farai 0.3.1 → 0.3.2

package/dist/cli/index.js

@@ -7270,6 +7270,7 @@ class KaliContainerBackend {
     this.workspacePath = containerWorkspacePath(this.rootWorkspace, this.workspace);
     this.timeoutMs = options.timeoutMs ?? 120000;
     this.processRunner = options.processRunner ?? ((command, args) => runProcess(command, args, Math.min(this.timeoutMs, 15000)));
+    this.pullRunner = options.pullRunner ?? options.processRunner ?? ((command, args) => runProcess(command, args, KALI_IMAGE_PULL_TIMEOUT_MS));
     this.signal = options.signal;
     this.onOutputChunk = options.onOutputChunk;
     this.lifecycle = options.lifecycle;
@@ -7280,9 +7281,56 @@ class KaliContainerBackend {
       imageContract: KALI_IMAGE_CONTRACT
     } : undefined;
   }
-  buildImageCommand() {
-    const contextDir = join9(import.meta.dir, "..", "..", "docker", "kali");
-    return ["docker", "build", "-t", this.image, "-f", join9(contextDir, "Dockerfile"), contextDir];
+  pullImageCommand() {
+    return ["docker", "pull", this.image];
+  }
+  async ensureImage() {
+    const current = await this.resolveImage();
+    if (current.exists && current.contract === KALI_IMAGE_CONTRACT) {
+      return {
+        exitCode: 0,
+        stdout: "image ready",
+        stderr: "",
+        durationMs: 0,
+        timedOut: false
+      };
+    }
+    const started = Date.now();
+    const pulled = await this.pullRunner("docker", ["pull", this.image]);
+    if (pulled.exitCode !== 0) {
+      return {
+        ...pulled,
+        stderr: dockerFailure(pulled, `could not pull kali image ${this.image}; check network access to ${KALI_IMAGE_REPO}`),
+        durationMs: Date.now() - started,
+        timedOut: false
+      };
+    }
+    const resolved = await this.resolveImage();
+    if (!resolved.exists) {
+      return {
+        exitCode: 1,
+        stdout: "",
+        stderr: resolved.error ?? `kali image ${this.image} is still missing after pull`,
+        durationMs: Date.now() - started,
+        timedOut: false
+      };
+    }
+    if (resolved.contract !== KALI_IMAGE_CONTRACT) {
+      return {
+        exitCode: 1,
+        stdout: "",
+        stderr: `pulled kali image ${this.image} does not satisfy the farai capability contract (${resolved.contract ?? "missing"})`,
+        durationMs: Date.now() - started,
+        timedOut: false
+      };
+    }
+    return {
+      exitCode: 0,
+      stdout: pulled.stdout || "image pulled",
+      stderr: "",
+      durationMs: Date.now() - started,
+      timedOut: false
+    };
   }
   async status() {
     const image = await this.resolveImage();
@@ -7427,18 +7475,13 @@ class KaliContainerBackend {
   }
   async startPersistentBody() {
     try {
-      const status = await this.status();
-      if (!status.imageExists) {
+      const ensured = await this.ensureImage();
+      if (ensured.exitCode !== 0) {
         if (this.identity && this.lifecycle)
           this.lifecycle.release(this.identity);
-        return {
-          exitCode: 1,
-          stdout: "",
-          stderr: status.dockerError ?? `kali image ${this.image} is missing; run \`farai setup --no-kb\``,
-          durationMs: 0,
-          timedOut: false
-        };
+        return ensured;
       }
+      const status = await this.status();
       if (status.dockerError) {
         if (this.identity && this.lifecycle)
           this.lifecycle.release(this.identity);
@@ -7460,17 +7503,6 @@ class KaliContainerBackend {
           timedOut: false
         };
       }
-      if (!status.imageContractCurrent) {
-        if (this.identity && this.lifecycle)
-          this.lifecycle.release(this.identity);
-        return {
-          exitCode: 1,
-          stdout: "",
-          stderr: `kali image ${this.image} does not satisfy the farai kali capability contract; run \`farai setup --no-kb\``,
-          durationMs: 0,
-          timedOut: false
-        };
-      }
       if (status.persistentRunning && status.persistentImageCurrent && (!this.identity || status.persistentIdentityCurrent)) {
         return {
           exitCode: 0,
@@ -7928,7 +7960,7 @@ function containerDoesNotExist2(result) {
   return /no such (container|object)/i.test(`${result.stdout}
 ${result.stderr}`);
 }
-var CONTAINER_WORKSPACE_MOUNT = "/workspace", CONTAINER_WORKTREES_MOUNT = "/worktrees", kaliSessions, kaliPtySessions, containerStartLocks, globalContainerStartChain, CONTAINER_EXEC_MARKER_DIR = "/tmp/farai-exec", CONTAINER_EXEC_WRAPPER, CONTAINER_EXEC_KILLER, CONTAINER_PREFIX, KALI_IMAGE_CONTRACT, DEFAULT_KALI_IMAGE = "farai-kali:latest", KALI_IMAGE_CONTRACT_LABEL = "org.farai.kali.contract";
+var CONTAINER_WORKSPACE_MOUNT = "/workspace", CONTAINER_WORKTREES_MOUNT = "/worktrees", kaliSessions, kaliPtySessions, containerStartLocks, globalContainerStartChain, CONTAINER_EXEC_MARKER_DIR = "/tmp/farai-exec", CONTAINER_EXEC_WRAPPER, CONTAINER_EXEC_KILLER, CONTAINER_PREFIX, KALI_IMAGE_CONTRACT, KALI_IMAGE_REPO = "ghcr.io/pajarori/farai-kali", DEFAULT_KALI_IMAGE, KALI_IMAGE_CONTRACT_LABEL = "org.farai.kali.contract", KALI_IMAGE_PULL_TIMEOUT_MS;
 var init_kali = __esm(() => {
   init_spawn_session();
   init_pty_session();
@@ -7947,6 +7979,8 @@ var init_kali = __esm(() => {
 `);
   CONTAINER_PREFIX = FARAI_CONTAINER_NAME_PREFIX;
   KALI_IMAGE_CONTRACT = KALI_TOOL_MANIFEST.contract;
+  DEFAULT_KALI_IMAGE = `${KALI_IMAGE_REPO}:${KALI_IMAGE_CONTRACT}`;
+  KALI_IMAGE_PULL_TIMEOUT_MS = 30 * 60 * 1000;
 });
 
 // src/agent-tools/shared/backend.ts
@@ -8698,8 +8732,8 @@ var init_process_output = __esm(() => {
 
 // src/version.ts
 function resolveFaraiVersion() {
-  if ("0.3.1")
-    return "0.3.1";
+  if ("0.3.2")
+    return "0.3.2";
   try {
     const parsed = JSON.parse(readBoundedFileTextSync(new URL("../package.json", import.meta.url), 1024 * 1024, "package metadata"));
     if (typeof parsed.version === "string" && parsed.version)
@@ -19996,15 +20030,15 @@ var init_add_finding = __esm(() => {
         },
         impact: {
           type: "string",
-          description: "security impact demonstrated by the evidence"
+          description: "security impact demonstrated by the evidence. rendered as markdown in the findings tab and reports"
         },
         reproduction: {
           type: "string",
-          description: "minimal reproducible steps and observed result"
+          description: "minimal reproducible steps and observed result. rendered as markdown, so write it well: use an ordered list for steps, fenced code blocks for requests, responses, payloads, and commands, and tables where they clarify"
         },
         remediation: {
           type: "string",
-          description: "specific corrective action"
+          description: "specific corrective action. rendered as markdown in the findings tab and reports"
         },
         campaignId: {
           type: "string",
@@ -20151,15 +20185,15 @@ var init_update_finding = __esm(() => {
         },
         impact: {
           type: "string",
-          description: "updated demonstrated security impact"
+          description: "updated demonstrated security impact. rendered as markdown in the findings tab and reports"
         },
         reproduction: {
           type: "string",
-          description: "updated minimal reproducible steps and observed result"
+          description: "updated minimal reproducible steps and observed result. rendered as markdown, so write it well: use an ordered list for steps, fenced code blocks for requests, responses, payloads, and commands, and tables where they clarify"
         },
         remediation: {
           type: "string",
-          description: "updated specific corrective action"
+          description: "updated specific corrective action. rendered as markdown in the findings tab and reports"
         }
       },
       additionalProperties: false,
@@ -43713,6 +43747,81 @@ var init_preflight = __esm(() => {
   init_updater();
 });
 
+// src/agent-container/preflight.ts
+var exports_preflight2 = {};
+__export(exports_preflight2, {
+  runStartupContainerPreflight: () => runStartupContainerPreflight
+});
+import { createInterface as createInterface2 } from "readline";
+async function runStartupContainerPreflight(workspace) {
+  const backend2 = new KaliContainerBackend({
+    workspace
+  });
+  const image = await backend2.resolveImage().catch(() => {
+    return;
+  });
+  if (!image || image.error)
+    return "continue";
+  if (image.exists && image.contract === KALI_IMAGE_CONTRACT)
+    return "continue";
+  const config = loadConfig(workspace);
+  if (config.updates?.prompt === false || !process.stdin.isTTY || !process.stdout.isTTY)
+    return "continue";
+  const answer = await promptForImagePull(KALI_IMAGE_CONTRACT, image.exists);
+  if (answer === "cancelled")
+    return "cancelled";
+  if (answer === "later")
+    return "continue";
+  console.log(`pulling ${DEFAULT_KALI_IMAGE}...`);
+  const pulled = await spawnPull();
+  if (pulled !== 0) {
+    console.error("kali image pull failed; farai will retry when the container is first needed");
+  }
+  return "continue";
+}
+async function promptForImagePull(contract, exists) {
+  console.log("");
+  console.log(FARAI_BANNER);
+  console.log("");
+  console.log(exists ? `kali container image is outdated (needs ${contract})` : `kali container image ${contract} is not installed`);
+  const interfaceHandle = createInterface2({
+    input: process.stdin,
+    output: process.stdout
+  });
+  return await new Promise((resolve10) => {
+    let settled = false;
+    const finish = (value) => {
+      if (settled)
+        return;
+      settled = true;
+      interfaceHandle.close();
+      resolve10(value);
+    };
+    interfaceHandle.once("SIGINT", () => finish("cancelled"));
+    interfaceHandle.question("pull before starting? [enter=yes, n=later] ", (value) => {
+      const normalized = value.trim().toLowerCase();
+      if (normalized === "n" || normalized === "no" || normalized === "later")
+        finish("later");
+      else
+        finish("apply");
+    });
+  });
+}
+async function spawnPull() {
+  const proc = Bun.spawn(["docker", "pull", DEFAULT_KALI_IMAGE], {
+    stdout: "inherit",
+    stderr: "inherit",
+    env: faraiDockerEnvironment()
+  });
+  return await proc.exited;
+}
+var init_preflight2 = __esm(() => {
+  init_branding();
+  init_config();
+  init_docker_environment();
+  init_kali();
+});
+
 // node_modules/solid-js/dist/solid.js
 function getContextId(count2) {
   const num2 = String(count2), len = num2.length - 1;
@@ -65250,8 +65359,8 @@ function FindingsEmpty(props) {
 }
 function findingMarkdown(finding) {
   const evidence = finding.evidenceIds.length > 0 ? finding.evidenceIds.map((id2) => `- \`${id2}\``) : ["_no linked evidence._"];
-  const technical = [finding.cvssVector ? `- cvss 3.1 vector: \`${finding.cvssVector}\`` : "", finding.campaignId ? `- campaign: \`${finding.campaignId}\`` : "", finding.hypothesisId ? `- hypothesis: \`${finding.hypothesisId}\`` : "", finding.duplicateOf ? `- duplicate of: \`${finding.duplicateOf}\`` : ""].filter(Boolean);
-  return ["## impact", "", finding.impact.trim() || "_not recorded._", "", "## reproduction", "", finding.reproduction.trim() || "_not recorded._", "", "## evidence", "", ...evidence, "", "## remediation", "", finding.remediation.trim() || "_not recorded._", ...technical.length > 0 ? ["", "## technical details", "", ...technical] : []].join(`
+  const technical = [finding.cvssVector ? `- CVSS 3.1 : \`${finding.cvssVector}\`` : "", finding.campaignId ? `- campaign : \`${finding.campaignId}\`` : "", finding.hypothesisId ? `- hypothesis: \`${finding.hypothesisId}\`` : "", finding.duplicateOf ? `- duplicate of: \`${finding.duplicateOf}\`` : ""].filter(Boolean);
+  return [...technical.length > 0 ? ["## technical details", "", ...technical, ""] : [], "## impact", "", finding.impact.trim() || "_not recorded._", "", "## reproduction", "", finding.reproduction.trim() || "_not recorded._", "", "## remediation", "", finding.remediation.trim() || "_not recorded._", "", "## evidence", "", ...evidence].join(`
 `);
 }
 function filteredFindings(findings, query) {
@@ -71890,11 +71999,15 @@ class BenchmarkDockerLifecycle {
   }
   async startUnlocked() {
     const processRunner = (command, args2) => this.runner(command, args2);
-    const image = await new KaliContainerBackend({
+    const provisioner = new KaliContainerBackend({
       workspace: this.workspace,
       image: DEFAULT_KALI_IMAGE,
       processRunner
-    }).resolveImage();
+    });
+    const ensured = await provisioner.ensureImage();
+    if (ensured.exitCode !== 0)
+      throw new Error(ensured.stderr || `benchmark agent image is unavailable: ${DEFAULT_KALI_IMAGE}`);
+    const image = await provisioner.resolveImage();
     if (!image.exists)
       throw new Error(image.error ?? `benchmark agent image is missing: ${DEFAULT_KALI_IMAGE}`);
     if (image.error)
@@ -73204,7 +73317,6 @@ var init_suite = __esm(() => {
 // src/cli/index.ts
 init_runtime();
 init_kali();
-init_docker_environment();
 init_model_registry();
 init_model_catalog();
 init_model_profiles();
@@ -73254,9 +73366,6 @@ function parseSetupArguments(args) {
     "api-key-stdin": {
       type: "boolean"
     },
-    "no-docker": {
-      type: "boolean"
-    },
     "no-kb": {
       type: "boolean"
     },
@@ -73277,7 +73386,6 @@ function parseSetupArguments(args) {
   if (!model && (baseUrl || apiKeyEnv || apiKeyStdin))
     throw new Error("--base-url and api key options require --model");
   return {
-    skipDocker: optionalBoolean(values, "no-docker"),
     skipKnowledge: aliasedBoolean(values, "no-kb", "no-knowledge"),
     ...optionalProperty("model", model),
     ...optionalProperty("baseUrl", baseUrl),
@@ -73765,15 +73873,15 @@ async function doctor() {
     workspace: process.cwd()
   });
   const image = await backend2.resolveImage();
-  console.log(`kali image: ${backend2.image} (${image.exists ? "exists" : "missing"})`);
-  console.log(`kali contract: ${image.contract ?? "missing"}`);
-  console.log(`kali capabilities: ${image.contract === KALI_IMAGE_CONTRACT ? "ready" : "rebuild required"}`);
+  const capabilities = !image.exists ? "not installed (pulled on first run)" : image.contract === KALI_IMAGE_CONTRACT ? "ready" : "update available (pulled on first run)";
+  console.log(`kali image: ${backend2.image} (${image.exists ? "installed" : "missing"})`);
+  console.log(`kali contract: ${image.contract ?? "missing"} (expected ${KALI_IMAGE_CONTRACT})`);
+  console.log(`kali capabilities: ${capabilities}`);
   const {
     contentStatus: contentStatus2
   } = await Promise.resolve().then(() => (init_updater(), exports_updater));
   const content = contentStatus2();
   console.log(`content: ${content.active?.version ?? "local fallback"}`);
-  console.log(`setup command: farai setup`);
 }
 async function setup(args2) {
   const parsed = parseSetupArguments(args2);
@@ -73787,17 +73895,7 @@ async function setup(args2) {
     const addArgs = [parsed.model, ...parsed.baseUrl ? ["--base-url", parsed.baseUrl] : [], ...parsed.apiKeyEnv ? ["--api-key-env", parsed.apiKeyEnv] : [], ...parsed.apiKeyStdin ? ["--api-key-stdin"] : [], "--set-default"];
     await addModel(addArgs);
   }
-  if (!parsed.skipDocker) {
-    console.log("[*] building Farai Kali image");
-    const code = await buildContainer();
-    if (code !== 0) {
-      process.exitCode = code;
-      console.error("[!] docker image build failed; rerun `farai setup --no-kb` after fixing Docker");
-      return;
-    }
-  } else {
-    console.log("[*] skipping Docker image build");
-  }
+  console.log(`[*] kali image: ${DEFAULT_KALI_IMAGE} (pulled on first run)`);
   if (!parsed.skipKnowledge) {
     const contentInstalled = await syncContentForSetup(process.cwd());
     if (!contentInstalled) {
@@ -73937,11 +74035,18 @@ async function launchTui(workspace, sessionId) {
   const {
     runStartupContentPreflight: runStartupContentPreflight2
   } = await Promise.resolve().then(() => (init_preflight(), exports_preflight));
+  const {
+    runStartupContainerPreflight: runStartupContainerPreflight2
+  } = await Promise.resolve().then(() => (init_preflight2(), exports_preflight2));
   const effectiveWorkspace = sessionId ? resolveSessionLocation(sessionId)?.workspace ?? workspace : workspace;
   if (await runStartupContentPreflight2(effectiveWorkspace) === "cancelled") {
     process.exitCode = 130;
     return;
   }
+  if (await runStartupContainerPreflight2(effectiveWorkspace) === "cancelled") {
+    process.exitCode = 130;
+    return;
+  }
   if (import.meta.path.endsWith(".ts")) {
     const sourceTuiPreload = "@opentui/solid/preload";
     await import(sourceTuiPreload);
@@ -74047,20 +74152,6 @@ async function benchmark(args2) {
     return;
   }
 }
-async function buildContainer() {
-  const backend2 = new KaliContainerBackend({
-    workspace: process.cwd()
-  });
-  console.log(backend2.buildImageCommand().join(" "));
-  const proc = Bun.spawn(backend2.buildImageCommand(), {
-    stdout: "inherit",
-    stderr: "inherit",
-    env: faraiDockerEnvironment()
-  });
-  const code = await proc.exited;
-  process.exitCode = code;
-  return code;
-}
 function wantsHelp(args2) {
   return args2.includes("--help") || args2.includes("-h") || args2[0] === "help";
 }
@@ -74076,7 +74167,6 @@ Options:
   --base-url <url>              OpenAI-compatible provider URL
   --api-key-env <ENV>           Environment variable containing the API key
   --api-key-stdin               Read the API key from stdin
-  --no-docker                   Skip Farai Kali image build
   --no-kb, --no-knowledge       Skip knowledge base content sync
 
 Examples:
@@ -74148,7 +74238,7 @@ Usage:
   farai
   farai resume [session-name-or-id]
   farai run <prompt> [--session <id>] [--json]
-  farai setup [--model provider:model] [--base-url url] [--api-key-env ENV | --api-key-stdin] [--no-docker] [--no-kb]
+  farai setup [--model provider:model] [--base-url url] [--api-key-env ENV | --api-key-stdin] [--no-kb]
   farai init [--target <ip-or-host>] [--name <name>] [--model provider:model]
   farai doctor
   farai model
@@ -74170,5 +74260,5 @@ Examples:
 `);
 }
 
-//# debugId=DE3417A125CB5EC964756E2164756E21
+//# debugId=4868BF6C23AAC2A664756E2164756E21
 //# sourceMappingURL=index.js.map