@kingsoftcloud/agentkit-harness-node 0.0.0-stage → 0.0.2

package/src/native/local-process-licenses/NOTICE

@@ -0,0 +1,21 @@
+The Node local-process adapter uses a small executable built from the adjacent
+local-process-launcher.c (the repository's Apache-2.0 license). It performs only
+POSIX resource-limit, fork/watchdog and exec operations; it is not a language
+interpreter or an execution policy.
+
+Darwin executables dynamically use the operating system's libSystem; no Apple
+runtime library is bundled. Linux executables are built with Alpine GCC 14.2.0
+and statically link musl 1.2.5. The Linux owner watchdog enforces
+maxProcesses per process group because RLIMIT_NPROC is scoped to the whole real
+user on shared hosts. The included musl COPYRIGHT is from the upstream 1.2.5
+source release. GCC runtime terms are included for compiler runtime parts:
+COPYING3 plus the GCC Runtime Library Exception (COPYING.RUNTIME).
+
+Upstream license sources:
+https://musl.libc.org/releases/musl-1.2.5.tar.gz (COPYRIGHT)
+https://github.com/gcc-mirror/gcc/blob/releases/gcc-14.2.0/COPYING3
+https://github.com/gcc-mirror/gcc/blob/releases/gcc-14.2.0/COPYING.RUNTIME
+
+Compiler identification, base-image digest and each executable's SHA-256 are
+recorded in local-process-manifest.json. Rebuilds are a maintainer operation;
+installation and execution never invoke a compiler, package manager or Python.

package/src/native/local-process-licenses/musl-COPYRIGHT

@@ -0,0 +1,193 @@
+musl as a whole is licensed under the following standard MIT license:
+
+----------------------------------------------------------------------
+Copyright © 2005-2020 Rich Felker, et al.
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+----------------------------------------------------------------------
+
+Authors/contributors include:
+
+A. Wilcox
+Ada Worcester
+Alex Dowad
+Alex Suykov
+Alexander Monakov
+Andre McCurdy
+Andrew Kelley
+Anthony G. Basile
+Aric Belsito
+Arvid Picciani
+Bartosz Brachaczek
+Benjamin Peterson
+Bobby Bingham
+Boris Brezillon
+Brent Cook
+Chris Spiegel
+Clément Vasseur
+Daniel Micay
+Daniel Sabogal
+Daurnimator
+David Carlier
+David Edelsohn
+Denys Vlasenko
+Dmitry Ivanov
+Dmitry V. Levin
+Drew DeVault
+Emil Renner Berthing
+Fangrui Song
+Felix Fietkau
+Felix Janda
+Gianluca Anzolin
+Hauke Mehrtens
+He X
+Hiltjo Posthuma
+Isaac Dunham
+Jaydeep Patil
+Jens Gustedt
+Jeremy Huntwork
+Jo-Philipp Wich
+Joakim Sindholt
+John Spencer
+Julien Ramseier
+Justin Cormack
+Kaarle Ritvanen
+Khem Raj
+Kylie McClain
+Leah Neukirchen
+Luca Barbato
+Luka Perkov
+M Farkas-Dyck (Strake)
+Mahesh Bodapati
+Markus Wichmann
+Masanori Ogino
+Michael Clark
+Michael Forney
+Mikhail Kremnyov
+Natanael Copa
+Nicholas J. Kain
+orc
+Pascal Cuoq
+Patrick Oppenlander
+Petr Hosek
+Petr Skocik
+Pierre Carrier
+Reini Urban
+Rich Felker
+Richard Pennington
+Ryan Fairfax
+Samuel Holland
+Segev Finer
+Shiz
+sin
+Solar Designer
+Stefan Kristiansson
+Stefan O'Rear
+Szabolcs Nagy
+Timo Teräs
+Trutz Behn
+Valentin Ochs
+Will Dietz
+William Haddon
+William Pitcock
+
+Portions of this software are derived from third-party works licensed
+under terms compatible with the above MIT license:
+
+The TRE regular expression implementation (src/regex/reg* and
+src/regex/tre*) is Copyright © 2001-2008 Ville Laurikari and licensed
+under a 2-clause BSD license (license text in the source files). The
+included version has been heavily modified by Rich Felker in 2012, in
+the interests of size, simplicity, and namespace cleanliness.
+
+Much of the math library code (src/math/* and src/complex/*) is
+Copyright © 1993,2004 Sun Microsystems or
+Copyright © 2003-2011 David Schultz or
+Copyright © 2003-2009 Steven G. Kargl or
+Copyright © 2003-2009 Bruce D. Evans or
+Copyright © 2008 Stephen L. Moshier or
+Copyright © 2017-2018 Arm Limited
+and labelled as such in comments in the individual source files. All
+have been licensed under extremely permissive terms.
+
+The ARM memcpy code (src/string/arm/memcpy.S) is Copyright © 2008
+The Android Open Source Project and is licensed under a two-clause BSD
+license. It was taken from Bionic libc, used on Android.
+
+The AArch64 memcpy and memset code (src/string/aarch64/*) are
+Copyright © 1999-2019, Arm Limited.
+
+The implementation of DES for crypt (src/crypt/crypt_des.c) is
+Copyright © 1994 David Burren. It is licensed under a BSD license.
+
+The implementation of blowfish crypt (src/crypt/crypt_blowfish.c) was
+originally written by Solar Designer and placed into the public
+domain. The code also comes with a fallback permissive license for use
+in jurisdictions that may not recognize the public domain.
+
+The smoothsort implementation (src/stdlib/qsort.c) is Copyright © 2011
+Valentin Ochs and is licensed under an MIT-style license.
+
+The x86_64 port was written by Nicholas J. Kain and is licensed under
+the standard MIT terms.
+
+The mips and microblaze ports were originally written by Richard
+Pennington for use in the ellcc project. The original code was adapted
+by Rich Felker for build system and code conventions during upstream
+integration. It is licensed under the standard MIT terms.
+
+The mips64 port was contributed by Imagination Technologies and is
+licensed under the standard MIT terms.
+
+The powerpc port was also originally written by Richard Pennington,
+and later supplemented and integrated by John Spencer. It is licensed
+under the standard MIT terms.
+
+All other files which have no copyright comments are original works
+produced specifically for use as part of this library, written either
+by Rich Felker, the main author of the library, or by one or more
+contibutors listed above. Details on authorship of individual files
+can be found in the git version control history of the project. The
+omission of copyright and license comments in each file is in the
+interest of source tree size.
+
+In addition, permission is hereby granted for all public header files
+(include/* and arch/*/bits/*) and crt files intended to be linked into
+applications (crt/*, ldso/dlstart.c, and arch/*/crt_arch.h) to omit
+the copyright notice and permission notice otherwise required by the
+license, and to use these files without any requirement of
+attribution. These files include substantial contributions from:
+
+Bobby Bingham
+John Spencer
+Nicholas J. Kain
+Rich Felker
+Richard Pennington
+Stefan Kristiansson
+Szabolcs Nagy
+
+all of whom have explicitly granted such permission.
+
+This file previously contained text expressing a belief that most of
+the files covered by the above exception were sufficiently trivial not
+to be subject to copyright, resulting in confusion over whether it
+negated the permissions granted in the license. In the spirit of
+permissive licensing, and of not having licensing issues being an
+obstacle to adoption, that text has been removed.

package/src/native/local-process-manifest.json

@@ -0,0 +1,32 @@
+{
+  "schemaVersion": "agentkit.local-process-binary/v1",
+  "sourceSha256": "aec24ff7327319074bd7dd66fcde657f55179556f8a7e954303ea3f9eb135f0e",
+  "builds": {
+    "darwin-arm64": {
+      "file": "local-process-bin/darwin-arm64/launcher",
+      "sha256": "202cb67e15c09285123b60a9b72c4a8b5824e49e3d8c30746eae2ffb681c22e8",
+      "bytes": 50944,
+      "compiler": "Apple clang version 21.0.0 (clang-2100.3.34.2)"
+    },
+    "darwin-x64": {
+      "file": "local-process-bin/darwin-x64/launcher",
+      "sha256": "756085384f20c8690b43ea4b304b5acd10ecb438f12c51cf1d78ad545d594fe3",
+      "bytes": 17640,
+      "compiler": "Apple clang version 21.0.0 (clang-2100.3.34.2)"
+    },
+    "linux-x64": {
+      "file": "local-process-bin/linux-x64/launcher",
+      "sha256": "15205c3219e9771855c0c64812639a589f5d58d2cb6cb5ede9c07a416ecb64b1",
+      "bytes": 62840,
+      "compiler": "cc (Alpine 14.2.0) 14.2.0",
+      "image": "docker.m.daocloud.io/library/alpine@sha256:4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412"
+    },
+    "linux-arm64": {
+      "file": "local-process-bin/linux-arm64/launcher",
+      "sha256": "c59bf87805d0887cd142f04eff5047146f5ec5d594d400042bda3ce40984b670",
+      "bytes": 132376,
+      "compiler": "cc (Alpine 14.2.0) 14.2.0",
+      "image": "docker.m.daocloud.io/library/alpine@sha256:4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412"
+    }
+  }
+}

package/src/native/local-process.mjs

@@ -0,0 +1,246 @@
+// Node owns the bounded lifetime; a packaged, verified POSIX exec substrate
+// applies resource controls and an owner-pipe watchdog. This is a risk control for
+// same-container commands, not an OS security sandbox or an execution policy.
+import { spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { readFileSync, lstatSync, constants } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { join } from 'node:path';
+import { constants as osConstants } from 'node:os';
+import { StringDecoder } from 'node:string_decoder';
+import { performance } from 'node:perf_hooks';
+import { localEnvironmentPolicy, localOutputPolicy, resolveEnvironmentPolicy, resolveOutputPolicy } from './local-output-policy.mjs';
+
+export const LOCAL_PROCESS_CONTRACT = 'agentkit.local-process-control/v1';
+const directory = fileURLToPath(new URL('./', import.meta.url));
+const defaults = Object.freeze({ cpuSeconds: 120, addressSpaceBytes: 1024 ** 3, maxProcesses: 64,
+  maxOpenFiles: 256, maxFileBytes: 64 * 1024 ** 2, maxOutputBytes: 1024 ** 2, wallSeconds: 900, extraEnvNames: [] });
+const limitNames = ['cpuSeconds', 'addressSpaceBytes', 'maxProcesses', 'maxOpenFiles', 'maxFileBytes'];
+export class LocalProcessError extends Error { constructor(code) { super(code); this.name = 'LocalProcessError'; this.code = code; } }
+const check = (value, code) => { if (!value) throw new LocalProcessError(code); };
+const hash = value => createHash('sha256').update(value).digest('hex');
+const wait = milliseconds => new Promise(resolve => setTimeout(resolve, milliseconds));
+async function boundedWait(promise, milliseconds) {
+  let timer;
+  try { await Promise.race([promise, new Promise(resolve => { timer = setTimeout(resolve, milliseconds); })]); }
+  finally { clearTimeout(timer); }
+}
+const namePattern = /^[A-Za-z_][A-Za-z0-9_]*$/;
+export function localControlSettings(input = {}) {
+  check(input && typeof input === 'object' && !Array.isArray(input)
+    && Object.keys(input).every(key => Object.hasOwn(defaults, key)), 'invalid_local_process_settings');
+  const settings = { ...defaults, ...input };
+  for (const [name, value] of Object.entries(settings)) if (name !== 'extraEnvNames')
+    check(Number.isSafeInteger(value) && value > 0, `invalid_local_process_limit:${name}`);
+  check(settings.wallSeconds <= Number.MAX_SAFE_INTEGER / 1000, 'invalid_local_process_wall_limit');
+  check(Array.isArray(settings.extraEnvNames) && settings.extraEnvNames.every(name => typeof name === 'string'
+    && namePattern.test(name) && !name.startsWith('KSADK_LOCAL_PROCESS_')), 'invalid_local_process_environment_allowlist');
+  settings.extraEnvNames = Object.freeze([...new Set(settings.extraEnvNames)]);
+  return Object.freeze(settings);
+}
+export function buildScriptEnvironment(source, { settings = localControlSettings(), required = {}, environmentPolicy = null } = {}) {
+  const policy = localControlSettings(settings), env = resolveEnvironmentPolicy(policy, localEnvironmentPolicy(environmentPolicy)), result = Object.create(null);
+  for (const name of ['PATH', 'LANG', 'LC_ALL', 'TZ', 'SYSTEMROOT', ...env.names, ...policy.extraEnvNames])
+    if (Object.hasOwn(source, name)) result[name] = String(source[name]);
+  result.PATH ??= '/bin:/usr/bin'; result.LANG ??= 'C.UTF-8'; result.CI = '1';
+  for (const [name, value] of Object.entries(required)) { check(namePattern.test(name), 'invalid_local_process_environment'); result[name] = String(value); }
+  return result;
+}
+export function supportsLocalProcessPlatform({ platform = process.platform, arch = process.arch } = {}) {
+  return ['darwin-arm64', 'darwin-x64', 'linux-arm64', 'linux-x64'].includes(`${platform}-${arch}`);
+}
+export function resolveLocalProcessLauncher({ platform = process.platform, arch = process.arch } = {}) {
+  const target = `${platform}-${arch}`;
+  check(supportsLocalProcessPlatform({ platform, arch }), 'unsupported_local_process_platform');
+  const manifest = JSON.parse(readFileSync(join(directory, 'local-process-manifest.json'), 'utf8'));
+  check(manifest.schemaVersion === 'agentkit.local-process-binary/v1'
+    && manifest.sourceSha256 === hash(readFileSync(join(directory, 'local-process-launcher.c'))), 'local_process_source_digest_mismatch');
+  const entry = manifest.builds?.[target], relative = `local-process-bin/${target}/launcher`;
+  check(entry?.file === relative, 'local_process_launcher_missing');
+  const filename = join(directory, relative), stat = lstatSync(filename);
+  check(stat.isFile() && (stat.mode & 0o111) !== 0, 'local_process_launcher_not_executable');
+  const bytes = readFileSync(filename, { flag: constants.O_RDONLY | constants.O_NOFOLLOW });
+  check(bytes.length === entry.bytes && hash(bytes) === entry.sha256, 'local_process_launcher_digest_mismatch');
+  return filename;
+}
+function controlReport(text, settings) {
+  try {
+    const report = JSON.parse(text);
+    check(report.schemaVersion === LOCAL_PROCESS_CONTRACT && ['applied', 'partial', 'failed'].includes(report.status)
+      && report.applied && typeof report.applied === 'object' && !Array.isArray(report.applied)
+      && Array.isArray(report.unsupported) && Array.isArray(report.failed), 'invalid_local_process_control_report');
+    check(Object.entries(report.applied).every(([key, value]) => limitNames.includes(key)
+      && Number.isSafeInteger(value) && value >= 0 && value <= settings[key]), 'invalid_local_process_control_report');
+    check(report.unsupported.every(key => limitNames.includes(key)) && report.failed.every(key => [...limitNames, 'owner_watchdog'].includes(key)),
+      'invalid_local_process_control_report');
+    if (report.status !== 'failed') {
+      const allowedUnsupported = process.platform === 'darwin' ? ['addressSpaceBytes', 'maxProcesses'] : [];
+      check(Number.isSafeInteger(report.watcherPid) && report.watcherPid > 0 && !report.failed.length
+        && report.unsupported.length === allowedUnsupported.length && allowedUnsupported.every(key => report.unsupported.includes(key))
+        && limitNames.every(key => Object.hasOwn(report.applied, key) !== report.unsupported.includes(key))
+        && report.status === (allowedUnsupported.length ? 'partial' : 'applied'), 'invalid_local_process_control_report');
+    }
+    const { watcherPid, ...publicReport } = report; return publicReport;
+  } catch { return { schemaVersion: LOCAL_PROCESS_CONTRACT, status: 'failed', applied: {}, unsupported: [], failed: ['control_report'] }; }
+}
+
+/** argv/env are already Host-authorized. Shell/AST/workspace policy belongs to
+ * the caller; no retries and no durable handle ownership is inferred here.
+ * outputPolicy is opt-in (persisted-stream/v1); when absent, legacy
+ * maxOutputBytes-then-kill semantics and result shape are preserved exactly. */
+export async function runBoundedProcess({ argv, cwd, env, settings: input = {}, timeoutMs = null, signal, onOutput, onSpawn, outputPolicy = null } = {}) {
+  const settings = localControlSettings(input); signal?.throwIfAborted();
+  check(Array.isArray(argv) && argv.length > 0 && argv.every(value => typeof value === 'string' && !value.includes('\0'))
+    && argv[0].length > 0 && typeof cwd === 'string' && cwd.length > 0, 'invalid_local_process_command');
+  check(env && typeof env === 'object' && !Array.isArray(env) && Object.entries(env).every(([name, value]) =>
+    namePattern.test(name) && typeof value === 'string' && !value.includes('\0')), 'invalid_local_process_environment');
+  check(timeoutMs === null || Number.isFinite(timeoutMs) && timeoutMs > 0, 'invalid_local_process_timeout');
+  const outPolicy = resolveOutputPolicy(settings, localOutputPolicy(outputPolicy));
+  const executable = resolveLocalProcessLauncher();
+  const started = performance.now(), duration = Math.min(timeoutMs ?? Infinity, settings.wallSeconds * 1000);
+  const child = spawn(executable, [...limitNames.map(key => String(settings[key])), '3', '4', '--', ...argv], {
+    cwd, env, detached: true, stdio: ['ignore', 'pipe', 'pipe', 'pipe', 'pipe'],
+  });
+  const output = { stdout: [], stderr: [] }, lengths = { stdout: 0, stderr: 0 };
+  const truncated = { stdout: false, stderr: false }, decoders = { stdout: new StringDecoder('utf8'), stderr: new StringDecoder('utf8') };
+  const report = []; let reportBytes = 0, timedOut = false, canceled = false, outputLimitExceeded = false;
+  const cleanupErrors = new Set(); let exitCode = null, exitSignal = null, exited = false, closed = false, spawnError = null, timer;
+  let stop; const stopping = new Promise(resolve => { stop = resolve; });
+  let exitDone; const exit = new Promise(resolve => { exitDone = resolve; });
+  let closeDone; const close = new Promise(resolve => { closeDone = resolve; });
+  child.once('error', error => { spawnError = error; exitDone(); stop(); });
+  child.once('exit', (code, signal) => { exited = true; exitCode = code; exitSignal = signal; exitDone(); stop(); });
+  child.once('close', () => { closed = true; closeDone(); });
+  child.once('spawn', () => { try { onSpawn?.({ pid: child.pid }); } catch { cleanupErrors.add('spawn_observer_failed'); stop(); } });
+  // persisted-stream/v1: the full capped UTF-8 output is streamed out via onOutput
+  // to the existing supervisor-owned files; result.stdout/stderr hold ONLY a bounded
+  // preview. No full 64MiB buffer is held in memory here. The supervisor fsyncs the
+  // streamed files before its terminal receipt and never overwrites them with the
+  // preview. Only the hard persisted cap, timeout, cancellation, or real resource
+  // limits stop the process; preview overflow never kills a successful process.
+  const persistedStream = outPolicy.mode === 'persistedStream';
+  const preview = persistedStream ? { stdout: [], stderr: [], lengths: { stdout: 0, stderr: 0 },
+    truncated: { stdout: false, stderr: false } } : null;
+  const stream = persistedStream ? { lengths: { stdout: 0, stderr: 0 }, emitted: { stdout: 0, stderr: 0 }, truncated: { stdout: false, stderr: false },
+    decoders: { stdout: new StringDecoder('utf8'), stderr: new StringDecoder('utf8') } } : null;
+  const utf8Prefix = (text, limit) => new StringDecoder('utf8').write(Buffer.from(text).subarray(0, limit));
+  const emitPersisted = (channel, text) => {
+    // Invalid source bytes may expand into replacement characters. Bound the
+    // encoded observation too, so normalization cannot exceed the persisted cap.
+    const remaining = outPolicy.persistedBytes - stream.emitted[channel];
+    const bounded = utf8Prefix(text, remaining);
+    stream.emitted[channel] += Buffer.byteLength(bounded);
+    if (bounded) { try { onOutput?.(channel, bounded); } catch { /* supervisor records its own write failure */ } }
+    if (bounded !== text) { stream.truncated[channel] = true; outputLimitExceeded = true; stop(); }
+  };
+  for (const channel of ['stdout', 'stderr']) {
+    child[channel].on('error', () => { cleanupErrors.add(`${channel}_read_error`); stop(); });
+    child[channel].on('data', chunk => {
+      if (!persistedStream) {
+        const remaining = settings.maxOutputBytes - lengths[channel], kept = chunk.subarray(0, Math.max(0, remaining));
+        if (kept.length) {
+          output[channel].push(kept); lengths[channel] += kept.length;
+          const text = decoders[channel].write(kept);
+          if (text) { try { onOutput?.(channel, text); } catch { /* observation never changes execution */ } }
+        }
+        if (chunk.length > remaining) { truncated[channel] = true; outputLimitExceeded = true; stop(); }
+        return;
+      }
+      // Hard persisted cap: stream all bytes up to this bound via onOutput (to the
+      // owned files). Beyond it the process is stopped — this is the real boundary.
+      const pRemaining = outPolicy.persistedBytes - stream.lengths[channel];
+      const pKept = chunk.subarray(0, Math.max(0, pRemaining));
+      const overcap = chunk.length > pRemaining;
+      if (pKept.length) {
+        stream.lengths[channel] += pKept.length;
+        // Stream complete characters only; the StringDecoder holds a trailing
+        // partial multibyte sequence rather than emitting it. We never flush that
+        // held tail as replacement bytes (end()), so the file holds at most
+        // persistedBytes of valid UTF-8 — a cap-cut multibyte sequence is dropped,
+        // not written as a 3-byte replacement char beyond the cap.
+        const text = stream.decoders[channel].write(pKept);
+        if (text) emitPersisted(channel, text);
+      }
+      // Bounded in-memory preview: keep only up to previewBytes for the receipt,
+      // captured from pKept BEFORE the hard-cap return so an overcap first chunk
+      // still yields a non-empty preview. Preview overflow is honest (truncated
+      // flag) but never stops the process.
+      const vRemaining = outPolicy.previewBytes - preview.lengths[channel];
+      if (vRemaining > 0) {
+        const vKept = pKept.subarray(0, Math.min(pKept.length, vRemaining));
+        if (vKept.length) { preview[channel].push(vKept); preview.lengths[channel] += vKept.length; }
+        if (pKept.length > vRemaining) preview.truncated[channel] = true;
+      } else if (chunk.length) preview.truncated[channel] = true;
+      if (overcap) { stream.truncated[channel] = true; outputLimitExceeded = true; stop(); }
+    });
+  }
+  child.stdio[3].on('error', () => { cleanupErrors.add('control_report_read_error'); stop(); });
+  child.stdio[3].on('data', chunk => {
+    reportBytes += chunk.length;
+    if (reportBytes <= 4096) report.push(chunk); else { cleanupErrors.add('control_report_oversize'); stop(); }
+  });
+  child.stdio[4].on('error', () => { cleanupErrors.add('owner_lease_error'); stop(); });
+  const abort = () => { canceled = true; stop(); };
+  signal?.addEventListener('abort', abort, { once: true }); if (signal?.aborted) abort();
+  const deadline = () => {
+    const remaining = duration - (performance.now() - started);
+    if (remaining <= 0) { timedOut = true; stop(); }
+    else timer = setTimeout(deadline, Math.min(2_147_483_647, Math.max(1, remaining)));
+  };
+  deadline();
+  const groupSignal = signal => {
+    if (!child.pid) return;
+    try { process.kill(-child.pid, signal); }
+    catch (error) { if (error.code !== 'ESRCH') cleanupErrors.add(`group_${signal}:${error.code ?? 'error'}`); }
+  };
+  try {
+    await stopping; clearTimeout(timer); signal?.removeEventListener('abort', abort);
+    if (child.pid) {
+      groupSignal('SIGTERM'); await wait(200); groupSignal('SIGKILL');
+      if (!exited) await boundedWait(exit, 1000);
+      if (!exited && !spawnError) { cleanupErrors.add('process_reap_timeout'); try { child.kill('SIGKILL'); } catch { /* recorded below */ } }
+    }
+    // The only owner writer closes after the last group signal. The watchdog
+    // also handles hard caller death, when no finally block can execute.
+    child.stdio[4].destroy();
+    if (!closed) await boundedWait(close, 200);
+    if (!closed && !spawnError) cleanupErrors.add('process_stdio_close_timeout');
+  } finally {
+    clearTimeout(timer); signal?.removeEventListener('abort', abort);
+    for (const stream of child.stdio) stream?.destroy();
+    if (!exited) child.unref();
+  }
+  if (!persistedStream) {
+    for (const channel of ['stdout', 'stderr']) {
+      const tail = decoders[channel].end();
+      if (tail) { try { onOutput?.(channel, tail); } catch { /* observation never changes execution */ } }
+    }
+  }
+  if (persistedStream) for (const channel of ['stdout', 'stderr']) {
+    // Do not synthesize a replacement for a sequence cut by the hard cap.
+    // Natural invalid tails are normalized within the same encoded-byte bound.
+    if (!stream.truncated[channel]) emitPersisted(channel, stream.decoders[channel].end());
+  }
+  if (spawnError) throw new LocalProcessError(`local_process_spawn_failed:${spawnError.code ?? 'error'}`);
+  const controls = controlReport(Buffer.concat(report).toString('utf8'), settings);
+  const code = exitCode ?? (exitSignal && osConstants.signals[exitSignal] ? -osConstants.signals[exitSignal] : null);
+  if (!persistedStream)
+    return { stdout: Buffer.concat(output.stdout).toString('utf8'), stderr: Buffer.concat(output.stderr).toString('utf8'),
+      exitCode: outputLimitExceeded ? 122 : code, timedOut, canceled, outputLimitExceeded,
+      stdoutTruncated: truncated.stdout, stderrTruncated: truncated.stderr, cleanupError: [...cleanupErrors].join(',') || null, controls };
+  // persisted-stream/v1: stdout/stderr hold ONLY the bounded preview. The full
+  // capped output lives in the supervisor-owned files (streamed via onOutput and
+  // located by task_id/cursors). Honest truncation flags distinguish preview vs
+  // hard persisted bounds; outputPersistedTruncated marks the real boundary.
+  const previewText = channel => {
+    const decoded = Buffer.concat(preview[channel]).toString('utf8'), bounded = utf8Prefix(decoded, outPolicy.previewBytes);
+    if (bounded !== decoded) preview.truncated[channel] = true;
+    return bounded;
+  };
+  return { stdout: previewText('stdout'), stderr: previewText('stderr'),
+    exitCode: outputLimitExceeded ? 122 : code, timedOut, canceled, outputLimitExceeded,
+    stdoutTruncated: preview.truncated.stdout, stderrTruncated: preview.truncated.stderr,
+    stdoutPersistedTruncated: stream.truncated.stdout, stderrPersistedTruncated: stream.truncated.stderr,
+    previewBytes: outPolicy.previewBytes, persistedBytes: outPolicy.persistedBytes,
+    cleanupError: [...cleanupErrors].join(',') || null, controls };
+}

package/src/native/local-resource-profile.mjs

@@ -0,0 +1,32 @@
+import { localControlSettings } from './local-process.mjs';
+
+export const LOCAL_RESOURCE_PROFILE = 'agentkit.local-resource-profile/v1';
+const profiles = Object.freeze({
+  'bounded/v1': Object.freeze({}),
+  // Repository packs and build artifacts routinely exceed the restricted
+  // per-file allowance. Keep a finite development allowance; explicit Host
+  // settings always win. Other limits retain their existing values.
+  'local-development/v1': Object.freeze({ maxFileBytes: 1024 ** 3 }),
+});
+export function validLocalResourceProfile(profile) {
+  return typeof profile === 'string' && Object.hasOwn(profiles, profile);
+}
+
+/** Host admission selects this policy, never a model/tool argument. */
+export function localResourceSettings({ profile = 'bounded/v1', settings = {} } = {}) {
+  if (!validLocalResourceProfile(profile)) throw Error('invalid_local_resource_profile');
+  // Validate raw settings before merging: unknown keys/invalid overrides must
+  // not be hidden by profile defaults.
+  localControlSettings(settings);
+  return localControlSettings({ ...profiles[profile], ...settings });
+}
+
+/** These are requested limits. Per-command receipts remain authoritative for
+ * OS hard-limit clamping, unsupported controls and actual process outcomes. */
+export function localResourceFacts(profile, settings) {
+  if (!validLocalResourceProfile(profile)) throw Error('invalid_local_resource_profile');
+  const selected = localControlSettings(settings);
+  return { contract: LOCAL_RESOURCE_PROFILE, profile, requestedLimits: Object.fromEntries(
+    ['cpuSeconds', 'addressSpaceBytes', 'maxProcesses', 'maxOpenFiles', 'maxFileBytes', 'wallSeconds']
+      .map(key => [key, selected[key]])) };
+}

package/src/native/memory-candidate.mjs

@@ -0,0 +1,121 @@
+import { createHash } from 'node:crypto';
+import { canonical, invariant } from '@kingsoftcloud/agentkit-harness-core';
+
+// KsADK memory/extraction.py native_user_memory_candidate, reference 355059d.
+// Only whole original human statements enter this path. Transcript extraction
+// and model/tool assertions intentionally have no candidate authority here.
+export const NATIVE_USER_EXTRACTION_POLICY = 'native-original-user-profile/v2';
+export const NATIVE_MEMORY_CANDIDATE = 'agentkit.native-memory-candidate/v1';
+export const memoryDigest = value => {
+  // UTF-8 replacement of a lone UTF-16 surrogate would alias a different
+  // original input. Python's strict UTF-8 encoder rejects it as well.
+  invariant(typeof value === 'string' && value.isWellFormed(), 'native_memory_text_invalid_unicode');
+  return 'sha256:' + createHash('sha256').update(value).digest('hex');
+};
+const identify = value => memoryDigest(canonical(value)).slice(7);
+const explicitPatterns = [/记住[:：]?\s*(.+)/iu, /别忘了[:：]?\s*(.+)/iu,
+  /remember\s+(?:that\s+)?(.+)/iu, /请记[:：]?\s*(.+)/iu];
+const sessionRetention = /\b(?:for|during|within|in)\s+(?:only\s+)?(?:this|the\s+current)\s+(?:conversation|chat|session|turn)\b|(?:本次|这次|此次|当前|这个|本)(?:会话|对话|聊天)|(?:本轮|这轮)/iu;
+const correction = /(?<prefix>(?:我|本人)?喜欢(?<action>吃|喝|用|看|听|玩))(?:的)?(?:是)?\s*(?<new>.+?)\s*(?:，|,)?\s*(?:而)?不是\s*(?<old>.+?)(?:[。.!！]|$)/iu;
+const generalCorrection = /(?:以后|今后)?(?<subject>[一-龥A-Za-z0-9]{1,12})?(?:请)?(?:不要|别)(?<old>.{1,20}?)[，,]?(?:请)?(?:改成|改为|换成|改用)(?<new>.+?)(?:[。.!！]|$)/iu;
+const hobby = /(?:我|本人)?的?爱好(?<correction>其实|现在|改)?(?:是|改成|变成)\s*(?<value>.+?)(?:[。.!！]|$)/iu;
+const implicitPatterns = [/(?:我|本人)?的?偏好(?:是|为)\s*(.+?)(?:[。.!！]|$)/iu,
+  /(?:我|本人)?(?:平时)?(?:喜欢|习惯)(吃|喝|用|看|听|玩)\s*(.+?)(?:[。.!！]|$)/iu];
+const full = (pattern, text) => { const match = pattern.exec(text); return match?.index === 0 && match[0].length === text.length ? match : null; };
+const edgePunctuation = value => value.trim().replace(/^[。.，,]+|[。.，,]+$/gu, '');
+const correctedContent = value => value.trim().replace(/^[。.，, ]+|[。.，, ]+$/gu, '');
+const sessionOnly = text => sessionRetention.test(text.trim().split(/[。！？!?\r\n]|\.(?=\s|$)/u, 1)[0]);
+
+export function deriveMemoryProfileSlotKey(content) {
+  if (hobby.test(content)) return 'profile.preference.hobby';
+  const action = /(?:我|本人)?喜欢(?<action>吃|喝|用|看|听|玩)/iu.exec(content)?.groups.action;
+  return action ? 'profile.preference.' + ({ 吃: 'food', 喝: 'drink', 用: 'tool', 看: 'viewing', 听: 'listening', 玩: 'activity' })[action] : '';
+}
+
+export function isExplicitMemoryInstruction(value) {
+  const text = value.trim();
+  if (sessionOnly(text)) return false;
+  return explicitPatterns.some(pattern => full(pattern, text)) || !!full(correction, text)
+    || !!full(generalCorrection, text) || !!full(hobby, text)?.groups.correction;
+}
+
+/** Stable candidate identity is versioned; it need not reproduce Python JSON bytes. */
+export function nativeUserMemoryCandidate({ text, sourceEventId, scope, scopeId }) {
+  invariant(typeof text === 'string' && text.isWellFormed() && typeof sourceEventId === 'string' && sourceEventId.isWellFormed()
+    && ['user', 'agent', 'workspace', 'org'].includes(scope) && typeof scopeId === 'string', 'native_memory_candidate_invalid');
+  text = text.trim();
+  const explicit = isExplicitMemoryInstruction(text), hobbyMatch = full(hobby, text);
+  if (!sourceEventId.trim() || !(explicit || implicitPatterns.some(pattern => full(pattern, text)) || hobbyMatch)) return null;
+  let content, operation = 'add', reason, importance;
+  const changedHobby = hobby.exec(text), general = generalCorrection.exec(text), preference = correction.exec(text);
+  // Preserve the reference's implicit hobby fallback after its legacy extractor
+  // declined a session-scoped statement. This is still only an observation.
+  if (sessionOnly(text)) {
+    if (!hobbyMatch || hobbyMatch.groups.correction) return null;
+    content = '我的爱好是' + hobbyMatch.groups.value.trim(); reason = 'implicit_user_preference'; importance = .65;
+  } else if (changedHobby?.groups.correction) {
+    const value = correctedContent(changedHobby.groups.value);
+    if (!value) return null;
+    content = '我的爱好是' + value; operation = 'update'; reason = 'explicit_user_correction'; importance = .9;
+  } else if (general) {
+    const subject = (general.groups.subject ?? '').trim(), value = correctedContent(general.groups.new);
+    if (!value) return null;
+    content = subject + '改为' + value; operation = 'update'; reason = 'explicit_user_correction'; importance = .8;
+  } else if (preference) {
+    const value = correctedContent(preference.groups.new);
+    if (!value) return null;
+    content = preference.groups.prefix.trim() + value; operation = 'update'; reason = 'explicit_user_correction'; importance = .9;
+  } else {
+    const instruction = explicitPatterns.map(pattern => pattern.exec(text)).find(Boolean);
+    if (instruction) {
+      content = edgePunctuation(instruction[1] || text);
+      if (!content) return null;
+      reason = 'explicit_user_request'; importance = .8;
+    } else {
+      const implicit = implicitPatterns.map(pattern => pattern.exec(text)).find(Boolean);
+      if (implicit) content = edgePunctuation(implicit[0]);
+      else if (hobbyMatch && !hobbyMatch.groups.correction) content = '我的爱好是' + hobbyMatch.groups.value.trim();
+      else return null;
+      reason = 'implicit_user_preference'; importance = .65;
+    }
+  }
+  if (!explicit && reason !== 'implicit_user_preference') return null;
+  return { contract: NATIVE_MEMORY_CANDIDATE, extractionPolicy: NATIVE_USER_EXTRACTION_POLICY,
+    candidateId: 'candidate_' + identify([NATIVE_MEMORY_CANDIDATE, NATIVE_USER_EXTRACTION_POLICY, scope, scopeId, sourceEventId, operation, content]),
+    operation, memoryType: 'profile', scope, scopeId, content, confidence: 1, importance,
+    sourceEventIds: [sourceEventId], conflictsWith: [], sensitiveLabels: [], reason,
+    slotKey: deriveMemoryProfileSlotKey(content), sensitivity: 'none', expiresAt: '' };
+}
+
+export function nativeMemoryScopeBindings(principal, scopes = ['user']) {
+  invariant(principal && ['tenantId', 'workspaceId', 'agentId', 'userId'].every(key => typeof principal[key] === 'string'
+    && principal[key].trim()), 'native_memory_principal_invalid');
+  const { tenantId, workspaceId, agentId, userId } = principal;
+  const bindings = { tenant: ['org', [tenantId]], workspace: ['workspace', [tenantId, workspaceId]],
+    agent: ['agent', [tenantId, workspaceId, agentId]], user: ['user', [tenantId, workspaceId, agentId, userId]] };
+  invariant(Array.isArray(scopes) && scopes.every(scope => Object.hasOwn(bindings, scope)), 'native_memory_scope_invalid');
+  return [...new Set(scopes)].map(name => ({ scope: bindings[name][0],
+    scopeId: 'native-memory-v1:' + identify([name, ...bindings[name][1]]) }));
+}
+
+const secretPatterns = [[/api[_-]?key\s*[:=]\s*\S+/iu, 'api_key'], [/secret[_-]?key\s*[:=]\s*\S+/iu, 'secret_key'],
+  [/access[_-]?key\s*[:=]\s*\S+|AKIA[0-9A-Z]{16}/iu, 'access_key'], [/cookie\s*[:=]\s*\S+/iu, 'cookie'],
+  [/authorization\s*[:=]\s*bearer\s+\S+/iu, 'auth_header'], [/https?:\/\/\S+?(?:X-Amz-Signature|X-Amz-Security-Token|signed)=/iu, 'signed_url'],
+  [/(postgres|mysql|mongodb|redis):\/\/\S+:\S+@\S+/iu, 'dsn'], [/sk-[A-Za-z0-9]{20,}/iu, 'token']];
+export function nativeMemorySensitiveLabels(content, supplied = []) {
+  return [...new Set([...supplied.filter(label => label && label !== 'none'),
+    ...secretPatterns.filter(([pattern]) => pattern.test(content)).map(([, label]) => label)])].sort();
+}
+
+/** Candidate decisions grant no execution authority; provider commits separately. */
+export function evaluateNativeMemoryCandidate(candidate, { existing = null, observations = 1 } = {}) {
+  const labels = nativeMemorySensitiveLabels(candidate.content, candidate.sensitiveLabels);
+  if (labels.length || candidate.sensitivity === 'high') return { decision: 'reject', operation: 'ignore', reason: 'sensitive_label_rejected:' + (labels.join(',') || 'explicit') };
+  if (/model_guess|transient|current_plan/iu.test(candidate.reason)) return { decision: 'reject', operation: 'ignore', reason: 'not_durable' };
+  const explicit = /explicit|user_request/iu.test(candidate.reason);
+  const threshold = explicit ? .6 : observations < 2 ? Infinity : .85;
+  if (candidate.confidence < threshold) return { decision: 'pending', operation: candidate.operation,
+    reason: `below_threshold:${candidate.confidence.toFixed(2)}<${Number.isFinite(threshold) ? threshold.toFixed(2) : 'inf'}` };
+  return { decision: 'commit', operation: existing ? 'update' : candidate.operation,
+    reason: existing ? 'conflict_supersede' : 'threshold_met' };
+}