@aiwg/cli 2026.10.8 → 2026.10.10

package/tools/ralph-external/lib/worker-inputs.mjs

@@ -0,0 +1,55 @@
+// Read bounded worker inputs through pinned, no-follow directory handles.
+import { constants } from 'node:fs';
+import { open } from 'node:fs/promises';
+import { isAbsolute } from 'node:path';
+
+// Linux directory handles pin each ancestor. O_NOFOLLOW on a pathname alone
+// cannot protect an ancestor that the worker replaces after inspection.
+export async function withWorkerPath(filename, operation) {
+  if (!isAbsolute(filename) || filename.includes('\0') || filename.split('/').includes('..')) throw new Error('Invalid worker path');
+  const components = filename.split('/').filter(Boolean);
+  const leaf = components.pop();
+  let directory = await open('/', constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+  try {
+    for (const component of components) {
+      const next = await open(`/proc/self/fd/${directory.fd}/${component}`, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+      await directory.close(); directory = next;
+    }
+    return await operation(`/proc/self/fd/${directory.fd}/${leaf ?? '.'}`);
+  } finally { await directory.close(); }
+}
+
+// #2915 review 4 (finding 4): `privateOutput: true` REPAIRS a loose mode
+// (chmod 0600) rather than rejecting it — correct for the worker's own
+// final-output file, which the launcher itself created and is free to
+// re-tighten. `rejectInsecureMode: true` additionally REFUSES a mode other
+// than exactly 0600 instead of repairing it, for evidence this launcher
+// did NOT create moments ago (retry predecessor metadata) — a 0666 file
+// there is itself a signal worth refusing on, not silently normalizing
+// away.
+export async function boundedPrivateRead(filename, limit, inspect, privateOutput = false, rejectInsecureMode = false) {
+  if (!await inspect(filename, 'file')) throw new Error('Required worker input is missing');
+  const handle = await withWorkerPath(filename, target => open(target, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK));
+  try {
+    const stat = await handle.stat();
+    if (!stat.isFile() || stat.nlink !== 1 || stat.size > limit) throw new Error('Worker input must be a bounded unaliased regular file');
+    if (privateOutput) {
+      if (stat.uid !== process.getuid()) throw new Error('Worker final must be conductor-owned');
+      if (rejectInsecureMode) {
+        if ((stat.mode & 0o777) !== 0o600) throw new Error('Worker input mode must already be exactly 0600; insecure modes are refused, not repaired');
+      } else {
+        await handle.chmod(0o600);
+      }
+    }
+    const buffer = Buffer.alloc(limit + 1);
+    let length = 0;
+    while (length < buffer.length) {
+      const { bytesRead } = await handle.read(buffer, length, buffer.length - length, length);
+      if (!bytesRead) break;
+      length += bytesRead;
+    }
+    if (length > limit) throw new Error('Worker input exceeds bound');
+    return buffer.subarray(0, length);
+  } finally { await handle.close(); }
+}
+

package/tools/ralph-external/lib/worker-isolation.mjs

@@ -42,50 +42,8 @@ import { buildSystemdClientEnv, resolveSystemdClient, resolveSystemdRun, CONNECT
 
 const UNIT_SAFE = /[^A-Za-z0-9:_.@-]/g;
 const transportBootstrapVariables = ['NODE_OPTIONS', 'NODE_PATH', 'LD_PRELOAD', 'LD_LIBRARY_PATH', 'LD_AUDIT', 'LD_DEBUG', 'LD_DEBUG_OUTPUT'];
-const nativeSandboxProbes = new Map();
-let nativeSandboxProbeSequence = 0;
-export const NATIVE_SANDBOX_UNAVAILABLE = 'OG_NATIVE_SANDBOX_UNAVAILABLE';
-
-export function workerNeedsNativeNamespaces(adapter, permissions = {}, platform = process.platform) {
-  return platform === 'linux' && adapter?.provider === 'codex'
-    && (permissions.transport ?? 'shell') === 'shell'
-    && ['read-only', 'workspace-write'].includes(permissions.sandbox ?? 'workspace-write');
-}
-
-export function nativeSandboxFailure(text) {
-  return /loopback: Failed RTM_NEWADDR: Operation not permitted|uid_map[^\n]*Operation not permitted/i.test(text);
-}
-
-export function nativeSandboxProbeMessage(result) {
-  return `${NATIVE_SANDBOX_UNAVAILABLE}: Native sandbox unavailable: restricted unprivileged user namespaces inside systemd user units (host AppArmor policy may restrict userns). Probe: ${String(result.detail ?? 'failed').replace(/[\x00-\x1f\x7f]/g, ' ').slice(0, 512)}. Select parallelism.groups.<group>.execution.launchMode="native-sandbox" with a verified enforcing CLI sandbox, or configure a host AppArmor allowance for the systemd worker launch path.`;
-}
-
-/** No inference: exercise user/network namespaces through the worker's unit and client environment path. */
-export function probeWorkerNativeSandbox({ spawn = spawnSync, env = process.env, envNames = ['PATH', 'HOME'], cwd,
-  cache = spawn === spawnSync ? nativeSandboxProbes : undefined } = {}) {
-  const key = JSON.stringify([cwd, [...envNames].sort()]);
-  if (cache?.has(key)) return cache.get(key);
-  let result;
-  try {
-    const managerEnvNames = resolveManagerEnvNames({ spawn });
-    const command = process.execPath;
-    const args = [fileURLToPath(import.meta.url), '--worker-environment', JSON.stringify(unitEnvironmentNames(envNames)),
-      '--', '/usr/bin/unshare', '--user', '--map-root-user', '--net', '/usr/bin/true'];
-    const argv = buildWorkerIsolationArgs({ unit: proposeWorkerUnitName(`sandbox-probe-${process.pid}-${++nativeSandboxProbeSequence}`),
-      command, args, cwd, env, envNames, managerEnvNames, memoryMaxGb: 0.25, attached: true,
-      extraProperties: ['RuntimeMaxSec=5s', 'TimeoutStopSec=1s'] });
-    const observed = spawn(resolveSystemdRun(), ['--collect', ...argv.slice(1)], {
-      encoding: 'utf8', timeout: 8000, maxBuffer: 4096, env: buildSystemdClientEnv({ env, envNames }) });
-    result = observed.status === 0 && !observed.error ? { ok: true, mode: 'systemd-unit' }
-      : { ok: false, mode: 'systemd-unit', code: NATIVE_SANDBOX_UNAVAILABLE,
-        detail: String(observed.error?.message ?? (String(observed.stderr ?? '').trim() || `exit ${observed.status}`)).replace(/[\x00-\x1f\x7f]/g, ' ').slice(0, 512) };
-  } catch (error) {
-    result = { ok: false, mode: 'systemd-unit', code: NATIVE_SANDBOX_UNAVAILABLE,
-      detail: String(error.message).replace(/[\x00-\x1f\x7f]/g, ' ').slice(0, 512) };
-  }
-  cache?.set(key, result);
-  return result;
-}
+export { NATIVE_SANDBOX_UNAVAILABLE, workerNeedsNativeNamespaces, nativeSandboxFailure,
+  nativeSandboxProbeMessage, probeWorkerNativeSandbox } from './worker-native-sandbox.mjs';
 
 /** Derive a unit-safe `aiwg-worker-<name>-<epoch>` unit name. */
 export function proposeWorkerUnitName(name, nowSeconds = Math.floor(Date.now() / 1000)) {

package/tools/ralph-external/lib/worker-launch-cli.mjs

@@ -0,0 +1,47 @@
+// Parse one-shot launch options and derive retry IDs from launcher records.
+import { join, isAbsolute } from 'node:path';
+import { boundedPrivateRead } from './worker-inputs.mjs';
+
+export function parseWorkerLaunchArgs(args) {
+  const result = {};
+  const seen = new Set();
+  let retryOfInvocationId;
+  let retryOfRunDir;
+  for (let i = 0; i < args.length; i++) {
+    const flag = args[i];
+    if (seen.has(flag)) throw new Error(`Duplicate worker launch option: ${flag}`);
+    seen.add(flag);
+    if (flag === '--launch-worker') continue;
+    if (flag === '--allow-degraded-worker') { result.allowDegraded = true; continue; }
+    // A run directory declares a retry; its launcher ID is derived before validation.
+    const key = { '--invocation': 'invocationPath', '--run-dir': 'runDir',
+      '--retry-of': '__retryOfInvocationId', '--retry-of-run-dir': '__retryOfRunDir' }[flag];
+    if (!key) throw new Error(`Unsupported worker launch option: ${flag}`);
+    const value = args[++i];
+    if (!value || value.startsWith('--')) throw new Error(`${flag} requires a value`);
+    if (key === '__retryOfInvocationId') retryOfInvocationId = value;
+    else if (key === '__retryOfRunDir') retryOfRunDir = value;
+    else result[key] = value;
+  }
+  if (!seen.has('--launch-worker') || !result.invocationPath || !result.runDir) {
+    throw new Error('Usage: ralph-external --launch-worker --invocation FILE --run-dir DIR [--allow-degraded-worker] [--retry-of-run-dir DIR [--retry-of ID]]');
+  }
+  if (retryOfInvocationId !== undefined && retryOfRunDir === undefined) {
+    throw new Error('--retry-of and --retry-of-run-dir must be supplied together when an explicit ID is used');
+  }
+  if (retryOfRunDir !== undefined) result.retryOf = { runDir: retryOfRunDir, ...(retryOfInvocationId === undefined ? {} : { invocationId: retryOfInvocationId }) };
+  return result;
+}
+
+export async function resolveRetryReference(retryOf, { inspect }) {
+  if (!retryOf || typeof retryOf !== 'object' || retryOf.invocationId !== undefined) return retryOf;
+  if (!isAbsolute(retryOf.runDir ?? '')) throw new Error('Retry run directory must be absolute');
+  const bytes = await boundedPrivateRead(join(retryOf.runDir, 'invocation.json'), 1048576, inspect, true, true);
+  const record = JSON.parse(bytes.toString('utf8'));
+  if (record.origin !== 'launcher' || typeof record.invocationId !== 'string' || !record.invocationId) {
+    throw new Error('Retry predecessor invocation.json must contain a launcher invocationId');
+  }
+  // Derivation is not acceptance: verifyRetryPredecessor still checks ownership,
+  // task-chain identity, matching records, writable roots and confirmed stop.
+  return { ...retryOf, invocationId: record.invocationId };
+}

package/tools/ralph-external/lib/worker-native-sandbox.mjs

@@ -0,0 +1,83 @@
+/** Probe each CLI's native sandbox mechanism through the worker's transient unit. */
+import { spawnSync } from 'node:child_process';
+import { accessSync, constants, statSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+import { buildWorkerIsolationArgs, proposeWorkerUnitName, resolveManagerEnvNames } from './worker-isolation.mjs';
+import { buildSystemdClientEnv, resolveSystemdRun, unitEnvironmentNames } from './systemd-client.mjs';
+
+const nativeSandboxProbes = new Map();
+let sequence = 0;
+export const NATIVE_SANDBOX_UNAVAILABLE = 'OG_NATIVE_SANDBOX_UNAVAILABLE';
+
+/** Prefer the system bwrap allowed by Ubuntu's executable-specific AppArmor policy. */
+export function resolveWorkerBwrap({ env = process.env, executable = candidate => {
+  try { accessSync(candidate, constants.X_OK); return statSync(candidate).isFile(); } catch { return false; }
+} } = {}) {
+  for (const candidate of ['/usr/bin/bwrap', ...(env.PATH ?? '').split(path.delimiter)
+    .filter(directory => path.isAbsolute(directory)).map(directory => path.join(directory, 'bwrap'))]) {
+    if (executable(candidate)) return candidate;
+  }
+  throw new Error('bwrap is unavailable at /usr/bin/bwrap or on the worker PATH');
+}
+
+const bwrapProbe = options => ({ mechanism: 'bwrap', command: resolveWorkerBwrap(options),
+  args: ['--ro-bind', '/', '/', '--unshare-user', '--unshare-net', '--', '/usr/bin/true'] });
+
+// Hooks are owned by launcher code, never loaded from project configuration.
+export const workerNativeSandboxProbeHooks = { codex: bwrapProbe, muse: bwrapProbe };
+
+// CLIs without their own hook keep a generic user/network namespace probe: bwrap when the host
+// has it (allowed by Ubuntu's bwrap profile), else the previous unshare probe.
+const genericProbe = options => {
+  try { return bwrapProbe(options); }
+  catch { return { mechanism: 'unshare', command: '/usr/bin/unshare', args: ['--user', '--map-root-user', '--net', '/usr/bin/true'] }; }
+};
+
+export function workerNeedsNativeNamespaces(adapter, permissions = {}, platform = process.platform) {
+  return platform === 'linux' && Object.hasOwn(workerNativeSandboxProbeHooks, adapter?.provider ?? '')
+    && (permissions.transport ?? 'shell') === 'shell'
+    && ['read-only', 'workspace-write'].includes(permissions.sandbox ?? 'workspace-write');
+}
+
+export function nativeSandboxFailure(text) {
+  return /loopback: Failed RTM_NEWADDR: Operation not permitted|uid_map[^\n]*Operation not permitted/i.test(text);
+}
+
+const bounded = detail => String(detail).replace(/[\x00-\x1f\x7f]/g, ' ').slice(0, 512);
+
+export function nativeSandboxProbeMessage(result) {
+  return `${NATIVE_SANDBOX_UNAVAILABLE}: Native sandbox unavailable: ${bounded(result.mechanism ?? 'CLI sandbox')} probe failed inside a systemd user unit. Probe: ${bounded(result.detail ?? 'failed')}. Verify that the named sandbox executable is installed and can create its sandbox in the worker unit environment.`;
+}
+
+/** Hooks return { mechanism, command, args }; the unit and environment path stay shared. */
+export function probeWorkerNativeSandbox({ adapter = { provider: 'codex' }, probeHooks = workerNativeSandboxProbeHooks,
+  spawn = spawnSync, env = process.env, envNames = ['PATH', 'HOME'], cwd,
+  cache = spawn === spawnSync ? nativeSandboxProbes : undefined } = {}) {
+  let mechanism = ['codex', 'muse'].includes(adapter.provider) ? 'bwrap' : `${adapter.provider} sandbox`;
+  let key;
+  let result;
+  try {
+    const hook = Object.hasOwn(probeHooks, adapter.provider) ? probeHooks[adapter.provider] : genericProbe;
+    const probe = hook({ env, cwd, adapter });
+    mechanism = probe.mechanism;
+    key = JSON.stringify([adapter.provider, probe, cwd, [...envNames].sort().map(name => [name, env[name]])]);
+    if (cache?.has(key)) return cache.get(key);
+    const managerEnvNames = resolveManagerEnvNames({ spawn });
+    const command = process.execPath;
+    const args = [fileURLToPath(new URL('./worker-isolation.mjs', import.meta.url)), '--worker-environment',
+      JSON.stringify(unitEnvironmentNames(envNames)), '--', probe.command, ...probe.args];
+    const argv = buildWorkerIsolationArgs({ unit: proposeWorkerUnitName(`sandbox-probe-${process.pid}-${++sequence}`),
+      command, args, cwd, env, envNames, managerEnvNames, memoryMaxGb: 0.25, attached: true,
+      extraProperties: ['RuntimeMaxSec=5s', 'TimeoutStopSec=1s'] });
+    const observed = spawn(resolveSystemdRun(), ['--collect', ...argv.slice(1)], {
+      encoding: 'utf8', timeout: 8000, maxBuffer: 4096, env: buildSystemdClientEnv({ env, envNames }) });
+    result = observed.status === 0 && !observed.error ? { ok: true, mode: 'systemd-unit', mechanism }
+      : { ok: false, mode: 'systemd-unit', mechanism, code: NATIVE_SANDBOX_UNAVAILABLE,
+        detail: bounded(observed.error?.message ?? (String(observed.stderr ?? '').trim() || `exit ${observed.status}`)) };
+  } catch (error) {
+    result = { ok: false, mode: 'systemd-unit', mechanism, code: NATIVE_SANDBOX_UNAVAILABLE, detail: bounded(error.message) };
+  }
+  if (key) cache?.set(key, result);
+  return result;
+}