@north-light/cli 0.3.592 → 0.3.594

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/cli",
-  "version": "0.3.592",
+  "version": "0.3.594",
   "description": "crtr — agent runtime with memory, plugins, and marketplaces",
   "type": "module",
   "main": "dist/index.js",
@@ -145,7 +145,7 @@
   },
   "license": "UNLICENSED",
   "dependencies": {
-    "@north-light/identity": "0.3.592",
+    "@north-light/identity": "0.3.594",
     "@earendil-works/chord": "1.1.0",
     "@earendil-works/pi-agent-core": "1.1.0",
     "@earendil-works/pi-ai": "1.1.0",

package/packages/crouter-identity/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/identity",
-  "version": "0.3.592",
+  "version": "0.3.594",
   "description": "Northlight access-token verification and scope rules",
   "type": "module",
   "main": "./dist/index.js",

package/runtime.lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@north-light/cli",
-  "version": "0.3.592",
+  "version": "0.3.594",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@north-light/cli",
-      "version": "0.3.592",
+      "version": "0.3.594",
       "hasInstallScript": true,
       "license": "UNLICENSED",
       "workspaces": [
@@ -28,7 +28,7 @@
         "@milkdown/preset-gfm": "^7.22.3",
         "@milkdown/prose": "^7.22.3",
         "@milkdown/utils": "^7.22.3",
-        "@north-light/identity": "0.3.592",
+        "@north-light/identity": "0.3.594",
         "cron-parser": "^5.6.0",
         "esbuild": "^0.27.7",
         "jose": "^6.2.12",
@@ -11956,17 +11956,17 @@
     },
     "packages/crouter-api": {
       "name": "@north-light/api",
-      "version": "0.3.592",
+      "version": "0.3.594",
       "license": "UNLICENSED"
     },
     "packages/crouter-env-docker": {
       "name": "@north-light/env-docker",
-      "version": "0.3.592",
+      "version": "0.3.594",
       "license": "UNLICENSED"
     },
     "packages/crouter-identity": {
       "name": "@north-light/identity",
-      "version": "0.3.592",
+      "version": "0.3.594",
       "license": "UNLICENSED",
       "dependencies": {
         "jose": "^6.2.1"
@@ -11974,21 +11974,21 @@
     },
     "packages/crouter-plugin": {
       "name": "@north-light/plugin",
-      "version": "0.3.592",
+      "version": "0.3.594",
       "license": "UNLICENSED",
       "dependencies": {
-        "@north-light/api": "0.3.592",
-        "@north-light/identity": "0.3.592"
+        "@north-light/api": "0.3.594",
+        "@north-light/identity": "0.3.594"
       }
     },
     "packages/crouter-sdk": {
       "name": "@north-light/sdk",
-      "version": "0.3.592",
+      "version": "0.3.594",
       "license": "UNLICENSED",
       "dependencies": {
-        "@north-light/api": "0.3.592",
-        "@north-light/identity": "0.3.592",
-        "@north-light/plugin": "0.3.592",
+        "@north-light/api": "0.3.594",
+        "@north-light/identity": "0.3.594",
+        "@north-light/plugin": "0.3.594",
         "jose": "^6.2.1"
       },
       "bin": {

package/scripts/sandbox-bootstrap.sh

@@ -5,8 +5,11 @@
 # CRTR_RELEASE_URL, CRTR_RELEASE_SHA256 and the rest the runner set. Once per sandbox it creates the `crtr` user
 # (`crtrd` refuses root) and its directories; it installs the release if it is absent (download, sha256 check,
 # unpack into a temp dir, rename into place, keep three), then hands over to `crtr-sandbox-start` as `crtr`.
-# The node token reaches the start script on stdin, never in its environment, so no process of user `crtr` can
-# read it from /proc. A failed download or checksum exits non-zero and prints `crtr-sandbox-start: failed <reason>`
+# The node token reaches the start script on stdin, never in its environment, so it is in no process's
+# /proc/<pid>/environ. It is not hidden from user `crtr` otherwise: the broker holds it in memory, and the agent's
+# shell runs as the same user (design-fleet D13/D78 scope the token to this execution's node, nothing more). The final `exec` chain forks nothing (busybox `nsenter -S/-G` execs, and the token goes in as a here-document, not a pipe, which would
+# put a forking shell in front of it), so the process Blaxel tracks as `broker-<execution id>` is the start script itself: stopping it reaches
+# the node and the broker, and its exit means the broker is gone. A failed download or checksum exits non-zero and prints `crtr-sandbox-start: failed <reason>`
 # as its last line (the runner's `status` reports that reason).
 set -eu
 
@@ -51,5 +54,8 @@ done
 
 token=$CRTR_NODE_TOKEN
 unset CRTR_NODE_TOKEN
-# `su -p` keeps the rest of the environment; the start script derives HOME and the layout itself.
-printf '%s' "$token" | exec su -p -s /bin/sh "$RUN_USER" -c "exec node '$RELEASE_DIR/scripts/sandbox-start.mjs'"
+# busybox `su` forks, which leaves the tracked process a wrapper whose children outlive a stop; `nsenter` with no namespace flag only sets the
+# uid and gid, then execs. It keeps the environment (as `su -p` did); the start script derives HOME and the layout itself.
+exec nsenter -S "$(id -u "$RUN_USER")" -G "$(id -g "$RUN_USER")" node "$RELEASE_DIR/scripts/sandbox-start.mjs" <<EOT
+$token
+EOT

package/scripts/sandbox-start.mjs

@@ -344,34 +344,71 @@ async function start(env) {
   gitConfig('credential.https://github.com.helper', join(releaseDir, 'scripts', 'git-credential-crtr'));
   if (bundle.git_identity) { gitConfig('user.name', bundle.git_identity.name); gitConfig('user.email', bundle.git_identity.email); }
 
-  // 5.5 plugins, once per revision.
+  // 5.5 plugins, once per revision. The person's install rows are already authoritative on the control plane, and no broker or daemon exists yet, so
+  // this materializes each plugin's code the way `pkg plugin install` lays it out in the user scope (`<runtime>/marketplaces/<name>`, `<runtime>/plugins/<plugin>`)
+  // with git alone; the release CLI would load the person's settings from a daemon this start cannot reach.
   const marker = join(work, '.crtr', 'plugins-revision');
   const have = existsSync(marker) ? readFileSync(marker, 'utf8').trim() : null;
-  if (have !== String(bundle.plugins_revision) && bundle.plugins.length > 0) {
-    const crtr = join(releaseDir, 'bin', 'crtr');
-    const pluginEnv = { ...gitEnv, NPM_CONFIG_PREFIX: join(home, '.npm-global'), CRTR_HOME: root, CRTR_NO_AUTO_INIT: '1' };
-    const crtrRun = (args) => run(process.execPath, [crtr, ...args], { env: pluginEnv, timeout: 300_000 });
+  if (have !== String(bundle.plugins_revision)) {
+    const pluginsDir = join(root, 'runtime', 'plugins');
+    const marketplacesDir = join(root, 'runtime', 'marketplaces');
+    const cloneEnv = { ...gitEnv, GIT_TERMINAL_PROMPT: '0' };
     const detail = (r) => (r.stderr || r.stdout || '').slice(0, 300);
-    // A plugin of a marketplace is installed as `<marketplace name>/<plugin>`; the bundle names only the marketplace's url and ref, so the name is what
-    // `pkg market add` reports. Adding re-clones, so a marketplace added once per start is current. A plugin already installed (an earlier revision) is
-    // removed first, since install refuses an installed name.
+    const cloneInto = (url, ref, dest) => {
+      const r = run('git', ['clone', '--depth', '1', ...(ref ? ['--branch', ref] : []), url, dest], { env: cloneEnv, timeout: 300_000 });
+      return r.status === 0 ? null : detail(r) || `git clone exited ${r.status}`;
+    };
+    // The directory holds exactly the bundle's plugins: one an earlier revision installed and this one no longer lists is removed.
+    let current = null;
+    try {
+    const wanted = new Set(bundle.plugins.map((plugin) => plugin.name));
+    if (existsSync(pluginsDir)) for (const name of readdirSync(pluginsDir)) if (!wanted.has(name)) rmSync(join(pluginsDir, name), { recursive: true, force: true });
+    const readJson = (path) => { try { return JSON.parse(readFileSync(path, 'utf8')); } catch { return null; } };
+    // A plugin of a marketplace is installed as `<plugin>` from the marketplace the bundle's url and ref name. Cloning again each start keeps a marketplace
+    // current; a plugin installed by an earlier revision is replaced.
     const marketplaces = new Map();
     for (const plugin of bundle.plugins) {
+      current = plugin.name;
       if ('path' in plugin.source) throw new StartFailure('plugin_source_unreachable', `${plugin.name}: its source is ${plugin.source.path} on the machine that registered it, which a sandbox cannot read`);
       const { url, ref } = plugin.source.marketplace;
       if (!url) throw new StartFailure('plugin_source_unreachable', `${plugin.name}: its marketplace has no url`);
+      const fail = (message) => new StartFailure('plugin_install_failed', `${plugin.name}: ${message}`);
+      if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(plugin.name)) throw fail('invalid plugin name');
       const key = `${url}\0${ref ?? ''}`;
       if (!marketplaces.has(key)) {
-        const added = crtrRun(['--json', 'pkg', 'market', 'add', url, ...(ref ? ['--ref', ref] : []), '--scope', 'user']);
-        let name;
-        try { name = JSON.parse(added.stdout).name; } catch { /* reported below */ }
-        if (added.status !== 0 || typeof name !== 'string') throw new StartFailure('plugin_install_failed', `${plugin.name}: marketplace ${url}: ${detail(added)}`);
-        marketplaces.set(key, name);
+        mkdirSync(marketplacesDir, { recursive: true });
+        const staging = join(marketplacesDir, `.clone-${process.pid}-${marketplaces.size}`);
+        rmSync(staging, { recursive: true, force: true });
+        const cloneError = cloneInto(url, ref, staging);
+        if (cloneError !== null) throw fail(`marketplace ${url}: ${cloneError}`);
+        const manifest = readJson(join(staging, '.crouter-marketplace', 'marketplace.json'));
+        if (typeof manifest?.name !== 'string' || !Array.isArray(manifest.plugins)) { rmSync(staging, { recursive: true, force: true }); throw fail(`marketplace ${url}: not a valid marketplace`); }
+        if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(manifest.name)) { rmSync(staging, { recursive: true, force: true }); throw fail(`marketplace ${url}: invalid marketplace name ${JSON.stringify(manifest.name)}`); }
+        const dest = join(marketplacesDir, manifest.name);
+        rmSync(dest, { recursive: true, force: true });
+        renameSync(staging, dest);
+        marketplaces.set(key, { dest, manifest });
       }
-      const removed = crtrRun(['pkg', 'plugin', 'remove', plugin.name, '--scope', 'user']);
-      if (removed.status !== 0 && !/not found/i.test(removed.stderr + removed.stdout)) throw new StartFailure('plugin_install_failed', `${plugin.name}: remove: ${detail(removed)}`);
-      const installed = crtrRun(['pkg', 'plugin', 'install', `${marketplaces.get(key)}/${plugin.name}`, '--scope', 'user']);
-      if (installed.status !== 0) throw new StartFailure('plugin_install_failed', `${plugin.name}: ${detail(installed)}`);
+      const { dest: marketplaceDir, manifest } = marketplaces.get(key);
+      const entry = manifest.plugins.find((candidate) => candidate?.name === plugin.name);
+      if (!entry || typeof entry.source !== 'string') throw fail(`not found in marketplace ${manifest.name}`);
+      const target = join(pluginsDir, plugin.name);
+      mkdirSync(pluginsDir, { recursive: true });
+      rmSync(target, { recursive: true, force: true });
+      if (/^(https?:\/\/|git@|ssh:\/\/|file:\/\/)/.test(entry.source) || entry.source.endsWith('.git')) {
+        const cloneError = cloneInto(entry.source, undefined, target);
+        if (cloneError !== null) throw fail(cloneError);
+      } else {
+        const source = resolve(marketplaceDir, entry.source);
+        if (!existsSync(source) || !within(realpathSync(marketplaceDir), realpathSync(source))) throw fail(`plugin source ${entry.source} is not in marketplace ${manifest.name}`);
+        symlinkSync(source, target, 'dir');
+      }
+      if (readJson(join(target, '.crouter-plugin', 'plugin.json')) === null) { rmSync(target, { recursive: true, force: true }); throw fail('its .crouter-plugin/plugin.json is missing or invalid'); }
+    }
+    } catch (error) {
+      // A filesystem error (mkdir, remove, rename, symlink) is an install failure of the plugin being installed, not a generic start failure.
+      if (error instanceof StartFailure) throw error;
+      throw new StartFailure('plugin_install_failed', `${current ?? 'plugins'}: ${error.message}`.slice(0, 300));
     }
   }
   if (have !== String(bundle.plugins_revision)) { mkdirSync(dirname(marker), { recursive: true }); writeFileSync(marker, String(bundle.plugins_revision)); }