pi-microsandbox 0.1.1 → 0.3.0

package/extensions/pi-msb/types.ts

@@ -12,8 +12,8 @@ import type {
 
 // --------------------------------------------------------------- identity ----
 
-export const STATE_SCHEMA_VERSION = 1;
-export const LOCKFILE_VERSION = 1;
+export const STATE_SCHEMA_VERSION = 2;
+export const LOCKFILE_VERSION = 2;
 
 export function resourceId(sessionId: string): string {
   return createHash("sha256").update(sessionId).digest("hex").slice(0, 20);
@@ -24,20 +24,18 @@ export function displayId(sessionId: string): string {
 export function sandboxNameFor(sessionId: string): string {
   return `pi-msb-${resourceId(sessionId)}`;
 }
-export function volumeNameFor(sessionId: string): string {
-  return `pi-msb-vol-${resourceId(sessionId)}`;
-}
-
 // ---------------------------------------------------------------- config ----
-
-export type StorageMode = "git" | "direct" | "none";
-export type ConfigStorageMode = "auto" | StorageMode;
 export type NetworkMode = "default" | "open" | "allowlist" | "deny";
 export type FallbackMode = "block" | "host";
 export type BootstrapTools = "auto" | boolean;
 export type PullPolicy = "always" | "if-missing" | "never";
 export type MountType = "dir" | "file" | "named" | "tmpfs";
+export type DockerMode = "auto" | "require" | "disabled";
 
+export interface DockerConfig {
+  mode: DockerMode;
+  startupTimeoutMs: number;
+}
 export interface NetworkConfig {
   mode: NetworkMode;
   allowHosts: string[];
@@ -68,12 +66,8 @@ export interface Config {
   replace: boolean;
   replaceTimeoutMs: number;
   sandboxName: string | null;
-  mode: ConfigStorageMode;
-  cloneBranch: "current" | string;
-  cloneDepth: number | "unlimited";
-  shallowArchive: boolean;
-  volumeQuotaMiB: number;
   network: NetworkConfig;
+  docker: DockerConfig;
   secrets: SecretConfig[];
   mounts: MountConfig[];
   blockThirdParty: boolean;
@@ -131,31 +125,21 @@ export const LABEL_KEYS = {
   managed: "pi-msb.managed",
   schema: "pi-msb.schema",
   session: "pi-msb.session",
-  mode: "pi-msb.mode",
   cwd: "pi-msb.cwd",
+  root: "pi-msb.root",
+  guestRoot: "pi-msb.guest-root",
   pid: "pi-msb.pid",
-  volume: "pi-msb.volume",
   image: "pi-msb.image",
   keep: "pi-msb.keep",
-  seedBranch: "pi-msb.seed-branch",
-  seedSha: "pi-msb.seed-sha",
 } as const;
 
 export interface SandboxLabelInput {
   sessionId: string;
-  mode: StorageMode;
   cwd: string;
+  root: string;
+  guestRoot: string;
   pid: number;
   image: string;
-  volumeName?: string;
-  seedBranch?: string | null;
-  seedSha?: string | null;
-}
-export interface VolumeLabelInput {
-  sessionId: string;
-  cwd: string;
-  seedBranch?: string | null;
-  seedSha?: string | null;
 }
 export interface ManagedSandboxRecord {
   name: string;
@@ -165,29 +149,18 @@ export interface ManagedSandboxRecord {
 }
 export interface ValidatedManagedSandbox extends ManagedSandboxRecord {
   sessionId: string;
-  mode: StorageMode;
   cwd: string;
-  volumeName?: string;
-}
-export interface VolumeRecord {
-  name: string;
-  hostPath: string;
-  labels: Record<string, string>;
-  kind?: string;
-  usedBytes?: number;
-  createdAt?: number;
+  root: string;
+  guestRoot: string;
 }
 export interface PersistedSandboxState {
   version: typeof STATE_SCHEMA_VERSION;
   sessionId: string;
   sandboxName: string;
-  mode: StorageMode;
   cwd: string;
+  root: string;
+  guestRoot: string;
   image: string;
-  volumeName?: string;
-  volumeHostPath?: string;
-  seedBranch?: string | null;
-  seedSha?: string | null;
   enabled: boolean;
   createdAt: number;
 }
@@ -198,9 +171,8 @@ export interface LockInfo {
   version: typeof LOCKFILE_VERSION;
   sessionId: string;
   sandboxName: string;
-  volumeName?: string;
-  mode: StorageMode;
   cwd: string;
+  root: string;
   pid: number;
   createdAt: number;
 }
@@ -212,52 +184,18 @@ export interface LocksPort {
   tryAcquire(sessionId: string): Promise<LockHandle | null>;
 }
 
-// ------------------------------------------------------------- git/storage ----
+// -------------------------------------------------------------- workspace ----
 
-export interface GitRepoInfo {
-  isGitRepo: boolean;
-  /** Canonical host source for direct binds; guest paths remain lexical. */
-  hostCwd?: string;
-  /** Canonical host source used only for Git reads and seed bundle creation. */
-  repoRoot: string | null;
-  /** Lexical guest namespace where the retained volume must be mounted. */
-  guestRepoRoot?: string | null;
-  branch: string | null;
-  headSha: string | null;
-  unborn: boolean;
-  isLinkedWorktree: boolean;
-}
-export interface GitSeedBundle {
-  hostPath: string;
-  branch: string | null;
-  headSha: string;
-  cleanup(): Promise<void>;
-}
-export interface GitVolumePlan {
-  kind: "git-volume";
-  sessionId: string;
-  volumeName: string;
-  volumeQuotaMiB: number;
-  repoRoot: string;
-  mountGuestPath: string;
-  workdir: string;
-  branch: string | null;
-  headSha: string | null;
-  unborn: boolean;
-  depth: number | "unlimited";
-  seedRequired: boolean;
-}
-export type StoragePlan =
-  | GitVolumePlan
-  | { kind: "direct-mount"; hostPath: string; guestPath: string; workdir: string }
-  | { kind: "none"; guestPath: string; workdir: string };
-export interface PreparedStorage {
-  plan: StoragePlan;
-  volume?: VolumeRecord;
-  bundle?: GitSeedBundle | null;
-  createdVolume: boolean;
-}
-export interface SeedResult { headSha: string | null }
+/** One path-preserving read/write bind used by every sandbox. */
+export interface Workspace {
+  /** Canonical host directory supplied to the bind mount. */
+  hostRoot: string;
+  /** Lexical absolute path used as the guest mount point. */
+  guestRoot: string;
+  /** Original lexical absolute cwd retained as the sandbox workdir. */
+  cwd: string;
+  fromGit: boolean;
+}
 
 // ------------------------------------------------------------- transport ----
 
@@ -300,8 +238,6 @@ export interface SandboxTransport {
   exists(path: string): Promise<boolean>;
   stat(path: string): Promise<StatResult>;
   list(path: string): Promise<FsEntry[]>;
-  copyFromHost(hostPath: string, guestPath: string): Promise<void>;
-  copyToHost(guestPath: string, hostPath: string): Promise<void>;
   exec(command: string, args: string[], options?: ExecOptions): Promise<TransportExecResult>;
   execStream(command: string, args: string[], options?: ExecStreamOptions): Promise<{ exitCode: number }>;
   dispose(): Promise<void>;
@@ -362,18 +298,26 @@ export type RuntimeStatus =
   | "off"
   | "host-fallback"
   | "disabled";
+export type DockerReadiness = "ready" | "missing" | "unavailable" | "disabled";
+export interface DockerCapabilityStatus {
+  mode: DockerMode;
+  readiness: DockerReadiness;
+  version?: string;
+  storageDriver?: string;
+  reason?: string;
+}
+export interface RuntimePreparation {
+  docker: DockerCapabilityStatus;
+}
 export interface SandboxInfo {
   name: string;
   displayId: string;
-  mode: StorageMode;
   image: string;
   pid: number;
   cwd: string;
-  volumeName?: string;
-  volumeHostPath?: string;
-  seedBranch?: string | null;
-  seedSha?: string | null;
+  root: string;
   createdAt: number;
+  docker: DockerCapabilityStatus;
 }
 export interface RuntimeState {
   status: RuntimeStatus;
@@ -383,6 +327,7 @@ export interface RuntimeState {
 export interface BootRequest {
   sessionId: string;
   cwd: string;
+  workspace: Workspace;
   config: Config;
   restored: PersistedSandboxState | null;
 }
@@ -411,22 +356,11 @@ export type ExecFn = (
 
 // ------------------------------------------------------- command/control ----
 
-export interface ExportResult { source: string; destination: string }
 export interface MsbControl {
   getState(): RuntimeState;
   setEnabled(enabled: boolean): Promise<void>;
   reload(): Promise<void>;
   pruneNow(): Promise<PruneReport>;
-  listVolumes(): Promise<VolumeRecord[]>;
-  describeVolume(name: string): Promise<{
-    volume: VolumeRecord;
-    branch?: string;
-    lastCommit?: string;
-    dirtyCount?: number;
-    mounted: boolean;
-  }>;
-  removeVolume(name: string): Promise<void>;
-  exportPaths(paths: string[], destination?: string): Promise<ExportResult[]>;
   getLogs(tailLines?: number): Promise<string>;
   getEffectiveConfig(): ResolvedConfig;
   getEffectiveConfigToml(): string;

package/extensions/pi-msb/workspace.ts

@@ -0,0 +1,126 @@
+import { execFile } from "node:child_process";
+import { realpath } from "node:fs/promises";
+import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import { promisify } from "node:util";
+
+import type { ExecFn, Workspace } from "./types.ts";
+
+const execFileAsync = promisify(execFile);
+
+interface ExecFileFailure {
+  code?: number | string;
+  killed?: boolean;
+  signal?: string | null;
+  stdout?: string | Buffer;
+  stderr?: string | Buffer;
+  message?: string;
+}
+
+const defaultExec: ExecFn = async (command, args, options = {}) => {
+  try {
+    const result = await execFileAsync(command, args, {
+      cwd: options.cwd,
+      env: { ...process.env, ...options.env, LC_ALL: "C" },
+      timeout: options.timeout === undefined ? undefined : options.timeout * 1000,
+      maxBuffer: 1024 * 1024,
+      encoding: "utf8",
+    });
+    return { stdout: String(result.stdout), stderr: String(result.stderr), code: 0 };
+  } catch (error: unknown) {
+    const failure = error as ExecFileFailure;
+    return {
+      stdout: String(failure.stdout ?? ""),
+      stderr: String(failure.stderr ?? failure.message ?? ""),
+      code: typeof failure.code === "number" ? failure.code : 127,
+      killed: Boolean(failure.killed || failure.signal),
+    };
+  }
+};
+
+async function lexicalRoot(cwd: string, canonicalRoot: string): Promise<string | null> {
+  let candidate = cwd;
+  while (true) {
+    let canonicalCandidate: string;
+    try {
+      canonicalCandidate = await realpath(candidate);
+    } catch (error) {
+      throw new Error(`workspace path cannot be canonicalized: ${candidate}`, { cause: error });
+    }
+    if (canonicalCandidate === canonicalRoot) return candidate;
+    const parent = dirname(candidate);
+    if (parent === candidate) return null;
+    candidate = parent;
+  }
+}
+
+function isNotRepository(code: number, stderr: string): boolean {
+  return code === 128 && /(?:^|\n)fatal: (?:not a git (?:repository|work tree)|this operation must be run in a work tree)(?:\s|$)/i.test(stderr);
+}
+
+const PROTECTED_GUEST_PATHS = [
+  "/bin",
+  "/dev",
+  "/etc/ld.so.cache",
+  "/etc/ld.so.preload",
+  "/lib",
+  "/lib64",
+  "/proc",
+  "/sbin",
+  "/sys",
+  "/usr",
+  "/run",
+  "/var/run",
+  "/var/lib/docker",
+] as const;
+
+function containsPath(parent: string, child: string): boolean {
+  const value = relative(parent, child);
+  return value === "" || (value !== ".." && !value.startsWith(`..${sep}`) && !isAbsolute(value));
+}
+
+function assertSafeGuestRoot(root: string): void {
+  if (PROTECTED_GUEST_PATHS.some((path) => containsPath(root, path) || containsPath(path, root))) {
+    throw new Error(`workspace root cannot safely be mounted at the guest path: ${root}`);
+  }
+}
+
+/** Discover the single path-preserving project bind for a configure/boot cycle. */
+export async function discoverWorkspace(cwd: string, exec: ExecFn = defaultExec): Promise<Workspace> {
+  const lexicalCwd = resolve(cwd);
+  let canonicalCwd: string;
+  try {
+    canonicalCwd = await realpath(lexicalCwd);
+  } catch (error) {
+    throw new Error(`workspace cwd cannot be canonicalized: ${lexicalCwd}`, { cause: error });
+  }
+
+  const result = await exec("git", ["-C", lexicalCwd, "rev-parse", "--show-toplevel"]);
+  if (result.killed) throw new Error("Git workspace discovery was interrupted");
+  if (result.code !== 0) {
+    if (isNotRepository(result.code, result.stderr)) {
+      assertSafeGuestRoot(lexicalCwd);
+      return { hostRoot: canonicalCwd, guestRoot: lexicalCwd, cwd: lexicalCwd, fromGit: false };
+    }
+    const detail = result.stderr.trim() || `git exited with code ${result.code}`;
+    throw new Error(`Git workspace discovery failed: ${detail}`);
+  }
+
+  const output = result.stdout.replace(/\r?\n$/, "");
+  if (!output || output.includes("\0") || output.includes("\n") || output.includes("\r") || !isAbsolute(output)) {
+    throw new Error("Git workspace discovery returned an invalid repository root");
+  }
+
+  let hostRoot: string;
+  try {
+    hostRoot = await realpath(output);
+  } catch (error) {
+    throw new Error(`Git workspace root cannot be canonicalized: ${output}`, { cause: error });
+  }
+  const guestRoot = await lexicalRoot(lexicalCwd, hostRoot);
+  if (guestRoot === null) {
+    throw new Error("Git workspace root cannot preserve the cwd guest path; unsupported symlink topology");
+  }
+  assertSafeGuestRoot(guestRoot);
+
+  return { hostRoot, guestRoot, cwd: lexicalCwd, fromGit: true };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-microsandbox",
-  "version": "0.1.1",
+  "version": "0.3.0",
   "description": "Microsandbox-backed isolation for Pi coding tools",
   "type": "module",
   "license": "MIT",

package/extensions/pi-msb/git.ts

@@ -1,256 +0,0 @@
-import { execFile } from "node:child_process";
-import { chmod, mkdir, mkdtemp, realpath, rm } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { dirname, isAbsolute, join, resolve } from "node:path";
-import { pathToFileURL } from "node:url";
-import { promisify } from "node:util";
-
-import type { ExecFn, GitRepoInfo, GitSeedBundle } from "./types.ts";
-
-const execFileAsync = promisify(execFile);
-const SEED_REF = "refs/pi-msb/seed";
-
-interface ExecFileFailure {
-  code?: number | string;
-  killed?: boolean;
-  signal?: string | null;
-  stdout?: string | Buffer;
-  stderr?: string | Buffer;
-  message?: string;
-}
-
-/** Execute a program without giving it a shell or interpolating its arguments. */
-const defaultExec: ExecFn = async (command, args, options = {}) => {
-  try {
-    const result = await execFileAsync(command, args, {
-      cwd: options.cwd,
-      env: options.env,
-      timeout: options.timeout === undefined ? undefined : options.timeout * 1000,
-      maxBuffer: 16 * 1024 * 1024,
-      encoding: "utf8",
-    });
-    return {
-      stdout: String(result.stdout),
-      stderr: String(result.stderr),
-      code: 0,
-    };
-  } catch (error: unknown) {
-    const failure = error as ExecFileFailure;
-    const numericCode = typeof failure.code === "number" ? failure.code : 127;
-    return {
-      stdout: String(failure.stdout ?? ""),
-      stderr: String(failure.stderr ?? failure.message ?? ""),
-      code: numericCode,
-      killed: Boolean(failure.killed || failure.signal),
-    };
-  }
-};
-
-const emptyRepo = (hostCwd?: string): GitRepoInfo => ({
-  isGitRepo: false,
-  ...(hostCwd ? { hostCwd } : {}),
-  repoRoot: null,
-  branch: null,
-  headSha: null,
-  unborn: false,
-  isLinkedWorktree: false,
-});
-
-function output(result: Awaited<ReturnType<ExecFn>>): string {
-  return result.stdout.trim();
-}
-
-function failureMessage(context: string, result: Awaited<ReturnType<ExecFn>>): Error {
-  const detail = result.stderr.trim() || `git exited with code ${result.code}`;
-  return new Error(`${context}: ${detail}`);
-}
-
-async function canonicalPath(value: string): Promise<string> {
-  try {
-    return await realpath(value);
-  } catch {
-    return resolve(value);
-  }
-}
-
-function pathFromGitResult(value: string, base: string): string {
-  return isAbsolute(value) ? value : resolve(base, value);
-}
-
-async function lexicalRepoRoot(requestedCwd: string, canonicalRepoRoot: string): Promise<string | null> {
-  let candidate = requestedCwd;
-  while (true) {
-    if (await canonicalPath(candidate) === canonicalRepoRoot) return candidate;
-    const parent = dirname(candidate);
-    if (parent === candidate) return null;
-    candidate = parent;
-  }
-}
-
-/**
- * Return the immutable source state of cwd. A directory outside Git is an ordinary
- * result rather than an error, which lets storage mode `auto` remain a direct alias.
- */
-export async function detectGitRepo(cwd: string, exec: ExecFn = defaultExec): Promise<GitRepoInfo> {
-  const requestedCwd = resolve(cwd);
-  const hostCwd = await canonicalPath(requestedCwd);
-  const topLevel = await exec("git", ["-C", requestedCwd, "rev-parse", "--show-toplevel"]);
-  if (topLevel.code !== 0 || topLevel.killed || !output(topLevel)) return emptyRepo(hostCwd);
-
-  const repoRoot = await canonicalPath(output(topLevel));
-  const guestRepoRoot = await lexicalRepoRoot(requestedCwd, repoRoot);
-  const branchResult = await exec("git", [
-    "-C",
-    repoRoot,
-    "symbolic-ref",
-    "--quiet",
-    "--short",
-    "HEAD",
-  ]);
-  const branch = branchResult.code === 0 && !branchResult.killed && output(branchResult)
-    ? output(branchResult)
-    : null;
-
-  const headResult = await exec("git", ["-C", repoRoot, "rev-parse", "--verify", "HEAD"]);
-  const headSha = headResult.code === 0 && !headResult.killed && output(headResult)
-    ? output(headResult)
-    : null;
-
-  // In a linked worktree --git-dir points at .git/worktrees/<name>, while
-  // --git-common-dir points at the shared .git directory.
-  const gitDirResult = await exec("git", ["-C", repoRoot, "rev-parse", "--git-dir"]);
-  const commonDirResult = await exec("git", ["-C", repoRoot, "rev-parse", "--git-common-dir"]);
-  let isLinkedWorktree = false;
-  if (gitDirResult.code === 0 && commonDirResult.code === 0) {
-    const gitDir = await canonicalPath(pathFromGitResult(output(gitDirResult), repoRoot));
-    const commonDir = await canonicalPath(pathFromGitResult(output(commonDirResult), repoRoot));
-    isLinkedWorktree = gitDir !== commonDir;
-  }
-
-  return {
-    isGitRepo: true,
-    hostCwd,
-    repoRoot,
-    guestRepoRoot,
-    branch,
-    headSha,
-    unborn: headSha === null && branch !== null,
-    isLinkedWorktree,
-  };
-}
-
-function bundleFailure(context: string, result: Awaited<ReturnType<ExecFn>>): never {
-  throw failureMessage(context, result);
-}
-
-async function checkedGit(
-  exec: ExecFn,
-  args: string[],
-  context: string,
-): Promise<Awaited<ReturnType<ExecFn>>> {
-  const result = await exec("git", args);
-  if (result.code !== 0 || result.killed) bundleFailure(context, result);
-  return result;
-}
-
-/**
- * Make a disposable bundle from committed objects only. The temporary bare clone
- * deliberately has no worktree, so ignored, modified, and untracked files cannot
- * enter the seed.
- */
-export async function createSeedBundle(
-  info: GitRepoInfo,
-  options: {
-    branch: "current" | string;
-    depth: number | "unlimited";
-    tempRoot?: string;
-    exec?: ExecFn;
-  },
-): Promise<GitSeedBundle | null> {
-  if (!info.isGitRepo || info.unborn || !info.repoRoot || !info.headSha) return null;
-  if (options.depth !== "unlimited" && (!Number.isInteger(options.depth) || options.depth < 1)) {
-    throw new Error(`invalid Git bundle depth: ${String(options.depth)}`);
-  }
-
-  const exec = options.exec ?? defaultExec;
-  const parent = resolve(options.tempRoot ?? tmpdir());
-  await mkdir(parent, { recursive: true, mode: 0o700 });
-  const tempDir = await mkdtemp(join(parent, "pi-msb-git-"));
-  await chmod(tempDir, 0o700);
-  let cleaned = false;
-  const cleanup = async (): Promise<void> => {
-    if (cleaned) return;
-    cleaned = true;
-    await rm(tempDir, { recursive: true, force: true });
-  };
-
-  try {
-    const bareName = "source.git";
-    const barePath = join(tempDir, bareName);
-    const bundlePath = join(tempDir, "seed.bundle");
-    const source = fileUrl(info.repoRoot);
-    const depthArgs = options.depth === "unlimited" ? [] : ["--depth", String(options.depth)];
-
-    // A file:// URL forces Git's local transport while keeping the source repo
-    // read-only. --bare means no checkout, filters, or worktree are involved.
-    await checkedGit(
-      exec,
-      ["-C", tempDir, "clone", "--bare", "--no-tags", ...depthArgs, source, bareName],
-      "creating temporary bare clone",
-    );
-
-    const objectCheck = await exec("git", ["-C", barePath, "cat-file", "-e", `${info.headSha}^{commit}`]);
-    if (objectCheck.code !== 0 || objectCheck.killed) {
-      // A branch may have moved between detection and clone. Fetch the captured
-      // object explicitly; never fall back to whatever HEAD the clone obtained.
-      await checkedGit(
-        exec,
-        ["-C", barePath, "fetch", "--no-tags", ...depthArgs, source, info.headSha],
-        `fetching captured HEAD ${info.headSha}`,
-      );
-    }
-
-    const verifiedObject = await exec("git", ["-C", barePath, "cat-file", "-e", `${info.headSha}^{commit}`]);
-    if (verifiedObject.code !== 0 || verifiedObject.killed) {
-      bundleFailure(`captured HEAD ${info.headSha} is not present in temporary clone`, verifiedObject);
-    }
-
-    await checkedGit(
-      exec,
-      ["-C", barePath, "update-ref", SEED_REF, info.headSha],
-      "updating temporary seed ref",
-    );
-    await checkedGit(
-      exec,
-      ["-C", barePath, "bundle", "create", bundlePath, SEED_REF],
-      "creating Git bundle",
-    );
-    await checkedGit(exec, ["-C", barePath, "bundle", "verify", bundlePath], "verifying Git bundle");
-    const heads = await checkedGit(
-      exec,
-      ["-C", barePath, "bundle", "list-heads", bundlePath],
-      "listing Git bundle heads",
-    );
-    const expectedHead = heads.stdout
-      .split(/\r?\n/)
-      .map((line) => line.trim().split(/\s+/))
-      .find(([sha, ref]) => sha === info.headSha && ref === SEED_REF);
-    if (!expectedHead) {
-      throw new Error(`Git bundle did not contain captured HEAD ${info.headSha} at ${SEED_REF}`);
-    }
-
-    return {
-      hostPath: bundlePath,
-      branch: options.branch === "current" ? info.branch : options.branch,
-      headSha: info.headSha,
-      cleanup,
-    };
-  } catch (error: unknown) {
-    await cleanup().catch(() => undefined);
-    throw error;
-  }
-}
-
-export function fileUrl(path: string): string {
-  return pathToFileURL(path).href;
-}