spawnfile 0.1.14 → 0.1.18

package/dist/shared/daimonCodexDocker.js

@@ -0,0 +1,120 @@
+import { createHash } from "node:crypto";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { DAIMON_GROK_SECCOMP_PROFILE_BYTES, DAIMON_GROK_SECCOMP_PROFILE_FILE_NAME, DAIMON_GROK_SECCOMP_PROFILE_SHA256 } from "./daimonGrokSeccompProfile.js";
+import { SpawnfileError } from "./errors.js";
+export const DAIMON_DOCKER_RUNTIME_SECURITY_ARGS = [
+    "--cap-drop=ALL",
+    "--cap-add=CHOWN",
+    "--cap-add=SETUID",
+    "--cap-add=SETGID",
+    "--cap-add=DAC_READ_SEARCH",
+    // Lets the broker launcher drop its bounding set to 00000000000000c1; without SETPCAP, setpriv --bounding-set silently no-ops.
+    "--cap-add=SETPCAP",
+    // The entrypoint supervises children dropped to uid 2100/2200+; without CAP_KILL, root cannot even kill -0 them, so a live child reads as dead.
+    "--cap-add=KILL",
+    "--security-opt=no-new-privileges:true"
+];
+export const DAIMON_CODEX_NATIVE_SANDBOX_DOCKER_SECURITY_OPTS = [
+    "--security-opt=seccomp=unconfined",
+    "--security-opt=apparmor=unconfined"
+];
+const DAIMON_CONFIG_VERSIONS = [
+    "noopolis.daimon.organization-runtime.v1",
+    "noopolis.daimon.organization-runtime.v2"
+];
+const DAIMON_CODEX_STRICT_SANDBOX = {
+    mode: "workspace-write",
+    networkAccess: false,
+    webSearch: "disabled"
+};
+const isRecord = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+const hasExactCodexStrictSandbox = (engine) => {
+    const sandbox = engine.codexSandbox;
+    if (sandbox === undefined)
+        return false;
+    if (!isRecord(sandbox)) {
+        throw new SpawnfileError("validation_error", "Daimon Codex sandbox policy has an invalid shape");
+    }
+    const expected = DAIMON_CODEX_STRICT_SANDBOX;
+    const keys = Object.keys(sandbox).sort();
+    const expectedKeys = Object.keys(expected).sort();
+    if (keys.length !== expectedKeys.length ||
+        keys.some((key, index) => key !== expectedKeys[index] || sandbox[key] !== expected[key])) {
+        throw new SpawnfileError("validation_error", "Daimon Codex sandbox policy is not the supported strict workspace-no-network policy");
+    }
+    return true;
+};
+export const resolveDaimonEngineDockerInterop = (source) => {
+    let parsed;
+    try {
+        parsed = JSON.parse(source);
+    }
+    catch {
+        throw new SpawnfileError("validation_error", "Daimon generated organization config is not JSON");
+    }
+    if (!isRecord(parsed) || !Array.isArray(parsed.agents)) {
+        throw new SpawnfileError("validation_error", "Daimon generated organization config has an invalid shape");
+    }
+    if (!DAIMON_CONFIG_VERSIONS.includes(parsed.version)) {
+        throw new SpawnfileError("validation_error", "Daimon generated organization config is not a supported v1/v2 contract");
+    }
+    const interop = { codex: false, grok: false };
+    for (const agent of parsed.agents) {
+        if (!isRecord(agent) || !isRecord(agent.engine)) {
+            throw new SpawnfileError("validation_error", "Daimon generated organization config has an invalid agent engine");
+        }
+        const kind = agent.engine.kind;
+        if (kind !== "agy" && kind !== "codex" && kind !== "grok") {
+            throw new SpawnfileError("validation_error", "Daimon generated organization config has an unsupported agent engine");
+        }
+        if (kind === "codex" && hasExactCodexStrictSandbox(agent.engine))
+            interop.codex = true;
+        if (kind === "grok")
+            interop.grok = true;
+    }
+    return interop;
+};
+export const configRequiresCodexNativeSandboxDockerInterop = (source) => resolveDaimonEngineDockerInterop(source).codex;
+export const DAIMON_GROK_HOST_USERNS_PREREQUISITE = "kernel.apparmor_restrict_unprivileged_userns=0";
+/**
+ * Writes the pinned Grok seccomp profile into `directory` (content-addressed,
+ * verified after writing) and returns its absolute path. Docker reads a
+ * `seccomp=<file>` option on the client at `docker run` and stores the profile
+ * in the container config, so the file only has to exist for that call.
+ */
+export const materializeDaimonGrokSeccompProfile = async (directory) => {
+    const target = path.resolve(directory, `${DAIMON_GROK_SECCOMP_PROFILE_SHA256.slice(0, 16)}-${DAIMON_GROK_SECCOMP_PROFILE_FILE_NAME}`);
+    await mkdir(path.dirname(target), { recursive: true });
+    await writeFile(target, DAIMON_GROK_SECCOMP_PROFILE_BYTES, { mode: 0o644 });
+    const written = await readFile(target);
+    if (createHash("sha256").update(written).digest("hex") !== DAIMON_GROK_SECCOMP_PROFILE_SHA256) {
+        throw new SpawnfileError("runtime_error", "Pinned Grok seccomp profile did not materialize byte-for-byte");
+    }
+    return target;
+};
+/**
+ * Docker security options for a Daimon container, by the engines its configs run.
+ *
+ * Codex's strict native sandbox needs seccomp and AppArmor fully unconfined, and
+ * that superset also lets Grok's bubblewrap run, so it wins whenever a strict
+ * Codex agent is present. Otherwise a Grok agent gets Docker's default seccomp
+ * profile plus bubblewrap's seven namespace syscalls (pinned bytes) and AppArmor
+ * unconfined — the narrowest combination under which Grok 1.0.34 starts. Grok
+ * additionally needs the Docker host to allow unprivileged user namespaces
+ * (`kernel.apparmor_restrict_unprivileged_userns=0`); the container entrypoint
+ * checks that before the broker starts.
+ */
+export const daimonEngineDockerSecurityArgsForConfigs = (sources, grokSeccompProfilePath) => {
+    const interop = sources.map(resolveDaimonEngineDockerInterop);
+    if (interop.some((entry) => entry.codex))
+        return Promise.resolve([...DAIMON_CODEX_NATIVE_SANDBOX_DOCKER_SECURITY_OPTS]);
+    if (!interop.some((entry) => entry.grok))
+        return Promise.resolve([]);
+    return grokSeccompProfilePath().then((profilePath) => {
+        if (!path.isAbsolute(profilePath))
+            throw new SpawnfileError("runtime_error", "Grok seccomp profile path must be absolute");
+        return [`--security-opt=seccomp=${profilePath}`, "--security-opt=apparmor=unconfined"];
+    });
+};
+export const codexNativeSandboxDockerSecurityArgsForConfigs = (sources) => sources.some(configRequiresCodexNativeSandboxDockerInterop) ? [...DAIMON_CODEX_NATIVE_SANDBOX_DOCKER_SECURITY_OPTS] : [];

package/dist/shared/daimonGrokSeccompProfile.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Docker's default seccomp profile plus the seven namespace syscalls bubblewrap
+ * needs without CAP_SYS_ADMIN (clone, clone3, unshare, mount, umount2, pivot_root,
+ * setns): the narrowest profile under which Grok 1.0.34's sandbox starts
+ * (Noopolis P0 container evidence, 2026-09-17). Bytes are pinned by sha256; Daimon's
+ * Grok broker projection and slot preflight receipt bind the same digest.
+ */
+export declare const DAIMON_GROK_SECCOMP_PROFILE_FILE_NAME: "seccomp-default-plus-userns.json";
+export declare const DAIMON_GROK_SECCOMP_PROFILE_SHA256: "9666074d2d6b1a261a410598b9ce1714d9060a6ef4c9c1d1cfb6f8915d7e842a";
+export declare const DAIMON_GROK_SECCOMP_PROFILE_BYTES = "{\n \"defaultAction\": \"SCMP_ACT_ERRNO\",\n \"defaultErrnoRet\": 1,\n \"archMap\": [\n  {\n   \"architecture\": \"SCMP_ARCH_X86_64\",\n   \"subArchitectures\": [\n    \"SCMP_ARCH_X86\",\n    \"SCMP_ARCH_X32\"\n   ]\n  },\n  {\n   \"architecture\": \"SCMP_ARCH_AARCH64\",\n   \"subArchitectures\": [\n    \"SCMP_ARCH_ARM\"\n   ]\n  },\n  {\n   \"architecture\": \"SCMP_ARCH_MIPS64\",\n   \"subArchitectures\": [\n    \"SCMP_ARCH_MIPS\",\n    \"SCMP_ARCH_MIPS64N32\"\n   ]\n  },\n  {\n   \"architecture\": \"SCMP_ARCH_MIPS64N32\",\n   \"subArchitectures\": [\n    \"SCMP_ARCH_MIPS\",\n    \"SCMP_ARCH_MIPS64\"\n   ]\n  },\n  {\n   \"architecture\": \"SCMP_ARCH_MIPSEL64\",\n   \"subArchitectures\": [\n    \"SCMP_ARCH_MIPSEL\",\n    \"SCMP_ARCH_MIPSEL64N32\"\n   ]\n  },\n  {\n   \"architecture\": \"SCMP_ARCH_MIPSEL64N32\",\n   \"subArchitectures\": [\n    \"SCMP_ARCH_MIPSEL\",\n    \"SCMP_ARCH_MIPSEL64\"\n   ]\n  },\n  {\n   \"architecture\": \"SCMP_ARCH_S390X\",\n   \"subArchitectures\": [\n    \"SCMP_ARCH_S390\"\n   ]\n  },\n  {\n   \"architecture\": \"SCMP_ARCH_RISCV64\",\n   \"subArchitectures\": null\n  },\n  {\n   \"architecture\": \"SCMP_ARCH_LOONGARCH64\",\n   \"subArchitectures\": null\n  }\n ],\n \"syscalls\": [\n  {\n   \"names\": [\n    \"clone\",\n    \"clone3\",\n    \"unshare\",\n    \"mount\",\n    \"umount2\",\n    \"pivot_root\",\n    \"setns\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"comment\": \"P0 spike: userns/mount syscalls bubblewrap needs, without CAP_SYS_ADMIN\"\n  },\n  {\n   \"names\": [\n    \"accept\",\n    \"accept4\",\n    \"access\",\n    \"adjtimex\",\n    \"alarm\",\n    \"bind\",\n    \"brk\",\n    \"cachestat\",\n    \"capget\",\n    \"capset\",\n    \"chdir\",\n    \"chmod\",\n    \"chown\",\n    \"chown32\",\n    \"clock_adjtime\",\n    \"clock_adjtime64\",\n    \"clock_getres\",\n    \"clock_getres_time64\",\n    \"clock_gettime\",\n    \"clock_gettime64\",\n    \"clock_nanosleep\",\n    \"clock_nanosleep_time64\",\n    \"close\",\n    \"close_range\",\n    \"connect\",\n    \"copy_file_range\",\n    \"creat\",\n    \"dup\",\n    \"dup2\",\n    \"dup3\",\n    \"epoll_create\",\n    \"epoll_create1\",\n    \"epoll_ctl\",\n    \"epoll_ctl_old\",\n    \"epoll_pwait\",\n    \"epoll_pwait2\",\n    \"epoll_wait\",\n    \"epoll_wait_old\",\n    \"eventfd\",\n    \"eventfd2\",\n    \"execve\",\n    \"execveat\",\n    \"exit\",\n    \"exit_group\",\n    \"faccessat\",\n    \"faccessat2\",\n    \"fadvise64\",\n    \"fadvise64_64\",\n    \"fallocate\",\n    \"fanotify_mark\",\n    \"fchdir\",\n    \"fchmod\",\n    \"fchmodat\",\n    \"fchmodat2\",\n    \"fchown\",\n    \"fchown32\",\n    \"fchownat\",\n    \"fcntl\",\n    \"fcntl64\",\n    \"fdatasync\",\n    \"fgetxattr\",\n    \"flistxattr\",\n    \"flock\",\n    \"fork\",\n    \"fremovexattr\",\n    \"fsetxattr\",\n    \"fstat\",\n    \"fstat64\",\n    \"fstatat64\",\n    \"fstatfs\",\n    \"fstatfs64\",\n    \"fsync\",\n    \"ftruncate\",\n    \"ftruncate64\",\n    \"futex\",\n    \"futex_requeue\",\n    \"futex_time64\",\n    \"futex_wait\",\n    \"futex_waitv\",\n    \"futex_wake\",\n    \"futimesat\",\n    \"getcpu\",\n    \"getcwd\",\n    \"getdents\",\n    \"getdents64\",\n    \"getegid\",\n    \"getegid32\",\n    \"geteuid\",\n    \"geteuid32\",\n    \"getgid\",\n    \"getgid32\",\n    \"getgroups\",\n    \"getgroups32\",\n    \"getitimer\",\n    \"getpeername\",\n    \"getpgid\",\n    \"getpgrp\",\n    \"getpid\",\n    \"getppid\",\n    \"getpriority\",\n    \"getrandom\",\n    \"getresgid\",\n    \"getresgid32\",\n    \"getresuid\",\n    \"getresuid32\",\n    \"getrlimit\",\n    \"get_robust_list\",\n    \"getrusage\",\n    \"getsid\",\n    \"getsockname\",\n    \"getsockopt\",\n    \"get_thread_area\",\n    \"gettid\",\n    \"gettimeofday\",\n    \"getuid\",\n    \"getuid32\",\n    \"getxattr\",\n    \"getxattrat\",\n    \"inotify_add_watch\",\n    \"inotify_init\",\n    \"inotify_init1\",\n    \"inotify_rm_watch\",\n    \"io_cancel\",\n    \"ioctl\",\n    \"io_destroy\",\n    \"io_getevents\",\n    \"io_pgetevents\",\n    \"io_pgetevents_time64\",\n    \"ioprio_get\",\n    \"ioprio_set\",\n    \"io_setup\",\n    \"io_submit\",\n    \"ipc\",\n    \"kill\",\n    \"landlock_add_rule\",\n    \"landlock_create_ruleset\",\n    \"landlock_restrict_self\",\n    \"lchown\",\n    \"lchown32\",\n    \"lgetxattr\",\n    \"link\",\n    \"linkat\",\n    \"listen\",\n    \"listmount\",\n    \"listxattr\",\n    \"listxattrat\",\n    \"llistxattr\",\n    \"_llseek\",\n    \"lremovexattr\",\n    \"lseek\",\n    \"lsetxattr\",\n    \"lstat\",\n    \"lstat64\",\n    \"madvise\",\n    \"map_shadow_stack\",\n    \"membarrier\",\n    \"memfd_create\",\n    \"memfd_secret\",\n    \"mincore\",\n    \"mkdir\",\n    \"mkdirat\",\n    \"mknod\",\n    \"mknodat\",\n    \"mlock\",\n    \"mlock2\",\n    \"mlockall\",\n    \"mmap\",\n    \"mmap2\",\n    \"mprotect\",\n    \"mq_getsetattr\",\n    \"mq_notify\",\n    \"mq_open\",\n    \"mq_timedreceive\",\n    \"mq_timedreceive_time64\",\n    \"mq_timedsend\",\n    \"mq_timedsend_time64\",\n    \"mq_unlink\",\n    \"mremap\",\n    \"mseal\",\n    \"msgctl\",\n    \"msgget\",\n    \"msgrcv\",\n    \"msgsnd\",\n    \"msync\",\n    \"munlock\",\n    \"munlockall\",\n    \"munmap\",\n    \"name_to_handle_at\",\n    \"nanosleep\",\n    \"newfstatat\",\n    \"_newselect\",\n    \"open\",\n    \"openat\",\n    \"openat2\",\n    \"pause\",\n    \"pidfd_open\",\n    \"pidfd_send_signal\",\n    \"pipe\",\n    \"pipe2\",\n    \"pkey_alloc\",\n    \"pkey_free\",\n    \"pkey_mprotect\",\n    \"poll\",\n    \"ppoll\",\n    \"ppoll_time64\",\n    \"prctl\",\n    \"pread64\",\n    \"preadv\",\n    \"preadv2\",\n    \"prlimit64\",\n    \"process_mrelease\",\n    \"pselect6\",\n    \"pselect6_time64\",\n    \"pwrite64\",\n    \"pwritev\",\n    \"pwritev2\",\n    \"read\",\n    \"readahead\",\n    \"readlink\",\n    \"readlinkat\",\n    \"readv\",\n    \"recv\",\n    \"recvfrom\",\n    \"recvmmsg\",\n    \"recvmmsg_time64\",\n    \"recvmsg\",\n    \"remap_file_pages\",\n    \"removexattr\",\n    \"removexattrat\",\n    \"rename\",\n    \"renameat\",\n    \"renameat2\",\n    \"restart_syscall\",\n    \"riscv_hwprobe\",\n    \"rmdir\",\n    \"rseq\",\n    \"rt_sigaction\",\n    \"rt_sigpending\",\n    \"rt_sigprocmask\",\n    \"rt_sigqueueinfo\",\n    \"rt_sigreturn\",\n    \"rt_sigsuspend\",\n    \"rt_sigtimedwait\",\n    \"rt_sigtimedwait_time64\",\n    \"rt_tgsigqueueinfo\",\n    \"sched_getaffinity\",\n    \"sched_getattr\",\n    \"sched_getparam\",\n    \"sched_get_priority_max\",\n    \"sched_get_priority_min\",\n    \"sched_getscheduler\",\n    \"sched_rr_get_interval\",\n    \"sched_rr_get_interval_time64\",\n    \"sched_setaffinity\",\n    \"sched_setattr\",\n    \"sched_setparam\",\n    \"sched_setscheduler\",\n    \"sched_yield\",\n    \"seccomp\",\n    \"select\",\n    \"semctl\",\n    \"semget\",\n    \"semop\",\n    \"semtimedop\",\n    \"semtimedop_time64\",\n    \"send\",\n    \"sendfile\",\n    \"sendfile64\",\n    \"sendmmsg\",\n    \"sendmsg\",\n    \"sendto\",\n    \"setfsgid\",\n    \"setfsgid32\",\n    \"setfsuid\",\n    \"setfsuid32\",\n    \"setgid\",\n    \"setgid32\",\n    \"setgroups\",\n    \"setgroups32\",\n    \"setitimer\",\n    \"setpgid\",\n    \"setpriority\",\n    \"setregid\",\n    \"setregid32\",\n    \"setresgid\",\n    \"setresgid32\",\n    \"setresuid\",\n    \"setresuid32\",\n    \"setreuid\",\n    \"setreuid32\",\n    \"setrlimit\",\n    \"set_robust_list\",\n    \"setsid\",\n    \"setsockopt\",\n    \"set_thread_area\",\n    \"set_tid_address\",\n    \"setuid\",\n    \"setuid32\",\n    \"setxattr\",\n    \"setxattrat\",\n    \"shmat\",\n    \"shmctl\",\n    \"shmdt\",\n    \"shmget\",\n    \"shutdown\",\n    \"sigaltstack\",\n    \"signalfd\",\n    \"signalfd4\",\n    \"sigprocmask\",\n    \"sigreturn\",\n    \"socketcall\",\n    \"socketpair\",\n    \"splice\",\n    \"stat\",\n    \"stat64\",\n    \"statfs\",\n    \"statfs64\",\n    \"statmount\",\n    \"statx\",\n    \"symlink\",\n    \"symlinkat\",\n    \"sync\",\n    \"sync_file_range\",\n    \"syncfs\",\n    \"sysinfo\",\n    \"tee\",\n    \"tgkill\",\n    \"time\",\n    \"timer_create\",\n    \"timer_delete\",\n    \"timer_getoverrun\",\n    \"timer_gettime\",\n    \"timer_gettime64\",\n    \"timer_settime\",\n    \"timer_settime64\",\n    \"timerfd_create\",\n    \"timerfd_gettime\",\n    \"timerfd_gettime64\",\n    \"timerfd_settime\",\n    \"timerfd_settime64\",\n    \"times\",\n    \"tkill\",\n    \"truncate\",\n    \"truncate64\",\n    \"ugetrlimit\",\n    \"umask\",\n    \"uname\",\n    \"unlink\",\n    \"unlinkat\",\n    \"uretprobe\",\n    \"utime\",\n    \"utimensat\",\n    \"utimensat_time64\",\n    \"utimes\",\n    \"vfork\",\n    \"vmsplice\",\n    \"wait4\",\n    \"waitid\",\n    \"waitpid\",\n    \"write\",\n    \"writev\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\"\n  },\n  {\n   \"names\": [\n    \"process_vm_readv\",\n    \"process_vm_writev\",\n    \"ptrace\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"minKernel\": \"4.8\"\n   }\n  },\n  {\n   \"names\": [\n    \"socket\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"args\": [\n    {\n     \"index\": 0,\n     \"value\": 38,\n     \"op\": \"SCMP_CMP_LT\"\n    }\n   ]\n  },\n  {\n   \"names\": [\n    \"socket\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"args\": [\n    {\n     \"index\": 0,\n     \"value\": 39,\n     \"op\": \"SCMP_CMP_EQ\"\n    }\n   ]\n  },\n  {\n   \"names\": [\n    \"socket\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"args\": [\n    {\n     \"index\": 0,\n     \"value\": 41,\n     \"op\": \"SCMP_CMP_EQ\"\n    }\n   ]\n  },\n  {\n   \"names\": [\n    \"socket\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"args\": [\n    {\n     \"index\": 0,\n     \"value\": 42,\n     \"op\": \"SCMP_CMP_EQ\"\n    }\n   ]\n  },\n  {\n   \"names\": [\n    \"socket\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"args\": [\n    {\n     \"index\": 0,\n     \"value\": 43,\n     \"op\": \"SCMP_CMP_EQ\"\n    }\n   ]\n  },\n  {\n   \"names\": [\n    \"socket\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"args\": [\n    {\n     \"index\": 0,\n     \"value\": 44,\n     \"op\": \"SCMP_CMP_EQ\"\n    }\n   ]\n  },\n  {\n   \"names\": [\n    \"socket\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"args\": [\n    {\n     \"index\": 0,\n     \"value\": 45,\n     \"op\": \"SCMP_CMP_EQ\"\n    }\n   ]\n  },\n  {\n   \"names\": [\n    \"personality\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"args\": [\n    {\n     \"index\": 0,\n     \"value\": 0,\n     \"op\": \"SCMP_CMP_EQ\"\n    }\n   ]\n  },\n  {\n   \"names\": [\n    \"personality\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"args\": [\n    {\n     \"index\": 0,\n     \"value\": 8,\n     \"op\": \"SCMP_CMP_EQ\"\n    }\n   ]\n  },\n  {\n   \"names\": [\n    \"personality\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"args\": [\n    {\n     \"index\": 0,\n     \"value\": 131072,\n     \"op\": \"SCMP_CMP_EQ\"\n    }\n   ]\n  },\n  {\n   \"names\": [\n    \"personality\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"args\": [\n    {\n     \"index\": 0,\n     \"value\": 131080,\n     \"op\": \"SCMP_CMP_EQ\"\n    }\n   ]\n  },\n  {\n   \"names\": [\n    \"personality\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"args\": [\n    {\n     \"index\": 0,\n     \"value\": 4294967295,\n     \"op\": \"SCMP_CMP_EQ\"\n    }\n   ]\n  },\n  {\n   \"names\": [\n    \"sync_file_range2\",\n    \"swapcontext\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"arches\": [\n     \"ppc64le\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"arm_fadvise64_64\",\n    \"arm_sync_file_range\",\n    \"sync_file_range2\",\n    \"breakpoint\",\n    \"cacheflush\",\n    \"set_tls\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"arches\": [\n     \"arm\",\n     \"arm64\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"arch_prctl\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"arches\": [\n     \"amd64\",\n     \"x32\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"modify_ldt\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"arches\": [\n     \"amd64\",\n     \"x32\",\n     \"x86\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"s390_pci_mmio_read\",\n    \"s390_pci_mmio_write\",\n    \"s390_runtime_instr\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"arches\": [\n     \"s390\",\n     \"s390x\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"riscv_flush_icache\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"arches\": [\n     \"riscv64\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"open_by_handle_at\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"caps\": [\n     \"CAP_DAC_READ_SEARCH\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"bpf\",\n    \"clone\",\n    \"clone3\",\n    \"fanotify_init\",\n    \"fsconfig\",\n    \"fsmount\",\n    \"fsopen\",\n    \"fspick\",\n    \"lookup_dcookie\",\n    \"lsm_get_self_attr\",\n    \"lsm_list_modules\",\n    \"lsm_set_self_attr\",\n    \"mount\",\n    \"mount_setattr\",\n    \"move_mount\",\n    \"open_tree\",\n    \"perf_event_open\",\n    \"quotactl\",\n    \"quotactl_fd\",\n    \"setdomainname\",\n    \"sethostname\",\n    \"setns\",\n    \"syslog\",\n    \"umount\",\n    \"umount2\",\n    \"unshare\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"caps\": [\n     \"CAP_SYS_ADMIN\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"clone\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"args\": [\n    {\n     \"index\": 0,\n     \"value\": 2114060288,\n     \"op\": \"SCMP_CMP_MASKED_EQ\"\n    }\n   ],\n   \"excludes\": {\n    \"caps\": [\n     \"CAP_SYS_ADMIN\"\n    ],\n    \"arches\": [\n     \"s390\",\n     \"s390x\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"clone\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"args\": [\n    {\n     \"index\": 1,\n     \"value\": 2114060288,\n     \"op\": \"SCMP_CMP_MASKED_EQ\"\n    }\n   ],\n   \"comment\": \"s390 parameter ordering for clone is different\",\n   \"includes\": {\n    \"arches\": [\n     \"s390\",\n     \"s390x\"\n    ]\n   },\n   \"excludes\": {\n    \"caps\": [\n     \"CAP_SYS_ADMIN\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"reboot\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"caps\": [\n     \"CAP_SYS_BOOT\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"chroot\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"caps\": [\n     \"CAP_SYS_CHROOT\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"delete_module\",\n    \"init_module\",\n    \"finit_module\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"caps\": [\n     \"CAP_SYS_MODULE\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"acct\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"caps\": [\n     \"CAP_SYS_PACCT\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"kcmp\",\n    \"pidfd_getfd\",\n    \"process_madvise\",\n    \"process_vm_readv\",\n    \"process_vm_writev\",\n    \"ptrace\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"caps\": [\n     \"CAP_SYS_PTRACE\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"iopl\",\n    \"ioperm\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"caps\": [\n     \"CAP_SYS_RAWIO\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"settimeofday\",\n    \"stime\",\n    \"clock_settime\",\n    \"clock_settime64\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"caps\": [\n     \"CAP_SYS_TIME\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"vhangup\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"caps\": [\n     \"CAP_SYS_TTY_CONFIG\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"get_mempolicy\",\n    \"mbind\",\n    \"set_mempolicy\",\n    \"set_mempolicy_home_node\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"caps\": [\n     \"CAP_SYS_NICE\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"syslog\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"caps\": [\n     \"CAP_SYSLOG\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"bpf\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"caps\": [\n     \"CAP_BPF\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"perf_event_open\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"caps\": [\n     \"CAP_PERFMON\"\n    ]\n   }\n  }\n ]\n}";

package/dist/shared/daimonGrokSeccompProfile.js

@@ -0,0 +1,11 @@
+/* v8 ignore file -- pinned data module */
+/**
+ * Docker's default seccomp profile plus the seven namespace syscalls bubblewrap
+ * needs without CAP_SYS_ADMIN (clone, clone3, unshare, mount, umount2, pivot_root,
+ * setns): the narrowest profile under which Grok 1.0.34's sandbox starts
+ * (Noopolis P0 container evidence, 2026-09-17). Bytes are pinned by sha256; Daimon's
+ * Grok broker projection and slot preflight receipt bind the same digest.
+ */
+export const DAIMON_GROK_SECCOMP_PROFILE_FILE_NAME = "seccomp-default-plus-userns.json";
+export const DAIMON_GROK_SECCOMP_PROFILE_SHA256 = "9666074d2d6b1a261a410598b9ce1714d9060a6ef4c9c1d1cfb6f8915d7e842a";
+export const DAIMON_GROK_SECCOMP_PROFILE_BYTES = "{\n \"defaultAction\": \"SCMP_ACT_ERRNO\",\n \"defaultErrnoRet\": 1,\n \"archMap\": [\n  {\n   \"architecture\": \"SCMP_ARCH_X86_64\",\n   \"subArchitectures\": [\n    \"SCMP_ARCH_X86\",\n    \"SCMP_ARCH_X32\"\n   ]\n  },\n  {\n   \"architecture\": \"SCMP_ARCH_AARCH64\",\n   \"subArchitectures\": [\n    \"SCMP_ARCH_ARM\"\n   ]\n  },\n  {\n   \"architecture\": \"SCMP_ARCH_MIPS64\",\n   \"subArchitectures\": [\n    \"SCMP_ARCH_MIPS\",\n    \"SCMP_ARCH_MIPS64N32\"\n   ]\n  },\n  {\n   \"architecture\": \"SCMP_ARCH_MIPS64N32\",\n   \"subArchitectures\": [\n    \"SCMP_ARCH_MIPS\",\n    \"SCMP_ARCH_MIPS64\"\n   ]\n  },\n  {\n   \"architecture\": \"SCMP_ARCH_MIPSEL64\",\n   \"subArchitectures\": [\n    \"SCMP_ARCH_MIPSEL\",\n    \"SCMP_ARCH_MIPSEL64N32\"\n   ]\n  },\n  {\n   \"architecture\": \"SCMP_ARCH_MIPSEL64N32\",\n   \"subArchitectures\": [\n    \"SCMP_ARCH_MIPSEL\",\n    \"SCMP_ARCH_MIPSEL64\"\n   ]\n  },\n  {\n   \"architecture\": \"SCMP_ARCH_S390X\",\n   \"subArchitectures\": [\n    \"SCMP_ARCH_S390\"\n   ]\n  },\n  {\n   \"architecture\": \"SCMP_ARCH_RISCV64\",\n   \"subArchitectures\": null\n  },\n  {\n   \"architecture\": \"SCMP_ARCH_LOONGARCH64\",\n   \"subArchitectures\": null\n  }\n ],\n \"syscalls\": [\n  {\n   \"names\": [\n    \"clone\",\n    \"clone3\",\n    \"unshare\",\n    \"mount\",\n    \"umount2\",\n    \"pivot_root\",\n    \"setns\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"comment\": \"P0 spike: userns/mount syscalls bubblewrap needs, without CAP_SYS_ADMIN\"\n  },\n  {\n   \"names\": [\n    \"accept\",\n    \"accept4\",\n    \"access\",\n    \"adjtimex\",\n    \"alarm\",\n    \"bind\",\n    \"brk\",\n    \"cachestat\",\n    \"capget\",\n    \"capset\",\n    \"chdir\",\n    \"chmod\",\n    \"chown\",\n    \"chown32\",\n    \"clock_adjtime\",\n    \"clock_adjtime64\",\n    \"clock_getres\",\n    \"clock_getres_time64\",\n    \"clock_gettime\",\n    \"clock_gettime64\",\n    \"clock_nanosleep\",\n    \"clock_nanosleep_time64\",\n    \"close\",\n    \"close_range\",\n    \"connect\",\n    \"copy_file_range\",\n    \"creat\",\n    \"dup\",\n    \"dup2\",\n    \"dup3\",\n    \"epoll_create\",\n    \"epoll_create1\",\n    \"epoll_ctl\",\n    \"epoll_ctl_old\",\n    \"epoll_pwait\",\n    \"epoll_pwait2\",\n    \"epoll_wait\",\n    \"epoll_wait_old\",\n    \"eventfd\",\n    \"eventfd2\",\n    \"execve\",\n    \"execveat\",\n    \"exit\",\n    \"exit_group\",\n    \"faccessat\",\n    \"faccessat2\",\n    \"fadvise64\",\n    \"fadvise64_64\",\n    \"fallocate\",\n    \"fanotify_mark\",\n    \"fchdir\",\n    \"fchmod\",\n    \"fchmodat\",\n    \"fchmodat2\",\n    \"fchown\",\n    \"fchown32\",\n    \"fchownat\",\n    \"fcntl\",\n    \"fcntl64\",\n    \"fdatasync\",\n    \"fgetxattr\",\n    \"flistxattr\",\n    \"flock\",\n    \"fork\",\n    \"fremovexattr\",\n    \"fsetxattr\",\n    \"fstat\",\n    \"fstat64\",\n    \"fstatat64\",\n    \"fstatfs\",\n    \"fstatfs64\",\n    \"fsync\",\n    \"ftruncate\",\n    \"ftruncate64\",\n    \"futex\",\n    \"futex_requeue\",\n    \"futex_time64\",\n    \"futex_wait\",\n    \"futex_waitv\",\n    \"futex_wake\",\n    \"futimesat\",\n    \"getcpu\",\n    \"getcwd\",\n    \"getdents\",\n    \"getdents64\",\n    \"getegid\",\n    \"getegid32\",\n    \"geteuid\",\n    \"geteuid32\",\n    \"getgid\",\n    \"getgid32\",\n    \"getgroups\",\n    \"getgroups32\",\n    \"getitimer\",\n    \"getpeername\",\n    \"getpgid\",\n    \"getpgrp\",\n    \"getpid\",\n    \"getppid\",\n    \"getpriority\",\n    \"getrandom\",\n    \"getresgid\",\n    \"getresgid32\",\n    \"getresuid\",\n    \"getresuid32\",\n    \"getrlimit\",\n    \"get_robust_list\",\n    \"getrusage\",\n    \"getsid\",\n    \"getsockname\",\n    \"getsockopt\",\n    \"get_thread_area\",\n    \"gettid\",\n    \"gettimeofday\",\n    \"getuid\",\n    \"getuid32\",\n    \"getxattr\",\n    \"getxattrat\",\n    \"inotify_add_watch\",\n    \"inotify_init\",\n    \"inotify_init1\",\n    \"inotify_rm_watch\",\n    \"io_cancel\",\n    \"ioctl\",\n    \"io_destroy\",\n    \"io_getevents\",\n    \"io_pgetevents\",\n    \"io_pgetevents_time64\",\n    \"ioprio_get\",\n    \"ioprio_set\",\n    \"io_setup\",\n    \"io_submit\",\n    \"ipc\",\n    \"kill\",\n    \"landlock_add_rule\",\n    \"landlock_create_ruleset\",\n    \"landlock_restrict_self\",\n    \"lchown\",\n    \"lchown32\",\n    \"lgetxattr\",\n    \"link\",\n    \"linkat\",\n    \"listen\",\n    \"listmount\",\n    \"listxattr\",\n    \"listxattrat\",\n    \"llistxattr\",\n    \"_llseek\",\n    \"lremovexattr\",\n    \"lseek\",\n    \"lsetxattr\",\n    \"lstat\",\n    \"lstat64\",\n    \"madvise\",\n    \"map_shadow_stack\",\n    \"membarrier\",\n    \"memfd_create\",\n    \"memfd_secret\",\n    \"mincore\",\n    \"mkdir\",\n    \"mkdirat\",\n    \"mknod\",\n    \"mknodat\",\n    \"mlock\",\n    \"mlock2\",\n    \"mlockall\",\n    \"mmap\",\n    \"mmap2\",\n    \"mprotect\",\n    \"mq_getsetattr\",\n    \"mq_notify\",\n    \"mq_open\",\n    \"mq_timedreceive\",\n    \"mq_timedreceive_time64\",\n    \"mq_timedsend\",\n    \"mq_timedsend_time64\",\n    \"mq_unlink\",\n    \"mremap\",\n    \"mseal\",\n    \"msgctl\",\n    \"msgget\",\n    \"msgrcv\",\n    \"msgsnd\",\n    \"msync\",\n    \"munlock\",\n    \"munlockall\",\n    \"munmap\",\n    \"name_to_handle_at\",\n    \"nanosleep\",\n    \"newfstatat\",\n    \"_newselect\",\n    \"open\",\n    \"openat\",\n    \"openat2\",\n    \"pause\",\n    \"pidfd_open\",\n    \"pidfd_send_signal\",\n    \"pipe\",\n    \"pipe2\",\n    \"pkey_alloc\",\n    \"pkey_free\",\n    \"pkey_mprotect\",\n    \"poll\",\n    \"ppoll\",\n    \"ppoll_time64\",\n    \"prctl\",\n    \"pread64\",\n    \"preadv\",\n    \"preadv2\",\n    \"prlimit64\",\n    \"process_mrelease\",\n    \"pselect6\",\n    \"pselect6_time64\",\n    \"pwrite64\",\n    \"pwritev\",\n    \"pwritev2\",\n    \"read\",\n    \"readahead\",\n    \"readlink\",\n    \"readlinkat\",\n    \"readv\",\n    \"recv\",\n    \"recvfrom\",\n    \"recvmmsg\",\n    \"recvmmsg_time64\",\n    \"recvmsg\",\n    \"remap_file_pages\",\n    \"removexattr\",\n    \"removexattrat\",\n    \"rename\",\n    \"renameat\",\n    \"renameat2\",\n    \"restart_syscall\",\n    \"riscv_hwprobe\",\n    \"rmdir\",\n    \"rseq\",\n    \"rt_sigaction\",\n    \"rt_sigpending\",\n    \"rt_sigprocmask\",\n    \"rt_sigqueueinfo\",\n    \"rt_sigreturn\",\n    \"rt_sigsuspend\",\n    \"rt_sigtimedwait\",\n    \"rt_sigtimedwait_time64\",\n    \"rt_tgsigqueueinfo\",\n    \"sched_getaffinity\",\n    \"sched_getattr\",\n    \"sched_getparam\",\n    \"sched_get_priority_max\",\n    \"sched_get_priority_min\",\n    \"sched_getscheduler\",\n    \"sched_rr_get_interval\",\n    \"sched_rr_get_interval_time64\",\n    \"sched_setaffinity\",\n    \"sched_setattr\",\n    \"sched_setparam\",\n    \"sched_setscheduler\",\n    \"sched_yield\",\n    \"seccomp\",\n    \"select\",\n    \"semctl\",\n    \"semget\",\n    \"semop\",\n    \"semtimedop\",\n    \"semtimedop_time64\",\n    \"send\",\n    \"sendfile\",\n    \"sendfile64\",\n    \"sendmmsg\",\n    \"sendmsg\",\n    \"sendto\",\n    \"setfsgid\",\n    \"setfsgid32\",\n    \"setfsuid\",\n    \"setfsuid32\",\n    \"setgid\",\n    \"setgid32\",\n    \"setgroups\",\n    \"setgroups32\",\n    \"setitimer\",\n    \"setpgid\",\n    \"setpriority\",\n    \"setregid\",\n    \"setregid32\",\n    \"setresgid\",\n    \"setresgid32\",\n    \"setresuid\",\n    \"setresuid32\",\n    \"setreuid\",\n    \"setreuid32\",\n    \"setrlimit\",\n    \"set_robust_list\",\n    \"setsid\",\n    \"setsockopt\",\n    \"set_thread_area\",\n    \"set_tid_address\",\n    \"setuid\",\n    \"setuid32\",\n    \"setxattr\",\n    \"setxattrat\",\n    \"shmat\",\n    \"shmctl\",\n    \"shmdt\",\n    \"shmget\",\n    \"shutdown\",\n    \"sigaltstack\",\n    \"signalfd\",\n    \"signalfd4\",\n    \"sigprocmask\",\n    \"sigreturn\",\n    \"socketcall\",\n    \"socketpair\",\n    \"splice\",\n    \"stat\",\n    \"stat64\",\n    \"statfs\",\n    \"statfs64\",\n    \"statmount\",\n    \"statx\",\n    \"symlink\",\n    \"symlinkat\",\n    \"sync\",\n    \"sync_file_range\",\n    \"syncfs\",\n    \"sysinfo\",\n    \"tee\",\n    \"tgkill\",\n    \"time\",\n    \"timer_create\",\n    \"timer_delete\",\n    \"timer_getoverrun\",\n    \"timer_gettime\",\n    \"timer_gettime64\",\n    \"timer_settime\",\n    \"timer_settime64\",\n    \"timerfd_create\",\n    \"timerfd_gettime\",\n    \"timerfd_gettime64\",\n    \"timerfd_settime\",\n    \"timerfd_settime64\",\n    \"times\",\n    \"tkill\",\n    \"truncate\",\n    \"truncate64\",\n    \"ugetrlimit\",\n    \"umask\",\n    \"uname\",\n    \"unlink\",\n    \"unlinkat\",\n    \"uretprobe\",\n    \"utime\",\n    \"utimensat\",\n    \"utimensat_time64\",\n    \"utimes\",\n    \"vfork\",\n    \"vmsplice\",\n    \"wait4\",\n    \"waitid\",\n    \"waitpid\",\n    \"write\",\n    \"writev\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\"\n  },\n  {\n   \"names\": [\n    \"process_vm_readv\",\n    \"process_vm_writev\",\n    \"ptrace\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"minKernel\": \"4.8\"\n   }\n  },\n  {\n   \"names\": [\n    \"socket\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"args\": [\n    {\n     \"index\": 0,\n     \"value\": 38,\n     \"op\": \"SCMP_CMP_LT\"\n    }\n   ]\n  },\n  {\n   \"names\": [\n    \"socket\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"args\": [\n    {\n     \"index\": 0,\n     \"value\": 39,\n     \"op\": \"SCMP_CMP_EQ\"\n    }\n   ]\n  },\n  {\n   \"names\": [\n    \"socket\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"args\": [\n    {\n     \"index\": 0,\n     \"value\": 41,\n     \"op\": \"SCMP_CMP_EQ\"\n    }\n   ]\n  },\n  {\n   \"names\": [\n    \"socket\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"args\": [\n    {\n     \"index\": 0,\n     \"value\": 42,\n     \"op\": \"SCMP_CMP_EQ\"\n    }\n   ]\n  },\n  {\n   \"names\": [\n    \"socket\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"args\": [\n    {\n     \"index\": 0,\n     \"value\": 43,\n     \"op\": \"SCMP_CMP_EQ\"\n    }\n   ]\n  },\n  {\n   \"names\": [\n    \"socket\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"args\": [\n    {\n     \"index\": 0,\n     \"value\": 44,\n     \"op\": \"SCMP_CMP_EQ\"\n    }\n   ]\n  },\n  {\n   \"names\": [\n    \"socket\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"args\": [\n    {\n     \"index\": 0,\n     \"value\": 45,\n     \"op\": \"SCMP_CMP_EQ\"\n    }\n   ]\n  },\n  {\n   \"names\": [\n    \"personality\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"args\": [\n    {\n     \"index\": 0,\n     \"value\": 0,\n     \"op\": \"SCMP_CMP_EQ\"\n    }\n   ]\n  },\n  {\n   \"names\": [\n    \"personality\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"args\": [\n    {\n     \"index\": 0,\n     \"value\": 8,\n     \"op\": \"SCMP_CMP_EQ\"\n    }\n   ]\n  },\n  {\n   \"names\": [\n    \"personality\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"args\": [\n    {\n     \"index\": 0,\n     \"value\": 131072,\n     \"op\": \"SCMP_CMP_EQ\"\n    }\n   ]\n  },\n  {\n   \"names\": [\n    \"personality\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"args\": [\n    {\n     \"index\": 0,\n     \"value\": 131080,\n     \"op\": \"SCMP_CMP_EQ\"\n    }\n   ]\n  },\n  {\n   \"names\": [\n    \"personality\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"args\": [\n    {\n     \"index\": 0,\n     \"value\": 4294967295,\n     \"op\": \"SCMP_CMP_EQ\"\n    }\n   ]\n  },\n  {\n   \"names\": [\n    \"sync_file_range2\",\n    \"swapcontext\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"arches\": [\n     \"ppc64le\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"arm_fadvise64_64\",\n    \"arm_sync_file_range\",\n    \"sync_file_range2\",\n    \"breakpoint\",\n    \"cacheflush\",\n    \"set_tls\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"arches\": [\n     \"arm\",\n     \"arm64\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"arch_prctl\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"arches\": [\n     \"amd64\",\n     \"x32\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"modify_ldt\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"arches\": [\n     \"amd64\",\n     \"x32\",\n     \"x86\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"s390_pci_mmio_read\",\n    \"s390_pci_mmio_write\",\n    \"s390_runtime_instr\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"arches\": [\n     \"s390\",\n     \"s390x\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"riscv_flush_icache\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"arches\": [\n     \"riscv64\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"open_by_handle_at\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"caps\": [\n     \"CAP_DAC_READ_SEARCH\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"bpf\",\n    \"clone\",\n    \"clone3\",\n    \"fanotify_init\",\n    \"fsconfig\",\n    \"fsmount\",\n    \"fsopen\",\n    \"fspick\",\n    \"lookup_dcookie\",\n    \"lsm_get_self_attr\",\n    \"lsm_list_modules\",\n    \"lsm_set_self_attr\",\n    \"mount\",\n    \"mount_setattr\",\n    \"move_mount\",\n    \"open_tree\",\n    \"perf_event_open\",\n    \"quotactl\",\n    \"quotactl_fd\",\n    \"setdomainname\",\n    \"sethostname\",\n    \"setns\",\n    \"syslog\",\n    \"umount\",\n    \"umount2\",\n    \"unshare\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"caps\": [\n     \"CAP_SYS_ADMIN\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"clone\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"args\": [\n    {\n     \"index\": 0,\n     \"value\": 2114060288,\n     \"op\": \"SCMP_CMP_MASKED_EQ\"\n    }\n   ],\n   \"excludes\": {\n    \"caps\": [\n     \"CAP_SYS_ADMIN\"\n    ],\n    \"arches\": [\n     \"s390\",\n     \"s390x\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"clone\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"args\": [\n    {\n     \"index\": 1,\n     \"value\": 2114060288,\n     \"op\": \"SCMP_CMP_MASKED_EQ\"\n    }\n   ],\n   \"comment\": \"s390 parameter ordering for clone is different\",\n   \"includes\": {\n    \"arches\": [\n     \"s390\",\n     \"s390x\"\n    ]\n   },\n   \"excludes\": {\n    \"caps\": [\n     \"CAP_SYS_ADMIN\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"reboot\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"caps\": [\n     \"CAP_SYS_BOOT\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"chroot\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"caps\": [\n     \"CAP_SYS_CHROOT\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"delete_module\",\n    \"init_module\",\n    \"finit_module\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"caps\": [\n     \"CAP_SYS_MODULE\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"acct\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"caps\": [\n     \"CAP_SYS_PACCT\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"kcmp\",\n    \"pidfd_getfd\",\n    \"process_madvise\",\n    \"process_vm_readv\",\n    \"process_vm_writev\",\n    \"ptrace\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"caps\": [\n     \"CAP_SYS_PTRACE\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"iopl\",\n    \"ioperm\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"caps\": [\n     \"CAP_SYS_RAWIO\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"settimeofday\",\n    \"stime\",\n    \"clock_settime\",\n    \"clock_settime64\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"caps\": [\n     \"CAP_SYS_TIME\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"vhangup\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"caps\": [\n     \"CAP_SYS_TTY_CONFIG\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"get_mempolicy\",\n    \"mbind\",\n    \"set_mempolicy\",\n    \"set_mempolicy_home_node\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"caps\": [\n     \"CAP_SYS_NICE\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"syslog\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"caps\": [\n     \"CAP_SYSLOG\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"bpf\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"caps\": [\n     \"CAP_BPF\"\n    ]\n   }\n  },\n  {\n   \"names\": [\n    \"perf_event_open\"\n   ],\n   \"action\": \"SCMP_ACT_ALLOW\",\n   \"includes\": {\n    \"caps\": [\n     \"CAP_PERFMON\"\n    ]\n   }\n  }\n ]\n}";

package/dist/shared/index.d.ts

@@ -1,4 +1,7 @@
 export * from "./constants.js";
 export * from "./errors.js";
+export * from "./recording.js";
 export * from "./redaction.js";
 export * from "./types.js";
+export * from "./volumeNames.js";
+export * from "./daimonCodexDocker.js";

package/dist/shared/index.js

@@ -1,4 +1,7 @@
 export * from "./constants.js";
 export * from "./errors.js";
+export * from "./recording.js";
 export * from "./redaction.js";
 export * from "./types.js";
+export * from "./volumeNames.js";
+export * from "./daimonCodexDocker.js";

package/dist/shared/recording.d.ts

@@ -0,0 +1,8 @@
+export declare const DEFAULT_RECORD_KEEP_MS: number;
+/** Absence disables recording; an empty declaration opts into the default window. */
+export declare const recordingKeepMs: (record: {
+    keep?: string;
+} | undefined) => number | undefined;
+export declare const maxRecordingKeepMs: (records: Iterable<{
+    keep?: string;
+} | undefined>) => number | undefined;

package/dist/shared/recording.js

@@ -0,0 +1,25 @@
+import { SpawnfileError } from "./errors.js";
+export const DEFAULT_RECORD_KEEP_MS = 30 * 24 * 60 * 60_000;
+/** Absence disables recording; an empty declaration opts into the default window. */
+export const recordingKeepMs = (record) => {
+    if (record === undefined)
+        return undefined;
+    if (record.keep === undefined)
+        return DEFAULT_RECORD_KEEP_MS;
+    const match = /^([1-9][0-9]*)([mhd])$/u.exec(record.keep);
+    const factors = { m: 60_000, h: 60 * 60_000, d: 24 * 60 * 60_000 };
+    const milliseconds = match ? Number(match[1]) * factors[match[2]] : NaN;
+    if (!Number.isSafeInteger(milliseconds) || milliseconds <= 0) {
+        throw new SpawnfileError("validation_error", "record.keep must be a safe positive duration matching ^[1-9][0-9]*[mhd]$");
+    }
+    return milliseconds;
+};
+export const maxRecordingKeepMs = (records) => {
+    let maximum;
+    for (const record of records) {
+        const keep = recordingKeepMs(record);
+        if (keep !== undefined)
+            maximum = Math.max(maximum ?? 0, keep);
+    }
+    return maximum;
+};

package/dist/shared/types.d.ts

@@ -1,6 +1,6 @@
 export type JsonPrimitive = boolean | null | number | string;
 export type JsonValue = JsonObject | JsonPrimitive | JsonValue[];
-export type ModelAuthMethod = "api_key" | "claude-code" | "codex" | "none";
+export type ModelAuthMethod = "api_key" | "claude-code" | "codex" | "grok" | "none";
 export type ModelEndpointCompatibility = "anthropic" | "openai";
 export type RuntimeLifecycleStatus = "active" | "deprecated" | "exploratory";
 export interface JsonObject {

package/dist/shared/volumeNames.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Host-stable name for state that must be reattached, never cloned, across
+ * run and deployment identities. The mount id is compiler-owned and the
+ * digest prevents normalization collisions.
+ */
+export declare const createExclusiveReattachVolumeName: (lineage: string, mountId: string) => string;

package/dist/shared/volumeNames.js

@@ -0,0 +1,14 @@
+import { createHash } from "node:crypto";
+/**
+ * Host-stable name for state that must be reattached, never cloned, across
+ * run and deployment identities. The mount id is compiler-owned and the
+ * digest prevents normalization collisions.
+ */
+export const createExclusiveReattachVolumeName = (lineage, mountId) => {
+    const safe = mountId
+        .replace(/[^A-Za-z0-9_.-]+/gu, "-")
+        .replace(/^-+|-+$/gu, "")
+        .slice(0, 48) || "realm";
+    const digest = createHash("sha256").update(lineage, "utf8").update("\0").update(mountId, "utf8").digest("hex").slice(0, 16);
+    return `spawnfile-exclusive-${safe}-${digest}`;
+};

package/dist/target/dockerArtifactsProvider.js

@@ -10,6 +10,7 @@ const MAX_OUTPUT_BYTES = 32_768;
 const MAX_REPOSITORY_BYTES = 255;
 const MAX_REFERENCE_BYTES = MAX_REPOSITORY_BYTES + 72;
 const MAX_IDENTITY_BYTES = 262_144;
+const IDENTITY_RETRY_ATTEMPTS = 64;
 const DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/u;
 const PORT_PATTERN = /^[1-9][0-9]{0,4}$/u;
 const NAME_COMPONENT_PATTERN = /^[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*$/u;
@@ -282,7 +283,9 @@ const openSecureIdentity = async (filePath) => {
 };
 const openIdentity = async (filePath, links) => {
     const value = await openSecureIdentity(filePath);
-    if (value !== null && !links.includes(value.nlink))
+    if (value === null || value.nlink === 0)
+        return null;
+    if (!links.includes(value.nlink))
         return fail();
     return value;
 };
@@ -295,6 +298,12 @@ const syncDirectory = async (directory) => {
         await handle.close();
     }
 };
+const retryTurn = (attempt) => new Promise((resolve) => {
+    if ((attempt + 1) % 8 === 0)
+        setTimeout(resolve, 1);
+    else
+        setImmediate(resolve);
+});
 /* One canonical immutable record exists for one exact operation/request pair. */
 const keyPath = (root, operationHandle, requestDigest) => path.join(root, `${digest("identity-operation", `${operationHandle}\0${requestDigest}`)}.identity.json`);
 const pendingPath = (file) => path.join(path.dirname(file), `.${path.basename(file)}.pending`);
@@ -308,7 +317,7 @@ const sameInode = (left, right) => left.dev === right.dev && left.ino === right.
  * what makes unlink-after-same-inode-proof safe here.
  */
 const reconcilePublishedIdentity = async (root, file, expected) => {
-    for (let attempt = 0; attempt < 16; attempt += 1) {
+    for (let attempt = 0; attempt < IDENTITY_RETRY_ATTEMPTS; attempt += 1) {
         const final = await openIdentity(file, [1, 2]);
         if (!final || final.bytes !== expected)
             return fail();
@@ -316,15 +325,24 @@ const reconcilePublishedIdentity = async (root, file, expected) => {
         if (final.nlink === 1) {
             if (pending === null)
                 return;
-            if (pending.bytes !== expected)
+            if (pending.bytes !== expected) {
+                if (pending.nlink === 1 && expected.startsWith(pending.bytes)) {
+                    await retryTurn(attempt);
+                    continue;
+                }
                 return fail();
-            if (pending.nlink !== 1)
+            }
+            if (pending.nlink !== 1) {
+                await retryTurn(attempt);
                 continue;
+            }
         }
         else {
             /* A concurrent unlink can make a just-read two-link final become one-link. */
-            if (pending === null || pending.nlink !== 2)
+            if (pending === null || pending.nlink !== 2) {
+                await retryTurn(attempt);
                 continue;
+            }
             if (!sameInode(final, pending) || pending.bytes !== expected)
                 return fail();
         }
@@ -337,6 +355,7 @@ const reconcilePublishedIdentity = async (root, file, expected) => {
             return fail();
         if (await openIdentity(pendingPath(file), [1]) === null)
             return;
+        await retryTurn(attempt);
     }
     return fail();
 };
@@ -357,7 +376,7 @@ const exactPublishedIdentity = async (root, file, content) => {
 };
 const publishIdentity = async (root, file, content, options) => {
     const pending = pendingPath(file);
-    for (let attempt = 0; attempt < 16; attempt += 1) {
+    for (let attempt = 0; attempt < IDENTITY_RETRY_ATTEMPTS; attempt += 1) {
         if (await exactPublishedIdentity(root, file, content))
             return;
         let created = false;
@@ -385,13 +404,20 @@ const publishIdentity = async (root, file, content, options) => {
         if (pendingRecord === null) {
             if (await exactPublishedIdentity(root, file, content))
                 return;
+            await retryTurn(attempt);
             continue;
         }
-        if (pendingRecord.bytes !== content)
+        if (pendingRecord.bytes !== content) {
+            if (pendingRecord.nlink === 1 && content.startsWith(pendingRecord.bytes)) {
+                await retryTurn(attempt);
+                continue;
+            }
             return fail();
+        }
         if (pendingRecord.nlink === 2) {
             if (await exactPublishedIdentity(root, file, content))
                 return;
+            await retryTurn(attempt);
             continue;
         }
         if (created)
@@ -409,6 +435,7 @@ const publishIdentity = async (root, file, content, options) => {
         /* EEXIST may mean another exact binder linked first or a final vanished; retry only after an exact proof. */
         if (await exactPublishedIdentity(root, file, content))
             return;
+        await retryTurn(attempt);
     }
     return fail();
 };

package/dist/target/dockerBaseImage.d.ts

@@ -0,0 +1,2 @@
+/** Strict portable image-reference grammar shared by target resolution and local helper setup. */
+export declare const parseDockerBaseImageReference: (raw: unknown) => string | null;

package/dist/target/dockerBaseImage.js

@@ -0,0 +1,11 @@
+import { parseImageReference } from "../distribution/index.js";
+const CONFIG_DIGEST = /^sha256:[a-f0-9]{64}$/u;
+const MAX_REFERENCE_BYTES = 512;
+/** Strict portable image-reference grammar shared by target resolution and local helper setup. */
+export const parseDockerBaseImageReference = (raw) => {
+    if (typeof raw !== "string" || raw !== raw.trim() || raw.includes("\0")
+        || Buffer.byteLength(raw, "utf8") > MAX_REFERENCE_BYTES || CONFIG_DIGEST.test(raw)
+        || parseImageReference(raw) === null)
+        return null;
+    return raw;
+};

package/dist/target/dockerCommandExecutor.d.ts

@@ -5,6 +5,12 @@ import { type DockerSecretExecutor } from "./dockerSecretsProvider.js";
 import { type DockerWorldServiceExecutor } from "./dockerWorldServiceProvider.js";
 import type { DockerEvidenceExportExecutor } from "./evidenceExportProvider.js";
 import { type DockerCommandSpawn } from "./dockerCommandExecutorCore.js";
+export declare const PUBLIC_ARTIFACT_READER_PROGRAM: string;
+/** Private control signal emitted only for an exact missing public path probe. */
+export declare class DockerPublicArtifactNotPresentError extends Error {
+    readonly kind: "not_present";
+    constructor();
+}
 export interface DockerTargetExecutors {
     readonly artifact: DockerArtifactExecutor;
     readonly attachment: DockerOrganizationAttachmentExecutor;
@@ -19,6 +25,11 @@ export interface DockerTargetExecutors {
     readonly secret: DockerSecretExecutor;
     readonly world: DockerWorldServiceExecutor;
 }
+export declare const createPublicArtifactReadCommand: (input: {
+    readonly containerId: string;
+    readonly context: string;
+    readonly path: string;
+}) => string[];
 export interface CreateDockerTargetExecutorsOptions {
     readonly dockerCommand?: string;
     readonly spawn?: DockerCommandSpawn;

package/dist/target/dockerCommandExecutor.js

@@ -5,8 +5,34 @@ import { DockerArtifactProviderError } from "./dockerArtifactsProvider.js";
 import { DockerResourceProviderError } from "./dockerResourcesProvider.js";
 import { DockerSecretProviderError } from "./dockerSecretsProvider.js";
 import { DockerWorldServiceProviderError } from "./dockerWorldServiceProvider.js";
-import { MAX_TARGET_PUBLIC_ARTIFACT_BYTES } from "./publicArtifactSnapshot.js";
+import { MAX_TARGET_PUBLIC_ARTIFACT_BYTES, isTargetPublicArtifactPath } from "./publicArtifactSnapshot.js";
 import { DOCKER_COMMAND_ERROR, DockerCommandFailure, executeDockerCommandCore } from "./dockerCommandExecutorCore.js";
+const PUBLIC_ARTIFACT_NOT_PRESENT_EXIT = 42;
+// The public directory is a separately mounted tmpfs and paths are restricted
+// to direct children.  Open the leaf exactly once with O_NOFOLLOW: no path
+// preflight is permitted because it would turn a replacement into a TOCTOU
+// disclosure.  Only ENOENT from that open denotes the terminal absence state.
+export const PUBLIC_ARTIFACT_READER_PROGRAM = [
+    "import fs from 'node:fs';",
+    "const path = process.argv[1];",
+    "let fd;",
+    "try { fd = fs.openSync(path, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW); }",
+    "catch (error) { process.exitCode = error?.code === 'ENOENT' ? 42 : 43; }",
+    "if (fd !== undefined) {",
+    "  try {",
+    "    if (!fs.fstatSync(fd).isFile()) process.exitCode = 43;",
+    "    else { const chunks = []; let bytes; do { const chunk = Buffer.allocUnsafe(65536); bytes = fs.readSync(fd, chunk); if (bytes) chunks.push(chunk.subarray(0, bytes)); } while (bytes); process.stdout.write(Buffer.concat(chunks)); }",
+    "  } catch { process.exitCode = 43; } finally { fs.closeSync(fd); }",
+    "}"
+].join(" ");
+/** Private control signal emitted only for an exact missing public path probe. */
+export class DockerPublicArtifactNotPresentError extends Error {
+    kind = "not_present";
+    constructor() {
+        super("Target public artifact is not present");
+        this.name = "DockerPublicArtifactNotPresentError";
+    }
+}
 const role = (args) => {
     if (args[0] === "--context") {
         return args.length >= 3 && /^[a-z][a-z0-9_-]{0,63}$/u.test(args[1]) ? args.slice(2) : [];
@@ -19,6 +45,23 @@ const role = (args) => {
     }
     return args;
 };
+const exactPublicArtifactAbsence = (args, error) => {
+    if (!(error instanceof DockerCommandFailure)
+        || error.code !== PUBLIC_ARTIFACT_NOT_PRESENT_EXIT || error.stderr !== ""
+        || error.stdoutBytes !== 0)
+        return undefined;
+    const command = role(args);
+    const path = command[8];
+    if (command.length !== 9
+        || command[0] !== "container" || command[1] !== "exec"
+        || !/^[a-f0-9]{64}$/u.test(command[2])
+        || command[3] !== "/usr/local/bin/node" || command[4] !== "--input-type=module"
+        || command[5] !== "-e" || command[6] !== PUBLIC_ARTIFACT_READER_PROGRAM
+        || command[7] !== "spawnfile-public-artifact-read"
+        || !isTargetPublicArtifactPath(path))
+        return undefined;
+    return new DockerPublicArtifactNotPresentError();
+};
 const exactMissingImageReference = (requested, reported) => {
     if (requested === undefined || reported === requested)
         return reported === requested;
@@ -112,6 +155,11 @@ const classify = (kind, args, error) => {
     }
     return new Error(DOCKER_COMMAND_ERROR);
 };
+export const createPublicArtifactReadCommand = (input) => [
+    "--context", input.context, "container", "exec", input.containerId,
+    "/usr/local/bin/node", "--input-type=module", "-e", PUBLIC_ARTIFACT_READER_PROGRAM,
+    "spawnfile-public-artifact-read", input.path
+];
 const normalizeCommandOptions = (raw, allowStdin) => {
     if (!raw || typeof raw !== "object" || Array.isArray(raw) || nodeTypes.isProxy(raw)
         || Object.getPrototypeOf(raw) !== Object.prototype)
@@ -189,7 +237,10 @@ export const createDockerTargetExecutors = (options = {}) => {
                 });
                 return { bytes: Uint8Array.from(result.stdout) };
             }
-            catch {
+            catch (error) {
+                const absence = exactPublicArtifactAbsence(args, error);
+                if (absence)
+                    throw absence;
                 throw new Error(DOCKER_COMMAND_ERROR);
             }
         },

package/dist/target/dockerCommandExecutorCore.d.ts

@@ -18,7 +18,8 @@ export type DockerCommandSpawn = (file: string, args: readonly string[], options
 export declare class DockerCommandFailure extends Error {
     readonly code: number;
     readonly stderr: string;
-    constructor(code: number, stderr: string);
+    readonly stdoutBytes: number;
+    constructor(code: number, stderr: string, stdoutBytes: number);
 }
 export interface DockerCommandCoreOptions {
     readonly binary: boolean;

package/dist/target/dockerCommandExecutorCore.js

@@ -7,10 +7,12 @@ const FALLBACK_MS = 50;
 export class DockerCommandFailure extends Error {
     code;
     stderr;
-    constructor(code, stderr) {
+    stdoutBytes;
+    constructor(code, stderr, stdoutBytes) {
         super(DOCKER_COMMAND_ERROR);
         this.code = code;
         this.stderr = stderr;
+        this.stdoutBytes = stdoutBytes;
     }
 }
 const ordinaryOptions = (raw) => {
@@ -42,7 +44,7 @@ const ordinaryOptions = (raw) => {
     return true;
 };
 const validate = (file, args, options) => {
-    if (typeof file !== "string" || file.length < 1 || file.length > 128 || file.includes("\0")
+    if (typeof file !== "string" || file.length < 1 || Buffer.byteLength(file, "utf8") > 1_024 || file.includes("\0")
         || Buffer.from(file, "utf8").toString("utf8") !== file
         || !Array.isArray(args) || nodeTypes.isProxy(args)
         || Object.getPrototypeOf(args) !== Array.prototype || args.length > 1_024
@@ -197,7 +199,7 @@ export const executeDockerCommandCore = (spawnCommand, file, args, rawOptions) =
                 return;
             }
             if (closeCode !== 0) {
-                settle(new DockerCommandFailure(closeCode, stderr));
+                settle(new DockerCommandFailure(closeCode, stderr, typeof stdout === "string" ? Buffer.byteLength(stdout, "utf8") : stdout.byteLength));
                 return;
             }
             settle(undefined, { stderr, stdout });

package/dist/target/dockerPublicArtifactSnapshot.d.ts

@@ -1,5 +1,5 @@
-import type { DockerTargetExecutors } from "./dockerCommandExecutor.js";
-import { type TargetPublicArtifactSnapshot } from "./publicArtifactSnapshot.js";
+import { type DockerTargetExecutors } from "./dockerCommandExecutor.js";
+import { type TargetPublicArtifactSnapshotResult } from "./publicArtifactSnapshot.js";
 import { type DockerWorldServiceExecutor } from "./dockerWorldServiceProvider.js";
 import type { WorldServiceAuthorityStore } from "./dockerWorldServiceStore.js";
 export declare const TARGET_PUBLIC_ARTIFACT_SNAPSHOT_ERROR = "Target public artifact snapshot failed";
@@ -12,6 +12,6 @@ export interface DockerPublicArtifactSnapshotOptions {
     readonly timeoutMs: number;
 }
 export interface PublicArtifactSnapshotReader {
-    snapshot(raw: unknown): Promise<TargetPublicArtifactSnapshot>;
+    snapshot(raw: unknown): Promise<TargetPublicArtifactSnapshotResult>;
 }
 export declare const createDockerPublicArtifactSnapshotReader: (options: DockerPublicArtifactSnapshotOptions) => PublicArtifactSnapshotReader;