@mifune/agro 0.24.0 → 0.24.1

package/dist/agro.js

@@ -2111,7 +2111,7 @@ import { basename as basename6, join as join6, sep as sep3 } from "node:path";
 import { basename as basename4, resolve as resolve7 } from "node:path";
 
 // src/lib/version.ts
-var AGRO_VERSION = true ? "0.24.0" : "0.0.0-dev";
+var AGRO_VERSION = true ? "0.24.1" : "0.0.0-dev";
 var OFFICIAL_IMAGE = "ghcr.io/mifunedev/agro";
 var RELEASE_VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[a-z][a-z0-9]*\.[0-9]+)?$/;
 function parseReleaseVersion(value) {
@@ -6959,6 +6959,8 @@ var TOOL_CATALOG = Object.freeze([
         'echo "$sha  $tmp/agent-browser" | sha256sum -c -',
         'install -d "$prefix/bin"',
         'install -m 0755 "$tmp/agent-browser" "$prefix/bin/agent-browser"',
+        "userns_sysctl=/proc/sys/kernel/apparmor_restrict_unprivileged_userns",
+        "apparmor_profile=/etc/apparmor.d/agro-agent-browser",
         'browser=""',
         'for candidate in "$AGENT_BROWSER_EXECUTABLE_PATH" google-chrome google-chrome-stable chromium chromium-browser brave-browser microsoft-edge; do',
         '  test -n "$candidate" || continue',
@@ -6967,6 +6969,11 @@ var TOOL_CATALOG = Object.freeze([
         '  browser="$resolved"',
         "  break",
         "done",
+        'userns=""',
+        'if [ -z "$browser" ] && [ "$(cat "$userns_sysctl" 2>/dev/null)" = 1 ]; then',
+        "  userns=restricted",
+        `  profile="$(printf '%s\\n' 'abi <abi/4.0>,' 'include <tunables/global>' "profile agro-agent-browser $HOME/.agent-browser/browsers/*/chrome flags=(unconfined) {" '  userns,' '}')"`,
+        "fi",
         'deps=""',
         'if [ -n "$browser" ]; then',
         '  echo "agent-browser will drive $browser"',
@@ -6977,6 +6984,11 @@ var TOOL_CATALOG = Object.freeze([
         '    PATH="$tmp:$PATH"',
         "  fi",
         '  "$prefix/bin/agent-browser" install --with-deps',
+        '  if [ -n "$userns" ]; then',
+        `    printf '%s\\n' "$profile" | sudo tee "$apparmor_profile" >/dev/null`,
+        '    sudo apparmor_parser -r "$apparmor_profile"',
+        '    userns=""',
+        "  fi",
         "else",
         '  "$prefix/bin/agent-browser" install',
         "  deps=missing",
@@ -6993,6 +7005,12 @@ var TOOL_CATALOG = Object.freeze([
         '    echo "Chrome needs system libraries, and this user has no passwordless sudo. Run this command, then rerun agro tool install agent-browser:" >&2',
         '    echo "  sudo $prefix/bin/agent-browser install --with-deps" >&2',
         "  fi",
+        '  if [ -n "$userns" ]; then',
+        '    echo "AppArmor blocks the user namespaces that the downloaded Chrome needs for its sandbox. Run these commands, then rerun agro tool install agent-browser:" >&2',
+        `    echo "sudo tee $apparmor_profile >/dev/null <<'EOF'" >&2`,
+        `    printf '%s\\n' "$profile" EOF >&2`,
+        '    echo "sudo apparmor_parser -r $apparmor_profile" >&2',
+        "  fi",
         "  exit 1",
         "fi",
         'echo "agent-browser launched headless Chrome"'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mifune/agro",
-  "version": "0.24.0",
+  "version": "0.24.1",
   "description": "AGRO CLI — create and manage sandboxes for coding agents.",
   "license": "Apache-2.0",
   "homepage": "https://github.com/mifunedev/agro#readme",