@fitlab-ai/agent-infra 0.9.5 → 0.9.6

package/dist/lib/sandbox/control/state.js

@@ -0,0 +1,181 @@
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { buildProcessTreeStopCommand } from '../../server/process-control.js';
+import { processIdentityMatches } from '../../server/process-state.js';
+export const SANDBOX_CONTROL_AUDIT_MAX_BYTES = 1024 * 1024;
+export const SANDBOX_CONTROL_EXECUTION_STOP_MS = 2_000;
+function assertRegularFile(filePath) {
+    const stat = fs.lstatSync(filePath);
+    if (!stat.isFile() || stat.isSymbolicLink())
+        throw new Error('SANDBOX_CONTROL_STATE_INVALID');
+}
+export function atomicWriteJson(filePath, value, mode = 0o600, createParent = true) {
+    if (createParent)
+        fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
+    const temporary = path.join(path.dirname(filePath), `.${path.basename(filePath)}.${process.pid}.${randomUUID()}.tmp`);
+    try {
+        fs.writeFileSync(temporary, `${JSON.stringify(value)}\n`, { mode, flag: 'wx' });
+        fs.renameSync(temporary, filePath);
+    }
+    finally {
+        fs.rmSync(temporary, { force: true });
+    }
+}
+export function readJsonFile(filePath) {
+    assertRegularFile(filePath);
+    return JSON.parse(fs.readFileSync(filePath, 'utf8'));
+}
+export function statusPath(manifest) {
+    return path.join(manifest.publicStatusDir, 'status.json');
+}
+export function writeSandboxControlStatus(manifest, broker, state, reasonCode, activeRequestId, now = Date.now()) {
+    const status = {
+        version: 1, generation: manifest.generation, broker, state, reasonCode, activeRequestId, updatedAt: now
+    };
+    atomicWriteJson(statusPath(manifest), status, 0o600, false);
+    return status;
+}
+export function parseSandboxControlStatus(value) {
+    const status = value;
+    if (!status || status.version !== 1 || typeof status.generation !== 'string'
+        || !status.broker || !Number.isSafeInteger(status.broker.pid) || typeof status.broker.startTime !== 'string'
+        || !['starting', 'healthy', 'busy', 'parked'].includes(status.state ?? '')
+        || (status.reasonCode !== null && typeof status.reasonCode !== 'string')
+        || (status.activeRequestId !== null && typeof status.activeRequestId !== 'string')
+        || !Number.isSafeInteger(status.updatedAt))
+        throw new Error('SANDBOX_CONTROL_STATUS_INVALID');
+    return status;
+}
+export function readSandboxControlStatus(directory) {
+    return parseSandboxControlStatus(readJsonFile(path.join(directory, 'status.json')));
+}
+export function readActiveLease(manifest, now = Date.now()) {
+    const filePath = path.join(path.dirname(manifest.publicStatusDir), 'lease.json');
+    if (!fs.existsSync(filePath))
+        return null;
+    const lease = readJsonFile(filePath);
+    if (!lease || lease.version !== 1
+        || typeof lease.nonce !== 'string' || !lease.owner || !Number.isSafeInteger(lease.owner.pid)
+        || typeof lease.owner.startTime !== 'string' || !Number.isSafeInteger(lease.issuedAt)
+        || !Number.isSafeInteger(lease.expiresAt) || typeof lease.generation !== 'string'
+        || (lease.taskId !== null && typeof lease.taskId !== 'string')
+        || typeof lease.branch !== 'string' || typeof lease.reason !== 'string') {
+        throw new Error('SANDBOX_CONTROL_LEASE_INVALID');
+    }
+    if (lease.generation !== manifest.generation || lease.expiresAt <= now
+        || lease.taskId !== manifest.taskId || lease.branch !== manifest.branch)
+        return null;
+    return lease;
+}
+export function cleanupStaleSandboxControlLease(manifest, now = Date.now()) {
+    const filePath = path.join(path.dirname(manifest.publicStatusDir), 'lease.json');
+    if (!fs.existsSync(filePath))
+        return false;
+    const raw = fs.readFileSync(filePath, 'utf8');
+    const lease = JSON.parse(raw);
+    if (!lease || lease.version !== 1
+        || typeof lease.nonce !== 'string' || !lease.owner || !Number.isSafeInteger(lease.owner.pid)
+        || typeof lease.owner.startTime !== 'string' || !Number.isSafeInteger(lease.issuedAt)
+        || !Number.isSafeInteger(lease.expiresAt) || typeof lease.generation !== 'string'
+        || (lease.taskId !== null && typeof lease.taskId !== 'string')
+        || typeof lease.branch !== 'string' || typeof lease.reason !== 'string') {
+        throw new Error('SANDBOX_CONTROL_LEASE_INVALID');
+    }
+    const stale = lease.generation !== manifest.generation || lease.taskId !== manifest.taskId
+        || lease.branch !== manifest.branch || lease.expiresAt <= now || !processIdentityMatches({
+        version: 1, pid: lease.owner.pid, startTime: lease.owner.startTime
+    });
+    if (!stale)
+        return false;
+    if (fs.readFileSync(filePath, 'utf8') !== raw)
+        throw new Error('SANDBOX_CONTROL_LEASE_OWNERSHIP_LOST');
+    fs.unlinkSync(filePath);
+    return true;
+}
+export function appendSandboxControlAudit(manifest, event, fields = {}, now = Date.now()) {
+    const auditPath = path.join(path.dirname(manifest.publicStatusDir), 'audit.ndjson');
+    if (fs.existsSync(auditPath) && fs.statSync(auditPath).size >= SANDBOX_CONTROL_AUDIT_MAX_BYTES) {
+        fs.rmSync(`${auditPath}.1`, { force: true });
+        fs.renameSync(auditPath, `${auditPath}.1`);
+    }
+    fs.appendFileSync(auditPath, `${JSON.stringify({ version: 1, event, generation: manifest.generation, at: now, ...fields })}\n`, {
+        encoding: 'utf8', mode: 0o600
+    });
+}
+export function executionPath(manifest, requestId) {
+    return path.join(manifest.processingDir, requestId, 'execution.json');
+}
+export function readExecution(filePath) {
+    const execution = readJsonFile(filePath);
+    if (!execution || execution.version !== 1 || typeof execution.generation !== 'string'
+        || typeof execution.requestId !== 'string' || typeof execution.nonce !== 'string'
+        || !execution.child || !Number.isSafeInteger(execution.child.pid) || typeof execution.child.startTime !== 'string'
+        || !['prepared', 'running', 'terminating'].includes(execution.phase ?? '')
+        || !Number.isSafeInteger(execution.updatedAt))
+        throw new Error('SANDBOX_CONTROL_EXECUTION_INVALID');
+    return execution;
+}
+export function terminateSandboxControlExecution(execution, options = {}) {
+    const platform = options.platform ?? process.platform;
+    const processGroupId = execution.child.processGroupId;
+    const processGroupAlive = (groupId) => {
+        try {
+            const rows = execFileSync('ps', ['-axo', 'pgid=,stat='], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+            return rows.split('\n').some((row) => {
+                const match = row.trim().match(/^(\d+)\s+(\S+)/);
+                return Number(match?.[1]) === groupId && !match?.[2]?.startsWith('Z');
+            });
+        }
+        catch {
+            try {
+                process.kill(-groupId, 0);
+                return true;
+            }
+            catch (error) {
+                return error.code === 'EPERM';
+            }
+        }
+    };
+    const treeAlive = () => {
+        if (platform === 'win32' || !processGroupId) {
+            return processIdentityMatches({ version: 1, pid: execution.child.pid, startTime: execution.child.startTime });
+        }
+        return processGroupAlive(processGroupId);
+    };
+    if (!treeAlive())
+        return true;
+    const command = buildProcessTreeStopCommand(processGroupId ?? execution.child.pid, platform);
+    try {
+        if (command.kind === 'exec')
+            execFileSync(command.command, command.args, { stdio: 'ignore' });
+        else
+            process.kill(command.pid, command.signal);
+    }
+    catch {
+        // The identity check below distinguishes an already-exited tree from a failed termination.
+    }
+    const deadline = Date.now() + (options.timeoutMs ?? SANDBOX_CONTROL_EXECUTION_STOP_MS);
+    while (Date.now() < deadline) {
+        if (!treeAlive())
+            return true;
+        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 25);
+    }
+    if (platform !== 'win32') {
+        try {
+            process.kill(processGroupId ? -processGroupId : execution.child.pid, 'SIGKILL');
+        }
+        catch {
+            // The final identity check handles an already-exited tree.
+        }
+        const killDeadline = Date.now() + (options.timeoutMs ?? SANDBOX_CONTROL_EXECUTION_STOP_MS);
+        while (Date.now() < killDeadline) {
+            if (!treeAlive())
+                return true;
+            Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 25);
+        }
+    }
+    return !treeAlive();
+}
+//# sourceMappingURL=state.js.map

package/dist/lib/sandbox/index.js

@@ -15,9 +15,9 @@ Commands:
   rebuild [--quiet] [--refresh]
                                Rebuild the sandbox image (--refresh pulls base + tools)
   refresh                      Sync host Claude Code credentials to all sandbox copies
-  rm <branch> | --all | --purge
+  rm <branch> | --unbound | --purge
                                Remove one sandbox, all sandboxes not bound to an
-                               active task (--all), or tear down everything (--purge)
+                               active task (--unbound), or tear down everything (--purge)
   start [--recreate] <branch | TASK-id | N>
                                Verify or recover an existing sandbox container;
                                optionally replace only the container on failure

package/dist/lib/sandbox/managed-fs.js

@@ -1,6 +1,7 @@
 import path from 'node:path';
 import { run, runSafe } from './shell.js';
 import { removeDirRecursive } from '../remove-dir.js';
+import { verifyWorktreePermit } from './worktree-safety.js';
 export function assertManagedPath(root, target) {
     const resolvedRoot = path.resolve(root);
     const resolvedTarget = path.resolve(target);
@@ -14,15 +15,26 @@ export function removeManagedDir(root, dir) {
     assertManagedPath(root, dir);
     removeDirRecursive(dir);
 }
-export function removeWorktreeDir(repoRoot, worktreeBase, dir, { runFn = run, runSafeFn = runSafe } = {}) {
+export function removeWorktreeDir(repoRoot, worktreeBase, dir, permit, { runFn = run, runSafeFn = runSafe, allowRegisteredPathFallback = false } = {}) {
+    assertManagedPath(worktreeBase, dir);
+    if (path.resolve(permit.snapshot.worktree) !== path.resolve(dir)) {
+        throw new Error(`Worktree permit target mismatch: ${dir}`);
+    }
+    verifyWorktreePermit(permit);
     try {
         runFn('git', ['-C', repoRoot, 'worktree', 'remove', dir, '--force']);
     }
-    catch {
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        const registeredPathMismatch = /(?:is not|not a valid) working tree|not a working tree/i.test(message);
+        if (!allowRegisteredPathFallback || !registeredPathMismatch) {
+            throw error;
+        }
         // On WSL2 the worktree is registered under its `/mnt/<drive>/...` path, so
         // `git worktree remove <windows-path>` cannot match it. Delete the managed
         // directory directly, then prune the now-dangling worktree metadata so the
         // branch is no longer reported as checked out.
+        verifyWorktreePermit(permit);
         removeManagedDir(worktreeBase, dir);
         runSafeFn('git', ['-C', repoRoot, 'worktree', 'prune']);
     }

package/dist/lib/sandbox/mounts.js

@@ -1,6 +1,19 @@
 import path from 'node:path';
 import { shareBranchDir, shareCommonDir, shellConfigDirCandidates, worktreeDirCandidates } from './constants.js';
+import { sandboxWorkspaceViewStatePaths } from './workspace-view.js';
 export function sandboxCoreBindMounts(config, branch, overrides) {
+    const taskBound = Boolean(overrides.taskSource && overrides.taskId);
+    const workspaceMounts = sandboxWorkspaceViewStatePaths(overrides.workspaceViewRoot).map(({ state, hostPath }) => taskBound && state === 'active'
+        ? {
+            hostPaths: [path.join(hostPath, '.short-ids.json')],
+            containerPath: '/workspace/.agents/workspace/active/.short-ids.json',
+            readOnly: true
+        }
+        : {
+            hostPaths: [hostPath],
+            containerPath: path.posix.join('/workspace/.agents/workspace', state),
+            readOnly: true
+        });
     const mounts = [
         {
             hostPaths: overrides.worktree
@@ -9,37 +22,35 @@ export function sandboxCoreBindMounts(config, branch, overrides) {
             containerPath: '/workspace',
             readOnly: false
         },
-        {
-            hostPaths: [overrides.workspaceViewRoot],
-            containerPath: '/workspace/.agents/workspace',
-            readOnly: true
-        },
-        {
-            hostPaths: [shareCommonDir(config)],
-            containerPath: '/share/common',
-            readOnly: false
-        },
-        {
-            hostPaths: [shareBranchDir(config, branch)],
-            containerPath: '/share/branch',
-            readOnly: false
-        },
-        {
-            hostPaths: overrides.shellConfigHostDir
-                ? [overrides.shellConfigHostDir]
-                : shellConfigDirCandidates(config, branch),
-            containerPath: '/home/devuser/.host-shell-config',
-            readOnly: true
-        }
+        ...workspaceMounts,
     ];
-    if (overrides.taskSource && overrides.taskId) {
-        mounts.splice(2, 0, {
+    if (taskBound) {
+        mounts.push({
             hostPaths: [overrides.taskSource],
             containerPath: path.posix.join('/workspace/.agents/workspace/active', overrides.taskId),
             readOnly: false
         });
     }
     mounts.push({
+        hostPaths: [shareCommonDir(config)],
+        containerPath: '/share/common',
+        readOnly: false
+    }, {
+        hostPaths: [shareBranchDir(config, branch)],
+        containerPath: '/share/branch',
+        readOnly: false
+    }, {
+        hostPaths: overrides.shellConfigHostDir
+            ? [overrides.shellConfigHostDir]
+            : shellConfigDirCandidates(config, branch),
+        containerPath: '/home/devuser/.host-shell-config',
+        readOnly: true
+    });
+    mounts.push({
+        hostPaths: [overrides.controlStatusDir],
+        containerPath: '/run/agent-infra/control-status',
+        readOnly: true
+    }, {
         hostPaths: [overrides.controlDir],
         containerPath: '/run/agent-infra/control',
         readOnly: false