// MUST be first: publishes the colocated libSQL/keyring native `.node` paths// before any import (e.g. `@executor-js/local` → libSQL) eagerly loads them.import "./native-bindings"; import { randomUUID } from "node:crypto";import { existsSync, realpathSync } from "node:fs";import { delimiter, dirname, join, resolve } from "node:path";// Make sibling binaries and standard GUI-missing CLI install locations// discoverable on $PATH so child processes spawned without an absolute path// still find them.const execDir = dirname(process.execPath);const prependPathEntries = (entries: ReadonlyArray<string>): void => {  const current = process.env.PATH?.split(delimiter).filter(Boolean) ?? [];  const next = [...entries.filter((entry) => !current.includes(entry)), ...current];  process.env.PATH = next.join(delimiter);};prependPathEntries([  execDir,  ...(process.platform === "darwin" ? ["/opt/homebrew/bin", "/usr/local/bin"] : []),]); // Pre-load QuickJS WASM for compiled binaries — must run before server importsconst wasmOnDisk = join(execDir, "emscripten-module.wasm");if (typeof Bun !== "undefined" && (await Bun.file(wasmOnDisk).exists())) {  const { setQuickJSModule } = await import("@executor-js/runtime-quickjs");  const { newQuickJSWASMModule } = await import("quickjs-emscripten");  type QuickJSSyncVariant = import("quickjs-emscripten").QuickJSSyncVariant;  const wasmBinary = await Bun.file(wasmOnDisk).arrayBuffer();  const importFFI: QuickJSSyncVariant["importFFI"] = () =>    import("@jitl/quickjs-wasmfile-release-sync/ffi").then((m) => m.QuickJSFFI);  const importModuleLoader: QuickJSSyncVariant["importModuleLoader"] = async () => {    const { default: original } =      await import("@jitl/quickjs-wasmfile-release-sync/emscripten-module");    return (moduleArg = {}) => original({ ...moduleArg, wasmBinary });  };  const variant: QuickJSSyncVariant = {    type: "sync" as const,    importFFI,    importModuleLoader,  };  const mod = await newQuickJSWASMModule(variant);  setQuickJSModule(mod);} const sentryDsn = process.env.EXECUTOR_SENTRY_DSN;if (sentryDsn) {  const Sentry = await import("@sentry/bun");  Sentry.init({    dsn: sentryDsn,    release: process.env.EXECUTOR_SENTRY_RELEASE,    environment: process.env.EXECUTOR_SENTRY_ENVIRONMENT ?? "production",    tracesSampleRate: 0,    initialScope: {      tags: {        process: "daemon",        platform: process.platform,        arch: process.arch,        ...(process.env.EXECUTOR_RUN_ID ? { runId: process.env.EXECUTOR_RUN_ID } : {}),      },    },  });} import { Argument as Args, Command, Flag as Options } from "effect/unstable/cli";import { BunRuntime, BunServices } from "@effect/platform-bun";import { HttpApiClient } from "effect/unstable/httpapi";import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/unstable/http";import { FileSystem, Path as PlatformPath } from "effect";import type { PlatformError } from "effect/PlatformError";import * as Effect from "effect/Effect";import * as Option from "effect/Option";import * as Cause from "effect/Cause";import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";import type { JSONRPCMessage } from "@modelcontextprotocol/sdk/types.js"; import { ExecutorApi, checkForUpdate } from "@executor-js/api";import {  getExecutorServerAuthorizationHeader,  normalizeExecutorServerConnection,  normalizeExecutorServerOrigin,  type ExecutorLocalServerKind,  type ExecutorLocalServerManifest,  type ExecutorServerConnection,  type ExecutorServerConnectionInput,} from "@executor-js/sdk/shared";import {  decodeAccessTokenClaims,  discoverCliLogin,  openBrowser,  pollForDeviceTokens,  refreshDeviceTokens,  requestDeviceCode,} from "./device-login";import {  startServer,  rotateLocalAuthToken,  localAuthTokenPath,  findDataDirOwnershipHeld,  type ServerInstance,  type StartServerOptions,} from "@executor-js/local";import { fetchIntegrations } from "./integrations";import {  buildDaemonSpawnSpec,  chooseDaemonPort,  canAutoStartLocalDaemonForHost,  isExecutorServerReachable,  isDevCliEntrypoint,  parseDaemonBaseUrl,  planServiceInstall,  spawnDetached,  terminateSpawnedDetachedProcess,  waitForReachable,  waitForUnreachable,} from "./daemon";import {  acquireDaemonStartLock,  canonicalDaemonHost,  currentDaemonScopeId,  isPidAlive,  readDaemonPointer,  readDaemonRecord,  releaseDaemonStartLock,  removeDaemonPointer,  removeDaemonRecord,  terminatePid,  writeDaemonPointer,  writeDaemonRecord,} from "./daemon-state";import {  canAutoStartCliServerConnection,  chooseCliServerConnectionWithActiveLocal,  parseCliExecutorServerConnection,  type CliServerConnectionSource,  withCliServerAuthFallback,} from "./server-connection";import {  readLocalServerManifest,  removeLocalServerManifestIfOwnedBy,  resolveExecutorDataDir,  writeLocalServerManifest,} from "./local-server-manifest";import {  DEFAULT_SERVICE_PORT,  getServiceBackend,  SERVICE_LABEL,  stopWindowsExecutorListenersOnPort,} from "./service";import {  defaultCliServerConnectionProfile,  findCliServerConnectionProfile,  readCliServerConnectionStore,  removeCliServerConnectionProfile,  setDefaultCliServerConnectionProfile,  upsertCliServerConnectionProfile,  validateCliServerConnectionProfileName,  type CliServerConnectionStore,} from "./server-profile";import {  buildResumeContentTemplate,  buildDescribeToolCode,  filterToolPathChildren,  buildInvokeToolCode,  buildListSourcesCode,  buildSearchToolsCode,  extractExecutionId,  extractPausedInteraction,  extractExecutionResult,  inspectToolPath,  normalizeCliErrorText,  parseJsonObjectInput,  resolveToolInvocation,  sanitizeCliOutputText,  shellQuoteArg,} from "./tooling"; // Embedded web UI — baked into compiled binaries via `with { type: "file" }`import embeddedWebUI from "./embedded-web-ui.gen"; // ---------------------------------------------------------------------------// Constants// --------------------------------------------------------------------------- const { version: CLI_VERSION } = await import("../package.json");const DEFAULT_PORT = 4788;/** Canonical public docs (Mintlify), matching the web shell's DEFAULT_DOCS_URL. */const DOCS_URL = "https://executor.sh/docs";const DEFAULT_BASE_URL = `http://localhost:${DEFAULT_PORT}`;const DESKTOP_SIDECAR_READY_SENTINEL = "EXECUTOR_READY";const DESKTOP_SIDECAR_ATTACHED_SENTINEL = "EXECUTOR_ATTACHED";const DAEMON_BOOT_TIMEOUT_MS = 15_000;const DAEMON_BOOT_POLL_MS = 150;const DAEMON_STOP_TIMEOUT_MS = 10_000;const SERVICE_BOOT_TIMEOUT_MS = 45_000; // ---------------------------------------------------------------------------// Helpers// --------------------------------------------------------------------------- const shouldEmitDesktopSidecarSentinels = (): boolean => process.env.EXECUTOR_CLIENT === "desktop"; const waitForShutdownSignal = () =>  Effect.callback<void, never>((resume) => {    const shutdown = () => resume(Effect.void);    process.once("SIGINT", shutdown);    process.once("SIGTERM", shutdown);    return Effect.sync(() => {      process.off("SIGINT", shutdown);      process.off("SIGTERM", shutdown);    });  }); // ---------------------------------------------------------------------------// Background server management// --------------------------------------------------------------------------- const isServerReachable = (baseUrl: string): Effect.Effect<boolean> =>  isExecutorServerReachable({ baseUrl }); const readReachableLocalServerHint = (): Effect.Effect<  ExecutorLocalServerManifest | null,  never,  FileSystem.FileSystem | PlatformPath.Path> =>  Effect.gen(function* () {    const manifest = yield* readLocalServerManifest();    if (!manifest) return null;     if (yield* isServerReachable(manifest.connection.origin)) {      return manifest;    }     if (!isPidAlive(manifest.pid)) {      yield* removeLocalServerManifestIfOwnedBy({ pid: manifest.pid }).pipe(Effect.ignore);      return null;    }     return null;  }); const readActiveLocalServerManifest = readReachableLocalServerHint; const normalizeDaemonScopeDir = (dir: string): string => {  const resolved = resolve(dir);  return existsSync(resolved) ? realpathSync.native(resolved) : resolved;}; const currentScopeDirForManifest = (): string | null =>  process.env.EXECUTOR_SCOPE_DIR ? normalizeDaemonScopeDir(process.env.EXECUTOR_SCOPE_DIR) : null; const script = process.argv[1];const isDevMode = isDevCliEntrypoint(script);const cliPrefix = isDevMode ? `bun run ${script}` : "executor"; const toError = (cause: unknown): Error =>  cause instanceof Error ? cause : new Error(String(cause)); interface ServerTarget {  readonly baseUrl?: string;  readonly serverName?: string;} interface RequestedExecutorServerConnection {  readonly connection: ExecutorServerConnection;  readonly source: CliServerConnectionSource;} interface ExecuteCodeResult {  readonly connection: ExecutorServerConnection;  readonly outcome: ExecuteCodeOutcome;} type LocalServerStartResult =  | { readonly kind: "started"; readonly server: ServerInstance }  | { readonly kind: "attached"; readonly manifest: ExecutorLocalServerManifest }; const attachToOwnedDataDirServerOrFail = (input: {  readonly lockPath: string;}): Effect.Effect<ExecutorLocalServerManifest, Error, FileSystem.FileSystem | PlatformPath.Path> =>  Effect.gen(function* () {    const manifest = yield* readReachableLocalServerHint();    if (manifest) return manifest;     const path = yield* PlatformPath.Path;    const dataDir = resolveExecutorDataDir(path);    return yield* Effect.fail(      new Error(        [          "Executor data directory is owned by another live process, but no reachable local server was advertised.",          `Data directory: ${dataDir}`,          `Ownership lock: ${input.lockPath}`,          "Wait for the existing process to finish starting, or stop it and retry.",        ].join("\n"),      ),    );  }); const startServerOrAttachOwnedDataDir = (  options: StartServerOptions,): Effect.Effect<LocalServerStartResult, Error, FileSystem.FileSystem | PlatformPath.Path> =>  Effect.tryPromise({    try: () => startServer(options),    catch: (cause) => cause,  }).pipe(    Effect.map((server) => ({ kind: "started" as const, server })),    Effect.catch((cause) => {      const ownership = findDataDirOwnershipHeld(cause);      if (!ownership) return Effect.fail(toError(cause));      return attachToOwnedDataDirServerOrFail({ lockPath: ownership.lockPath }).pipe(        Effect.map((manifest) => ({ kind: "attached" as const, manifest })),      );    }),  ); const parseDaemonUrl = (baseUrl: string) =>  Effect.try({    try: () => parseDaemonBaseUrl(baseUrl, DEFAULT_PORT),    catch: (cause) =>      cause instanceof Error ? cause : new Error(`Invalid base URL: ${String(cause)}`),  }); const parseExecutorServerConnection = (baseUrl: string) =>  Effect.try({    try: () => parseCliExecutorServerConnection(baseUrl),    catch: (cause) =>      cause instanceof Error ? cause : new Error(`Invalid server URL: ${String(cause)}`),  }); const daemonBaseUrl = (hostname: string, port: number): string =>  `http://${canonicalDaemonHost(hostname)}:${port}`; const makeLocalServerManifest = (input: {  readonly kind: ExecutorLocalServerKind;  readonly connection: ExecutorServerConnection;}): Effect.Effect<ExecutorLocalServerManifest, never, PlatformPath.Path> =>  Effect.gen(function* () {    const path = yield* PlatformPath.Path;    return {      version: 1,      kind: input.kind,      pid: process.pid,      startedAt: new Date().toISOString(),      dataDir: resolveExecutorDataDir(path),      scopeDir: currentScopeDirForManifest(),      connection: input.connection,      owner: {        client: process.env.EXECUTOR_CLIENT === "desktop" ? "desktop" : "cli",        version: CLI_VERSION,        executablePath: isDevMode ? (script ?? null) : process.execPath,      },    };  }); // Friendly, intentionally racy fast-path: it reads the server.json hint to fail// early with a helpful message when another local server is already up. It is// NOT the ownership gate — the DB ownership lock inside startServer// (openOwnedLocalDatabase) is. A stale/missing manifest only costs the nice// message; the kernel lock still refuses a second owner.const assertNoOtherActiveLocalServer = (): Effect.Effect<  void,  Error,  FileSystem.FileSystem | PlatformPath.Path> =>  Effect.gen(function* () {    const active = yield* readActiveLocalServerManifest();    if (!active || active.pid === process.pid) return;    return yield* Effect.fail(      new Error(        [          `A local Executor ${active.kind} is already running at ${active.connection.origin} (pid ${active.pid}).`,          `It owns the current data directory: ${active.dataDir}`,          "Stop it before starting another local server.",        ].join("\n"),      ),    );  }); const takeOverActiveLocalServer = (input?: {  readonly onlyKind?: ExecutorLocalServerKind;}): Effect.Effect<  ExecutorLocalServerManifest | null,  Error,  FileSystem.FileSystem | PlatformPath.Path> =>  Effect.gen(function* () {    const manifest = yield* readLocalServerManifest();    if (!manifest) return null;    if (input?.onlyKind && manifest.kind !== input.onlyKind) return null;     if (!isPidAlive(manifest.pid) || manifest.pid === process.pid) {      yield* removeLocalServerManifestIfOwnedBy({ pid: manifest.pid }).pipe(Effect.ignore);      return null;    }     yield* terminatePid(manifest.pid).pipe(Effect.ignore);    const stopped = yield* waitForUnreachable({      check: isServerReachable(manifest.connection.origin),      timeoutMs: DAEMON_STOP_TIMEOUT_MS,      intervalMs: DAEMON_BOOT_POLL_MS,    });    if (!stopped) {      return yield* Effect.fail(        new Error(          [            `The existing Executor ${manifest.kind} at ${manifest.connection.origin} (pid ${manifest.pid}) did not stop within ${DAEMON_STOP_TIMEOUT_MS / 1000}s.`,            "Stop it manually and re-run.",          ].join("\n"),        ),      );    }     yield* removeLocalServerManifestIfOwnedBy({ pid: manifest.pid }).pipe(Effect.ignore);    return manifest;  }); const publishLocalServerManifest = (input: {  readonly kind: ExecutorLocalServerKind;  readonly connection: ExecutorServerConnection;}): Effect.Effect<void, PlatformError, FileSystem.FileSystem | PlatformPath.Path> =>  Effect.gen(function* () {    const manifest = yield* makeLocalServerManifest(input);    yield* writeLocalServerManifest(manifest);  }); const installDefaultExecutorWebBaseUrl = (baseUrl: string): (() => void) => {  if (process.env.EXECUTOR_WEB_BASE_URL !== undefined) {    return () => {};  }   process.env.EXECUTOR_WEB_BASE_URL = baseUrl;  return () => {    delete process.env.EXECUTOR_WEB_BASE_URL;  };}; const cleanupPointer = (input: { hostname: string; scopeId: string; port: number }) =>  Effect.gen(function* () {    yield* removeDaemonPointer({ hostname: input.hostname, scopeId: input.scopeId }).pipe(      Effect.ignore,    );    yield* removeDaemonRecord({ hostname: input.hostname, port: input.port }).pipe(Effect.ignore);  }); const resolveDaemonTarget = (baseUrl: string) =>  Effect.gen(function* () {    const parsed = yield* parseDaemonUrl(baseUrl);    const host = canonicalDaemonHost(parsed.hostname);    const scopeId = currentDaemonScopeId();    const pointer = yield* readDaemonPointer({ hostname: host, scopeId });     if (pointer) {      const pointerUrl = daemonBaseUrl(pointer.hostname, pointer.port);      if (isPidAlive(pointer.pid) && (yield* isServerReachable(pointerUrl))) {        return {          baseUrl: pointerUrl,          hostname: pointer.hostname,          port: pointer.port,          scopeId,          fromPointer: true,        };      }       yield* cleanupPointer({ hostname: pointer.hostname, scopeId, port: pointer.port });    }     return {      baseUrl: daemonBaseUrl(host, parsed.port),      hostname: host,      port: parsed.port,      scopeId,      fromPointer: false,    };  }); const waitForDaemonStartupTarget = (input: {  readonly requestedBaseUrl: string;}): Effect.Effect<string | null, never, FileSystem.FileSystem | PlatformPath.Path> =>  Effect.gen(function* () {    let readyBaseUrl: string | null = null;    let requestedFallbackBaseUrl: string | null = null;    const ready = yield* waitForReachable({      check: Effect.gen(function* () {        // Prefer the manifest: it is written after the server has opened the        // owned DB and started serving, and it carries the bearer token the next        // API call needs. A bare health response on the requested URL is only a        // last-ditch fallback; keep polling for the manifest so tool calls do        // not race ahead without auth.        const manifest = yield* readReachableLocalServerHint();        if (manifest) {          readyBaseUrl = manifest.connection.origin;          return true;        }         if (yield* isServerReachable(input.requestedBaseUrl)) {          requestedFallbackBaseUrl = input.requestedBaseUrl;        }         return false;      }),

Lines 1–500 of 3172. Load more