owlrunkit 0.25.0 → 0.25.2

package/scripts/runkit-contract/peer-recovery.mjs

@@ -1,7 +1,7 @@
 import { createHash, randomUUID } from "node:crypto";
-import { spawn } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import {
-  closeSync, constants, existsSync, fsyncSync, linkSync, lstatSync, mkdirSync,
+  accessSync, closeSync, constants, existsSync, fsyncSync, linkSync, lstatSync, mkdirSync,
   mkdtempSync, openSync, readSync, readdirSync, realpathSync, unlinkSync,
   watch, writeFileSync,
 } from "node:fs";
@@ -9,6 +9,8 @@ import { tmpdir } from "node:os";
 import path from "node:path";
 
 import { RUNTIME_ROOT, currentCoreIdentity } from "./core-contract.mjs";
+import { linuxRuntimeHelper } from "./linux-runtime.mjs";
+import { BUBBLEWRAP_PEER_BACKEND, bubblewrapPeerArgs, probeBubblewrapPeer } from "./peer-linux-bwrap.mjs";
 import { safeIdentifier } from "./provenance-common.mjs";
 import { resolveVerificationEnvelopeBackendV1 } from "./verification-envelope.mjs";
 
@@ -195,9 +197,37 @@ function projection(task, state) {
   };
 }
 
+export function resolvePeerRecoveryBackend() {
+  if (process.platform === "linux") {
+    try {
+      const executable = linuxRuntimeHelper();
+      if (!executable) return { available: false };
+      const result = spawnSync(executable, ["probe"], {
+        timeout: 3000, env: {}, stdio: ["ignore", "ignore", "pipe"], encoding: "utf8",
+      });
+      if (result.status === 0) {
+        return { available: true, id: "linux_landlock_seccomp_v1", executable,
+          digest: digest(regularBytes(executable, CHECKPOINT_LIMIT)) };
+      }
+      const reason = result.stderr?.trim() || result.error?.code;
+      if (result.status !== 77) return { available: false, reason };
+      const fallback = probeBubblewrapPeer(executable);
+      if (!fallback.available) {
+        return { available: false, reason: [reason, fallback.reason].filter(Boolean).join("; ") };
+      }
+      const helperHash = digest(regularBytes(executable, CHECKPOINT_LIMIT));
+      const sandboxHash = digest(regularBytes(fallback.executable, CHECKPOINT_LIMIT));
+      return { ...fallback, digest: digest(JSON.stringify([helperHash, sandboxHash])) };
+    } catch (error) { return { available: false, reason: error.code }; }
+  }
+  return resolveVerificationEnvelopeBackendV1();
+}
+
 function requireBackend() {
-  const backend = resolveVerificationEnvelopeBackendV1();
-  if (!backend.available) throw new Error("peer_recovery_enforced_backend_unavailable");
+  const backend = resolvePeerRecoveryBackend();
+  if (!backend.available) {
+    throw new Error(["peer_recovery_enforced_backend_unavailable", backend.reason].filter(Boolean).join(": "));
+  }
   return backend;
 }
 
@@ -357,35 +387,69 @@ function reportExit(task, attemptId, processExit) {
   }
 }
 
-export async function runPeerTask({ workspaceRoot, taskId, agent, generation, command }) {
-  const backend = requireBackend();
-  safeIdentifier(agent, "current peer");
+function workerExecutable(command) {
   if (!Array.isArray(command) || !path.isAbsolute(command[0] ?? "")) {
     throw new Error("peer_recovery_absolute_worker_required");
   }
   const executable = realpathSync(command[0]);
   if (!lstatSync(executable).isFile()) throw new Error("peer_recovery_worker_invalid");
+  accessSync(executable, constants.X_OK);
+  return executable;
+}
+
+function existingHandoff(task, state, agent, generation) {
+  if (state.owner !== agent || state.generation !== generation || state.phase === "ready") return null;
+  const result = projection(task, state);
+  return state.phase === "exited" ? { ...result, exitCode: 2 } : result;
+}
+
+export async function runPeerTask({ workspaceRoot, taskId, agent, generation, command, handoff = false }) {
+  const backend = requireBackend();
+  safeIdentifier(agent, "current peer");
+  const executable = workerExecutable(command);
   const task = taskDirectory(workspaceRoot, taskId);
   const state = current(task);
   if (state.phase !== "ready" || state.owner !== agent || state.generation !== generation) {
+    const prior = handoff && existingHandoff(task, state, agent, generation);
+    if (prior) return prior;
     throw new Error("peer_recovery_attempt_not_available");
   }
   const id = randomUUID();
   const directory = mkdtempSync(path.join(realpathSync(tmpdir()), "owlrunkit-peer-"));
   materialize(checkpoint(task, state).files, directory);
-  const attempt = { id, directory, backend: backend.id };
+  const attempt = { id, directory, backend: backend.id,
+    ...(backend.digest ? { backendSha256: backend.digest } : {}) };
   const claimed = append(task, state, {
     attempt, phase: "running", processExit: null, event: "peer_attempt_started",
   });
-  if (!claimed) throw new Error("peer_recovery_attempt_already_claimed");
+  if (!claimed) {
+    const prior = handoff && existingHandoff(task, current(task), agent, generation);
+    if (prior) return prior;
+    throw new Error("peer_recovery_attempt_already_claimed");
+  }
 
   return new Promise((resolve, reject) => {
-    const child = spawn(backend.executable, ["-p", sandboxPolicy(executable, directory),
-      executable, ...command.slice(1)], {
-      cwd: directory, env: {
-        PATH: "/usr/bin:/bin", TMPDIR: directory, OWLRUNKIT_PEER_ATTEMPT: id,
-        OWLRUNKIT_PEER_PATHS: JSON.stringify(state.paths),
-      }, stdio: ["pipe", "pipe", "pipe"],
+    const environment = {
+      PATH: "/usr/bin:/bin", TMPDIR: directory, OWLRUNKIT_PEER_ATTEMPT: id,
+      OWLRUNKIT_PEER_PATHS: JSON.stringify(state.paths),
+    };
+    let args;
+    let env = environment;
+    if (backend.id === BUBBLEWRAP_PEER_BACKEND) {
+      args = bubblewrapPeerArgs({
+        helper: backend.helper, directory, worker: executable,
+        args: command.slice(1), environment,
+      });
+      env = {};
+    } else if (backend.id === "linux_landlock_seccomp_v1") {
+      args = ["run", String(process.pid), directory, executable, ...command.slice(1)];
+      // An isolated worker cannot read host OpenSSL configuration.
+      env.OPENSSL_CONF = "/dev/null";
+    } else {
+      args = ["-p", sandboxPolicy(executable, directory), executable, ...command.slice(1)];
+    }
+    const child = spawn(backend.executable, args, {
+      cwd: directory, env, stdio: ["pipe", "pipe", "pipe"],
     });
     let watcher, pending = Buffer.alloc(0), sentWake, protocolError = null;
     let diagnostic = Buffer.alloc(0);
@@ -440,3 +504,12 @@ export async function runPeerTask({ workspaceRoot, taskId, agent, generation, co
     } catch (error) { stop(error); }
   });
 }
+
+export async function recoverAndRunPeerTask(options, command) {
+  workerExecutable(command);
+  const recovered = await recoverPeerTask(options);
+  if (recovered.generation !== options.generation + 1 || recovered.owner !== options.agent) {
+    return recovered;
+  }
+  return runPeerTask({ ...options, generation: recovered.generation, command, handoff: true });
+}

package/scripts/runkit-contract/project-cli-resolver.mjs

@@ -27,10 +27,18 @@ const SELF_NORMALIZED_QUICK_CORE_VERSIONS = new Set([
   "0.24.0",
   "0.24.1",
   "0.25.0",
+  "0.25.1",
+  "0.25.2",
 ]);
 const EXACT_VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?$/;
 const SHA256_REF = /^sha256:[a-f0-9]{64}$/;
 const TRUSTED_PRIOR_CORE_IDENTITIES = new Map([
+  ["0.25.1", new Set([
+    "sha256:0934a076b147847a4623bc89263b677c88088b493495fc74f11485985b7903b5",
+  ])],
+  ["0.25.0", new Set([
+    "sha256:20e75c386f1408f11e908a6d3ee1a39316d9728d5719fa06f8d6a5aa45abd83e",
+  ])],
   ["0.24.1", new Set([
     "sha256:94aaa2e3a6d504374fa78cfcd341e31b33087806c9ddf5f84b3d3b47a6328e08",
   ])],

package/scripts/runkit-contract/resume-execution.mjs

@@ -20,6 +20,7 @@ import {
   validateExecutionPin,
   validateLeaseOwnedPaths,
 } from "./core-contract.mjs";
+import { acquireRunKitControlLock } from "./control-transaction-lock.mjs";
 import { buildCoverageIndex } from "./coverage-adoption.mjs";
 import { validateVerificationReceiptGate } from "./verification-receipt-gate.mjs";
 import {
@@ -103,14 +104,7 @@ function acquireResumeLock(workspaceRoot) {
   const runtimeRoot = path.join(workspaceRoot, RUNTIME_ROOT);
   assertSafeDirectory(workspaceRoot, runtimeRoot, "RunKit runtime root");
   assertSafeDirectory(runtimeRoot, path.join(runtimeRoot, "executions"), "Executions directory");
-  const lockPath = path.join(runtimeRoot, "control.lock");
-  try {
-    mkdirSync(lockPath);
-  } catch (error) {
-    if (error?.code === "EEXIST") throw new Error("Another RunKit control transaction is already active.");
-    throw error;
-  }
-  return () => rmSync(lockPath, { recursive: true, force: true });
+  return acquireRunKitControlLock(runtimeRoot);
 }
 
 function activeRunIds(workspaceRoot) {

package/scripts/runkit-contract/runkit-cli.mjs

@@ -95,6 +95,7 @@ import { buildHookRecoveryV1 } from "./hook-recovery.mjs";
 import {
   createPeerRecoveryTask,
   inspectPeerRecoveryTask,
+  recoverAndRunPeerTask,
   recoverPeerTask,
   runPeerTask,
 } from "./peer-recovery.mjs";
@@ -2454,7 +2455,7 @@ const PEER_HELP = `Usage:
   owlrunkit peer create --workspace <dir> --task <id> --request <json>
   owlrunkit peer inspect --workspace <dir> --task <id>
   owlrunkit peer run --workspace <dir> --task <id> --agent <id> --generation <n> -- /absolute/worker [args]
-  owlrunkit peer recover --workspace <dir> --task <id> --agent <id> --generation <n> --revision <n> [--wait-ms <n>]
+  owlrunkit peer recover --workspace <dir> --task <id> --agent <id> --generation <n> --revision <n> [--wait-ms <n>] [-- /absolute/worker [args]]
 `;
 
 function runPeerCommand(rest) {
@@ -2468,10 +2469,10 @@ function runPeerCommand(rest) {
     create: ["request"], inspect: [], run: ["agent", "generation"],
     recover: ["agent", "generation", "revision", "wait-ms"],
   };
-  if (!Object.hasOwn(flags, action) || (separator !== -1 && action !== "run")) {
+  if (!Object.hasOwn(flags, action) || (separator !== -1 && !["run", "recover"].includes(action))) {
     throw new Error(PEER_HELP);
   }
-  const options = parseOptions(optionArgs);
+  const options = parseOptions(optionArgs, { boolean: ["json"] });
   const allowed = new Set(["workspace", "task", "json", ...flags[action]]);
   if (Object.keys(options).some(key => !allowed.has(key))) throw new Error(PEER_HELP);
   const task = { workspaceRoot: workspace(options), taskId: requireOption(options, "task") };
@@ -2489,11 +2490,13 @@ function runPeerCommand(rest) {
     if (separator === -1) throw new Error(PEER_HELP);
     return runPeerTask({ ...peer, command: args.slice(separator + 1) });
   }
-  return recoverPeerTask({ ...peer,
+  const recovery = { ...peer,
     revision: parseCanonicalNonnegativeSafeInteger(requireOption(options, "revision"), "revision"),
     waitMs: options["wait-ms"] === undefined ? undefined
       : parseCanonicalNonnegativeSafeInteger(options["wait-ms"], "wait-ms"),
-  });
+  };
+  return separator === -1 ? recoverPeerTask(recovery)
+    : recoverAndRunPeerTask(recovery, args.slice(separator + 1));
 }
 
 export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {