@vellumai/assistant 0.8.0 → 0.8.2

package/AGENTS.md

@@ -34,6 +34,17 @@ Routes in `src/runtime/routes/` are being migrated to a **shared `ROUTES` array*
 - **Dual exposure is intentional.** Every route in the shared `ROUTES` array is served over both HTTP and IPC. This is by design — it enables the gateway to call the daemon over IPC instead of HTTP, eliminating JWT token exchange on those paths (ATL-309 → ATL-311). Do not flag IPC exposure of shared routes as unintentional surface area.
 - **`RouteDefinition` carries everything:** `operationId`, `endpoint`, `method`, `handler`, `policyKey?`, `summary?`, `description?`, `tags?`, `responseBody?`. The HTTP adapter reads all fields; the IPC adapter only needs `operationId` and `handler`.
 
+### CLI ↔ daemon communication protocol
+
+The CLI and daemon communicate over a Unix domain socket using **length-prefixed binary framing**: each frame is a 4-byte big-endian length followed by a payload. Messages use a JSON envelope `{ id, method, params?, headers? }` for requests and `{ id, result?, error?, headers? }` for responses.
+
+Three response shapes are supported:
+- **JSON-only**: a single JSON frame (no `content-length` or `transfer-encoding` header).
+- **Binary**: a JSON envelope with `headers: { "content-length": "<n>" }` followed by one binary frame of exactly `n` bytes.
+- **Chunked streaming**: a JSON envelope with `headers: { "transfer-encoding": "chunked" }` followed by one or more binary frames, terminated by a zero-length frame.
+
+The server auto-detects legacy newline-delimited JSON from old CLI clients and handles it transparently. New code must use length-prefixed framing via `writeMessage()` / `IpcFrameReader` in `src/ipc/ipc-framing.ts`.
+
 ### CLI ↔ daemon version skew
 
 The CLI and daemon are always shipped and upgraded together — there is no version skew between them. When migrating a route to the shared `ROUTES` array and updating the CLI to send structured params, backward compatibility with older CLI versions is **not required**. Do not add compat shims for flat-param callers that no longer exist.

package/ARCHITECTURE.md

@@ -1227,9 +1227,8 @@ graph TB
 
     subgraph "2. Persist (Filesystem)"
         SCAFFOLD["scaffold_managed_skill<br/>───────────────<br/>RiskLevel: High<br/>Requires user consent"]
-        MANAGED_STORE["managed-store.ts<br/>───────────────<br/>validateManagedSkillId()<br/>buildSkillMarkdown()<br/>createManagedSkill()<br/>upsertSkillsIndexEntry()"]
+        MANAGED_STORE["managed-store.ts<br/>───────────────<br/>validateManagedSkillId()<br/>buildSkillMarkdown()<br/>createManagedSkill()"]
         SKILL_DIR["~/.vellum/workspace/skills/&lt;id&gt;/<br/>SKILL.md (frontmatter + body)"]
-        INDEX["~/.vellum/workspace/skills/<br/>SKILLS.md (index)"]
     end
 
     subgraph "3. Load & Use"
@@ -1240,7 +1239,6 @@ graph TB
     subgraph "4. Delete"
         DELETE["delete_managed_skill<br/>───────────────<br/>RiskLevel: High<br/>Requires user consent"]
         RM_DIR["rmSync skill directory"]
-        RM_INDEX["removeSkillsIndexEntry()"]
     end
 
     subgraph "File Watcher"
@@ -1257,17 +1255,14 @@ graph TB
 
     SCAFFOLD --> MANAGED_STORE
     MANAGED_STORE --> SKILL_DIR
-    MANAGED_STORE --> INDEX
 
     SKILL_DIR --> WATCHER
-    INDEX --> WATCHER
     WATCHER --> EVICT
 
     SKILL_DIR --> SKILL_LOAD
     SKILL_LOAD --> SESSION
 
     DELETE --> RM_DIR
-    DELETE --> RM_INDEX
     RM_DIR --> WATCHER
 ```
 
@@ -1275,7 +1270,7 @@ graph TB
 
 - `evaluate_typescript_code` always forces `sandbox.enabled = true` regardless of global config.
 - Snippet contract: must export `default` or `run` with signature `(input: unknown) => unknown | Promise<unknown>`.
-- Managed-store writes are atomic (tmp file + rename) to prevent partial `SKILL.md` or `SKILLS.md` files.
+- Managed-store writes are atomic (tmp file + rename) to prevent partial `SKILL.md` files.
 - After persist or delete, the file watcher triggers conversation eviction; the next turn runs in a fresh conversation. The model's system prompt instructs it to continue normally.
 - macOS UI shows Inspect and Delete controls for managed skills only (source = "managed").
 - `skill_load` resolves the recursive include graph (via `include-graph.ts`) before emitting output. Missing children are listed as suggested skills without child `<loaded_skill>` markers; cycles still produce `isError: true` with no marker. Valid includes produce an "Included Skills (immediate)" metadata section showing child ID, name, description, and path.

package/Dockerfile

@@ -27,12 +27,13 @@ COPY packages/skill-host-contracts ./packages/skill-host-contracts
 COPY packages/slack-text ./packages/slack-text
 COPY packages/twilio-client ./packages/twilio-client
 
-# Install deps for shared packages that have their own file: dependencies.
-# Without this, bun's module resolution at runtime walks up from e.g.
-# packages/ces-client/src/ and never finds the transitive dependency
-# (ces-contracts) because only assistant/node_modules gets populated.
+# Install deps for shared packages whose source is loaded at runtime.
+# Without this, bun's module resolution walks up from packages/<name>/src/
+# and can't find the package's own deps (zod, transitive file: refs)
+# because only assistant/node_modules gets populated.
 RUN cd /app/packages/ces-client && bun install --frozen-lockfile
 RUN cd /app/packages/gateway-client && bun install --frozen-lockfile
+RUN cd /app/packages/service-contracts && bun install --frozen-lockfile
 
 # Install assistant dependencies first for cache reuse
 COPY assistant/package.json assistant/bun.lock ./assistant/
@@ -72,6 +73,9 @@ RUN apt-get update && apt-get install -y \
     bubblewrap \
     ca-certificates \
     curl \
+    debootstrap \
+    debian-archive-keyring \
+    debconf \
     ffmpeg \
     fonts-freefont-ttf \
     g++ \
@@ -116,6 +120,7 @@ RUN apt-get update && apt-get install -y \
     unzip \
     uuid-runtime \
     vim \
+    wget \
     xclip \
     xdg-utils \
     && rm -rf /var/lib/apt/lists/*
@@ -146,6 +151,76 @@ ENV PATH="${BUN_INSTALL}/bin:${PATH}"
 ENV PYTHONUSERBASE="/home/assistant/.python"
 ENV PATH="${PYTHONUSERBASE}/bin:${PATH}"
 
+RUN printf '%s\n' \
+    'if [ -r /app/assistant/docker-kata-apt-env.sh ]; then' \
+    '  . /app/assistant/docker-kata-apt-env.sh' \
+    'fi' \
+    > /etc/profile.d/vellum-kata-apt-root.sh && \
+    printf '%s\n' \
+    '' \
+    'if [ -r /etc/profile.d/vellum-kata-apt-root.sh ]; then' \
+    '  . /etc/profile.d/vellum-kata-apt-root.sh' \
+    'fi' \
+    >> /etc/bash.bashrc && \
+    printf '%s\n' \
+    '' \
+    'if [ -r /etc/profile.d/vellum-kata-apt-root.sh ]; then' \
+    '  . /etc/profile.d/vellum-kata-apt-root.sh' \
+    'fi' \
+    >> /root/.bashrc && \
+    printf '%s\n' \
+    '' \
+    'if [ -r /etc/profile.d/vellum-kata-apt-root.sh ]; then' \
+    '  . /etc/profile.d/vellum-kata-apt-root.sh' \
+    'fi' \
+    >> /home/assistant/.bashrc && \
+    chown assistant:assistant /home/assistant/.bashrc
+
+RUN printf '%s\n' \
+    '#!/usr/bin/env sh' \
+    'set -eu' \
+    'if [ "${VELLUM_SANDBOX_RUNTIME:-}" != "kata" ]; then' \
+    '  exec /usr/bin/apt-get "$@"' \
+    'fi' \
+    'export DEBIAN_FRONTEND=noninteractive' \
+    'DATA_ROOT="${VELLUM_APT_DATA_ROOT:-/data/system}"' \
+    '/app/assistant/docker-init-apt-root.sh' \
+    'if [ -x "${DATA_ROOT}/bin/sh" ] && [ -x "${DATA_ROOT}/usr/bin/apt-get" ] && [ -f "${DATA_ROOT}/.rootfs-initialized" ] && ! grep -qs " ${DATA_ROOT} .*noexec" /proc/mounts; then' \
+    '  exec chroot "${DATA_ROOT}" /usr/bin/apt-get "$@"' \
+    'fi' \
+    'exec /usr/bin/apt-get "$@"' \
+    > /usr/local/bin/apt-get && \
+    chmod +x /usr/local/bin/apt-get && \
+    printf '%s\n' \
+    '#!/usr/bin/env sh' \
+    'set -eu' \
+    'if [ "${VELLUM_SANDBOX_RUNTIME:-}" != "kata" ]; then' \
+    '  exec /usr/bin/apt "$@"' \
+    'fi' \
+    'export DEBIAN_FRONTEND=noninteractive' \
+    'DATA_ROOT="${VELLUM_APT_DATA_ROOT:-/data/system}"' \
+    '/app/assistant/docker-init-apt-root.sh' \
+    'if [ -x "${DATA_ROOT}/bin/sh" ] && [ -x "${DATA_ROOT}/usr/bin/apt" ] && [ -f "${DATA_ROOT}/.rootfs-initialized" ] && ! grep -qs " ${DATA_ROOT} .*noexec" /proc/mounts; then' \
+    '  exec chroot "${DATA_ROOT}" /usr/bin/apt "$@"' \
+    'fi' \
+    'exec /usr/bin/apt "$@"' \
+    > /usr/local/bin/apt && \
+    chmod +x /usr/local/bin/apt && \
+    printf '%s\n' \
+    '#!/usr/bin/env sh' \
+    'set -eu' \
+    'if [ "${VELLUM_SANDBOX_RUNTIME:-}" != "kata" ]; then' \
+    '  exec /usr/bin/dpkg "$@"' \
+    'fi' \
+    'DATA_ROOT="${VELLUM_APT_DATA_ROOT:-/data/system}"' \
+    '/app/assistant/docker-init-apt-root.sh' \
+    'if [ -x "${DATA_ROOT}/bin/sh" ] && [ -x "${DATA_ROOT}/usr/bin/dpkg" ] && [ -f "${DATA_ROOT}/.rootfs-initialized" ] && ! grep -qs " ${DATA_ROOT} .*noexec" /proc/mounts; then' \
+    '  exec chroot "${DATA_ROOT}" /usr/bin/dpkg "$@"' \
+    'fi' \
+    'exec /usr/bin/dpkg "$@"' \
+    > /usr/local/bin/dpkg && \
+    chmod +x /usr/local/bin/dpkg
+
 # Ensure the CES bootstrap socket volume is writable by the non-root CES user.
 RUN mkdir -p /run/ces-bootstrap && chmod 777 /run/ces-bootstrap
 
@@ -160,7 +235,7 @@ ENV IS_CONTAINERIZED=true
 # and the generated meet-join manifest from the builder stage.
 COPY --from=builder /app /app
 
-RUN chmod +x /app/assistant/docker-entrypoint.sh
+RUN chmod +x /app/assistant/docker-entrypoint.sh /app/assistant/docker-init-apt-root.sh /app/assistant/docker-kata-apt-env.sh
 
 # Run the daemon + http server
 CMD ["/app/assistant/docker-entrypoint.sh"]

package/README.md

@@ -47,9 +47,9 @@ cp .env.example .env
 
 ## Update Bulletin
 
-Release notes are surfaced via a background conversation dispatched at daemon startup. Workspace migrations write release notes to `<workspace>/UPDATES.md`; `runUpdateBulletinJobIfNeeded()` then spawns a `conversationType: "background"` conversation (via `wakeAgentForOpportunity()`) whenever the file's content hash changes. The agent uses judgment to surface updates to the user when relevant, and deletes the file when done.
+Release notes are surfaced via a background conversation dispatched at daemon startup. Workspace migrations write release notes to `<workspace>/UPDATES.md`; `runUpdateBulletinJobIfNeeded()` then spawns a `conversationType: "background"` conversation via `runBackgroundJob()` (see `runtime/background-job-runner.ts`) whenever the file's content hash changes. The agent uses judgment to surface updates to the user when relevant, and deletes the file when done.
 
-**For release maintainers:** Add a new migration under `assistant/src/workspace/migrations/0XX-release-notes-<slug>.ts` with the release notes inline as a string literal, and append the export to `WORKSPACE_MIGRATIONS` in `assistant/src/workspace/migrations/registry.ts`. Migrations are append-only. Idempotency is handled by the workspace-migration runner — `runWorkspaceMigrations()` records each migration's `WorkspaceMigration.id` in `<workspace>/data/.workspace-migrations.json` and never re-runs an ID that is already in the `applied` set, so release-notes migrations do not need an in-file guard. Skip the migration entirely for releases with no user/assistant-facing changes.
+**For release maintainers:** Add a new migration under `assistant/src/workspace/migrations/0XX-release-notes-<slug>.ts` with the release notes inline as a string literal, and append the export to `WORKSPACE_MIGRATIONS` in `assistant/src/workspace/migrations/registry.ts`. Migrations are append-only. Idempotency requires both the workspace-migration runner AND an in-file marker: `runWorkspaceMigrations()` records each migration's `WorkspaceMigration.id` in `<workspace>/data/.workspace-migrations.json` and skips IDs already in the `applied` set, but a crash between `UPDATES.md` append and checkpoint finalize can cause a duplicate append on next boot. Embed an HTML marker like `<!-- release-note-id:<migration-id> -->` in the appended block, and short-circuit when the marker is already present. See the root `AGENTS.md` "Release Update Hygiene" section for the full rationale. Skip the migration entirely for releases with no user/assistant-facing changes.
 
 ## Usage
 

package/bun.lock

@@ -37,6 +37,7 @@
         "playwright": "1.58.2",
         "postgres": "3.4.8",
         "rrule": "2.8.1",
+        "semver": "7.8.0",
         "stemmer": "2.0.1",
         "tar-stream": "3.1.7",
         "tldts": "7.0.25",
@@ -48,6 +49,7 @@
         "@types/archiver": "7.0.0",
         "@types/bun": "1.3.10",
         "@types/node": "25.5.0",
+        "@types/semver": "7.5.8",
         "@types/uuid": "10.0.0",
         "drizzle-kit": "0.30.6",
         "eslint": "10.0.3",
@@ -388,6 +390,8 @@
 
     "@types/retry": ["@types/retry@0.12.0", "", {}, "sha512-wWKOClTTiizcZhXnPY4wikVAwmdYHp8q6DmC+EJUzAMsycb7HB32Kh9RN4+0gExjmPmZSAQjgURXIGATPegAvA=="],
 
+    "@types/semver": ["@types/semver@7.5.8", "", {}, "sha512-I8EUhyrgfLrcTkzV3TSsGyl1tSuPrEDzr0yd5m90UgNxQkyDXULk3b6MlQqTCpZpNtWe1K0hzclnZkTcLBe2UQ=="],
+
     "@types/tedious": ["@types/tedious@4.0.14", "", { "dependencies": { "@types/node": "*" } }, "sha512-KHPsfX/FoVbUGbyYvk1q9MMQHLPeRZhRJZdO45Q4YjvFkv4hMNghCWTvy7rdKessBsmtz4euWCWAB6/tVpI1Iw=="],
 
     "@types/uuid": ["@types/uuid@10.0.0", "", {}, "sha512-7gqG38EyHgyP1S+7+xomFtL+ZNHcKv6DwNaCZmJmo1vgMugyF3TCnXVg4t1uk89mLNwnLtnY3TpOpCOyp1/xHQ=="],
@@ -1080,7 +1084,7 @@
 
     "secure-json-parse": ["secure-json-parse@4.1.0", "", {}, "sha512-l4KnYfEyqYJxDwlNVyRfO2E4NTHfMKAWdUuA8J0yve2Dz/E/PdBepY03RvyJpssIpRFwJoCD55wA+mEDs6ByWA=="],
 
-    "semver": ["semver@7.7.4", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA=="],
+    "semver": ["semver@7.8.0", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-AcM7dV/5ul4EekoQ29Agm5vri8JNqRyj39o0qpX6vDF2GZrtutZl5RwgD1XnZjiTAfncsJhMI48QQH3sN87YNA=="],
 
     "send": ["send@1.2.1", "", { "dependencies": { "debug": "^4.4.3", "encodeurl": "^2.0.0", "escape-html": "^1.0.3", "etag": "^1.8.1", "fresh": "^2.0.0", "http-errors": "^2.0.1", "mime-types": "^3.0.2", "ms": "^2.1.3", "on-finished": "^2.4.1", "range-parser": "^1.2.1", "statuses": "^2.0.2" } }, "sha512-1gnZf7DFcoIcajTjTwjwuDjzuz4PPcY2StKPlsGAQ1+YH20IRVrBaXSWmdjowTJ6u8Rc01PoYOGHXfP1mYcZNQ=="],
 
@@ -1248,6 +1252,8 @@
 
     "@typescript-eslint/eslint-plugin/ignore": ["ignore@7.0.5", "", {}, "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg=="],
 
+    "@typescript-eslint/typescript-estree/semver": ["semver@7.7.4", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA=="],
+
     "@vellumai/ces-client/@types/bun": ["@types/bun@1.2.4", "", { "dependencies": { "bun-types": "1.2.4" } }, "sha512-QtuV5OMR8/rdKJs213iwXDpfVvnskPXY/S0ZiFbsTjQZycuqPbMW8Gf/XhLfwE5njW8sxI2WjISURXPlHypMFA=="],
 
     "@vellumai/ces-client/@vellumai/service-contracts": ["@vellumai/service-contracts@file:../packages/service-contracts", { "dependencies": { "zod": "4.3.6" }, "devDependencies": { "@types/bun": "1.2.4", "typescript": "5.7.3" } }],
@@ -1274,6 +1280,8 @@
 
     "foreground-child/signal-exit": ["signal-exit@4.1.0", "", {}, "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw=="],
 
+    "gel/semver": ["semver@7.7.4", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA=="],
+
     "glob/minimatch": ["minimatch@9.0.9", "", { "dependencies": { "brace-expansion": "^2.0.2" } }, "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg=="],
 
     "jszip/readable-stream": ["readable-stream@2.3.8", "", { "dependencies": { "core-util-is": "~1.0.0", "inherits": "~2.0.3", "isarray": "~1.0.0", "process-nextick-args": "~2.0.0", "safe-buffer": "~5.1.1", "string_decoder": "~1.1.1", "util-deprecate": "~1.0.1" } }, "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA=="],
@@ -1380,6 +1388,8 @@
 
     "detective-typescript/@typescript-eslint/typescript-estree/@typescript-eslint/visitor-keys": ["@typescript-eslint/visitor-keys@8.59.1", "", { "dependencies": { "@typescript-eslint/types": "8.59.1", "eslint-visitor-keys": "^5.0.0" } }, "sha512-LdDNl6C5iJExcM0Yh0PwAIBb9PrSiCsWamF/JyEZawm3kFDnRoaq3LGE4bpyRao/fWeGKKyw7icx0YxrLFC5Cg=="],
 
+    "detective-typescript/@typescript-eslint/typescript-estree/semver": ["semver@7.7.4", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA=="],
+
     "glob/minimatch/brace-expansion": ["brace-expansion@2.1.0", "", { "dependencies": { "balanced-match": "^1.0.0" } }, "sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w=="],
 
     "jszip/readable-stream/string_decoder": ["string_decoder@1.1.1", "", { "dependencies": { "safe-buffer": "~5.1.0" } }, "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg=="],

package/docker-entrypoint.sh

@@ -1,11 +1,32 @@
 #!/usr/bin/env sh
 set -eu
 
+# Ensure /tmp has the standard sticky-bit world-writable mode so non-root
+# processes (the `assistant` user, bun's tmpdir, scratch writes) can use it.
+chmod 1777 /tmp 2>/dev/null || true
+
+if [ "${VELLUM_SANDBOX_RUNTIME:-}" = "kata" ] && [ -x /app/assistant/docker-init-apt-root.sh ]; then
+  . /app/assistant/docker-kata-apt-env.sh
+  /app/assistant/docker-init-apt-root.sh
+fi
+
 if [ "$(id -u)" = "0" ] && [ "${VELLUM_WORKSPACE_DIR:-}" = "/workspace" ] && [ -d /workspace ]; then
   git config --global --add safe.directory /workspace >/dev/null 2>&1 || true
   git config --global --add safe.directory '/workspace/*' >/dev/null 2>&1 || true
 fi
 
+# Source executable scripts from /workspace/.entrypoint.d/ in lexicographic
+# order so an assistant can extend the daemon environment from its own
+# workspace volume — PATH additions, credential helpers, tooling symlinks.
+# Scripts are sourced so env mutations propagate to the daemon. Errors are
+# logged but non-fatal.
+if [ -d /workspace/.entrypoint.d ]; then
+  for hook in /workspace/.entrypoint.d/*.sh; do
+    [ -r "$hook" ] || continue
+    . "$hook" || echo "Warning: workspace hook $hook exited $?" >&2
+  done
+fi
+
 # ── Bun profiler bootstrap ──────────────────────────────────────────────
 # When VELLUM_PROFILER_RUN_ID and VELLUM_PROFILER_MODE are set, prepare the
 # run directory on the workspace volume and append the appropriate Bun

package/docker-init-apt-root.sh

@@ -0,0 +1,94 @@
+#!/usr/bin/env sh
+set -eu
+
+DATA_ROOT="${VELLUM_APT_DATA_ROOT:-/data/system}"
+SENTINEL="${DATA_ROOT}/.rootfs-initialized"
+HOST_PATH="/usr/sbin:/usr/bin:/sbin:/bin"
+
+if [ "${VELLUM_SANDBOX_RUNTIME:-}" != "kata" ]; then
+  exit 0
+fi
+
+# Bootstrap the alternate root with the host toolchain so the wrapper
+# binaries in /usr/local/bin do not recurse back into this script.
+export PATH="${HOST_PATH}"
+
+check_sane_mount() {
+  target="$1"
+  probe_dev="${target}/.apt-test-dev-null"
+  probe_exec="${target}/.apt-test-exec"
+  shell_path="/bin/sh"
+
+  mkdir -p "${target}"
+
+  if ! mknod "${probe_dev}" c 1 3 2>/dev/null || ! echo test >"${probe_dev}"; then
+    rm -f "${probe_dev}"
+    : >"${probe_dev}"
+    if ! mount -o bind /dev/null "${probe_dev}" >/dev/null 2>&1; then
+      rm -f "${probe_dev}"
+      return 1
+    fi
+    if ! echo test >"${probe_dev}"; then
+      umount "${probe_dev}" >/dev/null 2>&1 || true
+      rm -f "${probe_dev}"
+      return 1
+    fi
+    umount "${probe_dev}" >/dev/null 2>&1 || true
+  fi
+  rm -f "${probe_dev}"
+
+  if [ ! -x "${shell_path}" ]; then
+    shell_path="$(command -v sh)"
+  fi
+
+  cat >"${probe_exec}" <<EOF
+#! ${shell_path}
+:
+EOF
+  chmod +x "${probe_exec}"
+  if ! "${probe_exec}" >/dev/null 2>&1; then
+    rm -f "${probe_exec}"
+    return 1
+  fi
+  rm -f "${probe_exec}"
+
+  return 0
+}
+
+if [ -f "${SENTINEL}" ] && [ -x "${DATA_ROOT}/bin/sh" ] && [ -x "${DATA_ROOT}/usr/bin/apt-get" ]; then
+  exit 0
+fi
+
+if grep -qs " ${DATA_ROOT} .*noexec" /proc/mounts; then
+  echo "Warning: ${DATA_ROOT} is mounted noexec; skipping persistent apt rootfs bootstrap" >&2
+  exit 0
+fi
+
+if ! check_sane_mount "${DATA_ROOT}"; then
+  echo "Warning: ${DATA_ROOT} cannot host a chrootable apt rootfs here; falling back to image-root apt installs" >&2
+  exit 0
+fi
+
+if [ -x "${DATA_ROOT}/bin/sh" ] && [ -x "${DATA_ROOT}/usr/bin/apt-get" ]; then
+  touch "${SENTINEL}"
+  exit 0
+fi
+
+SUITE="${VELLUM_APT_DATA_SUITE:-}"
+if [ -z "${SUITE}" ] && [ -r /etc/os-release ]; then
+  # shellcheck disable=SC1091
+  . /etc/os-release
+  SUITE="${VERSION_CODENAME:-trixie}"
+fi
+if [ -z "${SUITE}" ]; then
+  SUITE="trixie"
+fi
+
+MIRROR="${VELLUM_APT_DATA_MIRROR:-http://deb.debian.org/debian}"
+ARCH="$(/usr/bin/dpkg --print-architecture)"
+
+mkdir -p "${DATA_ROOT}"
+
+debootstrap --variant=minbase --arch="${ARCH}" "${SUITE}" "${DATA_ROOT}" "${MIRROR}"
+
+touch "${SENTINEL}"

package/docker-kata-apt-env.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env sh
+
+if [ "${VELLUM_SANDBOX_RUNTIME:-}" != "kata" ]; then
+  return 0 2>/dev/null || exit 0
+fi
+
+export VELLUM_APT_DATA_ROOT="${VELLUM_APT_DATA_ROOT:-/data/system}"
+
+_vellum_kata_append_path() {
+  case ":${PATH:-}:" in
+    *":$1:"*) ;;
+    *) PATH="${PATH:+${PATH}:}$1" ;;
+  esac
+}
+
+_vellum_kata_prepend_library_path() {
+  case ":${LD_LIBRARY_PATH:-}:" in
+    *":$1:"*) ;;
+    *) LD_LIBRARY_PATH="$1${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}" ;;
+  esac
+}
+
+_vellum_kata_append_path "${VELLUM_APT_DATA_ROOT}/bin"
+_vellum_kata_append_path "${VELLUM_APT_DATA_ROOT}/usr/local/sbin"
+_vellum_kata_append_path "${VELLUM_APT_DATA_ROOT}/usr/local/bin"
+_vellum_kata_append_path "${VELLUM_APT_DATA_ROOT}/usr/sbin"
+_vellum_kata_append_path "${VELLUM_APT_DATA_ROOT}/usr/bin"
+_vellum_kata_append_path "${VELLUM_APT_DATA_ROOT}/sbin"
+_vellum_kata_append_path "${VELLUM_APT_DATA_ROOT}/usr/games"
+_vellum_kata_append_path "${VELLUM_APT_DATA_ROOT}/games"
+export PATH
+
+_vellum_kata_prepend_library_path "${VELLUM_APT_DATA_ROOT}/usr/lib/aarch64-linux-gnu"
+_vellum_kata_prepend_library_path "${VELLUM_APT_DATA_ROOT}/usr/lib/x86_64-linux-gnu"
+_vellum_kata_prepend_library_path "${VELLUM_APT_DATA_ROOT}/usr/lib"
+_vellum_kata_prepend_library_path "${VELLUM_APT_DATA_ROOT}/usr/local/lib"
+export LD_LIBRARY_PATH
+
+unset -f _vellum_kata_append_path _vellum_kata_prepend_library_path