@elizaos/agent 2.0.0-beta.2 → 2.0.11-beta.5

package/services/sandbox-manager.js

@@ -0,0 +1,440 @@
+/** Sandbox container lifecycle: create, exec, health check, teardown. */
+import { mkdirSync } from "node:fs";
+import path, { join } from "node:path";
+import { resolveStateDir } from "../config/paths.js";
+import { createEngine, detectBestEngine, } from "./sandbox-engine.js";
+/**
+ * Quote a single argv token using POSIX single-quote rules so the engine's
+ * string-based command parser round-trips it back to exactly one argument.
+ * Single-quoted strings preserve every character except `'`, which is encoded
+ * as the standard `'\''` sequence.
+ */
+function shQuote(token) {
+    if (token.length === 0)
+        return "''";
+    if (/^[A-Za-z0-9_+\-./=:@%]+$/.test(token))
+        return token;
+    return `'${token.replace(/'/g, "'\\''")}'`;
+}
+// ── Implementation ───────────────────────────────────────────────────────────
+export class SandboxManager {
+    state = "uninitialized";
+    config;
+    engine;
+    containerId = null;
+    browserContainerId = null;
+    eventLog = [];
+    lifecycleQueue = Promise.resolve();
+    constructor(config) {
+        this.config = {
+            image: "eliza-sandbox:bookworm-slim",
+            containerPrefix: "eliza-sandbox",
+            workdir: "/workspace",
+            network: "none",
+            user: "1000:1000",
+            capDrop: ["ALL"],
+            memory: "512m",
+            cpus: 1,
+            pidsLimit: 256,
+            ...config,
+        };
+        this.engine = config.engineType
+            ? createEngine(config.engineType)
+            : detectBestEngine();
+    }
+    getState() {
+        return this.state;
+    }
+    /** The active container engine's type, for diagnostics/labeling. */
+    get engineType() {
+        return this.engine.engineType;
+    }
+    getMode() {
+        return this.config.mode;
+    }
+    getWorkspaceRoot() {
+        return this.resolveWorkspaceRoot();
+    }
+    getContainerWorkspacePath(hostPath) {
+        const workspaceRoot = path.resolve(this.resolveWorkspaceRoot());
+        const absoluteHostPath = path.resolve(hostPath);
+        const relative = path.relative(workspaceRoot, absoluteHostPath);
+        if (relative.startsWith("..") || path.isAbsolute(relative)) {
+            return null;
+        }
+        const containerWorkdir = this.config.workdir ?? "/workspace";
+        if (!relative)
+            return containerWorkdir;
+        return path.posix.join(containerWorkdir.replace(/\\/g, "/"), relative.replace(/\\/g, "/"));
+    }
+    isReady() {
+        return this.state === "ready";
+    }
+    resolveWorkspaceRoot() {
+        const wsRoot = this.config.workspaceRoot ?? join(resolveStateDir(), "sandbox-workspace");
+        mkdirSync(wsRoot, { recursive: true });
+        return wsRoot;
+    }
+    getMainContainerConfig() {
+        const image = this.config.image ?? "eliza-sandbox:bookworm-slim";
+        const containerPrefix = this.config.containerPrefix ?? "eliza-sandbox";
+        const workdir = this.config.workdir ?? "/workspace";
+        const network = this.config.network ?? "none";
+        const user = this.config.user ?? "1000:1000";
+        const wsRoot = this.resolveWorkspaceRoot();
+        return { image, containerPrefix, workdir, network, user, wsRoot };
+    }
+    async createMainContainer() {
+        const config = this.getMainContainerConfig();
+        return this.engine.runContainer({
+            image: config.image,
+            name: `${config.containerPrefix}-${Date.now()}`,
+            detach: true,
+            mounts: [
+                { host: config.wsRoot, container: config.workdir, readonly: false },
+            ],
+            env: this.config.env ?? {},
+            network: config.network,
+            user: config.user,
+            capDrop: this.config.capDrop ?? [],
+            memory: this.config.memory,
+            cpus: this.config.cpus,
+            pidsLimit: this.config.pidsLimit,
+            readOnlyRoot: this.config.readOnlyRoot,
+            dns: this.config.dns,
+        });
+    }
+    async cleanupContainer(containerId) {
+        if (!containerId)
+            return;
+        await this.engine.stopContainer(containerId);
+        await this.engine.removeContainer(containerId);
+    }
+    setState(newState) {
+        const oldState = this.state;
+        this.state = newState;
+        this.emitEvent({
+            timestamp: Date.now(),
+            type: "state_change",
+            detail: `${oldState} → ${newState}`,
+        });
+    }
+    queueLifecycle(operation) {
+        const run = this.lifecycleQueue.then(operation, operation);
+        this.lifecycleQueue = run.then(() => undefined, () => undefined);
+        return run;
+    }
+    async start() {
+        return this.queueLifecycle(async () => {
+            if (this.config.mode === "off") {
+                if (this.state !== "stopped") {
+                    this.setState("stopped");
+                }
+                return;
+            }
+            if (this.config.mode === "light") {
+                if (this.state !== "ready") {
+                    this.setState("ready");
+                }
+                return;
+            }
+            if (this.state === "ready" ||
+                this.state === "initializing" ||
+                this.state === "recovering") {
+                return;
+            }
+            // Standard / Max: create container
+            this.setState("initializing");
+            try {
+                const config = this.getMainContainerConfig();
+                if (!this.engine.isAvailable()) {
+                    throw new Error(`Container engine "${this.engine.engineType}" is not available. Install Docker or Apple Container.`);
+                }
+                if (!this.engine.imageExists(config.image)) {
+                    try {
+                        await this.engine.pullImage(config.image);
+                    }
+                    catch {
+                        throw new Error(`Sandbox image "${config.image}" not found. Build with: scripts/sandbox-setup.sh`);
+                    }
+                }
+                // Cleanup orphans from previous runs
+                const orphans = this.engine.listContainers(config.containerPrefix);
+                for (const id of orphans) {
+                    await this.engine.stopContainer(id);
+                    await this.engine.removeContainer(id);
+                }
+                this.containerId = await this.createMainContainer();
+                this.emitEvent({
+                    timestamp: Date.now(),
+                    type: "container_start",
+                    detail: `Container started: ${this.containerId}`,
+                });
+                // Start browser container if configured
+                if (this.config.browser?.enabled && this.config.browser.autoStart) {
+                    try {
+                        this.browserContainerId = await this.createBrowserContainer();
+                    }
+                    catch (err) {
+                        this.emitEvent({
+                            timestamp: Date.now(),
+                            type: "error",
+                            detail: `Browser container start failed: ${String(err)}`,
+                        });
+                        // Non-fatal: sandbox can work without browser
+                    }
+                }
+                // Health check
+                const healthy = await this.healthCheck();
+                if (healthy) {
+                    this.setState("ready");
+                }
+                else {
+                    this.setState("degraded");
+                }
+            }
+            catch (err) {
+                this.emitEvent({
+                    timestamp: Date.now(),
+                    type: "error",
+                    detail: `Sandbox start failed: ${String(err)}`,
+                });
+                this.setState("degraded");
+                throw err;
+            }
+        });
+    }
+    async recover() {
+        return this.queueLifecycle(async () => {
+            if (this.state !== "degraded") {
+                return; // Only recover from degraded
+            }
+            this.setState("recovering");
+            this.emitEvent({
+                timestamp: Date.now(),
+                type: "state_change",
+                detail: "Attempting recovery from degraded state",
+            });
+            try {
+                const config = this.getMainContainerConfig();
+                await this.cleanupContainer(this.containerId);
+                await this.cleanupContainer(this.browserContainerId);
+                this.containerId = null;
+                this.browserContainerId = null;
+                const orphans = this.engine.listContainers(config.containerPrefix);
+                for (const id of orphans) {
+                    await this.engine.stopContainer(id);
+                    await this.engine.removeContainer(id);
+                }
+                this.containerId = await this.createMainContainer();
+                const healthy = await this.healthCheck();
+                if (healthy) {
+                    this.setState("ready");
+                }
+                else {
+                    this.setState("degraded");
+                }
+            }
+            catch (err) {
+                this.emitEvent({
+                    timestamp: Date.now(),
+                    type: "error",
+                    detail: `Recovery failed: ${String(err)}`,
+                });
+                this.setState("degraded");
+            }
+        });
+    }
+    async stop() {
+        return this.queueLifecycle(async () => {
+            if (this.state === "stopped") {
+                return;
+            }
+            if (this.state === "uninitialized") {
+                this.setState("stopped");
+                return;
+            }
+            this.setState("stopping");
+            try {
+                await this.cleanupContainer(this.browserContainerId);
+                await this.cleanupContainer(this.containerId);
+                this.browserContainerId = null;
+                this.containerId = null;
+            }
+            catch (err) {
+                this.emitEvent({
+                    timestamp: Date.now(),
+                    type: "error",
+                    detail: `Sandbox stop error: ${String(err)}`,
+                });
+            }
+            this.setState("stopped");
+        });
+    }
+    async exec(options) {
+        const start = Date.now();
+        if (this.config.mode === "off" || this.config.mode === "light") {
+            // In off/light mode, refuse sandbox exec — caller must use local
+            return {
+                exitCode: 1,
+                stdout: "",
+                stderr: "Sandbox exec not available in current mode",
+                durationMs: Date.now() - start,
+                executedInSandbox: false,
+            };
+        }
+        if (!this.containerId || this.state !== "ready") {
+            this.emitEvent({
+                timestamp: Date.now(),
+                type: "exec_denied",
+                detail: `Sandbox not ready (state=${this.state})`,
+            });
+            return {
+                exitCode: 1,
+                stdout: "",
+                stderr: `Sandbox not ready (state=${this.state})`,
+                durationMs: Date.now() - start,
+                executedInSandbox: false,
+            };
+        }
+        this.emitEvent({
+            timestamp: Date.now(),
+            type: "exec",
+            detail: options.command.substring(0, 200),
+            metadata: {
+                workdir: options.workdir ?? this.config.workdir ?? "/workspace",
+            },
+        });
+        try {
+            const result = await this.engine.execInContainer({
+                containerId: this.containerId,
+                command: options.command,
+                workdir: options.workdir,
+                env: options.env,
+                timeoutMs: options.timeoutMs,
+                stdin: options.stdin,
+            });
+            return {
+                ...result,
+                executedInSandbox: true,
+            };
+        }
+        catch (err) {
+            this.emitEvent({
+                timestamp: Date.now(),
+                type: "error",
+                detail: `Sandbox exec failed: ${String(err)}`,
+                metadata: {
+                    command: options.command.substring(0, 200),
+                },
+            });
+            return {
+                exitCode: 1,
+                stdout: "",
+                stderr: `Exec error: ${String(err)}`,
+                durationMs: Date.now() - start,
+                executedInSandbox: false,
+            };
+        }
+    }
+    /**
+     * Argv-aware variant of {@link exec}. Builds a properly-quoted command
+     * string from `cmd` + `args` and forwards to the underlying engine. Use
+     * this from the shell-execution router so callers that already have
+     * argv-shaped requests don't have to re-quote and risk shell-injection
+     * mismatches.
+     */
+    async run(options) {
+        const tokens = [options.cmd, ...options.args].map(shQuote).join(" ");
+        return this.exec({
+            command: tokens,
+            workdir: options.workdir,
+            env: options.env,
+            timeoutMs: options.timeoutMs,
+            stdin: options.stdin,
+        });
+    }
+    getBrowserCdpEndpoint() {
+        if (!this.browserContainerId)
+            return null;
+        const port = this.config.browser?.cdpPort ?? 9222;
+        return `http://localhost:${port}`;
+    }
+    getBrowserWsEndpoint() {
+        if (!this.browserContainerId)
+            return null;
+        const port = this.config.browser?.cdpPort ?? 9222;
+        return `ws://localhost:${port}`;
+    }
+    getBrowserNoVncEndpoint() {
+        if (!this.browserContainerId)
+            return null;
+        const noVncEnabled = this.config.browser?.enableNoVnc ?? false;
+        const headless = this.config.browser?.headless ?? false;
+        if (!noVncEnabled || headless)
+            return null;
+        const port = this.config.browser?.noVncPort ?? 6080;
+        return `http://localhost:${port}/vnc.html?autoconnect=true&resize=scale&view_only=true`;
+    }
+    async createBrowserContainer() {
+        const name = `${this.config.containerPrefix}-browser-${Date.now()}`;
+        const cdpPort = this.config.browser?.cdpPort ?? 9222;
+        const vncPort = this.config.browser?.vncPort ?? 5900;
+        const noVncPort = this.config.browser?.noVncPort ?? 6080;
+        const enableNoVnc = this.config.browser?.enableNoVnc ?? false;
+        const headless = this.config.browser?.headless ?? false;
+        const image = this.config.browser?.image ?? "eliza-sandbox-browser:bookworm-slim";
+        return this.engine.runContainer({
+            image,
+            name,
+            detach: true,
+            mounts: [],
+            env: {
+                ELIZA_BROWSER_CDP_PORT: String(cdpPort),
+                ELIZA_BROWSER_VNC_PORT: String(vncPort),
+                ELIZA_BROWSER_NOVNC_PORT: String(noVncPort),
+                ELIZA_BROWSER_ENABLE_NOVNC: enableNoVnc ? "1" : "0",
+                ELIZA_BROWSER_HEADLESS: headless ? "1" : "0",
+            },
+            network: "bridge",
+            user: "1000:1000",
+            capDrop: [],
+            ports: [
+                { host: cdpPort, container: cdpPort },
+                { host: vncPort, container: vncPort },
+                ...(enableNoVnc && !headless
+                    ? [{ host: noVncPort, container: noVncPort }]
+                    : []),
+            ],
+        });
+    }
+    async healthCheck() {
+        if (!this.containerId)
+            return false;
+        const healthy = await this.engine.healthCheck(this.containerId);
+        this.emitEvent({
+            timestamp: Date.now(),
+            type: "health_check",
+            detail: healthy ? "healthy" : "unhealthy",
+        });
+        return healthy;
+    }
+    emitEvent(event) {
+        this.eventLog.push(event);
+        // Keep bounded
+        if (this.eventLog.length > 1000) {
+            this.eventLog = this.eventLog.slice(-500);
+        }
+    }
+    getEventLog() {
+        return [...this.eventLog];
+    }
+    getStatus() {
+        return {
+            state: this.state,
+            mode: this.config.mode,
+            containerId: this.containerId,
+            browserContainerId: this.browserContainerId,
+        };
+    }
+}

package/services/self-updater.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Detects the installation method and runs the appropriate upgrade command.
+ * Falls back to npm if detection is ambiguous.
+ */
+import type { ReleaseChannel } from "../config/types.eliza.ts";
+export type InstallMethod = "npm-global" | "bun-global" | "homebrew" | "snap" | "apt" | "flatpak" | "local-dev" | "unknown";
+export type UpdateAuthority = "package-manager" | "os-package-manager" | "developer" | "operator";
+export type UpdateNextAction = "run-package-manager-command" | "run-git-pull" | "review-installation" | "none";
+export interface UpdateResult {
+    success: boolean;
+    method: InstallMethod;
+    command: string;
+    previousVersion: string;
+    newVersion: string | null;
+    error: string | null;
+}
+export interface UpdateCommandInfo {
+    command: string;
+    args: string[];
+    displayCommand: string;
+}
+export interface UpdateActionPlan {
+    method: InstallMethod;
+    authority: UpdateAuthority;
+    nextAction: UpdateNextAction;
+    canAutoUpdate: boolean;
+    canExecuteFromContext: boolean;
+    remoteDisplay: boolean;
+    command: string | null;
+    message: string;
+}
+export declare function detectInstallMethod(): InstallMethod;
+export declare function buildUpdateCommand(method: InstallMethod, channel: ReleaseChannel): UpdateCommandInfo | null;
+export declare function getUpdateActionPlan(method: InstallMethod, channel: ReleaseChannel, options?: {
+    remoteDisplay?: boolean;
+}): UpdateActionPlan;
+export declare function performUpdate(currentVersion: string, channel: ReleaseChannel, method?: InstallMethod): Promise<UpdateResult>;
+//# sourceMappingURL=self-updater.d.ts.map

package/services/self-updater.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-updater.d.ts","sourceRoot":"","sources":["../../src/services/self-updater.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAK/D,MAAM,MAAM,aAAa,GACrB,YAAY,GACZ,YAAY,GACZ,UAAU,GACV,MAAM,GACN,KAAK,GACL,SAAS,GACT,WAAW,GACX,SAAS,CAAC;AAEd,MAAM,MAAM,eAAe,GACvB,iBAAiB,GACjB,oBAAoB,GACpB,WAAW,GACX,UAAU,CAAC;AAEf,MAAM,MAAM,gBAAgB,GACxB,6BAA6B,GAC7B,cAAc,GACd,qBAAqB,GACrB,MAAM,CAAC;AAEX,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,aAAa,CAAC;IACtB,SAAS,EAAE,eAAe,CAAC;IAC3B,UAAU,EAAE,gBAAgB,CAAC;IAC7B,aAAa,EAAE,OAAO,CAAC;IACvB,qBAAqB,EAAE,OAAO,CAAC;IAC/B,aAAa,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB;AA8BD,wBAAgB,mBAAmB,IAAI,aAAa,CAyBnD;AAED,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,cAAc,GACtB,iBAAiB,GAAG,IAAI,CAyD1B;AAkDD,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAE,GACpC,gBAAgB,CAyBlB;AA6CD,wBAAsB,aAAa,CACjC,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,cAAc,EACvB,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,YAAY,CAAC,CAsCvB"}