pi-roundtable-sandbox 0.7.0 → 0.7.3

package/worker/pi-main.ts

@@ -0,0 +1,382 @@
+/**
+ * Opt-in Pi worker: one session per isolated channel, no network or host credentials.
+ */
+import { existsSync, mkdirSync, readdirSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import {
+	type AgentSession,
+	createAgentSession,
+	DefaultResourceLoader,
+	ModelRuntime,
+	SessionManager,
+	SettingsManager,
+} from "@earendil-works/pi-coding-agent";
+import {
+	activeToolsExtension,
+	lastAssistant,
+	mcpAdapterExtension,
+	packageDir,
+	readAttachmentExtension,
+	textOf,
+} from "pi-roundtable/kit";
+import {
+	PI_BROKER_SOCKET as BROKER_SOCKET,
+	PI_RUN_DIR as CONTAINER_RUN_DIR,
+	PI_WORKSPACE as CONTAINER_WORKSPACE,
+	PI_FORWARDER_PORT as FORWARDER_PORT,
+	isPiThinkingLevel as isPartyThinkingLevel,
+	type PiMcpDiscovery as McpToolsResponse,
+	type PiTurnRequest as PartyTurnRequest,
+	type PiTurnResponse as PartyTurnResponse,
+	PI_MEDIA_LIMITS,
+	safeFileName,
+	type PiTurnContext as TurnContext,
+	validatePiTurn,
+	PI_ATTACHMENTS as WORKSPACE_ATTACHMENTS,
+	PI_OUTBOX as WORKSPACE_OUTBOX,
+} from "../src/pi-protocol.ts";
+import { boundedText } from "../src/protocol.ts";
+import type { PiWorkerContent } from "./pi-content.ts";
+import { speakerMemoryExtension } from "./pi-memory.ts";
+import {
+	loadSkillIndex,
+	skillsExtension,
+	skillsPromptBlock,
+} from "./pi-skills.ts";
+import { boundedFile, brokerToolsExtension } from "./pi-tools.ts";
+
+let content: PiWorkerContent;
+let baseTools: string[] = [];
+const THINKING = "low";
+const MCP_CONNECT_TIMEOUT_MS = 45_000;
+/** The tools every run may use: the base set plus the profile's MCP tools, fixed at startup. */
+let activeTools: readonly string[] = baseTools;
+/** The running turn, read by broker-backed tools; turns never overlap, the host queues them. */
+const turnContext: TurnContext = {
+	authorId: "",
+	authorName: "",
+	outbox: "",
+	memory: "",
+};
+const TURN_TIMEOUT_MS = 10 * 60_000;
+const DROPPED_HEADERS = [
+	"host",
+	"connection",
+	"content-length",
+	"accept-encoding",
+];
+const DROPPED_RESPONSE_HEADERS = [
+	"content-encoding",
+	"content-length",
+	"transfer-encoding",
+];
+
+function log(msg: string, fields: Record<string, unknown> = {}): void {
+	console.log(
+		JSON.stringify({ time: Date.now(), app: "sandbox-worker", msg, ...fields }),
+	);
+}
+
+function without(headers: Headers, names: readonly string[]): Headers {
+	const copy = new Headers(headers);
+	for (const name of names) copy.delete(name);
+	return copy;
+}
+
+/** Claude Code speaks only TCP, so loopback requests are forwarded to the host broker's socket. */
+function startForwarder(): void {
+	const broker = join(CONTAINER_RUN_DIR, BROKER_SOCKET);
+	Bun.serve({
+		hostname: "127.0.0.1",
+		port: FORWARDER_PORT,
+		idleTimeout: 0,
+		async fetch(request) {
+			// pi-lens-ignore: unchecked-throwing-call -- the server builds request.url, always an absolute URL
+			const url = new URL(request.url);
+			const hasBody = request.method !== "GET" && request.method !== "HEAD";
+			const response = await fetch(
+				`http://broker${url.pathname}${url.search}`,
+				{
+					unix: broker,
+					method: request.method,
+					headers: without(request.headers, DROPPED_HEADERS),
+					body: hasBody
+						? await boundedText(request.body, 96 * 1024 * 1024)
+						: undefined,
+					signal: request.signal,
+				},
+			);
+			return new Response(response.body, {
+				status: response.status,
+				statusText: response.statusText,
+				headers: without(response.headers, DROPPED_RESPONSE_HEADERS),
+			});
+		},
+	});
+}
+
+/** The profile's MCP servers and their tools, as the host broker resolved them. */
+async function mcpServers(): Promise<McpToolsResponse["servers"]> {
+	// pi-lens-ignore: react-insecure-request -- it goes over the broker's Unix socket; "broker" names no host
+	// nosemgrep: typescript.react.security.react-insecure-request.react-insecure-request
+	const response = await fetch("http://broker/mcp-tools", {
+		unix: join(CONTAINER_RUN_DIR, BROKER_SOCKET),
+	});
+	if (!response.ok)
+		throw new Error(`the broker answered ${response.status} for mcp-tools`);
+	return ((await response.json()) as McpToolsResponse).servers;
+}
+
+/** pi-mcp-adapter registers tools only after its eager connection completes. */
+async function waitForTools(
+	session: AgentSession,
+	expected: readonly string[],
+): Promise<void> {
+	const deadline = Date.now() + MCP_CONNECT_TIMEOUT_MS;
+	while (Date.now() < deadline) {
+		const registered = new Set(session.getAllTools().map((tool) => tool.name));
+		if (expected.every((name) => registered.has(name))) return;
+		await Bun.sleep(250);
+	}
+}
+
+async function createSession(
+	servers: McpToolsResponse["servers"],
+): Promise<AgentSession> {
+	const SKILLS = content.skillsDir ? loadSkillIndex(content.skillsDir) : [];
+	const agentDir = process.env.PI_CODING_AGENT_DIR ?? "/tmp/pi-agent";
+	mkdirSync(agentDir, { recursive: true });
+	const sessionDir = join(CONTAINER_WORKSPACE, "sessions");
+	mkdirSync(sessionDir, { recursive: true });
+	const modelRuntime = await ModelRuntime.create({
+		authPath: join(agentDir, "auth.json"),
+	});
+	const resourceLoader = new DefaultResourceLoader({
+		cwd: CONTAINER_WORKSPACE,
+		agentDir,
+		noExtensions: true,
+		noSkills: true,
+		noPromptTemplates: true,
+		noThemes: true,
+		noContextFiles: true,
+		additionalExtensionPaths: [packageDir("pi-claude-bridge", import.meta.url)],
+		extensionFactories: [
+			{
+				name: "read-attachment",
+				factory: readAttachmentExtension(
+					join(CONTAINER_WORKSPACE, WORKSPACE_ATTACHMENTS),
+				),
+			},
+			{
+				name: "broker-tools",
+				factory: brokerToolsExtension(
+					join(CONTAINER_RUN_DIR, BROKER_SOCKET),
+					join(CONTAINER_WORKSPACE, WORKSPACE_ATTACHMENTS),
+					() => turnContext,
+					content.brokerTools ?? [],
+				),
+			},
+			...(content.skillsDir
+				? [
+						{
+							name: "skills",
+							factory: skillsExtension(content.skillsDir, SKILLS),
+						},
+					]
+				: []),
+			{
+				name: "speaker-memory",
+				factory: speakerMemoryExtension(() => turnContext),
+			},
+			...(content.extensions?.(() => turnContext) ?? []),
+			...(servers.length > 0
+				? [
+						{
+							name: "mcp",
+							// Through the loopback forwarder; the broker adds the credential.
+							factory: mcpAdapterExtension(
+								servers.map((server) => ({
+									name: server.name,
+									url: `http://127.0.0.1:${FORWARDER_PORT}/mcp/${server.name}`,
+								})),
+							),
+						},
+					]
+				: []),
+			// Last, so it pins the tools after every other extension's before_agent_start handler.
+			{
+				name: "active-tools",
+				factory: activeToolsExtension(() => activeTools),
+			},
+		],
+		appendSystemPrompt: [...(content.prompt ?? []), skillsPromptBlock(SKILLS)],
+	});
+	await resourceLoader.reload();
+	const { session } = await createAgentSession({
+		cwd: CONTAINER_WORKSPACE,
+		agentDir,
+		thinkingLevel: THINKING,
+		modelRuntime,
+		resourceLoader,
+		sessionManager: SessionManager.continueRecent(
+			CONTAINER_WORKSPACE,
+			sessionDir,
+		),
+		settingsManager: SettingsManager.inMemory({}),
+		noTools: "builtin",
+	});
+	const model = modelRuntime.getModel(content.model.provider, content.model.id);
+	if (!model)
+		throw new Error(
+			`model ${content.model.provider}/${content.model.id} is not available`,
+		);
+	await session.setModel(model);
+	activeTools = [...baseTools, ...servers.flatMap((server) => server.tools)];
+	await waitForTools(session, activeTools);
+	const registered = new Set(session.getAllTools().map((tool) => tool.name));
+	const claimed = SKILLS.flatMap((skill) => skill.tools);
+	const missing = [...activeTools, ...claimed].filter(
+		(name) => !registered.has(name),
+	);
+	if (missing.length > 0)
+		throw new Error(`tools are not registered: ${missing.join(", ")}`);
+	return session;
+}
+
+async function runTurn(
+	session: AgentSession,
+	turn: PartyTurnRequest,
+): Promise<PartyTurnResponse> {
+	validatePiTurn(turn);
+	if (!isPartyThinkingLevel(turn.thinking))
+		return { ok: false, error: `unknown thinking level ${turn.thinking}` };
+	const outbox = join(CONTAINER_WORKSPACE, WORKSPACE_OUTBOX, turn.turnId);
+	mkdirSync(outbox, { recursive: true });
+	turnContext.authorId = turn.author.id;
+	turnContext.authorName = turn.author.name;
+	turnContext.outbox = outbox;
+	turnContext.memory = turn.memory;
+	session.setActiveToolsByName([...activeTools]);
+	session.setThinkingLevel(turn.thinking);
+	const timer = setTimeout(() => void session.abort(), TURN_TIMEOUT_MS);
+	const toolCalls: string[] = [];
+	const unsubscribe = session.subscribe((event) => {
+		if (event.type === "tool_execution_start") toolCalls.push(event.toolName);
+	});
+	try {
+		await session.prompt(
+			`[${turn.author.name} (${turn.author.id})] ${turn.text}`,
+			turn.images.length > 0
+				? {
+						images: turn.images.map((image) => ({
+							type: "image" as const,
+							...image,
+						})),
+					}
+				: undefined,
+		);
+	} catch (error) {
+		return { ok: false, error: `prompt failed: ${String(error)}` };
+	} finally {
+		clearTimeout(timer);
+		unsubscribe();
+		log("turn finished", {
+			turnId: turn.turnId,
+			thinking: session.thinkingLevel,
+			toolCalls,
+		});
+	}
+	const last = lastAssistant(session.messages);
+	if (!last.ok) return last;
+	const text = textOf(last.message.content).trim();
+	if (!text || text.length > 100_000)
+		return { ok: false, error: "Final text bounds exceeded" };
+	const files = existsSync(outbox) ? readdirSync(outbox) : [];
+	if (
+		files.length > PI_MEDIA_LIMITS.files ||
+		files.some((name) => !safeFileName(name))
+	)
+		return { ok: false, error: "Output file bounds exceeded" };
+	if (files.length === 0) rmSync(outbox, { recursive: true, force: true });
+	let total = 0;
+	const replies = files.map((name) => {
+		const data = boundedFile(join(outbox, name), PI_MEDIA_LIMITS.fileBytes);
+		total += data.byteLength;
+		if (total > PI_MEDIA_LIMITS.totalFileBytes)
+			throw new Error("Reply byte budget exceeded");
+		return { name, data: Buffer.from(data).toString("base64") };
+	});
+	return { ok: true, text, files: replies };
+}
+
+async function main(): Promise<void> {
+	const profile = process.env.SANDBOX_PROFILE ?? "";
+	const contentModule = process.env.SANDBOX_CONTENT ?? "/app/worker/content.ts";
+	const loaded = (await import(contentModule)) as {
+		workerContent(profile: string): PiWorkerContent | Promise<PiWorkerContent>;
+	};
+	content = await loaded.workerContent(profile);
+	baseTools = [
+		"read_attachment",
+		...(content.skillsDir ? ["read_skill"] : []),
+		...(content.brokerTools ?? []).map((tool) => tool.name),
+		...(content.toolNames ?? []),
+	];
+	activeTools = baseTools;
+	mkdirSync(process.env.HOME ?? "/tmp/home", { recursive: true });
+
+	startForwarder();
+	const servers = await mcpServers();
+	const session = await createSession(servers);
+
+	const brokerSocket = join(CONTAINER_RUN_DIR, BROKER_SOCKET);
+	log("sandbox worker ready", { profile, tools: activeTools.length });
+	for (;;) {
+		try {
+			// Local Unix-socket transport; no TCP connection or DNS lookup is made.
+			// nosemgrep: typescript.react.security.react-insecure-request.react-insecure-request
+			const ready = await fetch("http://broker/worker/ready", {
+				unix: brokerSocket,
+				method: "POST",
+				signal: AbortSignal.timeout(5000),
+			});
+			await ready.body?.cancel();
+			// Local Unix-socket transport; no TCP connection or DNS lookup is made.
+			// nosemgrep: typescript.react.security.react-insecure-request.react-insecure-request
+			const next = await fetch("http://broker/worker/next", {
+				unix: brokerSocket,
+				signal: AbortSignal.timeout(55_000),
+			});
+			if (!next.ok) {
+				await next.body?.cancel();
+				await Bun.sleep(250);
+				continue;
+			}
+			const turn: unknown = JSON.parse(
+				await boundedText(next.body, 96 * 1024 * 1024),
+			);
+			validatePiTurn(turn);
+			const result = await runTurn(session, turn).catch(() => ({
+				ok: false as const,
+				error: "Worker output failed",
+			}));
+			// Local Unix-socket transport; no TCP connection or DNS lookup is made.
+			// nosemgrep: typescript.react.security.react-insecure-request.react-insecure-request
+			const sent = await fetch("http://broker/worker/result", {
+				unix: brokerSocket,
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body: JSON.stringify({ turnId: turn.turnId, result }),
+				signal: AbortSignal.timeout(60_000),
+			});
+			await sent.body?.cancel();
+		} catch {
+			await Bun.sleep(250);
+		}
+	}
+}
+
+main().catch((error: unknown) => {
+	log("sandbox worker failed", { error: String(error) });
+	process.exit(1);
+});

package/worker/pi-memory.ts

@@ -0,0 +1,21 @@
+import type { ExtensionFactory } from "@earendil-works/pi-coding-agent";
+import type { PiTurnContext } from "../src/pi-protocol.ts";
+
+/**
+ * Adds what the channel keeps about the current speaker to this run's system prompt. The
+ * prompt is rebuilt every run, so the session history never piles up stale copies.
+ */
+export function speakerMemoryExtension(
+	turn: () => PiTurnContext,
+): ExtensionFactory {
+	return (pi) => {
+		pi.on("before_agent_start", (event) => {
+			const { memory } = turn();
+			if (!memory) return;
+			const current = event.systemPromptOptions.appendSystemPrompt;
+			event.systemPromptOptions.appendSystemPrompt = current
+				? `${current}\n\n${memory}`
+				: memory;
+		});
+	};
+}

package/worker/pi-skills.ts

@@ -0,0 +1,140 @@
+import {
+	existsSync,
+	readdirSync,
+	readFileSync,
+	realpathSync,
+	statSync,
+} from "node:fs";
+import { join, resolve, sep } from "node:path";
+import type { ExtensionFactory } from "@earendil-works/pi-coding-agent";
+import { toolText } from "pi-roundtable/kit";
+import { Type } from "typebox";
+
+export interface SkillEntry {
+	name: string;
+	description: string;
+	/** Tools that run only after this skill is read in the session, from frontmatter `tools`. */
+	tools: string[];
+}
+
+const MAX_READ_CHARS = 40_000;
+
+function frontmatter(text: string): Record<string, unknown> {
+	const match = /^---\r?\n([\s\S]*?)\r?\n---/.exec(text);
+	if (!match?.[1]) return {};
+	const parsed = Bun.YAML.parse(match[1]);
+	return parsed && typeof parsed === "object"
+		? (parsed as Record<string, unknown>)
+		: {};
+}
+
+/** Each `<dir>/<skill>/SKILL.md` with a name and description; a skill without them fails startup. */
+export function loadSkillIndex(dir: string): SkillEntry[] {
+	if (!existsSync(dir)) return [];
+	return readdirSync(dir, { withFileTypes: true })
+		.filter(
+			(entry) =>
+				entry.isDirectory() && existsSync(join(dir, entry.name, "SKILL.md")),
+		)
+		.map((entry) => {
+			const meta = frontmatter(
+				readFileSync(join(dir, entry.name, "SKILL.md"), "utf8"),
+			);
+			if (
+				meta.name !== entry.name ||
+				typeof meta.description !== "string" ||
+				!meta.description
+			) {
+				throw new Error(
+					`skill ${entry.name} needs a matching name and a description`,
+				);
+			}
+			const tools = Array.isArray(meta.tools)
+				? meta.tools.filter((tool): tool is string => typeof tool === "string")
+				: [];
+			return { name: entry.name, description: meta.description, tools };
+		})
+		.sort((a, b) => a.name.localeCompare(b.name));
+}
+
+/** The skills list for the system prompt, in the shape Pi uses for its own skills. */
+export function skillsPromptBlock(skills: readonly SkillEntry[]): string {
+	if (skills.length === 0) return "";
+	const entries = skills.map(
+		(skill) =>
+			`  <skill>\n    <name>${skill.name}</name>\n    <description>${skill.description}</description>\n  </skill>`,
+	);
+	return [
+		"These skills hold this channel's own procedures, which differ from general knowledge: which tools to call, what to record, what to ask first. When a request matches a skill's description, read it with read_skill before you answer or call any other tool, even on a subject you know well, unless you already read it in this conversation; load the files it points to the same way.",
+		"<available_skills>",
+		...entries,
+		"</available_skills>",
+	].join("\n");
+}
+
+/**
+ * `read_skill` reads only files inside the skills directory. A tool a skill claims is blocked
+ * until that skill's SKILL.md is read in the session, because the model skips skills whose
+ * subject it thinks it knows, and the skill holds this channel's own procedure.
+ * The built-in read tool stays off,
+ * because it could also read the channel's memory and session files.
+ */
+export function skillsExtension(
+	dir: string,
+	skills: readonly SkillEntry[],
+): ExtensionFactory {
+	const known = new Set(skills.map((skill) => skill.name));
+	const owners = new Map(
+		skills.flatMap((skill) => skill.tools.map((tool) => [tool, skill.name])),
+	);
+	const read = new Set<string>();
+	return (pi) => {
+		pi.on("tool_call", (event) => {
+			const owner = owners.get(event.toolName);
+			return owner && !read.has(owner)
+				? {
+						block: true,
+						reason: `Read the ${owner} skill with read_skill first; it sets how ${event.toolName} is used here.`,
+					}
+				: undefined;
+		});
+
+		pi.registerTool({
+			name: "read_skill",
+			label: "Read skill",
+			description:
+				"Load a skill's instructions (SKILL.md) or a file it references, such as ref/major-symbols.md.",
+			parameters: Type.Object({
+				skill: Type.String({
+					description: "Skill name from the available skills.",
+				}),
+				path: Type.Optional(
+					Type.String({
+						description: "File inside the skill; default SKILL.md.",
+					}),
+				),
+			}),
+			execute: async (_toolCallId, params) => {
+				if (!known.has(params.skill))
+					throw new Error(`there is no skill named ${params.skill}`);
+				const base = realpathSync(dir);
+				const root = realpathSync(resolve(base, params.skill));
+				if (!root.startsWith(`${base}${sep}`))
+					throw new Error("Skill directory escapes the content tree");
+				const file = realpathSync(resolve(root, params.path ?? "SKILL.md"));
+				if (!file.startsWith(`${root}${sep}`) || !existsSync(file)) {
+					throw new Error(`${params.path} is not a file of ${params.skill}`);
+				}
+				if (statSync(file).size > 256 * 1024)
+					throw new Error("Skill file too large");
+				const text = readFileSync(file, "utf8");
+				if (file === join(root, "SKILL.md")) read.add(params.skill);
+				return toolText(
+					text.length > MAX_READ_CHARS
+						? `${text.slice(0, MAX_READ_CHARS)}\n\n[truncated at ${MAX_READ_CHARS} characters]`
+						: text,
+				);
+			},
+		});
+	};
+}