maka-agent 0.2.0-dev.9.20260831 → 0.2.1-dev.82.20261014

package/node_modules/@openai/agents-core/dist/sandbox/sandboxes/unixLocal.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.UnixLocalSandboxClient = exports.UnixLocalSandboxSession = void 0;
+const sessionStateTrust_1 = require("../internal/sessionStateTrust.js");
 const errors_1 = require("../../errors.js");
 const applyDiff_1 = require("../../utils/applyDiff.js");
 const promises_1 = require("node:fs/promises");
@@ -10,15 +11,16 @@ const node_path_1 = require("node:path");
 const node_os_1 = require("node:os");
 const client_1 = require("../client.js");
 const session_1 = require("../session.js");
+const pathProbe_1 = require("../shared/pathProbe.js");
 const manifest_1 = require("../manifest.js");
 const errors_2 = require("../errors.js");
-const pathProbe_1 = require("../shared/pathProbe.js");
 const workspacePaths_1 = require("../workspacePaths.js");
 const localWorkspace_1 = require("./shared/localWorkspace.js");
 const manifestPersistence_1 = require("./shared/manifestPersistence.js");
 const mountSecurity_1 = require("../mountSecurity.js");
 const hostPath_1 = require("../shared/hostPath.js");
 const media_1 = require("../shared/media.js");
+const unixLocalFiles_1 = require("./shared/unixLocalFiles.js");
 const output_1 = require("../shared/output.js");
 const localSnapshots_1 = require("./shared/localSnapshots.js");
 const pty_1 = require("./shared/pty.js");
@@ -36,11 +38,20 @@ class UnixLocalSandboxSession {
     archiveLimits;
     activeProcesses = new Map();
     nextSessionId = 1;
-    closed = false;
+    closePromise;
+    files;
+    filesystemRoots = new Map();
     constructor(args) {
+        this.files =
+            args[unixLocalFiles_1.preparedFileIO] ?? new unixLocalFiles_1.UnixLocalFiles(args.fileIOProtection);
         this.state = args.state;
         this.defaultShell = args.defaultShell;
         this.setArchiveLimits(args.archiveLimits);
+        this.captureFilesystemRoots();
+    }
+    /** Selected once at creation or resume; Docker subclasses use the container backend. */
+    get fileIOBackend() {
+        return this.files.backend;
     }
     setArchiveLimits(limits) {
         (0, client_1.validateSandboxArchiveLimits)(limits);
@@ -48,7 +59,7 @@ class UnixLocalSandboxSession {
     }
     createEditor(runAs) {
         this.assertSessionUsable();
-        return new UnixLocalSandboxEditor(this, runAs);
+        return new UnixLocalSandboxEditor(this, (operation) => this.applyFileOperation(operation, runAs));
     }
     supportsPty() {
         return true;
@@ -183,38 +194,50 @@ class UnixLocalSandboxSession {
     async viewImage(args) {
         this.assertSessionUsable();
         await this.resolveFilesystemRunAs(args.runAs);
-        const filePath = this.resolveSandboxPath(args.path);
-        const info = await (0, promises_1.stat)(filePath).catch(() => {
-            throw new errors_1.UserError(`Image file not found: ${args.path}`);
+        const filePath = this.resolveFilesystemPath(args.path);
+        const bytes = await this.files
+            .run({ operation: 'image', path: filePath, limit: media_1.MAX_VIEW_IMAGE_BYTES })
+            .catch((error) => {
+            if (error.code === 'ENOENT')
+                throw new errors_1.UserError(`Image file not found: ${args.path}`);
+            if (error.code === 'EINVAL')
+                throw new errors_1.UserError(`Image path is not a file: ${args.path}`);
+            if (error.code === 'EFBIG')
+                throw new errors_1.UserError(`Image file exceeds the 10 MB limit: ${args.path}`);
+            throw error;
         });
-        if (!info.isFile()) {
-            throw new errors_1.UserError(`Image path is not a file: ${args.path}`);
-        }
-        (0, media_1.assertViewImageByteLength)(args.path, info.size);
-        const bytes = await (0, promises_1.readFile)(filePath);
         return (0, media_1.imageOutputFromBytes)(args.path, bytes);
     }
     async pathExists(path, runAs) {
         this.assertSessionUsable();
         await this.resolveFilesystemRunAs(runAs);
-        return await (0, localWorkspace_1.pathExists)(this.resolveSandboxPath(path));
+        return JSON.parse((await this.files.run({
+            operation: 'exists',
+            path: this.resolveFilesystemPath(path),
+        })).toString('utf8'));
     }
     async directoryExists(path, runAs) {
         this.assertSessionUsable();
         const identity = await this.resolveCommandRunAs(runAs);
-        const resolvedPath = this.resolveSandboxPath(path);
-        return await (0, pathProbe_1.probeSandboxDirectoryExists)({
-            path: resolvedPath,
-            runCommand: async (command) => await (0, runProcess_1.runSandboxProcess)('/bin/sh', ['-c', command], {
-                timeoutMs: RUN_AS_LOOKUP_TIMEOUT_MS,
-                ...(identity ? { uid: identity.uid, gid: identity.gid } : {}),
-            }),
-        });
+        const resolvedPath = this.resolveFilesystemPath(path);
+        if (this.files.backend === 'node') {
+            return (0, pathProbe_1.probeSandboxDirectoryExists)({
+                path: resolvedPath,
+                runCommand: (command) => (0, runProcess_1.runSandboxProcess)('/bin/sh', ['-c', command], {
+                    timeoutMs: RUN_AS_LOOKUP_TIMEOUT_MS,
+                    ...(identity ? { uid: identity.uid, gid: identity.gid } : {}),
+                }),
+            });
+        }
+        return JSON.parse((await this.files.run({ operation: 'directoryExists', path: resolvedPath }, { identity })).toString('utf8'));
     }
     async readFile(args) {
         this.assertSessionUsable();
         await this.resolveFilesystemRunAs(args.runAs);
-        const bytes = await (0, promises_1.readFile)(this.resolveSandboxPath(args.path));
+        const bytes = await this.files.run({
+            operation: 'read',
+            path: this.resolveFilesystemPath(args.path),
+        });
         if (typeof args.maxBytes === 'number' && bytes.byteLength > args.maxBytes) {
             return bytes.subarray(0, args.maxBytes);
         }
@@ -223,14 +246,16 @@ class UnixLocalSandboxSession {
     async listDir(args) {
         this.assertSessionUsable();
         await this.resolveFilesystemRunAs(args.runAs);
-        const logicalPath = this.resolveLogicalPath(args.path);
-        const entries = await (0, promises_1.readdir)(this.resolveSandboxPath(args.path), {
-            withFileTypes: true,
-        });
+        const resolved = this.resolveSandboxPathTarget(args.path);
+        const logicalPath = resolved.workspaceRelativePath ?? resolved.path;
+        const entries = JSON.parse((await this.files.run({
+            operation: 'list',
+            path: this.resolveFilesystemPath(args.path),
+        })).toString('utf8'));
         return entries.map((entry) => ({
             name: entry.name,
             path: logicalPath ? `${logicalPath}/${entry.name}` : entry.name,
-            type: entry.isDirectory() ? 'dir' : entry.isFile() ? 'file' : 'other',
+            type: entry.type,
         }));
     }
     async materializeEntry(args) {
@@ -250,6 +275,7 @@ class UnixLocalSandboxSession {
             await (0, localWorkspace_1.applyOwnershipRecursive)(this.resolveSandboxPath(args.path), runAs.uid, runAs.gid);
         }
         this.state.manifest = (0, manifestPersistence_1.mergeManifestEntryDelta)(this.state.manifest, logicalPath, args.entry);
+        this.captureFilesystemRoots();
         (0, mountSecurity_1.captureLiveMountCredentialAuthority)(this.state.manifest);
     }
     async applyManifest(manifest, runAs) {
@@ -275,6 +301,7 @@ class UnixLocalSandboxSession {
             ...environment,
         };
         this.state.manifest = (0, manifestPersistence_1.mergeManifestDelta)(this.state.manifest, manifest);
+        this.captureFilesystemRoots();
         (0, mountSecurity_1.captureLiveMountCredentialAuthority)(this.state.manifest);
     }
     async persistWorkspace() {
@@ -291,6 +318,7 @@ class UnixLocalSandboxSession {
         await this.materializeRestoredWorkspaceMounts();
     }
     async stop() {
+        await this.files.stop();
         await this.stopActiveProcesses();
     }
     async shutdown() {
@@ -300,10 +328,11 @@ class UnixLocalSandboxSession {
         await this.close();
     }
     async close() {
-        if (this.closed) {
-            return;
-        }
-        this.closed = true;
+        this.closePromise ??= this.closeResources();
+        await this.closePromise;
+    }
+    async closeResources() {
+        await this.files.close();
         await this.stopActiveProcesses();
         if (this.state.workspaceRootOwned) {
             await (0, promises_1.rm)(this.state.workspaceRootPath, { recursive: true, force: true });
@@ -323,33 +352,53 @@ class UnixLocalSandboxSession {
         this.activeProcesses.clear();
     }
     resolveSandboxPath(path, options = {}) {
+        return this.resolveHostPath(path, options, 'lexical');
+    }
+    resolveFilesystemPath(path, options = {}, mode = 'content') {
+        // Preserve provider overrides that reject container-only paths before host I/O.
+        const lexical = this.resolveSandboxPath(path, options);
+        // The Node backend retains released lexical path handling.
+        if (this.files.backend === 'node')
+            return lexical;
+        return this.resolveHostPath(path, options, mode);
+    }
+    resolveHostPath(path, options, mode) {
         this.assertSessionUsable();
         const resolved = this.resolveSandboxPathTarget(path, options);
         const workspaceRelativePath = resolved.workspaceRelativePath ?? '';
-        if (!workspaceRelativePath && !resolved.grant) {
-            return this.state.workspaceRootPath;
-        }
         if (resolved.grant) {
-            return validateResolvedHostPath({
+            const authority = this.filesystemRoot(resolved.grant.path);
+            const root = authority.content;
+            const validated = validateResolvedHostPath({
                 path,
-                resolvedPath: resolved.path,
-                allowedRoot: resolved.grant.path,
+                resolvedPath: (0, node_path_1.resolve)(root, (0, node_path_1.relative)(resolved.grant.path, resolved.path)),
+                allowedRoot: root,
+                entryRoot: authority.entry,
+                preserveLeaf: mode === 'entry',
             });
+            return mode === 'lexical' ? resolved.path : validated;
         }
-        const mountPath = this.resolveLocalBindMountPath(workspaceRelativePath, path, options);
+        const mountPath = this.resolveLocalBindMountPath(workspaceRelativePath, path, options, mode);
         if (mountPath) {
             return mountPath;
         }
-        const resolvedPath = (0, node_path_1.resolve)(this.state.workspaceRootPath, workspaceRelativePath);
-        const relativeToRoot = (0, node_path_1.relative)(this.state.workspaceRootPath, resolvedPath);
+        const authority = this.filesystemRoot(this.state.workspaceRootPath);
+        const root = authority.content;
+        const resolvedPath = (0, node_path_1.resolve)(root, workspaceRelativePath);
+        const relativeToRoot = (0, node_path_1.relative)(root, resolvedPath);
         if ((0, hostPath_1.relativeHostPathEscapesRoot)(relativeToRoot)) {
             throw new errors_1.UserError(`Sandbox path "${path}" escapes the workspace root.`);
         }
-        return validateResolvedHostPath({
+        const validated = validateResolvedHostPath({
             path,
             resolvedPath,
-            allowedRoot: this.state.workspaceRootPath,
+            allowedRoot: root,
+            entryRoot: authority.entry,
+            preserveLeaf: mode === 'entry',
         });
+        return mode === 'lexical'
+            ? (0, node_path_1.resolve)(this.state.workspaceRootPath, workspaceRelativePath)
+            : validated;
     }
     resolveCommandWorkdir(path) {
         return this.resolveSandboxPath(path);
@@ -357,13 +406,71 @@ class UnixLocalSandboxSession {
     assertSessionUsable() {
         (0, mountSecurity_1.assertSandboxSessionStateUsable)(this.state);
     }
+    captureFilesystemRoots() {
+        if (this.files.backend === 'node')
+            return;
+        const paths = [
+            this.state.workspaceRootPath,
+            ...this.state.manifest.extraPathGrants.map((grant) => grant.path),
+            ...this.state.manifest.mountTargets().flatMap(({ entry }) => {
+                const source = localBindMountSource(entry);
+                return source ? [source] : [];
+            }),
+        ];
+        for (const path of paths) {
+            if (!this.filesystemRoots.has(path)) {
+                try {
+                    this.filesystemRoots.set(path, {
+                        content: (0, node_fs_1.realpathSync)(path),
+                        entry: (0, node_path_1.resolve)((0, node_fs_1.realpathSync)((0, node_path_1.dirname)(path)), (0, node_path_1.basename)(path)),
+                    });
+                }
+                catch {
+                    this.filesystemRoots.set(path, new errors_1.UserError(`Sandbox filesystem root is unavailable: ${path}`));
+                }
+            }
+        }
+    }
+    filesystemRoot(path) {
+        if (this.files.backend === 'node') {
+            return { content: realpathForValidation(path), entry: path };
+        }
+        this.captureFilesystemRoots();
+        const root = this.filesystemRoots.get(path);
+        if (root instanceof Error)
+            throw root;
+        return root;
+    }
+    async applyFileOperation(operation, runAs) {
+        this.assertSessionUsable();
+        const owner = await this.resolveFilesystemRunAs(runAs);
+        const path = this.resolveFilesystemPath(operation.path, { forWrite: true }, operation.type === 'delete_file' ? 'entry' : 'content');
+        if (operation.type === 'create_file') {
+            const input = (0, applyDiff_1.applyDiff)('', operation.diff, 'create');
+            await this.files.run({ operation: 'create', path, owner }, { input });
+        }
+        else if (operation.type === 'update_file') {
+            const destination = operation.moveTo
+                ? this.resolveFilesystemPath(operation.moveTo, { forWrite: true })
+                : path;
+            const unlinkPath = operation.moveTo &&
+                this.resolveSandboxPath(operation.moveTo, { forWrite: true }) !==
+                    this.resolveSandboxPath(operation.path, { forWrite: true })
+                ? this.resolveFilesystemPath(operation.path, { forWrite: true }, 'entry')
+                : undefined;
+            await this.files.run({ operation: 'update', path, destination, unlinkPath, owner }, { update: (current) => (0, applyDiff_1.applyDiff)(current, operation.diff) });
+        }
+        else {
+            await this.files.run({ operation: 'delete', path });
+        }
+    }
     resolveSandboxPathTarget(path, options = {}) {
         return new workspacePaths_1.WorkspacePathPolicy({
             root: this.state.manifest.root,
             extraPathGrants: this.state.manifest.extraPathGrants,
         }).resolve(path, options);
     }
-    resolveLocalBindMountPath(workspaceRelativePath, path, options) {
+    resolveLocalBindMountPath(workspaceRelativePath, path, options, mode) {
         for (const { entry, mountPath } of this.state.manifest.mountTargets()) {
             const source = localBindMountSource(entry);
             if (!source) {
@@ -384,12 +491,21 @@ class UnixLocalSandboxSession {
             const childPath = workspaceRelativePath === mountRelativePath
                 ? ''
                 : workspaceRelativePath.slice(mountRelativePath.length + 1);
-            const resolvedPath = childPath ? (0, node_path_1.resolve)(source, childPath) : source;
-            return validateResolvedHostPath({
+            const authority = this.filesystemRoot(source);
+            const root = authority.content;
+            const resolvedPath = childPath ? (0, node_path_1.resolve)(root, childPath) : root;
+            const validated = validateResolvedHostPath({
                 path,
                 resolvedPath,
-                allowedRoot: source,
+                allowedRoot: root,
+                entryRoot: authority.entry,
+                preserveLeaf: mode === 'entry',
             });
+            return mode === 'lexical'
+                ? childPath
+                    ? (0, node_path_1.resolve)(source, childPath)
+                    : source
+                : validated;
         }
         return undefined;
     }
@@ -595,6 +711,14 @@ class UnixLocalSandboxSession {
     }
 }
 exports.UnixLocalSandboxSession = UnixLocalSandboxSession;
+/**
+ * Local sandbox client for Unix hosts.
+ * Host file protection defaults to auto and uses Python 3 when available.
+ * Set the host OPENAI_AGENTS_PYTHON to an absolute trusted executable to override
+ * discovery. Use fileIOProtection: 'required' to reject unavailable protection,
+ * or 'off' to use Node filesystem operations. Inspect session.fileIOBackend for
+ * the selected backend. Resumed sessions use current client configuration.
+ */
 class UnixLocalSandboxClient {
     backendId = 'unix_local';
     supportsDefaultOptions = true;
@@ -621,6 +745,7 @@ class UnixLocalSandboxClient {
         (0, mountSecurity_1.validateMountCredentialBoundaries)(manifest);
         assertUnixLocalHostPathGrantsUnsupported(manifest);
         (0, localWorkspace_1.assertLocalWorkspaceManifestMetadataSupported)('UnixLocalSandboxClient', manifest);
+        const files = new unixLocalFiles_1.UnixLocalFiles(resolvedOptions.fileIOProtection);
         const workspaceRootPath = await (0, promises_1.mkdtemp)((0, node_path_1.join)(resolvedOptions.workspaceBaseDir ?? (0, node_os_1.tmpdir)(), 'openai-agents-sandbox-'));
         await (0, localWorkspace_1.materializeLocalWorkspaceManifest)(manifest, workspaceRootPath, {
             concurrencyLimits: resolvedOptions.concurrencyLimits,
@@ -628,6 +753,7 @@ class UnixLocalSandboxClient {
         const environment = await manifest.resolveEnvironment();
         const configuredExposedPorts = (0, sessionStateValues_1.normalizeExposedPorts)(resolvedOptions.exposedPorts);
         return new UnixLocalSandboxSession({
+            [unixLocalFiles_1.preparedFileIO]: files,
             state: {
                 manifest,
                 workspaceRootPath,
@@ -649,8 +775,12 @@ class UnixLocalSandboxClient {
         const archiveLimits = options.archiveLimits === undefined
             ? this.options.archiveLimits
             : options.archiveLimits;
+        const currentOptions = ((0, sessionStateTrust_1.getRunStateSessionTrustedConfig)(state)
+            ?.clientOptions ?? options.clientOptions);
+        const files = new unixLocalFiles_1.UnixLocalFiles(currentOptions?.fileIOProtection ?? this.options.fileIOProtection);
         const restoredState = await this.restoreIfNeeded(state, archiveLimits);
         return new UnixLocalSandboxSession({
+            [unixLocalFiles_1.preparedFileIO]: files,
             state: restoredState,
             defaultShell: this.options.defaultShell,
             archiveLimits,
@@ -734,7 +864,7 @@ function assertUnixLocalHostPathGrantsUnsupported(manifest) {
     });
 }
 function validateResolvedHostPath(args) {
-    const allowedRootRealPath = realpathForValidation(args.allowedRoot, args.path);
+    const allowedRootRealPath = args.allowedRoot;
     const existingPath = nearestExistingPath(args.resolvedPath);
     if (!existingPath) {
         throw new errors_1.UserError(`Sandbox path "${args.path}" escapes the workspace root.`);
@@ -743,7 +873,17 @@ function validateResolvedHostPath(args) {
     if (!(0, hostPath_1.isHostPathWithinRoot)(allowedRootRealPath, realPath)) {
         throw new errors_1.UserError(`Sandbox path "${args.path}" escapes the workspace root.`);
     }
-    return args.resolvedPath;
+    if (args.preserveLeaf) {
+        // Unlink owns the original leaf entry, while content I/O owns its target.
+        if (args.resolvedPath === args.allowedRoot)
+            return args.entryRoot;
+        const parent = realpathForValidation((0, node_path_1.dirname)(args.resolvedPath), args.path);
+        if (!(0, hostPath_1.isHostPathWithinRoot)(allowedRootRealPath, parent)) {
+            throw new errors_1.UserError(`Sandbox path "${args.path}" escapes the workspace root.`);
+        }
+        return (0, node_path_1.resolve)(parent, (0, node_path_1.basename)(args.resolvedPath));
+    }
+    return (0, node_path_1.resolve)(realPath, (0, node_path_1.relative)(existingPath, args.resolvedPath));
 }
 function nearestExistingPath(path) {
     let current = path;
@@ -774,10 +914,10 @@ function realpathForValidation(path, originalPath) {
 }
 class UnixLocalSandboxEditor {
     session;
-    runAs;
-    constructor(session, runAs) {
+    apply;
+    constructor(session, apply) {
         this.session = session;
-        this.runAs = runAs;
+        this.apply = apply;
     }
     canAccessPathForEdit(path) {
         try {
@@ -789,45 +929,15 @@ class UnixLocalSandboxEditor {
         }
     }
     async createFile(operation) {
-        const identity = await this.session.resolveFilesystemRunAs(this.runAs);
-        const filePath = this.session.resolveSandboxPath(operation.path, {
-            forWrite: true,
-        });
-        await (0, promises_1.mkdir)((0, node_path_1.dirname)(filePath), { recursive: true });
-        const content = (0, applyDiff_1.applyDiff)('', operation.diff, 'create');
-        await (0, promises_1.writeFile)(filePath, content, { encoding: 'utf8', flag: 'wx' });
-        if (identity) {
-            await (0, localWorkspace_1.applyOwnershipRecursive)(filePath, identity.uid, identity.gid);
-        }
+        await this.apply(operation);
         return {};
     }
     async updateFile(operation) {
-        const identity = await this.session.resolveFilesystemRunAs(this.runAs);
-        const moveTo = operation.moveTo;
-        const filePath = this.session.resolveSandboxPath(operation.path, {
-            forWrite: true,
-        });
-        const destinationPath = moveTo
-            ? this.session.resolveSandboxPath(moveTo, { forWrite: true })
-            : filePath;
-        const current = await (0, promises_1.readFile)(filePath, 'utf8');
-        const next = (0, applyDiff_1.applyDiff)(current, operation.diff);
-        await (0, promises_1.mkdir)((0, node_path_1.dirname)(destinationPath), { recursive: true });
-        await (0, promises_1.writeFile)(destinationPath, next, 'utf8');
-        if (moveTo && destinationPath !== filePath) {
-            await (0, promises_1.unlink)(filePath);
-        }
-        if (identity) {
-            await (0, localWorkspace_1.applyOwnershipRecursive)(destinationPath, identity.uid, identity.gid);
-        }
+        await this.apply(operation);
         return {};
     }
     async deleteFile(operation) {
-        await this.session.resolveFilesystemRunAs(this.runAs);
-        const filePath = this.session.resolveSandboxPath(operation.path, {
-            forWrite: true,
-        });
-        await (0, promises_1.unlink)(filePath);
+        await this.apply(operation);
         return {};
     }
 }