rea-agents 3.2.1 → 4.0.0

package/dist/replay/LinuxJavaScriptReplaySandbox.js

@@ -1,121 +0,0 @@
-import { dirname } from "node:path";
-import { digestJson, } from "../application/JavaScriptReplayPlanning.js";
-import { resolveLinuxRuntimeClosure } from "./LinuxRuntimeClosure.js";
-export const assertRuntimeCommitment = (prepared, closure) => {
-    const observed = closure.map((item) => ({
-        source_path: item.sourcePath,
-        destination_path: item.destinationPath,
-        sha256: item.sha256,
-    }));
-    if (digestJson(observed) !==
-        digestJson(prepared.publicPlan.runtime.read_only_files))
-        throw new TypeError("Replay runtime closure changed after approval");
-};
-export const systemdArguments = (options) => {
-    const { unit, policy, prepared, workerPath, closure, filterPath } = options;
-    const limits = prepared.publicPlan.limits;
-    const descriptorPaths = [
-        filterPath,
-        ...closure.map(({ sourcePath }) => sourcePath),
-        workerPath,
-    ];
-    const workerFd = descriptorPaths.length + 2;
-    const wrapper = descriptorPaths
-        .map((_, index) => `exec ${String(index + 3)}<"$1"; shift`)
-        .concat('exec "$@"')
-        .join("\n");
-    return [
-        "--user",
-        "--pipe",
-        "--wait",
-        "--service-type=exec",
-        "--quiet",
-        `--unit=${unit}`,
-        `--property=MemoryMax=${String(limits.memory_bytes)}`,
-        "--property=MemorySwapMax=0",
-        `--property=TasksMax=${String(limits.tasks)}`,
-        `--property=CPUQuota=${String(limits.cpu_quota_percent)}%`,
-        "--property=KillMode=control-group",
-        "--property=SendSIGKILL=yes",
-        "--",
-        policy.shellPath,
-        "-c",
-        wrapper,
-        "rea-replay-wrapper",
-        ...descriptorPaths,
-        policy.bubblewrapPath,
-        "--unshare-all",
-        "--unshare-user",
-        "--disable-userns",
-        "--new-session",
-        "--die-with-parent",
-        "--cap-drop",
-        "ALL",
-        "--clearenv",
-        "--setenv",
-        "HOME",
-        "/work",
-        "--setenv",
-        "TMPDIR",
-        "/tmp",
-        "--setenv",
-        "TZ",
-        "UTC",
-        "--setenv",
-        "LANG",
-        "C",
-        "--setenv",
-        "LC_ALL",
-        "C",
-        "--tmpfs",
-        "/",
-        "--dir",
-        "/runtime",
-        "--dir",
-        "/work",
-        "--size",
-        String(limits.tmpfs_bytes),
-        "--tmpfs",
-        "/tmp",
-        ...bindArguments(closure),
-        "--ro-bind-fd",
-        String(workerFd),
-        "/runtime/worker.js",
-        "--proc",
-        "/proc",
-        "--dev",
-        "/dev",
-        "--remount-ro",
-        "/",
-        "--chdir",
-        "/work",
-        "--seccomp",
-        "3",
-        "--",
-        "/runtime/node",
-        `--max-old-space-size=${String(Math.max(8, Math.floor(limits.memory_bytes / 1024 / 1024 / 2)))}`,
-        "--experimental-vm-modules",
-        "--permission",
-        "--allow-fs-read=/runtime/worker.js",
-        "/runtime/worker.js",
-    ];
-};
-const bindArguments = (closure) => {
-    const arguments_ = [];
-    const directories = new Set();
-    for (const [index, item] of closure.entries()) {
-        const destination = item.destinationPath;
-        let parent = dirname(destination);
-        const chain = [];
-        while (parent !== "/" && !directories.has(parent)) {
-            chain.push(parent);
-            parent = dirname(parent);
-        }
-        for (const directory of chain.reverse()) {
-            directories.add(directory);
-            arguments_.push("--dir", directory);
-        }
-        arguments_.push("--ro-bind-fd", String(index + 4), destination);
-    }
-    return arguments_;
-};

package/dist/replay/LinuxRuntimeClosure.js

@@ -1,44 +0,0 @@
-import { spawn } from "node:child_process";
-import { createHash } from "node:crypto";
-import { readFile, realpath } from "node:fs/promises";
-/** Resolve and content-address the exact ELF closure mounted into a replay. */
-export const resolveLinuxRuntimeClosure = async (nodePath) => {
-    const canonicalNode = await realpath(nodePath);
-    const collected = await collectLdd(canonicalNode);
-    if (collected.code !== 0)
-        throw new TypeError("Node runtime dependency closure could not be resolved");
-    const paths = [...collected.stdout.matchAll(/(?:=>\s+)?(\/[^\s()]+)/gu)]
-        .map((match) => match[1])
-        .filter((value) => value !== undefined);
-    const libraries = await Promise.all([...new Set(paths)].map(async (path) => {
-        const sourcePath = await realpath(path);
-        return identity(sourcePath, path);
-    }));
-    return [await identity(canonicalNode, "/runtime/node"), ...libraries];
-};
-const identity = async (sourcePath, destinationPath) => ({
-    sourcePath,
-    destinationPath,
-    sha256: createHash("sha256")
-        .update(await readFile(sourcePath))
-        .digest("hex"),
-});
-const collectLdd = async (path) => new Promise((resolve, reject) => {
-    const child = spawn("/usr/bin/ldd", [path], {
-        stdio: ["ignore", "pipe", "ignore"],
-    });
-    const timeout = setTimeout(() => child.kill("SIGKILL"), 5_000);
-    timeout.unref();
-    let stdout = "";
-    child.stdout.on("data", (chunk) => {
-        stdout += chunk.toString("utf8");
-    });
-    child.once("error", (error) => {
-        clearTimeout(timeout);
-        reject(error);
-    });
-    child.once("close", (code) => {
-        clearTimeout(timeout);
-        resolve({ code, stdout });
-    });
-});

package/dist/replay/LinuxSeccompPolicy.js

@@ -1,40 +0,0 @@
-import { createHash } from "node:crypto";
-const BPF_LD_W_ABS = 0x20;
-const BPF_JMP_JEQ_K = 0x15;
-const BPF_RET_K = 0x06;
-const SECCOMP_RET_KILL_PROCESS = 0x8000_0000;
-const SECCOMP_RET_ERRNO = 0x0005_0000 | 1;
-const SECCOMP_RET_ALLOW = 0x7fff_0000;
-const AUDIT_ARCH_X86_64 = 0xc000_003e;
-const IOCTL = 16;
-const TIOCSTI = 0x5412;
-const DENIED_X86_64_SYSCALLS = [
-    101, 103, 155, 161, 163, 165, 166, 167, 168, 169, 172, 173, 175, 176, 179,
-    212, 246, 248, 249, 250, 272, 298, 303, 304, 308, 310, 311, 312, 313, 320,
-    321, 323, 425, 426, 427, 428, 429, 430, 431, 432, 433, 442,
-];
-/** Build the architecture-checked deny filter committed by ADR-0002. */
-export const buildLinuxX64ReplaySeccomp = () => {
-    const instructions = [
-        { code: BPF_LD_W_ABS, jt: 0, jf: 0, k: 4 },
-        { code: BPF_JMP_JEQ_K, jt: 1, jf: 0, k: AUDIT_ARCH_X86_64 },
-        { code: BPF_RET_K, jt: 0, jf: 0, k: SECCOMP_RET_KILL_PROCESS },
-        { code: BPF_LD_W_ABS, jt: 0, jf: 0, k: 0 },
-    ];
-    for (const syscall of DENIED_X86_64_SYSCALLS) {
-        instructions.push({ code: BPF_JMP_JEQ_K, jt: 0, jf: 1, k: syscall });
-        instructions.push({ code: BPF_RET_K, jt: 0, jf: 0, k: SECCOMP_RET_ERRNO });
-    }
-    instructions.push({ code: BPF_JMP_JEQ_K, jt: 0, jf: 3, k: IOCTL }, { code: BPF_LD_W_ABS, jt: 0, jf: 0, k: 24 }, { code: BPF_JMP_JEQ_K, jt: 0, jf: 1, k: TIOCSTI }, { code: BPF_RET_K, jt: 0, jf: 0, k: SECCOMP_RET_ERRNO }, { code: BPF_RET_K, jt: 0, jf: 0, k: SECCOMP_RET_ALLOW });
-    const encoded = new Uint8Array(instructions.length * 8);
-    const view = new DataView(encoded.buffer);
-    instructions.forEach((instruction, index) => {
-        const offset = index * 8;
-        view.setUint16(offset, instruction.code, true);
-        view.setUint8(offset + 2, instruction.jt);
-        view.setUint8(offset + 3, instruction.jf);
-        view.setUint32(offset + 4, instruction.k, true);
-    });
-    return encoded;
-};
-export const linuxX64ReplaySeccompDigest = () => createHash("sha256").update(buildLinuxX64ReplaySeccomp()).digest("hex");

package/dist/replay/ReplayOutcome.js

@@ -1,104 +0,0 @@
-import { digestJson, } from "../application/JavaScriptReplayPlanning.js";
-import { jsonValueSchema } from "../domain/jsonValue.js";
-export const workerRequest = (prepared) => ({
-    left: workerSide(prepared.publicPlan.left, prepared.leftSources),
-    ...(prepared.publicPlan.right === undefined ||
-        prepared.rightSources === undefined
-        ? {}
-        : { right: workerSide(prepared.publicPlan.right, prepared.rightSources) }),
-    cases: prepared.publicPlan.cases.map((item) => ({
-        caseId: item.case_id,
-        arguments: item.arguments,
-        inputSha256: item.sha256,
-    })),
-    determinism: {
-        clockIso: prepared.publicPlan.determinism.clock_iso,
-        randomSeed: prepared.publicPlan.determinism.random_seed,
-    },
-    limits: {
-        resultDepth: prepared.publicPlan.limits.result_depth,
-        resultNodes: prepared.publicPlan.limits.result_nodes,
-        exceptionBytes: prepared.publicPlan.limits.output_bytes,
-    },
-});
-const workerSide = (side, sources) => ({
-    modules: side.modules.map((module) => ({
-        alias: module.alias,
-        format: module.format,
-        dependencies: module.dependencies,
-        source: sources[module.alias] ?? "",
-    })),
-    entryAlias: side.entry_alias,
-    entryExport: side.entry_export,
-});
-export const commitOutcomes = (outcomes) => outcomes.map((outcome) => {
-    if (outcome.outcome === "return")
-        return {
-            case_id: outcome.case_id,
-            outcome: outcome.outcome,
-            value: jsonValueSchema.parse(outcome.value),
-            input_sha256: outcome.input_sha256,
-            output_sha256: digestJson(outcome.value),
-            truncated: false,
-        };
-    return {
-        case_id: outcome.case_id,
-        outcome: outcome.outcome,
-        exception: outcome.exception,
-        input_sha256: outcome.input_sha256,
-        output_sha256: digestJson(outcome.exception),
-        truncated: false,
-    };
-});
-export const compareOutcomes = (left, right) => left.map((item, index) => ({
-    case_id: item.case_id,
-    status: right[index] === undefined
-        ? "unknown"
-        : item.outcome === right[index].outcome &&
-            item.output_sha256 === right[index].output_sha256
-            ? "equal"
-            : "changed",
-    left_index: index,
-    right_index: index,
-}));
-export const terminationResult = (options) => {
-    const { prepared, stderr, termination, cleanup, limitation } = options;
-    const outcomes = termination === "protocol_error"
-        ? prepared.publicPlan.cases.map((item) => ({
-            case_id: item.case_id,
-            outcome: termination,
-            input_sha256: item.sha256,
-            output_sha256: null,
-            truncated: true,
-        }))
-        : prepared.publicPlan.cases.map((item) => ({
-            case_id: item.case_id,
-            outcome: termination,
-            input_sha256: item.sha256,
-            output_sha256: null,
-            truncated: false,
-        }));
-    const differential = prepared.publicPlan.right !== undefined;
-    return {
-        plan_digest: prepared.publicPlan.plan_digest,
-        outcomes: [...outcomes, ...(differential ? outcomes : [])],
-        ...(differential
-            ? {
-                comparison: outcomes.map((item, index) => ({
-                    case_id: item.case_id,
-                    status: "unknown",
-                    left_index: index,
-                    right_index: index,
-                })),
-            }
-            : {}),
-        stderr,
-        termination,
-        cleanup,
-        limitations: [
-            limitation ??
-                `Replay terminated with ${termination}; the requested functional result remains unknown.`,
-        ],
-        reproducer: null,
-    };
-};

package/dist/replay/ReplayProcessLifecycle.js

@@ -1,96 +0,0 @@
-import { spawn } from "node:child_process";
-export const boundedCollector = (maximum) => {
-    const chunks = [];
-    let bytes = 0;
-    let overflow = false;
-    return {
-        append: (chunk) => {
-            const retained = chunk.subarray(0, Math.max(0, maximum - bytes));
-            if (retained.byteLength > 0)
-                chunks.push(retained);
-            bytes += retained.byteLength;
-            if (retained.byteLength < chunk.byteLength)
-                overflow = true;
-        },
-        value: () => Buffer.concat(chunks).toString("utf8"),
-        exceeded: () => overflow,
-    };
-};
-const collect = async (executable, arguments_) => new Promise((resolve, reject) => {
-    const child = spawn(executable, [...arguments_], {
-        stdio: ["ignore", "pipe", "pipe"],
-    });
-    const stdout = unboundedCollector();
-    const stderr = unboundedCollector();
-    const timeout = setTimeout(() => child.kill("SIGKILL"), 5_000);
-    timeout.unref();
-    child.stdout?.on("data", stdout.append);
-    child.stderr?.on("data", stderr.append);
-    child.once("error", (error) => {
-        clearTimeout(timeout);
-        reject(error);
-    });
-    child.once("close", (code) => {
-        clearTimeout(timeout);
-        resolve({ code, stdout: stdout.value(), stderr: stderr.value() });
-    });
-});
-export const killUnit = async (systemctl, unit) => {
-    try {
-        await collect(systemctl, [
-            "--user",
-            "kill",
-            "--kill-whom=all",
-            "--signal=SIGKILL",
-            unit,
-        ]);
-    }
-    catch {
-        /* cleanup continues */
-    }
-};
-export const observeCleanup = async (systemctl, unit) => {
-    try {
-        const state = await collect(systemctl, [
-            "--user",
-            "show",
-            "--property=ActiveState",
-            "--value",
-            unit,
-        ]);
-        const activeState = state.stdout.trim();
-        if (state.code !== 0 ||
-            activeState === "inactive" ||
-            activeState === "failed" ||
-            activeState.length === 0) {
-            await collect(systemctl, ["--user", "reset-failed", unit]);
-            return { state: "complete", residual_resources: [] };
-        }
-        return { state: "incomplete", residual_resources: [unit] };
-    }
-    catch {
-        return { state: "incomplete", residual_resources: [unit] };
-    }
-};
-export const observeUnitResult = async (systemctl, unit) => {
-    try {
-        const result = await collect(systemctl, [
-            "--user",
-            "show",
-            "--property=Result",
-            "--value",
-            unit,
-        ]);
-        return result.stdout.trim();
-    }
-    catch {
-        return "unknown";
-    }
-};
-const unboundedCollector = () => {
-    const chunks = [];
-    return {
-        append: (chunk) => chunks.push(chunk),
-        value: () => Buffer.concat(chunks).toString("utf8"),
-    };
-};

package/dist/replay/ReplaySeccompFile.js

@@ -1,29 +0,0 @@
-import { mkdtemp, open, rm, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { buildLinuxX64ReplaySeccomp } from "./LinuxSeccompPolicy.js";
-/** Own a private seccomp file and descriptor until probe or execution cleanup. */
-export const temporaryFilterHandle = async () => {
-    const directory = await mkdtemp(join(tmpdir(), "rea-replay-filter-"));
-    const path = join(directory, "seccomp.bpf");
-    try {
-        await writeFile(path, buildLinuxX64ReplaySeccomp(), { mode: 0o600 });
-        const handle = await open(path, "r");
-        return {
-            path,
-            handle,
-            close: async () => {
-                try {
-                    await handle.close();
-                }
-                finally {
-                    await rm(directory, { recursive: true, force: true });
-                }
-            },
-        };
-    }
-    catch (cause) {
-        await rm(directory, { recursive: true, force: true });
-        throw cause;
-    }
-};

package/dist/replay/ReplayWorkerProtocol.js

@@ -1,58 +0,0 @@
-import { z } from "zod";
-const workerOutcomeFacts = {
-    case_id: z.string(),
-    input_sha256: z.string().regex(/^[a-f0-9]{64}$/u),
-    output_sha256: z.null(),
-    truncated: z.literal(false),
-};
-const exceptionSchema = z
-    .object({
-    name: z.string(),
-    message: z.string(),
-    stack: z.string().nullable(),
-})
-    .strict();
-const workerOutcomeSchema = z.discriminatedUnion("outcome", [
-    z.strictObject({
-        ...workerOutcomeFacts,
-        outcome: z.literal("return"),
-        value: z.json(),
-    }),
-    z.strictObject({
-        ...workerOutcomeFacts,
-        outcome: z.enum(["exception", "serialization_error", "denied"]),
-        exception: z.object(exceptionSchema.shape).strict(),
-    }),
-]);
-const singleWorkerResponseSchema = z
-    .object({
-    left: z.array(workerOutcomeSchema),
-})
-    .strict();
-const differentialWorkerResponseSchema = z
-    .object({
-    left: z.array(workerOutcomeSchema),
-    right: z.array(workerOutcomeSchema),
-})
-    .strict();
-/** Strictly authenticate case ordering and commitments in worker output. */
-export const parseReplayWorkerResponse = (rawResponse, cases, mode) => {
-    const response = mode === "single"
-        ? singleWorkerResponseSchema.parse(rawResponse)
-        : differentialWorkerResponseSchema.parse(rawResponse);
-    validateOutcomeSequence(response.left, cases);
-    if (mode === "differential")
-        validateOutcomeSequence(differentialWorkerResponseSchema.parse(response).right, cases);
-    return response;
-};
-const validateOutcomeSequence = (outcomes, cases) => {
-    if (outcomes.length !== cases.length)
-        throw new TypeError("Replay worker response case count changed");
-    outcomes.forEach((outcome, index) => {
-        const expected = cases[index];
-        if (expected === undefined ||
-            outcome.case_id !== expected.case_id ||
-            outcome.input_sha256 !== expected.sha256)
-            throw new TypeError("Replay worker response case identity changed");
-    });
-};

package/dist/replay/SystemJavaScriptReplayHost.js

@@ -1,153 +0,0 @@
-import { temporaryFilterHandle } from "./ReplaySeccompFile.js";
-import { constants } from "node:fs";
-import { open, readFile, realpath, stat } from "node:fs/promises";
-import { fileURLToPath } from "node:url";
-import { spawn } from "node:child_process";
-import { digestBytes } from "../application/JavaScriptReplayPlanning.js";
-import { linuxX64ReplaySeccompDigest } from "./LinuxSeccompPolicy.js";
-import { resolveLinuxRuntimeClosure } from "./LinuxRuntimeClosure.js";
-import { readBoundedFileBytes } from "../process/BoundedFileBytes.js";
-const bubblewrapProbeArguments = (command) => [
-    "--unshare-all",
-    "--unshare-user",
-    "--disable-userns",
-    "--new-session",
-    "--die-with-parent",
-    "--cap-drop",
-    "ALL",
-    "--ro-bind",
-    "/usr",
-    "/usr",
-    "--ro-bind",
-    "/lib",
-    "/lib",
-    "--ro-bind-try",
-    "/lib64",
-    "/lib64",
-    "--proc",
-    "/proc",
-    "--dev",
-    "/dev",
-    "--seccomp",
-    "3",
-    "--",
-    ...command,
-];
-/** Production planning host for descriptor-backed reads and fail-closed probes. */
-export class SystemJavaScriptReplayHost {
-    async readSource(path, maximumBytes) {
-        const canonicalPath = await realpath(path);
-        const handle = await open(canonicalPath, constants.O_RDONLY | constants.O_NOFOLLOW);
-        try {
-            const metadata = await handle.stat();
-            if (!metadata.isFile() || metadata.size > maximumBytes)
-                throw new RangeError(`Replay source exceeds its declared limit: ${canonicalPath}`);
-            const bytes = await readBoundedFileBytes(handle, maximumBytes);
-            if (bytes === undefined)
-                throw new RangeError(`Replay source exceeds its declared limit: ${canonicalPath}`);
-            return { canonicalPath, bytes };
-        }
-        finally {
-            await handle.close();
-        }
-    }
-    async identifyExecutable(path, versionArguments) {
-        const canonicalPath = await realpath(path);
-        const metadata = await stat(canonicalPath);
-        if (!metadata.isFile())
-            throw new TypeError(`Replay executable is not a file: ${canonicalPath}`);
-        const [bytes, version] = await Promise.all([
-            readFile(canonicalPath),
-            capture(canonicalPath, versionArguments),
-        ]);
-        return {
-            path: canonicalPath,
-            version: version.trim(),
-            sha256: digestBytes(bytes),
-        };
-    }
-    identifyWorker() {
-        return this.identifyExecutable(fileURLToPath(new URL("./JavaScriptReplayWorker.js", import.meta.url)), []);
-    }
-    identifyRuntimeClosure(nodePath) {
-        return resolveLinuxRuntimeClosure(nodePath);
-    }
-    seccompDigest() {
-        return linuxX64ReplaySeccompDigest();
-    }
-    async probe(policy) {
-        if (process.platform !== "linux" || process.arch !== "x64")
-            throw new TypeError("Controlled replay requires Linux x86_64 in v1");
-        const bwrapMetadata = await stat(policy.bubblewrapPath);
-        if ((bwrapMetadata.mode & 0o4000) !== 0)
-            throw new TypeError("Setuid Bubblewrap is not admitted by replay policy");
-        if ((await readFile("/sys/fs/cgroup/cgroup.controllers", "utf8")).trim()
-            .length === 0)
-            throw new TypeError("Controlled replay requires delegated cgroup v2");
-        const filter = await temporaryFilterHandle();
-        try {
-            await run(policy.bubblewrapPath, bubblewrapProbeArguments(["/usr/bin/true"]), ["ignore", "pipe", "pipe", filter.handle.fd]);
-            await runExpectFailure(policy.bubblewrapPath, bubblewrapProbeArguments([
-                "/usr/bin/unshare",
-                "--mount",
-                "/usr/bin/true",
-            ]), ["ignore", "pipe", "pipe", filter.handle.fd]);
-            await run(policy.systemdRunPath, [
-                "--user",
-                "--pipe",
-                "--wait",
-                "--service-type=exec",
-                "--quiet",
-                "--property=MemoryMax=16777216",
-                "--property=MemorySwapMax=0",
-                "--property=TasksMax=2",
-                "--",
-                "/usr/bin/true",
-            ]);
-        }
-        finally {
-            await filter.close();
-        }
-    }
-}
-const capture = async (executable, arguments_) => {
-    if (arguments_.length === 0)
-        return "content-addressed-worker-v1";
-    const result = await collect(executable, arguments_);
-    if (result.code !== 0)
-        throw new TypeError(`Replay executable probe failed: ${executable}`);
-    return result.stdout.length > 0 ? result.stdout : result.stderr;
-};
-const run = async (executable, arguments_, stdio) => {
-    const result = await collect(executable, arguments_, stdio);
-    if (result.code !== 0)
-        throw new TypeError(`Replay feature probe failed (${String(result.code)}): ${executable}: ${result.stderr.trim()}`);
-};
-const runExpectFailure = async (executable, arguments_, stdio) => {
-    const result = await collect(executable, arguments_, stdio);
-    if (result.code === 0)
-        throw new TypeError(`Replay denial probe unexpectedly succeeded: ${executable}`);
-};
-const collect = async (executable, arguments_, stdio = ["ignore", "pipe", "pipe"]) => new Promise((resolve, reject) => {
-    const child = spawn(executable, [...arguments_], { stdio });
-    const timeout = setTimeout(() => child.kill("SIGKILL"), 5_000);
-    timeout.unref();
-    let stdout = "";
-    let stderr = "";
-    if (child.stdout !== null)
-        child.stdout.on("data", (chunk) => {
-            stdout += chunk.toString("utf8");
-        });
-    if (child.stderr !== null)
-        child.stderr.on("data", (chunk) => {
-            stderr += chunk.toString("utf8");
-        });
-    child.once("error", (error) => {
-        clearTimeout(timeout);
-        reject(error);
-    });
-    child.once("close", (code) => {
-        clearTimeout(timeout);
-        resolve({ code, stdout, stderr });
-    });
-});