@dharma-ai-labs/agent-fabric 0.2.161 → 0.2.163

package/dist/namedCodexNodeOutput.d.ts

@@ -0,0 +1,3 @@
+export declare const namedCodexNodeOutputBody: string;
+export declare function namedCodexNodeOutputArguments(platform?: NodeJS.Platform): string[];
+//# sourceMappingURL=namedCodexNodeOutput.d.ts.map

package/dist/namedCodexNodeOutput.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"namedCodexNodeOutput.d.ts","sourceRoot":"","sources":["../src/namedCodexNodeOutput.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,wBAAwB,QAwBpC,CAAC;AAEF,wBAAgB,6BAA6B,CAAC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG,MAAM,EAAE,CAMpG"}

package/dist/namedCodexNodeOutput.js

@@ -0,0 +1,36 @@
+// Node can classify sandboxed socketpair descriptors as unknown and discard
+// child output. Repair only its dummy streams, using their existing fds.
+export const namedCodexNodeOutputBody = String.raw `
+for (const [name, fd] of [['stdout', 1], ['stderr', 2]]) {
+  const current = process[name];
+  if (current.constructor !== Writable || current._handle || current._type || !fstatSync(fd).isSocket()) continue;
+  const stream = new Writable({
+    write(chunk, encoding, callback) {
+      try {
+        const data = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk, encoding);
+        let offset = 0;
+        while (offset < data.length) {
+          const count = writeSync(fd, data, offset, data.length - offset);
+          if (!Number.isInteger(count) || count <= 0 || count > data.length - offset) {
+            throw new Error('named_node_output_descriptor_no_progress');
+          }
+          offset += count;
+        }
+        callback();
+      } catch (error) { callback(error); }
+    },
+  });
+  stream.fd = fd;
+  stream._isStdio = true;
+  Object.defineProperty(process, name, { configurable: true, enumerable: true, value: stream });
+}
+`;
+export function namedCodexNodeOutputArguments(platform = process.platform) {
+    if (platform !== 'linux')
+        return [];
+    const source = "import {writeSync,fstatSync} from 'node:fs';import {Writable} from 'node:stream';\n" + namedCodexNodeOutputBody;
+    const options = '--import=data:text/javascript;base64,' + Buffer.from(source).toString('base64');
+    // This fixed public module replaces, rather than forwards, user NODE_OPTIONS.
+    return ['-c', `shell_environment_policy.set={NODE_OPTIONS=${JSON.stringify(options)}}`];
+}
+//# sourceMappingURL=namedCodexNodeOutput.js.map

package/dist/namedCodexNodeOutput.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"namedCodexNodeOutput.js","sourceRoot":"","sources":["../src/namedCodexNodeOutput.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,yEAAyE;AACzE,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;CAwBjD,CAAC;AAEF,MAAM,UAAU,6BAA6B,CAAC,WAA4B,OAAO,CAAC,QAAQ;IACxF,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,qFAAqF,GAAG,wBAAwB,CAAC;IAChI,MAAM,OAAO,GAAG,uCAAuC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjG,8EAA8E;IAC9E,OAAO,CAAC,IAAI,EAAE,8CAA8C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AAC1F,CAAC"}

package/dist/namedCodexNodeOutput.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=namedCodexNodeOutput.test.d.ts.map

package/dist/namedCodexNodeOutput.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"namedCodexNodeOutput.test.d.ts","sourceRoot":"","sources":["../src/namedCodexNodeOutput.test.ts"],"names":[],"mappings":""}

package/dist/namedCodexNodeOutput.test.js

@@ -0,0 +1,90 @@
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { Writable } from 'node:stream';
+import test from 'node:test';
+import { compileFunction } from 'node:vm';
+import { namedCodexNodeOutputArguments, namedCodexNodeOutputBody } from './namedCodexNodeOutput.js';
+function fixture(options = {}) {
+    const original = new Writable({ write(_chunk, _encoding, callback) { callback(); } });
+    if (options.typed)
+        Object.assign(original, { _type: 'pipe' });
+    const target = { stdout: original, stderr: original };
+    const writes = [];
+    const inspected = [];
+    const install = compileFunction(namedCodexNodeOutputBody, ['writeSync', 'fstatSync', 'Writable', 'process']);
+    install((fd, data, offset, length) => {
+        assert.ok(fd === 1 || fd === 2);
+        if (options.failure)
+            throw Object.assign(new Error('descriptor denied'), { code: 'EACCES' });
+        if (options.zero)
+            return 0;
+        const count = options.partial ? Math.min(2, length) : length;
+        writes.push({ fd, bytes: Buffer.from(data.subarray(offset, offset + count)) });
+        return count;
+    }, (fd) => {
+        inspected.push(fd);
+        return { isSocket: () => options.socket !== false };
+    }, Writable, target);
+    return { original, target, writes, inspected };
+}
+test('only Linux receives a fixed public Node output module through Codex configuration', () => {
+    const args = namedCodexNodeOutputArguments('linux');
+    assert.equal(args.length, 2);
+    assert.equal(args[0], '-c');
+    assert.match(args[1], /^shell_environment_policy\.set=\{NODE_OPTIONS="--import=data:text\/javascript;base64,[A-Za-z0-9+/=]+"\}$/);
+    for (const platform of ['win32', 'darwin'])
+        assert.deepEqual(namedCodexNodeOutputArguments(platform), []);
+});
+test('dummy socket streams forward binary bytes only to their existing output descriptors', async () => {
+    const value = fixture();
+    assert.notEqual(value.target.stdout, value.original);
+    const bytes = Buffer.from([255, 15, 0, 128, 1]);
+    await new Promise((resolve, reject) => value.target.stdout.write(bytes, error => error ? reject(error) : resolve()));
+    await new Promise((resolve, reject) => value.target.stderr.write('public diagnostic', error => error ? reject(error) : resolve()));
+    assert.deepEqual(value.inspected, [1, 2]);
+    assert.deepEqual(value.writes[0], { fd: 1, bytes });
+    assert.deepEqual(value.writes[1], { fd: 2, bytes: Buffer.from('public diagnostic') });
+    assert.equal(value.target.stdout.fd, 1);
+});
+test('ordinary pipe streams and non-socket outputs are left unchanged', () => {
+    for (const options of [{ typed: true }, { socket: false }]) {
+        const value = fixture(options);
+        assert.equal(value.target.stdout, value.original);
+        assert.equal(value.target.stderr, value.original);
+        assert.deepEqual(value.writes, []);
+    }
+});
+test('partial descriptor writes preserve every byte exactly once', async () => {
+    const value = fixture({ partial: true });
+    await new Promise((resolve, reject) => value.target.stdout.write('abcdef', error => error ? reject(error) : resolve()));
+    assert.equal(value.writes.length, 3);
+    assert.equal(Buffer.concat(value.writes.map(write => write.bytes)).toString(), 'abcdef');
+});
+test('zero progress and denied output fail rather than reporting a successful write', async () => {
+    for (const options of [{ zero: true }, { failure: true }]) {
+        const value = fixture(options);
+        value.target.stdout.on('error', () => { });
+        const error = await new Promise(resolve => value.target.stdout.write('x', resolve));
+        assert.ok(error instanceof Error);
+        assert.deepEqual(value.writes, []);
+    }
+});
+test('the public module changes no environment, permission, file or network authority', () => {
+    const args = namedCodexNodeOutputArguments('linux');
+    const match = args[1]?.match(/base64,([A-Za-z0-9+/=]+)/);
+    assert.ok(match);
+    const module = Buffer.from(match[1], 'base64').toString();
+    assert.ok(module.includes(namedCodexNodeOutputBody));
+    assert.doesNotMatch(module, /process\.env|readFile|openSync|fetch\(|node:net|child_process|permissions\./);
+    assert.match(module, /writeSync/);
+    assert.match(module, /fstatSync/);
+});
+test('the production named launcher installs fixed output options without replacing its policy profiles', () => {
+    const entry = readFileSync(new URL('./index.js', import.meta.url), 'utf8');
+    assert.match(entry, /argv: \[\.\.\.namedCodexNodeOutputArguments\(\), '-c', 'allow_login_shell=false'/);
+    for (const profile of ['dharma_bridge', 'dharma_work']) {
+        assert.ok(entry.includes(`permissions.${profile}.network={enabled=false}`));
+        assert.ok(entry.includes(`permissions.${profile}.filesystem=`));
+    }
+});
+//# sourceMappingURL=namedCodexNodeOutput.test.js.map

package/dist/namedCodexNodeOutput.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"namedCodexNodeOutput.test.js","sourceRoot":"","sources":["../src/namedCodexNodeOutput.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,6BAA6B,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAEpG,SAAS,OAAO,CAAC,UAAuG,EAAE;IACxH,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtF,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACtD,MAAM,MAAM,GAAoC,EAAE,CAAC;IACnD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,eAAe,CAAC,wBAAwB,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;IAC7G,OAAO,CAAC,CAAC,EAAU,EAAE,IAAY,EAAE,MAAc,EAAE,MAAc,EAAE,EAAE;QACnE,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAChC,IAAI,OAAO,CAAC,OAAO;YAAE,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC7F,IAAI,OAAO,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC;QAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/E,OAAO,KAAK,CAAC;IACf,CAAC,EAAE,CAAC,EAAU,EAAE,EAAE;QAChB,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnB,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;IACtD,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrB,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACjD,CAAC;AAED,IAAI,CAAC,mFAAmF,EAAE,GAAG,EAAE;IAC7F,MAAM,IAAI,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC7B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAE,EAAE,0GAA0G,CAAC,CAAC;IACnI,KAAK,MAAM,QAAQ,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAU;QAAE,MAAM,CAAC,SAAS,CAAC,6BAA6B,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;AACrH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;IACrG,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC;IACxB,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC3H,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACzI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;IACtF,MAAM,CAAC,KAAK,CAAE,KAAK,CAAC,MAAM,CAAC,MAAqC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAC1E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iEAAiE,EAAE,GAAG,EAAE;IAC3E,KAAK,MAAM,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrC,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;IAC5E,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC9H,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;IAC/F,KAAK,MAAM,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/B,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAA2B,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QAC9G,MAAM,CAAC,EAAE,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC;QAClC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrC,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iFAAiF,EAAE,GAAG,EAAE;IAC3F,MAAM,IAAI,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACzD,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;IACjB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3D,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC,CAAC;IACrD,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,6EAA6E,CAAC,CAAC;IAC3G,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAClC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AACpC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mGAAmG,EAAE,GAAG,EAAE;IAC7G,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3E,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,kFAAkF,CAAC,CAAC;IACxG,KAAK,MAAM,OAAO,IAAI,CAAC,eAAe,EAAE,aAAa,CAAC,EAAE,CAAC;QACvD,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,OAAO,0BAA0B,CAAC,CAAC,CAAC;QAC5E,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,OAAO,cAAc,CAAC,CAAC,CAAC;IAClE,CAAC;AACH,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dharma-ai-labs/agent-fabric",
-  "version": "0.2.161",
+  "version": "0.2.163",
   "description": "Local-first CLI for connecting coding agents to Dharma evaluation, orchestration, and signed Skill delivery",
   "license": "MIT",
   "homepage": "https://github.com/dharma-ai-labs/dharma-agent-fabric/tree/main/packages/cli#readme",