@fungi.computer/truffle 0.2.0 → 0.2.2

package/dist/private-files-patch.js

@@ -6,6 +6,7 @@ import * as ChildProcess from "effect/process/ChildProcess";
 import { parsePatch } from "diff";
 import * as Stream from "effect/Stream";
 import { runPrivateInvocationProcess, } from "./private-invocation-computer.js";
+import { createNativePayloadStaging } from "./private-local-native-staging.js";
 function patchExecutable() {
     if (process.env.FUNGI_BUNDLED_CLI) {
         const name = `@fungi.computer/spore-native-${process.platform}-${process.arch}`;
@@ -51,7 +52,9 @@ async function unifiedDiffContext(patch, read, context) {
 export async function createPrivateFilesPatch(root, read, sandbox) {
     const executable = patchExecutable();
     try {
-        await access(executable, constants.X_OK);
+        // Advertise the installed helper if present; only the verified private
+        // copy is executed, so its source does not need an execute bit.
+        await access(executable, constants.F_OK);
     }
     catch (cause) {
         if (cause instanceof Error && "code" in cause && cause.code === "ENOENT")
@@ -63,27 +66,41 @@ export async function createPrivateFilesPatch(root, read, sandbox) {
         const bytes = new TextEncoder().encode(patch);
         if (bytes.byteLength > maximumPatchBytes)
             throw new Error("Patch exceeds the 128 KiB input bound");
-        const launch = sandbox?.(root, [executable]);
-        const env = { ...process.env, ...launch?.environment };
-        if (launch !== undefined) {
-            delete env.XDG_RUNTIME_DIR;
-            delete env.DBUS_SESSION_BUS_ADDRESS;
-        }
-        const command = ChildProcess.make(launch?.executable ?? executable, launch?.args ?? [], {
-            cwd: root,
-            env,
-            extendEnv: false,
-            stdin: Stream.make(bytes),
-            additionalFds: launch?.seccompFilter === undefined
-                ? undefined
-                : {
-                    fd3: {
-                        type: "input",
-                        stream: Stream.make(launch.seccompFilter),
+        let result;
+        let standalone;
+        try {
+            const launch = sandbox?.(root, [executable], executable);
+            // Without controls, this one Files invocation owns and closes its copy.
+            if (launch === undefined)
+                standalone = createNativePayloadStaging(root);
+            const privateExecutable = standalone?.patch(executable);
+            const executableToRun = launch?.executable ?? privateExecutable;
+            if (executableToRun === undefined)
+                throw new Error("Native Files helper was not staged");
+            const env = { ...process.env, ...launch?.environment };
+            if (launch !== undefined && !("bareNative" in launch)) {
+                delete env.XDG_RUNTIME_DIR;
+                delete env.DBUS_SESSION_BUS_ADDRESS;
+            }
+            const command = ChildProcess.make(executableToRun, launch?.args ?? [], {
+                cwd: root,
+                env,
+                extendEnv: false,
+                stdin: Stream.make(bytes),
+                additionalFds: launch?.seccompFilter === undefined
+                    ? undefined
+                    : {
+                        fd3: {
+                            type: "input",
+                            stream: Stream.make(launch.seccompFilter),
+                        },
                     },
-                },
-        });
-        const result = await runPrivateInvocationProcess(command, context.signal, 30_000);
+            });
+            result = await runPrivateInvocationProcess(command, context.signal, 30_000);
+        }
+        finally {
+            standalone?.close();
+        }
         if (result.status === "deadline_exceeded")
             return {
                 status: "failed",

package/dist/private-invocation-computer.d.ts

@@ -3,8 +3,15 @@ import type { KnapsackComputer } from "@fungi.computer/knapsack";
 import { z } from "zod";
 import { type PrivateLocalProcessScope } from "./private-local-computer-processes.js";
 import type { SandboxCommand } from "./private-local-containment.js";
-/** The host admits each launch; undefined is its explicit unavailable fallback. */
-export type LocalSandboxLaunch = (cwd: string, argv: readonly [string, ...string[]]) => SandboxCommand | undefined;
+/** A bare fallback for the native Files engine still names only staged bytes. */
+export type BareNativeCommand = SandboxCommand & Readonly<{
+    bareNative: true;
+}>;
+/** Only Files supplies a helper; generic exec can still fall back to its argv. */
+export type LocalSandboxLaunch = {
+    (cwd: string, argv: readonly [string, ...string[]]): SandboxCommand | undefined;
+    (cwd: string, argv: readonly [string, ...string[]], readOnlyHelperFile: string): SandboxCommand | BareNativeCommand;
+};
 declare const execOutput: z.ZodDiscriminatedUnion<[z.ZodObject<{
     exitCode: z.ZodNumber;
     stdout: z.ZodString;

package/dist/private-local-bwrap.d.ts

@@ -1,13 +1,21 @@
+import { type LocalSandboxPolicy } from "./private-local-sandbox-policy.js";
 export declare class LocalBwrapUnavailable extends Error {
-    readonly reason: "missing" | "invalid-digest" | "digest-mismatch" | "not-executable";
+    readonly reason: "missing" | "missing-artifact" | "invalid-digest" | "digest-mismatch" | "unreadable" | "not-executable" | "staging-failed";
     readonly name = "LocalBwrapUnavailable";
-    constructor(reason: "missing" | "invalid-digest" | "digest-mismatch" | "not-executable", message: string, options?: ErrorOptions);
+    constructor(reason: "missing" | "missing-artifact" | "invalid-digest" | "digest-mismatch" | "unreadable" | "not-executable" | "staging-failed", message: string, options?: ErrorOptions);
 }
 export type LinuxSandboxPayload = {
-    readonly executable: string;
+    readonly executableBytes: Uint8Array;
     readonly seccompFilter: Uint8Array;
 };
+export type LinuxSandboxDigests = Readonly<{
+    bwrap: string;
+    seccomp: string;
+}>;
+/** Packaged patch has no sidecar; the built module owns its digest. */
+export type NativeSourceReader = (path: string) => Buffer;
+export declare function verifiedNativePatchHelper(path: string, project: string, readNativeSource?: NativeSourceReader): Uint8Array;
 /** Check both packaged artifacts on every use; never cache verification. */
-export declare function verifyLocalLinuxSandboxPayload(executable: string): LinuxSandboxPayload;
+export declare function verifyLocalLinuxSandboxPayload(executable: string, policy: LocalSandboxPolicy, expected: LinuxSandboxDigests): LinuxSandboxPayload;
 /** Same optional native-package lookup as apply_patch, with no PATH fallback. */
-export declare function localLinuxSandboxPayload(): LinuxSandboxPayload;
+export declare function localLinuxSandboxPayload(policy: LocalSandboxPolicy): LinuxSandboxPayload;

package/dist/private-local-bwrap.js

@@ -1,13 +1,10 @@
 import { createHash } from "node:crypto";
-import { accessSync, constants, readFileSync, statSync } from "node:fs";
+import { lstatSync, readFileSync, statSync } from "node:fs";
 import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { z } from "zod";
-const digestSchema = z
-    .string()
-    .trim()
-    .regex(/^[a-f0-9]{64}$/u);
+import { nativeDigests } from "./private-local-native-digests.js";
+import { assertHostOwnedNativeFile, UnsafeNativePayload, } from "./private-local-sandbox-policy.js";
 export class LocalBwrapUnavailable extends Error {
     reason;
     name = "LocalBwrapUnavailable";
@@ -16,55 +13,93 @@ export class LocalBwrapUnavailable extends Error {
         this.reason = reason;
     }
 }
+export function verifiedNativePatchHelper(path, project, readNativeSource = readFileSync) {
+    const expected = nativeDigests[`${process.platform}-${process.arch}`]?.patch;
+    if (expected === undefined)
+        throw new LocalBwrapUnavailable("invalid-digest", "No built native patch digest for this platform; reinstall Fungi.");
+    return verifiedBytes(path, "fungi-apply-patch", project, expected, readNativeSource);
+}
 /** Check both packaged artifacts on every use; never cache verification. */
-export function verifyLocalLinuxSandboxPayload(executable) {
-    verifiedBytes(executable, "fungi-bwrap");
-    try {
-        accessSync(executable, constants.X_OK);
-    }
-    catch (cause) {
-        throw new LocalBwrapUnavailable("not-executable", "Packaged fungi-bwrap cannot be executed; reinstall Fungi.", { cause });
-    }
+export function verifyLocalLinuxSandboxPayload(executable, policy, expected) {
+    const executableBytes = verifiedBytes(executable, "fungi-bwrap", policy.projectRoot, expected.bwrap);
     return {
-        executable,
-        seccompFilter: verifiedBytes(join(dirname(executable), "fungi-seccomp.bpf"), "fungi-seccomp.bpf"),
+        executableBytes,
+        seccompFilter: verifiedBytes(join(dirname(executable), "fungi-seccomp.bpf"), "fungi-seccomp.bpf", policy.projectRoot, expected.seccomp),
     };
 }
-function verifiedBytes(path, label) {
+function verifiedBytes(path, label, project, expected, readNativeSource = readFileSync) {
     let bytes;
-    let digest;
     try {
+        assertHostOwnedNativeFile(project, path);
         if (!statSync(path).isFile())
             throw new LocalBwrapUnavailable("not-executable", `Packaged ${label} is not a regular file; reinstall Fungi.`);
-        bytes = readFileSync(path);
-        digest = readFileSync(`${path}.sha256`, "utf8");
+        bytes = readNativeSource(path);
     }
     catch (cause) {
         if (cause instanceof Error && "code" in cause && cause.code === "ENOENT")
-            throw new LocalBwrapUnavailable("missing", `Packaged ${label} or its digest is missing; reinstall Fungi with optional dependencies enabled.`, { cause });
-        throw cause;
+            throw new LocalBwrapUnavailable("missing-artifact", `Packaged ${label} is missing; reinstall Fungi with optional dependencies enabled.`, { cause });
+        if (cause instanceof UnsafeNativePayload ||
+            cause instanceof LocalBwrapUnavailable)
+            throw cause;
+        throw new LocalBwrapUnavailable("unreadable", `Packaged ${label} cannot be read; reinstall Fungi. No command was started.`, { cause });
     }
-    const expected = digestSchema.safeParse(digest);
-    if (!expected.success)
-        throw new LocalBwrapUnavailable("invalid-digest", `Packaged ${label} has an invalid SHA-256 record; reinstall Fungi.`);
-    if (createHash("sha256").update(bytes).digest("hex") !== expected.data)
+    if (createHash("sha256").update(bytes).digest("hex") !== expected)
         throw new LocalBwrapUnavailable("digest-mismatch", `Packaged ${label} digest mismatch; reinstall Fungi. No command was started.`);
     return bytes;
 }
 /** Same optional native-package lookup as apply_patch, with no PATH fallback. */
-export function localLinuxSandboxPayload() {
+export function localLinuxSandboxPayload(policy) {
+    const digest = nativeDigests[`${process.platform}-${process.arch}`];
+    if (digest?.bwrap === undefined || digest.seccomp === undefined)
+        throw new LocalBwrapUnavailable("invalid-digest", "No built native Linux payload digest for this platform; reinstall Fungi.");
     let executable;
     if (process.env.FUNGI_BUNDLED_CLI) {
         const name = `@fungi.computer/spore-native-${process.platform}-${process.arch}`;
+        const message = `Packaged ${name}/bin/fungi-bwrap cannot be read; reinstall Fungi.`;
+        let directories;
+        try {
+            directories = createRequire(process.env.FUNGI_BUNDLED_CLI).resolve.paths(name);
+        }
+        catch (cause) {
+            throw new LocalBwrapUnavailable("missing-artifact", message, { cause });
+        }
+        if (directories === null)
+            throw new LocalBwrapUnavailable("missing-artifact", message);
+        let packageRoot;
+        for (const directory of directories) {
+            const candidate = join(directory, name);
+            try {
+                if (lstatSync(candidate, { throwIfNoEntry: false }) !== undefined) {
+                    packageRoot = candidate;
+                    break;
+                }
+            }
+            catch (cause) {
+                throw new LocalBwrapUnavailable("missing-artifact", message, { cause });
+            }
+        }
+        if (packageRoot === undefined)
+            throw new LocalBwrapUnavailable("missing", `Missing ${name}; reinstall Fungi with optional dependencies enabled.`);
+        // Package metadata (including exports) is not an authority for whether
+        // native bytes are absent. Check the package's location before its bin.
         try {
-            executable = createRequire(process.env.FUNGI_BUNDLED_CLI).resolve(`${name}/bin/fungi-bwrap`);
+            assertHostOwnedNativeFile(policy.projectRoot, packageRoot);
+            if (!statSync(packageRoot).isDirectory())
+                throw new LocalBwrapUnavailable("missing-artifact", message);
         }
         catch (cause) {
-            throw new LocalBwrapUnavailable("missing", `Missing ${name}/bin/fungi-bwrap; reinstall Fungi with optional dependencies enabled.`, { cause });
+            if (cause instanceof UnsafeNativePayload ||
+                cause instanceof LocalBwrapUnavailable)
+                throw cause;
+            throw new LocalBwrapUnavailable("missing-artifact", message, { cause });
         }
+        executable = join(packageRoot, "bin", "fungi-bwrap");
     }
     else {
         executable = fileURLToPath(new URL("../native/bin/fungi-bwrap", import.meta.url));
     }
-    return verifyLocalLinuxSandboxPayload(executable);
+    return verifyLocalLinuxSandboxPayload(executable, policy, {
+        bwrap: digest.bwrap,
+        seccomp: digest.seccomp,
+    });
 }

package/dist/private-local-containment.d.ts

@@ -1,12 +1,19 @@
+import { type NativePayloadStaging } from "./private-local-native-staging.js";
 import { z } from "zod";
 export declare const sandboxUnavailableReasonSchema: z.ZodObject<{
     kind: z.ZodEnum<{
         missing: "missing";
+        "missing-artifact": "missing-artifact";
         "invalid-digest": "invalid-digest";
         "digest-mismatch": "digest-mismatch";
+        unreadable: "unreadable";
         "not-executable": "not-executable";
+        "staging-failed": "staging-failed";
         "unsupported-platform": "unsupported-platform";
         "invalid-folder": "invalid-folder";
+        "unsafe-native-payload": "unsafe-native-payload";
+        "unsafe-host-code": "unsafe-host-code";
+        "startup-refused": "startup-refused";
         "backend-refused": "backend-refused";
     }>;
     message: z.ZodString;
@@ -28,7 +35,7 @@ export type SandboxCommand = Readonly<{
 }>;
 /** Existing foreground/background owners retain process and cancellation lifetime. */
 export type LocalSandbox = Readonly<{
-    command(cwd: string, argv: readonly [string, ...string[]]): SandboxCommand;
+    command(cwd: string, argv: readonly [string, ...string[]], readOnlyHelperFile?: string): SandboxCommand;
     close(): void;
 }>;
 export type SandboxAdmission = Readonly<{
@@ -38,6 +45,7 @@ export type SandboxAdmission = Readonly<{
     state: "unavailable";
     reason: SandboxUnavailableReason;
 }>;
+export declare function sandboxUnavailableReason(cause: unknown): SandboxUnavailableReason;
 /**
  * The caller already owns the person's auto-approve choice. This module has no
  * mode, setting, bare-command branch, PATH fallback or permission to widen it.
@@ -48,4 +56,4 @@ export declare function establishLocalSandbox(input: Readonly<{
     /** Absolute folder selected by the Local owner. */
     folder: string;
     platform?: string;
-}>): SandboxAdmission;
+}>, staging?: NativePayloadStaging): SandboxAdmission;

package/dist/private-local-containment.js

@@ -1,20 +1,27 @@
 import { spawnSync } from "node:child_process";
-import { closeSync, mkdtempSync, openSync, realpathSync, rmSync, writeFileSync, } from "node:fs";
+import { closeSync, mkdtempSync, openSync, realpathSync, rmSync, } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { LocalBwrapUnavailable, localLinuxSandboxPayload, } from "./private-local-bwrap.js";
+import { LocalBwrapUnavailable } from "./private-local-bwrap.js";
+import { createNativePayloadStaging, } from "./private-local-native-staging.js";
 import { linuxSandboxCommand } from "./private-local-linux-sandbox.js";
 import { seatbeltCommand } from "./private-local-seatbelt.js";
-import { sandboxPolicy } from "./private-local-sandbox-policy.js";
+import { sandboxPolicy, UnsafeHostCode, UnsafeNativePayload, } from "./private-local-sandbox-policy.js";
 import { z } from "zod";
 export const sandboxUnavailableReasonSchema = z.strictObject({
     kind: z.enum([
         "unsupported-platform",
         "invalid-folder",
         "missing",
+        "missing-artifact",
         "invalid-digest",
         "digest-mismatch",
+        "unreadable",
         "not-executable",
+        "staging-failed",
+        "unsafe-native-payload",
+        "unsafe-host-code",
+        "startup-refused",
         "backend-refused",
     ]),
     message: z.string(),
@@ -27,7 +34,11 @@ export class LocalSandboxUnavailable extends Error {
         this.reason = reason;
     }
 }
-function unavailable(cause) {
+export function sandboxUnavailableReason(cause) {
+    if (cause instanceof UnsafeHostCode)
+        return { kind: "unsafe-host-code", message: cause.message };
+    if (cause instanceof UnsafeNativePayload)
+        return { kind: "unsafe-native-payload", message: cause.message };
     if (cause instanceof LocalBwrapUnavailable)
         return { kind: cause.reason, message: cause.message };
     return {
@@ -40,7 +51,7 @@ function unavailable(cause) {
  * mode, setting, bare-command branch, PATH fallback or permission to widen it.
  * A ready result proves only that the backend can start, not the escape matrix.
  */
-export function establishLocalSandbox(input) {
+export function establishLocalSandbox(input, staging) {
     try {
         sandboxPolicy(input.project, input.folder);
     }
@@ -62,14 +73,17 @@ export function establishLocalSandbox(input) {
                 message: `Local sandbox is unavailable on ${platform}.`,
             },
         };
-    let temporaryDirectory;
+    const native = staging ?? createNativePayloadStaging(input.project);
+    let agentTemporaryDirectory;
     try {
-        // A sandbox owns only its own temporary directory, never the host's HOME.
-        temporaryDirectory = realpathSync(mkdtempSync(join(tmpdir(), "fungi-sandbox-")));
-        const temporary = temporaryDirectory;
+        // Native staging is never granted as an Agent-writable temporary root.
+        if (platform === "darwin")
+            agentTemporaryDirectory = realpathSync(mkdtempSync(join(tmpdir(), "fungi-sandbox-")));
+        const agentTemporary = agentTemporaryDirectory;
+        const environmentTmp = agentTemporary ?? "/tmp";
         let closed = false;
         const sandbox = {
-            command: (cwd, argv) => {
+            command: (cwd, argv, readOnlyHelperFile) => {
                 if (closed)
                     throw new LocalSandboxUnavailable({
                         kind: "backend-refused",
@@ -79,23 +93,45 @@ export function establishLocalSandbox(input) {
                 // it must not turn into an authorized unsandboxed retry.
                 const policy = sandboxPolicy(input.project, input.folder);
                 try {
-                    const launch = platform === "linux"
-                        ? linuxSandboxCommand(policy, localLinuxSandboxPayload(), cwd, argv)
-                        : seatbeltCommand({ ...policy, temporaryDirectory: temporary }, argv);
+                    const linuxPayload = platform === "linux" ? native.linux(policy) : undefined;
+                    const stagedHelper = readOnlyHelperFile === undefined
+                        ? undefined
+                        : native.patch(readOnlyHelperFile);
+                    const stagedArgv = stagedHelper === undefined
+                        ? argv
+                        : [
+                            argv[0] === readOnlyHelperFile ? stagedHelper : argv[0],
+                            ...argv
+                                .slice(1)
+                                .map((argument) => argument === readOnlyHelperFile ? stagedHelper : argument),
+                        ];
+                    const launch = linuxPayload !== undefined
+                        ? linuxSandboxCommand(policy, linuxPayload, cwd, stagedArgv, undefined, stagedHelper)
+                        : seatbeltCommand({
+                            ...policy,
+                            temporaryDirectory: environmentTmp,
+                        }, stagedArgv);
                     return {
                         ...launch,
-                        environment: { TMPDIR: platform === "linux" ? "/tmp" : temporary },
+                        environment: { TMPDIR: environmentTmp },
                     };
                 }
                 catch (cause) {
-                    throw new LocalSandboxUnavailable(unavailable(cause));
+                    throw new LocalSandboxUnavailable(sandboxUnavailableReason(cause));
                 }
             },
             close: () => {
                 if (closed)
                     return;
                 closed = true;
-                rmSync(temporary, { recursive: true });
+                try {
+                    if (staging === undefined)
+                        native.close();
+                }
+                finally {
+                    if (agentTemporary !== undefined)
+                        rmSync(agentTemporary, { recursive: true });
+                }
             },
         };
         const command = sandbox.command(realpathSync(input.folder), [
@@ -104,8 +140,7 @@ export function establishLocalSandbox(input) {
         let filterDescriptor;
         const probe = () => {
             if (command.seccompFilter !== undefined) {
-                const path = join(temporary, "seccomp.bpf");
-                writeFileSync(path, command.seccompFilter, { mode: 0o600 });
+                const path = native.probeFilter(command.seccompFilter);
                 filterDescriptor = openSync(path, "r");
             }
             return spawnSync(command.executable, [...command.args], {
@@ -134,11 +169,11 @@ export function establishLocalSandbox(input) {
         })();
         if (result.status !== 0) {
             sandbox.close();
-            const stderr = result.stderr.trim();
+            const stderr = result.error === undefined ? result.stderr.trim() : "";
             return {
                 state: "unavailable",
                 reason: {
-                    kind: "backend-refused",
+                    kind: "startup-refused",
                     message: result.error?.message ??
                         (stderr.length > 0
                             ? stderr
@@ -149,13 +184,19 @@ export function establishLocalSandbox(input) {
         return { state: "ready", sandbox };
     }
     catch (cause) {
-        if (temporaryDirectory !== undefined)
-            rmSync(temporaryDirectory, { recursive: true });
+        try {
+            if (staging === undefined)
+                native.close();
+        }
+        finally {
+            if (agentTemporaryDirectory !== undefined)
+                rmSync(agentTemporaryDirectory, { recursive: true });
+        }
         return {
             state: "unavailable",
             reason: cause instanceof LocalSandboxUnavailable
                 ? cause.reason
-                : unavailable(cause),
+                : sandboxUnavailableReason(cause),
         };
     }
 }

package/dist/private-local-linux-sandbox.d.ts

@@ -1,8 +1,10 @@
 import { type LocalSandboxPolicy } from "./private-local-sandbox-policy.js";
 import type { LinuxSandboxPayload } from "./private-local-bwrap.js";
 /** Ordinary upstream bwrap argv. There is no approval or bare-command path. */
-export declare function linuxSandboxCommand(policy: LocalSandboxPolicy, payload: LinuxSandboxPayload, cwd: string, argv: readonly [string, ...string[]], host?: NodeJS.ProcessEnv): {
-    args: string[];
+export declare function linuxSandboxCommand(policy: LocalSandboxPolicy, payload: Omit<LinuxSandboxPayload, "executableBytes"> & {
     executable: string;
+}, cwd: string, argv: readonly [string, ...string[]], host?: NodeJS.ProcessEnv, readOnlyHelperFile?: string): {
+    args: string[];
     seccompFilter: Uint8Array;
+    executable: string;
 };

package/dist/private-local-linux-sandbox.js

@@ -2,15 +2,21 @@ import { existsSync, mkdirSync, realpathSync, statSync, writeFileSync, } from "n
 import { isAbsolute, join } from "node:path";
 import { protectedSandboxPaths, } from "./private-local-sandbox-policy.js";
 /** Ordinary upstream bwrap argv. There is no approval or bare-command path. */
-export function linuxSandboxCommand(policy, payload, cwd, argv, host = process.env) {
+export function linuxSandboxCommand(policy, payload, cwd, argv, host = process.env, readOnlyHelperFile) {
     const root = policy.writableRoot;
     // Bind sources must exist. Only the trusted host prepares the reserved paths.
     mkdirSync(join(root, ".fungi"), { recursive: true });
+    const reserved = new Set(policy.readOnly);
     for (const git of policy.immovable) {
-        mkdirSync(join(git, "hooks"), { recursive: true });
+        if (reserved.has(join(git, "hooks")))
+            mkdirSync(join(git, "hooks"), { recursive: true });
         for (const config of ["config", "config.worktree"])
-            if (!existsSync(join(git, config)))
+            if (reserved.has(join(git, config)) && !existsSync(join(git, config)))
                 writeFileSync(join(git, config), "", { flag: "wx" });
+        // Git reads a present commondir and rejects an empty one; "." names the
+        // Git directory itself, which is what an absent commondir means.
+        if (!existsSync(join(git, "commondir")))
+            writeFileSync(join(git, "commondir"), ".", { flag: "wx" });
     }
     const args = [
         "--unshare-all",
@@ -62,6 +68,13 @@ export function linuxSandboxCommand(policy, payload, cwd, argv, host = process.e
         existsSync(agentSocket) &&
         statSync(agentSocket).isSocket())
         args.push("--ro-bind", "/dev/null", realpathSync(agentSocket));
+    // Native Files passes its resolved helper, never an untrusted exec argv[0].
+    // Re-expose only that file after private mounts; its siblings stay hidden.
+    if (readOnlyHelperFile !== undefined) {
+        if (!statSync(readOnlyHelperFile).isFile())
+            throw new Error("Local native helper must be a regular file");
+        args.push("--ro-bind", readOnlyHelperFile, readOnlyHelperFile);
+    }
     args.push("--chdir", cwd, "--", ...argv);
     return { ...payload, args };
 }

package/dist/private-local-native-digests.js

@@ -0,0 +1,2 @@
+// Generated from native build output; not a runtime sidecar.
+export const nativeDigests = Object.freeze({"linux-x64":{"patch":"df8cca6e61abec1438f96b74cf415a1609caef3868ad2e0ebe0a8c20bd571b87","bwrap":"035ac5ddfc70dd7d4a9b575b351944d47aa9d0bbafeb433fb72b2afb02cef7f4","seccomp":"38112f9cf994bed2ed962fae63e803c41874732ab032088b2c1ea3d713e51c11"}});

package/dist/private-local-native-staging.d.ts

@@ -0,0 +1,17 @@
+import { type NativeSourceReader } from "./private-local-bwrap.js";
+import { type LocalSandboxPolicy, type NativeRunLivenessProbe } from "./private-local-sandbox-policy.js";
+/**
+ * One invocation owner for pinned native bytes. Verify the installed source on
+ * every admission, but execute/bind only the first private copy of those
+ * verified bytes. The built digest pins each label to a single payload.
+ */
+export declare function createNativePayloadStaging(project: string, readNativePatchSource?: NativeSourceReader, probeNativeRunLiveness?: NativeRunLivenessProbe): {
+    patch: (path: string) => string;
+    linux: (policy: LocalSandboxPolicy) => {
+        executable: string;
+        seccompFilter: Uint8Array<ArrayBufferLike>;
+    };
+    probeFilter: (bytes: Uint8Array) => string;
+    close: () => void;
+};
+export type NativePayloadStaging = ReturnType<typeof createNativePayloadStaging>;

package/dist/private-local-native-staging.js

@@ -0,0 +1,49 @@
+import { rmSync } from "node:fs";
+import { localLinuxSandboxPayload, verifiedNativePatchHelper, LocalBwrapUnavailable, } from "./private-local-bwrap.js";
+import { privateNativeDirectory, stageNativeBytes, UnsafeNativePayload, } from "./private-local-sandbox-policy.js";
+/**
+ * One invocation owner for pinned native bytes. Verify the installed source on
+ * every admission, but execute/bind only the first private copy of those
+ * verified bytes. The built digest pins each label to a single payload.
+ */
+export function createNativePayloadStaging(project, readNativePatchSource, probeNativeRunLiveness) {
+    let directory;
+    let closed = false;
+    const staged = new Map();
+    const stage = (label, bytes) => {
+        if (closed)
+            throw new Error("Native staging owner is closed");
+        const existing = staged.get(label);
+        if (existing !== undefined)
+            return existing;
+        try {
+            directory ??= privateNativeDirectory(project, probeNativeRunLiveness);
+            const path = stageNativeBytes(directory, label, bytes);
+            staged.set(label, path);
+            return path;
+        }
+        catch (cause) {
+            if (cause instanceof UnsafeNativePayload)
+                throw cause;
+            throw new LocalBwrapUnavailable("staging-failed", `Cannot stage verified ${label} in a private native directory; no command was started.`, { cause });
+        }
+    };
+    return {
+        patch: (path) => stage("fungi-apply-patch", verifiedNativePatchHelper(path, project, readNativePatchSource)),
+        linux: (policy) => {
+            const payload = localLinuxSandboxPayload(policy);
+            return {
+                executable: stage("fungi-bwrap", payload.executableBytes),
+                seccompFilter: payload.seccompFilter,
+            };
+        },
+        probeFilter: (bytes) => stage("fungi-seccomp.bpf", bytes),
+        close: () => {
+            if (closed)
+                return;
+            closed = true;
+            if (directory !== undefined)
+                rmSync(directory, { recursive: true });
+        },
+    };
+}

package/dist/private-local-runtime-host.js

@@ -1,5 +1,6 @@
 import { createAssistantMessageEventStream } from "@earendil-works/pi-ai/utils/event-stream";
-import { observeProviderStatus } from "@fungi.computer/mule";
+import { observeProviderStatus, normalizeModel, decodeProviderData, } from "@fungi.computer/mule";
+import { normalizeContext } from "@earendil-works/pi-ai/utils/transcript";
 import { modelFailureMessage, modelFailureRetryable, } from "./private-provider-rejection.js";
 import { logEvent } from "./log-event.js";
 import { localArchiveHandoff } from "./local-archive-handoff.js";
@@ -556,7 +557,7 @@ export function createPrivateLocalModelSource(models, providerId, modelId, provi
             // prose that any SDK can supply.
             let modelFailure;
             return Promise.resolve(Object.freeze({
-                model: selected,
+                model: normalizeModel(selected),
                 retryable: (message) => !signal.aborted &&
                     message.stopReason === "error" &&
                     modelFailure?.message === message &&
@@ -598,13 +599,19 @@ export function createPrivateLocalModelSource(models, providerId, modelId, provi
                     };
                     void (async () => {
                         try {
-                            const upstream = turn.models.streamSimple(selected, context, {
-                                ...streamOptions,
+                            const { onPayload, onResponse, ...rest } = streamOptions;
+                            const requestOptions = {
+                                ...rest,
                                 fetch: provider.fetch,
-                                onProviderStreamEvent: provider.onProviderStreamEvent,
+                                onProviderStreamEvent: (data, model) => provider.onProviderStreamEvent(decodeProviderData(data), normalizeModel(model)),
                                 sessionId: providerCacheKey,
                                 transport: options?.transport ?? "auto",
-                            });
+                            };
+                            if (onPayload !== undefined)
+                                requestOptions.onPayload = (data, model) => onPayload(decodeProviderData(data), normalizeModel(model));
+                            if (onResponse !== undefined)
+                                requestOptions.onResponse = (response, model) => onResponse(response, normalizeModel(model));
+                            const upstream = turn.models.streamSimple(selected, normalizeContext(context), requestOptions);
                             for await (const event of upstream) {
                                 if (event.type === "error") {
                                     const error = failure(event.error.usage, event.reason === "aborted", event.error);