pi-roundtable-sandbox 0.7.2 → 0.7.3

package/src/pi-container-driver.ts

@@ -0,0 +1,194 @@
+import { PI_DUMMY_TOKEN, PI_RUN_DIR, PI_WORKSPACE } from "./pi-protocol.ts";
+
+export interface PiContainerSpec {
+	name: string;
+	image: string;
+	channel: string;
+	profile: string;
+	timeZone?: string;
+	labelChannel?: string;
+	labelProfile?: string;
+	/** Host directories mounted as the run directory and the workspace. */
+	runDir: string;
+	workspaceDir: string;
+	/** The host user that owns the mounted directories. */
+	uid: number;
+	gid: number;
+}
+
+export type PiContainerState = "missing" | "running" | "stopped";
+
+export interface PiContainerStatus {
+	state: PiContainerState;
+	image?: string;
+	profile?: string;
+}
+
+/** Runs one container per sandbox channel; a fake replaces it in tests. */
+export interface PiContainerDriver {
+	/** Starts the container, recreating it when it is missing, stopped, or on another image or profile. */
+	ensureRunning(spec: PiContainerSpec): Promise<void>;
+	remove(name: string): Promise<void>;
+	status(name: string): Promise<PiContainerStatus>;
+}
+
+export const PI_LABEL_CHANNEL = "roundtable.sandbox.channel";
+export const PI_LABEL_PROFILE = "roundtable.sandbox.profile";
+
+/**
+ * The Docker Engine API body for a sealed sandbox container: no network, no capabilities,
+ * a read-only root, and only the channel's two directories mounted.
+ */
+export function piContainerCreateBody(spec: PiContainerSpec): object {
+	if (
+		!/^[a-z0-9][a-z0-9_.-]{0,90}$/.test(spec.name) ||
+		!/^[a-zA-Z0-9_-]{1,100}$/.test(spec.profile) ||
+		!spec.image ||
+		/[\s]/.test(spec.image) ||
+		spec.image.startsWith("-")
+	)
+		throw new Error("Invalid container specification");
+	if (
+		!Number.isSafeInteger(spec.uid) ||
+		spec.uid <= 0 ||
+		!Number.isSafeInteger(spec.gid) ||
+		spec.gid <= 0
+	)
+		throw new Error("Worker must be non-root");
+	for (const dir of [spec.runDir, spec.workspaceDir])
+		if (!dir.startsWith("/") || dir === "/" || /[:,\r\n]/.test(dir))
+			throw new Error("Invalid mount path");
+	new Intl.DateTimeFormat("en-US", { timeZone: spec.timeZone ?? "UTC" });
+	return {
+		Image: spec.image,
+		User: `${spec.uid}:${spec.gid}`,
+		Env: [
+			`SANDBOX_PROFILE=${spec.profile}`,
+			// Claude Code tells the model today's date from local time; guests live in Taipei.
+			`TZ=${spec.timeZone ?? "UTC"}`,
+			"ANTHROPIC_BASE_URL=http://127.0.0.1:8080/anthropic",
+			// Claude Code needs a token to start; the broker replaces it on the way out.
+			`CLAUDE_CODE_OAUTH_TOKEN=${PI_DUMMY_TOKEN}`,
+			"CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1",
+			"SANDBOX_CONTENT=/app/worker/content.ts",
+			"HOME=/tmp/home",
+			"PI_CODING_AGENT_DIR=/tmp/pi-agent",
+			`CLAUDE_CONFIG_DIR=${PI_WORKSPACE}/claude`,
+		],
+		Labels: {
+			[spec.labelChannel ?? PI_LABEL_CHANNEL]: spec.channel,
+			[spec.labelProfile ?? PI_LABEL_PROFILE]: spec.profile,
+		},
+		HostConfig: {
+			NetworkMode: "none",
+			ReadonlyRootfs: true,
+			Tmpfs: { "/tmp": "rw,nosuid,nodev,size=512m,mode=1777" },
+			MemorySwap: 1536 * 1024 * 1024,
+			Ulimits: [{ Name: "nofile", Soft: 256, Hard: 256 }],
+			CapDrop: ["ALL"],
+			SecurityOpt: ["no-new-privileges"],
+			Memory: 1536 * 1024 * 1024,
+			NanoCpus: 1_000_000_000,
+			PidsLimit: 256,
+			Binds: [
+				`${spec.runDir}:${PI_RUN_DIR}:ro`,
+				`${spec.workspaceDir}:${PI_WORKSPACE}`,
+			],
+			RestartPolicy: { Name: "unless-stopped" },
+			LogConfig: {
+				Type: "local",
+				Config: { "max-size": "10m", "max-file": "2" },
+			},
+		},
+	};
+}
+
+interface InspectBody {
+	Config?: { Image?: string; Labels?: Record<string, string> };
+	State?: { Running?: boolean };
+}
+
+/** PiContainerDriver over the Docker Engine API on its unix socket. */
+export class PiDockerContainerDriver implements PiContainerDriver {
+	readonly #socket: string;
+
+	constructor(
+		socket = "/var/run/docker.sock",
+		readonly labelProfile = PI_LABEL_PROFILE,
+	) {
+		this.#socket = socket;
+	}
+
+	async ensureRunning(spec: PiContainerSpec): Promise<void> {
+		const current = await this.status(spec.name);
+		if (
+			current.state === "running" &&
+			current.image === spec.image &&
+			current.profile === spec.profile
+		) {
+			return;
+		}
+		if (current.state !== "missing") await this.remove(spec.name);
+		await this.#call(
+			"POST",
+			`/containers/create?name=${encodeURIComponent(spec.name)}`,
+			piContainerCreateBody(spec),
+		);
+		await this.#call(
+			"POST",
+			`/containers/${encodeURIComponent(spec.name)}/start`,
+		);
+	}
+
+	async remove(name: string): Promise<void> {
+		await this.#call(
+			"DELETE",
+			`/containers/${encodeURIComponent(name)}?force=true`,
+			undefined,
+			[404],
+		);
+	}
+
+	async status(name: string): Promise<PiContainerStatus> {
+		const response = await this.#call(
+			"GET",
+			`/containers/${encodeURIComponent(name)}/json`,
+			undefined,
+			[404],
+		);
+		if (response.status === 404) return { state: "missing" };
+		const body = (await response.json()) as InspectBody;
+		return {
+			state: body.State?.Running ? "running" : "stopped",
+			...(body.Config?.Image ? { image: body.Config.Image } : {}),
+			...(body.Config?.Labels?.[this.labelProfile]
+				? { profile: body.Config.Labels[this.labelProfile] }
+				: {}),
+		};
+	}
+
+	async #call(
+		method: string,
+		path: string,
+		body?: object,
+		allowed: readonly number[] = [],
+	): Promise<Response> {
+		const response = await fetch(`http://docker${path}`, {
+			unix: this.#socket,
+			signal: AbortSignal.timeout(15_000),
+			method,
+			...(body
+				? {
+						headers: { "content-type": "application/json" },
+						body: JSON.stringify(body),
+					}
+				: {}),
+		});
+		if (!response.ok && !allowed.includes(response.status)) {
+			throw new Error(
+				`docker ${method} ${path} failed with ${response.status}: ${(await response.text()).slice(0, 300)}`,
+			);
+		}
+		return response;
+	}
+}

package/src/pi-model-input.ts

@@ -0,0 +1,219 @@
+import { localSchema } from "./model-input.ts";
+import { type PiThinkingLevel, validateImages } from "./pi-protocol.ts";
+import { isRecord, validCallId } from "./protocol.ts";
+
+function validFunctionName(value: unknown): value is string {
+	return typeof value === "string" && /^[a-zA-Z0-9_-]{1,128}$/.test(value);
+}
+
+function cache(value: Record<string, unknown>): Record<string, unknown> {
+	return isRecord(value.cache_control) &&
+		value.cache_control.type === "ephemeral"
+		? {
+				cache_control: {
+					type: "ephemeral",
+					...(value.cache_control.ttl === "1h" ? { ttl: "1h" } : {}),
+				},
+			}
+		: {};
+}
+function blocks(raw: unknown, nested = false): unknown[] | string {
+	if (typeof raw === "string") return raw;
+	if (!Array.isArray(raw) || raw.length > 256)
+		throw new Error("Invalid content");
+	return raw.map((value: unknown) => {
+		if (!isRecord(value)) throw new Error("Invalid block");
+		switch (value.type) {
+			case "text":
+				if (typeof value.text !== "string") break;
+				return { type: "text", text: value.text, ...cache(value) };
+			case "image": {
+				const source = value.source;
+				if (!isRecord(source) || source.type !== "base64") break;
+				validateImages([{ data: source.data, mimeType: source.media_type }]);
+				return {
+					type: "image",
+					source: {
+						type: "base64",
+						data: source.data,
+						media_type: source.media_type,
+					},
+					...cache(value),
+				};
+			}
+			case "tool_use":
+				if (
+					nested ||
+					!validCallId(value.id) ||
+					!validFunctionName(value.name) ||
+					!isRecord(value.input)
+				)
+					break;
+				return {
+					type: "tool_use",
+					id: value.id,
+					name: value.name,
+					input: value.input,
+					...cache(value),
+				};
+			case "tool_result":
+				if (nested || !validCallId(value.tool_use_id)) break;
+				return {
+					type: "tool_result",
+					tool_use_id: value.tool_use_id,
+					content: blocks(value.content, true),
+					...(value.is_error === true ? { is_error: true } : {}),
+					...cache(value),
+				};
+			case "thinking":
+				if (
+					nested ||
+					typeof value.thinking !== "string" ||
+					typeof value.signature !== "string"
+				)
+					break;
+				return {
+					type: "thinking",
+					thinking: value.thinking,
+					signature: value.signature,
+				};
+			case "redacted_thinking":
+				if (nested || typeof value.data !== "string") break;
+				return { type: "redacted_thinking", data: value.data };
+		}
+		throw new Error("Native tools or remote media refused");
+	});
+}
+const EFFORTS = ["low", "medium", "high", "xhigh", "max"] as const;
+/** Highest effort and extended-thinking budget the host-judged level allows. */
+const CEILINGS: Record<PiThinkingLevel, { effort: number; budget: number }> = {
+	low: { effort: 0, budget: 2048 },
+	medium: { effort: 1, budget: 8192 },
+	high: { effort: 2, budget: 16384 },
+	xhigh: { effort: 4, budget: 32768 },
+};
+
+/** Reconstruct ordinary Anthropic text/base64-image/custom-tool traffic; never forward opaque guest objects. */
+export function piModelInput(
+	input: Record<string, unknown>,
+	model: string,
+	countTokens: boolean,
+	maxOutputTokens = 128_000,
+	/** The host-judged level for the admitted turn; the guest can only go lower. */
+	thinking: PiThinkingLevel = "low",
+): Record<string, unknown> {
+	if (!Array.isArray(input.messages) || input.messages.length > 2000)
+		throw new Error("Invalid messages");
+	const body: Record<string, unknown> = {
+		model,
+		messages: input.messages.map((message: unknown) => {
+			if (
+				!isRecord(message) ||
+				!["user", "assistant"].includes(String(message.role))
+			)
+				throw new Error("Invalid role");
+			return { role: message.role, content: blocks(message.content) };
+		}),
+	};
+	if (input.system !== undefined) body.system = blocks(input.system, true);
+	if (input.tools !== undefined) {
+		if (!Array.isArray(input.tools) || input.tools.length > 128)
+			throw new Error("Invalid tools");
+		body.tools = input.tools.map((tool: unknown) => {
+			if (
+				!isRecord(tool) ||
+				(tool.type !== undefined && tool.type !== "custom") ||
+				!validFunctionName(tool.name) ||
+				!isRecord(tool.input_schema) ||
+				!localSchema(tool.input_schema) ||
+				(tool.description !== undefined && typeof tool.description !== "string")
+			)
+				throw new Error("Remote schema or native tool refused");
+			return {
+				name: tool.name,
+				input_schema: tool.input_schema,
+				...(tool.description ? { description: tool.description } : {}),
+				...cache(tool),
+			};
+		});
+	}
+	if (input.tool_choice !== undefined) {
+		const choice = input.tool_choice;
+		if (
+			!isRecord(choice) ||
+			!["auto", "any", "tool", "none"].includes(String(choice.type)) ||
+			(choice.type === "tool" && !validFunctionName(choice.name))
+		)
+			throw new Error("Invalid tool choice");
+		body.tool_choice = {
+			type: choice.type,
+			...(choice.type === "tool" ? { name: choice.name } : {}),
+			...(choice.disable_parallel_tool_use === true
+				? { disable_parallel_tool_use: true }
+				: {}),
+		};
+	}
+	const ceiling = CEILINGS[thinking];
+	if (isRecord(input.thinking)) {
+		if (
+			input.thinking.type === "adaptive" ||
+			input.thinking.type === "disabled"
+		)
+			body.thinking = { type: input.thinking.type };
+		else if (
+			input.thinking.type === "enabled" &&
+			Number.isSafeInteger(input.thinking.budget_tokens) &&
+			Number(input.thinking.budget_tokens) >= 1024
+		)
+			body.thinking = {
+				type: "enabled",
+				budget_tokens: Math.min(
+					Number(input.thinking.budget_tokens),
+					ceiling.budget,
+					maxOutputTokens - 1,
+				),
+			};
+		else throw new Error("Invalid thinking");
+	}
+	const asked = isRecord(input.output_config)
+		? EFFORTS.indexOf(input.output_config.effort as (typeof EFFORTS)[number])
+		: -1;
+	// Adaptive thinking without an explicit effort runs at the model's default, so the host caps it too.
+	const effort =
+		asked >= 0
+			? Math.min(asked, ceiling.effort)
+			: isRecord(body.thinking) &&
+					body.thinking.type === "adaptive" &&
+					ceiling.effort < 2
+				? ceiling.effort
+				: -1;
+	if (effort >= 0) body.output_config = { effort: EFFORTS[effort] };
+	if (!countTokens) {
+		const budget =
+			isRecord(body.thinking) && typeof body.thinking.budget_tokens === "number"
+				? body.thinking.budget_tokens
+				: 0;
+		body.max_tokens = Math.max(
+			budget + 1,
+			Math.min(
+				Number.isSafeInteger(input.max_tokens) && Number(input.max_tokens) > 0
+					? Number(input.max_tokens)
+					: 16384,
+				maxOutputTokens,
+			),
+		);
+		body.stream = input.stream === true;
+		for (const key of ["temperature", "top_p", "top_k"])
+			if (typeof input[key] === "number" && Number.isFinite(input[key]))
+				body[key] = input[key];
+		if (
+			Array.isArray(input.stop_sequences) &&
+			input.stop_sequences.length <= 16 &&
+			input.stop_sequences.every(
+				(s) => typeof s === "string" && s.length <= 1000,
+			)
+		)
+			body.stop_sequences = input.stop_sequences;
+	}
+	return body;
+}

package/src/pi-protocol.ts

@@ -0,0 +1,141 @@
+import { isRecord } from "./protocol.ts";
+
+export const PI_RUN_DIR = "/run/sandbox";
+export const PI_WORKSPACE = "/workspace";
+export const PI_BROKER_SOCKET = "broker.sock";
+export const PI_ATTACHMENTS = "attachments";
+export const PI_OUTBOX = "outbox";
+export const PI_FORWARDER_PORT = 8080;
+export const PI_DUMMY_TOKEN = "sandbox-dummy-token";
+export const PI_MEDIA_LIMITS = {
+	images: 8,
+	imageBytes: 20 * 1024 * 1024,
+	totalImageBytes: 64 * 1024 * 1024,
+	files: 10,
+	fileBytes: 10 * 1024 * 1024,
+	totalFileBytes: 50 * 1024 * 1024,
+} as const;
+export const PI_THINKING_LEVELS = ["low", "medium", "high", "xhigh"] as const;
+export type PiThinkingLevel = (typeof PI_THINKING_LEVELS)[number];
+export interface PiImage {
+	data: string;
+	mimeType: string;
+}
+export interface PiTurnRequest {
+	turnId: string;
+	author: { id: string; name: string };
+	text: string;
+	memory: string;
+	images: PiImage[];
+	thinking: PiThinkingLevel;
+}
+export interface PiReplyFile {
+	name: string;
+	data: string;
+}
+export type PiTurnResponse =
+	| { ok: true; text: string; files: PiReplyFile[] }
+	| { ok: false; error: string };
+export function validateReplyFiles(
+	files: unknown,
+): asserts files is PiReplyFile[] {
+	if (!Array.isArray(files) || files.length > PI_MEDIA_LIMITS.files)
+		throw new Error("Too many reply files");
+	let total = 0;
+	for (const file of files) {
+		if (
+			!isRecord(file) ||
+			typeof file.name !== "string" ||
+			!safeFileName(file.name) ||
+			typeof file.data !== "string" ||
+			file.data.length === 0 ||
+			file.data.length > Math.ceil(PI_MEDIA_LIMITS.fileBytes / 3) * 4 ||
+			file.data.length % 4 !== 0 ||
+			!/^[A-Za-z0-9+/]*={0,2}$/.test(file.data)
+		)
+			throw new Error("Invalid reply file");
+		const size = Buffer.byteLength(file.data, "base64");
+		total += size;
+		if (
+			size > PI_MEDIA_LIMITS.fileBytes ||
+			total > PI_MEDIA_LIMITS.totalFileBytes
+		)
+			throw new Error("Reply file budget exceeded");
+	}
+}
+export interface PiToolResponse {
+	ok: boolean;
+	text?: string;
+	error?: string;
+	image?: PiImage;
+}
+export interface PiTurnContext {
+	authorId: string;
+	authorName: string;
+	outbox: string;
+	memory: string;
+}
+export interface PiMcpDiscovery {
+	servers: { name: string; tools: string[] }[];
+}
+export function isPiThinkingLevel(value: unknown): value is PiThinkingLevel {
+	return (
+		typeof value === "string" &&
+		(PI_THINKING_LEVELS as readonly string[]).includes(value)
+	);
+}
+export function safeFileName(name: string): boolean {
+	return (
+		name.length > 0 &&
+		name.length <= 255 &&
+		!/[\\/\\\\\p{Cc}]/u.test(name) &&
+		name !== "." &&
+		name !== ".."
+	);
+}
+export function validateImages(images: unknown): asserts images is PiImage[] {
+	if (!Array.isArray(images) || images.length > PI_MEDIA_LIMITS.images)
+		throw new Error("Too many images");
+	let total = 0;
+	for (const image of images) {
+		if (
+			!isRecord(image) ||
+			typeof image.data !== "string" ||
+			typeof image.mimeType !== "string" ||
+			!["image/png", "image/jpeg", "image/webp", "image/gif"].includes(
+				image.mimeType,
+			) ||
+			image.data.length > Math.ceil(PI_MEDIA_LIMITS.imageBytes / 3) * 4 ||
+			image.data.length % 4 !== 0 ||
+			!/^[A-Za-z0-9+/]*={0,2}$/.test(image.data)
+		)
+			throw new Error("Invalid or oversized image");
+		const size = Buffer.byteLength(image.data, "base64");
+		total += size;
+		if (
+			size === 0 ||
+			size > PI_MEDIA_LIMITS.imageBytes ||
+			total > PI_MEDIA_LIMITS.totalImageBytes
+		)
+			throw new Error("Image budget exceeded");
+	}
+}
+export function validatePiTurn(value: unknown): asserts value is PiTurnRequest {
+	if (
+		!isRecord(value) ||
+		typeof value.turnId !== "string" ||
+		!safeFileName(value.turnId) ||
+		!isRecord(value.author) ||
+		typeof value.author.id !== "string" ||
+		typeof value.author.name !== "string" ||
+		value.author.id.length > 256 ||
+		value.author.name.length > 256 ||
+		typeof value.text !== "string" ||
+		value.text.length > 100_000 ||
+		typeof value.memory !== "string" ||
+		value.memory.length > 100_000 ||
+		!isPiThinkingLevel(value.thinking)
+	)
+		throw new Error("Invalid turn");
+	validateImages(value.images);
+}