@jigging/jig 0.1.0-alpha.11 → 0.1.0-alpha.13

package/libexec/linux-rootless-supervisor.js

@@ -2,7 +2,7 @@
 // src/internal/linux-rootless-supervisor.ts
 import { spawn } from "child_process";
 import { randomBytes } from "crypto";
-import { closeSync, readFileSync, statSync, writeSync } from "fs";
+import { closeSync, readFileSync, readSync, statSync, writeSync } from "fs";
 import {
   link,
   mkdir,
@@ -56,12 +56,17 @@ async function superviseConnected(control, startupDeadlineUnixMs) {
   let childExit;
   let stopReason;
   let admitted = false;
+  let continued = false;
+  let outputDirectory;
   let resolveAdmission;
   let rejectAdmission;
   const admission = new Promise((resolve, reject) => {
     resolveAdmission = resolve;
     rejectAdmission = reject;
   });
+  admission.catch(() => {
+    return;
+  });
   const killRun = async () => {
     if (!cgroupCreated)
       return;
@@ -85,6 +90,12 @@ async function superviseConnected(control, startupDeadlineUnixMs) {
       if (type === "admit" && !admitted) {
         admitted = true;
         resolveAdmission();
+      } else if (type === "continue" && configuration.output && outputDirectory !== undefined && !continued) {
+        continued = true;
+        const gate = child?.stdio[4];
+        if (gate === undefined)
+          return stop("setup_failed");
+        gate.end(Buffer.from([1]));
       } else if (type === "cancel") {
         stop("cancelled");
       } else {
@@ -113,7 +124,11 @@ async function superviseConnected(control, startupDeadlineUnixMs) {
 `);
     if (stopReason !== undefined)
       throw new Error(`rootless launch stopped during setup: ${stopReason}`);
-    safeSend(control, { type: "prepared", runCgroup, supervisorPid: process.pid });
+    safeSend(control, {
+      type: "prepared",
+      runCgroup,
+      supervisorPid: process.pid
+    });
     await admission;
     if (stopReason !== undefined)
       throw new Error(`rootless launch stopped before spawn: ${stopReason}`);
@@ -132,16 +147,30 @@ async function superviseConnected(control, startupDeadlineUnixMs) {
       env: {
         LD_LIBRARY_PATH: configuration.bunHostLibraryPath
       },
-      stdio: ["inherit", "inherit", "inherit", "pipe"]
+      stdio: [
+        "inherit",
+        "inherit",
+        "inherit",
+        "pipe",
+        configuration.output ? "pipe" : "ignore",
+        configuration.output ? "pipe" : "ignore",
+        ...configuration.capturedInputs.map((file) => file.fd)
+      ]
     });
     childExit = childClose(launched);
     child = launched;
     const ready = await readReady(launched);
+    if (configuration.output) {
+      const sandboxPid = await readSandboxPid(launched);
+      await outputReady(launched);
+      outputDirectory = await open(`/proc/${sandboxPid}/root/jig-output`, 65536);
+    }
     safeSend(control, {
       type: "ready",
       runCgroup,
       payloadPid: ready,
-      supervisorPid: process.pid
+      supervisorPid: process.pid,
+      ...outputDirectory === undefined ? {} : { outputFd: outputDirectory.fd }
     });
     const exit = await childExit;
     exitCode = exit.code;
@@ -154,6 +183,7 @@ async function superviseConnected(control, startupDeadlineUnixMs) {
 `);
   } finally {
     clearTimeout(deadline);
+    await outputDirectory?.close();
     let cleanupError;
     try {
       child?.kill("SIGKILL");
@@ -216,13 +246,35 @@ async function enterMain(arguments_) {
   writeSync(3, `${process.pid}
 `);
   closeSync(3);
-  const child = spawn(bubblewrap, bubblewrapArguments_, { cwd: "/", env: {}, stdio: "inherit" });
+  const output = bubblewrapArguments_.includes("--sync-fd");
+  const inputDescriptors = bubblewrapArguments_.flatMap((arg, index) => arg === "--ro-bind-data" ? [Number(bubblewrapArguments_[index + 1])] : []);
+  if (inputDescriptors.some((fd, index) => fd !== 6 + index))
+    throw new Error("invalid captured input descriptor order");
+  const child = spawn(bubblewrap, bubblewrapArguments_, {
+    cwd: "/",
+    env: {},
+    stdio: [
+      "inherit",
+      "inherit",
+      "inherit",
+      "ignore",
+      output ? 4 : "ignore",
+      output ? 5 : "ignore",
+      ...inputDescriptors
+    ]
+  });
+  for (const fd of inputDescriptors)
+    closeSync(fd);
+  if (output) {
+    closeSync(4);
+    closeSync(5);
+  }
   const exit = await childClose(child);
   if (exit.signal !== null)
     process.kill(process.pid, exit.signal);
   process.exitCode = exit.code ?? 1;
 }
-async function innerMain(command) {
+async function innerMain(command, output = false) {
   if (command.length === 0 || !absolute(command[0]))
     throw new Error("invalid rootless inner command");
   const nullDevice = statSync("/dev/null");
@@ -230,7 +282,19 @@ async function innerMain(command) {
   if (!nullDevice.isCharacterDevice() || !entropyDevice.isCharacterDevice() || (nullDevice.mode & 511) !== 438 || (entropyDevice.mode & 511) !== 438) {
     throw new Error("rootless private devices do not satisfy the required projection");
   }
-  const child = spawn(command[0], command.slice(1), { cwd: "/work", env: process.env, stdio: "inherit" });
+  if (output) {
+    writeSync(4, Buffer.from([1]));
+    const gate = Buffer.alloc(1);
+    if (readSync(4, gate, 0, 1, null) !== 1 || gate[0] !== 1) {
+      throw new Error("output ownership was not acquired");
+    }
+    closeSync(4);
+  }
+  const child = spawn(command[0], command.slice(1), {
+    cwd: "/work",
+    env: process.env,
+    stdio: "inherit"
+  });
   const exit = await childClose(child);
   if (exit.signal !== null)
     process.kill(process.pid, exit.signal);
@@ -272,11 +336,21 @@ function bubblewrapArguments(configuration) {
   ];
   for (const mount of configuration.readOnlyMounts)
     result.push("--ro-bind", mount.source, mount.destination);
+  if (configuration.inputDirectories.length > 0)
+    result.push("--size", "1048576", "--tmpfs", "/jig-input");
+  for (const path of configuration.inputDirectories)
+    result.push("--dir", path);
+  for (const file of configuration.capturedInputs)
+    result.push("--ro-bind-data", String(file.fd), file.destination);
+  if (configuration.inputDirectories.length > 0)
+    result.push("--remount-ro", "/jig-input");
+  if (configuration.output)
+    result.push("--size", String(16 * 1024 * 1024), "--tmpfs", "/jig-output", "--sync-fd", "4", "--json-status-fd", "5");
   result.push("--ro-bind", configuration.supervisorPath, MODULE_DESTINATION);
   for (const [name, value] of Object.entries(configuration.environment).sort(([a], [b]) => a.localeCompare(b))) {
     result.push("--setenv", name, value);
   }
-  result.push("--setenv", "LD_LIBRARY_PATH", SANDBOX_LIBRARY_PATH, "--uid", String(configuration.payloadUid), "--gid", String(configuration.payloadGid), "--cap-drop", "ALL", "--", SANDBOX_BUN, ...POLICY, MODULE_DESTINATION, "--inner", "--", ...configuration.command);
+  result.push("--setenv", "LD_LIBRARY_PATH", SANDBOX_LIBRARY_PATH, "--uid", String(configuration.payloadUid), "--gid", String(configuration.payloadGid), "--cap-drop", "ALL", "--", SANDBOX_BUN, ...POLICY, MODULE_DESTINATION, configuration.output ? "--inner-output" : "--inner", "--", ...configuration.command);
   return result;
 }
 async function claimActive(configuration) {
@@ -361,12 +435,15 @@ function requireStart(value) {
     "bunHostLibraryPath",
     "bunPath",
     "command",
+    "capturedInputs",
     "delegatedCgroup",
     "environment",
     "limits",
+    "inputDirectories",
     "mechanismDigest",
     "nestedUserNamespaces",
     "network",
+    "output",
     "ownerDigest",
     "ownerStateAllocationDigest",
     "ownerStateDirectory",
@@ -378,7 +455,7 @@ function requireStart(value) {
     "sealedPlanDigest",
     "supervisorPath"
   ];
-  if (configuration === null || typeof configuration !== "object" || Array.isArray(configuration) || Object.keys(configuration).sort().join("\x00") !== keys.sort().join("\x00") || !absolute(configuration.delegatedCgroup) || !absolute(configuration.bunHostLibraryPath) || !absolute(configuration.runCgroup) || posix.dirname(configuration.runCgroup) !== configuration.delegatedCgroup || !/^jig-run-[a-z0-9][a-z0-9-]{0,47}-[0-9a-f]{24}$/.test(posix.basename(configuration.runCgroup)) || !configuration.runCgroup.startsWith("/sys/fs/cgroup/") || !absolute(configuration.ownerStateDirectory) || !absolute(configuration.bunPath) || !absolute(configuration.bubblewrapPath) || !absolute(configuration.supervisorPath) || typeof configuration.mechanismDigest !== "string" || !DIGEST.test(configuration.mechanismDigest) || typeof configuration.ownerDigest !== "string" || !DIGEST.test(configuration.ownerDigest) || typeof configuration.sealedPlanDigest !== "string" || !DIGEST.test(configuration.sealedPlanDigest) || typeof configuration.ownerStateAllocationDigest !== "string" || !DIGEST.test(configuration.ownerStateAllocationDigest) || typeof configuration.ownerToken !== "string" || !OWNER_TOKEN.test(configuration.ownerToken) || configuration.network !== "isolated" && configuration.network !== "inherited" || typeof configuration.nestedUserNamespaces !== "boolean" || !positiveInteger(configuration.payloadUid) || !positiveInteger(configuration.payloadGid) || !validLimits(configuration.limits) || !validMounts(configuration.readOnlyMounts) || !validEnvironment(configuration.environment) || !Array.isArray(configuration.command) || configuration.command.length === 0 || !absolute(configuration.command[0]) || configuration.command.some((part) => typeof part !== "string" || part.includes("\x00"))) {
+  if (configuration === null || typeof configuration !== "object" || Array.isArray(configuration) || Object.keys(configuration).sort().join("\x00") !== keys.sort().join("\x00") || !absolute(configuration.delegatedCgroup) || !absolute(configuration.bunHostLibraryPath) || !absolute(configuration.runCgroup) || posix.dirname(configuration.runCgroup) !== configuration.delegatedCgroup || !/^jig-run-[a-z0-9][a-z0-9-]{0,47}-[0-9a-f]{24}$/.test(posix.basename(configuration.runCgroup)) || !configuration.runCgroup.startsWith("/sys/fs/cgroup/") || !absolute(configuration.ownerStateDirectory) || !absolute(configuration.bunPath) || !absolute(configuration.bubblewrapPath) || !absolute(configuration.supervisorPath) || typeof configuration.mechanismDigest !== "string" || !DIGEST.test(configuration.mechanismDigest) || typeof configuration.ownerDigest !== "string" || !DIGEST.test(configuration.ownerDigest) || typeof configuration.sealedPlanDigest !== "string" || !DIGEST.test(configuration.sealedPlanDigest) || typeof configuration.ownerStateAllocationDigest !== "string" || !DIGEST.test(configuration.ownerStateAllocationDigest) || typeof configuration.ownerToken !== "string" || !OWNER_TOKEN.test(configuration.ownerToken) || configuration.network !== "isolated" && configuration.network !== "inherited" || typeof configuration.nestedUserNamespaces !== "boolean" || typeof configuration.output !== "boolean" || !Array.isArray(configuration.capturedInputs) || configuration.capturedInputs.length > 64 || !Array.isArray(configuration.inputDirectories) || configuration.inputDirectories.length > 8 || configuration.inputDirectories.some((path) => typeof path !== "string" || path.length > 75 || !/^\/jig-input\/[a-z0-9]+(?:-[a-z0-9]+)*$/.test(path)) || configuration.capturedInputs.some((file, index) => file === null || typeof file !== "object" || file.fd !== 6 + index || !absolute(file.destination) || !configuration.inputDirectories.some((path) => file.destination.startsWith(`${path}/`))) || !positiveInteger(configuration.payloadUid) || !positiveInteger(configuration.payloadGid) || !validLimits(configuration.limits) || !validMounts(configuration.readOnlyMounts) || !validEnvironment(configuration.environment) || !Array.isArray(configuration.command) || configuration.command.length === 0 || !absolute(configuration.command[0]) || configuration.command.some((part) => typeof part !== "string" || part.includes("\x00"))) {
     throw new Error("invalid rootless supervisor configuration");
   }
   return configuration;
@@ -461,6 +538,39 @@ async function readReady(child) {
     throw new Error("invalid rootless entry readiness receipt");
   return pid;
 }
+async function readSandboxPid(child) {
+  const stream = child.stdio[5];
+  if (stream === undefined)
+    throw new Error("missing Bubblewrap status pipe");
+  let text = "";
+  for await (const chunk of stream.iterator({ destroyOnReturn: false })) {
+    text += String(chunk);
+    if (text.length > 4096)
+      throw new Error("oversized Bubblewrap status");
+    const end = text.indexOf("}");
+    if (end < 0)
+      continue;
+    const record = JSON.parse(text.slice(0, end + 1));
+    if (!positiveInteger(record["child-pid"]))
+      throw new Error("invalid Bubblewrap child identity");
+    stream.resume();
+    return record["child-pid"];
+  }
+  throw new Error("Bubblewrap exited before output handoff");
+}
+function outputReady(child) {
+  const stream = child.stdio[4];
+  return new Promise((resolve, reject) => {
+    stream.once("error", reject);
+    stream.once("end", () => reject(new Error("output launcher ended before handoff")));
+    stream.once("data", (bytes) => {
+      if (bytes.length !== 1 || bytes[0] !== 1)
+        reject(new Error("invalid output readiness"));
+      else
+        resolve();
+    });
+  });
+}
 async function waitUntilEmpty(cgroup, timeoutMs) {
   const deadline = Date.now() + timeoutMs;
   while (Date.now() <= deadline) {
@@ -505,7 +615,11 @@ async function readCounters(path) {
   return result;
 }
 function emptyEvidence() {
-  return Object.freeze({ cpuStat: Object.freeze({}), memoryEvents: Object.freeze({}), pidsEvents: Object.freeze({}) });
+  return Object.freeze({
+    cpuStat: Object.freeze({}),
+    memoryEvents: Object.freeze({}),
+    pidsEvents: Object.freeze({})
+  });
 }
 async function exists(path) {
   try {
@@ -606,10 +720,10 @@ async function main() {
   }
   if (mode === "--enter")
     return await enterMain(arguments_);
-  if (mode === "--inner") {
+  if (mode === "--inner" || mode === "--inner-output") {
     if (arguments_[0] !== "--")
       throw new Error("invalid rootless inner separator");
-    return await innerMain(arguments_.slice(1));
+    return await innerMain(arguments_.slice(1), mode === "--inner-output");
   }
   throw new Error("invalid rootless supervisor mode");
 }

package/libexec/preparation/bun-native-preparation-worker.js

@@ -1,15 +1,7 @@
 // @bun
 // src/internal/bun-native-preparation-worker.ts
 import { spawn } from "child_process";
-import {
-  copyFile,
-  lstat,
-  mkdir,
-  opendir,
-  readFile,
-  rm,
-  writeFile
-} from "fs/promises";
+import { copyFile, lstat, mkdir, opendir, readFile, rm, writeFile } from "fs/promises";
 import { dirname, join } from "path";
 
 // src/internal/bun-native-lock-policy.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jigging/jig",
-  "version": "0.1.0-alpha.11",
+  "version": "0.1.0-alpha.13",
   "description": "A local, secure host for admitted FLOW packages",
   "license": "MPL-2.0",
   "repository": {
@@ -66,16 +66,6 @@
     "LICENSE",
     "THIRD_PARTY_NOTICES"
   ],
-  "scripts": {
-    "verify:build-bun": "bun -e \"if (Bun.version !== '1.3.3' || Bun.revision !== '274e01c737e85f8142070a9745b43a2ba09fce4c') throw new Error('Jig must be built with exact Bun 1.3.3 revision 274e01c737e85f8142070a9745b43a2ba09fce4c')\"",
-    "build": "bun run verify:build-bun && bun run clean && mkdir -p bin libexec/agent libexec/evaluator libexec/preparation && cp scripts/installed-jig.sh bin/jig && chmod 755 bin/jig && bun node_modules/typescript/bin/tsc -p tsconfig.json && bun build src/index.ts --target=bun --format=esm --outfile=dist/index.js && bun build src/installed-cli.ts --target=bun --format=esm --outfile=libexec/installed-cli.js && bun build src/internal/linux-rootless-supervisor.ts --target=bun --format=esm --outfile=libexec/linux-rootless-supervisor.js && bun build src/internal/project-evaluator-worker.ts --target=bun --format=esm --outfile=libexec/evaluator/project-evaluator-worker.js && bun build src/internal/openai-agent-worker.ts --target=bun --format=esm --outfile=libexec/agent/openai-agent-worker.js && bun build src/internal/codex-agent-launcher.ts --target=bun --format=esm --outfile=libexec/agent/codex-agent-launcher.js && cp node_modules/@agentclientprotocol/codex-acp/dist/index.js libexec/agent/codex-acp.js && cp node_modules/@agentclientprotocol/codex-acp/LICENSE libexec/agent/codex-acp.LICENSE && cp support/codex-requirements.toml libexec/agent/codex-requirements.toml && bun build src/internal/claude-agent-launcher.ts --target=bun --format=esm --outfile=libexec/agent/claude-agent-launcher.js && bun build node_modules/@agentclientprotocol/claude-agent-acp/dist/index.js --target=bun --format=esm --outfile=libexec/agent/claude-agent-acp.js && cp node_modules/@agentclientprotocol/claude-agent-acp/LICENSE libexec/agent/claude-agent-acp.LICENSE && cp node_modules/@anthropic-ai/claude-agent-sdk/LICENSE.md libexec/agent/claude-agent-sdk.LICENSE && bun build src/internal/pi-agent-launcher.ts --target=bun --format=esm --outfile=libexec/agent/pi-agent-launcher.js && bun build node_modules/pi-acp/dist/index.js --target=bun --format=esm --outfile=libexec/agent/pi-acp.js && cp node_modules/pi-acp/LICENSE libexec/agent/pi-acp.LICENSE && bun build src/internal/bun-native-preparation-worker.ts --target=bun --format=esm --outfile=libexec/preparation/bun-native-preparation-worker.js && bun build src/project/evaluator-sdk-entry.ts --target=bun --format=esm --outfile=libexec/evaluator/project-evaluator-sdk.bundle.js && cp ../../docs/jig/spec/machine/project-authoring-1.schema.json libexec/evaluator/project-authoring-1.schema.json && cp node_modules/openai/LICENSE libexec/agent/openai.LICENSE",
-    "clean": "bun -e \"import { rm } from 'node:fs/promises'; for (const path of ['dist', 'bin', 'libexec']) await rm(path, { recursive: true, force: true })\"",
-    "prepack": "bun run build",
-    "test": "bun test",
-    "test:package": "bun run build && bun test/package-smoke.ts",
-    "test:linux-rootless:proof-host": "bun run build && JIG_LINUX_ROOTLESS_HOSTILE=1 bun test test/linux-rootless-delegation-hostile.test.ts --timeout 30000 && JIG_LINUX_ROOTLESS_HOSTILE=1 bun test test/linux-rootless-run.test.ts --timeout 30000 && JIG_LINUX_ROOTLESS_HOSTILE=1 bun test test/bun-native-preparation.test.ts --timeout 120000 && JIG_LINUX_ROOTLESS_HOSTILE=1 bun test test/private-foreground.test.ts --timeout 30000 && JIG_LINUX_ROOTLESS_HOSTILE=1 bun test test/root-agent-run-lifecycle.test.ts --timeout 180000",
-    "check": "bun run build && bun test"
-  },
   "dependencies": {
     "@oven/bun-linux-x64-baseline": "1.3.3"
   },
@@ -83,6 +73,7 @@
     "@agentclientprotocol/claude-agent-acp": "0.73.0",
     "@agentclientprotocol/codex-acp": "1.8.0",
     "@agentclientprotocol/sdk": "1.4.0",
+    "@anthropic-ai/claude-agent-sdk": "0.3.257",
     "@types/node": "24.13.3",
     "openai": "7.9.0",
     "pi-acp": "0.0.33",
@@ -90,4 +81,4 @@
     "yaml": "2.9.0",
     "zod": "4.3.6"
   }
-}
+}