chore(upstream): integrate code interpreter v1.10.10

.github/workflows/ci.yml

@@ -109,7 +109,7 @@ jobs:
 
       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
-          node-version: 22
+          node-version: 22.23.4
 
       - name: Compile anonymous-pipe addon
         run: |
@@ -164,6 +164,8 @@ jobs:
         runner: [ubuntu-latest, ubuntu-24.04-arm]
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - name: Verify descendant-reaping decisions
+        run: python3 tests/test_tool_call_pipes.py
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: 1.4.2
@@ -209,8 +211,8 @@ jobs:
             nsjail-ipc-test python3 /tests/supervisor_dns.py
           docker run --rm --init --security-opt seccomp=unconfined \
             --mount "type=bind,source=$GITHUB_WORKSPACE,target=/work,readonly" \
-            --entrypoint /usr/local/bin/sandbox-supervisor-policy \
-            nsjail-ipc-test bun test /work/api/src/pipe-process.test.ts
+            --entrypoint /bin/sh \
+            nsjail-ipc-test -ec 'test -x /usr/local/bin/tool-call-pipe-bridge; exec /usr/local/bin/sandbox-supervisor-policy bun test /work/api/src/pipe-process.test.ts'
           docker run --rm --init --security-opt seccomp=unconfined \
             --mount "type=bind,source=$GITHUB_WORKSPACE/tests,target=/tests,readonly" \
             --entrypoint /usr/local/bin/sandbox-supervisor-policy \
@@ -308,7 +310,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node-version: ['22.21.0', '24.16.0']
+        node-version: ['22.23.4', '24.22.1']
     defaults:
       run:
         working-directory: packages/code
@@ -345,7 +347,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
-          node-version: 24.16.0
+          node-version: 24.22.1
       - run: npm ci
       - run: npm run build
       - name: Selected project root containment tests
@@ -372,7 +374,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
-          node-version: 24.16.0
+          node-version: 24.22.1
       - name: Install bubblewrap
         run: |
           sudo apt-get update -qq

.github/workflows/extraction.yml

@@ -0,0 +1,25 @@
+name: Extraction Service
+on:
+    pull_request:
+        paths: ['packages/extraction/**', '.github/workflows/extraction.yml']
+    push:
+        branches: [main]
+        paths: ['packages/extraction/**', '.github/workflows/extraction.yml']
+permissions:
+    contents: read
+jobs:
+    extraction:
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+            - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
+              with:
+                  node-version: 24.22.1
+                  cache: npm
+                  cache-dependency-path: packages/extraction/package-lock.json
+            - run: npm ci --ignore-scripts
+              working-directory: packages/extraction
+            - run: npm run format:check && npm run typecheck && npm test
+              working-directory: packages/extraction
+            - run: npm run test:container
+              working-directory: packages/extraction

api/Dockerfile

@@ -35,7 +35,7 @@ COPY api/src/spec-guard.c /tmp/spec-guard.c
 COPY api/src/tool-call-pipe-bridge.c /tmp/tool-call-pipe-bridge.c
 COPY api/src/anonymous-pipes.c /tmp/anonymous-pipes.c
 COPY api/src/supervisor-policy.c /tmp/supervisor-policy.c
-COPY --from=node:22-slim /usr/local/include/node /usr/local/include/node
+COPY --from=node:22.23.4-slim /usr/local/include/node /usr/local/include/node
 # KVM/nsjail execution may need read permission on virtiofs-backed rootfs.
 COPY docker/rootfs-setup.c /tmp/rootfs-setup.c
 RUN gcc -shared -fPIC -O2 -Wall -Wextra -Werror -I/usr/local/include/node -o /usr/local/lib/anonymous-pipes.node /tmp/anonymous-pipes.c \
@@ -50,7 +50,7 @@ FROM nsjail-builder AS nsjail-ipc-test
 ENV SANDBOX_PIPE_ADDON=/usr/local/lib/anonymous-pipes.node
 COPY docker/python-runtime /python-runtime
 RUN python3 /python-runtime/install.py
-COPY --from=node:22-slim /usr/local/bin/node /usr/local/bin/node
+COPY --from=node:22.23.4-slim /usr/local/bin/node /usr/local/bin/node
 COPY --from=oven/bun:1.4.2-debian /usr/local/bin/bun /usr/local/bin/bun
 
 # ============================================================================
@@ -139,7 +139,7 @@ RUN chmod +x /usr/sbin/nsjail
 # The per-invocation broker starts Node after restore, so its OpenSSL process
 # state is not captured in the MicroVM snapshot. Pulling the Node binary
 # is ~30 MB and avoids inheriting npm/node_modules from a full apt install.
-COPY --from=node:22-slim /usr/local/bin/node /usr/local/bin/node
+COPY --from=node:22.23.4-slim /usr/local/bin/node /usr/local/bin/node
 
 WORKDIR /sandbox_api
 

api/package.json

@@ -27,5 +27,8 @@
     "@types/semver": "^7.5.8",
     "typescript": "^5.7.3"
   },
-  "license": "Apache-2.0"
+  "license": "Apache-2.0",
+  "overrides": {
+    "proxy-addr": "2.0.8"
+  }
 }

api/src/api/session-inputs.routes.test.ts

@@ -26,6 +26,7 @@ let baseUrl: string;
 const savedSessionWorkspaceEnabled = config.session_workspace_enabled;
 
 beforeAll(async () => {
+  await fsp.rm(SESSION_INPUT_CACHE_DIR, { recursive: true, force: true });
   config.session_workspace_enabled = true;
   const app = express();
   /* Mirror index.ts: no global JSON parser, router mounted under /api/v2. */

api/src/job.ts

@@ -171,8 +171,11 @@ export function ensureNodeModulesSymlink(
   if (!nodeModulesPath) return;
   const linkPath = path.join(submissionDir, 'node_modules');
   try {
-    fs.lstatSync(linkPath);
-    return;
+    if (!fs.lstatSync(linkPath).isSymbolicLink()) return;
+    const target = path.resolve(submissionDir, fs.readlinkSync(linkPath));
+    const packageRoot = `${path.resolve(config.packages_directory)}${path.sep}`;
+    if (!target.startsWith(packageRoot) || target === path.resolve(nodeModulesPath)) return;
+    fs.unlinkSync(linkPath);
   } catch (err) {
     if (errorCode(err) !== 'ENOENT') throw err;
   }