fix: improve one-shot token library copy robustness in chroot mode

[Copilot]

The one-shot token LD_PRELOAD library copy in chroot mode lacked proper error handling and could fail silently if /host/tmp was not writable.

Changes:

• Enhanced copy logic (containers/agent/entrypoint.sh):

  • Explicit verification that mkdir -p /host/tmp/awf-lib succeeds before copy
  • Post-copy validation that file exists at destination
  • Graceful degradation: continues without LD_PRELOAD if copy fails, with clear warnings

• Improved diagnostics:

  • Distinguishes between directory creation vs. copy failures
  • Documents that /tmp is always mounted rw in chroot mode
  • Warns when token protection is disabled due to copy failure

• Updated mount documentation (src/docker-manager.ts):

  • Clarifies /tmp mount is used for both command scripts and one-shot token library

Implementation:

# Before: Silent failure on mkdir/copy errors
mkdir -p /host/tmp/awf-lib
if cp library.so /host/tmp/awf-lib/library.so 2>/dev/null; then
  ONE_SHOT_TOKEN_LIB="/tmp/awf-lib/library.so"
fi

# After: Explicit validation and clear error reporting
if mkdir -p /host/tmp/awf-lib 2>/dev/null; then
  if cp library.so /host/tmp/awf-lib/library.so 2>/dev/null && \
     [ -f /host/tmp/awf-lib/library.so ]; then
    ONE_SHOT_TOKEN_LIB="/tmp/awf-lib/library.so"
  else
    echo "[WARN] Token protection will be disabled (tokens may be readable multiple times)"
  fi
fi

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Pull request overview

Improves robustness and observability of staging the one-shot token LD_PRELOAD library for chroot executions, ensuring the system degrades gracefully when the copy cannot be performed and clarifying how /tmp is used in chroot mode.

Changes:

• Adds explicit mkdir/copy success checks and post-copy validation for one-shot-token.so in containers/agent/entrypoint.sh.
• Clarifies /tmp usage in chroot volume mounts documentation in src/docker-manager.ts.
• Updates package-lock.json with new "peer": true flags on multiple packages.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

File	Description
containers/agent/entrypoint.sh	Adds more robust copy/validation logic and clearer warnings when token protection is disabled in chroot mode.
src/docker-manager.ts	Clarifies that /tmp mount supports both temp command scripts and the one-shot token library staging directory.
package-lock.json	Introduces new "peer": true metadata on multiple packages (appears unrelated to the PR’s stated scope).

Comments suppressed due to low confidence (1)

containers/agent/entrypoint.sh:184

• These warnings mention copying to "/tmp/awf-lib", but the copy target in this block is "/host/tmp/awf-lib" (which later appears as /tmp inside the chroot). To avoid confusion when debugging mount/permission problems, consider logging the real path used for the copy and/or explicitly noting the /host/tmp ↔ /tmp-in-chroot mapping in the message.

        echo "[entrypoint][WARN] Could not copy one-shot-token library to /tmp/awf-lib"
        echo "[entrypoint][WARN] Token protection will be disabled (tokens may be readable multiple times)"

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The mkdir/cp failures are redirected to /dev/null, so the warnings/errors here won’t include the underlying reason (e.g., permission denied, ENOSPC). For the “improved diagnostics” goal, consider capturing stderr and including it in the log output (or at least logging it when the operation fails).

[Copilot]

The mkdir failure message refers to "/tmp/awf-lib", but the failing operation is creating "/host/tmp/awf-lib" (pre-chroot). Using the actual path here (and optionally noting it maps to /tmp in the chroot) would make the error easier to act on.

This issue also appears on line 183 of the same file.

See below for a potential fix:

        echo "[entrypoint][WARN] Could not copy one-shot-token library to /host/tmp/awf-lib (chroot path: /tmp/awf-lib)"
        echo "[entrypoint][WARN] Token protection will be disabled (tokens may be readable multiple times)"
      fi
    else
      echo "[entrypoint][ERROR] Could not create /host/tmp/awf-lib directory (chroot path: /tmp/awf-lib)"
      echo "[entrypoint][ERROR] This should not happen - /host/tmp is mounted read-write and mapped to /tmp in chroot mode"