@sweny-ai/core 0.1.144 → 0.1.146

package/dist/harness/codex.d.ts

@@ -20,7 +20,7 @@
  *
  * Every sweny opinion in the Codex column of the enforcement matrix is
  * enforced natively here, kept by sweny (watchdog, fencing, env scoping,
- * output validation), reported in `degraded`, or refused under strict policy
+ * output parsing), reported in `degraded`, or refused under strict policy
  * by `policyGate`. Nothing is dropped silently.
  */
 import type { Logger, McpServerConfig, ToolContext } from "../types.js";

package/dist/harness/codex.js

@@ -20,7 +20,7 @@
  *
  * Every sweny opinion in the Codex column of the enforcement matrix is
  * enforced natively here, kept by sweny (watchdog, fencing, env scoping,
- * output validation), reported in `degraded`, or refused under strict policy
+ * output parsing), reported in `degraded`, or refused under strict policy
  * by `policyGate`. Nothing is dropped silently.
  */
 import { spawn, execFile } from "node:child_process";
@@ -201,15 +201,21 @@ export function isStrictCompatibleSchema(schema) {
 // ─── Process registry (crash cleanup) ────────────────────────────
 const liveChildren = new Set();
 let exitHookInstalled = false;
-/**
- * Stop Codex. It stays in sweny's process group (not detached), so a Ctrl-C
- * or a CI cancel reaches it too; its MCP servers exit when their stdin closes.
- */
+/** Stop the owned process tree, even after its leader has exited. */
 function stopChild(child, signal) {
-    if (child.pid === undefined || child.exitCode !== null || child.signalCode !== null)
+    if (child.pid === undefined)
         return;
     try {
-        child.kill(signal);
+        if (process.platform !== "win32") {
+            // exec() gives each run its own process group. Descendants can retain
+            // stdout/stderr after the leader exits, so do not gate this on exitCode.
+            process.kill(-child.pid, signal);
+        }
+        else {
+            // Windows has no POSIX process groups. Bound the tree-kill utility too.
+            execFile("taskkill", ["/pid", String(child.pid), "/T", "/F"], { timeout: 1000 }, () => { });
+            child.kill(signal);
+        }
     }
     catch {
         // already gone
@@ -220,10 +226,23 @@ function trackChild(child) {
     if (!exitHookInstalled) {
         exitHookInstalled = true;
         // A crashing sweny must not leave Codex (and its MCP servers) running.
-        process.on("exit", () => {
+        const cleanup = () => {
             for (const c of liveChildren)
                 stopChild(c, "SIGKILL");
-        });
+        };
+        process.on("exit", cleanup);
+        // Detached POSIX groups no longer receive our terminal's signals. Clean
+        // them up before host once-handlers remove themselves during dispatch.
+        for (const signal of ["SIGINT", "SIGTERM"]) {
+            const onSignal = () => {
+                cleanup();
+                if (process.listenerCount(signal) === 1) {
+                    process.removeListener(signal, onSignal);
+                    process.kill(process.pid, signal);
+                }
+            };
+            process.prependListener(signal, onSignal);
+        }
     }
 }
 function mapUsage(u) {
@@ -470,6 +489,7 @@ export class CodexHarness {
                 cwd: opts.spawn.cwd,
                 env: opts.spawn.env,
                 stdio: ["pipe", "pipe", "pipe"],
+                detached: process.platform !== "win32",
             });
         }
         catch (err) {
@@ -478,7 +498,9 @@ export class CodexHarness {
             return out;
         }
         trackChild(child);
+        let finish;
         const closed = new Promise((resolve) => {
+            finish = resolve;
             child.once("close", (code, signal) => {
                 out.exitCode = code;
                 out.exitSignal = signal;
@@ -495,9 +517,24 @@ export class CodexHarness {
                 return;
             stopped = true;
             stopChild(child, "SIGTERM");
-            killTimer = setTimeout(() => stopChild(child, "SIGKILL"), this.killGraceMs);
+            killTimer = setTimeout(() => {
+                stopChild(child, "SIGKILL");
+                // An escaped descendant or failed OS kill must not retain this await
+                // through inherited pipes after cancellation or leader exit.
+                child.stdin?.destroy();
+                child.stdout?.destroy();
+                child.stderr?.destroy();
+                child.unref();
+                finish();
+            }, this.killGraceMs);
             killTimer.unref?.();
         };
+        child.once("exit", (code, signal) => {
+            out.exitCode = code;
+            out.exitSignal = signal;
+            // The leader is done, but its descendants may still own our pipes.
+            stop();
+        });
         if (abort) {
             const onAbort = () => {
                 out.abortReason = abort.reason();
@@ -649,6 +686,7 @@ export class CodexHarness {
             onLine(buf);
         if (killTimer)
             clearTimeout(killTimer);
+        stopChild(child, "SIGKILL");
         abort?.clear();
         liveChildren.delete(child);
         return out;
@@ -677,11 +715,11 @@ export class CodexHarness {
             harness: this.info(),
             degraded: [...degraded, ...extra],
         });
-        const refused = (why) => {
+        const refused = (why, extra = []) => {
             const msg = `codex refused this node: ${why}`;
             this.logger.error(msg);
             // `refused` keeps fail_soft from softening a policy refusal (executor.ts).
-            return tag({ status: "failed", data: { error: msg, refused: true }, toolCalls: [] });
+            return tag({ status: "failed", data: { error: msg, refused: true }, toolCalls: [] }, extra);
         };
         if (gate.refuse)
             return refused(gate.refuse);
@@ -799,7 +837,7 @@ export class CodexHarness {
                 return refused(out.refuse);
             // OpenAI strict structured outputs reject some JSON schemas. When Codex
             // fails on the schema before doing anything, run once more without the
-            // native schema: sweny still asks for it in the prompt and checks it.
+            // native schema in relaxed mode. Prompt-only output is not schema-validated.
             if (schemaArgs.length > 0 &&
                 !out.completed &&
                 !out.abortReason &&
@@ -808,7 +846,10 @@ export class CodexHarness {
                 const why = isStrictCompatibleSchema(req.outputSchema)
                     ? "codex rejected the output schema"
                     : "the output schema is not OpenAI strict-compatible";
-                extraDegraded.push(`structured_output: ${why}; sweny parsed and checked the output instead`);
+                extraDegraded.push(`structured_output: ${why}; native schema validation unavailable`);
+                if (policy.strict) {
+                    return refused("strict policy requires structured_output validation; refusing prompt-only fallback", extraDegraded);
+                }
                 this.logger.warn(`  codex: ${why}; retrying without --output-schema`);
                 const again = await execOnce(false);
                 if ("refuse" in again)

package/dist/harness/sandbox-wrapper.d.ts

@@ -19,7 +19,10 @@
  *   host network except through that proxy.
  * - filesystem: the workspace (cwd) and a scratch HOME are writable; the rest
  *   of the filesystem is read-only; the operator's credential files are
- *   unreadable. Dry runs (`readOnly`) leave the workspace read-only too.
+ *   unreadable. Sibling homes under the same configured scratch root are
+ *   hidden; only this run's HOME is exposed. Dry runs (`readOnly`) leave the
+ *   workspace read-only too. All concurrent credential-bearing adapters must
+ *   use the same scratch root; different roots are not mutually isolated.
  * - env: exactly the env the adapter passes (already scoped by agent-env.ts),
  *   with HOME, XDG dirs and TMPDIR pointed into the scratch HOME. On Linux the
  *   process also gets its own PID namespace, so it cannot read another
@@ -55,7 +58,7 @@ export interface SandboxWrapRequest extends AgentSpawn {
 }
 /** The spawn to run instead, plus the scratch it owns. */
 export interface WrappedSpawn extends AgentSpawn {
-    /** Scratch HOME. Adapters may write config here (generated MCP config, copied auth) before spawning. */
+    /** Scratch HOME. Adapters sharing one scratch root may copy scoped auth/config here before spawning. */
     home: string;
     /** Remove the scratch HOME and the sandbox settings. Idempotent. */
     cleanup(): Promise<void>;
@@ -104,6 +107,8 @@ export declare function buildSrtSettings(req: Pick<SandboxWrapRequest, "cwd" | "
     credentialHome: string;
     exists?: (p: string) => boolean;
     credentialPaths?: readonly string[];
+    /** Shared wrapper storage to hide, with only `home` re-exposed. */
+    isolationRoot?: string;
 }): SrtSettings;
 /** Env for the wrapped process: the adapter's env with HOME, XDG and temp dirs moved into the scratch HOME. */
 export declare function scratchEnv(env: Record<string, string>, home: string): Record<string, string>;
@@ -114,7 +119,15 @@ export interface SrtWrapperOptions {
     credentialHome?: string;
     /** Override {@link CREDENTIAL_PATHS} (relative to `credentialHome`, or absolute). */
     credentialPaths?: readonly string[];
-    /** Where scratch dirs are created. Default: `os.tmpdir()`. */
+    /**
+     * Storage parent, default `os.tmpdir()`. Runs share a per-user child under
+     * this directory, hidden except for their own HOME. Concurrent adapters
+     * carrying credentials must use the same parent; separate roots are not
+     * mutually isolated. The existing parent is never removed. Its canonical
+     * hierarchy must be owned by this user or root; other-writable ancestors
+     * must be sticky (like /tmp). The shared child must be private and owned
+     * by this user. Unsafe existing paths are rejected, never repaired.
+     */
     scratchRoot?: string;
 }
 export declare class SrtSandboxWrapper implements SandboxWrapper {

package/dist/harness/sandbox-wrapper.js

@@ -19,7 +19,10 @@
  *   host network except through that proxy.
  * - filesystem: the workspace (cwd) and a scratch HOME are writable; the rest
  *   of the filesystem is read-only; the operator's credential files are
- *   unreadable. Dry runs (`readOnly`) leave the workspace read-only too.
+ *   unreadable. Sibling homes under the same configured scratch root are
+ *   hidden; only this run's HOME is exposed. Dry runs (`readOnly`) leave the
+ *   workspace read-only too. All concurrent credential-bearing adapters must
+ *   use the same scratch root; different roots are not mutually isolated.
  * - env: exactly the env the adapter passes (already scoped by agent-env.ts),
  *   with HOME, XDG dirs and TMPDIR pointed into the scratch HOME. On Linux the
  *   process also gets its own PID namespace, so it cannot read another
@@ -40,7 +43,7 @@
  */
 import { execFile } from "node:child_process";
 import { existsSync, realpathSync } from "node:fs";
-import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { lstat, mkdir, mkdtemp, realpath, rm, writeFile } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
 import * as path from "node:path";
 import { DEFAULT_SANDBOX_DOMAINS, parseList, resolveSandboxMode } from "../agent-env.js";
@@ -119,10 +122,14 @@ export function buildSrtSettings(req, opts) {
     const denyRead = (opts.credentialPaths ?? CREDENTIAL_PATHS)
         .map((rel) => (path.isAbsolute(rel) ? rel : path.join(opts.credentialHome, rel)))
         .filter((p) => exists(p));
+    // Deny the parent, not a snapshot of sibling homes: later-created runs
+    // must stay hidden too. srt allowRead carves out only our own HOME.
+    if (opts.isolationRoot)
+        denyRead.push(opts.isolationRoot);
     const allowWrite = req.readOnly ? [opts.home] : [real(req.cwd), opts.home];
     return {
         network: { allowedDomains, deniedDomains: [], strictAllowlist: true, allowLocalBinding: false },
-        filesystem: { denyRead, allowRead: [], allowWrite, denyWrite: [] },
+        filesystem: { denyRead, allowRead: opts.isolationRoot ? [opts.home] : [], allowWrite, denyWrite: [] },
     };
 }
 /** Env for the wrapped process: the adapter's env with HOME, XDG and temp dirs moved into the scratch HOME. */
@@ -147,7 +154,39 @@ export class SrtSandboxWrapper {
         this.opts = opts;
     }
     async wrap(req) {
-        const dir = await mkdtemp(path.join(real(this.opts.scratchRoot ?? tmpdir()), "sweny-sbx-"));
+        const uid = process.getuid?.();
+        if (uid === undefined)
+            throw new Error("Cannot validate sandbox scratch ownership on this platform");
+        const storageParent = await realpath(this.opts.scratchRoot ?? tmpdir());
+        // A private child can still be renamed by another user through a writable
+        // ancestor. Check the canonical hierarchy before accepting any run paths.
+        for (let ancestor = storageParent;; ancestor = path.dirname(ancestor)) {
+            const info = await lstat(ancestor);
+            if (!info.isDirectory() ||
+                (info.uid !== uid && info.uid !== 0) ||
+                ((info.mode & 0o022) !== 0 && (info.mode & 0o1000) === 0)) {
+                throw new Error(`Unsafe sandbox scratch ancestor: ${ancestor}`);
+            }
+            if (ancestor === path.dirname(ancestor))
+                break;
+        }
+        // Keep these components short: srt creates Unix sockets beneath HOME/tmp,
+        // and Linux socket paths must fit in 107 bytes (including caller parents).
+        const isolationRoot = path.join(storageParent, `sweny-${uid}`);
+        try {
+            await mkdir(isolationRoot, { mode: 0o700 });
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+        }
+        // Never adopt a symlink, a foreign-owned directory, or a directory other
+        // users can access. Validate newly created paths too; do not chmod them.
+        const info = await lstat(isolationRoot);
+        if (!info.isDirectory() || info.uid !== uid || (info.mode & 0o077) !== 0) {
+            throw new Error(`Unsafe sandbox scratch directory: ${isolationRoot}`);
+        }
+        const dir = await mkdtemp(path.join(isolationRoot, "r-"));
         let cleaned = false;
         const cleanup = async () => {
             if (cleaned)
@@ -162,6 +201,7 @@ export class SrtSandboxWrapper {
                 home,
                 credentialHome: this.opts.credentialHome ?? homedir(),
                 credentialPaths: this.opts.credentialPaths,
+                isolationRoot,
             });
             const settingsPath = path.join(dir, "srt-settings.json");
             await writeFile(settingsPath, JSON.stringify(settings, null, 2), { mode: 0o600 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sweny-ai/core",
-  "version": "0.1.144",
+  "version": "0.1.146",
   "type": "module",
   "bin": {
     "sweny": "./dist/cli/main.js"