@fitlab-ai/agent-infra 0.9.3 → 0.9.4

package/lib/sandbox/runtimes/base.dockerfile

@@ -64,69 +64,9 @@ RUN printf '%s\n' \
       'set -g mouse on' \
       'set -g status-interval 1' \
       'set -g status-right-length 80' \
-      "set -g status-right '#(/usr/local/bin/cc-token-status) | %H:%M'" \
+      "set -g status-right '%H:%M'" \
     > /etc/tmux.conf
 
-RUN cat > /usr/local/bin/cc-token-status <<'SCRIPT' && chmod +x /usr/local/bin/cc-token-status
-#!/bin/sh
-set -eu
-
-SETTINGS_FILE="/home/devuser/.claude/settings.json"
-if [ -r "$SETTINGS_FILE" ] && jq -e '
-  def has_nonempty($v):
-    if ($v | type) == "string" then ($v | gsub("^\\s+|\\s+$"; "") | length) > 0 else false end;
-  (if type == "object" then . else {} end) as $settings
-  | (if ($settings.env | type) == "object" then $settings.env else {} end) as $env
-  | has_nonempty($env.ANTHROPIC_AUTH_TOKEN)
-    or has_nonempty($env.ANTHROPIC_API_KEY)
-    or has_nonempty($settings.apiKeyHelper)
-' "$SETTINGS_FILE" >/dev/null 2>&1; then
-  exit 0
-fi
-
-CRED_FILE="/home/devuser/.claude/.credentials.json"
-[ -r "$CRED_FILE" ] || exit 0
-
-EXPIRES_MS=$(jq -r '(.claudeAiOauth.expiresAt // .expiresAt) // empty' "$CRED_FILE" 2>/dev/null || true)
-case "$EXPIRES_MS" in
-  ''|*[!0-9]*) exit 0 ;;
-esac
-
-NOW_MS=$(($(date +%s) * 1000))
-DIFF_MS=$((EXPIRES_MS - NOW_MS))
-DIFF_S=$((DIFF_MS / 1000))
-
-DIM='#[fg=colour245]'
-YELLOW='#[fg=yellow]'
-YELLOW_BOLD='#[fg=yellow,bold]'
-RED_BOLD='#[fg=red,bold]'
-RED_REV='#[fg=red,reverse]'
-RESET='#[default]'
-
-if [ "$DIFF_S" -le 0 ]; then
-  ELAPSED=$(( -DIFF_S ))
-  M=$((ELAPSED / 60))
-  printf '%sClaude Code auth EXPIRED %dm ago%s' "$RED_REV" "$M" "$RESET"
-elif [ "$DIFF_S" -lt 60 ]; then
-  printf '%sClaude Code auth expires in %ds%s' "$RED_BOLD" "$DIFF_S" "$RESET"
-elif [ "$DIFF_S" -lt 300 ]; then
-  M=$((DIFF_S / 60))
-  S=$((DIFF_S % 60))
-  printf '%sClaude Code auth expires in %dm %ds%s' "$RED_BOLD" "$M" "$S" "$RESET"
-elif [ "$DIFF_S" -lt 1800 ]; then
-  M=$((DIFF_S / 60))
-  printf '%sClaude Code auth expires in %dm%s' "$YELLOW_BOLD" "$M" "$RESET"
-elif [ "$DIFF_S" -lt 3600 ]; then
-  M=$((DIFF_S / 60))
-  printf '%sClaude Code auth expires in %dm%s' "$YELLOW" "$M" "$RESET"
-else
-  TOTAL_M=$((DIFF_S / 60))
-  H=$((TOTAL_M / 60))
-  M=$((TOTAL_M % 60))
-  printf '%sClaude Code auth expires in %dh %dm%s' "$DIM" "$H" "$M" "$RESET"
-fi
-SCRIPT
-
 RUN cat > /usr/local/bin/sandbox-dotfiles-link <<'SCRIPT' && chmod +x /usr/local/bin/sandbox-dotfiles-link
 #!/bin/sh
 # Mirror /dotfiles/ tree as symlinks under $HOME/, overwriting any image-baked
@@ -136,23 +76,34 @@ set -eu
 DOTFILES_SRC=/dotfiles
 [ -d "$DOTFILES_SRC" ] || exit 0
 
-cd "$DOTFILES_SRC"
-find . -type f -print | while IFS= read -r rel; do
-  rel=${rel#./}
-  target="$HOME/$rel"
-  case "$rel" in
+is_dotfiles_excluded() {
+  candidate=$1
+  case "$candidate" in
     .ssh|.ssh/*|\
     .gnupg|.gnupg/*|\
-    .claude|.claude/*|\
-    .codex|.codex/*|\
-    .gemini|.gemini/*|\
-    .config/opencode|.config/opencode/*|\
-    .local/share/opencode|.local/share/opencode/*|\
     .host-shell-config|.host-shell-config/*|\
     .gitconfig|.gitignore_global|.stCommitMsg|.bash_aliases|README.md)
-      continue ;;
+      return 0 ;;
   esac
 
+  [ -r /etc/agent-infra/dotfiles-exclusions ] || return 1
+  while IFS= read -r prefix; do
+    [ -n "$prefix" ] || continue
+    case "$candidate" in
+      "$prefix"|"$prefix"/*) return 0 ;;
+    esac
+  done < /etc/agent-infra/dotfiles-exclusions
+  return 1
+}
+
+cd "$DOTFILES_SRC"
+find . -type f -print | while IFS= read -r rel; do
+  rel=${rel#./}
+  target="$HOME/$rel"
+  if is_dotfiles_excluded "$rel"; then
+    continue
+  fi
+
   mkdir -p "$(dirname "$target")"
   if [ -d "$target" ] && [ ! -L "$target" ]; then
     printf 'sandbox-dotfiles-link: skipping %s (existing directory; use nested path like %s/<file> instead)\n' "$target" "$rel" >&2
@@ -198,8 +149,7 @@ fi
 exec tmux new-session -s "$SESSION"
 SCRIPT
 
-RUN test -s /usr/local/bin/cc-token-status && test -x /usr/local/bin/cc-token-status && \
-    test -s /usr/local/bin/sandbox-dotfiles-link && test -x /usr/local/bin/sandbox-dotfiles-link && \
+RUN test -s /usr/local/bin/sandbox-dotfiles-link && test -x /usr/local/bin/sandbox-dotfiles-link && \
     test -s /usr/local/bin/sandbox-tmux-entry && test -x /usr/local/bin/sandbox-tmux-entry
 
 ENV LANG=en_US.UTF-8

package/lib/sandbox/tool-types.ts

@@ -64,15 +64,23 @@ type SandboxResolvedToolState = Readonly<{
 
 type SandboxHookCreateContext = Readonly<{
   hostHome: string;
+  hostEnv?: Readonly<NodeJS.ProcessEnv>;
+  project: string;
   resolvedTools: readonly SandboxResolvedToolState[];
 }>;
 
+type SandboxHookEnterContext = Readonly<{
+  hostHome: string;
+  hostEnv?: Readonly<NodeJS.ProcessEnv>;
+}>;
+
 type AgentClientSandboxHookContext = Readonly<{
   signal: AbortSignal;
   runCommand(command: SandboxHookCommand): Promise<SandboxHookCommandResult>;
   config?: Readonly<Record<string, unknown>>;
   plan?: Readonly<Record<string, unknown>>;
   create?: SandboxHookCreateContext;
+  enter?: SandboxHookEnterContext;
 }>;
 
 type AgentClientSandboxHook = Readonly<{
@@ -113,11 +121,17 @@ type AgentClientSandboxRecoveryCheck = Readonly<{
   repair?: SandboxRecoveryRepair;
 }>;
 
+type AgentClientSandboxImageDescriptor = Readonly<{
+  dockerfileFragment?: string;
+  dotfilesExclusions?: readonly string[];
+}>;
+
 type AgentClientSandboxDescriptor = Readonly<{
   createTool(context: SandboxToolContext): SandboxTool;
   aliases: readonly SandboxAlias[];
   hooks: readonly AgentClientSandboxHook[];
   recoveryChecks?: readonly AgentClientSandboxRecoveryCheck[];
+  image?: AgentClientSandboxImageDescriptor;
 }>;
 
 export { SANDBOX_HOOK_PHASES };
@@ -126,6 +140,7 @@ export type {
   AgentClientSandboxHook,
   AgentClientSandboxHookContext,
   AgentClientSandboxHookResult,
+  AgentClientSandboxImageDescriptor,
   AgentClientSandboxRecoveryCheck,
   SandboxAlias,
   SandboxHookCommand,
@@ -133,6 +148,7 @@ export type {
   SandboxHookPhase,
   SandboxHookStatus,
   SandboxHookCreateContext,
+  SandboxHookEnterContext,
   SandboxRecoveryFindingDescriptor,
   SandboxRecoveryProbe,
   SandboxRecoveryRepair,

package/lib/sandbox/workspace-identity.ts

@@ -0,0 +1,123 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { isRemovedHashShortIdInput } from '../task/short-id.ts';
+
+const TASK_ID_RE = /^TASK-\d{8}-\d{6}$/;
+const SHORT_ID_RE = /^\d+$/;
+
+export type SandboxWorkspaceIdentity =
+  | Readonly<{ mode: 'task-bound'; taskId: string; shortId: string }>
+  | Readonly<{ mode: 'branch-only' }>;
+
+export type SandboxContainerWorkspaceIdentity =
+  | Readonly<{ mode: 'task-bound'; taskId: string }>
+  | Readonly<{ mode: 'branch-only' }>
+  | Readonly<{ mode: 'legacy-invalid' }>;
+
+export type SandboxTarget = Readonly<{
+  requestedRef: string;
+  branch: string;
+  workspace: SandboxWorkspaceIdentity;
+}>;
+
+function stripQuotes(value: string): string {
+  return value.replace(/^(?:"([^"]*)"|'([^']*)')$/, '$1$2');
+}
+
+function taskBranch(taskMd: string, taskId: string): string {
+  const content = fs.readFileSync(taskMd, 'utf8');
+  const value = content.match(/^branch:\s*(.+)$/m)?.[1]?.trim()
+    ?? content.match(/^- \*\*(?:分支|Branch)\*\*：[ \t]*`?([^`\n]+)`?$/m)?.[1]?.trim();
+  if (!value) throw new Error(`Task ${taskId} has no branch field in task.md`);
+  return stripQuotes(value);
+}
+
+function activeRegistry(repoRoot: string): Record<string, string> {
+  const registryPath = path.join(repoRoot, '.agents', 'workspace', 'active', '.short-ids.json');
+  if (!fs.existsSync(registryPath)) return {};
+  const value = JSON.parse(fs.readFileSync(registryPath, 'utf8')) as unknown;
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    throw new Error('Active task short-id registry is invalid');
+  }
+  const ids = 'ids' in value && value.ids && typeof value.ids === 'object' && !Array.isArray(value.ids)
+    ? value.ids as Record<string, unknown>
+    : value as Record<string, unknown>;
+  return Object.fromEntries(
+    Object.entries(ids).filter((entry): entry is [string, string] =>
+      SHORT_ID_RE.test(entry[0]) && typeof entry[1] === 'string' && TASK_ID_RE.test(entry[1])
+    )
+  );
+}
+
+function taskIdentity(repoRoot: string, taskId: string, registry: Record<string, string>): SandboxWorkspaceIdentity {
+  const taskMd = path.join(repoRoot, '.agents', 'workspace', 'active', taskId, 'task.md');
+  if (!fs.existsSync(taskMd)) throw new Error(`Active task not found: ${taskId}`);
+  const shortIds = Object.entries(registry).filter(([, id]) => id === taskId).map(([shortId]) => shortId);
+  if (shortIds.length !== 1) {
+    throw new Error(`Task ${taskId} must have exactly one active short id`);
+  }
+  return { mode: 'task-bound', taskId, shortId: shortIds[0]! };
+}
+
+export function resolveSandboxTarget(requestedRef: string, repoRoot: string): SandboxTarget {
+  if (isRemovedHashShortIdInput(requestedRef)) {
+    throw new Error(`Invalid task short id '${requestedRef}': task short ids must use bare digits`);
+  }
+  const registry = activeRegistry(repoRoot);
+  if (SHORT_ID_RE.test(requestedRef)) {
+    const matchingShortIds = Object.keys(registry).filter((shortId) =>
+      shortId === requestedRef || Number(shortId) === Number(requestedRef)
+    );
+    if (matchingShortIds.length > 1) {
+      throw new Error(`Short id '${requestedRef}' is ambiguous in active task registry`);
+    }
+    const canonicalShortId = matchingShortIds[0];
+    const taskId = canonicalShortId ? registry[canonicalShortId] : undefined;
+    if (!taskId) throw new Error(`Short id '${requestedRef}' not found in active task registry`);
+    const workspace = taskIdentity(repoRoot, taskId, registry);
+    return { requestedRef, branch: taskBranch(path.join(repoRoot, '.agents', 'workspace', 'active', taskId, 'task.md'), taskId), workspace };
+  }
+  if (TASK_ID_RE.test(requestedRef)) {
+    const workspace = taskIdentity(repoRoot, requestedRef, registry);
+    return { requestedRef, branch: taskBranch(path.join(repoRoot, '.agents', 'workspace', 'active', requestedRef, 'task.md'), requestedRef), workspace };
+  }
+
+  const activeRoot = path.join(repoRoot, '.agents', 'workspace', 'active');
+  const matches = fs.existsSync(activeRoot)
+    ? fs.readdirSync(activeRoot, { withFileTypes: true }).flatMap((entry) => {
+      if (!entry.isDirectory() || !TASK_ID_RE.test(entry.name)) return [];
+      const taskMd = path.join(activeRoot, entry.name, 'task.md');
+      if (!fs.existsSync(taskMd)) return [];
+      return taskBranch(taskMd, entry.name) === requestedRef ? [entry.name] : [];
+    })
+    : [];
+  if (matches.length > 1) {
+    throw new Error(`SANDBOX_TASK_IDENTITY_AMBIGUOUS: branch '${requestedRef}' is bound to multiple active tasks`);
+  }
+  if (matches.length === 1) {
+    const taskId = matches[0]!;
+    return { requestedRef, branch: requestedRef, workspace: taskIdentity(repoRoot, taskId, registry) };
+  }
+  return { requestedRef, branch: requestedRef, workspace: { mode: 'branch-only' } };
+}
+
+export function parseSandboxWorkspaceIdentity(
+  labels: Readonly<Record<string, string>>,
+  keys: Readonly<{ mode: string; taskId: string }>
+): SandboxContainerWorkspaceIdentity {
+  const mode = labels[keys.mode];
+  const taskId = labels[keys.taskId];
+  if (mode === 'branch-only' && taskId === undefined) return { mode: 'branch-only' };
+  if (mode === 'task-bound' && typeof taskId === 'string' && TASK_ID_RE.test(taskId)) {
+    return { mode: 'task-bound', taskId };
+  }
+  return { mode: 'legacy-invalid' };
+}
+
+export function sameSandboxWorkspaceIdentity(
+  left: SandboxWorkspaceIdentity | SandboxContainerWorkspaceIdentity,
+  right: SandboxWorkspaceIdentity | SandboxContainerWorkspaceIdentity
+): boolean {
+  return left.mode === right.mode
+    && (left.mode !== 'task-bound' || (right.mode === 'task-bound' && left.taskId === right.taskId));
+}

package/lib/sandbox/workspace-view.ts

@@ -0,0 +1,143 @@
+import { createHash, randomBytes } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import type { SandboxWorkspaceIdentity } from './workspace-identity.ts';
+import type { SandboxControlManifest } from './control/protocol.ts';
+
+export type SandboxWorkspaceView = Readonly<{
+  root: string;
+  taskMountPath: string | null;
+}>;
+
+export function sandboxWorkspaceViewPaths(params: Readonly<{
+  base: string;
+  project: string;
+  container: string;
+  identity: SandboxWorkspaceIdentity;
+}>): SandboxWorkspaceView {
+  const identityKey = params.identity.mode === 'task-bound'
+    ? `task-bound:${params.identity.taskId}`
+    : 'branch-only';
+  const digest = createHash('sha256').update(identityKey).digest('hex').slice(0, 16);
+  const projectRoot = path.resolve(params.base, params.project);
+  const root = path.resolve(projectRoot, params.container, digest);
+  return {
+    root,
+    taskMountPath: params.identity.mode === 'task-bound'
+      ? path.join(root, 'active', params.identity.taskId)
+      : null
+  };
+}
+
+export type SandboxControlSetup = Readonly<{
+  channelDir: string;
+  manifestPath: string;
+  token: string;
+}>;
+
+export function sandboxControlPaths(params: Readonly<{
+  base: string;
+  project: string;
+  container: string;
+  identity: SandboxWorkspaceIdentity;
+}>): Readonly<{ root: string; channelDir: string; manifestPath: string }> {
+  const identityKey = params.identity.mode === 'task-bound'
+    ? `task-bound:${params.identity.taskId}`
+    : 'branch-only';
+  const digest = createHash('sha256').update(identityKey).digest('hex').slice(0, 16);
+  const root = path.resolve(params.base, params.project, params.container, digest);
+  return { root, channelDir: path.join(root, 'channel'), manifestPath: path.join(root, 'manifest.json') };
+}
+
+function assertSafeDirectory(directory: string, expectedBase: string): void {
+  const relative = path.relative(expectedBase, directory);
+  if (relative.startsWith('..') || path.isAbsolute(relative)) {
+    throw new Error(`Sandbox workspace view escapes its configured root: ${directory}`);
+  }
+  if (fs.existsSync(directory) && fs.lstatSync(directory).isSymbolicLink()) {
+    throw new Error(`Sandbox workspace view must not be a symbolic link: ${directory}`);
+  }
+}
+
+export function assertSandboxTaskSource(repoRoot: string, taskId: string): string {
+  if (!/^TASK-\d{8}-\d{6}$/.test(taskId)) throw new Error('SANDBOX_TASK_SOURCE_INVALID');
+  const activeRoot = fs.realpathSync.native(path.join(repoRoot, '.agents', 'workspace', 'active'));
+  const source = path.join(activeRoot, taskId);
+  const stat = fs.lstatSync(source);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) {
+    throw new Error(`SANDBOX_TASK_SOURCE_INVALID: ${source} must be a real directory`);
+  }
+  const canonical = fs.realpathSync.native(source);
+  if (path.dirname(canonical) !== activeRoot) {
+    throw new Error(`SANDBOX_TASK_SOURCE_INVALID: ${source} escapes the active workspace`);
+  }
+  return canonical;
+}
+
+export function materializeSandboxWorkspaceView(params: Readonly<{
+  base: string;
+  project: string;
+  container: string;
+  identity: SandboxWorkspaceIdentity;
+}>): SandboxWorkspaceView {
+  const projectRoot = path.resolve(params.base, params.project);
+  const { root, taskMountPath } = sandboxWorkspaceViewPaths(params);
+  assertSafeDirectory(projectRoot, path.resolve(params.base));
+  assertSafeDirectory(root, projectRoot);
+  fs.mkdirSync(root, { recursive: true, mode: 0o700 });
+  for (const state of ['active', 'completed', 'blocked', 'archive']) {
+    const stateDir = path.join(root, state);
+    assertSafeDirectory(stateDir, root);
+    fs.rmSync(stateDir, { recursive: true, force: true });
+    fs.mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+  }
+
+  const active = path.join(root, 'active');
+  const registry = {
+    version: 1,
+    ids: params.identity.mode === 'task-bound'
+      ? { [params.identity.shortId]: params.identity.taskId }
+      : {}
+  };
+  fs.writeFileSync(path.join(active, '.short-ids.json'), `${JSON.stringify(registry)}\n`, {
+    encoding: 'utf8',
+    mode: 0o600
+  });
+  if (taskMountPath) {
+    assertSafeDirectory(taskMountPath, active);
+    fs.mkdirSync(taskMountPath, { recursive: true, mode: 0o700 });
+  }
+  return { root, taskMountPath };
+}
+
+export function materializeSandboxControl(params: Readonly<{
+  base: string;
+  repoRoot: string;
+  project: string;
+  container: string;
+  branch: string;
+  identity: SandboxWorkspaceIdentity;
+}>): SandboxControlSetup {
+  const { root, channelDir, manifestPath } = sandboxControlPaths(params);
+  assertSafeDirectory(root, path.resolve(params.base));
+  for (const queue of ['requests', 'responses']) {
+    const directory = path.join(channelDir, queue);
+    assertSafeDirectory(directory, root);
+    fs.rmSync(directory, { recursive: true, force: true });
+    fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+  }
+  const token = randomBytes(32).toString('hex');
+  const manifest: SandboxControlManifest = {
+    version: 1,
+    repoRoot: fs.realpathSync.native(params.repoRoot),
+    project: params.project,
+    container: params.container,
+    branch: params.branch,
+    mode: params.identity.mode,
+    taskId: params.identity.mode === 'task-bound' ? params.identity.taskId : null,
+    token,
+    channelDir
+  };
+  fs.writeFileSync(manifestPath, `${JSON.stringify(manifest)}\n`, { mode: 0o600 });
+  return { channelDir, manifestPath, token };
+}