farai 0.3.2 → 0.3.3

package/dist/cli/index.js

@@ -5398,7 +5398,7 @@ function parseManifest(value) {
   if (!value || typeof value !== "object")
     throw new Error("invalid farai tool manifest");
   const candidate = value;
-  if (typeof candidate.contract !== "string" || !candidate.contract || !Array.isArray(candidate.aptPackages) || !candidate.pinnedTools || typeof candidate.pinnedTools !== "object" || !candidate.pinnedAssets || typeof candidate.pinnedAssets !== "object" || !candidate.workflows || typeof candidate.workflows !== "object") {
+  if (!Array.isArray(candidate.aptPackages) || !candidate.pinnedTools || typeof candidate.pinnedTools !== "object" || !candidate.pinnedAssets || typeof candidate.pinnedAssets !== "object" || !candidate.workflows || typeof candidate.workflows !== "object") {
     throw new Error("invalid farai tool manifest");
   }
   const aptPackages = candidate.aptPackages.filter((item) => typeof item === "string" && Boolean(item));
@@ -5445,7 +5445,6 @@ function parseManifest(value) {
   if (!Object.keys(pinnedAssets).length)
     throw new Error("empty pinned asset manifest");
   return {
-    contract: candidate.contract,
     aptPackages,
     pinnedTools,
     pinnedAssets,
@@ -5455,11 +5454,15 @@ function parseManifest(value) {
 function isSha256(value) {
   return typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
 }
-var KALI_TOOL_MANIFEST_PATH, KALI_TOOL_MANIFEST;
+var KALI_TOOL_MANIFEST_PATH, KALI_IMAGE_CONTRACT_PATH, KALI_TOOL_MANIFEST, KALI_IMAGE_CONTRACT;
 var init_kali_tool_manifest = __esm(() => {
   init_file_read();
   KALI_TOOL_MANIFEST_PATH = join4(import.meta.dir, "..", "..", "docker", "kali", "farai-tool-manifest.json");
+  KALI_IMAGE_CONTRACT_PATH = join4(import.meta.dir, "..", "..", "docker", "kali", "farai-image-contract");
   KALI_TOOL_MANIFEST = parseManifest(JSON.parse(readBoundedFileTextSync(KALI_TOOL_MANIFEST_PATH, 1024 * 1024, "kali tool manifest")));
+  KALI_IMAGE_CONTRACT = readBoundedFileTextSync(KALI_IMAGE_CONTRACT_PATH, 1024, "kali image contract").trim();
+  if (!KALI_IMAGE_CONTRACT)
+    throw new Error("empty kali image contract");
 });
 
 // src/agent-tools/mcp-builtins.ts
@@ -7284,20 +7287,59 @@ class KaliContainerBackend {
   pullImageCommand() {
     return ["docker", "pull", this.image];
   }
-  async ensureImage() {
-    const current = await this.resolveImage();
-    if (current.exists && current.contract === KALI_IMAGE_CONTRACT) {
+  async remoteImageDigest() {
+    const inspect = await this.processRunner("docker", ["buildx", "imagetools", "inspect", this.image, "--format", "{{.Manifest.Digest}}"]);
+    if (inspect.exitCode !== 0)
+      return;
+    return digestOf(inspect.stdout.trim());
+  }
+  async checkForImageUpdate() {
+    const local = await this.resolveImage();
+    if (!local.exists)
       return {
-        exitCode: 0,
-        stdout: "image ready",
-        stderr: "",
-        durationMs: 0,
-        timedOut: false
+        exists: false,
+        upToDate: false,
+        ...local.error ? {
+          error: local.error
+        } : {}
       };
+    const remote = await this.remoteImageDigest();
+    if (!remote || !local.repoDigest)
+      return {
+        exists: true,
+        upToDate: true
+      };
+    return {
+      exists: true,
+      upToDate: local.repoDigest === remote
+    };
+  }
+  async ensureImage() {
+    const local = await this.resolveImage();
+    if (local.exists) {
+      const remote = await this.remoteImageDigest();
+      if (!remote || local.repoDigest !== undefined && local.repoDigest === remote) {
+        return {
+          exitCode: 0,
+          stdout: "image ready",
+          stderr: "",
+          durationMs: 0,
+          timedOut: false
+        };
+      }
     }
     const started = Date.now();
     const pulled = await this.pullRunner("docker", ["pull", this.image]);
     if (pulled.exitCode !== 0) {
+      if (local.exists) {
+        return {
+          exitCode: 0,
+          stdout: pulled.stdout || "using local kali image",
+          stderr: "",
+          durationMs: Date.now() - started,
+          timedOut: false
+        };
+      }
       return {
         ...pulled,
         stderr: dockerFailure(pulled, `could not pull kali image ${this.image}; check network access to ${KALI_IMAGE_REPO}`),
@@ -7315,15 +7357,6 @@ class KaliContainerBackend {
         timedOut: false
       };
     }
-    if (resolved.contract !== KALI_IMAGE_CONTRACT) {
-      return {
-        exitCode: 1,
-        stdout: "",
-        stderr: `pulled kali image ${this.image} does not satisfy the farai capability contract (${resolved.contract ?? "missing"})`,
-        durationMs: Date.now() - started,
-        timedOut: false
-      };
-    }
     return {
       exitCode: 0,
       stdout: pulled.stdout || "image pulled",
@@ -7922,6 +7955,7 @@ function parseImageInspect(raw) {
         exists: true
       };
     const contract = image.Config?.Labels?.[KALI_IMAGE_CONTRACT_LABEL];
+    const repoDigest = digestOf((image.RepoDigests ?? []).find((entry) => entry.includes("@sha256:")));
     return {
       exists: true,
       ...image.Id ? {
@@ -7929,6 +7963,9 @@ function parseImageInspect(raw) {
       } : {},
       ...contract ? {
         contract
+      } : {},
+      ...repoDigest ? {
+        repoDigest
       } : {}
     };
   } catch {
@@ -7937,6 +7974,12 @@ function parseImageInspect(raw) {
     };
   }
 }
+function digestOf(reference) {
+  if (!reference)
+    return;
+  const match = reference.match(/sha256:[a-f0-9]{64}/i);
+  return match ? match[0].toLowerCase() : undefined;
+}
 function dockerFailure(result, fallback) {
   const detail = `${result.stderr}
 ${result.stdout}`.trim().replace(/\s+/g, " ");
@@ -7960,7 +8003,7 @@ function containerDoesNotExist2(result) {
   return /no such (container|object)/i.test(`${result.stdout}
 ${result.stderr}`);
 }
-var CONTAINER_WORKSPACE_MOUNT = "/workspace", CONTAINER_WORKTREES_MOUNT = "/worktrees", kaliSessions, kaliPtySessions, containerStartLocks, globalContainerStartChain, CONTAINER_EXEC_MARKER_DIR = "/tmp/farai-exec", CONTAINER_EXEC_WRAPPER, CONTAINER_EXEC_KILLER, CONTAINER_PREFIX, KALI_IMAGE_CONTRACT, KALI_IMAGE_REPO = "ghcr.io/pajarori/farai-kali", DEFAULT_KALI_IMAGE, KALI_IMAGE_CONTRACT_LABEL = "org.farai.kali.contract", KALI_IMAGE_PULL_TIMEOUT_MS;
+var CONTAINER_WORKSPACE_MOUNT = "/workspace", CONTAINER_WORKTREES_MOUNT = "/worktrees", kaliSessions, kaliPtySessions, containerStartLocks, globalContainerStartChain, CONTAINER_EXEC_MARKER_DIR = "/tmp/farai-exec", CONTAINER_EXEC_WRAPPER, CONTAINER_EXEC_KILLER, CONTAINER_PREFIX, KALI_IMAGE_REPO = "ghcr.io/pajarori/farai-kali", KALI_IMAGE_TAG = "latest", DEFAULT_KALI_IMAGE, KALI_IMAGE_CONTRACT_LABEL = "org.farai.kali.contract", KALI_IMAGE_PULL_TIMEOUT_MS;
 var init_kali = __esm(() => {
   init_spawn_session();
   init_pty_session();
@@ -7978,8 +8021,7 @@ var init_kali = __esm(() => {
   CONTAINER_EXEC_KILLER = ["import os, signal, sys, time", "path = sys.argv[1]", "root = None", "marker_deadline = time.monotonic() + 0.25", "while root is None and time.monotonic() < marker_deadline:", "    try:", "        with open(path, encoding='ascii') as handle:", "            root = int(handle.read().strip())", "    except (FileNotFoundError, OSError, ValueError):", "        time.sleep(0.01)", "if root is None:", "    raise SystemExit(0)", "def direct_children(pid):", "    try:", "        with open(f'/proc/{pid}/task/{pid}/children', encoding='ascii') as handle:", "            return [int(value) for value in handle.read().split()]", "    except (FileNotFoundError, OSError, ValueError):", "        return []", "def descendants(pid):", "    found = []", "    pending = direct_children(pid)", "    seen = set()", "    while pending:", "        child = pending.pop()", "        if child in seen:", "            continue", "        seen.add(child)", "        found.append(child)", "        pending.extend(direct_children(child))", "    return found", "def alive(pid):", "    try:", "        os.kill(pid, 0)", "        return True", "    except ProcessLookupError:", "        return False", "    except PermissionError:", "        return True", "targets = descendants(root)", "for pid in [*reversed(targets), root]:", "    try:", "        os.kill(pid, signal.SIGTERM)", "    except (ProcessLookupError, PermissionError):", "        pass", "deadline = time.monotonic() + 1.0", "while time.monotonic() < deadline and any(alive(pid) for pid in [root, *targets]):", "    time.sleep(0.025)", "targets = list(dict.fromkeys([*targets, *descendants(root)]))", "for pid in [*reversed(targets), root]:", "    try:", "        os.kill(pid, signal.SIGKILL)", "    except (ProcessLookupError, PermissionError):", "        pass", "try:", "    os.unlink(path)", "except FileNotFoundError:", "    pass"].join(`
 `);
   CONTAINER_PREFIX = FARAI_CONTAINER_NAME_PREFIX;
-  KALI_IMAGE_CONTRACT = KALI_TOOL_MANIFEST.contract;
-  DEFAULT_KALI_IMAGE = `${KALI_IMAGE_REPO}:${KALI_IMAGE_CONTRACT}`;
+  DEFAULT_KALI_IMAGE = `${KALI_IMAGE_REPO}:${KALI_IMAGE_TAG}`;
   KALI_IMAGE_PULL_TIMEOUT_MS = 30 * 60 * 1000;
 });
 
@@ -8732,8 +8774,8 @@ var init_process_output = __esm(() => {
 
 // src/version.ts
 function resolveFaraiVersion() {
-  if ("0.3.2")
-    return "0.3.2";
+  if ("0.3.3")
+    return "0.3.3";
   try {
     const parsed = JSON.parse(readBoundedFileTextSync(new URL("../package.json", import.meta.url), 1024 * 1024, "package metadata"));
     if (typeof parsed.version === "string" && parsed.version)
@@ -43757,17 +43799,17 @@ async function runStartupContainerPreflight(workspace) {
   const backend2 = new KaliContainerBackend({
     workspace
   });
-  const image = await backend2.resolveImage().catch(() => {
+  const update = await backend2.checkForImageUpdate().catch(() => {
     return;
   });
-  if (!image || image.error)
+  if (!update || update.error)
     return "continue";
-  if (image.exists && image.contract === KALI_IMAGE_CONTRACT)
+  if (update.exists && update.upToDate)
     return "continue";
   const config = loadConfig(workspace);
   if (config.updates?.prompt === false || !process.stdin.isTTY || !process.stdout.isTTY)
     return "continue";
-  const answer = await promptForImagePull(KALI_IMAGE_CONTRACT, image.exists);
+  const answer = await promptForImagePull(update.exists);
   if (answer === "cancelled")
     return "cancelled";
   if (answer === "later")
@@ -43779,11 +43821,11 @@ async function runStartupContainerPreflight(workspace) {
   }
   return "continue";
 }
-async function promptForImagePull(contract, exists) {
+async function promptForImagePull(exists) {
   console.log("");
   console.log(FARAI_BANNER);
   console.log("");
-  console.log(exists ? `kali container image is outdated (needs ${contract})` : `kali container image ${contract} is not installed`);
+  console.log(exists ? "a newer kali container image is available" : "kali container image is not installed");
   const interfaceHandle = createInterface2({
     input: process.stdin,
     output: process.stdout
@@ -73872,11 +73914,12 @@ async function doctor() {
   const backend2 = new KaliContainerBackend({
     workspace: process.cwd()
   });
-  const image = await backend2.resolveImage();
-  const capabilities = !image.exists ? "not installed (pulled on first run)" : image.contract === KALI_IMAGE_CONTRACT ? "ready" : "update available (pulled on first run)";
-  console.log(`kali image: ${backend2.image} (${image.exists ? "installed" : "missing"})`);
-  console.log(`kali contract: ${image.contract ?? "missing"} (expected ${KALI_IMAGE_CONTRACT})`);
-  console.log(`kali capabilities: ${capabilities}`);
+  const update = await backend2.checkForImageUpdate().catch(() => {
+    return;
+  });
+  const status = !update ? "unknown (docker unavailable)" : !update.exists ? "not installed (pulled on first run)" : update.upToDate ? "up to date" : "update available (pulled on first run)";
+  console.log(`kali image: ${backend2.image}`);
+  console.log(`kali image status: ${status}`);
   const {
     contentStatus: contentStatus2
   } = await Promise.resolve().then(() => (init_updater(), exports_updater));
@@ -74260,5 +74303,5 @@ Examples:
 `);
 }
 
-//# debugId=4868BF6C23AAC2A664756E2164756E21
+//# debugId=11DF5F38873B6FC764756E2164756E21
 //# sourceMappingURL=index.js.map