toolroll 0.9.68 → 0.9.70

package/dist/tool-broker.js

@@ -139,8 +139,8 @@ class LocalServer {
                 return null;
             }
         }
-        const { file, args } = wrap === null ? { file: this.tool.spec.command, args: [...this.tool.spec.args] } : wrap(this.tool.spec.command, this.tool.spec.args);
-        const child = spawn(file, args, { env, ...(this.options.cwd === undefined ? {} : { cwd: this.options.cwd }), stdio: ["pipe", "pipe", "ignore"], detached: process.platform !== "win32" });
+        const { file, args, env: sandboxEnv } = wrap === null ? { file: this.tool.spec.command, args: [...this.tool.spec.args], env: undefined } : wrap(this.tool.spec.command, this.tool.spec.args, this.options.cwd);
+        const child = spawn(file, args, { env: { ...env, ...(sandboxEnv ?? {}) }, ...(this.options.cwd === undefined ? {} : { cwd: this.options.cwd }), stdio: ["pipe", "pipe", "ignore"], detached: process.platform !== "win32" });
         this.child = child;
         this.initialized = false;
         child.stdout?.setEncoding("utf8");

package/dist/tool-launcher.js

@@ -5,23 +5,15 @@
  * against codex-cli 0.156), so nothing rides Codex's environment. A build's
  * launch file names its run's tool broker (tool-broker.ts) and that launch's
  * token, and this process relays stdio to it over HTTP; the tool's own
- * secrets stay in the broker. A launch file naming a local program or a web
- * server with its values is still run as before.
+ * secrets stay in the broker. A launch file naming a local program is refused
+ * (docs/plans/sandbox-parity.md C2): Codex starts this launcher outside its
+ * command sandbox, so a program started here would run unfenced; every local
+ * server runs in the broker, inside the server fence.
  */
-import { spawn } from "node:child_process";
 import { readFileSync } from "node:fs";
 import { createInterface } from "node:readline";
-function runLocal(spec, values) {
-    const child = spawn(spec.command, spec.args, { env: { ...process.env, ...values }, stdio: "inherit" });
-    const forward = (signal) => { try {
-        child.kill(signal);
-    }
-    catch { /* gone */ } };
-    for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"])
-        process.on(signal, () => forward(signal));
-    child.on("error", error => { process.stderr.write(`the tool could not start: ${error.message}\n`); process.exit(127); });
-    child.on("exit", (code, signal) => process.exit(code ?? (signal === null ? 1 : 128)));
-}
+/** The refusal for a launch file naming a local program: nothing is started (126, "could not be executed"). */
+const LOCAL_LAUNCH_REFUSED = "This tool's launch names a local program, which only Toolroll's tool broker may start (inside its fence); nothing was started.";
 /** stdio ↔ streamable HTTP: each line from Codex is POSTed; JSON or event-stream answers go back as lines. */
 function relayWeb(spec, values) {
     const headers = { "content-type": "application/json", accept: "application/json, text/event-stream" };
@@ -98,5 +90,7 @@ catch {
 }
 if (launch.spec.transport === "http")
     relayWeb(launch.spec, launch.values);
-else
-    runLocal(launch.spec, launch.values);
+else {
+    process.stderr.write(`${LOCAL_LAUNCH_REFUSED}\n`);
+    process.exit(126);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolroll",
-  "version": "0.9.68",
+  "version": "0.9.70",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"
@@ -125,6 +125,7 @@
     }
   },
   "dependencies": {
+    "@anthropic-ai/sandbox-runtime": "0.0.79",
     "@slack/socket-mode": "3.1.0",
     "@xterm/addon-serialize": "0.14.0",
     "@xterm/headless": "6.0.0",

package/scripts/provider-canary.mjs

@@ -313,7 +313,7 @@ async function runtimeIdentity() {
 export async function checkCheckoutGit({ provider, worktree, databaseFile, repository, home = homedir() }, execute = run) {
   if (!["claude", "codex", "gemini"].includes(provider)) return null;
   if (typeof worktree !== "string" || worktree === "") throw new Error("the builder did not retain its worktree for the Git fence check");
-  const { agentFence, taskBoundary, trustedWorktreeBinding, checkoutGitEnv, HARDENED_GIT_ARGS, fenceGrants, codexFenceArgv, macosFenceAvailable, macosFenced, linuxFenceAvailable, linuxFenced } = await import(join(root, "dist", "agent-fence.js"));
+  const { agentFence, taskBoundary, trustedWorktreeBinding, checkoutGitEnv, HARDENED_GIT_ARGS, fenceGrants, codexFenceArgv, macosFenceAvailable, linuxFenceAvailable, sandboxedSpawn } = await import(join(root, "dist", "agent-fence.js"));
   const binding = trustedWorktreeBinding(repository, worktree);
   const boundary = taskBoundary({ worktree, provider, home, binding });
   const fence = agentFence({ databaseFile, worktree, home, boundary, binding });
@@ -329,16 +329,15 @@ export async function checkCheckoutGit({ provider, worktree, databaseFile, repos
       if (control.code !== 0) throw new Error(`unfenced git ${args.join(" ")} failed: ${control.stderr}`);
       const wrapped = provider === "codex"
         ? { file: "codex", args: ["sandbox", ...codexFenceArgv(fence, false, grants), "-P", "standing-orders", "--", "git", ...gitArgs] }
-        : macosFenceAvailable() ? macosFenced("git", gitArgs, fence, grants)
-        : linuxFenceAvailable() ? linuxFenced("git", gitArgs, fence, grants) : null;
+        : macosFenceAvailable() || linuxFenceAvailable() ? sandboxedSpawn("git", gitArgs, fence, grants, worktree) : null;
       if (wrapped === null || fence.length === 0) { skipped = true; if (args[0] === "rev-parse") head = control.stdout.trim(); continue; }
       const checked = await execute(wrapped.file, wrapped.args, { cwd: worktree,
-        env });
+        env: { ...env, ...(wrapped.env ?? {}) } });
       if (checked.code !== 0) {
         const trivial = provider === "codex"
           ? { file: "codex", args: ["sandbox", ...codexFenceArgv(fence, false, grants), "-P", "standing-orders", "--", "true"] }
-          : macosFenceAvailable() ? macosFenced("true", [], fence, grants) : linuxFenced("true", [], fence, grants);
-        const sandbox = await execute(trivial.file, trivial.args, { cwd: worktree, env });
+          : sandboxedSpawn("true", [], fence, grants, worktree);
+        const sandbox = await execute(trivial.file, trivial.args, { cwd: worktree, env: { ...env, ...(trivial.env ?? {}) } });
         throw new Error(sandbox.code === 0 ? `The build fence blocks this checkout's own Git data. git ${args.join(" ")}: ${checked.stderr}` : `The provider sandbox could not run its control: ${sandbox.stderr}`);
       }
       if (checked.stdout !== control.stdout) throw new Error(`fenced git ${args.join(" ")} disagrees with its control`);

package/dist/egress-bridge.d.ts

@@ -1,17 +0,0 @@
-/** The prefix of a bridge folder in the temp folder (agent-fence.ts RUN_FOLDER_PREFIXES denies every other run's). */
-export declare const BRIDGE_PREFIX = "so-net-";
-/** The forwarder, run inside the namespace as `node forward.mjs <folder> <port>... -- <command>`. Zero dependencies. */
-export declare const FORWARDER_SOURCE: string;
-/** Whether a bridge made under `root` keeps every socket path within the limit (its folder and `<port>.sock`). */
-export declare function bridgeFits(root: string): boolean;
-export type EgressBridge = {
-    folder: string;
-    forwarder: string;
-    close: () => Promise<void>;
-};
-/**
- * Serve one socket per port (each relayed to that port on the host's loopback) in a fresh owner-only folder under
- * `root`: the plane's own bridge folder beside the database (agent-fence.ts BRIDGE_DIR), which every build's fence
- * hides from launch, so no other build can change the forwarder or reach the sockets.
- */
-export declare function startEgressBridge(ports: readonly number[], root?: string): Promise<EgressBridge>;

package/dist/egress-bridge.js

@@ -1,111 +0,0 @@
-/**
- * How a Linux build with a network of its own reaches its proxy and tool broker (agent-fence.ts linuxFenced). The
- * plane serves one unix socket per port in a folder of its own (`<folder>/<port>.sock`, each relayed to that port on
- * the host's loopback); bubblewrap binds the folder read-only into the build's namespace, where the forwarder below
- * listens on the namespace's own 127.0.0.1 at the same ports and relays each connection to its socket. Only those
- * ports cross: nothing else of the host's network is reachable, and the relay never opens a connection of its own.
- *
- * The forwarder is written into the folder at launch (the plane's own file, read-only to the build), so it never runs
- * from an installation path a fence might hide or a build could change.
- */
-import { chmodSync, lstatSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
-import { connect, createServer } from "node:net";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-/** The prefix of a bridge folder in the temp folder (agent-fence.ts RUN_FOLDER_PREFIXES denies every other run's). */
-export const BRIDGE_PREFIX = "so-net-";
-/** The forwarder, run inside the namespace as `node forward.mjs <folder> <port>... -- <command>`. Zero dependencies. */
-export const FORWARDER_SOURCE = String.raw `import { connect, createServer } from "node:net";
-import { spawn } from "node:child_process";
-const argv = process.argv.slice(2);
-const split = argv.indexOf("--");
-if (split < 1 || split === argv.length - 1) { process.stderr.write("toolroll forwarder: usage <folder> <port>... -- <command>\n"); process.exit(2); }
-const folder = argv[0];
-const ports = argv.slice(1, split).map(Number);
-const command = argv.slice(split + 1);
-let ready = 0;
-for (const port of ports) {
-  const server = createServer(client => {
-    const upstream = connect(folder + "/" + port + ".sock");
-    client.on("error", () => upstream.destroy());
-    upstream.on("error", () => client.destroy());
-    client.pipe(upstream);
-    upstream.pipe(client);
-  });
-  server.on("error", error => { process.stderr.write("toolroll forwarder: " + error.message + "\n"); process.exit(70); });
-  server.listen(port, "127.0.0.1", () => { if (++ready === ports.length) start(); });
-}
-if (ports.length === 0) start();
-function start() {
-  const child = spawn(command[0], command.slice(1), { stdio: "inherit" });
-  for (const signal of ["SIGTERM", "SIGINT", "SIGHUP"]) process.on(signal, () => child.kill(signal));
-  child.on("error", error => { process.stderr.write("toolroll forwarder: " + error.message + "\n"); process.exit(127); });
-  child.on("exit", (code, signal) => {
-    if (signal === null) process.exit(code ?? 1);
-    // Die the way the agent died: this process's own handlers (which only pass a signal on) step aside first.
-    process.removeAllListeners(signal);
-    process.kill(process.pid, signal);
-    setTimeout(() => process.exit(128), 1000).unref();
-  });
-}
-`;
-/** The longest a unix socket's path may be here (macOS 104 bytes, Linux 108, with room to spare). */
-const SOCKET_PATH_MAX = 100;
-/** Whether a bridge made under `root` keeps every socket path within the limit (its folder and `<port>.sock`). */
-export function bridgeFits(root) {
-    return join(root, `${BRIDGE_PREFIX}XXXXXX`, "65535.sock").length <= SOCKET_PATH_MAX;
-}
-/**
- * Serve one socket per port (each relayed to that port on the host's loopback) in a fresh owner-only folder under
- * `root`: the plane's own bridge folder beside the database (agent-fence.ts BRIDGE_DIR), which every build's fence
- * hides from launch, so no other build can change the forwarder or reach the sockets.
- */
-export async function startEgressBridge(ports, root = tmpdir()) {
-    // The root must be a real folder of this user's alone, never a link a build could have planted before it existed.
-    const held = lstatSync(root);
-    if (held.isSymbolicLink() || !held.isDirectory() || (process.getuid !== undefined && held.uid !== process.getuid()) || (root !== tmpdir() && (held.mode & 0o077) !== 0)) {
-        throw new Error(`the bridge folder ${root} isn't a private folder of this user's`);
-    }
-    if (!bridgeFits(root))
-        throw new Error(`the bridge folder ${root} is too deep for a socket path`);
-    const folder = mkdtempSync(join(root, BRIDGE_PREFIX));
-    chmodSync(folder, 0o700);
-    const forwarder = join(folder, "forward.mjs");
-    writeFileSync(forwarder, FORWARDER_SOURCE, { mode: 0o500, flag: "wx" });
-    const servers = [];
-    const sockets = new Set();
-    try {
-        for (const port of ports) {
-            const server = createServer(client => {
-                sockets.add(client);
-                const upstream = connect(port, "127.0.0.1");
-                sockets.add(upstream);
-                const drop = () => { client.destroy(); upstream.destroy(); };
-                client.on("error", drop);
-                upstream.on("error", drop);
-                client.on("close", () => { sockets.delete(client); upstream.destroy(); });
-                upstream.on("close", () => { sockets.delete(upstream); client.destroy(); });
-                client.pipe(upstream);
-                upstream.pipe(client);
-            });
-            await new Promise((done, fail) => { server.once("error", fail); server.listen(join(folder, `${port}.sock`), () => { server.off("error", fail); done(); }); });
-            servers.push(server);
-        }
-    }
-    catch (error) {
-        for (const server of servers)
-            server.close();
-        rmSync(folder, { recursive: true, force: true });
-        throw error;
-    }
-    return {
-        folder,
-        forwarder,
-        close: async () => {
-            for (const socket of sockets)
-                socket.destroy();
-            await Promise.all(servers.map(server => new Promise(done => server.close(() => done()))));
-            rmSync(folder, { recursive: true, force: true });
-        },
-    };
-}