@fungi.computer/truffle 0.2.2 → 0.3.1

package/native/bin/bwrap-build-source/vendor/seccomp-unix-block.c

@@ -157,7 +157,8 @@ int main(int argc, char *argv[]) {
     const char *output_file = argv[1];
     const char *arch_name = (argc >= 3) ? argv[2] : NULL;
     const char *rule_set = (argc == 4) ? argv[3] : "unix";
-    if (strcmp(rule_set, "unix") != 0 && strcmp(rule_set, "namespaces") != 0) {
+    if (strcmp(rule_set, "unix") != 0 && strcmp(rule_set, "workspace") != 0 &&
+        strcmp(rule_set, "namespaces") != 0) {
         fprintf(stderr, "Error: Unknown rule set '%s'\n", rule_set);
         return 1;
     }
@@ -209,12 +210,14 @@ int main(int argc, char *argv[]) {
      * int, so the kernel ignores the upper 32 bits of the register. A plain
      * SCMP_CMP_EQ would compare all 64 bits and miss calls where the upper bits
      * are set. */
-    rc = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(socket), 1,
-                          SCMP_A0(SCMP_CMP_MASKED_EQ, 0xffffffff, AF_UNIX));
-    if (rc < 0) {
-        fprintf(stderr, "Error: Failed to add seccomp rule: %s\n", strerror(-rc));
-        seccomp_release(ctx);
-        return 1;
+    if (strcmp(rule_set, "unix") == 0) {
+        rc = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(socket), 1,
+                              SCMP_A0(SCMP_CMP_MASKED_EQ, 0xffffffff, AF_UNIX));
+        if (rc < 0) {
+            fprintf(stderr, "Error: Failed to add seccomp rule: %s\n", strerror(-rc));
+            seccomp_release(ctx);
+            return 1;
+        }
     }
 
     /* Add rule to block socket(AF_VSOCK, ...) */

package/native/bin/bwrap-build.json

@@ -13,10 +13,11 @@
       "repository": "https://github.com/anthropic-experimental/sandbox-runtime",
       "revision": "38d1aee29c72035f1dba1337ac89b03a2f655d26",
       "source": "vendor/seccomp-src/seccomp-unix-block.c",
-      "sourceSha256": "9dcde4aedc076fb44efc5cc8d843c7ba898f2a056b71931812d55ef99f1ed6b1",
+      "sourceSha256": "1599d24097d5e0bac5a22c6d38de98cae990eb18ee28d6be5faccf6db80dcf24",
       "licenseSha256": "1210bc93eb85dd786c33192d5bcb7153a93922fa99fbc1512af6a7199cb41080"
     },
-    "sha256": "38112f9cf994bed2ed962fae63e803c41874732ab032088b2c1ea3d713e51c11"
+    "readOnlySha256": "38112f9cf994bed2ed962fae63e803c41874732ab032088b2c1ea3d713e51c11",
+    "workspaceSha256": "e46f1045f85fcf14f91fae8654bba6a0c87f57e3b92f60bfc16008dbf7dc87c8"
   },
   "packages": [
     {

package/native/bin/fungi-seccomp-workspace.bpf.sha256

@@ -0,0 +1 @@
+e46f1045f85fcf14f91fae8654bba6a0c87f57e3b92f60bfc16008dbf7dc87c8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fungi.computer/truffle",
-  "version": "0.2.2",
+  "version": "0.3.1",
   "private": false,
   "description": "Truffle: Fungi's local Agent runtime, bundled into the fungi command",
   "type": "module",
@@ -49,6 +49,10 @@
     "./extensions": {
       "types": "./dist/local-extensions.d.ts",
       "import": "./dist/local-extensions.js"
+    },
+    "./rules": {
+      "types": "./dist/private-local-exec-rules.d.ts",
+      "import": "./dist/private-local-exec-rules.js"
     }
   },
   "files": [
@@ -61,27 +65,29 @@
     "@cf-wasm/photon": "0.4.0",
     "@earendil-works/pi-ai": "1.3.0",
     "@effect/platform-node": "4.0.2",
-    "@fungi.computer/agar": "0.3.0",
-    "@fungi.computer/approvals": "0.0.2",
-    "@fungi.computer/bird-dog": "0.1.0",
+    "@fungi.computer/agar": "0.3.1",
+    "@fungi.computer/approvals": "0.1.0",
+    "@fungi.computer/bird-dog": "0.2.0",
     "@fungi.computer/cairn": "0.1.0",
     "@fungi.computer/capnweb": "0.12.0",
-    "@fungi.computer/carrier": "0.1.0",
-    "@fungi.computer/cordyceps": "0.3.1",
+    "@fungi.computer/carrier": "0.2.0",
+    "@fungi.computer/cordyceps": "0.4.0",
     "@fungi.computer/gills": "0.2.0",
-    "@fungi.computer/graft": "0.1.1",
-    "@fungi.computer/knapsack": "0.2.1",
+    "@fungi.computer/graft": "0.1.2",
+    "@fungi.computer/knapsack": "0.3.0",
     "@fungi.computer/lantern": "0.3.0",
-    "@fungi.computer/mycelium": "0.2.1",
-    "@fungi.computer/nacre": "0.0.1",
-    "@fungi.computer/seam": "0.1.0",
-    "@fungi.computer/shiitake": "0.3.1",
-    "@fungi.computer/shiitake-extensions": "0.1.1",
+    "@fungi.computer/mycelium": "0.2.2",
+    "@fungi.computer/nacre": "0.0.2",
+    "@fungi.computer/seam": "0.2.0",
+    "@fungi.computer/shiitake": "0.4.0",
+    "@fungi.computer/shiitake-extensions": "0.2.0",
     "@fungi.computer/veil": "0.2.0",
     "@fungi.computer/watchdog": "0.1.0",
     "@fungi.computer/whistle": "0.1.0",
-    "@fungi.computer/zookeeper": "0.0.2",
+    "@fungi.computer/zookeeper": "0.0.3",
+    "@jellybrick/dbus-next": "0.11.4",
     "@modelcontextprotocol/client": "2.0.0",
+    "@napi-rs/keyring": "2.1.2",
     "diff": "8.0.4",
     "effect": "4.0.2",
     "eventsource": "5.1.1",
@@ -97,7 +103,7 @@
   },
   "devDependencies": {
     "@cloudflare/codemode": "0.5.1",
-    "@fungi.computer/mule": "0.1.1",
+    "@fungi.computer/mule": "0.2.0",
     "@modelcontextprotocol/server": "2.0.0",
     "@types/node": "24.13.3",
     "@types/proper-lockfile": "4.1.4",
@@ -148,11 +154,11 @@
     "test:node": "../../node_modules/.bin/vitest run",
     "test:bun": "pnpm run test:mesh-link && pnpm run test:bun:batch && bun test ./test/private-workerd-deadline.bun.test.ts",
     "test:mesh-link": "bun test ./test/private-local-mesh-links.bun.test.ts",
-    "test:bun:batch": "bun test ./test/private-sqlite-approval-driver.bun.test.ts ./test/mcp-form-service.bun.test.ts ./test/private-local-service-discovery.bun.test.ts ./test/private-local-service-listener.bun.test.ts ./test/private-local-service-manager.bun.test.ts ./test/private-local-service-rebind.bun.test.ts ./test/private-local-service-stop.bun.test.ts ./test/private-local-service-ensure.bun.test.ts ./test/private-local-service-identity.bun.test.ts ./test/private-local-service-kill-resume.bun.test.ts ./test/private-local-service-idle-owners.bun.test.ts ./test/private-local-service-idle-delegation.bun.test.ts ./test/private-local-mail-retry.bun.test.ts ./test/private-local-service-log-native.bun.test.ts ./test/private-local-service-log.bun.test.ts ./test/private-local-sqlite-lifetime.bun.test.ts ./test/private-sqlite-driver.bun.test.ts ./test/private-local-reload.bun.test.ts ./test/private-local-auth-rpc.bun.test.ts ./test/private-workerd-forage.bun.test.ts ./test/local-extensions.bun.test.ts ./test/local-zookeeper-slot.bun.test.ts ./test/local-extension-skills.bun.test.ts ./test/private-local-sandbox-service.bun.test.ts",
+    "test:bun:batch": "bun test ./test/private-sqlite-approval-driver.bun.test.ts ./test/mcp-form-service.bun.test.ts ./test/private-local-service-discovery.bun.test.ts ./test/private-local-service-listener.bun.test.ts ./test/private-local-service-manager.bun.test.ts ./test/private-local-service-rebind.bun.test.ts ./test/private-local-service-stop.bun.test.ts ./test/private-local-service-ensure.bun.test.ts ./test/private-local-service-identity.bun.test.ts ./test/private-local-service-kill-resume.bun.test.ts ./test/private-local-service-idle-owners.bun.test.ts ./test/private-local-service-idle-delegation.bun.test.ts ./test/private-local-mail-retry.bun.test.ts ./test/private-local-service-log-native.bun.test.ts ./test/private-local-service-log.bun.test.ts ./test/private-local-sqlite-lifetime.bun.test.ts ./test/private-sqlite-driver.bun.test.ts ./test/private-local-reload.bun.test.ts ./test/private-local-auth-rpc.bun.test.ts ./test/private-workerd-forage.bun.test.ts ./test/local-extensions.bun.test.ts ./test/local-zookeeper-slot.bun.test.ts ./test/local-extension-skills.bun.test.ts ./test/private-local-sandbox-service.bun.test.ts ./test/private-local-native-service.bun.test.ts",
     "build:native": "fungi-apply-patch-build --out native/bin && node scripts/build-bwrap.mjs --out native/bin && node scripts/generate-native-digests.mjs",
     "test:patch": "node --test --test-timeout=30000 test/apply-patch.native.mjs",
     "test:sandbox:linux": "node --import tsx test/fixtures/local-sandbox-proof.mts",
-    "test:sandbox:macos": "scratch=$(mktemp -d /tmp/fungi-seatbelt.XXXXXX) && scratch=$(cd \"$scratch\" && pwd -P) && mkdir \"$scratch/home\" && HOME=\"$scratch/home\" node --import tsx scripts/seatbelt-mac-proof.mjs \"$scratch\"",
+    "test:sandbox:macos": "scratch=$(mktemp -d /tmp/fungi-seatbelt.XXXXXX) && trap 'rm -rf \"$scratch\"' EXIT && scratch=$(cd \"$scratch\" && pwd -P) && mkdir -m 700 \"$scratch/home\" \"$scratch/runtime\" && HOME=\"$scratch/home\" XDG_CONFIG_HOME=\"$scratch/home/.config\" XDG_CACHE_HOME=\"$scratch/home/.cache\" XDG_DATA_HOME=\"$scratch/home/.local/share\" XDG_RUNTIME_DIR=\"$scratch/runtime\" node --import tsx scripts/seatbelt-mac-proof.mjs \"$scratch\"",
     "format:check": "node ../../tooling/repository/scripts/format-package-check.mjs",
     "lint:anti-slop": "node ../../tooling/repository/scripts/lint-package-anti-slop.mjs",
     "test:unit": "node ../../tooling/repository/scripts/test-file-pool.mjs pnpm run test:node && pnpm run test:mesh-link && pnpm run test:bun:batch && pnpm run test:stop-all",