@fitlab-ai/agent-infra 0.9.5 → 0.9.7

package/lib/sandbox/workspace-view.ts

@@ -9,6 +9,23 @@ export type SandboxWorkspaceView = Readonly<{
   taskMountPath: string | null;
 }>;
 
+export const SANDBOX_WORKSPACE_VIEW_STATES = Object.freeze([
+  'active',
+  'completed',
+  'blocked',
+  'archive'
+] as const);
+
+export function sandboxWorkspaceViewStatePaths(root: string): ReadonlyArray<Readonly<{
+  state: typeof SANDBOX_WORKSPACE_VIEW_STATES[number];
+  hostPath: string;
+}>> {
+  return SANDBOX_WORKSPACE_VIEW_STATES.map((state) => ({
+    state,
+    hostPath: path.join(root, state)
+  }));
+}
+
 export function sandboxWorkspaceViewPaths(params: Readonly<{
   base: string;
   project: string;
@@ -30,9 +47,12 @@ export function sandboxWorkspaceViewPaths(params: Readonly<{
 }
 
 export type SandboxControlSetup = Readonly<{
+  root: string;
   channelDir: string;
+  statusDir: string;
   manifestPath: string;
   token: string;
+  generation: string;
 }>;
 
 export function sandboxControlPaths(params: Readonly<{
@@ -40,13 +60,19 @@ export function sandboxControlPaths(params: Readonly<{
   project: string;
   container: string;
   identity: SandboxWorkspaceIdentity;
-}>): Readonly<{ root: string; channelDir: string; manifestPath: string }> {
+}>): Readonly<{ root: string; channelDir: string; statusDir: string; processingDir: string; manifestPath: string }> {
   const identityKey = params.identity.mode === 'task-bound'
     ? `task-bound:${params.identity.taskId}`
     : 'branch-only';
   const digest = createHash('sha256').update(identityKey).digest('hex').slice(0, 16);
   const root = path.resolve(params.base, params.project, params.container, digest);
-  return { root, channelDir: path.join(root, 'channel'), manifestPath: path.join(root, 'manifest.json') };
+  return {
+    root,
+    channelDir: path.join(root, 'channel'),
+    statusDir: path.join(root, 'public'),
+    processingDir: path.join(root, 'processing'),
+    manifestPath: path.join(root, 'manifest.json')
+  };
 }
 
 function assertSafeDirectory(directory: string, expectedBase: string): void {
@@ -74,6 +100,43 @@ export function assertSandboxTaskSource(repoRoot: string, taskId: string): strin
   return canonical;
 }
 
+export function prepareSandboxWorkspaceMountTarget(worktreeRoot: string): string {
+  const worktree = path.resolve(worktreeRoot);
+  const canonicalWorktree = fs.realpathSync.native(worktree);
+  const agentsRoot = path.join(worktree, '.agents');
+  if (fs.existsSync(agentsRoot)) {
+    const agentsStat = fs.lstatSync(agentsRoot);
+    if (!agentsStat.isDirectory() || agentsStat.isSymbolicLink()) {
+      throw new Error(`Sandbox workspace mount ancestor must be a real directory: ${agentsRoot}`);
+    }
+  } else {
+    fs.mkdirSync(agentsRoot, { mode: 0o700 });
+  }
+  const canonicalAgents = fs.realpathSync.native(agentsRoot);
+  if (path.dirname(canonicalAgents) !== canonicalWorktree) {
+    throw new Error(`Sandbox workspace mount ancestor escapes the worktree: ${agentsRoot}`);
+  }
+
+  const target = path.join(agentsRoot, 'workspace');
+  if (fs.existsSync(target)) {
+    const stat = fs.lstatSync(target);
+    if (stat.isSymbolicLink()) {
+      throw new Error(`Sandbox workspace mount target must not be a symbolic link: ${target}`);
+    }
+    if (!stat.isDirectory()) {
+      throw new Error(`Sandbox workspace mount target must be a directory: ${target}`);
+    }
+    if (path.dirname(fs.realpathSync.native(target)) !== canonicalAgents) {
+      throw new Error(`Sandbox workspace mount target escapes the worktree: ${target}`);
+    }
+  } else {
+    fs.mkdirSync(target, { mode: 0o700 });
+  }
+  fs.chmodSync(target, 0o700);
+  fs.accessSync(target, fs.constants.W_OK);
+  return target;
+}
+
 export function materializeSandboxWorkspaceView(params: Readonly<{
   base: string;
   project: string;
@@ -85,11 +148,10 @@ export function materializeSandboxWorkspaceView(params: Readonly<{
   assertSafeDirectory(projectRoot, path.resolve(params.base));
   assertSafeDirectory(root, projectRoot);
   fs.mkdirSync(root, { recursive: true, mode: 0o700 });
-  for (const state of ['active', 'completed', 'blocked', 'archive']) {
-    const stateDir = path.join(root, state);
-    assertSafeDirectory(stateDir, root);
-    fs.rmSync(stateDir, { recursive: true, force: true });
-    fs.mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+  for (const { hostPath } of sandboxWorkspaceViewStatePaths(root)) {
+    assertSafeDirectory(hostPath, root);
+    fs.rmSync(hostPath, { recursive: true, force: true });
+    fs.mkdirSync(hostPath, { recursive: true, mode: 0o700 });
   }
 
   const active = path.join(root, 'active');
@@ -118,13 +180,18 @@ export function materializeSandboxControl(params: Readonly<{
   container: string;
   branch: string;
   identity: SandboxWorkspaceIdentity;
+  engine?: string;
 }>): SandboxControlSetup {
-  const { root, channelDir, manifestPath } = sandboxControlPaths(params);
+  const { root, channelDir, statusDir, processingDir, manifestPath } = sandboxControlPaths(params);
   assertSafeDirectory(root, path.resolve(params.base));
   const consumedDir = path.join(root, 'consumed');
   assertSafeDirectory(consumedDir, root);
   fs.rmSync(consumedDir, { recursive: true, force: true });
   fs.mkdirSync(consumedDir, { recursive: true, mode: 0o700 });
+  for (const directory of [statusDir, processingDir]) {
+    assertSafeDirectory(directory, root);
+    fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+  }
   for (const queue of ['requests', 'responses']) {
     const directory = path.join(channelDir, queue);
     assertSafeDirectory(directory, root);
@@ -132,19 +199,43 @@ export function materializeSandboxControl(params: Readonly<{
     fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
   }
   const token = randomBytes(32).toString('hex');
+  const generation = randomBytes(16).toString('hex');
   const repoRoot = fs.realpathSync.native(params.repoRoot);
   const manifest: SandboxControlManifest = {
-    version: 2,
+    version: 4,
+    engine: params.engine ?? 'docker',
     repoRoot,
     worktreeRoot: fs.realpathSync.native(params.worktreeRoot),
     project: params.project,
     container: params.container,
+    containerIdentity: { id: '', labels: {} },
     branch: params.branch,
     mode: params.identity.mode,
     taskId: params.identity.mode === 'task-bound' ? params.identity.taskId : null,
     token,
-    channelDir
+    generation,
+    channelDir,
+    publicStatusDir: statusDir,
+    processingDir
   };
   fs.writeFileSync(manifestPath, `${JSON.stringify(manifest)}\n`, { mode: 0o600 });
-  return { channelDir, manifestPath, token };
+  return { root, channelDir, statusDir, manifestPath, token, generation };
+}
+
+export function finalizeSandboxControlManifest(
+  setup: SandboxControlSetup,
+  identity: Readonly<{ engine: string; id: string; labels: Readonly<Record<string, string>> }>
+): void {
+  if (!identity.engine || !identity.id) throw new Error('SANDBOX_CONTROL_CONTAINER_ID_INVALID');
+  const manifest = JSON.parse(fs.readFileSync(setup.manifestPath, 'utf8')) as Record<string, unknown>;
+  manifest.version = 4;
+  manifest.engine = identity.engine;
+  manifest.containerIdentity = { id: identity.id, labels: { ...identity.labels } };
+  const temporary = `${setup.manifestPath}.${process.pid}.${randomBytes(8).toString('hex')}.tmp`;
+  try {
+    fs.writeFileSync(temporary, `${JSON.stringify(manifest)}\n`, { mode: 0o600, flag: 'wx' });
+    fs.renameSync(temporary, setup.manifestPath);
+  } finally {
+    fs.rmSync(temporary, { force: true });
+  }
 }

package/lib/sandbox/worktree-safety.ts

@@ -0,0 +1,234 @@
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { runProbe } from './shell.ts';
+
+type WorktreeChange = {
+  indexStatus: string;
+  worktreeStatus: string;
+  path: string;
+  originalPath?: string;
+};
+
+type WorktreeSnapshot = {
+  worktree: string;
+  branch: string;
+  head: string;
+  changes: readonly WorktreeChange[];
+  identity: string;
+};
+
+type WorktreeInspection =
+  | { status: 'clean'; snapshot: WorktreeSnapshot }
+  | { status: 'dirty'; snapshot: WorktreeSnapshot }
+  | { status: 'failed'; worktree: string; message: string };
+
+type WorktreeRemovalPermit = {
+  mode: 'clean' | 'discard';
+  snapshot: WorktreeSnapshot;
+};
+
+type Probe = typeof runProbe;
+
+function probeText(probe: Probe, cwd: string, args: string[]): string {
+  const result = probe('git', ['-C', cwd, ...args], { encoding: 'utf8' });
+  if (result.error) throw result.error;
+  if (result.status !== 0) {
+    const stderr = typeof result.stderr === 'string' ? result.stderr.trim() : result.stderr.toString('utf8').trim();
+    throw new Error(stderr || `git ${args[0] ?? 'command'} failed with exit code ${result.status ?? 'unknown'}`);
+  }
+  return typeof result.stdout === 'string' ? result.stdout : result.stdout.toString('utf8');
+}
+
+function parseStatus(raw: string): WorktreeChange[] {
+  const records = raw.split('\0');
+  const changes: WorktreeChange[] = [];
+  for (let index = 0; index < records.length; index += 1) {
+    const record = records[index] ?? '';
+    if (!record || record.startsWith('# ')) continue;
+    if (record.startsWith('? ')) {
+      changes.push({ indexStatus: '?', worktreeStatus: '?', path: record.slice(2) });
+      continue;
+    }
+    if (record.startsWith('1 ')) {
+      const match = /^1 (..) \S+ \S+ \S+ \S+ \S+ \S+ (.*)$/s.exec(record);
+      if (!match) throw new Error('Unable to parse git porcelain v2 ordinary record');
+      changes.push({ indexStatus: match[1]![0]!, worktreeStatus: match[1]![1]!, path: match[2]! });
+      continue;
+    }
+    if (record.startsWith('2 ')) {
+      const match = /^2 (..) \S+ \S+ \S+ \S+ \S+ \S+ \S+ (.*)$/s.exec(record);
+      const originalPath = records[++index];
+      if (!match || originalPath === undefined || originalPath === '') {
+        throw new Error('Unable to parse git porcelain v2 rename record');
+      }
+      changes.push({
+        indexStatus: match[1]![0]!,
+        worktreeStatus: match[1]![1]!,
+        path: match[2]!,
+        originalPath
+      });
+      continue;
+    }
+    if (record.startsWith('u ')) {
+      const match = /^u (..) \S+ \S+ \S+ \S+ \S+ \S+ \S+ \S+ (.*)$/s.exec(record);
+      if (!match) throw new Error('Unable to parse git porcelain v2 unmerged record');
+      changes.push({ indexStatus: match[1]![0]!, worktreeStatus: match[1]![1]!, path: match[2]! });
+      continue;
+    }
+    throw new Error(`Unsupported git porcelain v2 record '${record[0] ?? ''}'`);
+  }
+  return changes;
+}
+
+function updatePart(hash: ReturnType<typeof createHash>, label: string, value: string | Buffer): void {
+  const data = Buffer.isBuffer(value) ? value : Buffer.from(value, 'utf8');
+  hash.update(`${label.length}:${label}:${data.length}:`, 'utf8');
+  hash.update(data);
+}
+
+function resolveSnapshotPath(worktree: string, relativePath: string): string {
+  const resolved = path.resolve(worktree, relativePath);
+  const relative = path.relative(worktree, resolved);
+  if (relative.startsWith('..') || path.isAbsolute(relative)) {
+    throw new Error(`Git reported a path outside the worktree: ${JSON.stringify(relativePath)}`);
+  }
+  return resolved;
+}
+
+function hashPath(hash: ReturnType<typeof createHash>, worktree: string, relativePath: string, probe: Probe): void {
+  updatePart(hash, 'path', relativePath);
+  const target = resolveSnapshotPath(worktree, relativePath);
+  let stat: fs.Stats;
+  try {
+    stat = fs.lstatSync(target);
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
+      updatePart(hash, 'kind', 'absent');
+      return;
+    }
+    throw error;
+  }
+
+  updatePart(hash, 'mode', String(stat.mode & 0o7777));
+  if (stat.isFile()) {
+    updatePart(hash, 'kind', 'file');
+    updatePart(hash, 'content', fs.readFileSync(target));
+    return;
+  }
+  if (stat.isSymbolicLink()) {
+    updatePart(hash, 'kind', 'symlink');
+    updatePart(hash, 'target', fs.readlinkSync(target));
+    return;
+  }
+  if (stat.isDirectory()) {
+    updatePart(hash, 'kind', 'git-directory');
+    const nestedHead = probeText(probe, target, ['rev-parse', '--verify', 'HEAD']).trim();
+    const nestedStatus = probeText(probe, target, [
+      'status', '--porcelain=v2', '-z', '--branch', '--untracked-files=all', '--ignore-submodules=none'
+    ]);
+    const nestedIndex = probeText(probe, target, ['ls-files', '--stage', '-z']);
+    updatePart(hash, 'nested-head', nestedHead);
+    updatePart(hash, 'nested-status', nestedStatus);
+    updatePart(hash, 'nested-index', nestedIndex);
+    for (const change of parseStatus(nestedStatus)) {
+      hashPath(hash, target, change.path, probe);
+      if (change.originalPath) hashPath(hash, target, change.originalPath, probe);
+    }
+    return;
+  }
+  throw new Error(`Unsupported file type in dirty snapshot: ${JSON.stringify(relativePath)}`);
+}
+
+function captureOnce(worktree: string, probe: Probe): WorktreeSnapshot {
+  const resolvedWorktree = path.resolve(worktree);
+  const branch = probeText(probe, resolvedWorktree, ['rev-parse', '--abbrev-ref', 'HEAD']).trim();
+  const head = probeText(probe, resolvedWorktree, ['rev-parse', '--verify', 'HEAD']).trim();
+  const status = probeText(probe, resolvedWorktree, [
+    'status', '--porcelain=v2', '-z', '--branch', '--untracked-files=all', '--ignore-submodules=none'
+  ]);
+  const index = probeText(probe, resolvedWorktree, ['ls-files', '--stage', '-z']);
+  if (!branch) throw new Error('Unable to determine worktree branch');
+  if (!head) throw new Error('Unable to determine worktree HEAD');
+  const changes = parseStatus(status);
+  const hash = createHash('sha256');
+  updatePart(hash, 'worktree', resolvedWorktree);
+  updatePart(hash, 'branch', branch);
+  updatePart(hash, 'head', head);
+  updatePart(hash, 'status', status);
+  updatePart(hash, 'index', index);
+  for (const change of changes) {
+    hashPath(hash, resolvedWorktree, change.path, probe);
+    if (change.originalPath) hashPath(hash, resolvedWorktree, change.originalPath, probe);
+  }
+  return { worktree: resolvedWorktree, branch, head, changes, identity: hash.digest('hex') };
+}
+
+function inspectWorktree(worktree: string, { probe = runProbe }: { probe?: Probe } = {}): WorktreeInspection {
+  const resolvedWorktree = path.resolve(worktree);
+  try {
+    const first = captureOnce(resolvedWorktree, probe);
+    const second = captureOnce(resolvedWorktree, probe);
+    if (first.identity !== second.identity) {
+      return { status: 'failed', worktree: resolvedWorktree, message: 'Snapshot changed while inspecting worktree' };
+    }
+    return { status: second.changes.length === 0 ? 'clean' : 'dirty', snapshot: second };
+  } catch (error) {
+    return {
+      status: 'failed',
+      worktree: resolvedWorktree,
+      message: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+
+function inspectWorktrees(worktrees: readonly string[]): WorktreeInspection[] {
+  return [...new Set(worktrees.map((worktree) => path.resolve(worktree)))].sort()
+    .map((worktree) => inspectWorktree(worktree));
+}
+
+function createCleanPermit(snapshot: WorktreeSnapshot): WorktreeRemovalPermit {
+  if (snapshot.changes.length > 0) throw new Error('Cannot create a clean permit for a dirty worktree');
+  return { mode: 'clean', snapshot };
+}
+
+function createDiscardPermit(snapshot: WorktreeSnapshot): WorktreeRemovalPermit {
+  if (snapshot.changes.length === 0) throw new Error('Cannot create a discard permit for a clean worktree');
+  return { mode: 'discard', snapshot };
+}
+
+function verifyWorktreePermit(
+  permit: WorktreeRemovalPermit,
+  options: { probe?: Probe } = {}
+): WorktreeSnapshot {
+  const current = inspectWorktree(permit.snapshot.worktree, options);
+  if (current.status === 'failed') throw new Error(`Unable to verify worktree permit: ${current.message}`);
+  if (current.snapshot.identity !== permit.snapshot.identity || (permit.mode === 'clean' && current.status !== 'clean')) {
+    throw new Error(`Worktree changed after authorization: ${permit.snapshot.worktree}`);
+  }
+  return current.snapshot;
+}
+
+function formatWorktreeSnapshot(snapshot: WorktreeSnapshot): string {
+  const lines = snapshot.changes.map((change) => {
+    const rename = change.originalPath ? ` <- ${JSON.stringify(change.originalPath)}` : '';
+    return `  ${change.indexStatus}${change.worktreeStatus} ${JSON.stringify(change.path)}${rename}`;
+  });
+  return [
+    `Worktree: ${JSON.stringify(snapshot.worktree)}`,
+    `Branch: ${snapshot.branch}`,
+    `HEAD: ${snapshot.head}`,
+    ...lines,
+    `Snapshot identity: ${snapshot.identity}`
+  ].join('\n');
+}
+
+export {
+  createCleanPermit,
+  createDiscardPermit,
+  formatWorktreeSnapshot,
+  inspectWorktree,
+  inspectWorktrees,
+  verifyWorktreePermit
+};
+export type { WorktreeChange, WorktreeInspection, WorktreeRemovalPermit, WorktreeSnapshot };

package/lib/server/daemon.ts

@@ -139,7 +139,7 @@ export async function runDaemon(): Promise<void> {
       logger.close();
       if (ownStartTime !== null) {
         removePidRecordIfMatches(config.pidFile, {
-          version: 1,
+          version: 2,
           pid: process.pid,
           startTime: ownStartTime
         });

package/lib/server/process-control.ts

@@ -11,7 +11,7 @@ import {
   removePidFileIfMatches,
   writePidRecord
 } from './process-state.ts';
-import type { PidRecord } from './process-state.ts';
+import type { PidRecord, ProcessIdentity, ProcessState } from './process-state.ts';
 
 export { isProcessAlive } from './process-state.ts';
 
@@ -24,6 +24,17 @@ export type StopCommand =
   | { kind: 'signal'; signal: NodeJS.Signals }
   | { kind: 'exec'; command: string; args: string[] };
 
+export type ProcessTreeStopCommand =
+  | { kind: 'group-signal'; pid: number; signal: NodeJS.Signals }
+  | { kind: 'exec'; command: string; args: string[] };
+
+export function buildProcessTreeStopCommand(pid: number, platform: NodeJS.Platform): ProcessTreeStopCommand {
+  if (platform === 'win32') {
+    return { kind: 'exec', command: 'taskkill', args: ['/PID', String(pid), '/T', '/F'] };
+  }
+  return { kind: 'group-signal', pid: -pid, signal: 'SIGTERM' };
+}
+
 export function buildStopCommand(pid: number, platform: NodeJS.Platform): StopCommand {
   if (platform === 'win32') {
     return { kind: 'exec', command: 'taskkill', args: ['/PID', String(pid), '/T', '/F'] };
@@ -40,13 +51,13 @@ async function waitForProcessIdentity(pid: number, timeoutMs = 2000): Promise<Pi
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
     const startTime = getProcessStartTime(pid);
-    if (startTime !== null) return { version: 1, pid, startTime };
+    if (startTime !== null) return { version: 2, pid, startTime };
     await delay(25);
   }
   return null;
 }
 
-function terminateIfMatching(record: PidRecord): void {
+function terminateIfMatching(record: ProcessIdentity): void {
   if (!processIdentityMatches(record)) return;
   const command = buildStopCommand(record.pid, process.platform);
   try {
@@ -72,6 +83,9 @@ export async function start({ foreground = false }: StartOptions = {}): Promise<
     process.stdout.write(`server already running (pid ${existing.record.pid})\n`);
     return;
   }
+  if (existing.kind === 'legacy-json' || existing.kind === 'legacy-pid-only' || existing.kind === 'legacy-unknown') {
+    throw new Error('server: legacy pid record requires the matching previous version to stop it before starting');
+  }
   if (existing.kind !== 'missing') {
     removePidFileIfMatches(pidPath, existing.snapshot);
   }
@@ -124,6 +138,9 @@ export async function stop(): Promise<void> {
     return;
   }
   if (state.kind !== 'running') {
+    if (state.kind === 'legacy-json' || state.kind === 'legacy-pid-only' || state.kind === 'legacy-unknown') {
+      throw new Error('server: legacy pid record requires the matching previous version to stop it');
+    }
     removePidFileIfMatches(config.pidFile, state.snapshot);
     process.stdout.write('server is not running (removed stale pid file)\n');
     return;
@@ -159,6 +176,10 @@ export function status(): void {
   const state = readProcessState(config.pidFile);
 
   if (state.kind !== 'running') {
+    if (state.kind === 'legacy-json' || state.kind === 'legacy-pid-only' || state.kind === 'legacy-unknown') {
+      process.stdout.write('server: legacy pid record requires the matching previous version to stop it\n');
+      return;
+    }
     if (state.kind !== 'missing') removePidFileIfMatches(config.pidFile, state.snapshot);
     process.stdout.write('server: stopped\n');
     return;