create(existing);
const enabled: string[] = [];
diff --git a/apps/desktop/src/main/__tests__/runtime-host-ssh-terminal.test.ts b/apps/desktop/src/main/__tests__/runtime-host-ssh-terminal.test.ts
index 7e9c87fc06..d82d53af08 100644
--- a/apps/desktop/src/main/__tests__/runtime-host-ssh-terminal.test.ts
+++ b/apps/desktop/src/main/__tests__/runtime-host-ssh-terminal.test.ts
@@ -38,30 +38,45 @@ import {
} from '@maka/runtime-host/operator';
import {
createDesktopRuntimeHostSshTerminal,
- runtimeHostDevelopmentPeerTargetFromUname,
+ runtimeHostPeerTargetFromNode,
} from '../runtime-host-ssh-terminal.js';
import { waitFor as pollFor } from '@maka/core/test-only/async-primitives';
-test('maps supported SSH uname identities to development peer targets', () => {
- assert.equal(runtimeHostDevelopmentPeerTargetFromUname('Linux', 'x86_64'), 'linux-x64');
- assert.equal(runtimeHostDevelopmentPeerTargetFromUname('Linux', 'aarch64'), 'linux-arm64');
- assert.equal(runtimeHostDevelopmentPeerTargetFromUname('Darwin', 'arm64'), 'darwin-arm64');
+const OPERATOR = {
+ kind: 'node' as const,
+ platform: 'posix' as const,
+ nodePath: '/usr/bin/node',
+ modulePath: '/home/operator/.local/share/maka/operator.mjs',
+};
+
+const WINDOWS_OPERATOR = {
+ kind: 'node' as const,
+ platform: 'win32' as const,
+ nodePath: 'C:\\Program Files\\nodejs\\node.exe',
+ modulePath: 'C:\\Users\\operator\\AppData\\Local\\Maka\\operator.mjs',
+};
+
+test('maps supported SSH Node identities to peer targets', () => {
+ assert.equal(runtimeHostPeerTargetFromNode('linux', 'x64'), 'linux-x64');
+ assert.equal(runtimeHostPeerTargetFromNode('linux', 'arm64'), 'linux-arm64');
+ assert.equal(runtimeHostPeerTargetFromNode('darwin', 'arm64'), 'darwin-arm64');
+ assert.equal(runtimeHostPeerTargetFromNode('win32', 'x64'), 'win32-x64');
assert.throws(
- () => runtimeHostDevelopmentPeerTargetFromUname('Linux', 'riscv64'),
+ () => runtimeHostPeerTargetFromNode('linux', 'riscv64'),
/not available/u,
);
});
-test('detects the development peer target through the bounded SSH preflight', async () => {
+test('detects the peer target through the bounded SSH preflight', async () => {
const harness = createHarness('pending');
- const detection = harness.terminal.resolveDevelopmentPeerTarget({
+ const detection = harness.terminal.resolvePeerTarget({
destination: 'operator@example.com',
});
await waitFor(() => harness.pty.hasDataListener());
const command = harness.launchArgs[0]?.at(-1) ?? '';
const marker = command.match(/__MAKA_RUNTIME_HOST_TARGET_[0-9a-f]+__/u)?.[0];
assert.ok(marker);
- harness.pty.emitData(`${marker}Linux:x86_64\r\n`);
+ harness.pty.emitData(`${marker}linux:x64\r\n`);
harness.pty.exit(0);
assert.equal(await detection, 'linux-x64');
@@ -131,6 +146,7 @@ test('keeps setup credentials out of the interactive terminal projection', async
{
destination: 'operator@example.com',
setupPackage: { kind: 'npm', specifier: 'maka-agent@1.2.3+desktop.1' },
+ remotePlatform: 'posix',
principalId: 'desktop:stable-client',
signal: controller.signal,
},
@@ -153,7 +169,7 @@ test('keeps setup credentials out of the interactive terminal projection', async
version: '0.1.0-beta.1',
serviceId: 'b'.repeat(64),
deploymentId: '00000000-0000-4000-8000-000000000001',
- operatorPath: '/home/operator/.local/share/maka/operator',
+ operator: OPERATOR,
rootPath: '/home/operator/.config/Maka/workspaces/default',
rootId: 'a'.repeat(64),
endpoint: 'ws://127.0.0.1:7443/runtime-host',
@@ -179,12 +195,54 @@ test('keeps setup credentials out of the interactive terminal projection', async
await harness.terminal.close();
});
+test('runs Windows setup through one encoded PowerShell command', async () => {
+ const harness = createHarness('pending');
+ const setup = harness.terminal.runSetup(
+ {
+ destination: 'operator@example.com',
+ setupPackage: { kind: 'npm', specifier: 'maka-agent@1.2.3' },
+ remotePlatform: 'win32',
+ principalId: 'desktop:stable-client',
+ lifecycle: 'on_demand',
+ },
+ () => undefined,
+ );
+ await waitFor(() => harness.pty.hasDataListener());
+ const remoteCommand = harness.launchArgs.at(-1)?.at(-1) ?? '';
+ assert.match(remoteCommand, /^powershell\.exe .* -EncodedCommand [A-Za-z0-9+/=]+$/u);
+ assert.doesNotMatch(remoteCommand, /\/bin\/sh|maka-agent/u);
+ const encoded = remoteCommand.split(' ').at(-1);
+ assert.ok(encoded);
+ const script = Buffer.from(encoded, 'base64').toString('utf16le');
+ assert.match(script, /npx\.cmd/u);
+ assert.match(script, /Remove-Item/u);
+
+ harness.pty.emitData(encodeRuntimeHostSetupFrame({
+ schemaVersion: 1,
+ sequence: 0,
+ kind: 'complete',
+ version: '1.2.3',
+ serviceId: 'b'.repeat(64),
+ deploymentId: '00000000-0000-4000-8000-000000000001',
+ operator: WINDOWS_OPERATOR,
+ rootPath: 'C:\\Users\\operator\\AppData\\Local\\Maka\\workspaces\\default',
+ rootId: 'a'.repeat(64),
+ endpoint: 'ws://127.0.0.1:7443/runtime-host',
+ credentialId: 'credential-1',
+ credential: 'secret-access-token',
+ }));
+ harness.pty.exit(0);
+ assert.deepEqual((await setup).operator, WINDOWS_OPERATOR);
+ await harness.terminal.close();
+});
+
test('discards an oversized reserved setup line instead of projecting its tail', async () => {
const harness = createHarness('pending');
const setup = harness.terminal.runSetup(
{
destination: 'operator@example.com',
setupPackage: { kind: 'npm', specifier: 'maka-agent@1.2.3' },
+ remotePlatform: 'posix',
principalId: 'desktop:stable-client',
},
() => undefined,
@@ -209,6 +267,7 @@ test('keeps a completed setup process owned until it exits', async () => {
{
destination: 'operator@example.com',
setupPackage: { kind: 'npm', specifier: 'maka-agent@1.2.3' },
+ remotePlatform: 'posix',
principalId: 'desktop:stable-client',
},
() => undefined,
@@ -221,7 +280,7 @@ test('keeps a completed setup process owned until it exits', async () => {
version: '1.2.3',
serviceId: 'b'.repeat(64),
deploymentId: '00000000-0000-4000-8000-000000000001',
- operatorPath: '/home/operator/.local/share/maka/operator',
+ operator: OPERATOR,
rootPath: '/home/operator/.config/Maka/workspaces/default',
rootId: 'a'.repeat(64),
endpoint: 'ws://127.0.0.1:7443/runtime-host',
@@ -244,6 +303,7 @@ test('force-stops a cancelled setup when SSH ignores graceful termination', asyn
{
destination: 'operator@example.com',
setupPackage: { kind: 'npm', specifier: 'maka-agent@1.2.3' },
+ remotePlatform: 'posix',
principalId: 'desktop:stable-client',
signal: controller.signal,
},
@@ -272,6 +332,7 @@ test('does not signal a reused process identity when cancellation races SSH exit
{
destination: 'operator@example.com',
setupPackage: { kind: 'npm', specifier: 'maka-agent@1.2.3' },
+ remotePlatform: 'posix',
principalId: 'desktop:stable-client',
signal: controller.signal,
},
@@ -292,7 +353,7 @@ test('reads a framed service result without projecting it into the SSH terminal'
const harness = createHarness('pending');
const management = harness.terminal.runServiceManagement({
destination: 'operator@example.com',
- operatorPath: '/home/operator/.local/share/maka/operator',
+ operator: OPERATOR,
action: 'status',
capabilityRequest: RUNTIME_HOST_OPERATOR_PEER_MANAGEMENT_CAPABILITY,
expectedTarget: {
@@ -344,7 +405,7 @@ test('applies the complete remote Project root policy through the managed operat
const fingerprint = `sha256:${'c'.repeat(64)}`;
const management = harness.terminal.runServiceManagement({
destination: 'operator@example.com',
- operatorPath: '/home/operator/.local/share/maka/operator',
+ operator: OPERATOR,
action: 'configure',
expectedTarget: {
serviceId: 'b'.repeat(64),
@@ -370,7 +431,7 @@ test('applies the complete remote Project root policy through the managed operat
assert.match(remoteCommand, /--allow-interrupt-active-tasks/u);
assert.match(
remoteCommand,
- /MAKA_RUNTIME_HOST_OPERATOR_PROJECT_DIRECTORY_CONFIGURATION_REQUEST=1/u,
+ /MAKA_RUNTIME_HOST_OPERATOR_PROJECT_DIRECTORY_CONFIGURATION_REQUEST='1'/u,
);
harness.pty.emitData(
encodeRuntimeHostServiceManagementFrame({
@@ -413,7 +474,7 @@ test('keeps a received management result when SSH teardown times out', async ()
harness.pty.exitOnForceKill = true;
const management = harness.terminal.runServiceManagement({
destination: 'operator@example.com',
- operatorPath: '/home/operator/.local/share/maka/operator',
+ operator: OPERATOR,
action: 'status',
expectedTarget: {
serviceId: 'b'.repeat(64),
@@ -451,6 +512,7 @@ test('runs an exact update package and reports progress before an active-work re
{
destination: 'operator@example.com',
setupPackage: { kind: 'npm', specifier: 'maka-agent@1.3.0' },
+ operator: OPERATOR,
expectedTarget: {
serviceId: 'b'.repeat(64),
rootPath: '/srv/maka',
@@ -521,7 +583,7 @@ test('uses the managed operator for update policy and one-shot reconciliation',
const policyHarness = createHarness('pending');
const policy = policyHarness.terminal.runUpdatePolicy({
destination: 'operator@example.com',
- operatorPath: '/home/operator/.local/share/maka/operator',
+ operator: OPERATOR,
policy: { kind: 'channel', channel: 'latest' },
expectedTarget: target,
});
@@ -549,7 +611,7 @@ test('uses the managed operator for update policy and one-shot reconciliation',
const reconciliation = reconcileHarness.terminal.runUpdateReconciliation(
{
destination: 'operator@example.com',
- operatorPath: '/home/operator/.local/share/maka/operator',
+ operator: OPERATOR,
expectedTarget: target,
},
(phase) => phases.push(phase),
@@ -599,7 +661,7 @@ test('keeps a prepared access credential out of the SSH terminal projection', as
const credential = 'maka_rh_secret-replacement';
const management = harness.terminal.runAccessManagement({
destination: 'operator@example.com',
- operatorPath: '/home/operator/.local/share/maka/operator',
+ operator: OPERATOR,
rootPath: '/srv/maka',
expectedRootId: 'a'.repeat(64),
action: 'prepare',
@@ -646,7 +708,7 @@ test('creates an owner connection code through the framed SSH operator channel',
const connectionCode = 'maka-runtime-host:connect:v1:secret-code';
const management = harness.terminal.runAccessManagement({
destination: 'operator@example.com',
- operatorPath: '/home/operator/.local/share/maka/operator',
+ operator: OPERATOR,
rootPath: '/srv/maka',
expectedRootId: 'a'.repeat(64),
action: 'connection-code',
@@ -680,7 +742,7 @@ test('requests adaptive-connectivity status only on the peer-management frame',
const harness = createHarness('pending');
const management = harness.terminal.runPeerManagement({
destination: 'operator@example.com',
- operatorPath: '/home/operator/.local/share/maka/operator',
+ operator: OPERATOR,
action: 'status',
webRtcStunStatus: true,
expectedTarget: {
@@ -729,7 +791,7 @@ test('sends a Mesh invitation only after the authenticated remote operator reque
const invitation = JSON.stringify({ secret: 'one-time-mesh-secret' });
const management = harness.terminal.runPeerMeshManagement({
destination: 'operator@example.com',
- operatorPath: '/home/operator/.local/share/maka/operator',
+ operator: OPERATOR,
action: 'join',
invitation,
expectedTarget: {
@@ -795,7 +857,7 @@ test('rejects a framed service result for a different action', async () => {
const harness = createHarness('pending');
const management = harness.terminal.runServiceManagement({
destination: 'operator@example.com',
- operatorPath: '/home/operator/.local/share/maka/operator',
+ operator: OPERATOR,
action: 'uninstall',
expectedTarget: {
serviceId: 'b'.repeat(64),
@@ -831,7 +893,7 @@ test('requires an absent operator deployment root to be absent', async () => {
const harness = createHarness('pending');
const cleanup = harness.terminal.cleanupManagedDeployment({
destination: 'operator@example.com',
- operatorPath: '/home/operator/.local/share/maka/operator',
+ operator: OPERATOR,
expectedTarget: {
serviceId: 'b'.repeat(64),
rootPath: '/srv/maka',
@@ -867,7 +929,7 @@ test('does not launch a management process after the terminal owner closes', asy
await assert.rejects(
terminal.runServiceManagement({
destination: 'operator@example.com',
- operatorPath: '/home/operator/.local/share/maka/operator',
+ operator: OPERATOR,
action: 'status',
expectedTarget: {
serviceId: 'b'.repeat(64),
@@ -885,7 +947,7 @@ test('runs interactive operator activation as one strict framed SSH command', as
const rootId = 'a'.repeat(64);
const activation = harness.terminal.activateSshOperator({
destination: 'operator@example.com',
- operatorPath: '/home/operator/.local/share/maka/operator',
+ operator: OPERATOR,
rootId,
interaction: 'terminal',
});
@@ -942,6 +1004,7 @@ test('uploads a development release archive before running the same remote setup
path: archive,
integrity,
} as const,
+ remotePlatform: 'posix' as const,
principalId: 'desktop:stable-client',
};
const setup = terminal.runSetup(setupInput, () => undefined);
diff --git a/apps/desktop/src/main/__tests__/runtime-host-wsl-controller.test.ts b/apps/desktop/src/main/__tests__/runtime-host-wsl-controller.test.ts
index 71023c8549..f2ed128d4a 100644
--- a/apps/desktop/src/main/__tests__/runtime-host-wsl-controller.test.ts
+++ b/apps/desktop/src/main/__tests__/runtime-host-wsl-controller.test.ts
@@ -35,6 +35,13 @@ import {
runDesktopRuntimeHostWslSetup,
} from '../runtime-host-wsl-controller.js';
+const OPERATOR = {
+ kind: 'node' as const,
+ platform: 'posix' as const,
+ nodePath: '/usr/bin/node',
+ modulePath: '/home/operator/.local/share/maka/operator.mjs',
+};
+
test('WSL management invokes the stable operator directly with the exact deployment target', async () => {
let launch:
| { readonly executable: string; readonly args: readonly string[]; readonly environment: NodeJS.ProcessEnv }
@@ -58,7 +65,7 @@ test('WSL management invokes the stable operator directly with the exact deploym
});
const result = await runDesktopRuntimeHostWslManagement({
distribution: 'Ubuntu',
- operatorPath: '/home/operator/.local/share/maka/operator',
+ operator: OPERATOR,
action: 'configure',
expectedTarget: {
serviceId: 'a'.repeat(64),
@@ -90,11 +97,12 @@ test('WSL management invokes the stable operator directly with the exact deploym
});
assert.equal(launch?.executable, 'wsl.exe');
- assert.deepEqual(launch?.args.slice(0, 5), [
+ assert.deepEqual(launch?.args.slice(0, 6), [
'--distribution',
'Ubuntu',
'--exec',
- '/home/operator/.local/share/maka/operator',
+ '/usr/bin/node',
+ '/home/operator/.local/share/maka/operator.mjs',
'configure',
]);
assert.ok(launch?.args.includes('--expected-deployment-id'));
@@ -136,7 +144,7 @@ test('WSL setup forwards the development archive and its exact evidence', async
version: '0.2.0-development',
serviceId: 'b'.repeat(64),
deploymentId: '00000000-0000-4000-8000-000000000001',
- operatorPath: '/tmp/maka/operator',
+ operator: { ...OPERATOR, modulePath: '/tmp/maka/operator.mjs' },
rootPath: '/tmp/maka/root',
rootId: 'a'.repeat(64),
endpoint: 'ws://127.0.0.1:7443/runtime-host',
diff --git a/apps/desktop/src/main/runtime-host-boot.ts b/apps/desktop/src/main/runtime-host-boot.ts
index 74e68af3ee..9476039aa3 100644
--- a/apps/desktop/src/main/runtime-host-boot.ts
+++ b/apps/desktop/src/main/runtime-host-boot.ts
@@ -634,7 +634,7 @@ const runtimeHostOnboarding = createDesktopRuntimeHostOnboarding({
runWslSetup: runDesktopRuntimeHostWslSetup,
listWslDistributions: listRuntimeHostWslDistributions,
setupPackageMode: runtimeHostSetupPackage.mode,
- resolveSshDevelopmentPeerTarget: runtimeHostSshTerminal.resolveDevelopmentPeerTarget,
+ resolveSshPeerTarget: runtimeHostSshTerminal.resolvePeerTarget,
resolveSetupPackage: runtimeHostSetupPackage.resolve,
send: (snapshot) =>
mainWindowController.send("runtime-host-onboarding:changed", snapshot),
@@ -666,7 +666,7 @@ const runtimeHostManagement = createDesktopRuntimeHostManagement({
runUpdatePolicy: runtimeHostSshTerminal.runUpdatePolicy,
runUpdateReconciliation: runtimeHostSshTerminal.runUpdateReconciliation,
setupPackageMode: runtimeHostSetupPackage.mode,
- resolveSshDevelopmentPeerTarget: runtimeHostSshTerminal.resolveDevelopmentPeerTarget,
+ resolveSshPeerTarget: runtimeHostSshTerminal.resolvePeerTarget,
resolveUpdatePackage: runtimeHostSetupPackage.resolve,
currentHostEpoch: (profileId) =>
runtimeHostManager?.current(profileId)?.candidate?.client.hostEpoch,
diff --git a/apps/desktop/src/main/runtime-host-local-management.ts b/apps/desktop/src/main/runtime-host-local-management.ts
index 933f7bd6e8..c6a1f90090 100644
--- a/apps/desktop/src/main/runtime-host-local-management.ts
+++ b/apps/desktop/src/main/runtime-host-local-management.ts
@@ -48,7 +48,7 @@ export function createDesktopRuntimeHostLocalManagement(input: {
run: (action, allowInterruptActiveTasks) => {
const execute = (target: DesktopRuntimeHostLocalManagementTarget) =>
input.operator.runService({
- operatorPath: target.operatorPath,
+ operator: target.operator,
action,
target,
...(allowInterruptActiveTasks ? { allowInterruptActiveTasks: true } : {}),
@@ -83,7 +83,7 @@ export function createDesktopRuntimeHostLocalManagement(input: {
input.remoteAccess.changeManaged(
(target) =>
input.operator.runService({
- operatorPath: target.operatorPath,
+ operator: target.operator,
action: 'configure',
target,
projectDirectoryRoots: roots,
@@ -94,14 +94,14 @@ export function createDesktopRuntimeHostLocalManagement(input: {
updatePolicy: (policy) =>
input.remoteAccess.inspectManaged((target) =>
input.operator.runUpdatePolicy({
- operatorPath: target.operatorPath,
+ operator: target.operator,
target,
...(policy ? { policy } : {}),
}).then((frame) => requireLocalFrame(frame, 'update_policy'))),
reconcileUpdate: (onProgress) =>
input.remoteAccess.changeManaged((target) =>
input.operator.runUpdateReconciliation(
- { operatorPath: target.operatorPath, target },
+ { operator: target.operator, target },
onProgress,
).then((frame) => requireLocalFrame(frame, 'reconcile_update'))),
currentHostEpoch: input.currentHostEpoch,
diff --git a/apps/desktop/src/main/runtime-host-local-operator.ts b/apps/desktop/src/main/runtime-host-local-operator.ts
index 6e0613ab60..bc6b9e010e 100644
--- a/apps/desktop/src/main/runtime-host-local-operator.ts
+++ b/apps/desktop/src/main/runtime-host-local-operator.ts
@@ -42,6 +42,7 @@ import {
RUNTIME_HOST_SERVICE_MANAGEMENT_FRAME_PREFIX,
RUNTIME_HOST_SETUP_FRAME_PREFIX,
RUNTIME_HOST_SETUP_SOURCE_PACKAGE_INTEGRITY_ENV,
+ runtimeHostOperatorInvocation,
type RuntimeHostAccessManagementFrame,
type RuntimeHostManagedUpdatePolicy,
type RuntimeHostPeerManagementFrame,
@@ -50,6 +51,7 @@ import {
type RuntimeHostServiceManagementFrame,
type RuntimeHostServiceUpdatePhase,
type RuntimeHostSetupFrame,
+ type RuntimeHostOperatorCommand,
} from '@maka/runtime-host/operator';
import { createRuntimeHostFramedOutputFilter } from './runtime-host-framed-output.js';
import {
@@ -87,7 +89,7 @@ export interface DesktopRuntimeHostLocalSetupCommand {
}
export interface DesktopRuntimeHostLocalServiceManagementInput {
- readonly operatorPath: string;
+ readonly operator: RuntimeHostOperatorCommand;
readonly action:
| 'status'
| 'start'
@@ -168,7 +170,7 @@ export function createDesktopRuntimeHostLocalOperator(input: {
onProgress: (frame: Extract<RuntimeHostSetupFrame, { kind: 'progress' }>) => void,
): Promise<RuntimeHostSetupCompleteFrame>;
runPeer(input: {
- readonly operatorPath: string;
+ readonly operator: RuntimeHostOperatorCommand;
readonly action: 'enable' | 'disable' | 'status';
readonly target: DesktopRuntimeHostLocalServiceTarget;
readonly coordinationRelays?: readonly string[];
@@ -176,7 +178,7 @@ export function createDesktopRuntimeHostLocalOperator(input: {
readonly signal?: AbortSignal;
}): Promise<RuntimeHostPeerManagementFrame>;
runPeerMesh(input: {
- readonly operatorPath: string;
+ readonly operator: RuntimeHostOperatorCommand;
readonly action: RuntimeHostPeerMeshManagementAction;
readonly target: DesktopRuntimeHostLocalServiceTarget;
readonly meshId?: string | null;
@@ -186,7 +188,7 @@ export function createDesktopRuntimeHostLocalOperator(input: {
readonly signal?: AbortSignal;
}): Promise<Exclude<RuntimeHostPeerMeshManagementFrame, { kind: 'input' }>>;
runAccess(input: {
- readonly operatorPath: string;
+ readonly operator: RuntimeHostOperatorCommand;
readonly target: DesktopRuntimeHostLocalServiceTarget;
readonly signal?: AbortSignal;
}): Promise<RuntimeHostAccessManagementFrame>;
@@ -205,21 +207,21 @@ export function createDesktopRuntimeHostLocalOperator(input: {
onProgress: (phase: RuntimeHostServiceUpdatePhase) => void,
): Promise<RuntimeHostServiceManagementFrame>;
runUpdatePolicy(input: {
- readonly operatorPath: string;
+ readonly operator: RuntimeHostOperatorCommand;
readonly target: DesktopRuntimeHostLocalServiceTarget;
readonly policy?: RuntimeHostManagedUpdatePolicy;
readonly signal?: AbortSignal;
}): Promise<RuntimeHostServiceManagementFrame>;
runUpdateReconciliation(
input: {
- readonly operatorPath: string;
+ readonly operator: RuntimeHostOperatorCommand;
readonly target: DesktopRuntimeHostLocalServiceTarget;
readonly signal?: AbortSignal;
},
onProgress: (phase: RuntimeHostServiceUpdatePhase) => void,
): Promise<RuntimeHostServiceManagementFrame>;
cleanupManagedDeployment(input: {
- readonly operatorPath: string;
+ readonly operator: RuntimeHostOperatorCommand;
readonly target: DesktopRuntimeHostLocalServiceTarget;
readonly finalize?: boolean;
readonly signal?: AbortSignal;
@@ -271,9 +273,7 @@ export function createDesktopRuntimeHostLocalOperator(input: {
runPeer(command) {
if (closed) throw new Error('Local Runtime Host operator is closed');
return runSingleFrameProcess({
- command: {
- executable: command.operatorPath,
- args: [
+ command: runtimeHostOperatorInvocation(command.operator, [
'peer',
command.action,
'--framed',
@@ -287,8 +287,7 @@ export function createDesktopRuntimeHostLocalOperator(input: {
: []),
...(command.allowInterruptActiveTasks ? ['--allow-interrupt-active-tasks'] : []),
...managedTargetArgs(command.target),
- ],
- },
+ ]),
prefix: RUNTIME_HOST_PEER_MANAGEMENT_FRAME_PREFIX,
decode: decodeRuntimeHostPeerManagementFrame,
label: 'Local Runtime Host peer management',
@@ -303,9 +302,7 @@ export function createDesktopRuntimeHostLocalOperator(input: {
runPeerMesh(command) {
if (closed) throw new Error('Local Runtime Host operator is closed');
return runPeerMeshFrameProcess({
- command: {
- executable: command.operatorPath,
- args: [
+ command: runtimeHostOperatorInvocation(command.operator, [
'mesh',
command.action,
'--framed',
@@ -321,8 +318,7 @@ export function createDesktopRuntimeHostLocalOperator(input: {
? ['--name', command.displayName]
: []),
...managedTargetArgs(command.target),
- ],
- },
+ ]),
environment: input.environment ?? process.env,
spawnProcess: input.spawnProcess ?? spawn,
timeoutMs: input.setupTimeoutMs ?? SETUP_TIMEOUT_MS,
@@ -336,9 +332,7 @@ export function createDesktopRuntimeHostLocalOperator(input: {
runAccess(command) {
if (closed) throw new Error('Local Runtime Host operator is closed');
return runSingleFrameProcess({
- command: {
- executable: command.operatorPath,
- args: [
+ command: runtimeHostOperatorInvocation(command.operator, [
'access',
'list',
'--framed',
@@ -346,8 +340,7 @@ export function createDesktopRuntimeHostLocalOperator(input: {
command.target.rootPath,
'--expected-root',
command.target.rootId,
- ],
- },
+ ]),
prefix: RUNTIME_HOST_ACCESS_MANAGEMENT_FRAME_PREFIX,
decode: decodeRuntimeHostAccessManagementFrame,
label: 'Local Runtime Host access management',
@@ -362,9 +355,7 @@ export function createDesktopRuntimeHostLocalOperator(input: {
runService(command) {
if (closed) throw new Error('Local Runtime Host operator is closed');
return runSingleFrameProcess({
- command: {
- executable: command.operatorPath,
- args: [
+ command: runtimeHostOperatorInvocation(command.operator, [
command.action,
'--framed',
...(command.projectDirectoryRoots === undefined
@@ -381,8 +372,7 @@ export function createDesktopRuntimeHostLocalOperator(input: {
...(command.allowInterruptActiveTasks ? ['--allow-interrupt-active-tasks'] : []),
...(command.retainManagedDeployment ? ['--retain-managed-deployment'] : []),
...managedTargetArgs(command.target),
- ],
- },
+ ]),
prefix: RUNTIME_HOST_SERVICE_MANAGEMENT_FRAME_PREFIX,
decode: decodeRuntimeHostServiceManagementFrame,
label: 'Local Runtime Host service management',
@@ -449,9 +439,7 @@ export function createDesktopRuntimeHostLocalOperator(input: {
if (closed) throw new Error('Local Runtime Host operator is closed');
const policy = command.policy;
return runServiceFrameProcess({
- command: {
- executable: command.operatorPath,
- args: [
+ command: runtimeHostOperatorInvocation(command.operator, [
'update-policy',
'--framed',
...(policy
@@ -465,8 +453,7 @@ export function createDesktopRuntimeHostLocalOperator(input: {
]
: []),
...managedTargetArgs(command.target),
- ],
- },
+ ]),
environment: {
...(input.environment ?? process.env),
[RUNTIME_HOST_OPERATOR_CAPABILITY_REQUEST_ENV]:
@@ -483,10 +470,11 @@ export function createDesktopRuntimeHostLocalOperator(input: {
runUpdateReconciliation(command, onProgress) {
if (closed) throw new Error('Local Runtime Host operator is closed');
return runServiceFrameProcess({
- command: {
- executable: command.operatorPath,
- args: ['reconcile-update', '--framed', ...managedTargetArgs(command.target)],
- },
+ command: runtimeHostOperatorInvocation(command.operator, [
+ 'reconcile-update',
+ '--framed',
+ ...managedTargetArgs(command.target),
+ ]),
environment: {
...(input.environment ?? process.env),
[RUNTIME_HOST_OPERATOR_PROJECT_DIRECTORY_CONFIGURATION_REQUEST_ENV]: '1',
@@ -505,25 +493,22 @@ export function createDesktopRuntimeHostLocalOperator(input: {
async cleanupManagedDeployment(command) {
if (closed) throw new Error('Local Runtime Host operator is closed');
try {
- await stat(command.operatorPath);
+ await stat(command.operator.modulePath);
} catch (error) {
if (!isNodeError(error, 'ENOENT')) throw error;
try {
- await rmdir(dirname(command.operatorPath));
+ await rmdir(dirname(command.operator.modulePath));
} catch (directoryError) {
if (!isNodeError(directoryError, 'ENOENT')) throw directoryError;
}
return;
}
await runExitProcess({
- command: {
- executable: command.operatorPath,
- args: [
+ command: runtimeHostOperatorInvocation(command.operator, [
'__cleanup-managed-deployment',
...(command.finalize ? ['--finalize'] : []),
...managedTargetArgs(command.target),
- ],
- },
+ ]),
label: 'Local Runtime Host deployment cleanup',
environment: input.environment ?? process.env,
spawnProcess: input.spawnProcess ?? spawn,
diff --git a/apps/desktop/src/main/runtime-host-local-remote-access.ts b/apps/desktop/src/main/runtime-host-local-remote-access.ts
index c0d8926795..7234fe30d9 100644
--- a/apps/desktop/src/main/runtime-host-local-remote-access.ts
+++ b/apps/desktop/src/main/runtime-host-local-remote-access.ts
@@ -20,13 +20,18 @@
import { randomUUID } from 'node:crypto';
import { open, readFile, rename, rm } from 'node:fs/promises';
import { hostname } from 'node:os';
-import { dirname, isAbsolute, join } from 'node:path';
+import { dirname, join } from 'node:path';
import type { IpcMain } from 'electron';
import {
encodeRuntimeHostOwnerConnectionCode,
issueRuntimeHostOwnerConnectionCode,
} from '@maka/runtime-host/client';
-import { resolveRuntimeHostManagedDeploymentAuthority } from '@maka/runtime-host/operator';
+import {
+ createRuntimeHostOperatorCommand,
+ decodeRuntimeHostOperatorCommand,
+ resolveRuntimeHostManagedDeploymentAuthority,
+ type RuntimeHostOperatorCommand,
+} from '@maka/runtime-host/operator';
import type { HostPeerEndpoint, HostRegistration } from '@maka/runtime-host/protocol';
import type {
DesktopLocalRuntimeHostRemoteAccessEnableResult,
@@ -53,13 +58,13 @@ const ADDRESS_MAX_COUNT = 16;
const LOCAL_REMOTE_ACCESS_PRINCIPAL_ID = 'desktop-owner:local-runtime-host-sharing';
interface LocalServiceTarget extends DesktopRuntimeHostLocalServiceTarget {
- readonly schemaVersion: 1;
- readonly operatorPath: string;
+ readonly schemaVersion: 2;
+ readonly operator: RuntimeHostOperatorCommand;
readonly deploymentId: string;
}
interface LocalServiceSetupPending {
- readonly schemaVersion: 1;
+ readonly schemaVersion: 2;
/** Persisted only after the Desktop-owned Host has retired. */
readonly state: 'setupPending';
readonly rootPath: string;
@@ -68,16 +73,6 @@ interface LocalServiceSetupPending {
readonly allowInterruptActiveTasks: boolean;
}
-/** Schema-v1 setup intent written by Desktop releases before ownership was established. */
-interface LocalServiceLegacyHandoff {
- readonly schemaVersion: 1;
- readonly state: 'handoff';
- readonly rootPath: string;
- readonly rootId: string;
- readonly coordinationRelays: readonly string[];
- readonly allowInterruptActiveTasks: boolean;
-}
-
interface LocalServiceManaged extends LocalServiceTarget {
readonly state: 'managed';
}
@@ -92,7 +87,7 @@ type LocalManagedDeploymentAuthority =
export interface DesktopRuntimeHostLocalManagementTarget
extends DesktopRuntimeHostLocalServiceTarget {
- readonly operatorPath: string;
+ readonly operator: RuntimeHostOperatorCommand;
readonly deploymentId: string;
}
@@ -146,7 +141,6 @@ interface LocalServiceUninstalling extends LocalServiceTarget {
}
type LocalServiceLifecycle =
- | LocalServiceLegacyHandoff
| LocalServiceSetupPending
| LocalServiceManaged
| LocalServicePeerChanging
@@ -201,9 +195,13 @@ export function createDesktopLocalRuntimeHostRemoteAccess(input: {
lifecycleMode: authority.record.lifecycle.mode,
target: requireServiceTarget(
{
- schemaVersion: 1,
+ schemaVersion: 2,
serviceId: authority.record.root.id,
- operatorPath: join(authority.record.deploymentRoot, 'operator'),
+ operator: createRuntimeHostOperatorCommand({
+ platform: process.platform === 'win32' ? 'win32' : 'posix',
+ nodePath: authority.record.launch.nodePath,
+ modulePath: join(authority.record.deploymentRoot, 'operator.mjs'),
+ }),
rootPath: authority.record.root.path,
rootId: authority.record.root.id,
deploymentId: authority.record.deploymentId,
@@ -244,7 +242,7 @@ export function createDesktopLocalRuntimeHostRemoteAccess(input: {
return {
state: 'unavailable',
message:
- lifecycle.state === 'setupPending' || lifecycle.state === 'handoff'
+ lifecycle.state === 'setupPending'
? 'Local Runtime Host setup is being recovered'
: lifecycle.state === 'peerChanging'
? 'Local Runtime Host remote access is being recovered'
@@ -285,14 +283,6 @@ export function createDesktopLocalRuntimeHostRemoteAccess(input: {
if (recovered.kind === 'active_tasks') return recovered;
lifecycle = managedLifecycle(lifecycle);
}
- if (lifecycle?.state === 'handoff') {
- const recovered = await recoverLegacyHandoff(lifecycle);
- if (recovered.kind === 'active_tasks') return recovered;
- if (recovered.kind === 'external') {
- throw new Error('The Local Runtime Host is already managed outside this Desktop');
- }
- lifecycle = recovered.managed;
- }
if (lifecycle?.state === 'setupPending') {
const committed = await adoptCommittedSetup(lifecycle);
if (committed.kind === 'managed') {
@@ -329,7 +319,7 @@ export function createDesktopLocalRuntimeHostRemoteAccess(input: {
}
const setup: LocalServiceSetupPending = {
- schemaVersion: 1,
+ schemaVersion: 2,
state: 'setupPending',
rootPath: input.rootPath,
rootId: input.rootId,
@@ -427,9 +417,9 @@ export function createDesktopLocalRuntimeHostRemoteAccess(input: {
}
target = requireServiceTarget(
{
- schemaVersion: 1,
+ schemaVersion: 2,
serviceId: complete.serviceId,
- operatorPath: complete.operatorPath,
+ operator: complete.operator,
rootPath: complete.rootPath,
rootId: complete.rootId,
deploymentId: complete.deploymentId,
@@ -455,51 +445,6 @@ export function createDesktopLocalRuntimeHostRemoteAccess(input: {
}
};
- const recoverLegacyHandoff = async (
- legacy: LocalServiceLegacyHandoff,
- ): Promise<
- | { readonly kind: 'active_tasks' }
- | { readonly kind: 'external' }
- | { readonly kind: 'complete'; readonly managed: LocalServiceManaged }
- > => {
- const pending = pendingSetup(legacy);
- const authority = await adoptCommittedSetup(pending);
- if (authority.kind === 'managed') {
- return { kind: 'complete', managed: authority.managed };
- }
- if (authority.kind === 'transition') {
- await writeDocument(lifecyclePath, pending);
- return finishSetup(pending, 'recovery');
- }
-
- const manager = requireManager(input.manager);
- const retirement = await manager.retireOwnedLocalHost(
- legacy.allowInterruptActiveTasks ? 'interrupt_active_work' : 'refuse_active_work',
- );
- if (retirement.kind === 'active_tasks') return { kind: 'active_tasks' };
- if (retirement.kind === 'not_owned') {
- const raced = await adoptCommittedSetup(pending);
- if (raced.kind === 'managed') {
- return { kind: 'complete', managed: raced.managed };
- }
- if (raced.kind === 'absent') {
- await removeDocument(lifecyclePath);
- return { kind: 'external' };
- }
- }
-
- try {
- await writeDocument(lifecyclePath, pending);
- const setupPackage = await input.resolveSetupPackage(closing.signal);
- const reconcile = () => reconcileSetup(pending, setupPackage);
- return retirement.kind === 'not_owned'
- ? await manager.runManagedLocalHostChange(reconcile)
- : await reconcile();
- } finally {
- if (retirement.kind === 'retired') retirement.resume();
- }
- };
-
const createConnectionCode = (): Promise<string> =>
serialize(async () => {
const managed = requireManaged(
@@ -581,7 +526,7 @@ export function createDesktopLocalRuntimeHostRemoteAccess(input: {
}
const managed = requireManagementTarget(lifecycle);
const intent: LocalServiceUninstalling = {
- schemaVersion: 1,
+ schemaVersion: 2,
...managed,
state: 'uninstalling',
allowInterruptActiveTasks,
@@ -599,7 +544,7 @@ export function createDesktopLocalRuntimeHostRemoteAccess(input: {
> => {
const change = () =>
input.operator.runPeer({
- operatorPath: intent.operatorPath,
+ operator: intent.operator,
action: intent.peerEnabled ? 'enable' : 'disable',
target: intent,
coordinationRelays: intent.coordinationRelays,
@@ -632,7 +577,7 @@ export function createDesktopLocalRuntimeHostRemoteAccess(input: {
if (authority) {
const change = () =>
input.operator.runService({
- operatorPath: intent.operatorPath,
+ operator: intent.operator,
action: 'uninstall',
target: intent,
allowInterruptActiveTasks: intent.allowInterruptActiveTasks,
@@ -654,12 +599,12 @@ export function createDesktopLocalRuntimeHostRemoteAccess(input: {
await writeDocument(lifecyclePath, intent);
}
await input.operator.cleanupManagedDeployment({
- operatorPath: intent.operatorPath,
+ operator: intent.operator,
target: intent,
signal,
});
await input.operator.cleanupManagedDeployment({
- operatorPath: intent.operatorPath,
+ operator: intent.operator,
target: intent,
finalize: true,
signal,
@@ -800,7 +745,7 @@ export function createDesktopLocalRuntimeHostRemoteAccess(input: {
if (frame.update.kind === 'already_current') {
const restarted = await input.operator.runService({
- operatorPath: lifecycle.operatorPath,
+ operator: lifecycle.operator,
action: 'restart',
target: lifecycle,
...(options.allowInterruptActiveTasks
@@ -842,18 +787,16 @@ export function createDesktopLocalRuntimeHostRemoteAccess(input: {
return true;
});
}
- if (observed?.state !== 'setupPending' && observed?.state !== 'handoff') return false;
+ if (observed?.state !== 'setupPending') return false;
return serialize(async () => {
operationSignal.throwIfAborted();
const pending = await readLifecycle(lifecyclePath, input.rootPath, input.rootId);
- if (pending?.state !== 'setupPending' && pending?.state !== 'handoff') return false;
- const committed = pendingSetup(pending);
- const authority = await adoptCommittedSetup(committed);
+ if (pending?.state !== 'setupPending') return false;
+ const authority = await adoptCommittedSetup(pending);
if (authority.kind === 'absent') return false;
if (authority.kind === 'managed') return true;
- if (pending.state === 'handoff') await writeDocument(lifecyclePath, committed);
const setupPackage = await input.resolveSetupPackage(operationSignal);
- await reconcileSetup(committed, setupPackage, operationSignal);
+ await reconcileSetup(pending, setupPackage, operationSignal);
return true;
});
},
@@ -872,12 +815,11 @@ export function createDesktopLocalRuntimeHostRemoteAccess(input: {
}
return;
}
- if (lifecycle.state === 'handoff' || lifecycle.state === 'setupPending') {
- const committed = await adoptCommittedSetup(pendingSetup(lifecycle));
+ if (lifecycle.state === 'setupPending') {
+ const committed = await adoptCommittedSetup(lifecycle);
if (committed.kind === 'managed') return;
if (!supported(input.directPeerAvailable)) return;
- if (lifecycle.state === 'handoff') await recoverLegacyHandoff(lifecycle);
- else await finishSetup(lifecycle, 'recovery');
+ await finishSetup(lifecycle, 'recovery');
return;
}
}),
@@ -929,7 +871,7 @@ async function readPeer(
receipt: LocalServiceTarget,
): Promise<LocalPeerDescriptor | undefined> {
const response = await operator.runPeer({
- operatorPath: receipt.operatorPath,
+ operator: receipt.operator,
action: 'status',
target: receipt,
});
@@ -997,7 +939,7 @@ async function hasSharedAccess(
target: LocalServiceTarget,
): Promise<boolean> {
const response = await operator.runAccess({
- operatorPath: target.operatorPath,
+ operator: target.operator,
target,
});
if (response.kind === 'error') throw new Error(response.error.message);
@@ -1039,25 +981,23 @@ function hostName(): string {
function requireServiceTarget(value: unknown, rootPath: string): LocalServiceTarget {
if (
!isRecord(value) ||
- value.schemaVersion !== 1 ||
+ value.schemaVersion !== 2 ||
typeof value.serviceId !== 'string' ||
!SERVICE_ID_PATTERN.test(value.serviceId) ||
typeof value.rootId !== 'string' ||
!ROOT_ID_PATTERN.test(value.rootId) ||
typeof value.deploymentId !== 'string' ||
!DEPLOYMENT_ID_PATTERN.test(value.deploymentId) ||
- value.rootPath !== rootPath ||
- typeof value.operatorPath !== 'string' ||
- !isAbsolute(value.operatorPath)
+ value.rootPath !== rootPath
) {
throw new Error('Local Runtime Host service receipt is invalid');
}
return {
- schemaVersion: 1,
+ schemaVersion: 2,
serviceId: value.serviceId,
rootPath,
rootId: value.rootId,
- operatorPath: value.operatorPath,
+ operator: decodeRuntimeHostOperatorCommand(value.operator),
deploymentId: value.deploymentId,
};
}
@@ -1078,25 +1018,12 @@ function requireManagementTarget(
return lifecycle;
}
-function pendingSetup(
- intent: LocalServiceSetupPending | LocalServiceLegacyHandoff,
-): LocalServiceSetupPending {
- return {
- schemaVersion: 1,
- state: 'setupPending',
- rootPath: intent.rootPath,
- rootId: intent.rootId,
- coordinationRelays: intent.coordinationRelays,
- allowInterruptActiveTasks: intent.allowInterruptActiveTasks,
- };
-}
-
function managedLifecycle(intent: LocalServiceTarget): LocalServiceManaged {
return {
- schemaVersion: 1,
+ schemaVersion: 2,
state: 'managed',
serviceId: intent.serviceId,
- operatorPath: intent.operatorPath,
+ operator: intent.operator,
rootPath: intent.rootPath,
rootId: intent.rootId,
deploymentId: intent.deploymentId,
@@ -1107,7 +1034,7 @@ function hasManagedServiceTarget(lifecycle: LocalServiceLifecycle): lifecycle is
| LocalServiceManaged
| LocalServicePeerChanging
| LocalServiceUninstalling {
- return lifecycle.state !== 'handoff' && lifecycle.state !== 'setupPending';
+ return lifecycle.state !== 'setupPending';
}
async function readLifecycle(
@@ -1124,13 +1051,13 @@ async function readLifecycle(
}
if (
!isRecord(value) ||
- value.schemaVersion !== 1 ||
+ value.schemaVersion !== 2 ||
value.rootPath !== rootPath ||
value.rootId !== rootId
) {
throw new Error('Local Runtime Host service lifecycle is invalid');
}
- if (value.state === 'setupPending' || value.state === 'handoff') {
+ if (value.state === 'setupPending') {
assertExactKeys(value, [
'schemaVersion',
'state',
@@ -1145,7 +1072,7 @@ async function readLifecycle(
throw new Error('Local Runtime Host setup intent is invalid');
}
return {
- schemaVersion: 1,
+ schemaVersion: 2,
state: value.state,
rootPath,
rootId,
@@ -1158,7 +1085,7 @@ async function readLifecycle(
'schemaVersion',
'state',
'serviceId',
- 'operatorPath',
+ 'operator',
'rootPath',
'rootId',
'deploymentId',
@@ -1256,7 +1183,7 @@ async function uninstallExactService(
receipt: LocalServiceTarget,
): Promise<void> {
const response = await operator.runService({
- operatorPath: receipt.operatorPath,
+ operator: receipt.operator,
action: 'uninstall',
target: receipt,
});
diff --git a/apps/desktop/src/main/runtime-host-managed-services.ts b/apps/desktop/src/main/runtime-host-managed-services.ts
index 665c52724b..7b1eb7a8b3 100644
--- a/apps/desktop/src/main/runtime-host-managed-services.ts
+++ b/apps/desktop/src/main/runtime-host-managed-services.ts
@@ -29,10 +29,14 @@ import {
type RuntimeHostRemoteTransport,
} from "@maka/runtime-host/client";
import { requireHostRootId } from "@maka/runtime-host/protocol";
+import {
+ decodeRuntimeHostOperatorCommand,
+ type RuntimeHostOperatorCommand,
+} from "@maka/runtime-host/operator";
import { withFileUpdateLock } from "@maka/storage/file-update-lock";
import { syncDirectory } from "@maka/storage/stable-storage";
-const SCHEMA_VERSION = 1;
+const SCHEMA_VERSION = 2;
const DOCUMENT_MAX_BYTES = 256 * 1024;
const BINDING_COUNT_MAX = 32;
const PATH_MAX_BYTES = 4 * 1024;
@@ -49,7 +53,7 @@ type ManagedSshRuntimeHostProfile = RemoteRuntimeHostProfile & {
interface DesktopRuntimeHostSshControlRoute {
readonly kind: "ssh_operator";
- readonly operatorPath: string;
+ readonly operator: RuntimeHostOperatorCommand;
}
interface DesktopRuntimeHostManagedServiceTargetBase {
@@ -146,7 +150,6 @@ export function createDesktopRuntimeHostManagedServiceStore(
): DesktopRuntimeHostManagedServiceStore {
return new FileDesktopRuntimeHostManagedServiceStore(
join(clientDataRoot, "runtime-host-deployments.json"),
- join(clientDataRoot, "runtime-host-managed-services.json"),
);
}
@@ -176,11 +179,9 @@ export function sameDesktopRuntimeHostManagedServiceBinding(
class FileDesktopRuntimeHostManagedServiceStore implements DesktopRuntimeHostManagedServiceStore {
readonly #path: string;
- readonly #legacyPath: string;
- constructor(path: string, legacyPath: string) {
+ constructor(path: string) {
this.#path = path;
- this.#legacyPath = legacyPath;
}
async read(): Promise<DesktopRuntimeHostManagedServiceDocument> {
@@ -192,25 +193,13 @@ class FileDesktopRuntimeHostManagedServiceStore implements DesktopRuntimeHostMan
try {
contents = await readFile(this.#path, "utf8");
} catch (error) {
- if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
- try {
- contents = await readFile(this.#legacyPath, "utf8");
- } catch (legacyError) {
- if ((legacyError as NodeJS.ErrnoException).code === "ENOENT")
- return emptyDocument();
- throw legacyError;
- }
- const migrated = decodeLegacyDocument(JSON.parse(contents));
- await writeDocument(this.#path, migrated);
- await removeLegacyDocument(this.#legacyPath);
- return migrated;
+ if ((error as NodeJS.ErrnoException).code === "ENOENT") return emptyDocument();
+ throw error;
}
if (Buffer.byteLength(contents, "utf8") > DOCUMENT_MAX_BYTES) {
throw new Error("Runtime Host managed service document is too large");
}
- const document = decodeDocument(JSON.parse(contents));
- await removeLegacyDocument(this.#legacyPath);
- return document;
+ return decodeDocument(JSON.parse(contents));
}
save(
@@ -455,36 +444,6 @@ function decodeDocument(
});
}
-function decodeLegacyDocument(
- value: unknown,
-): DesktopRuntimeHostManagedServiceDocument {
- const record = requireExactRecord(
- value,
- "Legacy Runtime Host managed service document",
- ["schemaVersion", "bindings"],
- );
- if (record.schemaVersion !== 1 || !Array.isArray(record.bindings)) {
- throw new Error("Legacy Runtime Host managed service document is invalid");
- }
- return decodeDocument({
- schemaVersion: SCHEMA_VERSION,
- bindings: record.bindings.map((candidate) => {
- const binding = requireExactRecord(
- candidate,
- "Legacy Runtime Host service binding",
- ["profile", "service", "state"],
- );
- const service = decodeLegacyService(binding.service);
- return {
- profile: binding.profile,
- deployment: { id: service.id, rootPath: service.rootPath },
- control: { kind: "ssh_operator", operatorPath: service.operatorPath },
- state: binding.state,
- };
- }),
- });
-}
-
function decodeDeployment(value: unknown): DesktopRuntimeHostDeploymentBinding {
const hasDeploymentId =
value !== null &&
@@ -509,19 +468,15 @@ function decodeSshControlRoute(value: unknown): DesktopRuntimeHostSshControlRout
const record = requireExactRecord(
value,
"Managed Runtime Host control route",
- ["kind", "operatorPath"],
+ ["kind", "operator"],
);
if (record.kind !== "ssh_operator") {
throw new Error("Managed Runtime Host control route is invalid");
}
- const operatorPath = requirePath(
- record.operatorPath,
- "Managed Runtime Host operator path",
- );
- if (!operatorPath.startsWith("/")) {
- throw new Error("Managed Runtime Host operator path must be absolute");
- }
- return Object.freeze({ kind: "ssh_operator", operatorPath });
+ return Object.freeze({
+ kind: "ssh_operator",
+ operator: decodeRuntimeHostOperatorCommand(record.operator),
+ });
}
function decodeBinding(
@@ -544,34 +499,6 @@ function decodeBinding(
return Object.freeze({ profile, deployment, control });
}
-function decodeLegacyService(value: unknown): {
- readonly id: string;
- readonly rootPath: string;
- readonly operatorPath: string;
-} {
- const record = requireExactRecord(
- value,
- "Managed Runtime Host service",
- ["id", "operatorPath", "rootPath"],
- );
- const rootPath = requirePath(
- record.rootPath,
- "Managed Runtime Host State Root",
- );
- const operatorPath = requirePath(
- record.operatorPath,
- "Managed Runtime Host operator path",
- );
- if (!operatorPath.startsWith("/")) {
- throw new Error("Managed Runtime Host operator path must be absolute");
- }
- return Object.freeze({
- id: requireHostRootId(record.id),
- rootPath,
- operatorPath,
- });
-}
-
function requireDeploymentId(value: unknown): string {
if (
typeof value !== "string" ||
@@ -632,7 +559,7 @@ function sameBindingTarget(
}
return (
isDesktopRuntimeHostManagedSshServiceBinding(right) &&
- left.control.operatorPath === right.control.operatorPath
+ JSON.stringify(left.control.operator) === JSON.stringify(right.control.operator)
);
}
@@ -676,13 +603,3 @@ async function writeDocument(
await rm(temporaryPath, { force: true });
}
}
-
-async function removeLegacyDocument(path: string): Promise<void> {
- try {
- await rm(path);
- } catch (error) {
- if ((error as NodeJS.ErrnoException).code === "ENOENT") return;
- throw error;
- }
- await syncDirectory(dirname(path));
-}
diff --git a/apps/desktop/src/main/runtime-host-management.ts b/apps/desktop/src/main/runtime-host-management.ts
index d31fcad04e..2824b16d19 100644
--- a/apps/desktop/src/main/runtime-host-management.ts
+++ b/apps/desktop/src/main/runtime-host-management.ts
@@ -125,7 +125,7 @@ export function createDesktopRuntimeHostManagement(input: {
onProgress: (phase: DesktopRuntimeHostManagementProgress['phase']) => void,
) => Promise<RuntimeHostServiceUpdateReconciliationTerminalFrame>;
readonly setupPackageMode: 'published' | 'development';
- readonly resolveSshDevelopmentPeerTarget: (input: {
+ readonly resolveSshPeerTarget: (input: {
readonly destination: string;
readonly sshPort?: number;
readonly signal?: AbortSignal;
@@ -213,7 +213,7 @@ export function createDesktopRuntimeHostManagement(input: {
}
const response = await input.runWslManagement({
distribution: managed.profile.provider.distribution,
- operatorPath: managed.profile.operatorPath,
+ operator: managed.profile.operator,
action: managementAction,
expectedTarget,
});
@@ -224,7 +224,7 @@ export function createDesktopRuntimeHostManagement(input: {
...(managed.profile.transport.sshPort === undefined
? {}
: { sshPort: managed.profile.transport.sshPort }),
- operatorPath: managed.control.operatorPath,
+ operator: managed.control.operator,
action: managementAction,
expectedTarget,
...(managementAction === 'install'
@@ -272,7 +272,7 @@ export function createDesktopRuntimeHostManagement(input: {
...(managementInput.sshPort === undefined
? {}
: { sshPort: managementInput.sshPort }),
- operatorPath: managementInput.operatorPath,
+ operator: managementInput.operator,
expectedTarget: managementInput.expectedTarget,
});
await input.cleanupManagedDeployment({
@@ -280,7 +280,7 @@ export function createDesktopRuntimeHostManagement(input: {
...(managementInput.sshPort === undefined
? {}
: { sshPort: managementInput.sshPort }),
- operatorPath: managementInput.operatorPath,
+ operator: managementInput.operator,
expectedTarget: managementInput.expectedTarget,
finalize: true,
});
@@ -357,7 +357,7 @@ export function createDesktopRuntimeHostManagement(input: {
...(managed.profile.transport.sshPort === undefined
? {}
: { sshPort: managed.profile.transport.sshPort }),
- operatorPath: managed.control.operatorPath,
+ operator: managed.control.operator,
rootPath: managed.deployment.rootPath,
expectedRootId: managed.profile.rootId,
},
@@ -443,7 +443,7 @@ export function createDesktopRuntimeHostManagement(input: {
...(target.transport.sshPort === undefined
? {}
: { sshPort: target.transport.sshPort }),
- operatorPath: target.managed.control.operatorPath,
+ operator: target.managed.control.operator,
action: 'status',
expectedTarget: target.expectedTarget,
capabilityRequest: RUNTIME_HOST_OPERATOR_PEER_WEBRTC_STUN_CAPABILITY,
@@ -462,7 +462,7 @@ export function createDesktopRuntimeHostManagement(input: {
...(target.transport.sshPort === undefined
? {}
: { sshPort: target.transport.sshPort }),
- operatorPath: target.managed.control.operatorPath,
+ operator: target.managed.control.operator,
action: 'status',
expectedTarget: target.expectedTarget,
capabilityRequest: RUNTIME_HOST_OPERATOR_PEER_RELAY_DISCOVERY_CAPABILITY,
@@ -505,7 +505,7 @@ export function createDesktopRuntimeHostManagement(input: {
const response = await input.runPeerManagement({
destination: transport.destination,
...(transport.sshPort === undefined ? {} : { sshPort: transport.sshPort }),
- operatorPath: managed.control.operatorPath,
+ operator: managed.control.operator,
action: 'status',
...(webRtcStunAvailable ? { webRtcStunStatus: true } : {}),
expectedTarget,
@@ -560,7 +560,7 @@ export function createDesktopRuntimeHostManagement(input: {
const response = await input.runPeerManagement({
destination: transport.destination,
...(transport.sshPort === undefined ? {} : { sshPort: transport.sshPort }),
- operatorPath: managed.control.operatorPath,
+ operator: managed.control.operator,
action: enabledValue ? 'enable' : 'disable',
...(enabledValue ? { coordinationRelays } : {}),
...(enabledValue ? { automaticRelayDiscovery: automaticRelayDiscoveryValue } : {}),
@@ -600,7 +600,7 @@ export function createDesktopRuntimeHostManagement(input: {
const rollback = await input.runPeerManagement({
destination: transport.destination,
...(transport.sshPort === undefined ? {} : { sshPort: transport.sshPort }),
- operatorPath: managed.control.operatorPath,
+ operator: managed.control.operator,
action: 'disable',
expectedTarget,
});
@@ -650,10 +650,10 @@ export function createDesktopRuntimeHostManagement(input: {
const previousHostEpoch = input.currentHostEpoch(profileId);
input.sendProgress({ profileId, phase: 'preparing_cli' });
const peerTarget = input.setupPackageMode === 'development'
- ? await input.resolveSshDevelopmentPeerTarget({
- destination: transport.destination,
- ...(transport.sshPort === undefined ? {} : { sshPort: transport.sshPort }),
- })
+ ? await input.resolveSshPeerTarget({
+ destination: transport.destination,
+ ...(transport.sshPort === undefined ? {} : { sshPort: transport.sshPort }),
+ })
: 'none';
const setupPackage = await input.resolveUpdatePackage(peerTarget);
execute = () => input.runUpdate(
@@ -661,6 +661,7 @@ export function createDesktopRuntimeHostManagement(input: {
destination: transport.destination,
...(transport.sshPort === undefined ? {} : { sshPort: transport.sshPort }),
setupPackage,
+ operator: managed.control.operator,
expectedTarget,
...(allowInterruptActiveTasksValue ? { allowInterruptActiveTasks: true } : {}),
},
@@ -723,7 +724,7 @@ export function createDesktopRuntimeHostManagement(input: {
if (!isDesktopRuntimeHostManagedSshServiceBinding(managed)) {
execute = () => input.runWslManagement({
distribution: managed.profile.provider.distribution,
- operatorPath: managed.profile.operatorPath,
+ operator: managed.profile.operator,
action: 'configure',
expectedTarget,
projectDirectoryRoots: roots,
@@ -735,7 +736,7 @@ export function createDesktopRuntimeHostManagement(input: {
execute = () => input.runServiceManagement({
destination: transport.destination,
...(transport.sshPort === undefined ? {} : { sshPort: transport.sshPort }),
- operatorPath: managed.control.operatorPath,
+ operator: managed.control.operator,
action: 'configure',
expectedTarget,
projectDirectoryRoots: roots,
@@ -800,7 +801,7 @@ export function createDesktopRuntimeHostManagement(input: {
...(transport.sshPort === undefined
? {}
: { sshPort: transport.sshPort }),
- operatorPath: managed.control.operatorPath,
+ operator: managed.control.operator,
expectedTarget,
};
return async (next?: RuntimeHostManagedUpdatePolicy) =>
@@ -843,7 +844,7 @@ export function createDesktopRuntimeHostManagement(input: {
{
destination: transport.destination,
...(transport.sshPort === undefined ? {} : { sshPort: transport.sshPort }),
- operatorPath: managed.control.operatorPath,
+ operator: managed.control.operator,
expectedTarget,
},
(phase) => input.sendProgress({ profileId, phase }),
diff --git a/apps/desktop/src/main/runtime-host-onboarding.ts b/apps/desktop/src/main/runtime-host-onboarding.ts
index 68d59f5adb..f1ac75c3d3 100644
--- a/apps/desktop/src/main/runtime-host-onboarding.ts
+++ b/apps/desktop/src/main/runtime-host-onboarding.ts
@@ -21,6 +21,7 @@ import { randomUUID } from 'node:crypto';
import type { IpcMain } from 'electron';
import {
parseRuntimeHostSetupEndpoint,
+ type RuntimeHostOperatorCommand,
type RuntimeHostSetupPhase,
} from '@maka/runtime-host/operator';
import type {
@@ -58,7 +59,7 @@ export function createDesktopRuntimeHostOnboarding(input: {
readonly rootPath: string;
readonly serviceId: string;
readonly deploymentId: string;
- readonly operatorPath: string;
+ readonly operator: RuntimeHostOperatorCommand;
readonly endpoint: string;
readonly credential: string;
}>;
@@ -71,12 +72,12 @@ export function createDesktopRuntimeHostOnboarding(input: {
readonly rootPath: string;
readonly serviceId: string;
readonly deploymentId: string;
- readonly operatorPath: string;
+ readonly operator: RuntimeHostOperatorCommand;
}>;
readonly listWslDistributions: () => Promise<readonly string[]>;
readonly send: (snapshot: DesktopRuntimeHostOnboardingSnapshot) => void;
readonly setupPackageMode: 'published' | 'development';
- readonly resolveSshDevelopmentPeerTarget: (input: {
+ readonly resolveSshPeerTarget: (input: {
readonly destination: string;
readonly sshPort?: number;
readonly signal?: AbortSignal;
@@ -134,10 +135,11 @@ export function createDesktopRuntimeHostOnboarding(input: {
const setupPackage = await input.resolveSetupPackage('none', signal);
return await runWsl(request, setupPackage, signal);
}
- const peerTarget = input.setupPackageMode === 'development'
- ? await resolveSshDevelopmentPeerTarget(request, signal)
- : 'none';
- const setupPackage = await input.resolveSetupPackage(peerTarget, signal);
+ const peerTarget = await resolveSshPeerTarget(request, signal);
+ const setupPackage = await input.resolveSetupPackage(
+ input.setupPackageMode === 'development' ? peerTarget : 'none',
+ signal,
+ );
const lifecycle = setupPackage.kind === 'npm' ? 'on_demand' : 'supervised';
signal.throwIfAborted();
publish({ kind: 'running', phase: 'connecting_ssh' });
@@ -156,6 +158,7 @@ export function createDesktopRuntimeHostOnboarding(input: {
destination: request.destination,
...(request.sshPort === undefined ? {} : { sshPort: request.sshPort }),
setupPackage,
+ remotePlatform: peerTarget === 'win32-x64' ? 'win32' : 'posix',
lifecycle,
principalId: `desktop:${input.clientInstanceId}`,
...(request.projectDirectoryRoots
@@ -191,7 +194,7 @@ export function createDesktopRuntimeHostOnboarding(input: {
? {
activation: {
kind: 'ssh_operator' as const,
- operatorPath: complete.operatorPath,
+ operator: complete.operator,
},
}
: {
@@ -209,7 +212,7 @@ export function createDesktopRuntimeHostOnboarding(input: {
},
control: {
kind: 'ssh_operator',
- operatorPath: complete.operatorPath,
+ operator: complete.operator,
},
},
});
@@ -226,12 +229,12 @@ export function createDesktopRuntimeHostOnboarding(input: {
}
};
- const resolveSshDevelopmentPeerTarget = async (
+ const resolveSshPeerTarget = async (
request: Extract<DesktopRuntimeHostOnboardingInput, { readonly kind: 'ssh' }>,
signal: AbortSignal,
): Promise<Exclude<DesktopRuntimeHostDevelopmentPeerTarget, 'none'>> => {
publish({ kind: 'running', phase: 'connecting_ssh' });
- const target = await input.resolveSshDevelopmentPeerTarget({
+ const target = await input.resolveSshPeerTarget({
destination: request.destination,
...(request.sshPort === undefined ? {} : { sshPort: request.sshPort }),
signal,
@@ -276,7 +279,7 @@ export function createDesktopRuntimeHostOnboarding(input: {
kind: 'environment' as const,
provider: { kind: 'wsl' as const, distribution: request.distribution },
rootId: complete.rootId,
- operatorPath: complete.operatorPath,
+ operator: complete.operator,
};
const connected = await input.profiles.addManagedEnvironmentAndEnable({
profile,
diff --git a/apps/desktop/src/main/runtime-host-peer-mesh-management.ts b/apps/desktop/src/main/runtime-host-peer-mesh-management.ts
index 675962f0fb..4fa6b568ba 100644
--- a/apps/desktop/src/main/runtime-host-peer-mesh-management.ts
+++ b/apps/desktop/src/main/runtime-host-peer-mesh-management.ts
@@ -155,7 +155,7 @@ export function createDesktopRuntimeHostPeerMeshManagement(input: {
const { invitation, ...rest } = command;
return runFramedPeerMeshCommand(command.action, () =>
input.runLocal({
- operatorPath: managed.operatorPath,
+ operator: managed.operator,
target: managedTarget(managed),
...rest,
...(invitation ? { invitation: JSON.stringify(invitation) } : {}),
@@ -203,7 +203,7 @@ export function createDesktopRuntimeHostPeerMeshManagement(input: {
input.runRemote({
destination: transport.destination,
...(transport.sshPort === undefined ? {} : { sshPort: transport.sshPort }),
- operatorPath: managed.control.operatorPath,
+ operator: managed.control.operator,
expectedTarget: {
serviceId: managed.deployment.id,
rootPath: managed.deployment.rootPath,
@@ -428,7 +428,7 @@ async function reconcileDesktopTarget(
const run: RunManagedPeerMeshCommand = async (command) => {
const { invitation, ...rest } = command;
const response = await runLocal({
- operatorPath: managed.operatorPath,
+ operator: managed.operator,
target: managedTarget(managed),
...rest,
...(invitation ? { invitation: JSON.stringify(invitation) } : {}),
@@ -600,7 +600,7 @@ function requireTarget(value: unknown): DesktopRuntimeHostPeerMeshTarget {
function managedTarget(
target: DesktopRuntimeHostLocalManagementTarget,
-): Omit<DesktopRuntimeHostLocalManagementTarget, 'operatorPath'> {
+): Omit<DesktopRuntimeHostLocalManagementTarget, 'operator'> {
return {
serviceId: target.serviceId,
rootPath: target.rootPath,
diff --git a/apps/desktop/src/main/runtime-host-ssh-terminal.ts b/apps/desktop/src/main/runtime-host-ssh-terminal.ts
index bf8fe7ae9f..8256d503c4 100644
--- a/apps/desktop/src/main/runtime-host-ssh-terminal.ts
+++ b/apps/desktop/src/main/runtime-host-ssh-terminal.ts
@@ -28,6 +28,7 @@ import {
activateRuntimeHostSshOperator,
normalizeRuntimeHostSshDestination,
openRuntimeHostSshTunnel,
+ runtimeHostSshOperatorRemoteCommand,
type RuntimeHostSshOperatorActivationInput,
type RuntimeHostSshProcess,
type RuntimeHostSshProcessFactory,
@@ -62,6 +63,7 @@ import {
type RuntimeHostPeerMeshManagementAction,
type RuntimeHostPeerMeshManagementFrame,
type RuntimeHostOperatorCapability,
+ type RuntimeHostOperatorCommand,
type RuntimeHostServiceManagementAction,
type RuntimeHostServiceManagementFrame,
type RuntimeHostServiceUpdatePhase,
@@ -110,6 +112,7 @@ export interface DesktopRuntimeHostSshSetupInput {
readonly destination: string;
readonly sshPort?: number;
readonly setupPackage: DesktopRuntimeHostSetupPackage;
+ readonly remotePlatform: RuntimeHostOperatorCommand['platform'];
readonly principalId: string;
readonly lifecycle?: 'supervised' | 'on_demand';
readonly projectDirectoryRoots?: readonly { readonly label: string; readonly path: string }[];
@@ -125,7 +128,7 @@ export interface DesktopRuntimeHostSshTargetInput {
export interface DesktopRuntimeHostSshManagementInput {
readonly destination: string;
readonly sshPort?: number;
- readonly operatorPath: string;
+ readonly operator: RuntimeHostOperatorCommand;
readonly action: Exclude<
RuntimeHostServiceManagementAction,
'check_update' | 'update' | 'update_policy' | 'reconcile_update'
@@ -151,6 +154,7 @@ export interface DesktopRuntimeHostSshUpdateInput {
readonly destination: string;
readonly sshPort?: number;
readonly setupPackage: DesktopRuntimeHostSetupPackage;
+ readonly operator: RuntimeHostOperatorCommand;
readonly expectedTarget: DesktopRuntimeHostSshManagementInput['expectedTarget'];
readonly allowInterruptActiveTasks?: boolean;
readonly signal?: AbortSignal;
@@ -159,7 +163,7 @@ export interface DesktopRuntimeHostSshUpdateInput {
export interface DesktopRuntimeHostSshUpdatePolicyInput {
readonly destination: string;
readonly sshPort?: number;
- readonly operatorPath: string;
+ readonly operator: RuntimeHostOperatorCommand;
readonly policy?: RuntimeHostManagedUpdatePolicy;
readonly expectedTarget: DesktopRuntimeHostSshManagementInput['expectedTarget'];
readonly signal?: AbortSignal;
@@ -168,7 +172,7 @@ export interface DesktopRuntimeHostSshUpdatePolicyInput {
export interface DesktopRuntimeHostSshUpdateReconciliationInput {
readonly destination: string;
readonly sshPort?: number;
- readonly operatorPath: string;
+ readonly operator: RuntimeHostOperatorCommand;
readonly expectedTarget: DesktopRuntimeHostSshManagementInput['expectedTarget'];
readonly signal?: AbortSignal;
}
@@ -176,7 +180,7 @@ export interface DesktopRuntimeHostSshUpdateReconciliationInput {
export interface DesktopRuntimeHostSshPeerManagementInput {
readonly destination: string;
readonly sshPort?: number;
- readonly operatorPath: string;
+ readonly operator: RuntimeHostOperatorCommand;
readonly action: Extract<RuntimeHostPeerManagementAction, 'enable' | 'disable' | 'status'>;
readonly coordinationRelays?: readonly string[];
readonly automaticRelayDiscovery?: boolean;
@@ -189,7 +193,7 @@ export interface DesktopRuntimeHostSshPeerManagementInput {
export interface DesktopRuntimeHostSshPeerMeshManagementInput {
readonly destination: string;
readonly sshPort?: number;
- readonly operatorPath: string;
+ readonly operator: RuntimeHostOperatorCommand;
readonly action: RuntimeHostPeerMeshManagementAction;
readonly expectedTarget: DesktopRuntimeHostSshManagementInput['expectedTarget'];
readonly meshId?: string | null;
@@ -202,7 +206,7 @@ export interface DesktopRuntimeHostSshPeerMeshManagementInput {
export interface DesktopRuntimeHostSshCleanupInput {
readonly destination: string;
readonly sshPort?: number;
- readonly operatorPath: string;
+ readonly operator: RuntimeHostOperatorCommand;
readonly expectedTarget: DesktopRuntimeHostSshManagementInput['expectedTarget'];
readonly finalize?: boolean;
readonly signal?: AbortSignal;
@@ -211,7 +215,7 @@ export interface DesktopRuntimeHostSshCleanupInput {
interface DesktopRuntimeHostSshAccessTarget {
readonly destination: string;
readonly sshPort?: number;
- readonly operatorPath: string;
+ readonly operator: RuntimeHostOperatorCommand;
readonly rootPath: string;
readonly expectedRootId: string;
readonly signal?: AbortSignal;
@@ -262,7 +266,7 @@ export function createDesktopRuntimeHostSshTerminal(input: {
input: RuntimeHostSshOperatorActivationInput,
): Promise<RuntimeHostActivationResult>;
openSshTunnel(input: RuntimeHostSshTunnelInput): Promise<RuntimeHostSshTunnel>;
- resolveDevelopmentPeerTarget(
+ resolvePeerTarget(
input: DesktopRuntimeHostSshTargetInput,
): Promise<Exclude<DesktopRuntimeHostDevelopmentPeerTarget, 'none'>>;
runSetup(
@@ -644,7 +648,7 @@ export function createDesktopRuntimeHostSshTerminal(input: {
}
return tunnel;
},
- resolveDevelopmentPeerTarget: async (targetInput) => {
+ resolvePeerTarget: async (targetInput) => {
if (closed) throw new Error('Runtime Host SSH terminal is closed');
targetInput.signal?.throwIfAborted();
const destination = normalizeRuntimeHostSshDestination(targetInput.destination);
@@ -652,7 +656,7 @@ export function createDesktopRuntimeHostSshTerminal(input: {
? undefined
: requireSetupPort(targetInput.sshPort);
const marker = `__MAKA_RUNTIME_HOST_TARGET_${randomUUID().replaceAll('-', '')}__`;
- const remoteCommand = `printf '${marker}%s:%s\\n' "$(uname -s)" "$(uname -m)"`;
+ const remoteCommand = `node -e "process.stdout.write('${marker}'+process.platform+':'+process.arch+'\\n')"`;
let target: Exclude<DesktopRuntimeHostDevelopmentPeerTarget, 'none'> | undefined;
let failure: Error | undefined;
const filter = createRuntimeHostFramedOutputFilter({
@@ -671,7 +675,7 @@ export function createDesktopRuntimeHostSshTerminal(input: {
return;
}
try {
- target = runtimeHostDevelopmentPeerTargetFromUname(system, machine);
+ target = runtimeHostPeerTargetFromNode(system, machine);
} catch (error) {
failure = error instanceof Error ? error : new Error(String(error));
}
@@ -961,19 +965,18 @@ export function createDesktopRuntimeHostSshTerminal(input: {
};
}
-export function runtimeHostDevelopmentPeerTargetFromUname(
- system: string,
- machine: string,
+export function runtimeHostPeerTargetFromNode(
+ platform: string,
+ arch: string,
): Exclude<DesktopRuntimeHostDevelopmentPeerTarget, 'none'> {
- const normalizedMachine = machine.toLowerCase();
- if (system === 'Darwin' && normalizedMachine === 'arm64') return 'darwin-arm64';
- if (system === 'Linux') {
- if (normalizedMachine === 'x86_64') return 'linux-x64';
- if (normalizedMachine === 'aarch64' || normalizedMachine === 'arm64') {
- return 'linux-arm64';
- }
- }
- throw new Error(`Direct peer is not available on ${system}/${machine}`);
+ const target = `${platform}-${arch}`;
+ if (
+ target === 'darwin-arm64' ||
+ target === 'linux-arm64' ||
+ target === 'linux-x64' ||
+ target === 'win32-x64'
+ ) return target;
+ throw new Error(`Direct peer is not available on ${target}`);
}
function cancellableUntilComplete(signal: AbortSignal | undefined): {
@@ -1169,7 +1172,7 @@ function runtimeHostSetupRemoteCommand(
setupPackage: PreparedSetupPackage,
input: Pick<
DesktopRuntimeHostSshSetupInput,
- 'principalId' | 'projectDirectoryRoots' | 'lifecycle'
+ 'principalId' | 'projectDirectoryRoots' | 'lifecycle' | 'remotePlatform'
>,
): string {
if (!/^[A-Za-z0-9_.:-]{1,128}$/u.test(input.principalId)) {
@@ -1198,29 +1201,24 @@ function runtimeHostSetupRemoteCommand(
JSON.stringify({ label, path }),
])),
'--json',
- ]);
+ ], {}, input.remotePlatform);
}
function runtimeHostActivationRemoteCommand(
input: RuntimeHostSshOperatorActivationInput,
): string {
- if (!pathPosix.isAbsolute(input.operatorPath)) {
- throw new Error('Runtime Host operator path must be absolute');
- }
- return [
- input.operatorPath,
+ return runtimeHostSshOperatorRemoteCommand(input.operator, [
'activate',
'--framed',
'--root-id',
input.rootId,
- ].map(quotePosix).join(' ');
+ ]);
}
function runtimeHostServiceManagementRemoteCommand(
input: DesktopRuntimeHostSshManagementInput,
): string {
- const command = [
- input.operatorPath,
+ const args = [
input.action,
'--framed',
...(input.rootPath ? ['--root', input.rootPath] : []),
@@ -1242,12 +1240,12 @@ function runtimeHostServiceManagementRemoteCommand(
...(input.allowInterruptActiveTasks ? ['--allow-interrupt-active-tasks'] : []),
...(input.retainManagedDeployment ? ['--retain-managed-deployment'] : []),
...managedServiceTargetArgs(input.expectedTarget),
- ].map(quotePosix).join(' ');
- const invocation =
- `${RUNTIME_HOST_OPERATOR_PROJECT_DIRECTORY_CONFIGURATION_REQUEST_ENV}=1 ` +
- `${RUNTIME_HOST_OPERATOR_CAPABILITY_REQUEST_ENV}=` +
- `${quotePosix(input.capabilityRequest ?? RUNTIME_HOST_OPERATOR_ACCESS_MANAGEMENT_CAPABILITY)} exec ${command}`;
- return `exec "\${SHELL:-/bin/sh}" -lic ${quotePosix(invocation)}`;
+ ];
+ return runtimeHostSshOperatorRemoteCommand(input.operator, args, {
+ [RUNTIME_HOST_OPERATOR_PROJECT_DIRECTORY_CONFIGURATION_REQUEST_ENV]: '1',
+ [RUNTIME_HOST_OPERATOR_CAPABILITY_REQUEST_ENV]:
+ input.capabilityRequest ?? RUNTIME_HOST_OPERATOR_ACCESS_MANAGEMENT_CAPABILITY,
+ });
}
function runtimeHostUpdateRemoteCommand(
@@ -1276,6 +1274,7 @@ function runtimeHostUpdateRemoteCommand(
RUNTIME_HOST_OPERATOR_ACCESS_MANAGEMENT_CAPABILITY,
[RUNTIME_HOST_OPERATOR_PROJECT_DIRECTORY_CONFIGURATION_REQUEST_ENV]: '1',
},
+ input.operator.platform,
);
}
@@ -1286,35 +1285,31 @@ function runtimeHostUpdatePolicyRemoteCommand(
const target = policy === undefined
? []
: ['--target', policy.kind === 'channel' ? policy.channel : policy.kind === 'fixed' ? policy.version : 'manual'];
- const command = [
- input.operatorPath,
+ const args = [
'update-policy',
'--framed',
...target,
...managedServiceTargetArgs(input.expectedTarget),
- ].map(quotePosix).join(' ');
- const invocation =
- `${RUNTIME_HOST_OPERATOR_CAPABILITY_REQUEST_ENV}=` +
- `${quotePosix(RUNTIME_HOST_OPERATOR_UPDATE_SCHEDULER_CAPABILITY)} exec ${command}`;
- return `exec "\${SHELL:-/bin/sh}" -lic ${quotePosix(invocation)}`;
+ ];
+ return runtimeHostSshOperatorRemoteCommand(input.operator, args, {
+ [RUNTIME_HOST_OPERATOR_CAPABILITY_REQUEST_ENV]:
+ RUNTIME_HOST_OPERATOR_UPDATE_SCHEDULER_CAPABILITY,
+ });
}
function runtimeHostUpdateReconciliationRemoteCommand(
input: DesktopRuntimeHostSshUpdateReconciliationInput,
): string {
- const command = [
- input.operatorPath,
+ const args = [
'reconcile-update',
'--framed',
...managedServiceTargetArgs(input.expectedTarget),
- ]
- .map(quotePosix)
- .join(' ');
- const invocation =
- `${RUNTIME_HOST_OPERATOR_PROJECT_DIRECTORY_CONFIGURATION_REQUEST_ENV}=1 ` +
- `${RUNTIME_HOST_OPERATOR_CAPABILITY_REQUEST_ENV}=` +
- `${quotePosix(RUNTIME_HOST_OPERATOR_UPDATE_SCHEDULER_CAPABILITY)} exec ${command}`;
- return `exec "\${SHELL:-/bin/sh}" -lic ${quotePosix(invocation)}`;
+ ];
+ return runtimeHostSshOperatorRemoteCommand(input.operator, args, {
+ [RUNTIME_HOST_OPERATOR_PROJECT_DIRECTORY_CONFIGURATION_REQUEST_ENV]: '1',
+ [RUNTIME_HOST_OPERATOR_CAPABILITY_REQUEST_ENV]:
+ RUNTIME_HOST_OPERATOR_UPDATE_SCHEDULER_CAPABILITY,
+ });
}
function runtimeHostAccessManagementRemoteCommand(
@@ -1330,8 +1325,7 @@ function runtimeHostAccessManagementRemoteCommand(
: input.action === 'connection-code'
? ['--name', input.name]
: [];
- const command = [
- input.operatorPath,
+ const args = [
'access',
input.action,
'--framed',
@@ -1340,15 +1334,14 @@ function runtimeHostAccessManagementRemoteCommand(
'--expected-root',
input.expectedRootId,
...actionArgs,
- ].map(quotePosix).join(' ');
- return `exec "\${SHELL:-/bin/sh}" -lic ${quotePosix(`exec ${command}`)}`;
+ ];
+ return runtimeHostSshOperatorRemoteCommand(input.operator, args);
}
function runtimeHostPeerManagementRemoteCommand(
input: DesktopRuntimeHostSshPeerManagementInput,
): string {
- const command = [
- input.operatorPath,
+ const args = [
'peer',
input.action,
'--framed',
@@ -1372,15 +1365,14 @@ function runtimeHostPeerManagementRemoteCommand(
: input.webRtcStunPolicy.urls.flatMap((url) => ['--webrtc-stun', url])
: []),
...managedServiceTargetArgs(input.expectedTarget),
- ].map(quotePosix).join(' ');
- return `exec "\${SHELL:-/bin/sh}" -lic ${quotePosix(`exec ${command}`)}`;
+ ];
+ return runtimeHostSshOperatorRemoteCommand(input.operator, args);
}
function runtimeHostPeerMeshManagementRemoteCommand(
input: DesktopRuntimeHostSshPeerMeshManagementInput,
): string {
- const command = [
- input.operatorPath,
+ const args = [
'mesh',
input.action,
'--framed',
@@ -1396,27 +1388,21 @@ function runtimeHostPeerMeshManagementRemoteCommand(
? ['--name', input.displayName]
: []),
...managedServiceTargetArgs(input.expectedTarget),
- ].map(quotePosix).join(' ');
- return `exec "\${SHELL:-/bin/sh}" -lic ${quotePosix(`exec ${command}`)}`;
+ ];
+ return runtimeHostSshOperatorRemoteCommand(input.operator, args);
}
function runtimeHostManagedDeploymentCleanupRemoteCommand(
input: DesktopRuntimeHostSshCleanupInput,
): string {
- const operator = quotePosix(input.operatorPath);
- const deploymentRoot = quotePosix(pathPosix.dirname(input.operatorPath));
- const cleanup = [
- input.operatorPath,
+ const args = [
'__cleanup-managed-deployment',
...(input.finalize ? ['--finalize'] : []),
...managedServiceTargetArgs(input.expectedTarget),
- ].map(quotePosix).join(' ');
- const invocation =
- `if [ ! -e ${operator} ]; then ` +
- `if [ ! -e ${deploymentRoot} ]; then exit 0; fi; ` +
- `exit 1; fi; ` +
- `exec ${cleanup}`;
- return `exec "\${SHELL:-/bin/sh}" -lic ${quotePosix(invocation)}`;
+ ];
+ return runtimeHostSshOperatorRemoteCommand(input.operator, args, {}, {
+ missingOperatorIsSuccess: true,
+ });
}
function managedServiceTargetArgs(input: {
@@ -1437,14 +1423,36 @@ function runtimeHostPackageRemoteCommand(
setupPackage: PreparedSetupPackage,
args: readonly string[],
environment: Readonly<Record<string, string>> = {},
+ platform: RuntimeHostOperatorCommand['platform'] = 'posix',
): string {
- const commandArgs = ['maka', ...args].map(quotePosix).join(' ');
- const environmentPrefix = Object.entries({
+ const completeEnvironment = {
...environment,
...(setupPackage.kind === 'development_archive'
? { [RUNTIME_HOST_SETUP_SOURCE_PACKAGE_INTEGRITY_ENV]: setupPackage.integrity }
: {}),
- })
+ };
+ if (platform === 'win32') {
+ const payload = Buffer.from(JSON.stringify({
+ kind: setupPackage.kind,
+ specifier: setupPackage.specifier,
+ args: ['maka', ...args],
+ environment: completeEnvironment,
+ ...(setupPackage.kind === 'development_archive'
+ ? { removeAfterSetup: setupPackage.removeAfterSetup }
+ : {}),
+ }), 'utf8').toString('base64');
+ const script = [
+ `$p=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${payload}'))|ConvertFrom-Json`,
+ `foreach($e in $p.environment.psobject.Properties){[Environment]::SetEnvironmentVariable($e.Name,[string]$e.Value,'Process')}`,
+ `$prefix=Join-Path ([IO.Path]::GetTempPath()) ('maka-runtime-host-command-'+[guid]::NewGuid().ToString('N'))`,
+ `$code=1`,
+ `try{if($p.kind -eq 'npm'){New-Item -ItemType Directory -Path $prefix|Out-Null;$n=@('--yes','--prefix',$prefix,'--package',[string]$p.specifier)}else{$n=@('--yes','--package',[string]$p.specifier)};$n+=@($p.args|ForEach-Object {[string]$_});& 'npx.cmd' @n;$code=if($null -eq $LASTEXITCODE){1}else{$LASTEXITCODE}}finally{if($p.kind -eq 'npm'){Remove-Item -LiteralPath $prefix -Recurse -Force -ErrorAction SilentlyContinue}elseif($p.removeAfterSetup){Remove-Item -LiteralPath ([string]$p. [...]
+ `exit $code`,
+ ].join(';');
+ return `powershell.exe -NoLogo -NoProfile -NonInteractive -EncodedCommand ${Buffer.from(script, 'utf16le').toString('base64')}`;
+ }
+ const commandArgs = ['maka', ...args].map(quotePosix).join(' ');
+ const environmentPrefix = Object.entries(completeEnvironment)
.map(([name, value]) => `${name}=${quotePosix(value)}`)
.join(' ');
const invocationPrefix = environmentPrefix ? `${environmentPrefix} ` : '';
diff --git a/apps/desktop/src/main/runtime-host-wsl-controller.ts b/apps/desktop/src/main/runtime-host-wsl-controller.ts
index c8ff168b4e..b57fcb0688 100644
--- a/apps/desktop/src/main/runtime-host-wsl-controller.ts
+++ b/apps/desktop/src/main/runtime-host-wsl-controller.ts
@@ -21,7 +21,6 @@ import { spawn, type ChildProcessWithoutNullStreams } from 'node:child_process';
import type { Readable } from 'node:stream';
import {
normalizeRuntimeHostWslDistribution,
- normalizeRuntimeHostWslOperatorPath,
resolveSystemRuntimeHostWslExecutable,
type RuntimeHostWslProcessFactory,
} from '@maka/runtime-host/client';
@@ -32,6 +31,9 @@ import {
RUNTIME_HOST_SERVICE_MANAGEMENT_FRAME_PREFIX,
RUNTIME_HOST_SETUP_FRAME_PREFIX,
RUNTIME_HOST_SETUP_SOURCE_PACKAGE_INTEGRITY_ENV,
+ decodeRuntimeHostOperatorCommand,
+ runtimeHostOperatorInvocation,
+ type RuntimeHostOperatorCommand,
type RuntimeHostSetupFrame,
type RuntimeHostSetupPhase,
type RuntimeHostServiceManagementFrame,
@@ -51,7 +53,7 @@ type RuntimeHostManagementTerminalFrame = Exclude<
export interface DesktopRuntimeHostWslManagementInput {
readonly distribution: string;
- readonly operatorPath: string;
+ readonly operator: RuntimeHostOperatorCommand;
readonly action: 'status' | 'configure';
readonly expectedTarget: {
readonly serviceId: string;
@@ -83,12 +85,9 @@ export async function runDesktopRuntimeHostWslManagement(
): Promise<RuntimeHostManagementTerminalFrame> {
input.signal?.throwIfAborted();
const distribution = normalizeRuntimeHostWslDistribution(input.distribution);
- const operatorPath = normalizeRuntimeHostWslOperatorPath(input.operatorPath);
- const args = [
- '--distribution',
- distribution,
- '--exec',
- operatorPath,
+ const operator = decodeRuntimeHostOperatorCommand(input.operator);
+ if (operator.platform !== 'posix') throw new Error('WSL Runtime Host operator must target POSIX');
+ const invocation = runtimeHostOperatorInvocation(operator, [
input.action,
'--framed',
...(input.projectDirectoryRoots === undefined
@@ -112,6 +111,13 @@ export async function runDesktopRuntimeHostWslManagement(
...(input.expectedTarget.deploymentId
? ['--expected-deployment-id', input.expectedTarget.deploymentId]
: []),
+ ]);
+ const args = [
+ '--distribution',
+ distribution,
+ '--exec',
+ invocation.executable,
+ ...invocation.args,
];
const environment = passEnvironmentToWsl(
process.env,
diff --git a/packages/cli/src/__tests__/runtime-host-cli-context.test.ts b/packages/cli/src/__tests__/runtime-host-cli-context.test.ts
index 8c4ca7183f..8d39fbf148 100644
--- a/packages/cli/src/__tests__/runtime-host-cli-context.test.ts
+++ b/packages/cli/src/__tests__/runtime-host-cli-context.test.ts
@@ -373,7 +373,7 @@ test('remote CLI profiles pin root identity and resolve credential outside the p
},
profileCatalog: {
read: async () => ({
- schemaVersion: 4,
+ schemaVersion: 5,
profiles: [
{
id: 'office',
@@ -677,7 +677,7 @@ function incompatibleRemoteHandshake(overrides: Partial<HostIncompatible> = {}):
function singleRemoteProfileCatalog(profile: RemoteRuntimeHostProfile): RuntimeHostProfileCatalog {
return {
- read: async () => ({ schemaVersion: 4, profiles: [profile] }),
+ read: async () => ({ schemaVersion: 5, profiles: [profile] }),
resolve: async (profileId) => {
assert.equal(profileId, profile.id);
return {
diff --git a/packages/cli/src/__tests__/runtime-host-profile-command.test.ts b/packages/cli/src/__tests__/runtime-host-profile-command.test.ts
index 68d4b4d21d..ae30ed40b8 100644
--- a/packages/cli/src/__tests__/runtime-host-profile-command.test.ts
+++ b/packages/cli/src/__tests__/runtime-host-profile-command.test.ts
@@ -204,7 +204,7 @@ function createProfileCatalogCapture(): {
saved: Array<{ profile: RemoteRuntimeHostProfile; credential?: string }>;
} {
const state: { document: RuntimeHostProfileDocument } = {
- document: { schemaVersion: 4, profiles: [] },
+ document: { schemaVersion: 5, profiles: [] },
};
const saved: Array<{ profile: RemoteRuntimeHostProfile; credential?: string }> = [];
const catalog: RuntimeHostProfileCatalog = {
@@ -214,7 +214,7 @@ function createProfileCatalogCapture(): {
save: async (profile: RemoteRuntimeHostProfile, credential?: string) => {
saved.push({ profile, credential });
state.document = {
- schemaVersion: 4,
+ schemaVersion: 5,
profiles: [
...state.document.profiles.filter((candidate) => candidate.id !== profile.id),
profile,
diff --git a/packages/cli/src/__tests__/runtime-host-service-manager.test.ts b/packages/cli/src/__tests__/runtime-host-service-manager.test.ts
index e82e7b0642..915ac3a4d7 100644
--- a/packages/cli/src/__tests__/runtime-host-service-manager.test.ts
+++ b/packages/cli/src/__tests__/runtime-host-service-manager.test.ts
@@ -2549,7 +2549,12 @@ describe('managed Runtime Host service', () => {
version,
root: deploymentRoot,
cliPath,
- operatorPath: join(deploymentRoot, 'operator'),
+ operator: {
+ kind: 'node' as const,
+ platform: 'posix' as const,
+ nodePath: '/usr/bin/node',
+ modulePath: join(deploymentRoot, 'operator.mjs'),
+ },
activate: async () => {
assert.equal(insideLifecycle, true);
order.push('activate');
@@ -2611,7 +2616,7 @@ describe('managed Runtime Host service', () => {
),
),
runOperator: async (
- _operatorPath: string,
+ _operator: import('@maka/runtime-host/operator').RuntimeHostOperatorCommand,
args: readonly string[],
invocation?: {
readonly inheritedFds?: readonly number[];
diff --git a/packages/cli/src/__tests__/runtime-host-setup.test.ts b/packages/cli/src/__tests__/runtime-host-setup.test.ts
index 773952b251..1b694b8d22 100644
--- a/packages/cli/src/__tests__/runtime-host-setup.test.ts
+++ b/packages/cli/src/__tests__/runtime-host-setup.test.ts
@@ -125,7 +125,12 @@ test('on-demand setup installs one exact deployment without a service backend',
version: '1.2.3',
root: join(canonicalDataHome, 'Maka', 'runtime-host-services', serviceId),
cliPath: '/verified/package/dist/cli.js',
- operatorPath: '/opt/maka/operator',
+ operator: {
+ kind: 'node' as const,
+ platform: 'posix' as const,
+ nodePath: '/usr/bin/node',
+ modulePath: '/opt/maka/operator.mjs',
+ },
activate: async () => undefined,
cleanup: async () => undefined,
rollback: async () => undefined,
@@ -380,7 +385,12 @@ test('fresh supervised setup discovers its provider before constructing a legacy
version: '1.2.3',
root: join(base, 'deployment'),
cliPath: '/verified/package/dist/cli.js',
- operatorPath: '/opt/maka/operator',
+ operator: {
+ kind: 'node' as const,
+ platform: 'posix' as const,
+ nodePath: '/usr/bin/node',
+ modulePath: '/opt/maka/operator.mjs',
+ },
activate: async () => undefined,
cleanup: async () => undefined,
rollback: async () => undefined,
@@ -715,7 +725,7 @@ test('registry package identity avoids local content and recovers an interrupted
}
await convergeRuntimeHostManagedOperator(undefined, currentConfig);
assert.equal(
- (await readFile(join(currentDeploymentRoot, 'operator'), 'utf8')).includes(
+ (await readFile(join(currentDeploymentRoot, 'operator.mjs'), 'utf8')).includes(
join(currentDeploymentRoot, 'versions', basename(registryRoot), 'dist', 'cli.js'),
),
true,
@@ -802,7 +812,7 @@ test('managed operator binds its Client Data Root and routes deployment cleanup'
deployment.cliPath,
`require('node:fs').writeFileSync(process.env.MAKA_TEST_OUTPUT, JSON.stringify(process.argv.slice(2)));\n`,
);
- await execFile(deployment.operatorPath, ['status'], {
+ await execFile(deployment.operator.nodePath, [deployment.operator.modulePath, 'status'], {
env: {
...process.env,
XDG_CONFIG_HOME: join(base, 'different-config'),
@@ -822,8 +832,8 @@ test('managed operator binds its Client Data Root and routes deployment cleanup'
]);
await execFile(
- deployment.operatorPath,
- ['access', 'list', '--root', '/runtime-root', '--framed'],
+ deployment.operator.nodePath,
+ [deployment.operator.modulePath, 'access', 'list', '--root', '/runtime-root', '--framed'],
{
env: { ...process.env, MAKA_TEST_OUTPUT: invocationPath },
},
@@ -837,9 +847,11 @@ test('managed operator binds its Client Data Root and routes deployment cleanup'
'--framed',
]);
- await execFile(deployment.operatorPath, ['activate', '--framed', '--root-id', 'a'.repeat(64)], {
- env: { ...process.env, MAKA_TEST_OUTPUT: invocationPath },
- });
+ await execFile(
+ deployment.operator.nodePath,
+ [deployment.operator.modulePath, 'activate', '--framed', '--root-id', 'a'.repeat(64)],
+ { env: { ...process.env, MAKA_TEST_OUTPUT: invocationPath } },
+ );
assert.deepEqual(JSON.parse(await readFile(invocationPath, 'utf8')), [
'runtime-host',
'activate',
@@ -848,9 +860,11 @@ test('managed operator binds its Client Data Root and routes deployment cleanup'
'a'.repeat(64),
]);
- await execFile(deployment.operatorPath, ['connect', '--framed', '--root-id', 'a'.repeat(64)], {
- env: { ...process.env, MAKA_TEST_OUTPUT: invocationPath },
- });
+ await execFile(
+ deployment.operator.nodePath,
+ [deployment.operator.modulePath, 'connect', '--framed', '--root-id', 'a'.repeat(64)],
+ { env: { ...process.env, MAKA_TEST_OUTPUT: invocationPath } },
+ );
assert.deepEqual(JSON.parse(await readFile(invocationPath, 'utf8')), [
'runtime-host',
'connect',
@@ -860,8 +874,9 @@ test('managed operator binds its Client Data Root and routes deployment cleanup'
]);
await execFile(
- deployment.operatorPath,
+ deployment.operator.nodePath,
[
+ deployment.operator.modulePath,
'__cleanup-managed-deployment',
'--expected-service-id',
serviceId,
diff --git a/packages/cli/src/__tests__/runtime-host-tui-context.test.ts b/packages/cli/src/__tests__/runtime-host-tui-context.test.ts
index 689b98979d..947d1b75a4 100644
--- a/packages/cli/src/__tests__/runtime-host-tui-context.test.ts
+++ b/packages/cli/src/__tests__/runtime-host-tui-context.test.ts
@@ -35,7 +35,12 @@ const ENVIRONMENT_PROFILE: RuntimeHostProfile = {
kind: 'environment',
provider: { kind: 'wsl', distribution: 'Ubuntu' },
rootId: 'b'.repeat(64),
- operatorPath: '/opt/maka/operator',
+ operator: {
+ kind: 'node',
+ platform: 'posix',
+ nodePath: '/usr/bin/node',
+ modulePath: '/opt/maka/operator.mjs',
+ },
};
const HOST_WORKSPACE_PROFILES = [REMOTE_PROFILE, ENVIRONMENT_PROFILE] as const;
diff --git a/packages/cli/src/cli-core.ts b/packages/cli/src/cli-core.ts
index 7c2fc2d315..4348e8eb6d 100644
--- a/packages/cli/src/cli-core.ts
+++ b/packages/cli/src/cli-core.ts
@@ -782,7 +782,7 @@ export async function runMakaCli(
id: command.id,
name: command.name,
distribution: command.distribution,
- operatorPath: command.operatorPath,
+ operator: command.operator,
expectedRootId: command.expectedRootId,
},
{},
diff --git a/packages/cli/src/runtime-host-cli.ts b/packages/cli/src/runtime-host-cli.ts
index 0fae0b15e8..73585417ae 100644
--- a/packages/cli/src/runtime-host-cli.ts
+++ b/packages/cli/src/runtime-host-cli.ts
@@ -22,9 +22,11 @@ import {
isProductReleaseVersion,
isSha512PackageIntegrity,
} from '@maka/runtime-host/operator/update-package-evidence';
-import type { RuntimeHostManagedUpdatePolicy } from '@maka/runtime-host/operator';
import {
+ decodeRuntimeHostOperatorCommand,
decodeRuntimeHostWebRtcStunPolicy,
+ type RuntimeHostManagedUpdatePolicy,
+ type RuntimeHostOperatorCommand,
type RuntimeHostWebRtcStunPolicy,
} from '@maka/runtime-host/operator';
import {
@@ -364,7 +366,7 @@ export type RuntimeHostCliCommand =
id: string;
name: string;
distribution: string;
- operatorPath: string;
+ operator: RuntimeHostOperatorCommand;
expectedRootId: string;
}
| { kind: 'runtime-host-profile-remove'; id: string }
@@ -1708,7 +1710,7 @@ function parseProfileCommand(argv: string[]): RuntimeHostCliCommand {
let sshWebSocketPath = '/runtime-host';
let sshWebSocketPathConfigured = false;
let wslDistribution: string | undefined;
- let operatorPath: string | undefined;
+ let operator: RuntimeHostOperatorCommand | undefined;
let expectedRootId: string | undefined;
let credentialEnv: string | undefined;
for (let index = 1; index < argv.length; index += 1) {
@@ -1723,7 +1725,7 @@ function parseProfileCommand(argv: string[]): RuntimeHostCliCommand {
argument !== '--ssh-remote-port' &&
argument !== '--ssh-websocket-path' &&
argument !== '--wsl-distribution' &&
- argument !== '--operator-path' &&
+ argument !== '--operator-command' &&
argument !== '--expected-root' &&
argument !== '--credential-env' &&
argument !== '--acknowledge-plaintext'
@@ -1748,7 +1750,13 @@ function parseProfileCommand(argv: string[]): RuntimeHostCliCommand {
sshWebSocketPathConfigured = true;
}
if (argument === '--wsl-distribution') wslDistribution = parsed;
- if (argument === '--operator-path') operatorPath = parsed;
+ if (argument === '--operator-command') {
+ try {
+ operator = decodeRuntimeHostOperatorCommand(JSON.parse(parsed));
+ } catch {
+ return error('--operator-command must be a valid Runtime Host operator command JSON value');
+ }
+ }
if (argument === '--expected-root') expectedRootId = parsed;
if (argument === '--credential-env') credentialEnv = parsed;
index += 1;
@@ -1766,11 +1774,11 @@ function parseProfileCommand(argv: string[]): RuntimeHostCliCommand {
'exactly one of --tls-url, --plaintext-url, --ssh-destination, or --wsl-distribution is required',
);
}
- if (wslDistribution && !operatorPath) {
- return error('--wsl-distribution requires --operator-path');
+ if (wslDistribution && !operator) {
+ return error('--wsl-distribution requires --operator-command');
}
- if (!wslDistribution && operatorPath) {
- return error('--operator-path requires --wsl-distribution');
+ if (!wslDistribution && operator) {
+ return error('--operator-command requires --wsl-distribution');
}
if (wslDistribution && credentialEnv) {
return error('WSL environment profiles do not accept --credential-env');
@@ -1806,7 +1814,7 @@ function parseProfileCommand(argv: string[]): RuntimeHostCliCommand {
id,
name,
distribution: wslDistribution,
- operatorPath: operatorPath!,
+ operator: operator!,
expectedRootId,
};
}
diff --git a/packages/cli/src/runtime-host-lifecycle-transaction.ts b/packages/cli/src/runtime-host-lifecycle-transaction.ts
index 60e24492a6..2b6723ae4b 100644
--- a/packages/cli/src/runtime-host-lifecycle-transaction.ts
+++ b/packages/cli/src/runtime-host-lifecycle-transaction.ts
@@ -859,7 +859,12 @@ export function runtimeHostReconciliationTriggerDefinition(
): RuntimeHostProviderDefinition {
const canonical = decodeRuntimeHostManagedDeploymentConfig(config);
return {
- command: [join(canonical.deploymentRoot, 'operator'), 'reconcile-update', '--framed'],
+ command: [
+ canonical.launch.nodePath,
+ join(canonical.deploymentRoot, 'operator.mjs'),
+ 'reconcile-update',
+ '--framed',
+ ],
};
}
diff --git a/packages/cli/src/runtime-host-managed-deployment.ts b/packages/cli/src/runtime-host-managed-deployment.ts
index 16bfb9977c..18dcc20737 100644
--- a/packages/cli/src/runtime-host-managed-deployment.ts
+++ b/packages/cli/src/runtime-host-managed-deployment.ts
@@ -18,6 +18,7 @@
*/
import { randomUUID } from 'node:crypto';
+import { spawn } from 'node:child_process';
import { constants } from 'node:fs';
import { access, lstat, mkdir, open, readdir, realpath, rename, rm } from 'node:fs/promises';
import { homedir } from 'node:os';
@@ -33,9 +34,11 @@ import {
import { readStableBoundedFile, syncDirectory } from '@maka/storage/stable-storage';
import { resolveExistingStorageRoot, tryAcquireStateRootOwner } from '@maka/storage/root-authority';
import {
+ createRuntimeHostOperatorCommand,
resolveRuntimeHostManagedDeploymentAuthorityRoot,
resolveRuntimeHostManagedDeploymentAuthority,
resolveRuntimeHostNpmDeploymentLayout,
+ type RuntimeHostOperatorCommand,
type RuntimeHostManagedDeploymentAuthorityOptions,
type RuntimeHostManagedDeploymentConfig,
} from '@maka/runtime-host/operator';
@@ -46,7 +49,7 @@ export interface RuntimeHostManagedPackageDeployment {
readonly version: string;
readonly root: string;
readonly cliPath: string;
- readonly operatorPath: string;
+ readonly operator: RuntimeHostOperatorCommand;
/** Legacy service replacement only; canonical deployments project the operator transactionally. */
activate(): Promise<void>;
cleanup(): Promise<void>;
@@ -429,11 +432,16 @@ function resolveRuntimeHostManagedDataHome(
): string {
const env = options.env ?? process.env;
const homeDir = options.homeDir ?? homedir();
- return (options.platform ?? process.platform) === 'darwin'
+ const platform = options.platform ?? process.platform;
+ return platform === 'darwin'
? join(homeDir, 'Library', 'Application Support')
- : env.XDG_DATA_HOME && isAbsolute(env.XDG_DATA_HOME)
- ? env.XDG_DATA_HOME
- : join(homeDir, '.local', 'share');
+ : platform === 'win32'
+ ? env.LOCALAPPDATA && isAbsolute(env.LOCALAPPDATA)
+ ? env.LOCALAPPDATA
+ : join(homeDir, 'AppData', 'Local')
+ : env.XDG_DATA_HOME && isAbsolute(env.XDG_DATA_HOME)
+ ? env.XDG_DATA_HOME
+ : join(homeDir, '.local', 'share');
}
export function resolveRuntimeHostManagedControlRoot(serviceId: string): string {
@@ -588,8 +596,37 @@ export async function removeRuntimeHostManagedDeployment(
// recognized as already complete and reclaimed by the next deployment.
await syncDirectory(parent);
}
- await rm(retiredRoot, { recursive: true, force: true });
- await syncDirectory(parent);
+ try {
+ await rm(retiredRoot, { recursive: true, force: true });
+ await syncDirectory(parent);
+ } catch (error) {
+ if (process.platform !== 'win32') throw error;
+ scheduleWindowsDeploymentCleanup(retiredRoot);
+ }
+}
+
+function scheduleWindowsDeploymentCleanup(path: string): void {
+ // Windows keeps loaded native addons locked until this operator exits. The
+ // deployment was already atomically renamed out of service, so a detached
+ // Node process can finish physical reclamation without owning lifecycle state.
+ const script = `const { rm } = require('node:fs/promises');
+const path = process.argv[1];
+const parent = Number(process.argv[2]);
+const wait = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+(async () => {
+ for (let attempt = 0; attempt < 3000; attempt += 1) {
+ try { process.kill(parent, 0); } catch { break; }
+ await wait(100);
+ }
+ await rm(path, { recursive: true, force: true, maxRetries: 100, retryDelay: 100 });
+})().catch(() => { process.exitCode = 1; });`;
+ const cleanup = spawn(process.execPath, ['-e', script, path, String(process.pid)], {
+ detached: true,
+ stdio: 'ignore',
+ windowsHide: true,
+ });
+ cleanup.on('error', () => undefined);
+ cleanup.unref();
}
function managedDeployment(
@@ -597,15 +634,20 @@ function managedDeployment(
clientDataRoot: string,
managedRootId: string,
): RuntimeHostManagedPackageDeployment {
- const operatorPath = join(staged.root, 'operator');
+ const modulePath = join(staged.root, 'operator.mjs');
+ const operator = createRuntimeHostOperatorCommand({
+ platform: process.platform === 'win32' ? 'win32' : 'posix',
+ nodePath: process.execPath,
+ modulePath,
+ });
return {
version: staged.version,
root: staged.root,
cliPath: staged.cliPath,
- operatorPath,
+ operator,
activate: () =>
writeOperatorLauncher(
- operatorPath,
+ modulePath,
process.execPath,
staged.cliPath,
clientDataRoot,
@@ -641,12 +683,7 @@ async function writeOperatorLauncher(
await file.close();
}
await rename(temporaryPath, path);
- const parent = await open(dirname(path), 'r');
- try {
- await parent.sync();
- } finally {
- await parent.close();
- }
+ await syncDirectory(dirname(path));
} finally {
await rm(temporaryPath, { force: true });
}
@@ -659,31 +696,38 @@ function operatorLauncherContents(
managedRootId: string,
deploymentId?: string,
): string {
- return [
- '#!/bin/sh',
- 'if [ "$#" -ge 1 ] && [ "$1" = "__cleanup-managed-deployment" ]; then',
- ' shift',
- ` exec ${quotePosix(nodePath)} ${quotePosix(cliPath)} runtime-host service cleanup-deployment "$@" --client-data-root ${quotePosix(clientDataRoot)} --managed-root-id ${quotePosix(managedRootId)}${deploymentId ? ` --operator-deployment-id ${quotePosix(deploymentId)}` : ''}`,
- 'fi',
- 'if [ "$#" -ge 1 ] && [ "$1" = "access" ]; then',
- ' shift',
- ` exec ${quotePosix(nodePath)} ${quotePosix(cliPath)} runtime-host access "$@"`,
- 'fi',
- 'if [ "$#" -ge 1 ] && [ "$1" = "activate" ]; then',
- ' shift',
- ` exec ${quotePosix(nodePath)} ${quotePosix(cliPath)} runtime-host activate "$@"`,
- 'fi',
- 'if [ "$#" -ge 1 ] && [ "$1" = "connect" ]; then',
- ' shift',
- ` exec ${quotePosix(nodePath)} ${quotePosix(cliPath)} runtime-host connect "$@"`,
- 'fi',
- 'if [ "$#" -ge 1 ] && [ "$1" = "serve" ]; then',
- ' shift',
- ` exec ${quotePosix(nodePath)} ${quotePosix(cliPath)} runtime-host serve "$@"`,
- 'fi',
- `exec ${quotePosix(nodePath)} ${quotePosix(cliPath)} runtime-host service "$@" --client-data-root ${quotePosix(clientDataRoot)} --managed-root-id ${quotePosix(managedRootId)}${deploymentId ? ` --operator-deployment-id ${quotePosix(deploymentId)}` : ''}`,
- '',
- ].join('\n');
+ const fixedServiceArguments = [
+ '--client-data-root',
+ clientDataRoot,
+ '--managed-root-id',
+ managedRootId,
+ ...(deploymentId ? ['--operator-deployment-id', deploymentId] : []),
+ ];
+ return `import { spawn } from 'node:child_process';
+
+const [action, ...args] = process.argv.slice(2);
+const direct = new Set(['access', 'activate', 'connect', 'serve']);
+const cliArgs = action === '__cleanup-managed-deployment'
+ ? ['runtime-host', 'service', 'cleanup-deployment', ...args, ...${JSON.stringify(fixedServiceArguments)}]
+ : direct.has(action)
+ ? ['runtime-host', action, ...args]
+ : ['runtime-host', 'service', ...(action === undefined ? [] : [action]), ...args, ...${JSON.stringify(fixedServiceArguments)}];
+const child = spawn(${JSON.stringify(nodePath)}, [${JSON.stringify(cliPath)}, ...cliArgs], {
+ stdio: 'inherit',
+ windowsHide: true,
+});
+for (const signal of ['SIGINT', 'SIGTERM']) {
+ process.on(signal, () => child.kill(signal));
+}
+child.once('error', (error) => {
+ console.error(error instanceof Error ? error.message : String(error));
+ process.exitCode = 1;
+});
+child.once('exit', (code, signal) => {
+ if (signal) process.kill(process.pid, signal);
+ else process.exitCode = code ?? 1;
+});
+`;
}
export async function convergeRuntimeHostManagedOperator(
@@ -695,7 +739,7 @@ export async function convergeRuntimeHostManagedOperator(
// The stable operator is the bounded cleanup and recovery route after authority
// is removed. Package cleanup removes it with the deployment root.
if (!desired) return;
- const operatorPath = join(deployment.deploymentRoot, 'operator');
+ const operatorPath = join(deployment.deploymentRoot, 'operator.mjs');
const layout = resolveRuntimeHostNpmDeploymentLayout(
desired.deploymentRoot,
desired.launch.package.integrity,
@@ -718,7 +762,7 @@ export async function restoreRuntimeHostLegacyManagedOperator(input: {
readonly serviceId: string;
}): Promise<void> {
await writeOperatorLauncher(
- join(input.deploymentRoot, 'operator'),
+ join(input.deploymentRoot, 'operator.mjs'),
input.nodePath,
input.cliPath,
input.clientDataRoot,
@@ -741,21 +785,19 @@ export async function verifyRuntimeHostManagedOperator(
config.deploymentId,
);
const observed = await readStableBoundedFile({
- path: join(config.deploymentRoot, 'operator'),
+ path: join(config.deploymentRoot, 'operator.mjs'),
maxBytes: Buffer.byteLength(expected),
invalidFile: () => new Error('The managed Runtime Host operator is not a stable regular file'),
}).then((contents) => new TextDecoder('utf-8', { fatal: true }).decode(contents));
if (observed !== expected)
throw new Error('The managed Runtime Host operator does not match its deployment');
- await access(join(config.deploymentRoot, 'operator'), constants.X_OK).catch((error: unknown) => {
- throw new Error('The managed Runtime Host operator is not executable', {
- cause: error,
- });
- });
-}
-
-function quotePosix(value: string): string {
- return `'${value.replaceAll("'", `'"'"'`)}'`;
+ await access(join(config.deploymentRoot, 'operator.mjs'), constants.R_OK).catch(
+ (error: unknown) => {
+ throw new Error('The managed Runtime Host operator is not readable', {
+ cause: error,
+ });
+ },
+ );
}
function isRecord(value: unknown): value is Record<string, unknown> {
diff --git a/packages/cli/src/runtime-host-profile-command.ts b/packages/cli/src/runtime-host-profile-command.ts
index 30339bf2f1..c710f06739 100644
--- a/packages/cli/src/runtime-host-profile-command.ts
+++ b/packages/cli/src/runtime-host-profile-command.ts
@@ -23,6 +23,7 @@ import {
type RuntimeHostRemoteTransport,
type RuntimeHostProfileCatalog,
} from '@maka/runtime-host/client';
+import type { RuntimeHostOperatorCommand } from '@maka/runtime-host/operator';
import { resolveMakaClientDataRoot } from '@maka/storage/workspace-root';
const DEFAULT_CREDENTIAL_ENV = 'MAKA_RUNTIME_HOST_ACCESS_CREDENTIAL';
@@ -42,7 +43,7 @@ export type RuntimeHostProfileCommand =
readonly id: string;
readonly name: string;
readonly distribution: string;
- readonly operatorPath: string;
+ readonly operator: RuntimeHostOperatorCommand;
readonly expectedRootId: string;
}
| { readonly kind: 'remove'; readonly id: string };
@@ -84,7 +85,7 @@ export async function runRuntimeHostProfileCommand(
name: command.name,
kind: 'environment',
provider: { kind: 'wsl', distribution: command.distribution },
- operatorPath: command.operatorPath,
+ operator: command.operator,
rootId: command.expectedRootId,
}
: {
diff --git a/packages/cli/src/runtime-host-setup-command.ts b/packages/cli/src/runtime-host-setup-command.ts
index e2a11e0176..db37143614 100644
--- a/packages/cli/src/runtime-host-setup-command.ts
+++ b/packages/cli/src/runtime-host-setup-command.ts
@@ -37,6 +37,7 @@ import {
RUNTIME_HOST_SETUP_ERROR_CODE_MAX_BYTES,
RUNTIME_HOST_SETUP_ERROR_MESSAGE_MAX_BYTES,
type RuntimeHostManagedDeploymentConfig,
+ type RuntimeHostOperatorCommand,
type RuntimeHostSetupFrame,
type RuntimeHostSetupPhase,
type RuntimeHostSupervisorProvider,
@@ -349,7 +350,7 @@ async function runRuntimeHostSupervisedSetupLocked(
): Promise<{
readonly serviceId: string;
readonly deploymentId: string;
- readonly operatorPath: string;
+ readonly operator: RuntimeHostOperatorCommand;
readonly rootPath: string;
readonly endpoint: string;
readonly directPeer?: {
@@ -541,7 +542,7 @@ async function runRuntimeHostSupervisedSetupLocked(
return {
serviceId: capability.rootId,
deploymentId: desired.deploymentId,
- operatorPath: deployment.operatorPath,
+ operator: deployment.operator,
rootPath: capability.canonicalPath,
endpoint: websocketUrl(websocket),
...(directPeer
@@ -808,7 +809,7 @@ async function runRuntimeHostOnDemandSetupLocked(
const reuseCurrent =
current?.lifecycle.mode === 'on_demand' && sameDesiredManagedDeployment(current, draft);
const config = reuseCurrent ? current : draft;
- let operatorPath: string | undefined;
+ let operator: RuntimeHostOperatorCommand | undefined;
let activation: Awaited<ReturnType<typeof activateRuntimeHostManagedDeployment>> | undefined;
const lifecycleDeps: RuntimeHostLifecycleTransactionDeps = {
convergeOperator: (currentConfig, desiredConfig) =>
@@ -849,7 +850,7 @@ async function runRuntimeHostOnDemandSetupLocked(
const desiredConfig: RuntimeHostManagedDeploymentConfig = current
? config
: { ...config, deploymentRoot: deployment.root };
- operatorPath = deployment.operatorPath;
+ operator = deployment.operator;
emit({ kind: 'progress', phase: 'installing_service' });
if (legacyToMigrate && legacyBackend) {
await legacyBackend.verifyDeployment(legacyToMigrate, {
@@ -905,7 +906,7 @@ async function runRuntimeHostOnDemandSetupLocked(
throw error;
}
});
- if (!operatorPath)
+ if (!operator)
throw new RuntimeHostSetupError('deployment_failed', 'Setup did not install an operator');
activation = await deps.activateManaged({ rootId: capability.rootId });
@@ -926,7 +927,7 @@ async function runRuntimeHostOnDemandSetupLocked(
{
serviceId,
deploymentId: config.deploymentId,
- operatorPath,
+ operator,
rootPath: capability.canonicalPath,
endpoint: websocketUrl({
host: activation.endpoint.host,
@@ -1079,7 +1080,7 @@ async function pairAndVerifyRuntimeHostSetup(
target: {
readonly serviceId: string;
readonly deploymentId: string;
- readonly operatorPath: string;
+ readonly operator: RuntimeHostOperatorCommand;
readonly rootPath: string;
readonly endpoint: string;
readonly directPeer?: {
@@ -1145,7 +1146,7 @@ async function pairAndVerifyRuntimeHostSetup(
version: options.version,
serviceId: target.serviceId,
deploymentId: target.deploymentId,
- operatorPath: target.operatorPath,
+ operator: target.operator,
rootPath: target.rootPath,
rootId: paired.rootId,
endpoint: target.endpoint,
diff --git a/packages/cli/src/runtime-host-update-command.ts b/packages/cli/src/runtime-host-update-command.ts
index 9914640edd..8e89649031 100644
--- a/packages/cli/src/runtime-host-update-command.ts
+++ b/packages/cli/src/runtime-host-update-command.ts
@@ -22,6 +22,7 @@ import { dirname, join, resolve } from 'node:path';
import { truncateUtf8 } from '@maka/core/diagnostic-log';
import { activateRuntimeHostManagedDeployment } from '@maka/runtime-host/client';
import {
+ createRuntimeHostOperatorCommand,
decodeRuntimeHostServiceManagementFrame,
encodeRuntimeHostServiceManagementFrame,
RUNTIME_HOST_SERVICE_ERROR_CODE_MAX_BYTES,
@@ -29,7 +30,9 @@ import {
RUNTIME_HOST_OPERATOR_ACCESS_MANAGEMENT_CAPABILITY,
RUNTIME_HOST_OPERATOR_CAPABILITY_REQUEST_ENV,
RUNTIME_HOST_OPERATOR_PROCESS_LIFETIME_LOCK_CAPABILITY,
+ runtimeHostOperatorInvocation,
type RuntimeHostOperatorCapability,
+ type RuntimeHostOperatorCommand,
type RuntimeHostServiceManagementFrame,
type RuntimeHostServiceUpdatePhase,
RuntimeHostManagedDeploymentError as RuntimeHostDeploymentAuthorityError,
@@ -130,7 +133,7 @@ interface RuntimeHostUpdateCliDeps {
readonly createBackend: (serviceId: string, clientDataRoot: string) => RuntimeHostServiceBackend;
readonly verifyReady: typeof verifyRuntimeHostManagedServiceReady;
readonly runOperator: (
- operatorPath: string,
+ operator: RuntimeHostOperatorCommand,
args: readonly string[],
invocation?: RuntimeHostOperatorInvocation,
) => Promise<RuntimeHostServiceManagementFrame>;
@@ -349,14 +352,18 @@ export async function runManagedRuntimeHostUpdateCli(
}
}
- const currentOperatorPath = join(serviceConfig.managedDeploymentRoot, 'operator');
+ const currentOperator = createRuntimeHostOperatorCommand({
+ platform: process.platform === 'win32' ? 'win32' : 'posix',
+ nodePath: serviceConfig.launch.nodePath,
+ modulePath: join(serviceConfig.managedDeploymentRoot, 'operator.mjs'),
+ });
let currentOperatorUsesProcessLifetimeLock = false;
let currentOperatorUnavailable = false;
if (status.service.active) {
try {
currentOperatorUsesProcessLifetimeLock = operatorUsesProcessLifetimeLock(
await deps.runOperator(
- currentOperatorPath,
+ currentOperator,
['status', '--framed', ...expectedTargetArgs(options.expectedTarget)],
{
capabilityRequest: RUNTIME_HOST_OPERATOR_PROCESS_LIFETIME_LOCK_CAPABILITY,
@@ -409,9 +416,9 @@ export async function runManagedRuntimeHostUpdateCli(
emit(progress('retiring', currentVersion, options.version));
const runCurrentOperator = (args: readonly string[]) =>
currentOperatorUsesProcessLifetimeLock
- ? deps.runOperator(currentOperatorPath, args)
+ ? deps.runOperator(currentOperator, args)
: deps.withLegacyOperatorLeases(options.clientDataRoot, (inheritedFds) =>
- deps.runOperator(currentOperatorPath, args, {
+ deps.runOperator(currentOperator, args, {
inheritedFds,
}),
);
@@ -1090,13 +1097,14 @@ function operatorCapabilities(): {
}
async function runManagedRuntimeHostOperator(
- operatorPath: string,
+ operator: RuntimeHostOperatorCommand,
args: readonly string[],
invocation: RuntimeHostOperatorInvocation = {},
): Promise<RuntimeHostServiceManagementFrame> {
return new Promise((resolve, reject) => {
const inheritedFds = invocation.inheritedFds ?? [];
- const child = spawn(operatorPath, [...args], {
+ const command = runtimeHostOperatorInvocation(operator, args);
+ const child = spawn(command.executable, [...command.args], {
// A detached legacy operator keeps the inherited advisory leases alive if
// this updater is interrupted, so an exact retry never steals active work.
detached: process.platform !== 'win32',
diff --git a/packages/runtime-host/src/__tests__/host-profile.test.ts b/packages/runtime-host/src/__tests__/host-profile.test.ts
index cd36ca4212..3fd209b9fb 100644
--- a/packages/runtime-host/src/__tests__/host-profile.test.ts
+++ b/packages/runtime-host/src/__tests__/host-profile.test.ts
@@ -54,6 +54,12 @@ import { RuntimeHostPeerError } from '../transport/peer-native.js';
const ROOT_A = 'a'.repeat(64);
const ROOT_B = 'b'.repeat(64);
+const OPERATOR = {
+ kind: 'node',
+ platform: 'posix',
+ nodePath: '/usr/bin/node',
+ modulePath: '/opt/maka/operator.mjs',
+} as const;
const temporaryDirectories: string[] = [];
afterEach(async () => {
@@ -64,14 +70,14 @@ describe('Runtime Host profiles', () => {
test('persists WSL environments without projecting a remote credential', async () => {
const path = await profilePath();
const catalog = createFileRuntimeHostProfileCatalog(path, memoryCredentials());
- assert.deepEqual(await catalog.read(), { schemaVersion: 4, profiles: [] });
+ assert.deepEqual(await catalog.read(), { schemaVersion: 5, profiles: [] });
await catalog.create({
id: 'ubuntu',
name: 'Ubuntu',
kind: 'environment',
provider: { kind: 'wsl', distribution: 'Ubuntu-24.04' },
rootId: ROOT_A,
- operatorPath: '/home/operator/.local/share/maka/operator',
+ operator: OPERATOR,
});
assert.deepEqual(await catalog.resolve('ubuntu'), {
profile: {
@@ -80,7 +86,7 @@ describe('Runtime Host profiles', () => {
kind: 'environment',
provider: { kind: 'wsl', distribution: 'Ubuntu-24.04' },
rootId: ROOT_A,
- operatorPath: '/home/operator/.local/share/maka/operator',
+ operator: OPERATOR,
},
});
assert.doesNotMatch(await readFile(path, 'utf8'), /credential/u);
@@ -124,7 +130,7 @@ describe('Runtime Host profiles', () => {
);
assert.deepEqual(await catalog.read(), {
- schemaVersion: 4,
+ schemaVersion: 5,
profiles: [
{
id: 'office',
@@ -147,7 +153,7 @@ describe('Runtime Host profiles', () => {
if (process.platform !== 'win32') assert.equal((await stat(path)).mode & 0o777, 0o600);
assert.deepEqual(await catalog.remove('office'), {
- schemaVersion: 4,
+ schemaVersion: 5,
profiles: [
{
id: 'backup',
@@ -200,7 +206,7 @@ describe('Runtime Host profiles', () => {
const catalog = createFileRuntimeHostProfileCatalog(path, memoryCredentials());
const document = await catalog.read();
- assert.equal(document.schemaVersion, 4);
+ assert.equal(document.schemaVersion, 5);
assert.equal(
(JSON.parse(await readFile(path, 'utf8')) as { schemaVersion: number }).schemaVersion,
1,
@@ -220,7 +226,7 @@ describe('Runtime Host profiles', () => {
transport: {
kind: 'ssh',
destination: 'operator@example.com',
- activation: { kind: 'ssh_operator', operatorPath: '/opt/maka/bin/operator' },
+ activation: { kind: 'ssh_operator', operator: OPERATOR },
},
rootId: ROOT_B,
},
@@ -228,7 +234,7 @@ describe('Runtime Host profiles', () => {
);
assert.equal(
(JSON.parse(await readFile(path, 'utf8')) as { schemaVersion: number }).schemaVersion,
- 2,
+ 5,
);
});
@@ -281,7 +287,7 @@ describe('Runtime Host profiles', () => {
assert.deepEqual(await desktop.removeIfCurrent(created), {
removed: false,
document: {
- schemaVersion: 4,
+ schemaVersion: 5,
profiles: [
{
...profile,
@@ -295,7 +301,7 @@ describe('Runtime Host profiles', () => {
assert.equal(rotated.credential, 'rotated-token');
assert.equal(rotated.profileIncarnationId, created.profileIncarnationId);
assert.equal((await desktop.removeIfCurrent(rotated)).removed, true);
- assert.deepEqual(await desktop.read(), { schemaVersion: 4, profiles: [] });
+ assert.deepEqual(await desktop.read(), { schemaVersion: 5, profiles: [] });
});
test('conditionally updates one Host connection and credential', async () => {
@@ -657,7 +663,7 @@ describe('Runtime Host profiles', () => {
assert.equal(sameRemoteRuntimeHostProfileTarget(original, moved), true);
assert.equal(sameRemoteRuntimeHostProfileTarget(original, replacement), false);
assert.deepEqual(
- decodeRuntimeHostProfileDocument({ schemaVersion: 4, profiles: [moved] }).profiles[0],
+ decodeRuntimeHostProfileDocument({ schemaVersion: 5, profiles: [moved] }).profiles[0],
moved,
);
});
@@ -858,7 +864,7 @@ describe('Runtime Host profiles', () => {
transport: {
kind: 'ssh',
destination: 'operator@example.com',
- activation: { kind: 'ssh_operator', operatorPath: '/opt/maka/operator' },
+ activation: { kind: 'ssh_operator', operator: OPERATOR },
},
rootId: ROOT_A,
},
@@ -869,7 +875,7 @@ describe('Runtime Host profiles', () => {
{
activateSshOperator: async (input) => {
events.push('activate');
- assert.equal(input.operatorPath, '/opt/maka/operator');
+ assert.deepEqual(input.operator, OPERATOR);
assert.equal(input.rootId, ROOT_A);
assert.equal(input.interaction, 'terminal');
return {
diff --git a/packages/runtime-host/src/__tests__/ssh-operator-activation.test.ts b/packages/runtime-host/src/__tests__/ssh-operator-activation.test.ts
index a5550260eb..6659ab7732 100644
--- a/packages/runtime-host/src/__tests__/ssh-operator-activation.test.ts
+++ b/packages/runtime-host/src/__tests__/ssh-operator-activation.test.ts
@@ -44,13 +44,20 @@ const RESULT = {
endpoint: { host: '127.0.0.1', port: 45_678, websocketPath: '/runtime-host' },
} as const;
+const operator = (modulePath: string) => ({
+ kind: 'node' as const,
+ platform: 'posix' as const,
+ nodePath: '/usr/bin/node',
+ modulePath,
+});
+
test('SSH activation accepts a strict final frame that drains after process exit', async () => {
let invocation: Parameters<RuntimeHostSshOperatorProcessFactory>[0] | undefined;
const result = await activateRuntimeHostSshOperator(
{
destination: 'operator@example.com',
sshPort: 2222,
- operatorPath: "/opt/maka/operator's bin",
+ operator: operator("/opt/maka/operator's bin"),
rootId: ROOT_ID,
interaction: 'batch',
},
@@ -83,7 +90,7 @@ test('SSH activation accepts a strict final frame that drains after process exit
'-p',
'2222',
'operator@example.com',
- `'${"/opt/maka/operator's bin".replaceAll("'", `'"'"'`)}' activate --framed --root-id ${ROOT_ID}`,
+ `exec '/usr/bin/node' '${"/opt/maka/operator's bin".replaceAll("'", `'"'"'`)}' 'activate' '--framed' '--root-id' '${ROOT_ID}'`,
]);
});
@@ -92,7 +99,7 @@ test('SSH activation rejects multiple framed results', async () => {
activateRuntimeHostSshOperator(
{
destination: 'operator@example.com',
- operatorPath: '/opt/maka/operator',
+ operator: operator('/opt/maka/operator.mjs'),
rootId: ROOT_ID,
interaction: 'batch',
},
@@ -117,7 +124,7 @@ test('SSH activation kills and rejects oversized operator output', async () => {
activateRuntimeHostSshOperator(
{
destination: 'operator@example.com',
- operatorPath: '/opt/maka/operator',
+ operator: operator('/opt/maka/operator.mjs'),
rootId: ROOT_ID,
interaction: 'batch',
},
diff --git a/packages/runtime-host/src/__tests__/wsl-environment.test.ts b/packages/runtime-host/src/__tests__/wsl-environment.test.ts
index 722be8d464..d024e3cbc5 100644
--- a/packages/runtime-host/src/__tests__/wsl-environment.test.ts
+++ b/packages/runtime-host/src/__tests__/wsl-environment.test.ts
@@ -22,6 +22,13 @@ import { spawn, type ChildProcessWithoutNullStreams } from 'node:child_process';
import test from 'node:test';
import { connectRuntimeHostWslEnvironment } from '../client/wsl-environment.js';
+const operator = (modulePath: string) => ({
+ kind: 'node' as const,
+ platform: 'posix' as const,
+ nodePath: '/usr/bin/node',
+ modulePath,
+});
+
test('passes WSL target values as literal argv to the absolute operator', async () => {
const sentinel = new Error('stop after argv capture');
let invocation: { readonly executable: string; readonly args: readonly string[] } | undefined;
@@ -29,7 +36,7 @@ test('passes WSL target values as literal argv to the absolute operator', async
connectRuntimeHostWslEnvironment(
{
distribution: 'Ubuntu work; echo unsafe',
- operatorPath: "/opt/Maka operator's/bin/maka-operator",
+ operator: operator("/opt/Maka operator's/bin/maka-operator.mjs"),
rootId: 'a'.repeat(64),
clientInstanceId: 'desktop-test',
},
@@ -49,7 +56,8 @@ test('passes WSL target values as literal argv to the absolute operator', async
'--distribution',
'Ubuntu work; echo unsafe',
'--exec',
- "/opt/Maka operator's/bin/maka-operator",
+ '/usr/bin/node',
+ "/opt/Maka operator's/bin/maka-operator.mjs",
'connect',
'--framed',
'--root-id',
@@ -66,7 +74,7 @@ test('owns WSL bridge cancellation without emitting a child-stream error', async
const connection = connectRuntimeHostWslEnvironment(
{
distribution: 'Ubuntu',
- operatorPath: '/opt/maka/operator',
+ operator: operator('/opt/maka/operator.mjs'),
rootId: 'a'.repeat(64),
clientInstanceId: 'desktop-test',
signal: abort.signal,
@@ -94,7 +102,7 @@ test('contains oversized WSL bridge diagnostics inside the connection failure',
connectRuntimeHostWslEnvironment(
{
distribution: 'Ubuntu',
- operatorPath: '/opt/maka/operator',
+ operator: operator('/opt/maka/operator.mjs'),
rootId: 'a'.repeat(64),
clientInstanceId: 'desktop-test',
handshakeTimeoutMs: 10_000,
diff --git a/packages/runtime-host/src/client/host-profile.ts b/packages/runtime-host/src/client/host-profile.ts
index 632cfdc428..cdc9a76650 100644
--- a/packages/runtime-host/src/client/host-profile.ts
+++ b/packages/runtime-host/src/client/host-profile.ts
@@ -20,7 +20,7 @@
import { createHash, randomUUID } from 'node:crypto';
import { watch } from 'node:fs';
import { chmod, mkdir, open, readFile, rename, rm } from 'node:fs/promises';
-import { dirname, join, posix } from 'node:path';
+import { dirname, join } from 'node:path';
import { createFileCredentialStore, type CredentialStore } from '@maka/storage/credential-store';
import { withFileUpdateLock } from '@maka/storage/file-update-lock';
import {
@@ -31,6 +31,10 @@ import {
requireClientInstanceId,
requireHostRootId,
} from '../protocol/index.js';
+import {
+ decodeRuntimeHostOperatorCommand,
+ type RuntimeHostOperatorCommand,
+} from '../operator/operator-command.js';
import type { RuntimeHostProfileOfKind } from '../profile-kind.js';
import {
connectRemoteRuntimeHost,
@@ -64,11 +68,10 @@ import { waitForRuntimeHostReady } from './wait-for-ready.js';
import {
connectRuntimeHostWslEnvironment,
normalizeRuntimeHostWslDistribution,
- normalizeRuntimeHostWslOperatorPath,
type RuntimeHostWslProcessFactory,
} from './wsl-environment.js';
-const PROFILE_SCHEMA_VERSION = 4;
+const PROFILE_SCHEMA_VERSION = 5;
const CLIENT_PROFILE_DOCUMENT_NAME = 'runtime-host-profiles.json';
const PROFILE_DOCUMENT_MAX_BYTES = 64 * 1024;
const PROFILE_COUNT_MAX = 32;
@@ -101,7 +104,7 @@ export interface EnvironmentRuntimeHostProfile extends RuntimeHostProfileOfKind<
readonly distribution: string;
};
readonly rootId: string;
- readonly operatorPath: string;
+ readonly operator: RuntimeHostOperatorCommand;
}
export interface RemoteRuntimeHostProfile extends RuntimeHostProfileOfKind<'remote'> {
@@ -143,7 +146,7 @@ export type RuntimeHostRemoteTransport =
readonly sshPort?: number;
readonly activation: {
readonly kind: 'ssh_operator';
- readonly operatorPath: string;
+ readonly operator: RuntimeHostOperatorCommand;
};
readonly remotePort?: never;
readonly websocketPath?: never;
@@ -408,7 +411,7 @@ export async function connectRuntimeHostProfile(
return (overrides.connectWsl ?? connectRuntimeHostWslEnvironment)(
{
distribution: input.profile.provider.distribution,
- operatorPath: input.profile.operatorPath,
+ operator: input.profile.operator,
rootId: input.profile.rootId,
clientInstanceId: input.clientInstanceId,
...(input.signal === undefined ? {} : { signal: input.signal }),
@@ -490,7 +493,7 @@ export async function connectRemoteRuntimeHostProfile(
? await (overrides.activateSshOperator ?? activateRuntimeHostSshOperator)({
destination: transport.destination,
...(transport.sshPort === undefined ? {} : { sshPort: transport.sshPort }),
- operatorPath: transport.activation.operatorPath,
+ operator: transport.activation.operator,
rootId: input.profile.rootId,
interaction: input.sshInteraction ?? 'batch',
...(input.signal === undefined ? {} : { signal: input.signal }),
@@ -802,14 +805,16 @@ export function decodeRuntimeHostProfileDocument(value: unknown): RuntimeHostPro
}
const profiles = record.profiles.map(decodePersistedRuntimeHostProfile);
if (
- record.schemaVersion === 1 &&
+ (record.schemaVersion as number) < PROFILE_SCHEMA_VERSION &&
profiles.some(
(profile) =>
profile.kind === 'environment' ||
(profile.transport.kind === 'ssh' && profile.transport.activation !== undefined),
)
) {
- throw new Error('Runtime Host profile schema 1 cannot contain activation');
+ throw new Error(
+ `Runtime Host profile schema ${PROFILE_SCHEMA_VERSION} is required for activation`,
+ );
}
if (
(record.schemaVersion as number) < 3 &&
@@ -1213,7 +1218,7 @@ export function decodeEnvironmentRuntimeHostProfile(value: unknown): Environment
'kind',
'provider',
'rootId',
- 'operatorPath',
+ 'operator',
]);
if (record.kind !== 'environment') {
throw new Error('Runtime Host environment profile kind must be environment');
@@ -1234,9 +1239,7 @@ export function decodeEnvironmentRuntimeHostProfile(value: unknown): Environment
),
}),
rootId: requireHostRootId(record.rootId),
- operatorPath: normalizeRuntimeHostWslOperatorPath(
- requireString(record.operatorPath, 'WSL operator path'),
- ),
+ operator: decodeRuntimeHostOperatorCommand(record.operator),
});
}
@@ -1317,17 +1320,17 @@ export function decodeRuntimeHostRemoteTransport(value: unknown): RuntimeHostRem
if (activated) {
const activation = requireExactRecord(record.activation, 'Runtime Host SSH activation', [
'kind',
- 'operatorPath',
+ 'operator',
]);
if (activation.kind !== 'ssh_operator') {
throw new Error('Runtime Host SSH activation kind is invalid');
}
- const operatorPath = requireOperatorPath(activation.operatorPath);
+ const operator = decodeRuntimeHostOperatorCommand(activation.operator);
return Object.freeze({
kind: 'ssh',
destination,
...(sshPort === undefined ? {} : { sshPort }),
- activation: Object.freeze({ kind: 'ssh_operator', operatorPath }),
+ activation: Object.freeze({ kind: 'ssh_operator', operator }),
});
}
const remotePort = requirePort(record.remotePort, 'Runtime Host SSH remote port');
@@ -1494,7 +1497,7 @@ function profileTargetBinding(profile: PersistedRuntimeHostProfile): string {
'environment',
normalized.provider.kind,
normalized.provider.distribution,
- normalized.operatorPath,
+ JSON.stringify(normalized.operator),
normalized.rootId,
].join('\0');
}
@@ -1518,7 +1521,7 @@ function transportCredentialBinding(transport: RuntimeHostRemoteTransport): stri
return `${transport.url}\0${transport.acknowledgement}`;
case 'ssh':
return transport.activation
- ? `${transport.destination}\0${transport.sshPort ?? ''}\0activate\0${transport.activation.operatorPath}`
+ ? `${transport.destination}\0${transport.sshPort ?? ''}\0activate\0${JSON.stringify(transport.activation.operator)}`
: `${transport.destination}\0${transport.sshPort ?? ''}\0${transport.remotePort}\0${transport.websocketPath}`;
case 'libp2p-direct':
return transport.reachability.lease.peerId;
@@ -1619,18 +1622,6 @@ function requireWebSocketPath(value: unknown): string {
return path;
}
-function requireOperatorPath(value: unknown): string {
- const path = requireString(value, 'Runtime Host SSH operator path');
- if (
- !posix.isAbsolute(path) ||
- Buffer.byteLength(path, 'utf8') > 4_096 ||
- /[\u0000-\u001f\u007f]/u.test(path)
- ) {
- throw new Error('Runtime Host SSH operator path must be an absolute POSIX path');
- }
- return posix.normalize(path);
-}
-
function requireRecord(value: unknown, label: string): Record<string, unknown> {
if (typeof value !== 'object' || value === null || Array.isArray(value)) {
throw new Error(`${label} must be an object`);
@@ -1667,20 +1658,18 @@ async function writeProfileDocument(
document: RuntimeHostProfileDocument,
): Promise<void> {
const schemaVersion = document.profiles.some(
- (profile) => profile.kind === 'remote' && profile.transport.kind === 'libp2p-direct',
+ (profile) =>
+ profile.kind === 'environment' ||
+ (profile.kind === 'remote' &&
+ (profile.transport.kind === 'libp2p-direct' ||
+ (profile.transport.kind === 'ssh' && profile.transport.activation !== undefined))),
)
? PROFILE_SCHEMA_VERSION
: document.profiles.some(
(profile) => profile.kind === 'remote' && profile.access === 'session_guest',
)
? 3
- : document.profiles.some(
- (profile) =>
- profile.kind === 'environment' ||
- (profile.transport.kind === 'ssh' && profile.transport.activation !== undefined),
- )
- ? 2
- : 1;
+ : 1;
const encoded = `${JSON.stringify({ ...document, schemaVersion }, null, 2)}\n`;
if (Buffer.byteLength(encoded, 'utf8') > PROFILE_DOCUMENT_MAX_BYTES) {
throw new Error('Runtime Host profile document exceeds its size limit');
diff --git a/packages/runtime-host/src/client/index.ts b/packages/runtime-host/src/client/index.ts
index bb5a98bfb9..0274e75c02 100644
--- a/packages/runtime-host/src/client/index.ts
+++ b/packages/runtime-host/src/client/index.ts
@@ -87,6 +87,7 @@ export {
export {
RuntimeHostSshOperatorActivationError,
activateRuntimeHostSshOperator,
+ runtimeHostSshOperatorRemoteCommand,
type RuntimeHostSshOperatorActivationInput,
} from './ssh-operator-activation.js';
export {
diff --git a/packages/runtime-host/src/client/ssh-operator-activation.ts b/packages/runtime-host/src/client/ssh-operator-activation.ts
index 7ea035db5c..38a0346a71 100644
--- a/packages/runtime-host/src/client/ssh-operator-activation.ts
+++ b/packages/runtime-host/src/client/ssh-operator-activation.ts
@@ -18,13 +18,18 @@
*/
import { spawn } from 'node:child_process';
-import { posix } from 'node:path';
+import { posix, win32 } from 'node:path';
import { finished } from 'node:stream/promises';
import {
RUNTIME_HOST_ACTIVATION_FRAME_MAX_BYTES,
decodeRuntimeHostActivationFrame,
type RuntimeHostActivationResult,
} from '../operator/index.js';
+import {
+ decodeRuntimeHostOperatorCommand,
+ runtimeHostOperatorInvocation,
+ type RuntimeHostOperatorCommand,
+} from '../operator/operator-command.js';
import { requireHostRootId } from '../protocol/index.js';
import {
normalizeRuntimeHostSshDestination,
@@ -36,7 +41,7 @@ const DEFAULT_TIMEOUT_MS = 120_000;
export interface RuntimeHostSshOperatorActivationInput {
readonly destination: string;
readonly sshPort?: number;
- readonly operatorPath: string;
+ readonly operator: RuntimeHostOperatorCommand;
readonly rootId: string;
readonly interaction: RuntimeHostSshInteraction;
readonly signal?: AbortSignal;
@@ -77,13 +82,18 @@ export async function activateRuntimeHostSshOperator(
}
const destination = normalizeRuntimeHostSshDestination(input.destination);
const sshPort = input.sshPort === undefined ? undefined : requirePort(input.sshPort);
- const operatorPath = requireOperatorPath(input.operatorPath);
+ const operator = decodeRuntimeHostOperatorCommand(input.operator);
const rootId = requireHostRootId(input.rootId);
const timeoutMs = input.timeoutMs ?? DEFAULT_TIMEOUT_MS;
if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > DEFAULT_TIMEOUT_MS) {
throw new RangeError('Runtime Host SSH activation timeout must be between 1 and 120000 ms');
}
- const remoteCommand = `${quotePosix(operatorPath)} activate --framed --root-id ${rootId}`;
+ const remoteCommand = runtimeHostSshOperatorRemoteCommand(operator, [
+ 'activate',
+ '--framed',
+ '--root-id',
+ rootId,
+ ]);
const args = [
'-T',
'-o',
@@ -110,6 +120,49 @@ export async function activateRuntimeHostSshOperator(
return waitForActivation(child, input, timeoutMs);
}
+export function runtimeHostSshOperatorRemoteCommand(
+ operator: RuntimeHostOperatorCommand,
+ args: readonly string[],
+ environment: Readonly<Record<string, string>> = {},
+ options: { readonly missingOperatorIsSuccess?: boolean } = {},
+): string {
+ const invocation = runtimeHostOperatorInvocation(operator, args);
+ const entries = Object.entries(environment);
+ for (const [name] of entries) {
+ if (!/^[A-Z][A-Z0-9_]*$/u.test(name)) {
+ throw new Error('Runtime Host operator environment variable name is invalid');
+ }
+ }
+ if (operator.platform === 'posix') {
+ const command = [invocation.executable, ...invocation.args].map(quotePosix).join(' ');
+ const variables = entries.map(([name, value]) => `${name}=${quotePosix(value)}`).join(' ');
+ const execute = `exec ${variables ? `${variables} ` : ''}${command}`;
+ if (!options.missingOperatorIsSuccess) return execute;
+ const artifact = quotePosix(operator.modulePath);
+ const deploymentRoot = quotePosix(posix.dirname(operator.modulePath));
+ return `if [ ! -e ${artifact} ]; then [ ! -e ${deploymentRoot} ] && exit 0; exit 1; fi; ${execute}`;
+ }
+ const payload = Buffer.from(
+ JSON.stringify({
+ ...invocation,
+ environment,
+ modulePath: operator.modulePath,
+ deploymentRoot: win32.dirname(operator.modulePath),
+ missingOperatorIsSuccess: options.missingOperatorIsSuccess === true,
+ }),
+ 'utf8',
+ ).toString('base64');
+ const script = [
+ `$p=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${payload}'))|ConvertFrom-Json`,
+ `if($p.missingOperatorIsSuccess -and -not (Test-Path -LiteralPath $p.modulePath -PathType Leaf)){if(-not (Test-Path -LiteralPath $p.deploymentRoot)){exit 0}else{exit 1}}`,
+ `foreach($e in $p.environment.psobject.Properties){[Environment]::SetEnvironmentVariable($e.Name,[string]$e.Value,'Process')}`,
+ `& ([string]$p.executable) @($p.args|ForEach-Object {[string]$_})`,
+ `exit $LASTEXITCODE`,
+ ].join(';');
+ const encoded = Buffer.from(script, 'utf16le').toString('base64');
+ return `powershell.exe -NoLogo -NoProfile -NonInteractive -EncodedCommand ${encoded}`;
+}
+
async function waitForActivation(
child: RuntimeHostSshOperatorProcess,
input: RuntimeHostSshOperatorActivationInput,
@@ -203,17 +256,6 @@ function spawnSshOperatorProcess(input: {
};
}
-function requireOperatorPath(value: string): string {
- if (
- !posix.isAbsolute(value) ||
- Buffer.byteLength(value, 'utf8') > 4_096 ||
- /[\u0000-\u001f\u007f]/u.test(value)
- ) {
- throw new Error('Runtime Host SSH operator path must be an absolute POSIX path');
- }
- return posix.normalize(value);
-}
-
function requirePort(value: number): number {
if (!Number.isInteger(value) || value < 1 || value > 65_535) {
throw new RangeError('Runtime Host SSH port must be between 1 and 65535');
diff --git a/packages/runtime-host/src/client/wsl-environment.ts b/packages/runtime-host/src/client/wsl-environment.ts
index 56b9a01f03..9bf0274b1c 100644
--- a/packages/runtime-host/src/client/wsl-environment.ts
+++ b/packages/runtime-host/src/client/wsl-environment.ts
@@ -18,6 +18,11 @@
*/
import type { ChildProcessWithoutNullStreams } from 'node:child_process';
+import {
+ decodeRuntimeHostOperatorCommand,
+ runtimeHostOperatorInvocation,
+ type RuntimeHostOperatorCommand,
+} from '../operator/operator-command.js';
import {
INTERACTIVE_RUNTIME_HOST_COMPOSITION_ID,
RUNTIME_HOST_PROTOCOL_VERSION,
@@ -63,7 +68,7 @@ export {
export interface RuntimeHostWslEnvironmentInput {
readonly distribution: string;
- readonly operatorPath: string;
+ readonly operator: RuntimeHostOperatorCommand;
readonly rootId: string;
readonly clientInstanceId: string;
readonly signal?: AbortSignal;
@@ -81,20 +86,26 @@ export async function connectRuntimeHostWslEnvironment(
): Promise<RuntimeHostConnection> {
input.signal?.throwIfAborted();
const distribution = normalizeRuntimeHostWslDistribution(input.distribution);
- const operatorPath = normalizeRuntimeHostWslOperatorPath(input.operatorPath);
+ const operator = decodeRuntimeHostOperatorCommand(input.operator);
+ if (operator.platform !== 'posix') {
+ throw new Error('WSL Runtime Host operator must target POSIX');
+ }
const rootId = requireHostRootId(input.rootId);
const processFactory = overrides.processFactory ?? spawnRuntimeHostWslProcess;
- const child = processFactory(overrides.wslExecutable ?? resolveSystemRuntimeHostWslExecutable(), [
- '--distribution',
- distribution,
- '--exec',
- operatorPath,
+ const invocation = runtimeHostOperatorInvocation(operator, [
'connect',
'--framed',
'--root-id',
rootId,
'--repair-root-after-remount',
]);
+ const child = processFactory(overrides.wslExecutable ?? resolveSystemRuntimeHostWslExecutable(), [
+ '--distribution',
+ distribution,
+ '--exec',
+ invocation.executable,
+ ...invocation.args,
+ ]);
const resource = new WslProcessByteStream(child);
const transport = new FramedByteStreamTransport(resource);
const abort = () => transport.abort(abortReason(input.signal));
diff --git a/packages/runtime-host/src/operator/index.ts b/packages/runtime-host/src/operator/index.ts
index 61c7cd2d24..8e1b09ff8e 100644
--- a/packages/runtime-host/src/operator/index.ts
+++ b/packages/runtime-host/src/operator/index.ts
@@ -94,6 +94,13 @@ export {
type RuntimeHostSetupFrame,
type RuntimeHostSetupPhase,
} from './setup-frame.js';
+export {
+ createRuntimeHostOperatorCommand,
+ decodeRuntimeHostOperatorCommand,
+ runtimeHostOperatorInvocation,
+ type RuntimeHostOperatorCommand,
+ type RuntimeHostOperatorPlatform,
+} from './operator-command.js';
export {
RUNTIME_HOST_SETUP_SOURCE_PACKAGE_INTEGRITY_ENV,
compareProductReleaseVersions,
diff --git a/packages/runtime-host/src/operator/operator-command.ts b/packages/runtime-host/src/operator/operator-command.ts
new file mode 100644
index 0000000000..01bceae9ad
--- /dev/null
+++ b/packages/runtime-host/src/operator/operator-command.ts
@@ -0,0 +1,97 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { posix, win32 } from 'node:path';
+
+const PATH_MAX_BYTES = 4 * 1024;
+
+export type RuntimeHostOperatorPlatform = 'posix' | 'win32';
+
+/** A stable operator entrypoint with no target-shell dependency. */
+export interface RuntimeHostOperatorCommand {
+ readonly kind: 'node';
+ readonly platform: RuntimeHostOperatorPlatform;
+ readonly nodePath: string;
+ readonly modulePath: string;
+}
+
+export function createRuntimeHostOperatorCommand(input: {
+ readonly platform: RuntimeHostOperatorPlatform;
+ readonly nodePath: string;
+ readonly modulePath: string;
+}): RuntimeHostOperatorCommand {
+ return Object.freeze({
+ kind: 'node',
+ platform: input.platform,
+ nodePath: requireAbsolutePath(input.nodePath, input.platform, 'operator Node path'),
+ modulePath: requireAbsolutePath(input.modulePath, input.platform, 'operator module path'),
+ });
+}
+
+export function decodeRuntimeHostOperatorCommand(value: unknown): RuntimeHostOperatorCommand {
+ if (!value || typeof value !== 'object' || Array.isArray(value)) {
+ throw new Error('Runtime Host operator command is invalid');
+ }
+ const record = value as Record<string, unknown>;
+ const keys = Object.keys(record).sort();
+ const expected = ['kind', 'modulePath', 'nodePath', 'platform'];
+ if (keys.length !== expected.length || keys.some((key, index) => key !== expected[index])) {
+ throw new Error('Runtime Host operator command has unexpected fields');
+ }
+ if (record.kind !== 'node') throw new Error('Runtime Host operator command kind is invalid');
+ if (record.platform !== 'posix' && record.platform !== 'win32') {
+ throw new Error('Runtime Host operator platform is invalid');
+ }
+ return createRuntimeHostOperatorCommand({
+ platform: record.platform,
+ nodePath: requireString(record.nodePath, 'Runtime Host operator Node path'),
+ modulePath: requireString(record.modulePath, 'Runtime Host operator module path'),
+ });
+}
+
+export function runtimeHostOperatorInvocation(
+ command: RuntimeHostOperatorCommand,
+ args: readonly string[],
+): { readonly executable: string; readonly args: readonly string[] } {
+ const normalized = decodeRuntimeHostOperatorCommand(command);
+ return {
+ executable: normalized.nodePath,
+ args: [normalized.modulePath, ...args],
+ };
+}
+
+function requireAbsolutePath(
+ value: string,
+ platform: RuntimeHostOperatorPlatform,
+ label: string,
+): string {
+ if (
+ Buffer.byteLength(value, 'utf8') > PATH_MAX_BYTES ||
+ /[\u0000-\u001f\u007f]/u.test(value) ||
+ !(platform === 'win32' ? win32.isAbsolute(value) : posix.isAbsolute(value))
+ ) {
+ throw new Error(`Runtime Host ${label} must be an absolute ${platform} path`);
+ }
+ return value;
+}
+
+function requireString(value: unknown, label: string): string {
+ if (typeof value !== 'string' || value.length === 0) throw new Error(`${label} is invalid`);
+ return value;
+}
diff --git a/packages/runtime-host/src/operator/setup-frame.ts b/packages/runtime-host/src/operator/setup-frame.ts
index aa74d34aed..e1dbfb214a 100644
--- a/packages/runtime-host/src/operator/setup-frame.ts
+++ b/packages/runtime-host/src/operator/setup-frame.ts
@@ -19,6 +19,7 @@
import { z } from 'zod';
import { isCanonicalRuntimeHostWebSocketPath } from '../protocol/index.js';
+import { decodeRuntimeHostOperatorCommand } from './operator-command.js';
export const RUNTIME_HOST_SETUP_FRAME_PREFIX = 'MAKA_RUNTIME_HOST_SETUP_V1 ';
const SETUP_FRAME_MAX_BYTES = 32 * 1024;
@@ -61,9 +62,17 @@ const SETUP_FRAME_SCHEMA = z.discriminatedUnion('kind', [
version: boundedString(128),
serviceId: z.string().regex(/^[a-f0-9]{64}$/u),
deploymentId: z.string().uuid(),
- operatorPath: boundedString(4 * 1024).refine(
- (value) => value.startsWith('/') && !/[\u0000-\u001f\u007f]/u.test(value),
- ),
+ operator: z.unknown().transform((value, context) => {
+ try {
+ return decodeRuntimeHostOperatorCommand(value);
+ } catch (error) {
+ context.addIssue({
+ code: 'custom',
+ message: error instanceof Error ? error.message : 'Runtime Host operator is invalid',
+ });
+ return z.NEVER;
+ }
+ }),
rootPath: boundedString(4 * 1024).refine((value) => !/[\u0000-\u001f\u007f]/u.test(value)),
rootId: z.string().regex(/^[a-f0-9]{64}$/u),
endpoint: boundedString(SETUP_FIELD_MAX_BYTES).refine(
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org