[codex] add native file-generation runtime

[thanhnguyen4649]

What

• Add native spreadsheet, document, presentation, PDF, image, audio, and video generation dependencies to the sandbox runtime.
• Build and checksum a persistent /pkgs bundle with Python, Node.js, npm, Bun, LibreOffice, FFmpeg, Poppler, and WeasyPrint support.
• Pin patched npm internals (tar, brace-expansion, and ip-address) and patched Python security baselines; remove pip's build-only vendored SBOM before runtime scanning.
• Expose only the package checksum and selected runtime inside NsJail, with narrow AppArmor and read-only native-tool configuration access.
• Add an in-sandbox verifier and CI regression checks for native file signatures, conversions, and renamed-text rejection.

Why

WowLoop needs Code Interpreter to return real downloadable files rather than HTML, Markdown, JSON, or plain text renamed with native extensions.

Test

• bun ci && bun run build
• env -u ANTHROPIC_AUTH_TOKEN bun run test - 370 passed, 0 failed
• tests/sandbox_runner_healthcheck.sh
• tests/file_generation_runtime_static.sh
• tests/block_root_package_delivery.sh
• bash -n build-packages.sh docker/package-init.sh
• python3 -m py_compile scripts/verify-file-generation-runtime.py
• docker buildx build --check -f api/Dockerfile .
• docker buildx build --check -f docker/Dockerfile.worker-sandbox .
• Built sandbox-runner-true and sandbox-runner-false after rebasing onto 297fead
• Trivy detected 0 fixable HIGH/CRITICAL findings in both final local images; Fedora 43 OS-package scanning remains unsupported by this Trivy database and is disclosed as residual risk
• Sandbox runtime verifier passed 15/15 workflows before and after restart, including XLSX/CSV/DOCX/PPTX/PDF, image/audio/video, LibreOffice, WeasyPrint, and fake-XLSX rejection
• Package bundle checksum remained d885ebbfb33de87386baf2b79da73da6b705564776509ce250ef9fddfd0c126b across restart
• git diff --check and secret-pattern scan passed

Risk

• No database migration or authentication-contract change.
• This changes the sandbox image, package supply chain, and native binary surface; production rollout still requires architecture/KVM evidence, immutable VPS image digests, backup and rollback capture, authenticated WowLoop E2E, manual XLSX acceptance, and restart-persistence evidence.
• Direct NsJail mode shares the host kernel and must not be treated as equivalent to the KVM isolation boundary.

Deployment

Not deployed. Keep this PR in draft until the coordinated WowLoop deployment PR and all VPS/manual gates are reviewed.

Related

• WowLoop deployment PR: https://github.com/thanhnguyen4649/wl/pull/34

[thanhnguyen4649]

VPS test deployment evidence (2026-08-27)

Deployed the reviewed candidate to the WowLoop test VPS after the test-credential exposure was explicitly accepted for this environment only.

Revisions and runtime

• Code Interpreter source: e16182b88eec45b383f2d3b42475d2429acbc3c7
• WowLoop integration source: 0f9fe2ac565f3bc52cd799ec0aa1ad5f82d88e7b
• Host: x86_64; KVM_ENABLED=false (direct NsJail test exception)
• AppArmor profile sandbox-nsjail installed and loaded
• Sandbox mount is only /home/wowloop/code-interpreter/data/pkgs -> /host-packages; no temporary script/config bind mounts remain
• Runtime package checksum: 68ce64978b0bd0560185c7e8414f31ddde73cdeca51298e23a282f69008a6d9a

Deployed first-party image IDs

• API: sha256:41a36e29b51bca3575a50632d23eacdcaf0145b22475b8c75739cb677b0a69d0
• Worker: sha256:82c089e17313a5424367d362dc33a946b874219d08ffeb3fd01e80f8f0c5028f
• Egress: sha256:87a5998a13870abd0c1ee888b812c526141218864d50175e86582586f4ebf15f
• Tools: sha256:2f077b070122271901b776fd617570cd95077751120539678f20492a13900b6b
• Sandbox: sha256:2af3e55cd076b9dd087e31af55b0c2f3c2d61e05816f1b3a4b2ff6fd6586a718
• Files: sha256:738249f6e0d728d6ce2f5db224f03a9942872e2bc3bc6f278e0b769b785f3b0f

Verification

• Static runtime regression test passed after e16182b added resolver-file access to the direct-mode AppArmor profile.
• Code API, egress gateway and sandbox are healthy; local /v1/health returns OK.
• WowLoop Chat container reaches http://wowloop-codeapi-api:3112/v1/health with HTTP 200.
• Authenticated WowLoop JWT verifier passed every required format: XLSX, renamed-text rejection, CSV, DOCX, PPTX, PDF, PNG, JPG, WEBP, SVG, WAV, MP3, MP4, LibreOffice conversion and HTML-to-PDF.
• Verifier generated and downloaded PDF/XLSX/PNG artifacts twice through the real download boundary.
• After restarting the complete Code Interpreter stack, the same Redis and MinIO volumes remained attached, a pre-restart marker downloaded with the identical SHA-256, and the complete authenticated verifier passed again with the same package checksum.
• Independent XLSX inspection confirmed two worksheets, formulas for revenue/cost/profit/margin/CPA, currency and percentage formats, frozen first rows, a native Revenue by plan chart and zero formula-error matches.

Remaining gate

The exact browser Chat XLSX prompt was submitted with Run Code enabled, but the test account returned No key found; every provider currently shows Set API Key. The server runtime and authenticated download boundary are proven, but the real Chat-provider journey must be regenerated after a tester supplies a personal provider key.

This is test deployment evidence only. Production remains NOT READY: KVM isolation is unavailable on this VPS, the manual provider-backed Chat XLSX gate is pending, human approval is still required, and existing image-security findings must be resolved or explicitly accepted through the production release process.