nucleic/nucleic
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6,199 Commits 1 Branch 0 Tags
0c81858bcaa663ff230028d32872a6d506bc2b30
Commit Graph
285 Commits
Author SHA1 Message Date
abkslm 0c81858bca Merge nucleic/ivory-velvet-yak-ghon into dev 2026-07-21 01:38:57 -07:00
abkslm 3681039c5d Merge nucleic/ivory-velvet-yak-ghon into dev 2026-07-21 01:17:07 -07:00
abkslm 0989770f46 Merge nucleic/lucid-lunar-wren-wxyw into dev 2026-07-21 00:54:30 -07:00
abkslm fac7c9238d Merge nucleic/keen-willow-wren-ydll into dev 2026-07-21 00:16:38 -07:00
abkslm 4b43d05eb9 Merge nucleic/jolly-grove-heron-w349 into dev 2026-07-20 23:33:43 -07:00
abkslm effa3c91fa Merge nucleic/amber-thistle-dingo-urcn into dev 2026-07-20 18:08:22 -07:00
abkslm 9371e629a4 Merge nucleic/mellow-opal-wren-obc4 into dev 2026-07-20 00:23:05 -07:00
abkslm f767be52b3 Merge claude/nash-shell-naros-agent-fix-d1c190 into dev 2026-07-19 20:06:33 -07:00
abkslmandClaude Opus 4.8 3510cb5799 nash: accept bash's -c operand ordering; fix test socket paths 
`bash -c` does not bind to the token that follows it: short-option parsing
continues and the command string is the first operand, so `bash -c -l <cmd>`
runs `<cmd>` as a login shell. brush's clap CLI instead binds `-c` to the next
token and rejects one shaped like an option, so every command the agent CLI
sent as `-c -l <cmd>` inside naros-agent failed with

    error: a value is required for '-c <COMMAND>' but none was supplied

Since narOS diverts /bin/sh, /bin/bash and /bin/dash to nash, that broke every
command in the container. nash's compat fallback did not cover it either: it
read "-l" as the command, which parses fine as bash, so no fallback fired.

Normalize the argv before clap sees it, hoisting short options that sit between
the `-c` group and its command ahead of that group (`-c -l cmd` -> `-l -c cmd`),
including value-taking ones (`-c -o xtrace cmd`, `-c -oxtrace cmd`). Only short
options are hoisted — bash itself rejects long options once short-option parsing
has begun — and anything not positively identified as an option ends the scan,
so a command string is never mistaken for a flag. Teach nash's dash_c_command()
the same rule so the parse-failure fallback checks the real command.

Also repair the observe test harness, which could not run under a normal macOS
TMPDIR: it named its socket directory with `{:?}` of an Instant (~45 chars),
overflowing sun_path, and never cleaned up, so a recycled pid inherited a stale
socket and failed the bind with AlreadyExists. Route every scratch directory
through a helper that keeps names short, falls back to /tmp when the socket path
would not fit, clears stale state, and drops the directory when the sink dies.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
 2026-07-19 20:06:28 -07:00
abkslm 928a0c6c69 Merge nucleic/calm-velvet-newt-rnxk into dev 2026-07-19 19:57:51 -07:00
abkslm 0d5f2f1cd9 Merge nucleic/humble-glass-heron-hcpq into dev 2026-07-19 18:51:49 -07:00
abkslm ec9071a17f Merge nucleic/lucid-spruce-toad-wizh into dev 2026-07-19 17:43:49 -07:00
abkslm dc134431bd Merge nucleic/calm-velvet-newt-rnxk into dev 2026-07-19 16:18:02 -07:00
abkslm 0832ff53d8 Merge nucleic/eager-ancient-heron-p5em into dev 2026-07-18 19:00:14 -07:00
abkslm 73f0d5d9f5 Merge nucleic/olive-ember-seal-q7vk into dev 2026-07-18 15:50:01 -07:00
abkslm c1ea8b67dc Merge nucleic/olive-ember-seal-q7vk into dev 2026-07-18 15:33:08 -07:00
abkslm 19056d089e Merge nucleic/olive-ember-seal-q7vk into dev 2026-07-18 15:14:54 -07:00
abkslm dcc9016a6b Merge nucleic/sleek-thistle-egret-fyej into dev 2026-07-18 14:51:02 -07:00
abkslm e994f0f4bf Merge nucleic/olive-ember-seal-q7vk into dev 2026-07-18 14:35:57 -07:00
abkslm 0d3f0f4ce6 Merge nucleic/sleek-thistle-egret-fyej into dev 2026-07-18 14:31:25 -07:00
abkslm d03198dde0 Merge nucleic/olive-ember-seal-q7vk into dev 2026-07-18 14:18:29 -07:00
abkslm ebc023de49 Merge nucleic/olive-ember-seal-q7vk into dev 2026-07-18 13:59:00 -07:00
abkslm 8ec5e35ace Merge nucleic/upbeat-dewy-yak-kfbg into dev 2026-07-18 13:26:29 -07:00
abkslm d50b9a1611 Merge nucleic/sleek-thistle-egret-fyej into dev 2026-07-18 13:13:42 -07:00
abkslm 7f48369b31 Merge nucleic/sleek-thistle-egret-fyej into dev 2026-07-18 12:45:36 -07:00
abkslm 98432fdfd0 Merge nucleic/sleek-thistle-egret-fyej into dev 2026-07-18 12:23:09 -07:00
abkslm cfe28d5397 Merge nucleic/sleek-thistle-egret-fyej into dev 2026-07-18 05:19:31 -07:00
abkslm f3d0d630be Merge nucleic/sleek-thistle-egret-fyej into dev 2026-07-18 04:59:43 -07:00
abkslm e9d8e6e16c Merge nucleic/sleek-thistle-egret-fyej into dev 2026-07-18 04:18:09 -07:00
abkslm 73996cd25d Merge nucleic/sleek-thistle-egret-fyej into dev 2026-07-18 04:01:56 -07:00
abkslm 784a0c0692 Merge nucleic/sleek-thistle-egret-fyej into dev 2026-07-18 03:59:22 -07:00
abkslm adcb95d3d3 Merge nucleic/sleek-thistle-egret-fyej into dev 2026-07-18 01:49:58 -07:00
abkslm bb920dd313 Merge nucleic/fuzzy-velvet-quail-rnyt into dev 2026-07-18 01:14:37 -07:00
abkslm f559bcfa91 Merge nucleic/sleek-river-urchin-2nzm into dev 2026-07-17 23:42:54 -07:00
abkslm 2d44afc8db Merge nucleic/sleek-river-urchin-2nzm into dev 2026-07-17 23:27:01 -07:00
abkslm 45c62b58ef Merge nucleic/sleek-river-urchin-2nzm into dev 2026-07-17 22:16:34 -07:00
abkslm 7526dc0dd4 Merge nucleic/olive-iris-heron-n0uc into dev 2026-07-17 21:49:09 -07:00
abkslm 4275e1745e Merge nucleic/tidy-north-gecko-6wqv into dev 2026-07-17 16:01:25 -07:00
abkslm 1cd4d31ba7 Merge nucleic/tidy-north-gecko-6wqv into dev 2026-07-17 15:35:17 -07:00
abkslm fcd21d0a92 Merge nucleic/plucky-ancient-koala-2qbh into dev 2026-07-14 19:54:13 -07:00
abkslm d96d02314a Merge nucleic/warm-yarn-koala-ffjl into dev 2026-07-14 18:44:15 -07:00
abkslm 3c62e1e102 Merge nucleic/olive-dewy-urchin-megz into dev 2026-07-14 04:40:04 -07:00
abkslmandClaude Fable 5 ab9f836a05 Fix the all-sessions stdio stall: UnixSocketByteConn read-after-close on recycled fds 
The "agent started but produced no output within 60s / stdio transport
stalled" lockup was never in the container stack — it was the approval
server's unix-socket transport. UnixSocketByteConn.close() did
shutdown(2)+close(2), freeing the fd NUMBER while the serve loop could
still dispatch its next blocking read(2) on the stored raw int. The race
arms on every SSE-streamed tools/call (respondStreamingToolCall closes
the connection mid-serve-loop; instant auto-approvals make the window
widest). The straggler read then landed on a RECYCLED descriptor —
another session's MCP socket, a container's stdout vsock channel —
parking a global-queue thread forever on, and stealing bytes from, an
unrelated stream. Zombies accumulated until every session stalled at
once (the 2026-07-14 00:02 wedge: 26 threads parked in receive() with
only 2 live unix connections). Yesterday's container-side fixes were
correct but orthogonal, which is why build 898 still stalled.

Fix: close() now only shuts the socket down (wakes a parked read with
EOF, fails later writes with EPIPE); the descriptor is close(2)d exactly
once, in deinit, and every offloaded read/write block strongly captures
self so the fd number cannot be recycled while any block that could
still pass it to the kernel is in flight. receive() is additionally
cancellation-aware, so stop()'s task cancellation unwedges parked reads
instead of stranding them. Regression test drives ten SSE-close /
fresh-connect cycles over a real AF_UNIX socket.

Also found while validating the earlier patch: ensureInitfs trusted a
bare cached vminit.ext4 forever, so repointing vminitReference at the
custom -nucleic1 image never took effect (containers still boot the
Jun-21 upstream initfs — guest patch #8 never actually deployed). The
cache is now keyed on the reference via a sidecar file, the pull
authenticates against GHCR with the app's GitHub token (the package is
private; anonymous pulls 403), and a failed re-pull falls back to the
existing cache so an offline launch still boots.

Co-Authored-By: Claude Fable 5 <[email protected]>
 2026-07-14 00:40:48 -07:00
abkslmandClaude Opus 4.8 f3c056fd0d docs: add CONTAINER_ISOLATION.md — session-isolation model + build/validate workflow 
Overview doc so other agents/humans understand the shared-control-container
isolation work: the failure vectors + fixes (stdio wedge, connection leak,
control-plane HOL, OOM cross-kill, CPU/fork-bomb, per-session memory.max), the
host-vs-guest shipping surfaces, the per-exec cgroup layout + graceful fallback,
and the local vminit-image build/validate workflow + -nucleicN tag invariant.
Cross-linked from the vendored PATCHES.md.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
 2026-07-13 22:03:03 -07:00
abkslm 2d052948fe Merge nucleic/frosty-drift-wren-hm99 into dev 2026-07-13 04:51:40 -07:00
abkslm a7c7ab1acb Merge nucleic/nimble-feather-ibis-gdlr into dev 2026-07-13 02:20:06 -07:00
abkslm 99f0ce84b4 Merge nucleic/nimble-feather-ibis-gdlr into dev 2026-07-13 01:58:54 -07:00
abkslm ab0a880dfc Merge nucleic/ivory-harbor-lynx-vuwe into dev 2026-07-13 01:53:35 -07:00
abkslm 24e68ccf19 Merge nucleic/lucid-quartz-otter into dev 2026-07-12 23:01:22 -07:00
abkslm 8787d8ee84 Merge nucleic/fuzzy-jade-egret-2 into dev 2026-07-12 20:16:27 -07:00