langbot-plugin 0.4.2b1__tar.gz → 0.4.2b3__tar.gz

{langbot_plugin-0.4.2b1 → langbot_plugin-0.4.2b3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: langbot-plugin
-Version: 0.4.2b1
+Version: 0.4.2b3
 Summary: This package contains the SDK, CLI for building plugins for LangBot, plus the runtime for hosting LangBot plugins
 Project-URL: Homepage, https://langbot.app
 Project-URL: Repository, https://github.com/langbot-app/langbot-plugin-sdk

{langbot_plugin-0.4.2b1 → langbot_plugin-0.4.2b3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "langbot-plugin"
-version = "0.4.2b1"
+version = "0.4.2b3"
 description = "This package contains the SDK, CLI for building plugins for LangBot, plus the runtime for hosting LangBot plugins"
 readme = "README.md"
 authors = [

{langbot_plugin-0.4.2b1 → langbot_plugin-0.4.2b3}/src/langbot_plugin/box/nsjail_backend.py

@@ -44,6 +44,23 @@ _READONLY_ETC_ENTRIES: list[str] = [
     '/etc/resolv.conf',  # needed when network=ON
 ]
 
+# Essential character devices bind-mounted into the sandbox's /dev.
+# /dev is a fresh empty tmpfs (see _build_args), so these nodes do not exist
+# unless we bind them in from the host. Tooling that shells out for probes
+# relies on them — notably `uv`/`uvx` redirects its glibc/musl detection
+# subprocess to /dev/null; without it uv fails with "Could not detect either
+# glibc version nor musl libc version" and the process exits before it can do
+# anything (e.g. an stdio MCP server dies before the initialize handshake,
+# surfacing as a misleading "Connection closed / please check URL").
+_DEV_NODES: list[str] = [
+    '/dev/null',
+    '/dev/zero',
+    '/dev/full',
+    '/dev/random',
+    '/dev/urandom',
+    '/dev/tty',
+]
+
 _DEFAULT_BASE_DIR = '/tmp/langbot-box-nsjail'
 
 
@@ -116,6 +133,19 @@ class NsjailBackend(BaseSandboxBackend):
         for d in (root_dir, workspace_dir, tmp_dir, home_dir):
             d.mkdir(parents=True, exist_ok=True)
 
+        # When a host_path is mounted into the sandbox it becomes the nsjail
+        # bind-mount source (see _build_mounts). nsjail requires the source to
+        # already exist on the host, otherwise the bind-mount fails and the
+        # command exits 255 with no stdout/stderr. The per-session loop above
+        # never creates host_path (it lives outside session_dir), so ensure it
+        # exists here. Read-only mounts intentionally are NOT auto-created: a
+        # missing read-only source is a caller error that should surface.
+        if (
+            spec.host_path is not None
+            and spec.host_path_mode == BoxHostMountMode.READ_WRITE
+        ):
+            os.makedirs(spec.host_path, exist_ok=True)
+
         # If host_path is specified, we will use it directly instead of the
         # per-session workspace when building nsjail args (see _build_mounts).
         meta = {
@@ -317,6 +347,15 @@ class NsjailBackend(BaseSandboxBackend):
         args.extend(['--mount', 'none:/proc:proc:rw'])
         args.extend(['--mount', 'none:/dev:tmpfs:rw'])
 
+        # /dev is a fresh empty tmpfs, so bind in the essential character
+        # devices. Without /dev/null in particular, uv's glibc/musl detection
+        # subprocess fails and any uvx-launched process (e.g. stdio MCP servers)
+        # exits before doing useful work. Mounted read-write so writes to
+        # /dev/null behave normally.
+        for dev in _DEV_NODES:
+            if os.path.exists(dev):
+                args.extend(['--bindmount', f'{dev}:{dev}'])
+
         # Working directory.
         args.extend(['--cwd', spec.workdir])
 

{langbot_plugin-0.4.2b1 → langbot_plugin-0.4.2b3}/tests/box/test_nsjail_backend.py

@@ -93,20 +93,62 @@ async def test_start_session_creates_directories(backend, tmp_base):
 @pytest.mark.anyio
 async def test_start_session_with_host_path(backend, tmp_base):
     tmp_base.mkdir(parents=True, exist_ok=True)
+    host_path = str(tmp_base / 'rw_host')
     spec = BoxSpec(
         session_id='sess2',
         cmd='ls',
-        host_path='/some/path',
+        host_path=host_path,
         host_path_mode=BoxHostMountMode.READ_WRITE,
         mount_path='/project',
     )
 
     info = await backend.start_session(spec)
-    assert info.host_path == '/some/path'
+    assert info.host_path == host_path
     assert info.host_path_mode == BoxHostMountMode.READ_WRITE
     assert info.mount_path == '/project'
 
 
+@pytest.mark.anyio
+async def test_start_session_creates_missing_rw_host_path(backend, tmp_base):
+    """Regression: a read-write host_path that does not yet exist must be
+    created by start_session, otherwise nsjail's --bindmount source is missing
+    and the command exits 255 with no output (SaaS MCP shared-workspace bug)."""
+    tmp_base.mkdir(parents=True, exist_ok=True)
+    host_path = tmp_base / 'never_created' / 'workspace'
+    assert not host_path.exists()
+
+    spec = BoxSpec(
+        session_id='sess-mkdir',
+        cmd='ls',
+        host_path=str(host_path),
+        host_path_mode=BoxHostMountMode.READ_WRITE,
+        mount_path='/workspace',
+    )
+
+    await backend.start_session(spec)
+    assert host_path.is_dir()
+
+
+@pytest.mark.anyio
+async def test_start_session_does_not_create_ro_host_path(backend, tmp_base):
+    """A missing read-only host_path is a caller error and must NOT be silently
+    created — it should surface rather than mount an empty dir."""
+    tmp_base.mkdir(parents=True, exist_ok=True)
+    host_path = tmp_base / 'ro_missing'
+    assert not host_path.exists()
+
+    spec = BoxSpec(
+        session_id='sess-ro',
+        cmd='ls',
+        host_path=str(host_path),
+        host_path_mode=BoxHostMountMode.READ_ONLY,
+        mount_path='/project',
+    )
+
+    await backend.start_session(spec)
+    assert not host_path.exists()
+
+
 # ── stop_session ──────────────────────────────────────────────────────
 
 @pytest.mark.anyio
@@ -173,6 +215,54 @@ def test_build_nsjail_args_basic(backend, tmp_base):
     assert (session_dir / 'root' / 'home').is_dir()
 
 
+def test_build_nsjail_args_binds_essential_dev_nodes(backend, tmp_base):
+    """/dev is a fresh empty tmpfs, so essential character devices must be
+    bind-mounted in. Regression: without /dev/null, uv's glibc/musl detection
+    subprocess fails ("Could not detect either glibc version nor musl libc
+    version") and uvx-launched stdio MCP servers die before the initialize
+    handshake, surfacing as a misleading "Connection closed / please check URL".
+    """
+    tmp_base.mkdir(parents=True, exist_ok=True)
+    session_dir = tmp_base / 'test_dev'
+    for d in ('root', 'workspace', 'tmp', 'home'):
+        (session_dir / d).mkdir(parents=True)
+
+    spec = BoxSpec(session_id='s-dev', cmd='echo hi')
+    session = BoxSessionInfo(
+        session_id='s-dev',
+        backend_name='nsjail',
+        backend_session_id=str(session_dir),
+        image=spec.image,
+        network=BoxNetworkMode.OFF,
+        created_at='2024-01-01T00:00:00+00:00',
+        last_used_at='2024-01-01T00:00:00+00:00',
+    )
+
+    # Pretend every candidate device node exists on the host.
+    with mock.patch('os.path.exists', return_value=True):
+        args = backend._build_nsjail_args(session, spec, session_dir)
+
+    # /dev itself is a tmpfs mount.
+    mount_specs = [args[i + 1] for i, a in enumerate(args) if a == '--mount']
+    assert 'none:/dev:tmpfs:rw' in mount_specs
+
+    # /dev/null (the critical one for uv) must be bind-mounted read-write,
+    # ordered AFTER the /dev tmpfs mount so it lands on the fresh tmpfs.
+    rw_binds = [args[i + 1] for i, a in enumerate(args) if a == '--bindmount']
+    assert '/dev/null:/dev/null' in rw_binds
+    assert '/dev/urandom:/dev/urandom' in rw_binds
+
+    dev_tmpfs_idx = next(
+        i for i, a in enumerate(args)
+        if a == '--mount' and args[i + 1] == 'none:/dev:tmpfs:rw'
+    )
+    dev_null_idx = next(
+        i for i, a in enumerate(args)
+        if a == '--bindmount' and args[i + 1] == '/dev/null:/dev/null'
+    )
+    assert dev_tmpfs_idx < dev_null_idx
+
+
 def test_build_nsjail_args_network_on(backend, tmp_base):
     tmp_base.mkdir(parents=True, exist_ok=True)
     session_dir = tmp_base / 'test_session_net'