@myagentroam/agent 0.11.35 → 0.11.37

package/dist/sandbox/linux/bubblewrap-seccomp.js

@@ -0,0 +1,43 @@
+import { policyInvalid } from './sandbox-error.js';
+export function seccompFilter(architecture) {
+    const policy = syscallPolicy(architecture);
+    const filters = [
+        [0x20, 0, 0, 4],
+        [0x15, 1, 0, policy.auditArchitecture],
+        [0x06, 0, 0, 0x80000000],
+        [0x20, 0, 0, 0]
+    ];
+    if (architecture === 'x64')
+        filters.push([0x54, 0, 0, 0x40000000], [0x15, 1, 0, 0], [0x06, 0, 0, 0x80000000], [0x20, 0, 0, 0]);
+    for (const syscall of policy.blockedSyscalls)
+        filters.push([0x15, 0, 1, syscall], [0x06, 0, 0, 0x00050001]);
+    filters.push([0x06, 0, 0, 0x7fff0000]);
+    const buffer = Buffer.alloc(filters.length * 8);
+    for (const [index, [code, jumpTrue, jumpFalse, value]] of filters.entries()) {
+        const offset = index * 8;
+        buffer.writeUInt16LE(code, offset);
+        buffer.writeUInt8(jumpTrue, offset + 2);
+        buffer.writeUInt8(jumpFalse, offset + 3);
+        buffer.writeUInt32LE(value >>> 0, offset + 4);
+    }
+    return buffer;
+}
+function syscallPolicy(architecture) {
+    if (architecture === 'x64')
+        return {
+            auditArchitecture: 0xc000003e,
+            blockedSyscalls: [
+                101, 155, 165, 166, 175, 176, 246, 248, 249, 250, 272, 298, 304, 308, 313, 321, 323, 428,
+                429, 430, 431, 432, 442
+            ]
+        };
+    if (architecture === 'arm64')
+        return {
+            auditArchitecture: 0xc00000b7,
+            blockedSyscalls: [
+                39, 40, 41, 97, 104, 105, 106, 117, 217, 218, 219, 241, 265, 268, 273, 280, 282, 428, 429,
+                430, 431, 432, 442
+            ]
+        };
+    throw policyInvalid();
+}

package/dist/sandbox/linux/index.d.ts

@@ -1,2 +1,3 @@
-export { BubblewrapSandboxExecutor, probeBubblewrapSandbox } from './bubblewrap-sandbox-executor.js';
+export { BubblewrapSandboxExecutor } from './bubblewrap-sandbox-executor.js';
+export { probeBubblewrapSandbox } from './bubblewrap-probe.js';
 export { LINUX_BUBBLEWRAP_SANDBOX_POLICY_VERSION, type BubblewrapSandboxExecutorOptions, type BubblewrapSandboxProfile, type LinuxSandboxMount, type LinuxSandboxNetworkMode, type LinuxSandboxTemporaryDirectory, type LinuxSandboxWorkingDirectory } from './profile.js';

package/dist/sandbox/linux/index.js

@@ -1,2 +1,3 @@
-export { BubblewrapSandboxExecutor, probeBubblewrapSandbox } from './bubblewrap-sandbox-executor.js';
+export { BubblewrapSandboxExecutor } from './bubblewrap-sandbox-executor.js';
+export { probeBubblewrapSandbox } from './bubblewrap-probe.js';
 export { LINUX_BUBBLEWRAP_SANDBOX_POLICY_VERSION } from './profile.js';

package/dist/sandbox/linux/sandbox-error.d.ts

@@ -0,0 +1,4 @@
+import { AgentError } from '../../error.js';
+export declare function unavailable(_cause?: unknown): AgentError;
+export declare function policyInvalid(_cause?: unknown): AgentError;
+export declare function withCleanupDiagnostics(error: AgentError, failures: readonly ('close' | 'remove' | 'terminate' | 'exit_timeout')[]): AgentError;

package/dist/sandbox/linux/sandbox-error.js

@@ -0,0 +1,14 @@
+import { AgentError } from '../../error.js';
+export function unavailable(_cause) {
+    return new AgentError('SANDBOX_UNAVAILABLE', 'Bubblewrap sandbox is unavailable.');
+}
+export function policyInvalid(_cause) {
+    return new AgentError('SANDBOX_POLICY_INVALID', 'Sandbox policy is invalid.');
+}
+export function withCleanupDiagnostics(error, failures) {
+    if (failures.length === 0)
+        return error;
+    return new AgentError(error.code, error.publicMessage, {
+        details: { cleanup: [...new Set(failures)] }
+    });
+}

package/dist/sandbox/linux/sandbox-mounts.d.ts

@@ -0,0 +1,13 @@
+import type { LocalProcessSpawnRequest } from '../../process/contracts.js';
+import type { BubblewrapSandboxProfile, BubblewrapSandboxExecutorOptions, LinuxSandboxMount } from './profile.js';
+export interface SandboxMount {
+    readonly source: string;
+    readonly destination: string;
+    readonly access: LinuxSandboxMount['access'];
+}
+export declare function resolveMounts(profile: BubblewrapSandboxProfile): Promise<readonly SandboxMount[]>;
+export declare function workingDirectory(request: LocalProcessSpawnRequest, mounts: readonly SandboxMount[], configuration: BubblewrapSandboxExecutorOptions['profile']['workingDirectory']): Promise<string>;
+export declare function sandboxDirectoryArguments(mounts: readonly SandboxMount[]): string[];
+/** Host assets retain absolute module URLs, but cannot overlay or widen profile mounts. */
+export declare function trustedRuntimeMounts(directories: readonly string[], mounts: readonly SandboxMount[]): Promise<readonly SandboxMount[]>;
+export declare function within(parent: string, candidate: string): boolean;

package/dist/sandbox/linux/sandbox-mounts.js

@@ -0,0 +1,221 @@
+import { lstat, realpath } from 'node:fs/promises';
+import { isAbsolute, join, posix, relative, resolve, sep } from 'node:path';
+import { AgentError } from '../../error.js';
+import { policyInvalid } from './sandbox-error.js';
+const GENERATED_IMAGES_SANDBOX_ROOT = '/home/mar/.mar/agent/sessions';
+const RESERVED_SANDBOX_ROOTS = [
+    '/home/mar',
+    '/runtime',
+    '/usr',
+    '/bin',
+    '/sbin',
+    '/lib',
+    '/lib64',
+    '/etc',
+    '/proc',
+    '/dev',
+    '/run',
+    '/tmp'
+];
+export async function resolveMounts(profile) {
+    const mounts = [];
+    for (const definition of profile.mounts ?? []) {
+        mounts.push({
+            source: await secureDirectory(definition.source),
+            destination: sandboxDestination(definition.destination, definition.access),
+            access: definition.access
+        });
+    }
+    if (profile.temporaryDirectory?.kind === 'MOUNT')
+        mounts.push({
+            source: await secureDirectory(profile.temporaryDirectory.source),
+            destination: '/tmp',
+            access: 'READ_WRITE'
+        });
+    for (const [index, mount] of mounts.entries()) {
+        for (const other of mounts.slice(index + 1)) {
+            if (mount.destination === other.destination)
+                throw policyInvalid();
+            const parent = withinSandboxPath(mount.destination, other.destination)
+                ? mount
+                : withinSandboxPath(other.destination, mount.destination)
+                    ? other
+                    : undefined;
+            if (parent !== undefined) {
+                const child = parent === mount ? other : mount;
+                if (parent.access !== 'READ_ONLY' || child.access !== 'READ_WRITE')
+                    throw policyInvalid();
+            }
+            if (mount.source === other.source) {
+                if (mount.access !== other.access)
+                    throw policyInvalid();
+                continue;
+            }
+            if (within(mount.source, other.source) || within(other.source, mount.source))
+                throw policyInvalid();
+        }
+    }
+    const ordered = [...mounts].sort(compareMountDestinations);
+    await prepareNestedMountDestinations(ordered);
+    return ordered;
+}
+async function secureDirectory(path) {
+    if (!isAbsolute(path))
+        throw policyInvalid();
+    try {
+        const metadata = await lstat(path);
+        if (!metadata.isDirectory() || metadata.isSymbolicLink())
+            throw policyInvalid();
+        const canonical = await realpath(path);
+        if (canonical !== resolve(path))
+            throw policyInvalid();
+        return canonical;
+    }
+    catch (error) {
+        if (error instanceof AgentError)
+            throw error;
+        throw policyInvalid(error);
+    }
+}
+export async function workingDirectory(request, mounts, configuration) {
+    const selected = configuration ?? { kind: 'SANDBOX', path: '/tmp' };
+    if (selected.kind === 'REQUEST')
+        return await sandboxPath(request.cwd, mounts);
+    const path = normalizedSandboxPath(selected.path);
+    if (path === '/tmp' || path === '/home/mar')
+        return path;
+    const mount = [...mounts]
+        .sort((left, right) => right.destination.length - left.destination.length)
+        .find((candidate) => path === candidate.destination || withinSandboxPath(candidate.destination, path));
+    if (mount === undefined)
+        throw policyInvalid();
+    const suffix = posix.relative(mount.destination, path).split('/').filter(Boolean);
+    await secureDirectory(join(mount.source, ...suffix));
+    return path;
+}
+async function sandboxPath(path, mounts) {
+    const canonical = await secureDirectory(path);
+    const mount = [...mounts]
+        .sort((left, right) => right.source.length - left.source.length)
+        .find((candidate) => canonical === candidate.source || within(candidate.source, canonical));
+    if (mount === undefined)
+        throw policyInvalid();
+    const suffix = relative(mount.source, canonical).split(sep).filter(Boolean);
+    return suffix.length === 0 ? mount.destination : posix.join(mount.destination, ...suffix);
+}
+function sandboxDestination(path, access) {
+    const normalized = normalizedSandboxPath(path);
+    if (generatedImagesSandboxPath(normalized)) {
+        if (access !== 'READ_ONLY')
+            throw policyInvalid();
+        return normalized;
+    }
+    if (normalized === '/' ||
+        RESERVED_SANDBOX_ROOTS.some((root) => normalized === root ||
+            withinSandboxPath(root, normalized) ||
+            withinSandboxPath(normalized, root)))
+        throw policyInvalid();
+    return normalized;
+}
+function normalizedSandboxPath(path) {
+    if (!path.startsWith('/') ||
+        path.includes('\0') ||
+        path.includes('\\') ||
+        posix.normalize(path) !== path ||
+        posix.resolve(path) !== path)
+        throw policyInvalid();
+    return path;
+}
+function generatedImagesSandboxPath(path) {
+    const segments = posix.relative(GENERATED_IMAGES_SANDBOX_ROOT, path).split('/').filter(Boolean);
+    return (withinSandboxPath(GENERATED_IMAGES_SANDBOX_ROOT, path) &&
+        segments.length === 2 &&
+        safePathSegment(segments[0]) &&
+        segments[1] === 'generated_images');
+}
+function safePathSegment(value) {
+    return (value.length > 0 &&
+        value.length <= 255 &&
+        value !== '.' &&
+        value !== '..' &&
+        !value.includes('/') &&
+        !value.includes('\\'));
+}
+function compareMountDestinations(left, right) {
+    const depth = left.destination.split('/').filter(Boolean).length -
+        right.destination.split('/').filter(Boolean).length;
+    return depth === 0 ? left.destination.localeCompare(right.destination, 'en-US') : depth;
+}
+async function prepareNestedMountDestinations(mounts) {
+    for (const [index, mount] of mounts.entries()) {
+        const parent = mounts
+            .slice(0, index)
+            .filter((candidate) => withinSandboxPath(candidate.destination, mount.destination))
+            .sort((left, right) => right.destination.length - left.destination.length)[0];
+        if (parent === undefined)
+            continue;
+        const suffix = relative(parent.destination, mount.destination).split(sep).filter(Boolean);
+        const target = join(parent.source, ...suffix);
+        try {
+            const metadata = await lstat(target);
+            if (!metadata.isDirectory() ||
+                metadata.isSymbolicLink() ||
+                (await realpath(target)) !== resolve(target))
+                throw policyInvalid();
+        }
+        catch (error) {
+            if (error instanceof AgentError)
+                throw error;
+            throw policyInvalid(error);
+        }
+    }
+}
+export function sandboxDirectoryArguments(mounts) {
+    const directories = new Set(['/home', '/home/mar']);
+    for (const mount of mounts) {
+        const segments = mount.destination.split('/').filter(Boolean);
+        let current = '';
+        for (const segment of segments) {
+            current = `${current}/${segment}`;
+            directories.add(current);
+        }
+    }
+    return [...directories]
+        .sort((left, right) => {
+        const depth = left.split('/').filter(Boolean).length - right.split('/').filter(Boolean).length;
+        return depth === 0 ? left.localeCompare(right, 'en-US') : depth;
+    })
+        .flatMap((directory) => ['--dir', directory]);
+}
+/** Host assets retain absolute module URLs, but cannot overlay or widen profile mounts. */
+export async function trustedRuntimeMounts(directories, mounts) {
+    if (!Array.isArray(directories) || directories.length > 16)
+        throw policyInvalid();
+    const result = [];
+    for (const path of directories) {
+        if (typeof path !== 'string' || path.length > 4096)
+            throw policyInvalid();
+        const source = await secureDirectory(path);
+        if (source.split('/').filter(Boolean).length < 3)
+            throw policyInvalid();
+        const overlaps = (left, right) => left === right || within(left, right) || within(right, left);
+        if (mounts.some((mount) => overlaps(source, mount.source) || overlaps(source, mount.destination)) ||
+            ['/home/mar', '/runtime', '/etc', '/proc', '/dev', '/run', '/tmp'].some((root) => overlaps(source, root)))
+            throw policyInvalid();
+        // These trees are already exposed read-only by the fixed runtime policy.
+        if (['/usr', '/bin', '/sbin', '/lib', '/lib64'].some((root) => within(root, source)))
+            continue;
+        if (result.some((mount) => overlaps(source, mount.source)))
+            throw policyInvalid();
+        result.push({ source, destination: source, access: 'READ_ONLY' });
+    }
+    return result;
+}
+export function within(parent, candidate) {
+    const relation = relative(parent, candidate);
+    return relation.length > 0 && relation !== '..' && !relation.startsWith(`..${sep}`);
+}
+function withinSandboxPath(parent, candidate) {
+    const relation = posix.relative(parent, candidate);
+    return relation.length > 0 && relation !== '..' && !relation.startsWith('../');
+}

package/dist/sandbox/linux/sandbox-process.d.ts

@@ -0,0 +1,3 @@
+import type { ChildProcessWithoutNullStreams } from 'node:child_process';
+/** Signal only the detached group created for this child; never signal the host's group. */
+export declare function terminateSandboxChild(child: ChildProcessWithoutNullStreams, detached: boolean): boolean;

package/dist/sandbox/linux/sandbox-process.js

@@ -0,0 +1,32 @@
+/** Signal only the detached group created for this child; never signal the host's group. */
+export function terminateSandboxChild(child, detached) {
+    const pid = child.pid;
+    if (pid !== undefined && (!Number.isInteger(pid) || pid <= 1 || pid === process.pid))
+        return false;
+    if (detached && pid !== undefined && pid > 1) {
+        try {
+            process.kill(-pid, 'SIGKILL');
+            return true;
+        }
+        catch (error) {
+            if (error.code !== 'ESRCH') {
+                // Even if group termination failed, do not abandon a live direct child.
+                if (child.exitCode === null && child.signalCode === null) {
+                    try {
+                        child.kill('SIGKILL');
+                    }
+                    catch {
+                        // The false result reports the unconfirmed group and child termination.
+                    }
+                }
+                return false;
+            }
+            if (child.exitCode !== null || child.signalCode !== null)
+                return true;
+            // A spawn failure may not have created the detached group yet.
+        }
+    }
+    if (child.exitCode !== null || child.signalCode !== null)
+        return true;
+    return child.kill('SIGKILL');
+}

package/dist/session/store/jsonl/images.js

@@ -35,7 +35,7 @@ export async function copyGeneratedImages(sourceSessionDirectory, targetSessionD
     for (const fileName of fileNames) {
         const path = join(target, fileName);
         await copyFile(join(source, fileName), path);
-        const handle = await open(path, 'r');
+        const handle = await open(path, 'r+');
         try {
             await handle.sync();
         }

package/dist/session/store/jsonl/jsonl-migration.js

@@ -97,7 +97,7 @@ async function copyOptionalFile(source, target) {
     if (!sourceInfo.isFile())
         return;
     await copyFile(source, target);
-    const handle = await open(target, 'r');
+    const handle = await open(target, 'r+');
     await syncAndClose(handle);
 }
 function corruptHistory() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@myagentroam/agent",
-  "version": "0.11.35",
+  "version": "0.11.37",
   "description": "Embeddable MAR coding agent SDK and CLI.",
   "license": "Apache-2.0",
   "type": "module",