@sigrun/sigrun 0.1.6 → 0.2.0

package/dist/harness/workspace.js

@@ -1,74 +1,78 @@
-/**
- * Static workspace resolution (spec §4.5).
- *
- * pi-durable calls `HarnessOptions.env` per tool call to build the
- * conversation's `ExecutionEnv`. sigrun routes that through
- * `workspaceService.forConversation(conversation, prefs)`, a thin wrapper
- * whose signature survives a swap from static config to a dynamic
- * resolver: v1 answers from the static local workspace path carried in
- * `prefs`; a future resolver replaces the *implementation*
- * and nothing downstream changes.
- *
- * v1 is deliberately static: every conversation resolves to the same local
- * workspace. Per-conversation `agent.cwd` (the committed `pi.agent`
- * document's directory within the workspace) is applied by the `toHarnessEnv`
- * adapter below: pi-durable passes it through `EnvTarget.cwd` and applies
- * nothing itself, so the adapter must root the env at it.
- */
-import { AgentExecutionEnv } from "./agent-env.js";
+/** Resolve each conversation's ExecutionEnv: single-user, jailed, or fail-closed. */
 import { isAbsolute, resolve } from "node:path";
-/**
- * Build the static workspace service.
- *
- * v1 resolves every conversation from `prefs.defaultWorkspace` — the spec's
- * static configuration — so the service carries no state of its own. The
- * returned env is an {@link AgentExecutionEnv}: upstream's local Node
- * `ExecutionEnv` with commands confined to the agent environment
- * allowlist (multi-user spec §8). Its `FileSystem.id` is the stable
- * `"node:local"` (every
- * local environment sees the same files), and its `Shell` runs commands
- * rooted at the workspace `cwd`. A fresh instance per call matches how
- * upstream builds envs; equal ids see the same files whatever their `cwd`.
- */
-export function createWorkspaceService() {
+import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
+import { buildUserPolicy } from "../sandbox/policy.js";
+import { SandboxedExecutionEnv } from "../sandbox/sandboxed-env.js";
+import { UnavailableExecutionEnv } from "../sandbox/unavailable-env.js";
+import { selfPackageRoot } from "./packages.js";
+import { defaultModuleTrees } from "../sandbox/policy.js";
+import { AgentExecutionEnv } from "./agent-env.js";
+import { lookupOsAccount } from "../sandbox/os-account.js";
+export function createWorkspaceService(deps) {
     return {
-        async forConversation(_conversation, prefs) {
+        async forConversation(conversation, prefs, read, ctx) {
             const workspace = prefs.defaultWorkspace;
             if (workspace.type !== "local") {
-                // Fail loud: v1 knows only the static local workspace; any other
-                // type reaching here means the preferences are not v1's.
                 throw new Error(`Unsupported workspace type: ${JSON.stringify(workspace.type)}`);
             }
-            return new AgentExecutionEnv({ cwd: workspace.path });
+            if (deps === undefined)
+                return new AgentExecutionEnv({ cwd: workspace.path });
+            const { directory, isolation } = deps;
+            const records = directory.list();
+            const owner = read === undefined
+                ? undefined
+                : await deps.ownerOf(conversation.id, read, ctx ?? BACKGROUND_CONTEXT);
+            const record = records.find((candidate) => candidate.user === owner)
+                ?? records.find((candidate) => candidate.admin);
+            let osAccount;
+            if (record?.osUser !== undefined) {
+                if (deps.osUsers?.available !== true) {
+                    return new UnavailableExecutionEnv("osUser requires CAP_SETUID");
+                }
+                try {
+                    osAccount = (deps.lookupAccount ?? lookupOsAccount)(record.osUser);
+                }
+                catch {
+                    return new UnavailableExecutionEnv(`OS account not found: ${record.osUser}`);
+                }
+                if (osAccount === undefined) {
+                    return new UnavailableExecutionEnv(`OS account not found: ${record.osUser}`);
+                }
+            }
+            const active = isolation.active();
+            if (osAccount === undefined) {
+                if (records.length <= 1 && !active) {
+                    return new AgentExecutionEnv({ cwd: workspace.path });
+                }
+                if (!active) {
+                    return new UnavailableExecutionEnv(isolation.reason() ?? "isolation is not active");
+                }
+            }
+            if (record === undefined)
+                return new UnavailableExecutionEnv("conversation owner is not in the user directory");
+            const coreRoot = selfPackageRoot();
+            if (coreRoot === undefined)
+                return new UnavailableExecutionEnv("sigrun package root not found");
+            const policy = buildUserPolicy(record, {
+                managed: deps.managed,
+                nodeBinDir: process.execPath,
+                moduleTrees: defaultModuleTrees(coreRoot),
+                ...(osAccount === undefined ? {} : { osAccount }),
+            });
+            if (!policy.ok)
+                return new UnavailableExecutionEnv(policy.reason);
+            return new SandboxedExecutionEnv(deps.pool.client(policy.policy), policy.policy.workspace);
         },
     };
 }
-/**
- * The default workspace preferences for a configured local workspace path:
- * exactly the spec §4.5 static shape.
- */
 export function defaultWorkspacePrefs(workspacePath) {
     return { defaultWorkspace: { type: "local", path: workspacePath } };
 }
-/**
- * Adapt the service to the `HarnessOptions.env` builder pi-durable invokes
- * per tool call. pi-durable passes the conversation's committed `agent.cwd`
- * through `EnvTarget.cwd` and applies nothing itself (verified:
- * dist/harness/harness.js:137-138) — this adapter roots the resolved env
- * there, so tools see the conversation's directory. `agent.cwd` is a
- * directory within the environment's file system: an absolute path is
- * assigned as-is, a relative one is joined to the env's base (the workspace
- * root the service resolved), because upstream's Node env would otherwise
- * anchor a bare relative `cwd` at the process directory. Without a cwd, the
- * env stays at the workspace root.
- */
 export function toHarnessEnv(service, prefs) {
-    return async (target, _context) => {
-        const env = await service.forConversation({ id: target.conversationId }, prefs);
+    return async (target, context) => {
+        const env = await service.forConversation({ id: target.conversationId }, prefs, target.read, context);
         if (target.cwd != null) {
-            env.cwd = isAbsolute(target.cwd)
-                ? target.cwd
-                : resolve(env.cwd, target.cwd);
+            env.cwd = isAbsolute(target.cwd) ? target.cwd : resolve(env.cwd, target.cwd);
         }
         return env;
     };

package/dist/jobs/fire.js

@@ -38,6 +38,7 @@ import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
 import { parseModelSpec } from "../config.js";
 import { expandInput } from "../commands/expand.js";
 import { SessionMetaDoc } from "../server/session-meta.js";
+import { noteThen } from "../server/turns/submit-turn.js";
 import { JobRunDoc, patchJob, readJob } from "./docs.js";
 /**
  * Fire one job under `fireKey`. `fireAt` is the epoch ms the key pins
@@ -173,16 +174,12 @@ async function firePrompt(deps, id, record, fireKey, baseRun, prior, context) {
                 draft.lastRun = run;
             }, context);
         }
-        await conversation.submit({
+        const prompt = await jobPromptText(deps, conversationId, action.prompt, context);
+        await noteThen(deps.harness, conversation, () => conversation.submit({
             type: "input",
-            content: [
-                {
-                    type: "text",
-                    text: await jobPromptText(deps, conversationId, action.prompt, context),
-                },
-            ],
+            content: [{ type: "text", text: prompt }],
             requestId: `job:${fireKey}`,
-        }, context);
+        }, context), context);
         return { outcome: "running", conversationId };
     }
     // conversation: "new" — the run record + conversation in ONE commit.
@@ -221,6 +218,7 @@ async function firePrompt(deps, id, record, fireKey, baseRun, prior, context) {
                     meta.deliver = [...action.deliver];
                 if (record.owner !== undefined)
                     meta.owner = record.owner;
+                await deps.rewriteUserSelection?.(tx, newId, undefined, record.owner);
                 if (action.runSharing !== undefined)
                     meta.sharing = action.runSharing;
                 meta.name = runName(record.spec.name, deps.now(), record, deps);
@@ -238,16 +236,12 @@ async function firePrompt(deps, id, record, fireKey, baseRun, prior, context) {
         // fire (never silently succeed).
         return { outcome: "blocked" };
     }
-    await conversation.submit({
+    const prompt = await jobPromptText(deps, conversationId, action.prompt, context);
+    await noteThen(deps.harness, conversation, () => conversation.submit({
         type: "input",
-        content: [
-            {
-                type: "text",
-                text: await jobPromptText(deps, conversationId, action.prompt, context),
-            },
-        ],
+        content: [{ type: "text", text: prompt }],
         requestId: `job:${fireKey}`,
-    }, context);
+    }, context), context);
     return { outcome: "running", conversationId };
 }
 /** `<job name> · <YYYY-MM-DD HH:mm in the job's timezone>` (the plan's name). */

package/dist/sandbox/availability.js

@@ -0,0 +1,162 @@
+/** Boot-time Landlock availability probe and fail-closed helper self-test. */
+import { execFile } from "node:child_process";
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { promisify } from "node:util";
+import { lookupOsAccount } from "./os-account.js";
+const execFileAsync = promisify(execFile);
+/**
+ * Prove a real identity transition, not merely the presence of a helper.
+ * Every failure has the one operator-actionable reason; no failed switch is
+ * ever treated as permission to run under the service account instead.
+ */
+export async function probeOsUsers(helper, options) {
+    const unavailable = () => ({
+        available: false,
+        status: "osUsers requires CAP_SETUID",
+    });
+    try {
+        const account = lookupOsAccount("nobody", options?.read);
+        if (account === undefined)
+            return unavailable();
+        const run = options?.run ?? (async (command, args, execOptions) => execFileAsync(command, args, execOptions));
+        const { stdout } = await run(helper, ["run", "--", "/usr/bin/id", "-u"], {
+            env: {
+                LC_ALL: "C",
+                SIGRUN_SANDBOX_POLICY: JSON.stringify({
+                    ro: ["/usr", "/usr/bin", "/bin", "/sbin", "/lib", "/lib32", "/lib64", "/etc", "/opt", "/proc", "/sys"],
+                    rw: [],
+                    minAbi: 6,
+                    uid: account.uid,
+                    gid: account.gid,
+                    groups: account.groups,
+                }),
+            },
+        });
+        return stdout.trim() === String(account.uid)
+            ? { available: true, status: "available" }
+            : unavailable();
+    }
+    catch {
+        return unavailable();
+    }
+}
+/** Execute the helper's lightweight `probe` command and parse its ABI. */
+export async function runHelperProbe(helper) {
+    const { stdout } = await execFileAsync(helper, ["probe"]);
+    const result = JSON.parse(stdout);
+    if (typeof result !== "object" ||
+        result === null ||
+        !("abi" in result) ||
+        typeof result.abi !== "number" ||
+        !Number.isInteger(result.abi)) {
+        throw new Error("sigrun-sandbox probe returned an invalid ABI");
+    }
+    return { abi: result.abi };
+}
+/** One reader invocation, changing only whether the probe dir is granted. */
+async function runSelfTestLeg(helper, reader, probe, probeDir, grantProbe) {
+    const ro = [
+        "/bin",
+        "/usr/bin",
+        "/lib",
+        "/lib64",
+        "/usr/lib",
+        "/usr/lib64",
+        dirname(reader),
+        dirname(process.execPath),
+        ...(grantProbe ? [probeDir] : []),
+    ];
+    return execFileAsync(helper, ["run", "--", process.execPath, reader, probe], {
+        env: {
+            ...process.env,
+            LC_ALL: "C",
+            SIGRUN_SANDBOX_POLICY: JSON.stringify({ ro, rw: [], minAbi: 6 }),
+        },
+    });
+}
+const SELF_TEST_READER = `
+console.log("BEGIN");
+try {
+	const content = require("node:fs").readFileSync(process.argv[2], "utf8");
+	console.log("READ_OK:" + content);
+} catch (error) {
+	console.log("READ_DENIED:" + (error && error.code ? error.code : "UNKNOWN"));
+	process.exitCode = 1;
+}
+`;
+/**
+ * The security boundary check runs OUR reader twice with identical argv;
+ * only the probe-directory grant changes. The reader prints BEGIN before
+ * touching the file, then READ_OK with the content or READ_DENIED with the
+ * machine-readable errno. The control requires exact successful output,
+ * proving helper exec, node, the script, and the file work when permitted.
+ * The denial leg requires BEGIN plus READ_DENIED:EACCES and no helper-refusal
+ * line. No locale-dependent stderr text classifies the failure: the errno is
+ * the positive evidence, and BEGIN proves the reader actually executed.
+ */
+export async function selfTestHelper(helper) {
+    const root = await mkdtemp(join(tmpdir(), "sigrun-sandbox-self-test-"));
+    const grantedDir = join(root, "granted");
+    const probeDir = join(root, "probe");
+    const reader = join(grantedDir, "reader.cjs");
+    const probe = join(probeDir, "probe");
+    const content = "sandbox boundary probe\n";
+    try {
+        await mkdir(grantedDir);
+        await mkdir(probeDir);
+        await writeFile(reader, SELF_TEST_READER, { mode: 0o600 });
+        await writeFile(probe, content, { mode: 0o600 });
+        let control;
+        try {
+            control = await runSelfTestLeg(helper, reader, probe, probeDir, true);
+        }
+        catch {
+            return false;
+        }
+        if (control.stdout !== `BEGIN\nREAD_OK:${content}\n`)
+            return false;
+        try {
+            await runSelfTestLeg(helper, reader, probe, probeDir, false);
+            return false;
+        }
+        catch (error) {
+            if (typeof error !== "object" || error === null)
+                return false;
+            const outcome = error;
+            if (typeof outcome.stderr !== "string")
+                return false;
+            return (typeof outcome.code === "number" &&
+                outcome.code !== 0 &&
+                outcome.stdout === "BEGIN\nREAD_DENIED:EACCES\n" &&
+                !outcome.stderr
+                    .split(/\r?\n/)
+                    .some((line) => line.startsWith("sigrun-sandbox:")));
+        }
+    }
+    finally {
+        await rm(root, { recursive: true, force: true });
+    }
+}
+/** Decide availability once per boot, short-circuiting unusable helpers. */
+export async function probeIsolation(opts) {
+    if (opts.platform !== "linux") {
+        return { available: false, abi: 0, reason: "not linux" };
+    }
+    if (opts.helper === undefined) {
+        return { available: false, abi: 0, reason: "sandbox helper not found" };
+    }
+    const { abi } = await opts.runProbe(opts.helper);
+    if (abi < 6) {
+        return {
+            available: false,
+            abi,
+            reason: `landlock ABI ${abi} < 6`,
+        };
+    }
+    if (!(await opts.selfTest(opts.helper))) {
+        return { available: false, abi, reason: "self-test failed" };
+    }
+    return { available: true, abi, helper: opts.helper };
+}

package/dist/sandbox/command-observer.js

@@ -0,0 +1,59 @@
+/** Conservative ownership for pi-durable's detached command processes. */
+export const UNATTRIBUTED_OWNER = -1;
+/**
+ * Install ONE observer per environment's private pid set. Overlapping spawn
+ * attribution is intentionally conservative; only the -1 sentinel may remain
+ * stale. All ordinary owners are removed at request settlement so PID reuse
+ * can never turn an old command entry into a signal for an unrelated group.
+ */
+export function createCommandObserver(opts) {
+    const { registry, pending, active, emit } = opts;
+    const owners = new Map();
+    const originalAdd = registry.add;
+    const originalDelete = registry.delete;
+    const originalClear = registry.clear;
+    registry.add = (pid) => {
+        const result = originalAdd.call(registry, pid);
+        const currentlyPending = pending();
+        const attributed = currentlyPending.size === 0
+            ? new Set([UNATTRIBUTED_OWNER])
+            : new Set(currentlyPending);
+        owners.set(pid, attributed);
+        for (const id of attributed)
+            emit({ id, pid, phase: "start" });
+        return result;
+    };
+    registry.delete = (pid) => {
+        const result = originalDelete.call(registry, pid);
+        forgetIfSettled(pid);
+        return result;
+    };
+    registry.clear = () => {
+        const pids = [...registry];
+        originalClear.call(registry);
+        for (const pid of pids)
+            forgetIfSettled(pid);
+    };
+    function forgetIfSettled(pid) {
+        const attributed = owners.get(pid);
+        if (attributed === undefined)
+            return;
+        for (const id of attributed) {
+            // The sentinel can never be proved settled; retain it permanently.
+            if (id === UNATTRIBUTED_OWNER || active().has(id))
+                return;
+        }
+        owners.delete(pid);
+        for (const id of attributed)
+            emit({ id, pid, phase: "end" });
+    }
+    return {
+        owners,
+        settleRequest(id) {
+            for (const [pid, attributed] of owners) {
+                if (attributed.has(id))
+                    forgetIfSettled(pid);
+            }
+        },
+    };
+}

package/dist/sandbox/grants.js

@@ -0,0 +1,159 @@
+/**
+ * Per-user workspace/grant path validation (multi-user M1 §9.5).
+ *
+ * Every path is made absolute by the caller, resolved with realpath, and
+ * only THEN compared in either direction: Landlock follows the resolved
+ * hierarchy, so checking the spelling before realpath would let a symlink
+ * into a store root through. Missing/unresolvable paths fail closed.
+ *
+ * CORE-OWNED VS FOREIGN EXTENSION DIRS: the reserved-slug list also names
+ * core data dirs (`workspace`, `models`, `users`, …), but those names are
+ * NOT extension directories for this validator. `<dataDir>/<name>` counts
+ * as an extension directory only when `name` is not RESERVED_EXTENSION_SLUGS
+ * and the directory exists. Core dirs have their own explicit rules:
+ * `<dataDir>/users` is protected by the ancestor/equality check, and
+ * `<dataDir>/users/<other>` by the other-user-area check. In particular,
+ * `<dataDir>/workspace` and `<dataDir>/users/<user>/workspace` are valid.
+ * Do not "fix" this by treating every data child as an extension dir.
+ */
+import { readdirSync, realpathSync, statSync } from "node:fs";
+import { isAbsolute, join, resolve, sep } from "node:path";
+import { RESERVED_EXTENSION_SLUGS } from "../harness/reserved-sections.js";
+const RESERVED_SLUG_SET = new Set(RESERVED_EXTENSION_SLUGS);
+/** `child === parent` or `child` is below `parent` (path-segment aware). */
+function inside(child, parent) {
+    return child === parent || child.startsWith(parent.endsWith(sep) ? parent : parent + sep);
+}
+function canonical(path) {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        return resolve(path);
+    }
+}
+function directoryExists(path) {
+    try {
+        return statSync(path).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+/** Existing direct data children not claimed by a reserved core slug. */
+function extensionDirectories(dataDir) {
+    try {
+        return readdirSync(dataDir, { withFileTypes: true })
+            .filter((entry) => (entry.isDirectory() || entry.isSymbolicLink()) &&
+            !RESERVED_SLUG_SET.has(entry.name) &&
+            directoryExists(join(dataDir, entry.name)))
+            .map((entry) => canonical(join(dataDir, entry.name)));
+    }
+    catch {
+        return [];
+    }
+}
+function rejectContaining(candidate, path, label) {
+    if (inside(path, candidate)) {
+        return { ok: false, reason: `path is or contains ${label}` };
+    }
+    return undefined;
+}
+function rejectInside(candidate, path, label) {
+    if (inside(candidate, path)) {
+        return { ok: false, reason: `path is inside ${label}` };
+    }
+    return undefined;
+}
+/**
+ * Validate one workspace or grant. The returned realpath is the only value
+ * callers may store or use to construct a policy.
+ */
+export function validateGrantPath(path, ctx) {
+    if (!isAbsolute(path))
+        return { ok: false, reason: "path must be absolute" };
+    let candidate;
+    try {
+        candidate = realpathSync(path);
+    }
+    catch {
+        return { ok: false, reason: "path does not exist or cannot be resolved" };
+    }
+    const { managed, user, inheritedFrom } = ctx;
+    const { roots } = managed;
+    const rootLabels = [
+        [roots.configDir, "configDir"],
+        [roots.dataDir, "dataDir"],
+        [roots.cacheDir, "cacheDir"],
+        [roots.stateDir, "stateDir"],
+        [managed.storagePath, "storagePath"],
+        [join(roots.dataDir, "users"), "dataDir/users"],
+        [managed.coreRoot, "coreRoot"],
+    ];
+    for (const [protectedPath, label] of rootLabels) {
+        const rejected = rejectContaining(candidate, canonical(protectedPath), label);
+        if (rejected !== undefined)
+            return rejected;
+    }
+    const extensions = extensionDirectories(roots.dataDir);
+    for (const extension of extensions) {
+        const rejected = rejectContaining(candidate, extension, `extension directory ${extension}`);
+        if (rejected !== undefined)
+            return rejected;
+    }
+    for (const [protectedPath, label] of [
+        [roots.configDir, "configDir"],
+        [roots.stateDir, "stateDir"],
+        [roots.cacheDir, "cacheDir"],
+        [managed.storagePath, "storagePath"],
+        [managed.coreRoot, "coreRoot"],
+    ]) {
+        const rejected = rejectInside(candidate, canonical(protectedPath), label);
+        if (rejected !== undefined)
+            return rejected;
+    }
+    for (const extension of extensions) {
+        const rejected = rejectInside(candidate, extension, `extension directory ${extension}`);
+        if (rejected !== undefined)
+            return rejected;
+    }
+    const usersRoot = canonical(join(roots.dataDir, "users"));
+    if (inside(candidate, usersRoot)) {
+        // Identity is the LEXICAL path segment under users/, never whatever
+        // that segment resolves to. Canonicalizing the own area would let a
+        // users/alice symlink into Bob's area make both sides agree on Bob's
+        // realpath, turning the exception into a cross-user bypass.
+        const ownArea = join(usersRoot, user);
+        const inheritedArea = inheritedFrom === undefined || inheritedFrom === user
+            ? undefined
+            : join(usersRoot, inheritedFrom);
+        if (!inside(candidate, ownArea) &&
+            (inheritedArea === undefined || !inside(candidate, inheritedArea))) {
+            return { ok: false, reason: "path is inside another user's area" };
+        }
+    }
+    return { ok: true, realpath: candidate };
+}
+/** Re-run the current validation over every stored path for this user. */
+export function revalidate(record, managed) {
+    if (record.workspace !== undefined) {
+        const result = validateGrantPath(record.workspace, {
+            managed,
+            user: record.user,
+        });
+        if (!result.ok)
+            return result;
+    }
+    for (const grant of record.grants ?? []) {
+        const result = validateGrantPath(grant.path, {
+            managed,
+            user: record.user,
+            ...(grant.inheritedFrom === undefined
+                ? {}
+                : { inheritedFrom: grant.inheritedFrom }),
+        });
+        if (!result.ok)
+            return result;
+    }
+    return { ok: true };
+}

package/dist/sandbox/helper.js

@@ -0,0 +1,29 @@
+/** Locate the native sandbox helper without probing it. */
+import { existsSync } from "node:fs";
+import { createRequire } from "node:module";
+import { isAbsolute, join } from "node:path";
+/**
+ * Resolve in deployment precedence order: an explicit absolute env path,
+ * the installed platform package, then this checkout's release build.
+ * An unusable explicit path warns and falls through rather than aborting boot.
+ */
+export function resolveHelper(env, coreRoot) {
+    const configured = env.SIGRUN_SANDBOX_HELPER;
+    if (configured !== undefined && configured !== "") {
+        if (isAbsolute(configured) && existsSync(configured))
+            return configured;
+        console.warn(`SIGRUN_SANDBOX_HELPER is not an existing absolute path: ${configured}; falling back to installed or repo helper`);
+    }
+    try {
+        const platformPackage = `@sigrun/sandbox-linux-${process.arch}`;
+        const require = createRequire(join(coreRoot, "package.json"));
+        const helper = require.resolve(`${platformPackage}/bin/sigrun-sandbox`);
+        if (existsSync(helper))
+            return helper;
+    }
+    catch {
+        // The optional platform package is absent in a source-only install.
+    }
+    const repoHelper = join(coreRoot, "sandbox", "target", "release", "sigrun-sandbox");
+    return existsSync(repoHelper) ? repoHelper : undefined;
+}

package/dist/sandbox/isolation.js

@@ -0,0 +1,29 @@
+/** The process-lifetime isolation decision, including auto's irreversible latch. */
+export class IsolationState {
+    opts;
+    current;
+    latched = false;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    active() {
+        if (this.opts.mode === "auto" && this.opts.availability.available && this.opts.userCount() > 1) {
+            this.latched = true;
+        }
+        const active = this.opts.mode === "off"
+            ? false
+            : this.opts.mode === "always"
+                ? this.opts.availability.available
+                : this.latched;
+        if (active !== this.current) {
+            this.current = active;
+            this.opts.log(`sandbox isolation: ${active ? "active" : "inactive"} (mode ${this.opts.mode}${this.opts.availability.available ? "" : `, unavailable: ${this.reason() ?? "unknown reason"}`})`);
+        }
+        return active;
+    }
+    reason() {
+        if (this.opts.mode === "off")
+            return "isolation mode is off";
+        return this.opts.availability.reason;
+    }
+}

package/dist/sandbox/launch.js

@@ -0,0 +1,20 @@
+/** The shared helper launch shape for worker and per-user service processes. */
+/** Apply a complete policy in the helper, then exec the requested sibling process. */
+export function launchInJail(helper, policy, command, args, env) {
+    return {
+        command: helper,
+        args: ["run", "--", command, ...args],
+        env: {
+            ...env,
+            SIGRUN_SANDBOX_POLICY: JSON.stringify({
+                ro: policy.ro,
+                rw: policy.rw,
+                ensureDirs: policy.ensureDirs,
+                minAbi: 6,
+                ...(policy.uid === undefined ? {} : { uid: policy.uid }),
+                ...(policy.gid === undefined ? {} : { gid: policy.gid }),
+                ...(policy.groups === undefined ? {} : { groups: policy.groups }),
+            }),
+        },
+    };
+}