@arthovlabs/liber 0.5.0 → 0.5.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arthovlabs/liber",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "LiBER — autonomous agent orchestrator with a machine-enforced grounding gate and a skill library",
   "bin": {
     "liber": "bin/liber",

package/src/daemon/core/tools/terminal-tool.js

@@ -268,10 +268,15 @@ function auditTerminal(entry) {
 function containerPolicy() {
   const term = policy.terminalConfig();
   const requested = term.backend === 'docker';
+  const image = term.image || 'alpine:latest';
+  const usable = requested ? containerUsable(false, image) : { ok: false, error: null };
   return {
-    on: requested && containerAvailable(),
+    // A daemon that answers but cannot start a container would make every
+    // command fail; treat "usable" as the condition, and say why otherwise.
+    on: requested && usable.ok,
     requested,
-    image: term.image || 'alpine:latest',
+    fallback_reason: requested && !usable.ok ? (usable.error || 'container runtime not usable') : null,
+    image,
     network: term.allow_network === true,
     memory: term.memory || '512m',
     pids: Number(term.pids) || 128
@@ -292,12 +297,45 @@ function containerAvailable(force = false) {
   return ok;
 }
 
+let _runCache = null;
+/**
+ * Can this machine actually START a container with the configured image?
+ * A reachable daemon is not the same thing: a CI runner can have the CLI and a
+ * server version and still refuse to run (no image, no permissions). Checking by
+ * running is the only honest answer, and it is cached because it costs ~1s.
+ */
+function containerUsable(force = false, image = 'alpine:latest') {
+  if (!force && _runCache && _runCache.image === image && Date.now() - _runCache.at < 300_000) return _runCache;
+  if (!containerAvailable(force)) {
+    _runCache = { ok: false, image, at: Date.now(), error: 'docker daemon not reachable' };
+    return _runCache;
+  }
+  let ok = false;
+  let error = null;
+  try {
+    require('child_process').execFileSync('docker', ['run', '--rm', '--network', 'none', image, 'true'],
+      { timeout: 60000, windowsHide: true, stdio: ['ignore', 'ignore', 'pipe'] });
+    ok = true;
+  } catch (e) {
+    error = String(e.stderr || e.message || 'container run failed').slice(0, 200);
+  }
+  _runCache = { ok, image, at: Date.now(), error };
+  return _runCache;
+}
+
 function runContainer(command, { cwd, timeout, profile }) {
   const { execFile } = require('child_process');
   const mount = `${path.resolve(process.cwd())}:/work:rw`;
+  // On POSIX hosts run as the invoking user: files the container writes land
+  // owned by them instead of root, which is both safer and the only way a write
+  // into the mount works under a rootless daemon.
+  const asUser = process.platform !== 'win32' && typeof process.getuid === 'function'
+    ? ['--user', `${process.getuid()}:${process.getgid()}`]
+    : [];
   const args = [
     'run', '--rm', '--interactive',
     ...(profile.network ? ['--network', 'bridge'] : ['--network', 'none']),
+    ...asUser,
     '--read-only',
     '--tmpfs', '/tmp:rw,noexec,nosuid,size=64m',
     '--memory', profile.memory,
@@ -445,5 +483,6 @@ module.exports = {
   sandboxPolicy,
   sandboxEnv,
   containerPolicy,
-  containerAvailable
+  containerAvailable,
+  containerUsable
 };

package/src/daemon/core/workspace.js

@@ -26,8 +26,11 @@ function isGitRepo() {
 }
 
 function branch() {
+  // `rev-parse --abbrev-ref HEAD` prints the literal string "HEAD" on a detached
+  // checkout (CI tag builds do this), which is not a branch name — reporting it
+  // as one made the UI show a branch called HEAD and marked nothing current.
   const b = sh('git', ['rev-parse', '--abbrev-ref', 'HEAD']);
-  if (b && b.trim()) return b.trim();
+  if (b && b.trim() && b.trim() !== 'HEAD') return b.trim();
   const detached = sh('git', ['rev-parse', '--short', 'HEAD']);
   return detached ? `detached@${detached.trim()}` : null;
 }
@@ -158,6 +161,9 @@ function gitState() {
     is_git: true,
     root: git(['rev-parse', '--show-toplevel']).out || process.cwd(),
     branch: current,
+    // CI checks out a commit, not a branch: say so instead of pretending a
+    // branch is current and letting the UI mark nothing.
+    detached: String(current || '').startsWith('detached@'),
     branches: list.map(name => ({ name, current: name === current })),
     remote: remoteUrl ? { name: 'origin', url: remoteUrl } : null,
     ahead, behind, dirty