@fitlab-ai/agent-infra 0.9.13 → 0.9.15

package/dist/lib/sandbox/control/native-file-lock.js

@@ -0,0 +1,85 @@
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { acquireFileLock, NATIVE_LOCK_PRIMITIVE, probeNativeLockCapability } from '../../fs/file-lock.js';
+export { probeNativeLockCapability };
+const LOCK_ROOT_NAME = path.join('.agent-infra', 'sandbox-locks');
+function digest(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+function assertPrivateDirectory(directory, home) {
+    const resolvedHome = path.resolve(home);
+    let current = resolvedHome;
+    const relative = path.relative(resolvedHome, path.resolve(directory));
+    if (!relative || relative.startsWith('..') || path.isAbsolute(relative)) {
+        throw new Error('SANDBOX_LOCK_UNSUPPORTED: lock root must be below the user home');
+    }
+    for (const segment of relative.split(path.sep).filter(Boolean)) {
+        current = path.join(current, segment);
+        if (fs.existsSync(current)) {
+            const stat = fs.lstatSync(current);
+            if (stat.isSymbolicLink() || !stat.isDirectory()) {
+                throw new Error('SANDBOX_LOCK_UNSUPPORTED: lock namespace contains a link or non-directory');
+            }
+            if (process.platform !== 'win32' && typeof process.getuid === 'function'
+                && stat.uid !== process.getuid()) {
+                throw new Error('SANDBOX_LOCK_UNSUPPORTED: lock namespace owner mismatch');
+            }
+        }
+        else {
+            try {
+                fs.mkdirSync(current, { mode: 0o700 });
+            }
+            catch (error) {
+                if (error.code !== 'EEXIST')
+                    throw error;
+                const stat = fs.lstatSync(current);
+                if (stat.isSymbolicLink() || !stat.isDirectory()) {
+                    throw new Error('SANDBOX_LOCK_UNSUPPORTED: lock namespace contains a link or non-directory');
+                }
+            }
+        }
+        if (process.platform !== 'win32')
+            fs.chmodSync(current, 0o700);
+    }
+    const real = fs.realpathSync.native(path.resolve(directory));
+    const realRelative = path.relative(fs.realpathSync.native(resolvedHome), real);
+    if (!realRelative || realRelative.startsWith('..') || path.isAbsolute(realRelative)) {
+        throw new Error('SANDBOX_LOCK_UNSUPPORTED: lock namespace realpath escapes the user home');
+    }
+}
+export function resolveSandboxLockNamespace(carrierIdentity, options = {}) {
+    if (!carrierIdentity.trim())
+        throw new Error('SANDBOX_LOCK_IDENTITY_INVALID');
+    const home = path.resolve(options.home ?? os.homedir());
+    const lockRoot = path.join(home, LOCK_ROOT_NAME);
+    assertPrivateDirectory(lockRoot, home);
+    const lockDomain = options.lockDomain ?? digest(`${process.platform}\0${process.arch}\0${NATIVE_LOCK_PRIMITIVE}`);
+    if (!/^[a-f0-9]{64}$/u.test(lockDomain))
+        throw new Error('SANDBOX_LOCK_DOMAIN_INVALID');
+    const domainDirectory = path.join(lockRoot, lockDomain);
+    assertPrivateDirectory(domainDirectory, home);
+    const carrierIdentityDigest = digest(carrierIdentity);
+    return {
+        lockRoot,
+        domainDirectory,
+        lockDomain,
+        carrierIdentityDigest,
+        lockPath: path.join(domainDirectory, `${carrierIdentityDigest}.lock`)
+    };
+}
+export function stableSandboxLockPath(carrierIdentity, lockDomain, options = {}) {
+    return resolveSandboxLockNamespace(carrierIdentity, { lockDomain, home: options.home }).lockPath;
+}
+export function acquireSandboxResourceLock(carrierIdentity, options = {}) {
+    const namespace = resolveSandboxLockNamespace(carrierIdentity, options);
+    try {
+        const lock = acquireFileLock(namespace.lockPath);
+        return { path: namespace.lockPath, lockDomain: namespace.lockDomain, release: lock.release };
+    }
+    catch (error) {
+        throw new Error(String(error instanceof Error ? error.message : error).replaceAll('FILE_LOCK_', 'SANDBOX_LOCK_'));
+    }
+}
+//# sourceMappingURL=native-file-lock.js.map

package/dist/lib/sandbox/control/protocol.js

@@ -1,6 +1,8 @@
 import { createHash } from 'node:crypto';
 import { validateTaskCreateCandidate } from '../../task/create.js';
 import { normalizeAgentToken } from '../../agent-clients/tokens.js';
+import { validateTaskWorkflowRequest } from './task-workflow.js';
+import { validateLifecycleAuthorityRequest } from '../../task/control-authority.js';
 export const SANDBOX_CONTROL_MAX_BYTES = 64 * 1024;
 export const SANDBOX_CONTROL_MAX_LOGICAL_RECORDS = 1024;
 export const SANDBOX_CONTROL_MAX_RESPONSE_BYTES = 64 * 1024 * 1024;
@@ -10,7 +12,7 @@ export const SANDBOX_CONTROL_ADMISSION_WINDOW_MS = 2_000;
 export const SANDBOX_CONTROL_STATUS_INTERVAL_MS = 250;
 export const SANDBOX_CONTROL_STATUS_STALE_MS = 1_500;
 export const SANDBOX_CONTROL_FUTURE_SKEW_MS = 1_000;
-export const SANDBOX_CONTROL_FAMILIES = ['task-lifecycle', 'task-orchestration', 'task-finalization', 'task-create', 'codex-controller'];
+export const SANDBOX_CONTROL_FAMILIES = ['task-lifecycle', 'task-orchestration', 'task-finalization', 'task-create', 'codex-controller', 'task-workflow'];
 export const DEFAULT_SANDBOX_CONTROL_TIMING = Object.freeze({
     controlTickMs: 250,
     parkedBindingInitialMs: 1_000,
@@ -171,8 +173,27 @@ export function validateSandboxControlRequest(value, manifest, options = {}) {
         }
         return request;
     }
-    const expected = ['args', 'controllerProcess', 'controllerProof', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'token', 'version'];
-    if (Object.keys(request).sort().join(',') !== expected.sort().join(',')
+    if (request.family === 'task-workflow') {
+        const expected = ['args', 'authority', 'controllerProcess', 'controllerProof', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'token', 'version', 'workflow'];
+        const baseExpected = expected.filter((key) => key !== 'authority');
+        if (![baseExpected, expected].some((keys) => Object.keys(request).sort().join(',') === keys.sort().join(','))
+            || !Array.isArray(request.args) || request.args.length !== 0
+            || request.controllerProcess !== null || request.controllerProof !== null) {
+            fail('SANDBOX_CONTROL_REQUEST_INVALID', 'task-workflow request schema is invalid');
+        }
+        if (manifest.mode !== 'task-bound' || !manifest.taskId)
+            fail('SANDBOX_CONTROL_BRANCH_ONLY', 'branch-only sandboxes cannot use task-workflow');
+        const workflow = validateTaskWorkflowRequest(request.workflow);
+        if (workflow.taskId !== manifest.taskId || workflow.generation !== manifest.generation || workflow.id !== request.id) {
+            fail('SANDBOX_CONTROL_REQUEST_INVALID', 'task-workflow binding does not match the sandbox manifest');
+        }
+        if (request.authority !== undefined)
+            validateAuthoritySelector(request.authority, request, manifest);
+        return { ...request, workflow };
+    }
+    const expected = ['args', 'authority', 'controllerProcess', 'controllerProof', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'token', 'version'];
+    const baseExpected = expected.filter((key) => key !== 'authority');
+    if (![baseExpected, expected].some((keys) => Object.keys(request).sort().join(',') === keys.sort().join(','))
         || !Array.isArray(request.args) || !request.args.every((arg) => typeof arg === 'string')) {
         fail('SANDBOX_CONTROL_REQUEST_INVALID', 'request schema or authorization is invalid');
     }
@@ -190,10 +211,40 @@ export function validateSandboxControlRequest(value, manifest, options = {}) {
     if (request.family !== 'task-orchestration' && request.controllerProof !== null) {
         fail('SANDBOX_CONTROL_REQUEST_INVALID', 'controller proof is not allowed for this family');
     }
+    if (request.authority !== undefined)
+        validateAuthoritySelector(request.authority, request, manifest);
     return request;
 }
+function validateAuthoritySelector(value, request, manifest) {
+    let authority;
+    try {
+        authority = validateLifecycleAuthorityRequest(value);
+    }
+    catch {
+        fail('SANDBOX_CONTROL_AUTHORITY_INVALID', 'lifecycle authority selector is invalid');
+    }
+    if (authority.requestId !== request.id
+        || authority.taskId !== manifest.taskId
+        || authority.expectedControlGeneration !== manifest.generation) {
+        fail('SANDBOX_CONTROL_AUTHORITY_INVALID', 'lifecycle authority selector is not bound to this request');
+    }
+    const args = Array.isArray(request.args) ? request.args : [];
+    if (request.family === 'task-orchestration'
+        && (args[1] !== 'prepare' || authority.phase !== 'orchestration.prepare')) {
+        fail('SANDBOX_CONTROL_AUTHORITY_INVALID', 'orchestration authority is only valid for prepare');
+    }
+    const workflow = request.workflow;
+    if (request.family === 'task-workflow') {
+        const expectedPhase = workflow?.operation === 'artifact-finalize-local'
+            ? 'artifact.finalize-local'
+            : workflow?.operation === 'event' ? 'task-event.completed' : null;
+        if (authority.phase !== expectedPhase) {
+            fail('SANDBOX_CONTROL_AUTHORITY_INVALID', 'workflow authority phase does not match the workflow operation');
+        }
+    }
+}
 export function bindSandboxControlTask(request, taskId) {
-    if (request.family === 'task-create' || request.family === 'codex-controller' || request.family === 'task-finalization') {
+    if (request.family === 'task-create' || request.family === 'codex-controller' || request.family === 'task-finalization' || request.family === 'task-workflow') {
         fail('SANDBOX_CONTROL_REQUEST_INVALID', `${request.family} requests do not bind a current task`);
     }
     if (request.args.length === 0)