@fungi.computer/truffle 0.2.0 → 0.2.2

package/dist/private-local-sandbox.js

@@ -1,7 +1,10 @@
 import { isAbsolute, relative, resolve, sep } from "node:path";
+import { tmpdir } from "node:os";
+import { fileURLToPath } from "node:url";
+import { createNativePayloadStaging } from "./private-local-native-staging.js";
 import { z } from "zod";
-import { establishLocalSandbox, LocalSandboxUnavailable, sandboxUnavailableReasonSchema, } from "./private-local-containment.js";
-import { protectedSandboxPaths, resolveAgentFolder, sandboxPolicy, } from "./private-local-sandbox-policy.js";
+import { establishLocalSandbox, LocalSandboxUnavailable, sandboxUnavailableReason, sandboxUnavailableReasonSchema, } from "./private-local-containment.js";
+import { protectedSandboxPaths, assertHostCodeOutsideAgent, UnsafeHostCode, resolveAgentFolder, sandboxPolicy, } from "./private-local-sandbox-policy.js";
 /** Availability is not a hostile-program security or an approval status. */
 export const sandboxStatusSchema = z.discriminatedUnion("state", [
     z.strictObject({
@@ -25,59 +28,126 @@ function contains(root, path) {
 export function createLocalSandboxControls(input) {
     const required = input.required();
     const folder = resolveAgentFolder(input.project, input.folder);
+    // The packed Node wrapper passes the paths it actually loaded. In source
+    // runs this module is the executing host authority instead. Check before
+    // staging or probing, independent of the optional/required setting.
+    try {
+        const launcher = process.env.FUNGI_LAUNCHER;
+        const cli = launcher === undefined
+            ? fileURLToPath(import.meta.url)
+            : process.env.FUNGI_BUNDLED_CLI;
+        if (cli === undefined)
+            throw new UnsafeHostCode("Packed CLI entry was not provided by the launcher; reinstall Fungi outside the project.");
+        assertHostCodeOutsideAgent(input.project, cli, launcher ?? cli);
+    }
+    catch (cause) {
+        throw new LocalSandboxUnavailable(cause instanceof UnsafeHostCode
+            ? sandboxUnavailableReason(cause)
+            : {
+                kind: "unsafe-host-code",
+                message: `Fungi host JavaScript identity cannot be verified (${cause instanceof Error ? cause.message : String(cause)}); reinstall Fungi using a copying install outside the project.`,
+            });
+    }
+    const platform = input.platform === undefined ? {} : { platform: input.platform };
+    const native = createNativePayloadStaging(input.project, input.readNativePatchSource, input.probeNativeRunLiveness);
     const initial = establishLocalSandbox({
         project: input.project,
         folder: folder.absolute,
-    });
+        ...platform,
+    }, native);
     let sandbox = initial.state === "ready" ? initial.sandbox : undefined;
+    let everReady = initial.state === "ready";
     let unavailable = initial.state === "unavailable" ? initial.reason : undefined;
     if (unavailable !== undefined) {
-        if (unavailable.kind === "invalid-folder")
+        if (unavailable.kind === "invalid-folder") {
+            native.close();
             throw new Error(unavailable.message);
-        if (required)
+        }
+        if (required) {
+            native.close();
             throw new LocalSandboxUnavailable(unavailable);
+        }
     }
     let closed = false;
     const assertFolder = () => {
         if (closed)
             throw new Error("Local sandbox owner is closed");
-        const current = resolveAgentFolder(input.project, input.folder);
-        if (current.absolute !== folder.absolute)
+        try {
+            const current = resolveAgentFolder(input.project, input.folder);
+            if (current.absolute === folder.absolute)
+                return;
             throw new Error("Local Agent folder authority changed while open");
+        }
+        catch (cause) {
+            if (!everReady)
+                throw cause;
+            unavailable = {
+                kind: "invalid-folder",
+                message: cause instanceof Error ? cause.message : String(cause),
+            };
+            throw new LocalSandboxUnavailable(unavailable);
+        }
     };
-    const launch = (cwd, argv) => {
+    function launch(cwd, argv, readOnlyHelperFile) {
         assertFolder();
         if (sandbox === undefined) {
             const admission = establishLocalSandbox({
                 project: input.project,
                 folder: folder.absolute,
-            });
-            if (admission.state === "ready")
+                ...platform,
+            }, native);
+            if (admission.state === "ready") {
                 sandbox = admission.sandbox;
+                everReady = true;
+            }
             else
                 unavailable = admission.reason;
         }
         if (sandbox !== undefined) {
             try {
-                const command = sandbox.command(cwd, argv);
+                const command = sandbox.command(cwd, argv, readOnlyHelperFile);
                 unavailable = undefined;
                 return command;
             }
             catch (cause) {
-                if (!(cause instanceof LocalSandboxUnavailable))
-                    throw cause;
-                unavailable = cause.reason;
+                unavailable =
+                    cause instanceof LocalSandboxUnavailable
+                        ? cause.reason
+                        : sandboxUnavailableReason(cause);
+                throw new LocalSandboxUnavailable(unavailable);
             }
         }
         if (unavailable === undefined)
             throw new Error("Local sandbox preparation produced no result");
-        if (unavailable.kind === "invalid-folder")
+        if (unavailable.kind === "invalid-folder" && !everReady)
             throw new Error(unavailable.message);
+        // A formerly ready sandbox never becomes optional bare execution.
+        // Before readiness, only availability failures permit fallback.
+        if (everReady ||
+            (unavailable.kind !== "missing" &&
+                unavailable.kind !== "unsupported-platform" &&
+                unavailable.kind !== "startup-refused"))
+            throw new LocalSandboxUnavailable(unavailable);
         if (input.required())
             throw new LocalSandboxUnavailable(unavailable);
-        // No executable has started. Only this owner admits the bare fallback.
+        // Files is never handed back its installed executable for a bare retry.
+        if (readOnlyHelperFile !== undefined) {
+            try {
+                return {
+                    bareNative: true,
+                    executable: native.patch(readOnlyHelperFile),
+                    args: [],
+                    environment: { TMPDIR: process.env.TMPDIR ?? tmpdir() },
+                };
+            }
+            catch (cause) {
+                unavailable = sandboxUnavailableReason(cause);
+                throw new LocalSandboxUnavailable(unavailable);
+            }
+        }
+        // No executable has started. Generic exec retains its ordinary fallback.
         return undefined;
-    };
+    }
     const assertReady = () => {
         launch(folder.absolute, ["/usr/bin/true"]);
     };
@@ -108,7 +178,12 @@ export function createLocalSandboxControls(input) {
             if (closed)
                 return;
             closed = true;
-            sandbox?.close();
+            try {
+                sandbox?.close();
+            }
+            finally {
+                native.close();
+            }
         },
     };
 }

package/dist/private-local-service-discovery.d.ts

@@ -131,10 +131,10 @@ export declare const archiveRefusalSchema: z.ZodObject<{
     reason: z.ZodEnum<{
         pending: "pending";
         running: "running";
+        unreadable: "unreadable";
         archived: "archived";
         not_creator: "not_creator";
         self: "self";
-        unreadable: "unreadable";
     }>;
     error: z.ZodString;
 }, z.core.$strict>;

package/dist/private-local-service-owner.d.ts

@@ -114,7 +114,7 @@ onRecoveryDisabled?: ServiceLogLifecycle["recoveryDisabled"], configRoot?: Priva
         state: "unavailable";
         requireSandbox: boolean;
         reason: {
-            kind: "missing" | "invalid-digest" | "digest-mismatch" | "not-executable" | "unsupported-platform" | "invalid-folder" | "backend-refused";
+            kind: "missing" | "missing-artifact" | "invalid-digest" | "digest-mismatch" | "unreadable" | "not-executable" | "staging-failed" | "unsupported-platform" | "invalid-folder" | "unsafe-native-payload" | "unsafe-host-code" | "startup-refused" | "backend-refused";
             message: string;
         };
     }>;

package/dist/private-local-service.js

@@ -232,12 +232,19 @@ export function createPrivateLocalServiceManager(options = {}) {
             if (await serviceOwnerIsLive(directory))
                 return "busy";
             const bundledCli = process.env.FUNGI_BUNDLED_CLI;
-            const child = spawn(options.executable ?? process.execPath, bundledCli === undefined
-                ? [
-                    fileURLToPath(new URL("./private-local-service-process.js", import.meta.url)),
-                    directory,
-                ]
-                : [bundledCli, "--internal-service", directory], {
+            // A detached Bun service also starts in the invoking project's cwd.
+            // Keep the host process from importing Agent-authored bunfig or .env.
+            const bunFlags = options.executable === undefined && "bun" in process.versions
+                ? ["--config=/dev/null", "--no-env-file"]
+                : [];
+            const serviceEntry = bundledCli ??
+                fileURLToPath(new URL("./private-local-service-process.js", import.meta.url));
+            const child = spawn(options.executable ?? process.execPath, [
+                ...bunFlags,
+                serviceEntry,
+                ...(bundledCli === undefined ? [] : ["--internal-service"]),
+                directory,
+            ], {
                 detached: true,
                 stdio: "ignore",
                 // Service startup retains its existing inherited inputs. This is

package/dist/private-local-session-discovery.d.ts

@@ -37,7 +37,7 @@ export declare function readPrivateLocalAgentProfile(path: string): {
     model: {
         readonly providerId: string;
         readonly modelId: string;
-        readonly reasoning?: "minimal" | "low" | "medium" | "high" | "xhigh" | "max" | undefined;
+        readonly reasoning?: "high" | "low" | "max" | "medium" | "minimal" | "xhigh" | undefined;
     } | null;
 };
 export declare function readPrivateLocalSessionSummaries(path: string): Promise<readonly LocalSummary[]>;

package/native/bin/bwrap-build-source/Dockerfile

@@ -12,7 +12,7 @@ RUN if [ "$TARGET" = linux-arm64 ]; then \
     fi && apt-get update && apt-get install -y --no-install-recommends \
       build-essential ca-certificates curl xz-utils python3-pip ninja-build \
       pkg-config patchelf libcap-dev libseccomp-dev \
-      $(if [ "$TARGET" = linux-arm64 ]; then printf 'gcc-aarch64-linux-gnu binutils-aarch64-linux-gnu libcap-dev:arm64'; fi) \
+      $(if [ "$TARGET" = linux-arm64 ]; then printf 'gcc-aarch64-linux-gnu binutils-aarch64-linux-gnu libc6-dev-arm64-cross libcap-dev:arm64'; fi) \
     && rm -rf /var/lib/apt/lists/*
 # prefer_static is a maintained Meson option newer than Jammy's Meson.
 RUN pip3 install --no-cache-dir meson==1.10.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fungi.computer/truffle",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "private": false,
   "description": "Truffle: Fungi's local Agent runtime, bundled into the fungi command",
   "type": "module",
@@ -67,20 +67,20 @@
     "@fungi.computer/cairn": "0.1.0",
     "@fungi.computer/capnweb": "0.12.0",
     "@fungi.computer/carrier": "0.1.0",
-    "@fungi.computer/cordyceps": "0.3.0",
+    "@fungi.computer/cordyceps": "0.3.1",
     "@fungi.computer/gills": "0.2.0",
-    "@fungi.computer/graft": "0.1.0",
-    "@fungi.computer/knapsack": "0.2.0",
+    "@fungi.computer/graft": "0.1.1",
+    "@fungi.computer/knapsack": "0.2.1",
     "@fungi.computer/lantern": "0.3.0",
-    "@fungi.computer/mycelium": "0.2.0",
+    "@fungi.computer/mycelium": "0.2.1",
     "@fungi.computer/nacre": "0.0.1",
     "@fungi.computer/seam": "0.1.0",
-    "@fungi.computer/shiitake": "0.3.0",
-    "@fungi.computer/shiitake-extensions": "0.1.0",
+    "@fungi.computer/shiitake": "0.3.1",
+    "@fungi.computer/shiitake-extensions": "0.1.1",
     "@fungi.computer/veil": "0.2.0",
     "@fungi.computer/watchdog": "0.1.0",
     "@fungi.computer/whistle": "0.1.0",
-    "@fungi.computer/zookeeper": "0.0.1",
+    "@fungi.computer/zookeeper": "0.0.2",
     "@modelcontextprotocol/client": "2.0.0",
     "diff": "8.0.4",
     "effect": "4.0.2",
@@ -97,7 +97,7 @@
   },
   "devDependencies": {
     "@cloudflare/codemode": "0.5.1",
-    "@fungi.computer/mule": "0.1.0",
+    "@fungi.computer/mule": "0.1.1",
     "@modelcontextprotocol/server": "2.0.0",
     "@types/node": "24.13.3",
     "@types/proper-lockfile": "4.1.4",
@@ -140,7 +140,7 @@
   "scripts": {
     "lint": "../../node_modules/.bin/eslint src scripts test --max-warnings=0 && ../../node_modules/.bin/oxlint --config ../../oxlint.config.ts --deny-warnings src scripts test",
     "typecheck": "tsc -p tsconfig.json --noEmit",
-    "build": "pnpm run clean && tsc -p tsconfig.build.json && node scripts/copy-seatbelt.mjs && esbuild src/internal/private-workerd-sandbox-worker.mjs --outfile=dist/internal/private-workerd-sandbox-worker.mjs --bundle --format=esm --platform=neutral --conditions=workerd,browser --target=es2024 --external:cloudflare:workers --metafile=dist/internal/sandbox-metafile.json --log-level=warning && esbuild src/internal/local-image-fit-worker.mjs --outfile=dist/internal/local-image-fit-worker.mjs --bundle --format=esm --platform=node --target=es2024 --metafile=dist/internal/image-fit-metafile.json --log-level=warning",
+    "build": "if [ ! -f src/private-local-native-digests.js ]; then pnpm run build:native; fi && node scripts/generate-native-digests.mjs --verify && pnpm run clean && tsc -p tsconfig.build.json && cp src/private-local-native-digests.js dist/private-local-native-digests.js && node scripts/copy-seatbelt.mjs && esbuild src/internal/private-workerd-sandbox-worker.mjs --outfile=dist/internal/private-workerd-sandbox-worker.mjs --bundle --format=esm --platform=neutral --conditions=workerd,browser --target=es2024 --external:cloudflare:workers --metafile=dist/internal/sandbox-metafile.json --log-level=warning && esbuild src/internal/local-image-fit-worker.mjs --outfile=dist/internal/local-image-fit-worker.mjs --bundle --format=esm --platform=node --target=es2024 --metafile=dist/internal/image-fit-metafile.json --log-level=warning",
     "clean": "node --input-type=module --eval \"import { rm } from 'node:fs/promises'; await rm('dist', { recursive: true, force: true });\"",
     "test": "pnpm run test:node && pnpm run test:merge && pnpm run test:stop-all",
     "test:stop-all": "bun test ./test/private-local-stop-all.bun.test.ts",
@@ -149,7 +149,7 @@
     "test:bun": "pnpm run test:mesh-link && pnpm run test:bun:batch && bun test ./test/private-workerd-deadline.bun.test.ts",
     "test:mesh-link": "bun test ./test/private-local-mesh-links.bun.test.ts",
     "test:bun:batch": "bun test ./test/private-sqlite-approval-driver.bun.test.ts ./test/mcp-form-service.bun.test.ts ./test/private-local-service-discovery.bun.test.ts ./test/private-local-service-listener.bun.test.ts ./test/private-local-service-manager.bun.test.ts ./test/private-local-service-rebind.bun.test.ts ./test/private-local-service-stop.bun.test.ts ./test/private-local-service-ensure.bun.test.ts ./test/private-local-service-identity.bun.test.ts ./test/private-local-service-kill-resume.bun.test.ts ./test/private-local-service-idle-owners.bun.test.ts ./test/private-local-service-idle-delegation.bun.test.ts ./test/private-local-mail-retry.bun.test.ts ./test/private-local-service-log-native.bun.test.ts ./test/private-local-service-log.bun.test.ts ./test/private-local-sqlite-lifetime.bun.test.ts ./test/private-sqlite-driver.bun.test.ts ./test/private-local-reload.bun.test.ts ./test/private-local-auth-rpc.bun.test.ts ./test/private-workerd-forage.bun.test.ts ./test/local-extensions.bun.test.ts ./test/local-zookeeper-slot.bun.test.ts ./test/local-extension-skills.bun.test.ts ./test/private-local-sandbox-service.bun.test.ts",
-    "build:native": "fungi-apply-patch-build --out native/bin && node scripts/build-bwrap.mjs --out native/bin",
+    "build:native": "fungi-apply-patch-build --out native/bin && node scripts/build-bwrap.mjs --out native/bin && node scripts/generate-native-digests.mjs",
     "test:patch": "node --test --test-timeout=30000 test/apply-patch.native.mjs",
     "test:sandbox:linux": "node --import tsx test/fixtures/local-sandbox-proof.mts",
     "test:sandbox:macos": "scratch=$(mktemp -d /tmp/fungi-seatbelt.XXXXXX) && scratch=$(cd \"$scratch\" && pwd -P) && mkdir \"$scratch/home\" && HOME=\"$scratch/home\" node --import tsx scripts/seatbelt-mac-proof.mjs \"$scratch\"",