@minionry/minion 0.7.36

package/bin/sandbox-config.js

@@ -0,0 +1,306 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+
+
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export const SECCOMP_PROFILE = resolve(dirname(fileURLToPath(import.meta.url)), 'sandbox', 'seccomp-userns.json');
+
+export const MIN_MEMORY_GB = 1;
+export const MIN_DISK_GB = 5;
+
+export const MAX_GB = 1024;
+
+export const SANDBOX_IMAGE_TAG = 'minionry-sandbox:latest';
+
+export const SANDBOX_UID = 1000;
+
+export const SANDBOX_HOME = '/home/minion';
+
+export const REPO_KINDS = [
+  { kind: 'agents', label: 'Claude Code agents', dest: '~/.claude/agents' },
+  { kind: 'skills', label: 'Claude Code skills', dest: '~/.claude/skills' },
+  { kind: 'prompts', label: 'Minionry system prompts', dest: '~/.minionry/prompts' },
+];
+
+const NAME_PATTERN = /^[a-z0-9][a-z0-9-]{0,30}(?<!-)$/;
+
+export function validateSandboxName(name) {
+  if (NAME_PATTERN.test(name)) return null;
+  return 'Sandbox names must be lowercase letters, digits and hyphens (max 31 chars, no leading/trailing hyphen).';
+}
+
+export function sandboxNames(name) {
+  return {
+    name,
+    container: `minionry-${name}`,
+    volume: `minionry-${name}-disk`,
+    hostname: name,
+  };
+}
+
+export function sandboxVolume(row) {
+  return row.volume || sandboxNames(row.name).volume;
+}
+
+function sandboxContainer(row) {
+  return row.container || sandboxNames(row.name).container;
+}
+
+export function checkSandboxName(name, { taken = [], imageExists = false } = {}) {
+  const invalid = validateSandboxName(name);
+  if (invalid) return { invalid };
+
+  const { container, volume } = sandboxNames(name);
+  const clashes = [];
+  if (taken.includes(container)) clashes.push('container');
+  if (taken.includes(volume)) clashes.push('volume');
+  if (imageExists) clashes.push('image');
+  return clashes.length > 0 ? { clashes } : null;
+}
+
+export function defaultSandboxName(taken) {
+  const isFree = (candidate) => {
+    const { container, volume } = sandboxNames(candidate);
+    return !taken.includes(container) && !taken.includes(volume);
+  };
+  if (isFree('sandbox')) return 'sandbox';
+  for (let i = 2; ; i++) {
+    if (isFree(`sandbox-${i}`)) return `sandbox-${i}`;
+  }
+}
+
+export function parseGbFlag(raw, { flag, min }) {
+  const trimmed = (raw ?? '').trim();
+  const match = trimmed.match(/^(\d+)\s*(?:g|gb)?$/i);
+  if (!match) {
+    return { ok: false, error: `${flag} needs a whole number of GB (e.g. ${flag} 16).` };
+  }
+  const gb = Number.parseInt(match[1], 10);
+  if (gb < min) return { ok: false, error: `${flag} must be at least ${min} GB.` };
+  if (gb > MAX_GB) return { ok: false, error: `${flag} of ${gb} GB looks like a typo (max ${MAX_GB} GB — the unit here is GB, not MB).` };
+  return { ok: true, gb };
+}
+
+function parseCapFlag(flag, value) {
+  const isDisk = flag === '--disk';
+  const parsed = parseGbFlag(value, { flag, min: isDisk ? MIN_DISK_GB : MIN_MEMORY_GB });
+  if (!parsed.ok) return { ok: false, error: parsed.error };
+  return { ok: true, key: isDisk ? 'diskGb' : 'memoryGb', gb: parsed.gb };
+}
+
+export function parseSandboxArgs(args) {
+  const result = { ok: true, name: null, rebuild: false, memoryGb: null, diskGb: null };
+
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    const flagMatch = arg.match(/^(--memory|--disk)(?:=(.*))?$/);
+
+    if (arg === '--rebuild') {
+      result.rebuild = true;
+    } else if (flagMatch) {
+      const cap = parseCapFlag(flagMatch[1], flagMatch[2] ?? args[++i]);
+      if (!cap.ok) return cap;
+      result[cap.key] = cap.gb;
+    } else if (arg.startsWith('-')) {
+      return { ok: false, error: `Unknown option "${arg}".` };
+    } else if (result.name !== null) {
+      return { ok: false, error: `Unexpected extra argument "${arg}" (a sandbox takes one name).` };
+    } else {
+      result.name = arg;
+    }
+  }
+
+  return result;
+}
+
+export function parseRepoInput(raw) {
+  const trimmed = (raw ?? '').trim();
+  if (trimmed === '') return { ok: true, url: null };
+  const looksClonable =
+    /^https?:\/\/\S+$/i.test(trimmed) ||
+    /^git@[^\s:]+:\S+$/.test(trimmed) ||
+    /^(ssh|git):\/\/\S+$/i.test(trimmed);
+  if (!looksClonable) {
+    return { ok: false, error: 'That does not look like a git URL (expected https://…, git@…, or ssh://…). Press Enter to skip.' };
+  }
+  return { ok: true, url: trimmed };
+}
+
+export function buildDiskImageCommands({ imagePath, sizeGb, volume }) {
+  return {
+    imageBytes: sizeGb * 1024 * 1024 * 1024,
+    mkfs: [
+      'mkfs.ext4',
+      ['-F', '-q', '-E', `root_owner=${SANDBOX_UID}:${SANDBOX_UID}`, imagePath],
+    ],
+    volumeCreate: [
+      'docker',
+      [
+        'volume', 'create',
+        '--driver', 'local',
+        '--opt', 'type=ext4',
+        '--opt', `device=${imagePath}`,
+        '--opt', 'o=loop',
+        '--label', 'minionry.sandbox=1',
+        volume,
+      ],
+    ],
+  };
+}
+
+export function buildPlainVolumeArgs(volume) {
+  return ['volume', 'create', '--label', 'minionry.sandbox=1', volume];
+}
+
+function memoryValue(gb) {
+  return Number.isInteger(gb) ? `${gb}g` : String(Math.round(gb * 1024 ** 3));
+}
+
+export function buildRunArgs({ names, memoryGb, diskGb, diskCapped, seccompProfile = SECCOMP_PROFILE }) {
+  const args = [
+    'run', '-d',
+    '--name', names.container,
+    '--hostname', names.hostname,
+    '--init',
+    '--restart', 'unless-stopped',
+  ];
+  if (seccompProfile) args.push('--security-opt', `seccomp=${seccompProfile}`);
+  if (memoryGb) args.push('--memory', memoryValue(memoryGb), '--memory-swap', memoryValue(memoryGb));
+  args.push(
+    '-v', `${names.volume}:${SANDBOX_HOME}`,
+    '--label', 'minionry.sandbox=1',
+    '--label', `minionry.sandbox.volume=${names.volume}`,
+  );
+  if (memoryGb) args.push('--label', `minionry.sandbox.memory-gb=${memoryGb}`);
+  if (diskGb) {
+    args.push(
+      '--label', `minionry.sandbox.disk-gb=${diskGb}`,
+      '--label', `minionry.sandbox.disk-capped=${diskCapped}`,
+    );
+  }
+  args.push(SANDBOX_IMAGE_TAG);
+  return args;
+}
+
+export function withoutSeccompProfile(args) {
+  const at = args.indexOf('--security-opt');
+  if (at === -1 || !String(args[at + 1]).startsWith('seccomp=')) return [...args];
+  return [...args.slice(0, at), ...args.slice(at + 2)];
+}
+
+export function buildSandboxListArgs() {
+  return [
+    'ps', '-a',
+    '--filter', 'label=minionry.sandbox=1',
+    '--format', [
+      '{{.Names}}',
+      '{{.Status}}',
+      '{{.Label "minionry.sandbox.disk-gb"}}',
+      '{{.Label "minionry.sandbox.disk-capped"}}',
+      '{{.Label "minionry.sandbox.volume"}}',
+    ].join('\t'),
+  ];
+}
+
+function tabRows(stdout) {
+  return (stdout ?? '')
+    .split('\n')
+    .map((line) => line.replace(/\r$/, ''))
+    .filter((line) => line.trim() !== '')
+    .map((line) => line.split('\t'));
+}
+
+export function parseSandboxRows(stdout) {
+  return tabRows(stdout).map(([container, status, diskGb, diskCapped, volume]) => {
+    const gb = (diskGb ?? '').trim();
+    const name = container.replace(/^minionry-/, '');
+    return {
+      container,
+      name,
+      status: (status ?? '').trim(),
+      diskGb: /^\d+$/.test(gb) ? Number.parseInt(gb, 10) : null,
+      diskCapped: (diskCapped ?? '').trim() === 'true',
+      volume: (volume ?? '').trim() || sandboxNames(name).volume,
+    };
+  });
+}
+
+export function buildMemoryInspectArgs(containers) {
+  return ['inspect', '--format', '{{.Name}}\t{{.HostConfig.Memory}}', ...containers];
+}
+
+export function parseMemoryCaps(stdout) {
+  const caps = new Map();
+  for (const [name, bytes] of tabRows(stdout)) {
+    const parsed = Number.parseInt(bytes ?? '', 10);
+    caps.set(name.replace(/^\//, ''), Number.isFinite(parsed) && parsed > 0 ? parsed : 0);
+  }
+  return caps;
+}
+
+export function formatMemoryCap(bytes) {
+  if (!bytes || bytes <= 0) return null;
+  const gb = bytes / 1024 ** 3;
+  return `${Number.isInteger(gb) ? gb : gb.toFixed(1)} GB`;
+}
+
+export function parseRestartArgs(args) {
+  let name = null;
+  let uncap = false;
+  for (const arg of args) {
+    if (arg === '--uncap') {
+      uncap = true;
+    } else if (arg.startsWith('-')) {
+      return { ok: false, error: `Unknown option "${arg}".` };
+    } else if (name !== null) {
+      return { ok: false, error: `Unexpected extra argument "${arg}" (restart takes one sandbox name).` };
+    } else {
+      name = arg;
+    }
+  }
+  if (name === null) return { ok: false, error: 'Which sandbox? Pass its name.' };
+  return { ok: true, name, uncap };
+}
+
+function buildReplaceCommands(row, changes) {
+  const names = { ...sandboxNames(changes.name ?? row.name), volume: sandboxVolume(row) };
+  return [
+    ['rm', '-f', sandboxContainer(row)],
+    buildRunArgs({ names, memoryGb: changes.memoryGb, diskGb: row.diskGb, diskCapped: row.diskCapped }),
+  ];
+}
+
+export function buildUncapCommands(row) {
+  return buildReplaceCommands(row, { memoryGb: null });
+}
+
+export function buildRenameCommands(row, newName) {
+  return buildReplaceCommands(row, { name: newName, memoryGb: memoryCapGb(row.memoryBytes) });
+}
+
+export function memoryCapGb(bytes) {
+  return bytes > 0 ? bytes / 1024 ** 3 : null;
+}
+
+export function parseRenameArgs(args) {
+  const positional = [];
+  for (const arg of args) {
+    if (arg.startsWith('-')) return { ok: false, error: `Unknown option "${arg}".` };
+    positional.push(arg.trim());
+  }
+  if (positional.length === 0) return { ok: false, error: 'Which sandbox? Pass its current name, then the new one.' };
+  if (positional.length === 1) {
+    return { ok: false, error: `What should "${positional[0]}" be called? Pass the new name too.` };
+  }
+  if (positional.length > 2) {
+    return { ok: false, error: `Unexpected extra argument "${positional[2]}" (rename takes a current name and a new one).` };
+  }
+  return { ok: true, from: positional[0], to: positional[1] };
+}
+
+export function findSandbox(rows, input) {
+  const wanted = (input ?? '').trim();
+  return rows.find((row) => row.name === wanted) ?? rows.find((row) => row.container === wanted) ?? null;
+}

package/dist/bin/machine-identity.js

@@ -0,0 +1,221 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+
+
+import { execFileSync } from 'node:child_process';
+import { createHash, randomUUID } from 'node:crypto';
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { hostname, networkInterfaces, platform } from 'node:os';
+import { ensureMachineDir, machineFile } from './machine-layout.js';
+
+const BINDING_VERSION = 1;
+
+const MAX_REMEMBERED_MACS = 32;
+
+const NULL_MAC = '00:00:00:00:00:00';
+
+const DISABLE_ENV = 'MINIONRY_NO_CLONE_DETECTION';
+
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+
+function runCommand(file, args) {
+  try {
+    return execFileSync(file, args, {
+      encoding: 'utf-8',
+      timeout: 2000,
+      stdio: ['ignore', 'pipe', 'ignore'],
+    });
+  } catch {
+    return null;
+  }
+}
+
+function linuxMachineId() {
+  for (const path of ['/etc/machine-id', '/var/lib/dbus/machine-id']) {
+    try {
+      if (!existsSync(path)) continue;
+      const value = readFileSync(path, 'utf-8').trim();
+      if (value) return value;
+    } catch {
+    }
+  }
+  return null;
+}
+
+function darwinMachineId() {
+  const out = runCommand('/usr/sbin/ioreg', ['-rd1', '-c', 'IOPlatformExpertDevice']);
+  return out?.match(/"IOPlatformUUID"\s*=\s*"([^"]+)"/)?.[1] ?? null;
+}
+
+function windowsMachineId() {
+  const out = runCommand('reg', [
+    'query',
+    'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography',
+    '/v',
+    'MachineGuid',
+  ]);
+  return out?.match(/MachineGuid\s+REG_SZ\s+(\S+)/i)?.[1] ?? null;
+}
+
+const MACHINE_ID_SOURCES = Object.freeze({
+  linux: linuxMachineId,
+  darwin: darwinMachineId,
+  win32: windowsMachineId,
+});
+
+export function readPlatformMachineId() {
+  try {
+    return MACHINE_ID_SOURCES[platform()]?.() ?? null;
+  } catch {
+    return null;
+  }
+}
+
+export function readMacAddresses() {
+  const found = new Set();
+  try {
+    for (const addresses of Object.values(networkInterfaces())) {
+      for (const address of addresses ?? []) {
+        if (address.internal) continue;
+        const mac = address.mac?.toLowerCase();
+        if (mac && mac !== NULL_MAC) found.add(mac);
+      }
+    }
+  } catch {
+  }
+  return [...found].sort();
+}
+
+export function collectMachineSignals() {
+  return {
+    machineId: readPlatformMachineId(),
+    macs: readMacAddresses(),
+    hostname: hostname() || null,
+  };
+}
+
+export function fingerprintOf(signals) {
+  const canonical = JSON.stringify({
+    machineId: signals.machineId ?? '',
+    macs: [...signals.macs].sort(),
+    hostname: signals.hostname ?? '',
+  });
+  return createHash('sha256').update(canonical).digest('hex').slice(0, 32);
+}
+
+
+export function classifyMachineChange(recorded, current) {
+  if (!recorded) return 'unknown';
+
+  const knownMacs = recorded.macs ?? [];
+  const haveMacsBothSides = knownMacs.length > 0 && current.macs.length > 0;
+
+  if (haveMacsBothSides && current.macs.some((mac) => knownMacs.includes(mac))) {
+    return 'same';
+  }
+
+  if (!haveMacsBothSides) return 'unknown';
+
+  const machineIdDiffers =
+    !!recorded.machineId && !!current.machineId && recorded.machineId !== current.machineId;
+  const hostnameDiffers =
+    !!recorded.hostname && !!current.hostname && recorded.hostname !== current.hostname;
+
+  return machineIdDiffers || hostnameDiffers ? 'cloned' : 'unknown';
+}
+
+
+function bindingPath() {
+  return machineFile('clientIdBinding');
+}
+
+function readBinding() {
+  try {
+    const path = bindingPath();
+    if (!existsSync(path)) return null;
+    const parsed = JSON.parse(readFileSync(path, 'utf-8'));
+    if (parsed?.v !== BINDING_VERSION || typeof parsed.clientId !== 'string') return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+
+function writeBinding(clientId, signals, knownMacs) {
+  try {
+    ensureMachineDir('state');
+    const record = {
+      v: BINDING_VERSION,
+      clientId,
+      machineId: signals.machineId,
+      hostname: signals.hostname,
+      macs: knownMacs.slice(0, MAX_REMEMBERED_MACS),
+      boundAt: new Date().toISOString(),
+    };
+    writeFileSync(bindingPath(), JSON.stringify(record, null, 2), { mode: 0o600 });
+  } catch {
+  }
+}
+
+function mergeKnownMacs(recorded, current) {
+  return [...new Set([...current.macs, ...(recorded?.macs ?? [])])];
+}
+
+
+function readClientIdFile() {
+  try {
+    const path = machineFile('clientId');
+    if (!existsSync(path)) return null;
+    const id = readFileSync(path, 'utf-8').trim();
+    return UUID_RE.test(id) ? id : null;
+  } catch {
+    return null;
+  }
+}
+
+function writeClientIdFile(clientId) {
+  ensureMachineDir('state');
+  writeFileSync(machineFile('clientId'), clientId, 'utf-8');
+  return clientId;
+}
+
+export function resolveClientId() {
+  const signals = collectMachineSignals();
+  const fingerprint = fingerprintOf(signals);
+  const existing = readClientIdFile();
+  const binding = readBinding();
+
+  if (!existing) {
+    const minted = writeClientIdFile(randomUUID());
+    writeBinding(minted, signals, signals.macs);
+    return { clientId: minted, fingerprint, rotated: false, previousClientId: null };
+  }
+
+  const baseline = binding?.clientId === existing ? binding : null;
+  const verdict = process.env[DISABLE_ENV] ? 'same' : classifyMachineChange(baseline, signals);
+
+  if (verdict !== 'cloned') {
+    writeBinding(existing, signals, mergeKnownMacs(baseline, signals));
+    return { clientId: existing, fingerprint, rotated: false, previousClientId: null };
+  }
+
+  const minted = writeClientIdFile(randomUUID());
+  writeBinding(minted, signals, signals.macs);
+  return { clientId: minted, fingerprint, rotated: true, previousClientId: existing };
+}
+
+export function rotateClientId() {
+  const signals = collectMachineSignals();
+  const previousClientId = readClientIdFile();
+  const minted = writeClientIdFile(randomUUID());
+  writeBinding(minted, signals, signals.macs);
+  return {
+    clientId: minted,
+    fingerprint: fingerprintOf(signals),
+    rotated: true,
+    previousClientId,
+  };
+}
+
+export const CLONE_DETECTION_DISABLE_ENV = DISABLE_ENV;