pi-glovebox 0.2.1 → 0.3.0

package/README.md

@@ -13,7 +13,7 @@ Every call becomes one command run by `pi-glovebox-server` inside your sandbox:
 | `write` | `mkdir -p`, then `cat > file` with the content on stdin |
 | `edit` | `: < file && : >> file` to check access, `cat`, `cat > file` |
 
-Your `!` and `!!` commands run the same way as `bash`. Commands get the server's environment, not Pi's. Aborts and timeouts close the connection, and the server kills the command's process group. Like Pi's own `bash`, a command counts as finished once it has exited and any background processes it started have printed nothing for 100 ms; those processes keep running.
+Your `!` and `!!` commands run the same way as `bash`. Commands get the server's environment, not Pi's. Aborts and timeouts close the connection, and the server kills the command's process group. Like Pi's own `bash`, a command counts as finished once it has exited and any background processes it started have printed nothing for 100 ms. Those processes keep running, but nothing reads their output any more: if one later writes to the stdout or stderr it inherited, it gets `SIGPIPE` and usually dies, so redirect the output of anything meant to outlive the command (`server > log 2>&1 &`).
 
 pi-glovebox also blocks calls to tools that would run in Pi's process instead, returning an error the model sees:
 
@@ -63,7 +63,7 @@ This sandbox sees the project read-write, `/nix` and the directories on your `PA
 
 ## Protocol
 
-One connection runs one command. The client sends one line of JSON, `{"argv": [...], "cwd": "/abs/path", "stdin": "optional text"}`. The server answers with frames of a 1-byte type, a 4-byte big-endian length and a payload: type 1 carries output (stdout and stderr as they arrive); type 2 carries the exit code as JSON (`null` if the command was killed by a signal); type 3 carries an error message if the command could not start, such as a missing `cwd`. Either type 2 or type 3 comes last, then the server closes the connection. Closing the connection early, including only its writing side, kills the command's process group, so keep it fully open until the last frame; a malformed request closes it without running anything.
+One connection runs one command. The client sends one line of JSON, `{"argv": [...], "cwd": "/abs/path", "stdin": "optional text"}`. The server answers with frames of a 1-byte type, a 4-byte big-endian length and a payload: type 1 carries stdout and type 4 carries stderr, each as it arrives; type 2 carries the exit code as JSON (`null` if the command was killed by a signal); type 3 carries an error message if the command could not start, such as a missing `cwd`. Either type 2 or type 3 comes last, then the server closes the connection. Closing the connection early, including only its writing side, kills the command's process group, so keep it fully open until the last frame; a malformed request closes it without running anything. `read` and `edit` take file contents from stdout alone and the file tools report errors from stderr, so warnings a tool in the sandbox prints on stderr never end up in a file.
 
 ## License
 

package/bin/pi-glovebox-server.mjs

@@ -3,9 +3,10 @@ import { spawn } from "node:child_process";
 import { existsSync } from "node:fs";
 import net from "node:net";
 
-const output = 1;
+const stdout = 1;
 const exit = 2;
 const failure = 3;
+const stderr = 4;
 // Background processes can hold stdout and stderr open after the command exits. Like Pi's own bash,
 // stop waiting for their output once none has arrived for this long.
 const quietMs = 100;
@@ -44,11 +45,11 @@ net
       }, quietMs);
     };
 
-    const forward = (stream) =>
+    const forward = (stream, type) =>
       stream.on("data", (chunk) => {
         if (finished) return;
         if (exited) finishWhenQuiet();
-        if (socket.write(frame(output, chunk))) return;
+        if (socket.write(frame(type, chunk))) return;
         stream.pause();
         socket.once("drain", () => stream.resume());
       });
@@ -90,8 +91,8 @@ net
       } catch (error) {
         return finish(failure, error.message);
       }
-      forward(child.stdout);
-      forward(child.stderr);
+      forward(child.stdout, stdout);
+      forward(child.stderr, stderr);
       child.on("error", (error) => finish(failure, error.message));
       child.on("exit", () => {
         exited = true;

package/extensions/index.ts

@@ -23,18 +23,20 @@ const ownPaths = [ownFile, path.dirname(ownFile)];
 const ownTools = ["bash", "read", "write", "edit"];
 // The largest delay setTimeout accepts; Pi's own bash rejects longer timeouts the same way.
 const maxTimeoutMs = 2147483647;
-const frameOutput = 1;
+const frameStdout = 1;
 const frameExit = 2;
 const frameFailure = 3;
+const frameStderr = 4;
 
 type Request = { argv: string[]; cwd: string; stdin?: string };
 type Options = { onData?: (data: Buffer) => void; signal?: AbortSignal; timeout?: number };
-type Result = { output: Buffer; exitCode: number | null };
+type Result = { stdout: Buffer; stderr: Buffer; exitCode: number | null };
 
 const run = (request: Request, { onData, signal, timeout }: Options = {}) =>
 	new Promise<Result>((resolve, reject) => {
 		const socket = net.createConnection(socketPath);
-		const output: Buffer[] = [];
+		const stdout: Buffer[] = [];
+		const stderr: Buffer[] = [];
 		let received = Buffer.alloc(0);
 		let exitCode: number | null | undefined;
 		let failure: string | undefined;
@@ -51,9 +53,9 @@ const run = (request: Request, { onData, signal, timeout }: Options = {}) =>
 			received = Buffer.concat([received, chunk]);
 			while (received.length >= 5 && received.length >= 5 + received.readUInt32BE(1)) {
 				const payload = received.subarray(5, 5 + received.readUInt32BE(1));
-				if (received[0] === frameOutput) {
+				if (received[0] === frameStdout || received[0] === frameStderr) {
 					if (onData) onData(payload);
-					else output.push(payload);
+					else (received[0] === frameStdout ? stdout : stderr).push(payload);
 				} else if (received[0] === frameExit) {
 					exitCode = JSON.parse(payload.toString());
 				} else if (received[0] === frameFailure) {
@@ -68,17 +70,18 @@ const run = (request: Request, { onData, signal, timeout }: Options = {}) =>
 			signal?.removeEventListener("abort", abort);
 			if (failure !== undefined) reject(new Error(failure));
 			else if (exitCode === undefined) reject(new Error("pi-glovebox: connection closed before the command finished"));
-			else resolve({ output: Buffer.concat(output), exitCode });
+			else resolve({ stdout: Buffer.concat(stdout), stderr: Buffer.concat(stderr), exitCode });
 		});
 
 		if (signal?.aborted) abort();
 		else socket.write(`${JSON.stringify(request)}\n`);
 	});
 
+// File contents come from stdout alone, so warnings a sandboxed tool prints on stderr never end up in them.
 const succeed = async (argv: string[], stdin?: string) => {
-	const { output, exitCode } = await run({ argv, cwd: "/", stdin });
-	if (exitCode !== 0) throw new Error(output.toString().trim() || `exit code ${exitCode}`);
-	return output;
+	const { stdout, stderr, exitCode } = await run({ argv, cwd: "/", stdin });
+	if (exitCode !== 0) throw new Error(stderr.toString().trim() || `exit code ${exitCode}`);
+	return stdout;
 };
 
 const shell = (script: string, file: string, stdin?: string) =>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-glovebox",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Run Pi's bash, read, write and edit tools in a separate sandbox, reached over a Unix socket",
   "keywords": [
     "pi-package",