@zenera/neo 1.1.20 → 1.1.22

package/dist/tools/sandbox.js

@@ -39,6 +39,17 @@ const MAX_TIMEOUT_MS = 3_600_000;
 const DEFAULT_PIDS = 1024;
 /** How long a container gets to stop itself before it is killed. */
 const STOP_GRACE_S = 2;
+// Standard mode's resource ceilings. Even without the strict profile, an
+// unbounded container can exhaust host cores or memory during runaway builds.
+const DEFAULT_CPUS = 4;
+const DEFAULT_MEMORY = 4096;
+// Strict mode's own defaults. A limit that is only there when someone
+// remembered to write it down is not a limit, so the profile supplies one for
+// each of the four exhaustible things: cores, memory, processes and disk.
+const STRICT_CPUS = 2;
+const STRICT_MEMORY = 2048;
+const STRICT_TMPFS = 'rw,noexec,nosuid,nodev';
+const STRICT_TMP_SIZE = '64m';
 /** The family name config selects the whole set by: `tools: [sandbox:*]`. */
 export const SANDBOX_GROUP = 'sandbox';
 /** A failure the caller can do something about — a missing engine, usually. */
@@ -198,14 +209,36 @@ export class Sandbox {
         }
         args.push('--pids-limit', String(DEFAULT_PIDS));
         // `no-new-privileges` costs nothing here and closes setuid escalation.
-        // Capabilities are deliberately *not* dropped wholesale: installing a
-        // package is the ordinary use of this tool, and `--cap-drop=ALL` breaks
-        // every package manager there is. The container is the boundary.
+        // Under `standard` the capabilities are deliberately *not* dropped
+        // wholesale: installing a package is the ordinary use of this tool, and
+        // `--cap-drop=ALL` breaks every package manager there is. The container
+        // is the boundary. `strict` makes the opposite trade, below.
         args.push('--security-opt', 'no-new-privileges');
         // Background jobs orphan processes; without an init they accumulate as
         // zombies until the pids limit stops the sandbox dead.
         args.push('--init');
         args.push('--restart', 'no');
+        if (s.hardening === 'strict') {
+            args.push('--cap-drop', 'ALL');
+            // The image's own files become reference material: a command can
+            // read a binary and run it, and can write nowhere but the mounts
+            // and the tmpfs below.
+            args.push('--read-only');
+            // `noexec` is safe for the job launcher because a job script is
+            // *interpreted* (`/bin/sh <file>`), never executed as a program.
+            // `/run` is left to podman's own read-only tmpfs: `--init` mounts
+            // catatonit under it and has to be able to exec it.
+            args.push('--tmpfs', `/tmp:${STRICT_TMPFS},size=${STRICT_TMP_SIZE}`);
+            if (!s.user) {
+                // Rootless podman maps container uid 0 to the host account, so
+                // the default container root is already unprivileged on the
+                // host — but it is uid 0 *inside*, where the setuid binaries
+                // are. `keep-id` runs the process as the host's own uid, which
+                // is both non-zero and the owner of every bind mount, so the
+                // workspace stays writable without a chown.
+                args.push('--userns', 'keep-id');
+            }
+        }
         if (s.user) {
             args.push('--user', s.user);
         }
@@ -418,15 +451,20 @@ function resolveSpec(opts) {
     if (!posix.isAbsolute(workdir)) {
         throw new SandboxError(`sandbox workdir must be absolute: ${workdir}`);
     }
+    const hardening = opts.hardening ?? 'standard';
+    const strict = hardening === 'strict';
     return {
         root: opts.root,
         key: opts.key,
         image: opts.image ?? DEFAULT_IMAGE,
-        cpus: opts.cpus ?? 0,
-        memory: opts.memory ?? 0,
-        network: opts.network ?? 'bridge',
+        cpus: opts.cpus ?? (strict ? STRICT_CPUS : DEFAULT_CPUS),
+        memory: opts.memory ?? (strict ? STRICT_MEMORY : DEFAULT_MEMORY),
+        explicitCpus: opts.cpus !== undefined,
+        explicitMemory: opts.memory !== undefined,
+        network: opts.network ?? (strict ? 'none' : 'bridge'),
         workdir,
         timeout: opts.timeout ?? DEFAULT_TIMEOUT_MS / 1000,
+        hardening,
         user: opts.user,
         persist: opts.persist ?? false,
         env: opts.env ?? {},
@@ -447,12 +485,21 @@ function resolveSpec(opts) {
  * every time a key was rotated.
  */
 function containerName(spec) {
+    // Unconfigured cpus and memory hash 0 under standard and strict's own
+    // defaults under strict, so introducing defaults did not rename every
+    // existing container.
+    const hashCpus = spec.explicitCpus ? spec.cpus : spec.hardening === 'strict' ? STRICT_CPUS : 0;
+    const hashMemory = spec.explicitMemory
+        ? spec.memory
+        : spec.hardening === 'strict'
+            ? STRICT_MEMORY
+            : 0;
     const digest = createHash('sha256')
         .update(JSON.stringify([
         spec.root,
         spec.image,
-        spec.cpus,
-        spec.memory,
+        hashCpus,
+        hashMemory,
         spec.network,
         spec.workdir,
         spec.user ?? null,
@@ -460,6 +507,9 @@ function containerName(spec) {
         spec.mounts,
         Object.entries(spec.env).sort(),
         [...spec.secrets].sort(),
+        // Appended only when it is set, so adding the profile did not
+        // rename every container that existed before it.
+        ...(spec.hardening === 'strict' ? ['strict'] : []),
     ]))
         .digest('hex')
         .slice(0, 10);

package/dist/tools/workspace.js

@@ -760,8 +760,8 @@ function patchLines(lines, chunks, file) {
 // ---------------------------------------------------------------------------
 // The tools
 // ---------------------------------------------------------------------------
-/** The family name config selects the whole set by: `tools: [workspace:*]`. */
-const GROUP = 'workspace';
+/** The family name config selects the whole set by: `tools: [files:*]` (or legacy `workspace:*`). */
+const GROUP = 'files';
 export function workspaceTools(opts) {
     const ws = new Workspace(opts);
     // What the model is told about naming a file. The long form goes in

package/dist/types.js

@@ -57,6 +57,16 @@ export function isToolReturn(v) {
 export function tool(def) {
     return def;
 }
+/**
+ * Aliases for tool groups, so renaming a group breaks no existing configuration.
+ * `workspace` is the legacy name for the file tools (`files`).
+ */
+const GROUP_ALIASES = {
+    workspace: 'files',
+};
+function canonicalGroup(group) {
+    return group ? (GROUP_ALIASES[group] ?? group) : undefined;
+}
 /**
  * Resolves selectors against the tools a host provided, in the order written
  * and without duplicates. A selector is a tool name, `<group>:<name>` for the
@@ -88,11 +98,14 @@ function matchTools(available, selector, opts) {
         return available;
     }
     if (selector.endsWith(':*')) {
-        const group = selector.slice(0, -2);
-        const hits = available.filter((t) => t.group === group);
+        const rawGroup = selector.slice(0, -2);
+        const group = canonicalGroup(rawGroup) ?? rawGroup;
+        const hits = available.filter((t) => (canonicalGroup(t.group) ?? t.group) === group);
         if (hits.length === 0) {
-            const groups = [...new Set(available.map((t) => t.group).filter(Boolean))];
-            throw new Error(`${opts.where}: no tools in group "${group}" ` +
+            const groups = [
+                ...new Set(available.map((t) => canonicalGroup(t.group) ?? t.group).filter(Boolean)),
+            ];
+            throw new Error(`${opts.where}: no tools in group "${rawGroup}" ` +
                 `(known groups: ${groups.join(', ') || 'none'})`);
         }
         return hits;
@@ -101,21 +114,23 @@ function matchTools(available, selector, opts) {
     if (exact) {
         return [exact];
     }
-    // `workspace:read_file` is the same thing as `read_file`: an author who
-    // writes `workspace:*` on one line should not be told the qualified form
-    // is a typo on the next.
+    // `workspace:read_file` or `files:read_file` is the same thing as `read_file`:
+    // an author who writes `files:*` on one line should not be told the qualified
+    // form is a typo on the next.
     const colon = selector.lastIndexOf(':');
     if (colon > 0) {
-        const group = selector.slice(0, colon);
+        const rawGroup = selector.slice(0, colon);
+        const group = canonicalGroup(rawGroup) ?? rawGroup;
         const name = selector.slice(colon + 1);
-        const qualified = available.find((t) => t.group === group && t.name === name);
+        const qualified = available.find((t) => (canonicalGroup(t.group) ?? t.group) === group && t.name === name);
         if (qualified) {
             return [qualified];
         }
         const elsewhere = available.find((t) => t.name === name);
         if (elsewhere) {
+            const elsewhereGroup = canonicalGroup(elsewhere.group) ?? elsewhere.group ?? 'none';
             throw new Error(`${opts.where}: unknown tool "${selector}" ` +
-                `("${name}" is in group "${elsewhere.group ?? 'none'}", not "${group}")`);
+                `("${name}" is in group "${elsewhereGroup}", not "${rawGroup}")`);
         }
     }
     const known = available.map((t) => t.name).join(', ') || 'none';

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@zenera/neo",
-    "version": "1.1.20",
+    "version": "1.1.22",
     "description": "A multi-agent runtime for Node.js: agents, models, tools, skills, memory and an append-only trajectory.",
     "keywords": [
         "agents",