kern-sandbox 0.2.12 → 0.2.14

package/index.js

@@ -36,7 +36,7 @@ const crypto = require("crypto");
 const zlib = require("zlib");
 const { spawn, spawnSync } = require("child_process");
 
-const VERSION = "0.2.12";
+const VERSION = "0.2.14";
 
 const DEFAULT_IMAGE = "python:3.12-slim";
 const WORKSPACE = "/workspace"; // where the persistent workspace is mounted inside every box
@@ -1115,6 +1115,14 @@ function looksLikeStartupFailure(stderr) {
     "error: box:",
     "error: oci:",
     "error: image:",
+    // REACHABLE EXACTLY WHEN A CALLER PASSES `profiles`, and missing until it was measured: a profile
+    // name that is well formed but absent from `kern.toml` makes kern refuse before any box exists, and
+    // without this marker the call came back `exitCode 1, fault null`, which a caller reading `fault`
+    // cannot tell from their own code exiting 1.
+    "error: config:",
+    // The binding builds its own argv, so these mean IT got something wrong; either way the box never ran.
+    "error: usage:",
+    "error: invalid box name:",
   ];
   // The OOM sentence is skipped for a sharper reason than the benign notes: it is a report about a box
   // that RAN, and it is `kern:`-prefixed, so it used to satisfy this predicate. MEASURED, that is how a
@@ -2812,12 +2820,28 @@ class Kernel {
         "the kernel box was killed, and its memory cap was not enforced here (no cgroup delegation), so no memory limit was in force to attribute it to",
         rc,
       ];
-    if (this._sbx.memoryMb !== null)
+    if (this._sbx.memoryMb !== null) {
+      // A BINARY THAT DOES NOT REPORT THE SIGNAL CANNOT HAVE THIS SENTENCE PUT IN ITS MOUTH. MEASURED on
+      // the released 0.9.32, which is what `install.sh` serves today: it writes two of the four teardown
+      // bytes, so `workloadSignal` is null, and a cell that SEGFAULTED and a cell whose syscall the
+      // seccomp filter refused both landed here and were told "an external kill", which is false for
+      // both. The verdict cannot improve without the byte; the sentence can say so.
+      if (kernWrotePayload && workloadSignal === null)
+        return [
+          "killed",
+          "the kernel box was killed and the kernel reported no OOM against its memory cap. THIS kern " +
+            "does not report which signal ended the box (it writes 2 of the 4 teardown bytes), so an " +
+            "external kill, a crash in your own code and a syscall the sandbox refused are " +
+            "indistinguishable from here: a newer kern separates them, and until then read the box's " +
+            "stderr before concluding it was killed from outside",
+          rc,
+        ];
       return [
         "killed",
         "the kernel box was killed and the kernel reported no OOM against its memory cap: an external kill (`kern stop`, a signal, or the host running out of memory), not the box exceeding its own memory",
         rc,
       ];
+    }
     return ["killed", "the kernel box exited", rc];
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kern-sandbox",
-  "version": "0.2.12",
+  "version": "0.2.14",
   "description": "kern is a fast, rootless sandbox and virtual resource runtime for any workload, including untrusted and AI-generated code; kern-sandbox is its Node/TypeScript binding. Run untrusted or agent-generated code (Python/JS/Bash) in a real, kernel-enforced box in single-digit milliseconds, with no cloud, no account and no VM.",
   "keywords": [
     "sandbox",