Node / ReticulumProjects / MeshChatX.git / files / docs / agents / skills / landlock-sqlite / SKILL.md

Displaying Raw • View rendered • Download

Tc9d1d9# Skill: landlock-sqlite

Landlock / Windows AppContainer + SQLite conversation-load failures (temp_store, slim queries, memory pressure). Also covers subprocess and user-local CLI breakage under Linux Landlock.

Tc9d1d9# MeshChatX FS sandbox + SQLite

Tc9d1d9## Symptoms

Tff7b72- Ta5d6ff`/api/v1/lxmf/conversations` or Ta5d6ff`/api/v1/notifications` return 500/503

Tff7b72- Logs show Ta5d6ff`sqlite3.OperationalError: unable to open database file`

Tff7b72- Happens after Landlock or Windows AppContainer enables, often with large message Ta5d6ff`fields` / base64 blobs

Tc9d1d9## Root causes (priority order)

Tff7b721. Worker-thread connections missing Ta5d6ff`PRAGMA temp_store=MEMORY` (Ta5d6ff`DatabaseProvider._configure_connection`)

Tff7b722. Conversation SELECT pulling full Ta5d6ff`content` / Ta5d6ff`fields`

Tff7b723. Memory-pressure switching to Ta5d6ff`temp_store=FILE` under a filesystem sandbox

Tff7b724. Identity context not ready (should be 503, not 500)

Tc9d1d9## Required behavior

Tff7b72- Default: Ta5d6ff`temp_store=MEMORY` on every new connection

Tff7b72- FS sandbox active (Ta5d6ff`landlock_active` or Ta5d6ff`appcontainer_active` / Ta5d6ff`fs_sandbox_active`) + memory pressure: shrink cache/mmap, **keep MEMORY temp**

Tff7b72- Non-sandbox memory pressure may use FILE temp + storage-local Ta5d6ff`sqlite-tmp` TMPDIR

Tff7b72- List queries: Ta5d6ff`substr(content, 1, 240)` and SQL Ta5d6ff`instr` flags for attachments

Tff7b72- API: map OperationalError / unable-to-open / locked to **503** with retryable message

Tc9d1d9## Subprocess and user-local tools (Linux Landlock)

Tc9d1d9### Symptoms

Tff7b72- Translator shows Argos as available but **no languages** after Refresh, or translation fails with Ta5d6ff`Permission denied`

Tff7b72- Ta5d6ff`argospm list` or Ta5d6ff`argos-translate` works in a normal shell but not inside MeshChatX

Tff7b72- PATH tools in Ta5d6ff`~/.local/bin` fail while Ta5d6ff`/usr/bin` tools work

Tc9d1d9### Root causes

Tff7b721. Landlock read roots did not include pipx or user-local install paths (Ta5d6ff`~/.local/bin`, Ta5d6ff`~/.local/share/pipx`)

Tff7b722. Argos Stanza needs **write** under Ta5d6ff`~/.local/share/argos-translate` (not read-only)

Tff7b723. Ta5d6ff`TranslatorHandler` used Python Ta5d6ff`argostranslate` with zero packages and did not fall back to Ta5d6ff`argospm list`

Tff7b724. Symlink wrappers in Ta5d6ff`~/.local/bin` that point outside allowed trees (not fixable by widening Ta5d6ff`~/.local/bin` alone)

Tc9d1d9### Required behavior

Tff7b72- Ta5d6ff`_collect_read_roots()` includes user-local CLI roots when present (Ta5d6ff`landlock_sandbox._collect_user_local_cli_roots`)

Tff7b72- Ta5d6ff`_collect_rw_roots()` includes Ta5d6ff`~/.local/share/argos-translate` when present

Tff7b72- New external-tool integrations: add roots and a probe in Ta5d6ff`tests/backend/test_landlock_integration_surfaces.py`

Tc9d1d9## Windows counterpart

Tff7b72- Module: Ta5d6ff`meshchatx/src/backend/appcontainer_sandbox.py`

Tff7b72- Launcher: Ta5d6ff`meshchatx/src/backend/appcontainer_launcher.py` via Ta5d6ff`--meshchatx-run-module`

Tff7b72- Electron win32 spawn uses the launcher only when Ta5d6ff`MESHCHAT_APPCONTAINER=1`

Tc9d1d9## Verification

Ta5d6ff```Ta5d6ffbash

uv run pytest tests/backend/test_sqlite_landlock_temp_store.py tests/backend/test_sqlite_memory_pressure.py tests/backend/test_landlock_sandbox.py tests/backend/test_landlock_integration_surfaces.py tests/backend/test_appcontainer_sandbox.py tests/backend/test_self_check.py -q

pnpm Tffa657exec vitest run tests/frontend/i18n.test.js

bash scripts/ci/github-verify-frozen-sandbox.sh build/exe

Ta5d6ff```

For live stress, run Landlock in a **subprocess** (sandbox applies once per process). Expect FILE temp complex queries to fail under Landlock. MEMORY must pass. On Windows, confirm Ta5d6ff`appcontainer_active` via Ta5d6ff`/api/v1/server/security`. Headless self-check includes Ta5d6ff`FS Sandbox Modules` and requires AppContainer status fields on Ta5d6ff`/api/v1/server/security`.

Tc9d1d9## Key files

Tff7b72- Ta5d6ff`meshchatx/src/backend/database/provider.py`

Tff7b72- Ta5d6ff`meshchatx/src/backend/database/__init__.py`

Tff7b72- Ta5d6ff`meshchatx/src/backend/memory_pressure.py`

Tff7b72- Ta5d6ff`meshchatx/src/backend/landlock_sandbox.py`

Tff7b72- Ta5d6ff`meshchatx/src/backend/appcontainer_sandbox.py`

Tff7b72- Ta5d6ff`meshchatx/src/backend/appcontainer_launcher.py`

Tff7b72- Ta5d6ff`meshchatx/src/backend/seccomp_sandbox.py` (syscall denylist after Landlock)

Tff7b72- Ta5d6ff`meshchatx/src/backend/translator_handler.py` (Argos CLI and lib language listing)

Tff7b72- Ta5d6ff`tests/backend/landlock_integration_support.py`

Tff7b72- Ta5d6ff`tests/backend/test_landlock_integration_surfaces.py`