pi-agent-browser-native 0.9.3 → 0.9.5

package/dist/extensions/agent-browser/lib/process-socket-storage.js

@@ -0,0 +1,256 @@
+import { lstat, mkdir, readdir, readlink, stat } from "node:fs/promises";
+import { dirname, isAbsolute, join } from "node:path";
+import { env as processEnv, platform as processPlatform } from "node:process";
+import { parseArgvDescriptor } from "./argv-descriptor.js";
+import { extractExplicitSessionName, resolveAgentBrowserNamespace } from "./argv-grammar.js";
+import { getAgentBrowserProcessEnvironment } from "./process-environment.js";
+import { getCurrentProcessUid } from "./process-identity.js";
+import { getErrorCode } from "./process-errors.js";
+const AGENT_BROWSER_SOCKET_DIR_ENV = "AGENT_BROWSER_SOCKET_DIR";
+const PI_AGENT_BROWSER_SOCKET_DIR_ENV = "PI_AGENT_BROWSER_SOCKET_DIR";
+const TERMUX_PACKAGE_NAME_PATTERN = /^[A-Za-z0-9_]+(?:\.[A-Za-z0-9_]+)+$/;
+function isTermuxAppRoot(platform, packageName) {
+    return (platform === "android" &&
+        packageName !== undefined &&
+        packageName.length > 0 &&
+        TERMUX_PACKAGE_NAME_PATTERN.test(packageName));
+}
+export function getAgentBrowserSocketDir(platform = processPlatform, uid = getCurrentProcessUid(), termuxPackageName = processEnv.TERMUX_APP__PACKAGE_NAME) {
+    if (platform === "win32") {
+        return undefined;
+    }
+    const termuxAppRoot = isTermuxAppRoot(platform, termuxPackageName);
+    let prefix = "/tmp/piab";
+    if (platform === "darwin") {
+        prefix = "/private/tmp/piab";
+    }
+    else if (termuxAppRoot) {
+        prefix = `/data/data/${termuxPackageName ?? ""}/piab`;
+    }
+    return `${prefix}${!termuxAppRoot && typeof uid === "number" ? `-${uid}` : ""}`;
+}
+export function resolveAgentBrowserSocketDir(options = {}) {
+    const parentEnv = options.parentEnv ?? getAgentBrowserProcessEnvironment();
+    return (options.env?.[AGENT_BROWSER_SOCKET_DIR_ENV] ??
+        parentEnv[PI_AGENT_BROWSER_SOCKET_DIR_ENV] ??
+        (options.ownedManagedSession !== true ? parentEnv[AGENT_BROWSER_SOCKET_DIR_ENV] : undefined) ??
+        getAgentBrowserSocketDir());
+}
+export function isTrustedAndroidAppDataRoot(path, metadata, uid, platform = processPlatform) {
+    if (platform !== "android" ||
+        metadata.uid !== uid ||
+        metadata.isSymbolicLink() ||
+        !metadata.isDirectory() ||
+        (metadata.mode & 0o777) !== 0o700) {
+        return false;
+    }
+    const parent = dirname(path);
+    return parent === "/data/data" || /^\/data\/user\/\d+$/.test(parent);
+}
+function isPrivateAndroidAncestor(metadata, uid, platform) {
+    return platform === "android" && uid !== 0 && metadata.uid === uid && metadata.gid === uid;
+}
+export function isTrustedSocketDirAncestor(metadata, uid, platform = processPlatform) {
+    if (metadata.isSymbolicLink()) {
+        return metadata.uid === 0;
+    }
+    if (!metadata.isDirectory()) {
+        return false;
+    }
+    const mode = metadata.mode & 0o7777;
+    if (isPrivateAndroidAncestor(metadata, uid, platform)) {
+        return (mode & 0o002) === 0;
+    }
+    if (metadata.uid === uid && uid !== 0) {
+        return (mode & 0o022) === 0;
+    }
+    return metadata.uid === 0 && ((mode & 0o022) === 0 || (mode & 0o1000) !== 0);
+}
+class SocketStorageInspection {
+    uid;
+    visited = new Set();
+    entryCount = 0;
+    constructor(uid) {
+        this.uid = uid;
+    }
+    async ancestry(socketDir) {
+        let current = dirname(socketDir);
+        while (true) {
+            current = current.replace(/\/+$/, "");
+            if (current.length === 0) {
+                current = "/";
+            }
+            if (this.visited.has(current)) {
+                return true;
+            }
+            this.visited.add(current);
+            // Each ancestor and symlink destination must be inspected before advancing the walk.
+            // oxlint-disable-next-line no-await-in-loop
+            const metadata = await lstat(current);
+            if (this.isSystemRoot(current, metadata)) {
+                return true;
+            }
+            if (!isTrustedSocketDirAncestor(metadata, this.uid)) {
+                return false;
+            }
+            if (metadata.isSymbolicLink()) {
+                // Resolving one link requires validating its target before continuing this ancestry.
+                // oxlint-disable-next-line no-await-in-loop
+                if (!(await this.symlink(current))) {
+                    return false;
+                }
+            }
+            const parent = dirname(current);
+            if (parent === current) {
+                return true;
+            }
+            current = parent;
+        }
+    }
+    isSystemRoot(path, metadata) {
+        // The environment supplies /; its owner may be unmapped in a user namespace.
+        return ((path === "/" && metadata.isDirectory() && (metadata.mode & 0o022) === 0) ||
+            isTrustedAndroidAppDataRoot(path, metadata, this.uid));
+    }
+    async symlink(current) {
+        if (!isTrustedSocketDirAncestor(await stat(current), this.uid)) {
+            return false;
+        }
+        const target = await readlink(current);
+        const targetPath = isAbsolute(target) ? target : `${dirname(current)}/${target}`;
+        // Keep '..' after symlinks intact; '/.' includes the target itself in the parent walk.
+        return await this.ancestry(`${targetPath}/.`);
+    }
+    async entries(socketDir) {
+        for (const name of await readdir(socketDir)) {
+            this.entryCount += 1;
+            if (this.entryCount > 16_384) {
+                return false;
+            }
+            // A single shared bound and fail-closed traversal prevent unbounded recursive inspection.
+            // oxlint-disable-next-line no-await-in-loop
+            if (!(await this.entry(join(socketDir, name)))) {
+                return false;
+            }
+        }
+        return true;
+    }
+    async entry(path) {
+        try {
+            const metadata = await lstat(path);
+            if (metadata.uid !== this.uid || metadata.isSymbolicLink()) {
+                return false;
+            }
+            if (metadata.isDirectory()) {
+                return await this.entries(path);
+            }
+            return metadata.isFile() || metadata.isSocket();
+        }
+        catch (error) {
+            return getErrorCode(error) === "ENOENT";
+        }
+    }
+}
+async function validateWindowsDirectory(socketDir) {
+    try {
+        try {
+            await mkdir(socketDir);
+        }
+        catch (error) {
+            if (getErrorCode(error) !== "EEXIST") {
+                throw error;
+            }
+        }
+        const metadata = await lstat(socketDir);
+        if (metadata.isSymbolicLink()) {
+            return "the directory is a symlink";
+        }
+        return metadata.isDirectory() ? undefined : "the path is not a directory";
+    }
+    catch (error) {
+        return `the directory could not be inspected (${getErrorCode(error) ?? "unknown error"})`;
+    }
+}
+export async function getAgentBrowserSocketDirValidationError(socketDir, uid = getCurrentProcessUid(), platform = processPlatform) {
+    if (!isAbsolute(socketDir)) {
+        return "the path is not absolute";
+    }
+    // Windows uses native ACLs and named pipes, but still requires a real directory.
+    if (platform === "win32") {
+        return await validateWindowsDirectory(socketDir);
+    }
+    if (typeof uid !== "number") {
+        return "POSIX ownership metadata is unavailable";
+    }
+    try {
+        if (!(await new SocketStorageInspection(uid).ancestry(socketDir))) {
+            return "an ancestor is writable, foreign-owned, a non-directory, or an untrusted symlink";
+        }
+        const creationError = await createPosixSocketDirectory(socketDir);
+        return creationError ?? (await validatePosixDirectory(socketDir, uid));
+    }
+    catch (error) {
+        return `the directory could not be inspected (${getErrorCode(error) ?? "unknown error"})`;
+    }
+}
+async function createPosixSocketDirectory(socketDir) {
+    try {
+        await mkdir(socketDir, { mode: 0o700 });
+    }
+    catch (error) {
+        if (getErrorCode(error) !== "EEXIST") {
+            return `the directory could not be created (${getErrorCode(error) ?? "unknown error"})`;
+        }
+    }
+    return undefined;
+}
+async function validatePosixDirectory(socketDir, uid) {
+    const metadata = await lstat(socketDir);
+    if (!metadata.isDirectory()) {
+        return "the path is not a directory";
+    }
+    if (metadata.isSymbolicLink()) {
+        return "the directory is a symlink";
+    }
+    if (metadata.uid !== uid) {
+        return `the directory is owned by uid ${metadata.uid}, not uid ${uid}`;
+    }
+    if ((metadata.mode & 0o777) !== 0o700) {
+        return `the directory mode is ${(metadata.mode & 0o777).toString(8)}, not 700`;
+    }
+    if (!(await new SocketStorageInspection(uid).ancestry(socketDir))) {
+        return "an ancestor became untrusted during validation";
+    }
+    if (!(await new SocketStorageInspection(uid).entries(socketDir))) {
+        return "the directory contains a foreign-owned, symlink, special, or excessively deep entry";
+    }
+    return undefined;
+}
+function nativeSocketRoot(options) {
+    const namespace = resolveAgentBrowserNamespace(options.args, options.env?.AGENT_BROWSER_NAMESPACE);
+    return namespace !== undefined && namespace.length > 0
+        ? join(options.socketDir, "namespaces", namespace, "run")
+        : options.socketDir;
+}
+export function getAgentBrowserSocketPathValidationError(options) {
+    if ((options.platform ?? processPlatform) === "win32") {
+        return undefined;
+    }
+    const { command } = parseArgvDescriptor(options.args).commandInfo;
+    // Preflight browser-launch/navigation only; follow-up/cleanup may inspect an earlier daemon.
+    if (command === undefined ||
+        command.length === 0 ||
+        !["batch", "connect", "goto", "navigate", "open", "visit"].includes(command)) {
+        return undefined;
+    }
+    const sessionName = extractExplicitSessionName(options.args);
+    if (sessionName === undefined || sessionName.length === 0) {
+        return undefined;
+    }
+    const socketRoot = nativeSocketRoot(options);
+    const pathBytes = Buffer.byteLength(join(socketRoot, `${sessionName}.sock`));
+    if (pathBytes <= 103) {
+        return undefined;
+    }
+    return `Agent-browser Unix socket path would be ${pathBytes} bytes (max 103) for session ${JSON.stringify(sessionName)} under ${JSON.stringify(options.socketDir)}. Set PI_AGENT_BROWSER_SOCKET_DIR to a shorter absolute private directory such as /tmp/piab-<uid> with mode 0700; retrying sessionMode "fresh" cannot shorten this configured root.`;
+}

package/dist/extensions/agent-browser/lib/process-stdout.js

@@ -0,0 +1,74 @@
+import { normalizeProcessError } from "./process-errors.js";
+import { openSecureTempFile, writeSecureTempChunk } from "./temp.js";
+const MAX_BUFFERED_STDOUT_BYTES = 512 * 1_024;
+const MAX_BUFFERED_STDOUT_TAIL_CHARS = 32_000;
+export function appendProcessOutputTail(text, addition, maxChars) {
+    const combined = text + addition;
+    return combined.length <= maxChars ? combined : combined.slice(combined.length - maxChars);
+}
+/** Own buffered output, sequential spill writes and the spill handle through subprocess completion. */
+export class ProcessStdout {
+    buffers = [];
+    bufferedBytes = 0;
+    tail = "";
+    handle;
+    spillPath;
+    spillPending = false;
+    pendingWrite = Promise.resolve();
+    spillError;
+    queue(buffer) {
+        this.tail = appendProcessOutputTail(this.tail, buffer.toString("utf8"), MAX_BUFFERED_STDOUT_TAIL_CHARS);
+        if (this.spillError) {
+            return;
+        }
+        if (!this.spillPending &&
+            this.spillPath === undefined &&
+            this.bufferedBytes + buffer.length <= MAX_BUFFERED_STDOUT_BYTES) {
+            this.buffers.push(buffer);
+            this.bufferedBytes += buffer.length;
+            return;
+        }
+        this.spillPending = true;
+        this.pendingWrite = this.pendingWrite
+            .then(() => this.write(buffer))
+            .catch((error) => {
+            this.spillError = normalizeProcessError(error);
+        });
+    }
+    async write(buffer) {
+        if (this.spillError) {
+            return;
+        }
+        if (!this.handle || this.spillPath === undefined) {
+            const file = await openSecureTempFile("process-stdout", ".json");
+            this.handle = file.fileHandle;
+            this.spillPath = file.path;
+            if (this.buffers.length > 0) {
+                await writeSecureTempChunk({
+                    content: Buffer.concat(this.buffers),
+                    fileHandle: this.handle,
+                    path: this.spillPath,
+                });
+                this.buffers = [];
+                this.bufferedBytes = 0;
+            }
+        }
+        await writeSecureTempChunk({ content: buffer, fileHandle: this.handle, path: this.spillPath });
+    }
+    async drain() {
+        await this.pendingWrite;
+    }
+    async finish() {
+        await this.pendingWrite;
+        if (this.handle) {
+            await this.handle.close().catch(() => {
+                /* Spill close is best-effort after all writes settled. */
+            });
+        }
+        return {
+            stdout: this.spillPath === undefined ? Buffer.concat(this.buffers).toString("utf8") : this.tail,
+            stdoutSpillPath: this.spillPath,
+            error: this.spillError,
+        };
+    }
+}