@librechat/agents 3.6.13 → 3.6.14

package/src/tools/local/syntaxCheck.ts

@@ -18,12 +18,15 @@
 
 import { extname } from 'path';
 import type * as t from '@/types';
-import { isWorkspaceClientTimeoutError } from './workspaceFS';
 import {
+  commandAvailabilityEnvCacheKey,
   getSpawn,
   getWorkspaceFS,
+  probeLocalCommandAvailability,
+  setCommandAvailabilityCacheEntry,
   spawnLocalProcess,
 } from './LocalExecutionEngine';
+import { isWorkspaceClientTimeoutError } from './workspaceFS';
 
 export type SyntaxCheckOutcome =
   | { ok: true }
@@ -48,26 +51,17 @@ export type SyntaxChecker = (
  * reset hook re-creates the map.
  */
 type ProbeKind = 'hasNode' | 'hasPython' | 'hasBash';
-type ProbeCache = Partial<Record<ProbeKind, Promise<boolean>>>;
+type ProbeCache = Partial<
+  Record<ProbeKind, ReturnType<typeof probeLocalCommandAvailability>>
+>;
 
-// Per-backend × per-env cache. Codex P2 #40 — keying by spawn
-// backend alone misses env-driven availability changes (e.g. PATH
-// loses node between Runs that share the same backend). Same fix
-// shape as the ripgrep cache (Codex P1 #34).
+// Per-backend × hashed-env cache. The inner map is bounded so a long-lived
+// world cannot retain unbounded environment variants.
 let probeCacheByBackend = new WeakMap<
   t.LocalSpawn,
   Map<string, ProbeCache>
 >();
 
-function envCacheKey(env: NodeJS.ProcessEnv | undefined): string {
-  if (env == null) return '';
-  const sorted: Record<string, string | undefined> = {};
-  for (const k of Object.keys(env).sort()) {
-    sorted[k] = env[k];
-  }
-  return JSON.stringify(sorted);
-}
-
 function cacheFor(
   config: t.LocalExecutionConfig
 ): ProbeCache {
@@ -77,11 +71,11 @@ function cacheFor(
     envMap = new Map();
     probeCacheByBackend.set(backend, envMap);
   }
-  const envKey = envCacheKey(config.env);
+  const envKey = commandAvailabilityEnvCacheKey(config.env);
   let entry = envMap.get(envKey);
   if (entry == null) {
     entry = {};
-    envMap.set(envKey, entry);
+    setCommandAvailabilityCacheEntry(envMap, envKey, entry);
   }
   return entry;
 }
@@ -95,17 +89,20 @@ async function probe(
   const entry = cacheFor(config);
   let probePromise = entry[cached];
   if (probePromise == null) {
-    probePromise = spawnLocalProcess(
-      command,
-      args,
-      { ...config, timeoutMs: 5000, sandbox: { enabled: false } },
-      { internal: true }
-    )
-      .then((result) => result != null && result.exitCode === 0)
-      .catch(() => false);
+    probePromise = probeLocalCommandAvailability(command, args, config);
     entry[cached] = probePromise;
   }
-  return probePromise;
+  const result = await probePromise;
+  if (!result.cacheable && entry[cached] === probePromise) {
+    delete entry[cached];
+  }
+  if (result.cacheUntil != null && result.cacheUntil <= Date.now()) {
+    if (entry[cached] === probePromise) {
+      delete entry[cached];
+    }
+    return probe(command, args, cached, config);
+  }
+  return result.available;
 }
 
 /**

package/src/tools/local/workspaceFS.ts

@@ -92,10 +92,9 @@ export interface WorkspaceFS {
  * Returned by `getWorkspaceFS(config)` when the host hasn't supplied
  * an override on `local.exec.fs`.
  */
-export const nodeWorkspaceFS: WorkspaceFS = {
+export const nodeWorkspaceFS = Object.freeze<WorkspaceFS>({
   // The runtime impl ignores the encoding-vs-buffer distinction; the
   // overload signatures above are what callers see.
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
   readFile: ((path: string, encoding?: 'utf8') =>
     encoding != null
       ? fsReadFile(path, encoding)
@@ -113,4 +112,4 @@ export const nodeWorkspaceFS: WorkspaceFS = {
   realpath: (path) => fsRealpath(path),
   unlink: (path) => fsUnlink(path),
   open: (path, flags) => fsOpen(path, flags),
-};
+});

package/src/types/tools.ts

@@ -820,47 +820,35 @@ export type LocalWorkspaceConfig = {
 };
 
 /**
- * Engine-agnostic execution seam. Default uses Node's
- * `child_process.spawn` and `fs/promises`. A future engine (e.g.
- * stateful remote sandbox) supplies its own `spawn` and `fs` and
- * inherits every tool factory unchanged.
+ * One execution world shared by filesystem and subprocess operations.
+ * Backend identity is stable so capability probes remain warm when tool
+ * bundles are rebuilt for later agent bindings.
+ */
+export interface ExecutionWorld {
+  /** Launches a process inside this world's filesystem namespace. */
+  readonly spawn: LocalSpawn;
+  /** Reads and writes the same namespace observed by `spawn`. */
+  readonly fs: Readonly<import('@/tools/local/workspaceFS').WorkspaceFS>;
+  /** Whether the world already enforces a sandbox boundary. */
+  readonly sandboxed: boolean;
+}
+
+/**
+ * Backward-compatible partial execution-world override. Omitted fields use
+ * the Node host world; remote backends should provide the complete trio.
  *
- * **Important — pair `spawn` and `fs` together.** Most file-touching
- * surfaces in the local engine route through `getWorkspaceFS(config)`
- * so a host can transparently swap in a remote/in-memory FS. A small
- * set of helpers — currently the `execute_code` non-bash temp-file
- * write (Codex P2 [48]) — still uses host `fs/promises` directly to
- * stage source on disk before invoking the spawn. If you override
- * `spawn` to point at a remote runtime (SSH, container, etc.) you
- * MUST also override `fs` with the corresponding remote
- * implementation; otherwise temp source files written to the host
- * `/tmp` won't be visible to the remote interpreter and `py`/`js`/
- * `ts`/etc. executions will fail. (Bash-style executions go through
- * `executeLocalBash` which doesn't stage temp files, so they're
- * unaffected.)
+ * Non-bash `execute_code` still stages source through the host temporary
+ * directory. Remote runtimes should use their dedicated execution engine for
+ * that tool until temporary lifecycle operations join this seam.
  *
- * Threat-model note: the regex-based command validators
- * (`dangerousCommandPatterns`, `quotedDestructivePatterns`, etc.) and
- * the workspace policy hook are documented as best-effort tripwires.
- * The hard security boundary is `local.sandbox.enabled: true` (which
- * wraps execution in `@anthropic-ai/sandbox-runtime`); for adversarial-
- * model threat models, do NOT rely on the regex layer alone.
+ * Command validators and workspace policies are best-effort tripwires. For an
+ * adversarial-model threat model, use a backend sandbox boundary rather than
+ * relying on validation alone.
  */
 export type LocalExecConfig = {
-  /** Pluggable spawn (for SSH, container, remote workers, etc.). */
-  spawn?: LocalSpawn;
-  /**
-   * Pluggable filesystem (for remote-workspace engines). Pair with
-   * `spawn` — see the type-level note above on why both should be
-   * overridden together for non-host engines.
-   */
-  fs?: import('@/tools/local/workspaceFS').WorkspaceFS;
-  /**
-   * Set by custom execution backends that already provide their own
-   * sandbox boundary. Suppresses the local host-sandbox warning while
-   * preserving the warning for plain host `child_process` execution.
-   */
-  sandboxed?: boolean;
+  -readonly [Key in keyof ExecutionWorld]?: Key extends 'fs'
+    ? import('@/tools/local/workspaceFS').WorkspaceFS
+    : ExecutionWorld[Key];
 };
 
 export type LocalExecutionConfig = {