spawnfile 0.1.14 → 0.1.17

package/dist/target/dockerArtifactsProvider.js

@@ -10,6 +10,7 @@ const MAX_OUTPUT_BYTES = 32_768;
 const MAX_REPOSITORY_BYTES = 255;
 const MAX_REFERENCE_BYTES = MAX_REPOSITORY_BYTES + 72;
 const MAX_IDENTITY_BYTES = 262_144;
+const IDENTITY_RETRY_ATTEMPTS = 64;
 const DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/u;
 const PORT_PATTERN = /^[1-9][0-9]{0,4}$/u;
 const NAME_COMPONENT_PATTERN = /^[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*$/u;
@@ -282,7 +283,9 @@ const openSecureIdentity = async (filePath) => {
 };
 const openIdentity = async (filePath, links) => {
     const value = await openSecureIdentity(filePath);
-    if (value !== null && !links.includes(value.nlink))
+    if (value === null || value.nlink === 0)
+        return null;
+    if (!links.includes(value.nlink))
         return fail();
     return value;
 };
@@ -295,6 +298,12 @@ const syncDirectory = async (directory) => {
         await handle.close();
     }
 };
+const retryTurn = (attempt) => new Promise((resolve) => {
+    if ((attempt + 1) % 8 === 0)
+        setTimeout(resolve, 1);
+    else
+        setImmediate(resolve);
+});
 /* One canonical immutable record exists for one exact operation/request pair. */
 const keyPath = (root, operationHandle, requestDigest) => path.join(root, `${digest("identity-operation", `${operationHandle}\0${requestDigest}`)}.identity.json`);
 const pendingPath = (file) => path.join(path.dirname(file), `.${path.basename(file)}.pending`);
@@ -308,7 +317,7 @@ const sameInode = (left, right) => left.dev === right.dev && left.ino === right.
  * what makes unlink-after-same-inode-proof safe here.
  */
 const reconcilePublishedIdentity = async (root, file, expected) => {
-    for (let attempt = 0; attempt < 16; attempt += 1) {
+    for (let attempt = 0; attempt < IDENTITY_RETRY_ATTEMPTS; attempt += 1) {
         const final = await openIdentity(file, [1, 2]);
         if (!final || final.bytes !== expected)
             return fail();
@@ -316,15 +325,24 @@ const reconcilePublishedIdentity = async (root, file, expected) => {
         if (final.nlink === 1) {
             if (pending === null)
                 return;
-            if (pending.bytes !== expected)
+            if (pending.bytes !== expected) {
+                if (pending.nlink === 1 && expected.startsWith(pending.bytes)) {
+                    await retryTurn(attempt);
+                    continue;
+                }
                 return fail();
-            if (pending.nlink !== 1)
+            }
+            if (pending.nlink !== 1) {
+                await retryTurn(attempt);
                 continue;
+            }
         }
         else {
             /* A concurrent unlink can make a just-read two-link final become one-link. */
-            if (pending === null || pending.nlink !== 2)
+            if (pending === null || pending.nlink !== 2) {
+                await retryTurn(attempt);
                 continue;
+            }
             if (!sameInode(final, pending) || pending.bytes !== expected)
                 return fail();
         }
@@ -337,6 +355,7 @@ const reconcilePublishedIdentity = async (root, file, expected) => {
             return fail();
         if (await openIdentity(pendingPath(file), [1]) === null)
             return;
+        await retryTurn(attempt);
     }
     return fail();
 };
@@ -357,7 +376,7 @@ const exactPublishedIdentity = async (root, file, content) => {
 };
 const publishIdentity = async (root, file, content, options) => {
     const pending = pendingPath(file);
-    for (let attempt = 0; attempt < 16; attempt += 1) {
+    for (let attempt = 0; attempt < IDENTITY_RETRY_ATTEMPTS; attempt += 1) {
         if (await exactPublishedIdentity(root, file, content))
             return;
         let created = false;
@@ -385,13 +404,20 @@ const publishIdentity = async (root, file, content, options) => {
         if (pendingRecord === null) {
             if (await exactPublishedIdentity(root, file, content))
                 return;
+            await retryTurn(attempt);
             continue;
         }
-        if (pendingRecord.bytes !== content)
+        if (pendingRecord.bytes !== content) {
+            if (pendingRecord.nlink === 1 && content.startsWith(pendingRecord.bytes)) {
+                await retryTurn(attempt);
+                continue;
+            }
             return fail();
+        }
         if (pendingRecord.nlink === 2) {
             if (await exactPublishedIdentity(root, file, content))
                 return;
+            await retryTurn(attempt);
             continue;
         }
         if (created)
@@ -409,6 +435,7 @@ const publishIdentity = async (root, file, content, options) => {
         /* EEXIST may mean another exact binder linked first or a final vanished; retry only after an exact proof. */
         if (await exactPublishedIdentity(root, file, content))
             return;
+        await retryTurn(attempt);
     }
     return fail();
 };

package/dist/target/dockerBaseImage.d.ts

@@ -0,0 +1,2 @@
+/** Strict portable image-reference grammar shared by target resolution and local helper setup. */
+export declare const parseDockerBaseImageReference: (raw: unknown) => string | null;

package/dist/target/dockerBaseImage.js

@@ -0,0 +1,11 @@
+import { parseImageReference } from "../distribution/index.js";
+const CONFIG_DIGEST = /^sha256:[a-f0-9]{64}$/u;
+const MAX_REFERENCE_BYTES = 512;
+/** Strict portable image-reference grammar shared by target resolution and local helper setup. */
+export const parseDockerBaseImageReference = (raw) => {
+    if (typeof raw !== "string" || raw !== raw.trim() || raw.includes("\0")
+        || Buffer.byteLength(raw, "utf8") > MAX_REFERENCE_BYTES || CONFIG_DIGEST.test(raw)
+        || parseImageReference(raw) === null)
+        return null;
+    return raw;
+};

package/dist/target/dockerCommandExecutor.d.ts

@@ -5,6 +5,12 @@ import { type DockerSecretExecutor } from "./dockerSecretsProvider.js";
 import { type DockerWorldServiceExecutor } from "./dockerWorldServiceProvider.js";
 import type { DockerEvidenceExportExecutor } from "./evidenceExportProvider.js";
 import { type DockerCommandSpawn } from "./dockerCommandExecutorCore.js";
+export declare const PUBLIC_ARTIFACT_READER_PROGRAM: string;
+/** Private control signal emitted only for an exact missing public path probe. */
+export declare class DockerPublicArtifactNotPresentError extends Error {
+    readonly kind: "not_present";
+    constructor();
+}
 export interface DockerTargetExecutors {
     readonly artifact: DockerArtifactExecutor;
     readonly attachment: DockerOrganizationAttachmentExecutor;
@@ -19,6 +25,11 @@ export interface DockerTargetExecutors {
     readonly secret: DockerSecretExecutor;
     readonly world: DockerWorldServiceExecutor;
 }
+export declare const createPublicArtifactReadCommand: (input: {
+    readonly containerId: string;
+    readonly context: string;
+    readonly path: string;
+}) => string[];
 export interface CreateDockerTargetExecutorsOptions {
     readonly dockerCommand?: string;
     readonly spawn?: DockerCommandSpawn;

package/dist/target/dockerCommandExecutor.js

@@ -5,8 +5,34 @@ import { DockerArtifactProviderError } from "./dockerArtifactsProvider.js";
 import { DockerResourceProviderError } from "./dockerResourcesProvider.js";
 import { DockerSecretProviderError } from "./dockerSecretsProvider.js";
 import { DockerWorldServiceProviderError } from "./dockerWorldServiceProvider.js";
-import { MAX_TARGET_PUBLIC_ARTIFACT_BYTES } from "./publicArtifactSnapshot.js";
+import { MAX_TARGET_PUBLIC_ARTIFACT_BYTES, isTargetPublicArtifactPath } from "./publicArtifactSnapshot.js";
 import { DOCKER_COMMAND_ERROR, DockerCommandFailure, executeDockerCommandCore } from "./dockerCommandExecutorCore.js";
+const PUBLIC_ARTIFACT_NOT_PRESENT_EXIT = 42;
+// The public directory is a separately mounted tmpfs and paths are restricted
+// to direct children.  Open the leaf exactly once with O_NOFOLLOW: no path
+// preflight is permitted because it would turn a replacement into a TOCTOU
+// disclosure.  Only ENOENT from that open denotes the terminal absence state.
+export const PUBLIC_ARTIFACT_READER_PROGRAM = [
+    "import fs from 'node:fs';",
+    "const path = process.argv[1];",
+    "let fd;",
+    "try { fd = fs.openSync(path, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW); }",
+    "catch (error) { process.exitCode = error?.code === 'ENOENT' ? 42 : 43; }",
+    "if (fd !== undefined) {",
+    "  try {",
+    "    if (!fs.fstatSync(fd).isFile()) process.exitCode = 43;",
+    "    else { const chunks = []; let bytes; do { const chunk = Buffer.allocUnsafe(65536); bytes = fs.readSync(fd, chunk); if (bytes) chunks.push(chunk.subarray(0, bytes)); } while (bytes); process.stdout.write(Buffer.concat(chunks)); }",
+    "  } catch { process.exitCode = 43; } finally { fs.closeSync(fd); }",
+    "}"
+].join(" ");
+/** Private control signal emitted only for an exact missing public path probe. */
+export class DockerPublicArtifactNotPresentError extends Error {
+    kind = "not_present";
+    constructor() {
+        super("Target public artifact is not present");
+        this.name = "DockerPublicArtifactNotPresentError";
+    }
+}
 const role = (args) => {
     if (args[0] === "--context") {
         return args.length >= 3 && /^[a-z][a-z0-9_-]{0,63}$/u.test(args[1]) ? args.slice(2) : [];
@@ -19,6 +45,23 @@ const role = (args) => {
     }
     return args;
 };
+const exactPublicArtifactAbsence = (args, error) => {
+    if (!(error instanceof DockerCommandFailure)
+        || error.code !== PUBLIC_ARTIFACT_NOT_PRESENT_EXIT || error.stderr !== ""
+        || error.stdoutBytes !== 0)
+        return undefined;
+    const command = role(args);
+    const path = command[8];
+    if (command.length !== 9
+        || command[0] !== "container" || command[1] !== "exec"
+        || !/^[a-f0-9]{64}$/u.test(command[2])
+        || command[3] !== "/usr/local/bin/node" || command[4] !== "--input-type=module"
+        || command[5] !== "-e" || command[6] !== PUBLIC_ARTIFACT_READER_PROGRAM
+        || command[7] !== "spawnfile-public-artifact-read"
+        || !isTargetPublicArtifactPath(path))
+        return undefined;
+    return new DockerPublicArtifactNotPresentError();
+};
 const exactMissingImageReference = (requested, reported) => {
     if (requested === undefined || reported === requested)
         return reported === requested;
@@ -112,6 +155,11 @@ const classify = (kind, args, error) => {
     }
     return new Error(DOCKER_COMMAND_ERROR);
 };
+export const createPublicArtifactReadCommand = (input) => [
+    "--context", input.context, "container", "exec", input.containerId,
+    "/usr/local/bin/node", "--input-type=module", "-e", PUBLIC_ARTIFACT_READER_PROGRAM,
+    "spawnfile-public-artifact-read", input.path
+];
 const normalizeCommandOptions = (raw, allowStdin) => {
     if (!raw || typeof raw !== "object" || Array.isArray(raw) || nodeTypes.isProxy(raw)
         || Object.getPrototypeOf(raw) !== Object.prototype)
@@ -189,7 +237,10 @@ export const createDockerTargetExecutors = (options = {}) => {
                 });
                 return { bytes: Uint8Array.from(result.stdout) };
             }
-            catch {
+            catch (error) {
+                const absence = exactPublicArtifactAbsence(args, error);
+                if (absence)
+                    throw absence;
                 throw new Error(DOCKER_COMMAND_ERROR);
             }
         },

package/dist/target/dockerCommandExecutorCore.d.ts

@@ -18,7 +18,8 @@ export type DockerCommandSpawn = (file: string, args: readonly string[], options
 export declare class DockerCommandFailure extends Error {
     readonly code: number;
     readonly stderr: string;
-    constructor(code: number, stderr: string);
+    readonly stdoutBytes: number;
+    constructor(code: number, stderr: string, stdoutBytes: number);
 }
 export interface DockerCommandCoreOptions {
     readonly binary: boolean;

package/dist/target/dockerCommandExecutorCore.js

@@ -7,10 +7,12 @@ const FALLBACK_MS = 50;
 export class DockerCommandFailure extends Error {
     code;
     stderr;
-    constructor(code, stderr) {
+    stdoutBytes;
+    constructor(code, stderr, stdoutBytes) {
         super(DOCKER_COMMAND_ERROR);
         this.code = code;
         this.stderr = stderr;
+        this.stdoutBytes = stdoutBytes;
     }
 }
 const ordinaryOptions = (raw) => {
@@ -197,7 +199,7 @@ export const executeDockerCommandCore = (spawnCommand, file, args, rawOptions) =
                 return;
             }
             if (closeCode !== 0) {
-                settle(new DockerCommandFailure(closeCode, stderr));
+                settle(new DockerCommandFailure(closeCode, stderr, typeof stdout === "string" ? Buffer.byteLength(stdout, "utf8") : stdout.byteLength));
                 return;
             }
             settle(undefined, { stderr, stdout });

package/dist/target/dockerPublicArtifactSnapshot.d.ts

@@ -1,5 +1,5 @@
-import type { DockerTargetExecutors } from "./dockerCommandExecutor.js";
-import { type TargetPublicArtifactSnapshot } from "./publicArtifactSnapshot.js";
+import { type DockerTargetExecutors } from "./dockerCommandExecutor.js";
+import { type TargetPublicArtifactSnapshotResult } from "./publicArtifactSnapshot.js";
 import { type DockerWorldServiceExecutor } from "./dockerWorldServiceProvider.js";
 import type { WorldServiceAuthorityStore } from "./dockerWorldServiceStore.js";
 export declare const TARGET_PUBLIC_ARTIFACT_SNAPSHOT_ERROR = "Target public artifact snapshot failed";
@@ -12,6 +12,6 @@ export interface DockerPublicArtifactSnapshotOptions {
     readonly timeoutMs: number;
 }
 export interface PublicArtifactSnapshotReader {
-    snapshot(raw: unknown): Promise<TargetPublicArtifactSnapshot>;
+    snapshot(raw: unknown): Promise<TargetPublicArtifactSnapshotResult>;
 }
 export declare const createDockerPublicArtifactSnapshotReader: (options: DockerPublicArtifactSnapshotOptions) => PublicArtifactSnapshotReader;

package/dist/target/dockerPublicArtifactSnapshot.js

@@ -1,5 +1,6 @@
 import { SpawnfileError } from "../shared/index.js";
-import { createTargetPublicArtifactSnapshot, parseTargetPublicArtifactSnapshotRequest } from "./publicArtifactSnapshot.js";
+import { createPublicArtifactReadCommand, DockerPublicArtifactNotPresentError } from "./dockerCommandExecutor.js";
+import { createTargetPublicArtifactSnapshot, createTargetPublicArtifactSnapshotNotPresent, parseTargetPublicArtifactSnapshotRequest } from "./publicArtifactSnapshot.js";
 import { inspectDockerWorldService, sameWorldServiceValue, worldServiceSpecForBinding } from "./dockerWorldServiceLifecycle.js";
 export const TARGET_PUBLIC_ARTIFACT_SNAPSHOT_ERROR = "Target public artifact snapshot failed";
 const CONTEXT_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/u;
@@ -29,45 +30,26 @@ const exactBinding = async (request, options) => {
     return binding;
 };
 const readPublicArtifact = async (containerId, request, options) => {
+    let result;
     try {
-        const resolved = await options.contentExecutor("docker", [
-            "--context", options.context,
-            "container", "exec",
+        result = await options.contentExecutor("docker", createPublicArtifactReadCommand({
             containerId,
-            "/usr/bin/readlink",
-            "-e",
-            request.artifact.path
-        ], {
+            context: options.context,
+            path: request.artifact.path
+        }), {
             signal: options.signal,
             timeout: options.timeoutMs
         });
-        if (!resolved || !(resolved.bytes instanceof Uint8Array))
-            return fail();
-        const resolvedPath = new TextDecoder("utf-8", { fatal: true })
-            .decode(resolved.bytes);
-        // Reject the final file and every parent alias. The world may publish only
-        // the exact regular path that its descriptor declared, never a symlink
-        // into private evidence, credentials, or another runtime surface.
-        if (resolvedPath !== `${request.artifact.path}\n`)
-            return fail();
-        const result = await options.contentExecutor("docker", [
-            "--context", options.context,
-            "container", "exec",
-            containerId,
-            "/bin/cat",
-            request.artifact.path
-        ], {
-            signal: options.signal,
-            timeout: options.timeoutMs
-        });
-        if (!result || !(result.bytes instanceof Uint8Array)
-            || result.bytes.byteLength > request.artifact.max_bytes)
-            return fail();
-        return Uint8Array.from(result.bytes);
     }
-    catch {
+    catch (error) {
+        if (error instanceof DockerPublicArtifactNotPresentError)
+            return null;
         return fail();
     }
+    if (!result || !(result.bytes instanceof Uint8Array)
+        || result.bytes.byteLength > request.artifact.max_bytes)
+        return fail();
+    return Uint8Array.from(result.bytes);
 };
 class DockerPublicArtifactSnapshotReader {
     #options;
@@ -93,7 +75,9 @@ class DockerPublicArtifactSnapshotReader {
         if (!after || after.containerId !== before.containerId
             || after.status !== "running")
             return fail();
-        return createTargetPublicArtifactSnapshot({ content, request });
+        return content === null
+            ? createTargetPublicArtifactSnapshotNotPresent(request)
+            : createTargetPublicArtifactSnapshot({ content, request });
     }
 }
 export const createDockerPublicArtifactSnapshotReader = (options) => new DockerPublicArtifactSnapshotReader(options);

package/dist/target/dockerTarget.d.ts

@@ -12,6 +12,7 @@ export type DockerDeploymentTarget = {
 };
 export type DockerTargetExecFile = (file: string, args: string[], options: {
     signal?: AbortSignal;
+    stdin?: Uint8Array;
     timeout: number;
 }) => Promise<{
     stderr: string;

package/dist/target/dockerTargetBinding.d.ts

@@ -1,7 +1,6 @@
-import { execFile as execFileCallback } from "node:child_process";
 import { type SelectedTargetReceipt } from "./contracts.js";
 import type { ResolveDockerDeploymentTargetOptions, SelectTargetOptions } from "./dockerTarget.js";
-export declare const defaultDockerTargetExecFile: typeof execFileCallback.__promisify__;
+export { defaultDockerTargetExecFile } from "./dockerTargetExecFile.js";
 /** Private owner-only endpoint binding. Never export this module through the target barrel. */
 export interface ResolvedSelectedTargetBinding {
     readonly endpoint: string;

package/dist/target/dockerTargetBinding.js

@@ -1,10 +1,9 @@
-import { execFile as execFileCallback } from "node:child_process";
 import { createHash } from "node:crypto";
-import { promisify } from "node:util";
 import { SpawnfileError } from "../shared/index.js";
 import { SELECTED_TARGET_VERSION, parseOpaqueTargetHandle, parseSelectedTargetReceipt } from "./contracts.js";
 import { createEndpointFingerprint } from "./dockerEndpointFingerprint.js";
-export const defaultDockerTargetExecFile = promisify(execFileCallback);
+import { defaultDockerTargetExecFile } from "./dockerTargetExecFile.js";
+export { defaultDockerTargetExecFile } from "./dockerTargetExecFile.js";
 const TARGET_SELECTION_ERROR = "Target selection failed";
 const DOCKER_CONTEXT_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/u;
 const MAX_RAW_EXECUTOR_STDOUT_BYTES = 4_096;

package/dist/target/dockerTargetExecFile.d.ts

@@ -0,0 +1,19 @@
+import type { DockerTargetExecFile } from "./dockerTarget.js";
+export type DockerTargetExecutionFailureKind = "aborted" | "cleanup_failed" | "failed" | "timeout";
+export declare class DockerTargetExecutionError extends Error {
+    readonly kind: DockerTargetExecutionFailureKind;
+    constructor(kind: DockerTargetExecutionFailureKind);
+}
+export declare class DockerTargetCommandFailure extends DockerTargetExecutionError {
+    readonly code: number;
+    readonly stderr: string;
+    readonly stdoutBytes: number;
+    constructor(code: number, stderr: string, stdoutBytes: number);
+}
+/**
+ * Docker target probe/build transport with exact stdin and bounded tree teardown.
+ * POSIX children lead a private process group so timeout/abort cannot strand a
+ * buildx descendant that inherited the CLI's stdio handles.
+ */
+export declare const createBoundedDockerTargetExecFile: () => DockerTargetExecFile;
+export declare const defaultDockerTargetExecFile: DockerTargetExecFile;

package/dist/target/dockerTargetExecFile.js

@@ -0,0 +1,194 @@
+import { spawn } from "node:child_process";
+const ERROR = "Docker target command failed";
+const OUTPUT_CAP = 65_536;
+const TERM_GRACE_MS = 50;
+const KILL_GRACE_MS = 250;
+export class DockerTargetExecutionError extends Error {
+    kind;
+    constructor(kind) {
+        super(ERROR);
+        this.name = "DockerTargetExecutionError";
+        this.kind = kind;
+    }
+}
+export class DockerTargetCommandFailure extends DockerTargetExecutionError {
+    code;
+    stderr;
+    stdoutBytes;
+    constructor(code, stderr, stdoutBytes) {
+        super("failed");
+        this.name = "DockerTargetCommandFailure";
+        this.code = code;
+        this.stderr = stderr;
+        this.stdoutBytes = stdoutBytes;
+    }
+}
+const decode = (chunks) => {
+    try {
+        return new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(chunks));
+    }
+    catch {
+        throw new DockerTargetExecutionError("failed");
+    }
+};
+/**
+ * Docker target probe/build transport with exact stdin and bounded tree teardown.
+ * POSIX children lead a private process group so timeout/abort cannot strand a
+ * buildx descendant that inherited the CLI's stdio handles.
+ */
+export const createBoundedDockerTargetExecFile = () => (file, args, options) => {
+    if (typeof file !== "string" || file.length < 1 || file.includes("\0")
+        || !Array.isArray(args) || args.some((arg) => typeof arg !== "string" || arg.includes("\0"))
+        || !options || !Number.isSafeInteger(options.timeout) || options.timeout < 1
+        || options.timeout > 120_000
+        || options.signal !== undefined && !(options.signal instanceof AbortSignal)
+        || options.stdin !== undefined && !(options.stdin instanceof Uint8Array)) {
+        return Promise.reject(new DockerTargetExecutionError("failed"));
+    }
+    if (options.signal?.aborted) {
+        return Promise.reject(new DockerTargetExecutionError("aborted"));
+    }
+    return new Promise((resolve, reject) => {
+        const grouped = process.platform !== "win32";
+        let child;
+        try {
+            child = spawn(file, args, {
+                detached: grouped,
+                shell: false,
+                stdio: ["pipe", "pipe", "pipe"],
+            });
+        }
+        catch {
+            reject(new DockerTargetExecutionError("failed"));
+            return;
+        }
+        const stdout = [];
+        const stderr = [];
+        let stdoutBytes = 0;
+        let stderrBytes = 0;
+        let terminal;
+        let settled = false;
+        let termTimer;
+        let killTimer;
+        const groupAbsent = () => {
+            if (!grouped || !child.pid)
+                return false;
+            try {
+                process.kill(-child.pid, 0);
+                return false;
+            }
+            catch (error) {
+                return error.code === "ESRCH";
+            }
+        };
+        const signalTree = (signal) => {
+            try {
+                if (grouped && child.pid)
+                    process.kill(-child.pid, signal);
+                else
+                    child.kill(signal);
+            }
+            catch { /* only a later ESRCH liveness probe proves quiescence */ }
+        };
+        const destroyPipes = () => {
+            child.stdin.on("error", () => undefined);
+            child.stdout.on("error", () => undefined);
+            child.stderr.on("error", () => undefined);
+            child.stdin.destroy();
+            child.stdout.destroy();
+            child.stderr.destroy();
+        };
+        const cleanup = () => {
+            clearTimeout(timeoutTimer);
+            if (termTimer)
+                clearTimeout(termTimer);
+            if (killTimer)
+                clearTimeout(killTimer);
+            options.signal?.removeEventListener("abort", onAbort);
+        };
+        const finish = (error, unresolved = false) => {
+            if (settled || !unresolved && !groupAbsent())
+                return;
+            settled = true;
+            cleanup();
+            destroyPipes();
+            reject(error);
+        };
+        const terminate = (kind) => {
+            if (terminal || settled)
+                return;
+            terminal = new DockerTargetExecutionError(kind);
+            signalTree("SIGTERM");
+            termTimer = setTimeout(() => {
+                signalTree("SIGKILL");
+                destroyPipes();
+                const started = Date.now();
+                const poll = () => {
+                    if (!terminal || settled)
+                        return;
+                    if (groupAbsent()) {
+                        finish(terminal);
+                        return;
+                    }
+                    signalTree("SIGKILL");
+                    if (Date.now() - started >= KILL_GRACE_MS) {
+                        finish(new DockerTargetExecutionError("cleanup_failed"), true);
+                        return;
+                    }
+                    killTimer = setTimeout(poll, 10);
+                };
+                poll();
+            }, TERM_GRACE_MS);
+        };
+        const append = (target, chunk, output) => {
+            const value = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            if (output === "stdout")
+                stdoutBytes += value.byteLength;
+            else
+                stderrBytes += value.byteLength;
+            if (stdoutBytes > OUTPUT_CAP || stderrBytes > OUTPUT_CAP) {
+                terminate("failed");
+                return;
+            }
+            target.push(Buffer.from(value));
+        };
+        function onAbort() { terminate("aborted"); }
+        child.stdout.on("data", (chunk) => append(stdout, chunk, "stdout"));
+        child.stderr.on("data", (chunk) => append(stderr, chunk, "stderr"));
+        child.stdin.on("error", () => terminate("failed"));
+        child.on("error", () => terminate("failed"));
+        child.on("close", (code) => {
+            if (terminal || settled)
+                return;
+            settled = true;
+            cleanup();
+            try {
+                const stderrText = decode(stderr);
+                const stdoutText = decode(stdout);
+                if (code !== 0) {
+                    reject(new DockerTargetCommandFailure(code ?? -1, stderrText, Buffer.byteLength(stdoutText, "utf8")));
+                    return;
+                }
+                resolve({ stderr: stderrText, stdout: stdoutText });
+            }
+            catch (error) {
+                reject(error);
+            }
+        });
+        options.signal?.addEventListener("abort", onAbort, { once: true });
+        const timeoutTimer = setTimeout(() => terminate("timeout"), options.timeout);
+        if (options.signal?.aborted) {
+            terminate("aborted");
+            return;
+        }
+        try {
+            const input = options.stdin === undefined ? undefined
+                : Buffer.from(options.stdin.buffer, options.stdin.byteOffset, options.stdin.byteLength);
+            child.stdin.end(input);
+        }
+        catch {
+            terminate("failed");
+        }
+    });
+};
+export const defaultDockerTargetExecFile = createBoundedDockerTargetExecFile();

package/dist/target/dockerWorldServiceProvider.d.ts

@@ -5,6 +5,10 @@ export declare const WORLD_RUNTIME_TMPFS: Readonly<{
     path: "/tmp";
     options: "rw,noexec,nosuid,nodev,size=1m,mode=1777";
 }>;
+export declare const WORLD_PUBLIC_ARTIFACT_TMPFS: Readonly<{
+    path: "/tmp/spawnfile-public";
+    options: "rw,noexec,nosuid,nodev,size=1m,mode=1777";
+}>;
 export type DockerWorldServiceFailureKind = "collision" | "not_found";
 export interface DockerWorldServiceExecutor {
     (file: string, args: string[], options: {

package/dist/target/dockerWorldServiceProvider.js

@@ -9,6 +9,16 @@ export const WORLD_RUNTIME_TMPFS = Object.freeze({
     path: "/tmp",
     options: "rw,noexec,nosuid,nodev,size=1m,mode=1777"
 });
+/*
+ * A distinct mount point is a confinement boundary, not merely a convenient
+ * directory.  The public-artifact reader opens one direct child with
+ * O_NOFOLLOW; this mount prevents that child from being hard-linked or
+ * replaced with a path from the world root, secrets, or evidence mounts.
+ */
+export const WORLD_PUBLIC_ARTIFACT_TMPFS = Object.freeze({
+    path: "/tmp/spawnfile-public",
+    options: "rw,noexec,nosuid,nodev,size=1m,mode=1777"
+});
 const MAX_OUTPUT_BYTES = 32_768;
 const MAX_NAME_LENGTH = 63;
 const DIGEST_PATTERN = /^sha256:[a-f0-9]{64}$/u;
@@ -183,6 +193,7 @@ export const createDockerWorldServiceSpec = (input) => {
             "--cap-drop", "ALL", "--security-opt", "no-new-privileges=true",
             "--ipc", "none", "--cgroupns", "private",
             "--tmpfs", `${WORLD_RUNTIME_TMPFS.path}:${WORLD_RUNTIME_TMPFS.options}`,
+            "--tmpfs", `${WORLD_PUBLIC_ARTIFACT_TMPFS.path}:${WORLD_PUBLIC_ARTIFACT_TMPFS.options}`,
             ...labelArgs,
             "--mount", `type=volume,src=${evidence.name},dst=${evidenceMountPath},volume-nocopy`,
             "--mount", `type=volume,src=${secrets.name},dst=${WORLD_SECRETS_PATH},readonly,volume-nocopy`,
@@ -304,8 +315,9 @@ export const parseExpectedDockerWorldService = (stdout, spec) => {
         && value.PidMode === "" && value.IpcMode === "none" && value.UTSMode === ""
         && value.UsernsMode === "" && value.CgroupnsMode === "private"
         && exactRecord(value.Tmpfs)
-        && exactKeys(value.Tmpfs, [WORLD_RUNTIME_TMPFS.path])
+        && exactKeys(value.Tmpfs, [WORLD_RUNTIME_TMPFS.path, WORLD_PUBLIC_ARTIFACT_TMPFS.path])
         && value.Tmpfs[WORLD_RUNTIME_TMPFS.path] === WORLD_RUNTIME_TMPFS.options
+        && value.Tmpfs[WORLD_PUBLIC_ARTIFACT_TMPFS.path] === WORLD_PUBLIC_ARTIFACT_TMPFS.options
         && value.ReadonlyRootfs === true
         && JSON.stringify(value.SecurityOpt) === JSON.stringify(["no-new-privileges=true"])
         && value.LogType === "none" && value.RestartPolicyName === "no"