@qwen-code/arena-agent 0.0.10-dev.3 → 0.0.10-dev.5

package/dist/tools.js

@@ -1,6 +1,6 @@
 import { spawn } from "node:child_process";
-import { existsSync, mkdirSync, realpathSync, } from "node:fs";
-import { open, readFile, realpath, stat, writeFile, } from "node:fs/promises";
+import { existsSync, mkdirSync, realpathSync } from "node:fs";
+import { open, readFile, realpath, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { Ajv } from "ajv";
 import addFormats from "ajv-formats";
@@ -13,14 +13,16 @@ import { CodeToolExecutor } from "./code-tools.js";
 import { supportsImageInput } from "./config.js";
 import { extractStructuredDocument, isStructuredDocument, } from "./document-reader.js";
 import { FetchPageReader } from "./fetch-page.js";
+import { replaceFirstText } from "./file-edit.js";
 import { generatedImageBytesForExtension, prepareImageForModel, } from "./image.js";
 import { imageTextFromFallbackModel } from "./image-input-fallback.js";
 import { isCodeArenaMode } from "./mode.js";
 import { generateImageWithModelRouter, generateSpeechWithModelRouter, } from "./model-router-media.js";
 import { processManagerForWorkspace, } from "./process-manager.js";
-import { HttpModelClient, } from "./provider.js";
+import { HttpModelClient } from "./provider.js";
 import { RoutifyFetchPageReader, routifyWebFetchEnabled, } from "./routify-web-fetch.js";
 import { toolDefinitions } from "./spec.js";
+import { createSandboxFile, privilegedFileCreationEnabled } from "./sandbox-file-write.js";
 import { voiceRegistryForWorkspace, } from "./voice-registry.js";
 export function imageInputFallbackConnection(config) {
     if (!config.imageInputFallbackBaseUrl &&
@@ -214,7 +216,7 @@ const visualIntroText = "<arena-system-message>\n" +
     "treat them as the authentic output of the tool call.\n" +
     "</arena-system-message>";
 const bashOutputLimit = 20_000;
-const textFileByteLimit = 256 * 1024;
+const textFileOutputByteLimit = 256 * 1024;
 const toolResultCharacterLimit = 1_000_000;
 // 中段截断，逐字反推自 3 个 truncated:true 参考样本：头尾各 9987 字符 +
 // 26 字符标记，总长恰 20000（由 T1(b) 执行回放发现，非首段截断）。
@@ -228,6 +230,24 @@ function capBashOutput(value) {
         truncated: true,
     };
 }
+function readTextResult(data) {
+    if (data.length <= textFileOutputByteLimit) {
+        return { content: decodeText(data), truncated: false };
+    }
+    const half = textFileOutputByteLimit / 2;
+    const prefixBreak = data.lastIndexOf(0x0a, half);
+    const suffixBreak = data.indexOf(0x0a, data.length - half);
+    const prefixEnd = prefixBreak === -1 ? half : prefixBreak;
+    const suffixStart = suffixBreak === -1 ? data.length - half : suffixBreak + 1;
+    const elidedBytes = Math.max(0, suffixStart - prefixEnd);
+    const marker = `\n\n[${Math.round(elidedBytes / 1024)} KB elided from the middle of the file]\n\n`;
+    return {
+        content: decodeText(data.subarray(0, prefixEnd)) +
+            marker +
+            decodeText(data.subarray(suffixStart)),
+        truncated: true,
+    };
+}
 const mimeTypes = {
     ".aac": "audio/aac",
     ".bmp": "image/bmp",
@@ -281,8 +301,7 @@ function decodeUtf32(data, littleEndian) {
         const codePoint = littleEndian
             ? data.readUInt32LE(index)
             : data.readUInt32BE(index);
-        characters.push(codePoint <= 0x10ffff &&
-            !(codePoint >= 0xd800 && codePoint <= 0xdfff)
+        characters.push(codePoint <= 0x10ffff && !(codePoint >= 0xd800 && codePoint <= 0xdfff)
             ? String.fromCodePoint(codePoint)
             : "\ufffd");
     }
@@ -560,12 +579,15 @@ class ArenaToolExecutor {
     config;
     workspace;
     workspaceReal;
+    tmpReal;
+    varTmpReal;
     validators = new Map();
     pendingVisualContent = new Map();
     askUserHandler;
     imageInputFallbackClient;
     signal;
     workspaceContext;
+    nativeSandboxPaths;
     pageReader;
     routifyPageReader;
     processManager;
@@ -587,6 +609,13 @@ class ArenaToolExecutor {
         this.workspace = path.resolve(config.workspace);
         mkdirSync(this.workspace, { recursive: true });
         this.workspaceReal = realpathSync(this.workspace);
+        // A Linux /home/user workspace is already an OS-level sandbox. Other
+        // callers still confine ordinary workspace paths, while /tmp and /var/tmp
+        // always refer to the actual system directories seen by Bash.
+        this.nativeSandboxPaths =
+            process.platform === "linux" && this.workspaceReal === "/home/user";
+        this.tmpReal = realpathSync("/tmp");
+        this.varTmpReal = realpathSync("/var/tmp");
         this.processManager = processManagerForWorkspace(this.workspaceReal);
         this.voiceRegistry = voiceRegistryForWorkspace(this.workspaceReal);
         this.askUserHandler = options.askUserHandler;
@@ -747,10 +776,9 @@ class ArenaToolExecutor {
         const message = errorMessage(error);
         const durationMs = Date.now() - startedAt;
         if (name === "bash") {
-            const stderr = this.virtualizeBashOutput(message);
             return {
                 status: "shell_error",
-                stderr,
+                stderr: message,
                 stdout: "",
                 exit_code: null,
                 duration_ms: durationMs,
@@ -892,28 +920,57 @@ class ArenaToolExecutor {
         if (!raw)
             throw new Error("path must not be empty");
         let candidate;
-        if (raw === "/home/user") {
-            candidate = this.workspace;
+        let confinementRoot = this.workspace;
+        let confinementRootReal = this.workspaceReal;
+        const expanded = raw === "~"
+            ? "/home/user"
+            : raw.startsWith("~/")
+                ? `/home/user/${raw.slice(2)}`
+                : raw;
+        const virtualAbsolute = path.posix.resolve("/home/user", expanded);
+        let suffix;
+        if (virtualAbsolute === "/var/tmp" ||
+            virtualAbsolute.startsWith("/var/tmp/")) {
+            confinementRoot = "/var/tmp";
+            confinementRootReal = this.varTmpReal;
+            suffix = virtualAbsolute.slice("/var/tmp".length).replace(/^\/+/, "");
+            candidate = path.join(confinementRoot, suffix);
         }
-        else if (raw.startsWith("/home/user/")) {
-            candidate = path.join(this.workspace, raw.slice("/home/user/".length));
+        else if (virtualAbsolute === "/tmp" ||
+            virtualAbsolute.startsWith("/tmp/")) {
+            confinementRoot = "/tmp";
+            confinementRootReal = this.tmpReal;
+            suffix = virtualAbsolute.slice("/tmp".length).replace(/^\/+/, "");
+            candidate = path.join(confinementRoot, suffix);
         }
-        else if (!this.workspaceContext && raw === "~") {
+        else if (this.nativeSandboxPaths && path.posix.isAbsolute(raw)) {
+            confinementRoot = "/";
+            confinementRootReal = "/";
+            candidate = raw;
+        }
+        else if (!this.workspaceContext) {
+            if (virtualAbsolute === "/home/user" ||
+                virtualAbsolute.startsWith("/home/user/")) {
+                suffix = virtualAbsolute.slice("/home/user".length).replace(/^\/+/, "");
+            }
+            else {
+                throw new Error(`path is outside the workspace: ${raw}`);
+            }
+            candidate = path.join(confinementRoot, suffix);
+        }
+        else if (raw === "/home/user") {
             candidate = this.workspace;
         }
-        else if (!this.workspaceContext && raw.startsWith("~/")) {
-            candidate = path.join(this.workspace, raw.slice(2));
+        else if (raw.startsWith("/home/user/")) {
+            candidate = path.join(this.workspace, raw.slice("/home/user/".length));
         }
         else {
-            const defaultCwd = this.workspaceContext
-                ? path.resolve(this.workspaceContext.cwd)
-                : this.workspace;
+            const defaultCwd = path.resolve(this.workspaceContext.cwd);
             candidate = path.isAbsolute(raw) ? raw : path.join(defaultCwd, raw);
         }
         const absolute = path.resolve(candidate);
-        const lexicalRelative = path.relative(this.workspace, absolute);
-        if (lexicalRelative.startsWith("..") ||
-            path.isAbsolute(lexicalRelative)) {
+        const lexicalRelative = path.relative(confinementRoot, absolute);
+        if (lexicalRelative.startsWith("..") || path.isAbsolute(lexicalRelative)) {
             throw new Error(`path is outside the workspace: ${raw}`);
         }
         let ancestor = absolute;
@@ -925,33 +982,45 @@ class ArenaToolExecutor {
         }
         const ancestorReal = await realpath(ancestor);
         const resolved = path.resolve(ancestorReal, path.relative(ancestor, absolute));
-        const realRelative = path.relative(this.workspaceReal, resolved);
+        const realRelative = path.relative(confinementRootReal, resolved);
         if (realRelative.startsWith("..") || path.isAbsolute(realRelative)) {
             throw new Error(`path is outside the workspace: ${raw}`);
         }
         return resolved;
     }
     relativePath(target) {
+        for (const [root, virtualRoot] of [
+            [this.varTmpReal, "/var/tmp"],
+            [this.tmpReal, "/tmp"],
+        ]) {
+            const relative = path.relative(root, target);
+            if (!relative.startsWith("..") && !path.isAbsolute(relative)) {
+                const suffix = relative.split(path.sep).join("/");
+                return suffix ? `${virtualRoot}/${suffix}` : virtualRoot;
+            }
+        }
         return path.relative(this.workspaceReal, target).split(path.sep).join("/");
     }
-    virtualizeBashOutput(value) {
-        if (this.workspaceContext)
-            return value;
-        let virtualized = value;
-        const workspaceRoots = [...new Set([this.workspace, this.workspaceReal])]
-            .filter((root) => root !== path.parse(root).root)
-            .sort((left, right) => right.length - left.length);
-        for (const root of workspaceRoots) {
-            virtualized = virtualized.replaceAll(root, "/home/user");
+    displayWorkspacePath(rawPath) {
+        if (!this.workspaceContext) {
+            if (rawPath === "/home/user" || rawPath === "~")
+                return ".";
+            if (rawPath.startsWith("/home/user/")) {
+                return rawPath.slice("/home/user/".length);
+            }
+            if (rawPath.startsWith("~/"))
+                return rawPath.slice(2);
         }
-        return virtualized;
+        return rawPath;
     }
     sandboxEnvironment() {
         const env = {
             ...process.env,
             ARENA_WORKSPACE: this.workspace,
-            LANG: "C.UTF-8",
-            LC_ALL: "C.UTF-8",
+            // Agent Arena captures use C character classification (grep -P, wc -w).
+            // This controls command behavior, not the UTF-8 encoding of stored files.
+            LANG: "C",
+            LC_ALL: "C",
         };
         delete env.FORCE_COLOR;
         delete env.CLICOLOR_FORCE;
@@ -959,20 +1028,22 @@ class ArenaToolExecutor {
     }
     async bash(command, cwd, timeoutSeconds) {
         const workdir = await this.confinedPath(cwd);
-        if (!(await stat(workdir)).isDirectory()) {
+        const metadata = await stat(workdir).catch((error) => {
+            // A missing cwd prevents shell startup; captured Bash stderr is empty.
+            // Keep other filesystem failures and start_process diagnostics intact.
+            if (error.code === "ENOENT")
+                throw new Error("");
+            throw error;
+        });
+        if (!metadata.isDirectory()) {
             throw new Error(`cwd is not a directory: ${cwd}`);
         }
-        // Legacy callers without runtime context retain the captured /home/user
-        // contract. Runtime-aware callers execute and report their actual paths.
-        const translatedCommand = this.workspaceContext
-            ? command
-            : command.replaceAll("/home/user", "\"$ARENA_WORKSPACE\"");
         return new Promise((resolve, reject) => {
             const env = this.sandboxEnvironment();
             // detached：管道成员（npm、tail…）与 bash 同进程组。只杀 bash 会留下
             // 孤儿持有 stdout/stderr 管道，close 永不触发，整个 turn 挂死；
             // 必须杀整组，并在宽限期后强制结算兜底。
-            const child = spawn("/bin/bash", ["-lc", translatedCommand], {
+            const child = spawn("/bin/bash", ["-lc", command], {
                 cwd: workdir,
                 env,
                 stdio: ["ignore", "pipe", "pipe"],
@@ -1017,8 +1088,8 @@ class ArenaToolExecutor {
                     reject(this.signal.reason || new Error("operation cancelled"));
                     return;
                 }
-                const out = capBashOutput(this.virtualizeBashOutput(stdout));
-                const err = capBashOutput(this.virtualizeBashOutput(stderr));
+                const out = capBashOutput(stdout);
+                const err = capBashOutput(stderr);
                 resolve({
                     status: timedOut ? "timeout" : signal ? "killed" : "completed",
                     stderr: err.text,
@@ -1071,12 +1142,9 @@ class ArenaToolExecutor {
         if (!(await stat(workdir)).isDirectory()) {
             throw new Error(`cwd is not a directory: ${cwd}`);
         }
-        const translatedCommand = this.workspaceContext
-            ? command
-            : command.replaceAll("/home/user", '"$ARENA_WORKSPACE"');
         return this.processManager.start({
             name,
-            command: translatedCommand,
+            command,
             cwd: workdir,
             startupWaitSeconds,
             env: this.sandboxEnvironment(),
@@ -1085,10 +1153,12 @@ class ArenaToolExecutor {
     }
     async askUser(questions, toolCallId, context) {
         if (this.askUserHandler) {
-            return this.askUserHandler(toolCallId, questions, context ? {
-                ...context,
-                signal: this.signal || context.signal,
-            } : undefined);
+            return this.askUserHandler(toolCallId, questions, context
+                ? {
+                    ...context,
+                    signal: this.signal || context.signal,
+                }
+                : undefined);
         }
         // ask_user is not offered in non-interactive sessions; if the model still
         // emits it (e.g. resumed history or a hallucinated call), report an error
@@ -1168,23 +1238,25 @@ class ArenaToolExecutor {
         catch {
             return {
                 status: "error",
-                message: `Failed to read workspace file: ${rawPath}`,
+                message: `Failed to read workspace file: ${this.displayWorkspacePath(rawPath)}`,
             };
         }
-        // 仅精确匹配：曾有空白容错回退，但 T1(b) 回放证实生产没有——case-003
-        // 四个 old_text 精确缺失的 edit 生产全部返回 Context not found，而回退
-        // 会静默改错文件；全部参考成功样本也都能走精确路径复现。
-        // 注意：spec/tools.json 的 edit_file description（与生产逐字一致，受
-        // T1(c) 门禁保护）声称支持 fuzzy matching——那是上游自身的描述与行为
-        // 不一致，按实测行为对齐，描述不改。见 TRAJECTORY_FIDELITY.md §5。
-        if (!source.includes(oldText)) {
+        // Agent Arena replaces the first match and tolerates multiline whitespace
+        // drift. Code Arena deliberately uses a separate unique-match policy.
+        const edited = replaceFirstText(source, oldText, newText, {
+            whitespaceInsensitiveMultiline: true,
+        });
+        if (edited === undefined) {
             return {
                 status: "error",
                 message: "Context not found. Read the file to verify the text exists.",
             };
         }
         try {
-            await writeFile(target, source.replace(oldText, newText), "utf8");
+            // Replacement text is literal. String.replace(string, string) expands
+            // $&, $`, $' and $$ sequences and therefore corrupts JavaScript/jQuery
+            // snippets observed in production trajectories.
+            await writeFile(target, edited, "utf8");
         }
         catch {
             return {
@@ -1195,10 +1267,11 @@ class ArenaToolExecutor {
         return { status: "success", message: `Edited ${rawPath}.` };
     }
     async readWorkspaceFile(rawPath, toolCallId) {
-        const target = await this.confinedPath(rawPath);
+        let target;
         let fileSize;
         let sample;
         try {
+            target = await this.confinedPath(rawPath);
             const metadata = await stat(target);
             if (!metadata.isFile())
                 throw new Error("not a regular file");
@@ -1215,23 +1288,13 @@ class ArenaToolExecutor {
             }
         }
         catch {
-            // 逐字对齐生产错误文案，路径按调用方原样回显。
             return {
                 status: "error",
-                message: `Failed to read workspace file: ${rawPath}`,
+                message: `Failed to read workspace file: ${this.displayWorkspacePath(rawPath)}`,
             };
         }
         const extension = path.extname(target).toLowerCase();
         const kind = workspaceFileKind(target, sample);
-        if (kind === "text" && fileSize > textFileByteLimit) {
-            return {
-                status: "error",
-                message: `File content (${displayByteSize(fileSize)}) exceeds the maximum allowed size ` +
-                    `(${displayByteSize(textFileByteLimit)}). Use bash with sed/head/tail to read ` +
-                    "specific portions of the file, or grep/rg to search for specific content " +
-                    "instead of reading the whole file.",
-            };
-        }
         if (kind === "image" && fileSize > 20 * 1024 * 1024) {
             throw new Error(`image exceeds 20 MB: ${rawPath}`);
         }
@@ -1258,7 +1321,7 @@ class ArenaToolExecutor {
         catch {
             return {
                 status: "error",
-                message: `Failed to read workspace file: ${rawPath}`,
+                message: `Failed to read workspace file: ${this.displayWorkspacePath(rawPath)}`,
             };
         }
         if (isStructuredDocument(target)) {
@@ -1286,12 +1349,13 @@ class ArenaToolExecutor {
             return result;
         }
         if (kind === "text") {
-            const content = decodeText(data);
+            const text = readTextResult(data);
             return {
                 kind: "text",
-                lines: content.split("\n").length,
-                size: Buffer.byteLength(content, "utf8"),
-                content,
+                lines: data.reduce((count, byte) => count + (byte === 0x0a ? 1 : 0), 1),
+                size: data.length,
+                content: text.content,
+                ...(text.truncated ? { truncated: true } : {}),
             };
         }
         const mimeType = mime.getType(target) ||
@@ -1341,11 +1405,22 @@ class ArenaToolExecutor {
         };
     }
     async writeWorkspaceFile(rawPath, content) {
-        let target;
         try {
-            target = await this.confinedPath(rawPath);
+            const target = await this.confinedPath(rawPath);
             mkdirSync(path.dirname(target), { recursive: true });
-            await writeFile(target, content, "utf8");
+            try {
+                await writeFile(target, content, "utf8");
+            }
+            catch (error) {
+                const code = error.code;
+                if (!["EACCES", "EPERM"].includes(code || "") || !privilegedFileCreationEnabled({
+                    platform: process.platform, workspace: this.workspaceReal,
+                    docker: existsSync("/.dockerenv"), flag: process.env.ARENA_SANDBOX_PRIVILEGED_FILE_CREATION,
+                    uid: process.getuid?.(),
+                }))
+                    throw error;
+                await createSandboxFile(target, content);
+            }
         }
         catch {
             return {
@@ -1368,18 +1443,21 @@ class ArenaToolExecutor {
         const slug = query
             .toLowerCase()
             .replace(/[^a-z0-9]+/g, "-")
-            .slice(0, 40);
+            .replace(/^-+|-+$/g, "")
+            .slice(0, 40) || "results";
         for (const value of results) {
             if (saved.length >= count)
                 break;
             const item = record(value);
             const properties = record(item.properties);
             const thumbnail = record(item.thumbnail);
-            const sourceUrl = stringValue(properties.url) || stringValue(thumbnail.src);
-            const thumbnailUrl = stringValue(thumbnail.src) || sourceUrl;
-            if (!sourceUrl)
+            // Brave's result URL is the source page; properties.url is an image asset.
+            const sourceUrl = stringValue(item.url);
+            const imageUrl = stringValue(properties.url) || stringValue(thumbnail.src);
+            const thumbnailUrl = stringValue(thumbnail.src) || imageUrl;
+            if (!imageUrl)
                 continue;
-            const downloadUrls = [...new Set([sourceUrl, thumbnailUrl])];
+            const downloadUrls = [...new Set([imageUrl, thumbnailUrl])];
             for (const downloadUrl of downloadUrls) {
                 try {
                     const imageResponse = await fetch(downloadUrl, {
@@ -1394,7 +1472,9 @@ class ArenaToolExecutor {
                         .split(";")[0]
                         ?.trim()
                         .toLowerCase();
-                    const extension = Object.entries(mimeTypes).find(([, mime]) => mime === normalizedType)?.[0] || ".jpg";
+                    const extension = normalizedType === "image/jpeg"
+                        ? ".jpg"
+                        : Object.entries(mimeTypes).find(([, mime]) => mime === normalizedType)?.[0] || ".jpg";
                     const target = await this.confinedPath(`image-search/${slug}-${saved.length + 1}${extension}`);
                     mkdirSync(path.dirname(target), { recursive: true });
                     await writeFile(target, await responseBytes(imageResponse));
@@ -1475,7 +1555,7 @@ class ArenaToolExecutor {
         await writeFile(target, await generatedImageBytesForExtension(generated.bytes, generated.mimeType, extension));
         return {
             status: "success",
-            file_path: this.relativePath(target),
+            file_path: rawPath,
         };
     }
     async generateSpeech(rawPath, text, voiceId, language) {
@@ -1511,7 +1591,7 @@ class ArenaToolExecutor {
         }));
         return {
             status: "success",
-            file_path: this.relativePath(target),
+            file_path: rawPath,
         };
     }
 }