@fungi.computer/truffle 0.2.1 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (68) hide show
  1. package/dist/private-files-patch.js +39 -36
  2. package/dist/private-invocation-computer.d.ts +224 -5
  3. package/dist/private-invocation-computer.js +162 -22
  4. package/dist/private-invocation-files.d.ts +3 -2
  5. package/dist/private-invocation-files.js +22 -3
  6. package/dist/private-local-agent-control.d.ts +2 -2
  7. package/dist/private-local-bwrap.d.ts +17 -7
  8. package/dist/private-local-bwrap.js +73 -33
  9. package/dist/private-local-computer-processes.d.ts +15 -0
  10. package/dist/private-local-computer-processes.js +13 -0
  11. package/dist/private-local-containment.d.ts +18 -8
  12. package/dist/private-local-containment.js +70 -45
  13. package/dist/private-local-delegation.d.ts +3 -3
  14. package/dist/private-local-delegation.js +32 -19
  15. package/dist/private-local-exec-review.d.ts +10 -0
  16. package/dist/private-local-exec-review.js +50 -0
  17. package/dist/private-local-exec-rules.d.ts +14 -0
  18. package/dist/private-local-exec-rules.js +420 -0
  19. package/dist/private-local-git-exclude.js +25 -15
  20. package/dist/private-local-linux-sandbox.d.ts +5 -3
  21. package/dist/private-local-linux-sandbox.js +71 -25
  22. package/dist/private-local-mail.d.ts +2 -2
  23. package/dist/private-local-mesh-links.d.ts +4 -1
  24. package/dist/private-local-mesh-links.js +50 -3
  25. package/dist/private-local-native-digests.js +2 -0
  26. package/dist/private-local-native-install-error.d.ts +2 -0
  27. package/dist/private-local-native-install-error.js +10 -0
  28. package/dist/private-local-native-staging.d.ts +16 -0
  29. package/dist/private-local-native-staging.js +138 -0
  30. package/dist/private-local-permission-mode.d.ts +10 -0
  31. package/dist/private-local-permission-mode.js +18 -0
  32. package/dist/private-local-runtime-host.d.ts +19 -5
  33. package/dist/private-local-runtime-host.js +391 -71
  34. package/dist/private-local-sandbox-policy.d.ts +46 -6
  35. package/dist/private-local-sandbox-policy.js +350 -71
  36. package/dist/private-local-sandbox.d.ts +34 -18
  37. package/dist/private-local-sandbox.js +225 -60
  38. package/dist/private-local-seatbelt.d.ts +7 -13
  39. package/dist/private-local-seatbelt.js +55 -32
  40. package/dist/private-local-service-contract.d.ts +5 -4
  41. package/dist/private-local-service-discovery.d.ts +18 -6
  42. package/dist/private-local-service-discovery.js +4 -3
  43. package/dist/private-local-service-listener.js +40 -2
  44. package/dist/private-local-service-log.d.ts +8 -0
  45. package/dist/private-local-service-log.js +3 -0
  46. package/dist/private-local-service-owner.d.ts +18 -10
  47. package/dist/private-local-service-owner.js +117 -25
  48. package/dist/private-local-service.js +43 -9
  49. package/dist/private-local-session-discovery.d.ts +3 -2
  50. package/dist/private-local-session-discovery.js +18 -6
  51. package/dist/private-mcp-form-contract.d.ts +8 -1
  52. package/dist/private-mcp-form-contract.js +8 -1
  53. package/dist/private-mcp-form-session.d.ts +33 -3
  54. package/dist/private-mcp-form-session.js +28 -5
  55. package/dist/private-oyster-mcp-auth.d.ts +1 -1
  56. package/dist/private-oyster-mcp-auth.js +139 -7
  57. package/dist/private-provider-rejection.js +1 -1
  58. package/dist/seatbelt/safe-base.sbpl +2 -2
  59. package/native/bin/bwrap-build-source/Dockerfile +3 -1
  60. package/native/bin/bwrap-build-source/README.md +6 -6
  61. package/native/bin/bwrap-build-source/pin.mjs +2 -2
  62. package/native/bin/bwrap-build-source/record.mjs +12 -1
  63. package/native/bin/bwrap-build-source/vendor/seccomp-unix-block.c +10 -7
  64. package/native/bin/bwrap-build.json +3 -2
  65. package/native/bin/fungi-apply-patch +0 -0
  66. package/native/bin/fungi-seccomp-workspace.bpf +0 -0
  67. package/native/bin/fungi-seccomp-workspace.bpf.sha256 +1 -0
  68. package/package.json +25 -19
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@fungi.computer/truffle",
3
- "version": "0.2.1",
3
+ "version": "0.3.0",
4
4
  "private": false,
5
5
  "description": "Truffle: Fungi's local Agent runtime, bundled into the fungi command",
6
6
  "type": "module",
@@ -49,6 +49,10 @@
49
49
  "./extensions": {
50
50
  "types": "./dist/local-extensions.d.ts",
51
51
  "import": "./dist/local-extensions.js"
52
+ },
53
+ "./rules": {
54
+ "types": "./dist/private-local-exec-rules.d.ts",
55
+ "import": "./dist/private-local-exec-rules.js"
52
56
  }
53
57
  },
54
58
  "files": [
@@ -61,27 +65,29 @@
61
65
  "@cf-wasm/photon": "0.4.0",
62
66
  "@earendil-works/pi-ai": "1.3.0",
63
67
  "@effect/platform-node": "4.0.2",
64
- "@fungi.computer/agar": "0.3.0",
65
- "@fungi.computer/approvals": "0.0.2",
66
- "@fungi.computer/bird-dog": "0.1.0",
68
+ "@fungi.computer/agar": "0.3.1",
69
+ "@fungi.computer/approvals": "0.1.0",
70
+ "@fungi.computer/bird-dog": "0.2.0",
67
71
  "@fungi.computer/cairn": "0.1.0",
68
72
  "@fungi.computer/capnweb": "0.12.0",
69
- "@fungi.computer/carrier": "0.1.0",
70
- "@fungi.computer/cordyceps": "0.3.1",
73
+ "@fungi.computer/carrier": "0.2.0",
74
+ "@fungi.computer/cordyceps": "0.4.0",
71
75
  "@fungi.computer/gills": "0.2.0",
72
- "@fungi.computer/graft": "0.1.0",
73
- "@fungi.computer/knapsack": "0.2.0",
76
+ "@fungi.computer/graft": "0.1.2",
77
+ "@fungi.computer/knapsack": "0.3.0",
74
78
  "@fungi.computer/lantern": "0.3.0",
75
- "@fungi.computer/mycelium": "0.2.0",
76
- "@fungi.computer/nacre": "0.0.1",
77
- "@fungi.computer/seam": "0.1.0",
78
- "@fungi.computer/shiitake": "0.3.0",
79
- "@fungi.computer/shiitake-extensions": "0.1.0",
79
+ "@fungi.computer/mycelium": "0.2.2",
80
+ "@fungi.computer/nacre": "0.0.2",
81
+ "@fungi.computer/seam": "0.2.0",
82
+ "@fungi.computer/shiitake": "0.4.0",
83
+ "@fungi.computer/shiitake-extensions": "0.2.0",
80
84
  "@fungi.computer/veil": "0.2.0",
81
85
  "@fungi.computer/watchdog": "0.1.0",
82
86
  "@fungi.computer/whistle": "0.1.0",
83
- "@fungi.computer/zookeeper": "0.0.1",
87
+ "@fungi.computer/zookeeper": "0.0.3",
88
+ "@jellybrick/dbus-next": "0.11.4",
84
89
  "@modelcontextprotocol/client": "2.0.0",
90
+ "@napi-rs/keyring": "2.1.2",
85
91
  "diff": "8.0.4",
86
92
  "effect": "4.0.2",
87
93
  "eventsource": "5.1.1",
@@ -97,7 +103,7 @@
97
103
  },
98
104
  "devDependencies": {
99
105
  "@cloudflare/codemode": "0.5.1",
100
- "@fungi.computer/mule": "0.1.0",
106
+ "@fungi.computer/mule": "0.2.0",
101
107
  "@modelcontextprotocol/server": "2.0.0",
102
108
  "@types/node": "24.13.3",
103
109
  "@types/proper-lockfile": "4.1.4",
@@ -140,7 +146,7 @@
140
146
  "scripts": {
141
147
  "lint": "../../node_modules/.bin/eslint src scripts test --max-warnings=0 && ../../node_modules/.bin/oxlint --config ../../oxlint.config.ts --deny-warnings src scripts test",
142
148
  "typecheck": "tsc -p tsconfig.json --noEmit",
143
- "build": "pnpm run clean && tsc -p tsconfig.build.json && node scripts/copy-seatbelt.mjs && esbuild src/internal/private-workerd-sandbox-worker.mjs --outfile=dist/internal/private-workerd-sandbox-worker.mjs --bundle --format=esm --platform=neutral --conditions=workerd,browser --target=es2024 --external:cloudflare:workers --metafile=dist/internal/sandbox-metafile.json --log-level=warning && esbuild src/internal/local-image-fit-worker.mjs --outfile=dist/internal/local-image-fit-worker.mjs --bundle --format=esm --platform=node --target=es2024 --metafile=dist/internal/image-fit-metafile.json --log-level=warning",
149
+ "build": "if [ ! -f src/private-local-native-digests.js ]; then pnpm run build:native; fi && node scripts/generate-native-digests.mjs --verify && pnpm run clean && tsc -p tsconfig.build.json && cp src/private-local-native-digests.js dist/private-local-native-digests.js && node scripts/copy-seatbelt.mjs && esbuild src/internal/private-workerd-sandbox-worker.mjs --outfile=dist/internal/private-workerd-sandbox-worker.mjs --bundle --format=esm --platform=neutral --conditions=workerd,browser --target=es2024 --external:cloudflare:workers --metafile=dist/internal/sandbox-metafile.json --log-level=warning && esbuild src/internal/local-image-fit-worker.mjs --outfile=dist/internal/local-image-fit-worker.mjs --bundle --format=esm --platform=node --target=es2024 --metafile=dist/internal/image-fit-metafile.json --log-level=warning",
144
150
  "clean": "node --input-type=module --eval \"import { rm } from 'node:fs/promises'; await rm('dist', { recursive: true, force: true });\"",
145
151
  "test": "pnpm run test:node && pnpm run test:merge && pnpm run test:stop-all",
146
152
  "test:stop-all": "bun test ./test/private-local-stop-all.bun.test.ts",
@@ -148,11 +154,11 @@
148
154
  "test:node": "../../node_modules/.bin/vitest run",
149
155
  "test:bun": "pnpm run test:mesh-link && pnpm run test:bun:batch && bun test ./test/private-workerd-deadline.bun.test.ts",
150
156
  "test:mesh-link": "bun test ./test/private-local-mesh-links.bun.test.ts",
151
- "test:bun:batch": "bun test ./test/private-sqlite-approval-driver.bun.test.ts ./test/mcp-form-service.bun.test.ts ./test/private-local-service-discovery.bun.test.ts ./test/private-local-service-listener.bun.test.ts ./test/private-local-service-manager.bun.test.ts ./test/private-local-service-rebind.bun.test.ts ./test/private-local-service-stop.bun.test.ts ./test/private-local-service-ensure.bun.test.ts ./test/private-local-service-identity.bun.test.ts ./test/private-local-service-kill-resume.bun.test.ts ./test/private-local-service-idle-owners.bun.test.ts ./test/private-local-service-idle-delegation.bun.test.ts ./test/private-local-mail-retry.bun.test.ts ./test/private-local-service-log-native.bun.test.ts ./test/private-local-service-log.bun.test.ts ./test/private-local-sqlite-lifetime.bun.test.ts ./test/private-sqlite-driver.bun.test.ts ./test/private-local-reload.bun.test.ts ./test/private-local-auth-rpc.bun.test.ts ./test/private-workerd-forage.bun.test.ts ./test/local-extensions.bun.test.ts ./test/local-zookeeper-slot.bun.test.ts ./test/local-extension-skills.bun.test.ts ./test/private-local-sandbox-service.bun.test.ts",
152
- "build:native": "fungi-apply-patch-build --out native/bin && node scripts/build-bwrap.mjs --out native/bin",
157
+ "test:bun:batch": "bun test ./test/private-sqlite-approval-driver.bun.test.ts ./test/mcp-form-service.bun.test.ts ./test/private-local-service-discovery.bun.test.ts ./test/private-local-service-listener.bun.test.ts ./test/private-local-service-manager.bun.test.ts ./test/private-local-service-rebind.bun.test.ts ./test/private-local-service-stop.bun.test.ts ./test/private-local-service-ensure.bun.test.ts ./test/private-local-service-identity.bun.test.ts ./test/private-local-service-kill-resume.bun.test.ts ./test/private-local-service-idle-owners.bun.test.ts ./test/private-local-service-idle-delegation.bun.test.ts ./test/private-local-mail-retry.bun.test.ts ./test/private-local-service-log-native.bun.test.ts ./test/private-local-service-log.bun.test.ts ./test/private-local-sqlite-lifetime.bun.test.ts ./test/private-sqlite-driver.bun.test.ts ./test/private-local-reload.bun.test.ts ./test/private-local-auth-rpc.bun.test.ts ./test/private-workerd-forage.bun.test.ts ./test/local-extensions.bun.test.ts ./test/local-zookeeper-slot.bun.test.ts ./test/local-extension-skills.bun.test.ts ./test/private-local-sandbox-service.bun.test.ts ./test/private-local-native-service.bun.test.ts",
158
+ "build:native": "fungi-apply-patch-build --out native/bin && node scripts/build-bwrap.mjs --out native/bin && node scripts/generate-native-digests.mjs",
153
159
  "test:patch": "node --test --test-timeout=30000 test/apply-patch.native.mjs",
154
160
  "test:sandbox:linux": "node --import tsx test/fixtures/local-sandbox-proof.mts",
155
- "test:sandbox:macos": "scratch=$(mktemp -d /tmp/fungi-seatbelt.XXXXXX) && scratch=$(cd \"$scratch\" && pwd -P) && mkdir \"$scratch/home\" && HOME=\"$scratch/home\" node --import tsx scripts/seatbelt-mac-proof.mjs \"$scratch\"",
161
+ "test:sandbox:macos": "scratch=$(mktemp -d /tmp/fungi-seatbelt.XXXXXX) && trap 'rm -rf \"$scratch\"' EXIT && scratch=$(cd \"$scratch\" && pwd -P) && mkdir -m 700 \"$scratch/home\" \"$scratch/runtime\" && HOME=\"$scratch/home\" XDG_CONFIG_HOME=\"$scratch/home/.config\" XDG_CACHE_HOME=\"$scratch/home/.cache\" XDG_DATA_HOME=\"$scratch/home/.local/share\" XDG_RUNTIME_DIR=\"$scratch/runtime\" node --import tsx scripts/seatbelt-mac-proof.mjs \"$scratch\"",
156
162
  "format:check": "node ../../tooling/repository/scripts/format-package-check.mjs",
157
163
  "lint:anti-slop": "node ../../tooling/repository/scripts/lint-package-anti-slop.mjs",
158
164
  "test:unit": "node ../../tooling/repository/scripts/test-file-pool.mjs pnpm run test:node && pnpm run test:mesh-link && pnpm run test:bun:batch && pnpm run test:stop-all",