@fitlab-ai/agent-infra 0.9.5 → 0.9.7

package/lib/sandbox/control/state.ts

@@ -0,0 +1,213 @@
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { buildProcessTreeStopCommand } from '../../server/process-control.ts';
+import { processIdentityMatches } from '../../server/process-state.ts';
+import type { ProcessIdentity } from '../../server/process-state.ts';
+import type {
+  SandboxControlExecution,
+  SandboxControlLease,
+  SandboxControlManifest,
+  SandboxControlStatus
+} from './protocol.ts';
+
+export const SANDBOX_CONTROL_AUDIT_MAX_BYTES = 1024 * 1024;
+export const SANDBOX_CONTROL_EXECUTION_STOP_MS = 2_000;
+
+function assertRegularFile(filePath: string): void {
+  const stat = fs.lstatSync(filePath);
+  if (!stat.isFile() || stat.isSymbolicLink()) throw new Error('SANDBOX_CONTROL_STATE_INVALID');
+}
+
+export function atomicWriteJson(filePath: string, value: unknown, mode = 0o600, createParent = true): void {
+  if (createParent) fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
+  const temporary = path.join(path.dirname(filePath), `.${path.basename(filePath)}.${process.pid}.${randomUUID()}.tmp`);
+  try {
+    fs.writeFileSync(temporary, `${JSON.stringify(value)}\n`, { mode, flag: 'wx' });
+    fs.renameSync(temporary, filePath);
+  } finally {
+    fs.rmSync(temporary, { force: true });
+  }
+}
+
+export function readJsonFile(filePath: string): unknown {
+  assertRegularFile(filePath);
+  return JSON.parse(fs.readFileSync(filePath, 'utf8'));
+}
+
+export function statusPath(manifest: SandboxControlManifest): string {
+  return path.join(manifest.publicStatusDir, 'status.json');
+}
+
+export function writeSandboxControlStatus(
+  manifest: SandboxControlManifest,
+  broker: ProcessIdentity & { brokerId: string },
+  state: SandboxControlStatus['state'],
+  reasonCode: string | null,
+  activeRequestId: string | null,
+  now = Date.now()
+): SandboxControlStatus {
+  const status: SandboxControlStatus = {
+    version: 2, generation: manifest.generation, broker, state, reasonCode, activeRequestId, updatedAt: now
+  };
+  atomicWriteJson(statusPath(manifest), status, 0o600, false);
+  return status;
+}
+
+export function parseSandboxControlStatus(value: unknown): SandboxControlStatus {
+  const status = value as Partial<SandboxControlStatus> | null;
+  if (!status || status.version !== 2 || typeof status.generation !== 'string'
+    || !status.broker || !Number.isSafeInteger(status.broker.pid) || typeof status.broker.startTime !== 'number'
+    || !Number.isSafeInteger(status.broker.startTime) || typeof status.broker.brokerId !== 'string'
+    || status.broker.brokerId.length === 0
+    || !['starting', 'healthy', 'busy', 'parked'].includes(status.state ?? '')
+    || (status.reasonCode !== null && typeof status.reasonCode !== 'string')
+    || (status.activeRequestId !== null && typeof status.activeRequestId !== 'string')
+    || !Number.isSafeInteger(status.updatedAt)) throw new Error('SANDBOX_CONTROL_STATUS_INVALID');
+  return status as SandboxControlStatus;
+}
+
+export function readSandboxControlStatus(directory: string): SandboxControlStatus {
+  return parseSandboxControlStatus(readJsonFile(path.join(directory, 'status.json')));
+}
+
+export function readActiveLease(manifest: SandboxControlManifest, now = Date.now()): SandboxControlLease | null {
+  const filePath = path.join(path.dirname(manifest.publicStatusDir), 'lease.json');
+  if (!fs.existsSync(filePath)) return null;
+  const lease = readJsonFile(filePath) as Partial<SandboxControlLease> | null;
+  if (!lease || lease.version !== 2
+    || typeof lease.nonce !== 'string' || !lease.owner || !Number.isSafeInteger(lease.owner.pid)
+    || typeof lease.owner.startTime !== 'number' || !Number.isSafeInteger(lease.owner.startTime)
+    || !Number.isSafeInteger(lease.issuedAt)
+    || !Number.isSafeInteger(lease.expiresAt) || typeof lease.generation !== 'string'
+    || (lease.taskId !== null && typeof lease.taskId !== 'string')
+    || typeof lease.branch !== 'string' || typeof lease.reason !== 'string') {
+    throw new Error('SANDBOX_CONTROL_LEASE_INVALID');
+  }
+  if (lease.generation !== manifest.generation || lease.expiresAt! <= now
+    || lease.taskId !== manifest.taskId || lease.branch !== manifest.branch) return null;
+  return lease as SandboxControlLease;
+}
+
+export function cleanupStaleSandboxControlLease(manifest: SandboxControlManifest, now = Date.now()): boolean {
+  const filePath = path.join(path.dirname(manifest.publicStatusDir), 'lease.json');
+  if (!fs.existsSync(filePath)) return false;
+  const raw = fs.readFileSync(filePath, 'utf8');
+  const lease = JSON.parse(raw) as Partial<SandboxControlLease> | null;
+  if (!lease || lease.version !== 2
+    || typeof lease.nonce !== 'string' || !lease.owner || !Number.isSafeInteger(lease.owner.pid)
+    || typeof lease.owner.startTime !== 'number' || !Number.isSafeInteger(lease.owner.startTime)
+    || !Number.isSafeInteger(lease.issuedAt)
+    || !Number.isSafeInteger(lease.expiresAt) || typeof lease.generation !== 'string'
+    || (lease.taskId !== null && typeof lease.taskId !== 'string')
+    || typeof lease.branch !== 'string' || typeof lease.reason !== 'string') {
+    throw new Error('SANDBOX_CONTROL_LEASE_INVALID');
+  }
+  const stale = lease.generation !== manifest.generation || lease.taskId !== manifest.taskId
+    || lease.branch !== manifest.branch || lease.expiresAt! <= now || !processIdentityMatches({
+    pid: lease.owner.pid!, startTime: lease.owner.startTime!
+  });
+  if (!stale) return false;
+  if (fs.readFileSync(filePath, 'utf8') !== raw) throw new Error('SANDBOX_CONTROL_LEASE_OWNERSHIP_LOST');
+  fs.unlinkSync(filePath);
+  return true;
+}
+
+export function appendSandboxControlAudit(
+  manifest: SandboxControlManifest,
+  event: string,
+  fields: Record<string, string | number | boolean | null> = {},
+  now = Date.now()
+): void {
+  const auditPath = path.join(path.dirname(manifest.publicStatusDir), 'audit.ndjson');
+  if (fs.existsSync(auditPath) && fs.statSync(auditPath).size >= SANDBOX_CONTROL_AUDIT_MAX_BYTES) {
+    fs.rmSync(`${auditPath}.1`, { force: true });
+    fs.renameSync(auditPath, `${auditPath}.1`);
+  }
+  fs.appendFileSync(auditPath, `${JSON.stringify({ version: 1, event, generation: manifest.generation, at: now, ...fields })}\n`, {
+    encoding: 'utf8', mode: 0o600
+  });
+}
+
+export function executionPath(manifest: SandboxControlManifest, requestId: string): string {
+  return path.join(manifest.processingDir, requestId, 'execution.json');
+}
+
+export function readExecution(filePath: string): SandboxControlExecution {
+  const execution = readJsonFile(filePath) as Partial<SandboxControlExecution> | null;
+  if (!execution || execution.version !== 2 || typeof execution.generation !== 'string'
+    || typeof execution.requestId !== 'string' || typeof execution.nonce !== 'string'
+    || !execution.child || !Number.isSafeInteger(execution.child.pid) || typeof execution.child.startTime !== 'number'
+    || !Number.isSafeInteger(execution.child.startTime)
+    || !['prepared', 'running', 'terminating'].includes(execution.phase ?? '')
+    || !Number.isSafeInteger(execution.updatedAt)) throw new Error('SANDBOX_CONTROL_EXECUTION_INVALID');
+  return execution as SandboxControlExecution;
+}
+
+export function terminateSandboxControlExecution(
+  execution: SandboxControlExecution,
+  options: {
+    platform?: NodeJS.Platform;
+    timeoutMs?: number;
+    deadlineAt?: number;
+    forceAt?: number;
+    allowForce?: boolean;
+  } = {}
+): boolean {
+  const platform = options.platform ?? process.platform;
+  const processGroupId = execution.child.processGroupId;
+  const processGroupAlive = (groupId: number): boolean => {
+    try {
+      const rows = execFileSync('ps', ['-axo', 'pgid=,stat='], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+      return rows.split('\n').some((row) => {
+        const match = row.trim().match(/^(\d+)\s+(\S+)/);
+        return Number(match?.[1]) === groupId && !match?.[2]?.startsWith('Z');
+      });
+    } catch {
+      try {
+        process.kill(-groupId, 0);
+        return true;
+      } catch (error) {
+        return (error as NodeJS.ErrnoException).code === 'EPERM';
+      }
+    }
+  };
+  const treeAlive = (): boolean => {
+    if (platform === 'win32' || !processGroupId) {
+      return processIdentityMatches({ pid: execution.child.pid, startTime: execution.child.startTime });
+    }
+    return processGroupAlive(processGroupId);
+  };
+  if (!treeAlive()) return true;
+  const command = buildProcessTreeStopCommand(processGroupId ?? execution.child.pid, platform);
+  try {
+    if (command.kind === 'exec') execFileSync(command.command, command.args, { stdio: 'ignore' });
+    else process.kill(command.pid, command.signal);
+  } catch {
+    // The identity check below distinguishes an already-exited tree from a failed termination.
+  }
+  const deadline = options.deadlineAt ?? (Date.now() + (options.timeoutMs ?? SANDBOX_CONTROL_EXECUTION_STOP_MS));
+  const forceAt = options.forceAt ?? (options.deadlineAt === undefined
+    ? deadline
+    : Math.min(deadline, Date.now() + Math.floor(Math.max(0, deadline - Date.now()) / 2)));
+  while (Date.now() < forceAt) {
+    if (!treeAlive()) return true;
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 25);
+  }
+  if (platform !== 'win32' && options.allowForce !== false
+    && (options.deadlineAt === undefined || Date.now() < deadline)) {
+    try {
+      process.kill(processGroupId ? -processGroupId : execution.child.pid, 'SIGKILL');
+    } catch {
+      // The final identity check handles an already-exited tree.
+    }
+    const killDeadline = options.deadlineAt
+      ?? (Date.now() + (options.timeoutMs ?? SANDBOX_CONTROL_EXECUTION_STOP_MS));
+    while (Date.now() < killDeadline) {
+      if (!treeAlive()) return true;
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 25);
+    }
+  }
+  return !treeAlive();
+}

package/lib/sandbox/control/timing.ts

@@ -0,0 +1,12 @@
+export type SandboxControlBackoffStep = Readonly<{
+  delayMs: number;
+  nextDelayMs: number;
+}>;
+
+export function nextSandboxControlBackoff(currentDelayMs: number, capMs: number): SandboxControlBackoffStep {
+  const delayMs = Math.min(currentDelayMs, capMs);
+  return {
+    delayMs,
+    nextDelayMs: Math.min(capMs, delayMs * 2)
+  };
+}

package/lib/sandbox/index.ts

@@ -15,9 +15,9 @@ Commands:
   rebuild [--quiet] [--refresh]
                                Rebuild the sandbox image (--refresh pulls base + tools)
   refresh                      Sync host Claude Code credentials to all sandbox copies
-  rm <branch> | --all | --purge
+  rm <branch> | --unbound | --purge
                                Remove one sandbox, all sandboxes not bound to an
-                               active task (--all), or tear down everything (--purge)
+                               active task (--unbound), or tear down everything (--purge)
   start [--recreate] <branch | TASK-id | N>
                                Verify or recover an existing sandbox container;
                                optionally replace only the container on failure

package/lib/sandbox/managed-fs.ts

@@ -1,6 +1,8 @@
 import path from 'node:path';
 import { run, runSafe } from './shell.ts';
 import { removeDirRecursive } from '../remove-dir.ts';
+import { verifyWorktreePermit } from './worktree-safety.ts';
+import type { WorktreeRemovalPermit } from './worktree-safety.ts';
 
 export function assertManagedPath(root: string, target: string): void {
   const resolvedRoot = path.resolve(root);
@@ -22,18 +24,31 @@ export function removeWorktreeDir(
   repoRoot: string,
   worktreeBase: string,
   dir: string,
-  { runFn = run, runSafeFn = runSafe }: {
+  permit: WorktreeRemovalPermit,
+  { runFn = run, runSafeFn = runSafe, allowRegisteredPathFallback = false }: {
     runFn?: typeof run;
     runSafeFn?: typeof runSafe;
+    allowRegisteredPathFallback?: boolean;
   } = {}
 ): void {
+  assertManagedPath(worktreeBase, dir);
+  if (path.resolve(permit.snapshot.worktree) !== path.resolve(dir)) {
+    throw new Error(`Worktree permit target mismatch: ${dir}`);
+  }
+  verifyWorktreePermit(permit);
   try {
     runFn('git', ['-C', repoRoot, 'worktree', 'remove', dir, '--force']);
-  } catch {
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const registeredPathMismatch = /(?:is not|not a valid) working tree|not a working tree/i.test(message);
+    if (!allowRegisteredPathFallback || !registeredPathMismatch) {
+      throw error;
+    }
     // On WSL2 the worktree is registered under its `/mnt/<drive>/...` path, so
     // `git worktree remove <windows-path>` cannot match it. Delete the managed
     // directory directly, then prune the now-dangling worktree metadata so the
     // branch is no longer reported as checked out.
+    verifyWorktreePermit(permit);
     removeManagedDir(worktreeBase, dir);
     runSafeFn('git', ['-C', repoRoot, 'worktree', 'prune']);
   }

package/lib/sandbox/mounts.ts

@@ -24,10 +24,12 @@ export function sandboxCoreBindMounts(
     shellConfigHostDir?: string;
     workspaceViewRoot: string;
     controlDir: string;
+    controlStatusDir: string;
     taskSource?: string;
     taskId?: string;
   }
 ): SandboxBindMountDeclaration[] {
+  const taskBound = Boolean(overrides.taskSource && overrides.taskId);
   const mounts: SandboxBindMountDeclaration[] = [
     {
       hostPaths: overrides.worktree
@@ -41,6 +43,15 @@ export function sandboxCoreBindMounts(
       containerPath: '/workspace/.agents/workspace',
       readOnly: true
     },
+  ];
+  if (taskBound) {
+    mounts.push({
+      hostPaths: [overrides.taskSource!],
+      containerPath: path.posix.join('/workspace/.agents/workspace/active', overrides.taskId!),
+      readOnly: false
+    });
+  }
+  mounts.push(
     {
       hostPaths: [shareCommonDir(config)],
       containerPath: '/share/common',
@@ -58,15 +69,12 @@ export function sandboxCoreBindMounts(
       containerPath: '/home/devuser/.host-shell-config',
       readOnly: true
     }
-  ];
-  if (overrides.taskSource && overrides.taskId) {
-    mounts.splice(2, 0, {
-      hostPaths: [overrides.taskSource],
-      containerPath: path.posix.join('/workspace/.agents/workspace/active', overrides.taskId),
-      readOnly: false
-    });
-  }
+  );
   mounts.push({
+    hostPaths: [overrides.controlStatusDir],
+    containerPath: '/run/agent-infra/control-status',
+    readOnly: true
+  }, {
     hostPaths: [overrides.controlDir],
     containerPath: '/run/agent-infra/control',
     readOnly: false