@quantiya/codevibe-core 2.0.81 → 2.0.82

package/dist/orchestration-shell/index.d.ts

@@ -605,6 +605,22 @@ export declare function parseTaskCommand(text: string): {
         ordinal: number | null;
     } | null;
 };
+export declare const AGY_ADVISORY_LISTING_MAX_ENTRIES = 500;
+export declare const AGY_ADVISORY_LISTING_MAX_BYTES = 16384;
+export declare const AGY_ADVISORY_IGNORED_DIRS: Set<string>;
+/**
+ * Warning and instructions injected into advisory Antigravity turns under macOS Seatbelt sandbox.
+ * In plan mode under Seatbelt confinement, command execution is denied; files must be read via read_file.
+ */
+export declare const AGY_COMMAND_TOOL_SEATBELT_WARNING = "Your command tool cannot run in this sandbox: do not call it. CodeVibe listed the folder for you below (relative paths with '/' separator; literal backslashes escaped as \\\\, control characters escaped as \\xNN or \\uNNNN; a trailing / marks a folder). Read files with your file-reading tool, using absolute paths under the folder.";
+/**
+ * Bounds-checked directory walk for advisory Antigravity turns under macOS Seatbelt.
+ * In read-only plan mode, agy cannot execute command tools without PTY/tmpdir permissions.
+ * Providing this bounded folder listing directly in the prompt context allows agy to know
+ * the workspace layout and inspect target files via read_file without running shell commands.
+ */
+export declare function formatAgyWorkspaceListing(workdir: string, maxEntries?: number, maxBytes?: number): string;
+export declare function agyReadOnlyWorkdirPreamble(workdir: string, listing?: string): string;
 export declare function readOnlyAgentPrompt(args: {
     agent: LocalExecutorAgentKind;
     intent: AgentMentionIntent;
@@ -612,6 +628,7 @@ export declare function readOnlyAgentPrompt(args: {
     workingDir: string;
     allowRepositoryTools: boolean;
     hasRetainedPage?: boolean;
+    folderListing?: string;
 }): string;
 export declare function readOnlyAdvisoryAllowsRepositoryTools(_input: string): boolean;
 export declare function applyReadOnlyAdvisoryToolPolicy(agent: LocalExecutorAgentKind, plan: ReturnType<typeof buildImplementorArgv>, allowRepositoryTools: boolean, workingDir?: string, attachments?: readonly string[]): ReturnType<typeof buildImplementorArgv>;

package/dist/substrate/bwrap.d.ts

@@ -0,0 +1,93 @@
+import { type WorkspaceRootAuthority } from '../local-executor/workspace-authority';
+import type { HostDescendantReap } from '../local-executor/descendant-reaper';
+import type { CommandRunner, EgressFidelity, Substrate, SubstrateHandle, SubstrateProc, SubstrateSpec } from './types';
+export declare const SECCOMP_RET_KILL_PROCESS = 2147483648;
+export declare const SECCOMP_RET_ALLOW = 2147418112;
+export declare const SECCOMP_RET_ERRNO = 327680;
+export declare const EAFNOSUPPORT = 97;
+export declare const ENOSYS = 38;
+export declare const AUDIT_ARCH_X86_64 = 3221225534;
+export declare const AUDIT_ARCH_AARCH64 = 3221225655;
+export declare const AUDIT_ARCH_I386 = 1073741827;
+export declare const AUDIT_ARCH_ARM = 1073741864;
+/**
+ * Generates the exact 56-instruction classic-BPF seccomp filter (448 bytes)
+ * specified in WORKSPACE-HARDENING-DESIGN §6.2.
+ *
+ * Rules:
+ *  - socket(AF_VSOCK, …) and socket(AF_UNIX, …) → EAFNOSUPPORT (97)
+ *  - socketpair() → EAFNOSUPPORT unless type low 4 bits is SOCK_STREAM (1) or SOCK_SEQPACKET (5)
+ *  - io_uring_setup, io_uring_enter, io_uring_register → ENOSYS (38)
+ *  - Branches on ABI: x86_64, x32, i386 (socketcall SYS_SOCKET and SYS_SOCKETPAIR → ENOSYS),
+ *    aarch64, arm (socketcall SYS_SOCKET and SYS_SOCKETPAIR → ENOSYS)
+ *  - Any other ABI → SECCOMP_RET_KILL_PROCESS
+ *  - All other system calls allowed
+ */
+export declare function generateSeccompBpfFilter(): Buffer;
+export interface BubblewrapDeps {
+    runner?: CommandRunner;
+    platform?: NodeJS.Platform;
+    stateRoot?: string;
+    cacheRoot?: string;
+    desktopPid?: number;
+    uid?: number;
+    gid?: number;
+    homedir?: string;
+    fsShim?: {
+        lstatSync?: (p: string) => {
+            isSymbolicLink: () => boolean;
+        };
+        readlinkSync?: (p: string) => string;
+        existsSync?: (p: string) => boolean;
+        realpathSync?: (p: string) => string;
+    };
+}
+export declare class BubblewrapHandle implements SubstrateHandle {
+    readonly id: string;
+    readonly egressFidelity: EgressFidelity;
+    private readonly runner;
+    private readonly fullPrefix;
+    private readonly filterPath;
+    private readonly cleanupPaths;
+    private readonly workdir;
+    private readonly workdirAuthority?;
+    private readonly scratchAuthority?;
+    private proc;
+    private procExited;
+    private tornDown;
+    private teardownStarted;
+    private executed;
+    private inFlightExec;
+    private teardownPromise;
+    constructor(opts: {
+        id: string;
+        runner: CommandRunner;
+        fullPrefix: readonly string[];
+        filterPath: string;
+        cleanupPaths: string[];
+        workdir: string;
+        workdirAuthority?: WorkspaceRootAuthority;
+        scratchAuthority?: WorkspaceRootAuthority;
+    });
+    exec(argv: string[], opts: {
+        stdinTty: boolean;
+        timeoutMs?: number;
+        signal?: AbortSignal;
+        descendantReap?: HostDescendantReap;
+    }): Promise<SubstrateProc>;
+    teardown(): Promise<void>;
+    private performTeardown;
+}
+export declare class BubblewrapSubstrate implements Substrate {
+    private readonly runner;
+    private readonly platform;
+    private readonly stateRoot;
+    private readonly cacheRoot?;
+    private readonly desktopPid;
+    private readonly uid;
+    private readonly gid;
+    private readonly homedir;
+    private readonly fsShim?;
+    constructor(deps?: BubblewrapDeps);
+    launch(spec: SubstrateSpec): Promise<SubstrateHandle>;
+}

package/dist/substrate/command-runner.d.ts

@@ -17,6 +17,7 @@ export declare class ChildProcessCommandRunner implements CommandRunner {
         signal?: AbortSignal;
         env?: Readonly<Record<string, string>>;
         cwd?: string;
+        detached?: boolean;
         cwdAuthority?: WorkspaceRootAuthority;
         launchPathAuthorities?: readonly WorkspaceRootAuthority[];
         descendantReap?: HostDescendantReap;

package/dist/substrate/index.d.ts

@@ -4,6 +4,10 @@ export { DockerSubstrate } from "./docker";
 export type { DockerSubstrateDeps } from "./docker";
 export { SandboxExecSubstrate, buildSeatbeltProfile } from "./sandbox-exec";
 export type { SandboxExecDeps } from "./sandbox-exec";
+export { BubblewrapSubstrate, generateSeccompBpfFilter } from "./bwrap";
+export type { BubblewrapDeps } from "./bwrap";
+export { buildPastaArgv, buildSetprivPrefix, IN_TIER_CLEANUP_PASTA, IN_TIER_CLEANUP_BROKER, } from "./pasta";
+export type { PastaOptions } from "./pasta";
 export { SubstrateUnavailableError, SubstrateLaunchError } from "./errors";
 export { ChildProcessCommandRunner } from "./command-runner";
 export { HostEgressForwarder, defaultForwarderFactory } from "./forwarder";

package/dist/substrate/pasta.d.ts

@@ -0,0 +1,36 @@
+export interface PastaOptions {
+    /**
+     * The namespace-to-host TCP port of the per-spawn broker proxy.
+     * - 'none' (or omitted): no port forwarding (-T none) — used for broker-less Antigravity.
+     * - number: forwards 127.0.0.1:<port> and [::1]:<port> to host — used for web-browsing Claude/Codex.
+     */
+    brokerPort?: number | 'none';
+    /**
+     * DNS forwarding address. Defaults to 169.254.1.1 per §6.2.
+     */
+    dnsForward?: string;
+    /**
+     * Executable name or path for pasta. Defaults to 'pasta'.
+     */
+    pastaBin?: string;
+}
+/**
+ * Builds the pasta command line prefix up to and including the `--` terminator.
+ */
+export declare function buildPastaArgv(opts?: PastaOptions): string[];
+/**
+ * Builds the setpriv parent-death checking wrapper prefix per §6.2.
+ * Compares $PPID with the desktop PID and exits 97 if mismatched before execing payload.
+ */
+export declare function buildSetprivPrefix(desktopPid?: number): string[];
+/**
+ * In-tier bash step for the open-egress (pasta) tier:
+ * Closes all fds above 2, opens filter as fd 9, and execs bwrap with --seccomp 9.
+ */
+export declare const IN_TIER_CLEANUP_PASTA = "for f in /proc/self/fd/*; do n=${f##*/}; case $n in 0|1|2) ;; *) eval \"exec $n>&-\" 2>/dev/null;; esac; done; exec 9<\"$0\" && exec bwrap --seccomp 9 \"$@\"";
+/**
+ * In-tier bash step for the isolated broker tier (no pasta):
+ * Keeps fds 0-3 (fd 3 is the broker relay socketpair), closes fds above 3,
+ * opens filter as fd 9, and execs bwrap with --seccomp 9.
+ */
+export declare const IN_TIER_CLEANUP_BROKER = "for f in /proc/self/fd/*; do n=${f##*/}; case $n in 0|1|2|3) ;; *) eval \"exec $n>&-\" 2>/dev/null;; esac; done; exec 9<\"$0\" && exec bwrap --seccomp 9 \"$@\"";

package/dist/substrate/types.d.ts

@@ -6,7 +6,7 @@ import type { HostDescendantReap } from "../local-executor/descendant-reaper";
  * A3-after-C2] — declared so the union admits the hosted runner without
  * reopening the contract; not implemented in Rung 1.
  */
-export type IsolationTech = "docker" | "sandbox_exec" | "firecracker";
+export type IsolationTech = "docker" | "sandbox_exec" | "bubblewrap" | "firecracker";
 /**
  * How tightly the substrate can pin egress to the single broker
  * destination.
@@ -275,6 +275,8 @@ export interface CommandRunner {
         env?: Readonly<Record<string, string>>;
         /** Child working directory. Absent → inherit the parent's cwd. */
         cwd?: string;
+        /** Whether the child process is spawned detached from parent process group. */
+        detached?: boolean;
         /** Exact cwd incarnation held through native process creation. */
         cwdAuthority?: WorkspaceRootAuthority;
         /**

package/dist/substrate-launch/engage-substrate.d.ts

@@ -46,6 +46,10 @@ export interface EngageSubstrateInput {
      * Default true (writes permitted to workdir).
      */
     writableWorkdir?: boolean;
+    /** Optional spawn identifier for per-spawn private homes / filters. */
+    spawnId?: string;
+    /** Optional home dir override (injectable for tests). */
+    homedir?: string;
     /** F-P46a-4 — the implementor spawn's process-tree id (descendant reaping marker). */
     processTreeId?: string;
     /** Ladder deps (injectable for tests). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quantiya/codevibe-core",
-  "version": "2.0.81",
+  "version": "2.0.82",
   "description": "Core library for CodeVibe plugins - shared keychain, crypto, AppSync, and auth functionality",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",