labgate 0.5.45 → 0.5.47

package/dist/lib/container.js

@@ -36,6 +36,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.shouldUseDangerousPermissionsByDefault = shouldUseDangerousPermissionsByDefault;
 exports.computeMountFingerprint = computeMountFingerprint;
 exports.prepareMcpServers = prepareMcpServers;
 exports.imageToSifName = imageToSifName;
@@ -68,6 +69,20 @@ const slurm_poller_js_1 = require("./slurm-poller.js");
 const slurm_cli_passthrough_js_1 = require("./slurm-cli-passthrough.js");
 const startup_stage_lock_js_1 = require("./startup-stage-lock.js");
 const log = __importStar(require("./log.js"));
+function isTruthyEnvFlag(value) {
+    const normalized = String(value || '').trim().toLowerCase();
+    return normalized === '1' || normalized === 'true' || normalized === 'yes' || normalized === 'on';
+}
+function shouldUseDangerousPermissionsByDefault(agent, options = {}) {
+    if (agent !== 'codex')
+        return false;
+    if (String(options.linkedWebTerminalId || '').trim().length > 0)
+        return false;
+    const env = options.env ?? process.env;
+    if (isTruthyEnvFlag(env.LABGATE_CODEX_STANDARD_PERMISSIONS))
+        return false;
+    return true;
+}
 /**
  * Compute a deterministic fingerprint of mount-affecting config fields.
  * Used to detect when running sessions need a restart after config changes.
@@ -1710,6 +1725,112 @@ function buildEntrypoint(agent, options = {}) {
         '    chmod +x "$HOME/.labgate-bin/$_cmd"',
         '  done',
         'fi',
+        'labgate_install_bzip2_shims() {',
+        '  local needs_bzip2="0"',
+        '  local py=""',
+        '  for _cmd in bzip2 bunzip2 bzcat; do',
+        '    if ! command -v "$_cmd" >/dev/null 2>&1; then',
+        '      needs_bzip2="1"',
+        '      break',
+        '    fi',
+        '  done',
+        '  [ "$needs_bzip2" = "1" ] || return 0',
+        '  if ! command -v python3 >/dev/null 2>&1; then',
+        '    return 0',
+        '  fi',
+        '  cat > "$HOME/.labgate-bin/bzip2" <<\'EOF\'',
+        '#!/usr/bin/env python3',
+        'import bz2',
+        'import os',
+        'import sys',
+        '',
+        'prog = os.path.basename(sys.argv[0])',
+        'args = sys.argv[1:]',
+        'decompress = prog in ("bunzip2", "bzcat")',
+        'stdout_mode = prog == "bzcat"',
+        'keep = prog == "bzcat"',
+        'force = False',
+        'files = []',
+        '',
+        'def fail(message: str, code: int = 2) -> None:',
+        '    sys.stderr.write(message + "\\n")',
+        '    raise SystemExit(code)',
+        '',
+        'def read_bytes(path: str | None) -> bytes:',
+        '    if not path or path == "-":',
+        '        return sys.stdin.buffer.read()',
+        '    with open(path, "rb") as handle:',
+        '        return handle.read()',
+        '',
+        'def write_bytes(path: str | None, data: bytes) -> None:',
+        '    if not path or path == "-":',
+        '        sys.stdout.buffer.write(data)',
+        '        return',
+        '    with open(path, "wb") as handle:',
+        '        handle.write(data)',
+        '',
+        'while args:',
+        '    arg = args.pop(0)',
+        '    if arg == "--":',
+        '        files.extend(args)',
+        '        break',
+        '    if arg == "-":',
+        '        files.append(arg)',
+        '        continue',
+        '    if arg.startswith("-") and arg != "-":',
+        '        for flag in arg[1:]:',
+        '            if flag == "d":',
+        '                decompress = True',
+        '            elif flag == "z":',
+        '                decompress = False',
+        '            elif flag == "c":',
+        '                stdout_mode = True',
+        '            elif flag == "k":',
+        '                keep = True',
+        '            elif flag == "f":',
+        '                force = True',
+        '            else:',
+        '                fail(f"bzip2 shim: unsupported option -{flag}")',
+        '        continue',
+        '    files.append(arg)',
+        '',
+        'if not files:',
+        '    files = ["-"]',
+        '',
+        'exit_code = 0',
+        'for path in files:',
+        '    try:',
+        '        raw = read_bytes(path)',
+        '        data = bz2.decompress(raw) if decompress else bz2.compress(raw)',
+        '        if stdout_mode or path == "-":',
+        '            write_bytes(None, data)',
+        '            continue',
+        '        if decompress:',
+        '            target = path[:-4] if path.endswith(".bz2") else path + ".out"',
+        '        else:',
+        '            target = path + ".bz2"',
+        '        if os.path.exists(target) and not force:',
+        '            sys.stderr.write(f"{target} already exists; use -f to overwrite\\n")',
+        '            exit_code = 1',
+        '            continue',
+        '        write_bytes(target, data)',
+        '        if not keep:',
+        '            try:',
+        '                os.unlink(path)',
+        '            except OSError:',
+        '                pass',
+        '    except Exception as exc:',
+        '        label = "stdin" if path == "-" else path',
+        '        sys.stderr.write(f"{label}: {exc}\\n")',
+        '        exit_code = 1',
+        '',
+        'raise SystemExit(exit_code)',
+        'EOF',
+        '  chmod +x "$HOME/.labgate-bin/bzip2"',
+        '  ln -sf "$HOME/.labgate-bin/bzip2" "$HOME/.labgate-bin/bunzip2"',
+        '  ln -sf "$HOME/.labgate-bin/bzip2" "$HOME/.labgate-bin/bzcat"',
+        '}',
+        'labgate_install_bzip2_shims',
         '',
         // Minimal progress indicator for first-run npm installs (keeps logs quiet, avoids "nothing happening" UX).
         'labgate_npm_install_global() {',
@@ -1747,10 +1868,10 @@ function buildEntrypoint(agent, options = {}) {
         '',
     ];
     const preLaunchLines = [];
+    if (ensureCommands.length > 0) {
+        preLaunchLines.push('labgate_install_system_package() {', '  local manager="${1:-}"', '  local pkg="${2:-}"', '  [ -n "$manager" ] && [ -n "$pkg" ] || return 1', '  case "$manager" in', '    apt-get) apt-get install -y "$pkg" >/dev/null 2>&1 ;;', '    apk) apk add --no-cache "$pkg" >/dev/null 2>&1 ;;', '    dnf) dnf install -y "$pkg" >/dev/null 2>&1 ;;', '    yum) yum install -y "$pkg" >/dev/null 2>&1 ;;', '    microdnf) microdnf install -y "$pkg" >/dev/null 2>&1 ;;', '    *) return 1 ;;', '  esac', '}', 'labgate_candidate_packages_for_command() {', '  local cmd="${1:-}"', '  case "$cmd" in', '    rg) echo "ripgrep rg" ;;', '    fd) echo "fd-find fd" ;;', '    pip) echo "python3-pip py3-pip pip" ;;', '    python) echo "python3 python" ;;', '    *) echo "$cmd" ;;', '  esac', '}', 'labgate_ensure_commands() {', `  local required=(${ensureCommands.map((cmd) => JSON.stringify(cmd)).join(' ')})`, '  local missing=()', '  local cmd=""', '  for cmd in "${required[@]}"; do', '    if ! command -v "$cmd" >/dev/null 2>&1; then', '      missing+=("$cmd")', '    fi', '  done', '  if [ "${#missing[@]}" -eq 0 ]; then', '    return 0', '  fi', '  if [ "$(id -u)" != "0" ]; then', '    echo "[labgate] Warning: missing container command(s): ${missing[*]}." >&2', '    echo "[labgate] Configure an image with required tools preinstalled for reliable startup." >&2', '    return 0', '  fi', '  local manager=""', '  if command -v apt-get >/dev/null 2>&1; then', '    manager="apt-get"', '    export DEBIAN_FRONTEND=noninteractive', '    apt-get update >/dev/null 2>&1 || true', '  elif command -v apk >/dev/null 2>&1; then', '    manager="apk"', '  elif command -v dnf >/dev/null 2>&1; then', '    manager="dnf"', '  elif command -v yum >/dev/null 2>&1; then', '    manager="yum"', '  elif command -v microdnf >/dev/null 2>&1; then', '    manager="microdnf"', '  fi', '  if [ -z "$manager" ]; then', '    echo "[labgate] Warning: cannot install missing commands (${missing[*]}); no known package manager found." >&2', '    return 0', '  fi', '  echo "[labgate] Installing missing container tools: ${missing[*]}..."', '  local candidate=""', '  local installed="0"', '  for cmd in "${missing[@]}"; do', '    installed="0"', '    for candidate in $(labgate_candidate_packages_for_command "$cmd"); do', '      if labgate_install_system_package "$manager" "$candidate"; then', '        installed="1"', '        if command -v "$cmd" >/dev/null 2>&1; then', '          break', '        fi', '      fi', '    done', '    if [ "$installed" != "1" ]; then', '      echo "[labgate] Warning: failed to install command ${cmd}." >&2', '    fi', '  done', '  local still_missing=()', '  for cmd in "${required[@]}"; do', '    if ! command -v "$cmd" >/dev/null 2>&1; then', '      still_missing+=("$cmd")', '    fi', '  done', '  if [ "${#still_missing[@]}" -gt 0 ]; then', '    echo "[labgate] Warning: command(s) still unavailable after install attempt: ${still_missing[*]}." >&2', '    echo "[labgate] Configure an image with these tools preinstalled for reliable startup." >&2', '  fi', '}', 'labgate_ensure_commands', '');
+    }
     if (agent === 'claude') {
-        if (ensureCommands.length > 0) {
-            preLaunchLines.push('labgate_install_system_package() {', '  local manager="${1:-}"', '  local pkg="${2:-}"', '  [ -n "$manager" ] && [ -n "$pkg" ] || return 1', '  case "$manager" in', '    apt-get) apt-get install -y "$pkg" >/dev/null 2>&1 ;;', '    apk) apk add --no-cache "$pkg" >/dev/null 2>&1 ;;', '    dnf) dnf install -y "$pkg" >/dev/null 2>&1 ;;', '    yum) yum install -y "$pkg" >/dev/null 2>&1 ;;', '    microdnf) microdnf install -y "$pkg" >/dev/null 2>&1 ;;', '    *) return 1 ;;', '  esac', '}', 'labgate_candidate_packages_for_command() {', '  local cmd="${1:-}"', '  case "$cmd" in', '    rg) echo "ripgrep rg" ;;', '    fd) echo "fd-find fd" ;;', '    pip) echo "python3-pip py3-pip pip" ;;', '    python) echo "python3 python" ;;', '    *) echo "$cmd" ;;', '  esac', '}', 'labgate_ensure_commands() {', `  local required=(${ensureCommands.map((cmd) => JSON.stringify(cmd)).join(' ')})`, '  local missing=()', '  local cmd=""', '  for cmd in "${required[@]}"; do', '    if ! command -v "$cmd" >/dev/null 2>&1; then', '      missing+=("$cmd")', '    fi', '  done', '  if [ "${#missing[@]}" -eq 0 ]; then', '    return 0', '  fi', '  if [ "$(id -u)" != "0" ]; then', '    echo "[labgate] Warning: missing container command(s): ${missing[*]}." >&2', '    echo "[labgate] Configure an image with required tools preinstalled for best Claude UX." >&2', '    return 0', '  fi', '  local manager=""', '  if command -v apt-get >/dev/null 2>&1; then', '    manager="apt-get"', '    export DEBIAN_FRONTEND=noninteractive', '    apt-get update >/dev/null 2>&1 || true', '  elif command -v apk >/dev/null 2>&1; then', '    manager="apk"', '  elif command -v dnf >/dev/null 2>&1; then', '    manager="dnf"', '  elif command -v yum >/dev/null 2>&1; then', '    manager="yum"', '  elif command -v microdnf >/dev/null 2>&1; then', '    manager="microdnf"', '  fi', '  if [ -z "$manager" ]; then', '    echo "[labgate] Warning: cannot install missing commands (${missing[*]}); no known package manager found." >&2', '    return 0', '  fi', '  echo "[labgate] Installing missing container tools: ${missing[*]}..."', '  local candidate=""', '  local installed="0"', '  for cmd in "${missing[@]}"; do', '    installed="0"', '    for candidate in $(labgate_candidate_packages_for_command "$cmd"); do', '      if labgate_install_system_package "$manager" "$candidate"; then', '        installed="1"', '        if command -v "$cmd" >/dev/null 2>&1; then', '          break', '        fi', '      fi', '    done', '    if [ "$installed" != "1" ]; then', '      echo "[labgate] Warning: failed to install command ${cmd}." >&2', '    fi', '  done', '  local still_missing=()', '  for cmd in "${required[@]}"; do', '    if ! command -v "$cmd" >/dev/null 2>&1; then', '      still_missing+=("$cmd")', '    fi', '  done', '  if [ "${#still_missing[@]}" -gt 0 ]; then', '    echo "[labgate] Warning: command(s) still unavailable after install attempt: ${still_missing[*]}." >&2', '    echo "[labgate] Configure an image with these tools preinstalled for reliable startup." >&2', '  fi', '}', 'labgate_ensure_commands', '');
-        }
         if (disableClaudeStatusLine) {
             // Set the statusLine to a no-op command so Claude Code renders an empty
             // status bar instead of falling back to its default "time ➜ at host |".
@@ -2048,18 +2169,32 @@ function setupBrowserHook(options = {}) {
             return false;
         }
     };
-    // Watch for the URL file on the host side
-    const watcher = (0, fs_1.watch)(labgateDir, (_eventType, filename) => {
-        if (handled)
-            return;
-        const name = filename || '';
-        if (name !== 'browser-url')
-            return;
-        if (processUrlFile())
-            return;
-        // File may exist but not be fully flushed yet. Retry shortly.
-        setTimeout(() => { processUrlFile(); }, 60);
-    });
+    // Watch for the URL file on the host side. Some constrained runners can hit
+    // watch limits; the poller below is the fallback path for those cases.
+    let watcher = null;
+    try {
+        watcher = (0, fs_1.watch)(labgateDir, (_eventType, filename) => {
+            if (handled)
+                return;
+            const name = filename || '';
+            if (name !== 'browser-url')
+                return;
+            if (processUrlFile())
+                return;
+            // File may exist but not be fully flushed yet. Retry shortly.
+            setTimeout(() => { processUrlFile(); }, 60);
+        });
+        watcher.on('error', () => {
+            try {
+                watcher?.close();
+            }
+            catch { /* best effort */ }
+            watcher = null;
+        });
+    }
+    catch {
+        watcher = null;
+    }
     // Safety net: if fs.watch misses events, poll for a short window.
     const poll = setInterval(() => {
         if (handled) {
@@ -2072,7 +2207,10 @@ function setupBrowserHook(options = {}) {
     poll.unref?.();
     pollTimeout.unref?.();
     const cleanup = () => {
-        watcher.close();
+        try {
+            watcher?.close();
+        }
+        catch { /* best effort */ }
         clearInterval(poll);
         clearTimeout(pollTimeout);
         try {
@@ -3038,6 +3176,9 @@ async function restartSession(id, opts) {
         config,
         dryRun: false,
         footerMode: 'once',
+        dangerouslySkipPermissions: shouldUseDangerousPermissionsByDefault(agent, {
+            linkedWebTerminalId: sessionData.webTerminalId,
+        }),
         sharedSessionsDir: effective.sharedSessionsDir,
         sharedAuditDir: effective.sharedAuditDir,
     });