@agenthippo-ai/agenthippo 0.2.3-dataplane → 1.110.11

package/out/test/sandbox-hardening.test.js

@@ -0,0 +1,406 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *
+ *  The three sandbox properties audited: the socket channel is not raceable by another local
+ *  account, the tier reported is the tier delivered, and a raw provider key does not cross into a
+ *  sandbox by accident.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const fs = __importStar(require("node:fs"));
+const net = __importStar(require("node:net"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const containerDriver_1 = require("../sandbox/containerDriver");
+const processDriver_1 = require("../sandbox/processDriver");
+const types_1 = require("../sandbox/types");
+const support_1 = require("../sandbox/support");
+const IMAGE = 'ghcr.io/agenthippoai/pack@sha256:' + 'b'.repeat(64);
+function tmpdir() {
+    return fs.mkdtempSync(path.join(os.tmpdir(), 'ah-sandbox-hard-'));
+}
+function spec(over = {}) {
+    return {
+        sandboxKey: 'sess-1',
+        image: IMAGE,
+        tier: 2,
+        routes: [{ kind: 'inference', target: 'litellm:4000' }],
+        fs: { readonly: [], writable: [] },
+        limits: { ttlSeconds: 0 },
+        ...over,
+    };
+}
+/** docker stub: network internal-ness is configurable, everything else succeeds. */
+function execStub(internal, calls = []) {
+    return async (args) => {
+        calls.push(args);
+        if (args[0] === 'network' && args[1] === 'inspect') {
+            return { stdout: internal ? 'true\n' : 'false\n', code: 0 };
+        }
+        if (args[0] === 'run') {
+            return { stdout: 'container-id\n', code: 0 };
+        }
+        return { stdout: '', code: 0 };
+    };
+}
+suite('sandbox socket directory permissions', () => {
+    test('without a known sandbox uid, the directory is sticky (0o1733) — not the old 0o733', () => {
+        if (process.platform === 'win32') {
+            return;
+        }
+        const dir = path.join(tmpdir(), 'sandbox-x');
+        try {
+            (0, containerDriver_1.prepareSocketDir)(dir);
+            const mode = fs.statSync(dir).mode & 0o7777;
+            assert.strictEqual(mode, 0o1733, `expected sticky 1733, got ${mode.toString(8)}`);
+            // The sticky bit is the whole point: it stops another local account from unlinking or
+            // renaming the socket the sandbox bound and substituting its own.
+            assert.strictEqual(mode & 0o1000, 0o1000, 'sticky bit is set');
+        }
+        finally {
+            fs.rmSync(path.dirname(dir), { recursive: true, force: true });
+        }
+    });
+    test('when the sandbox uid is our own, the directory is 0o700 — nothing else can even traverse', () => {
+        if (process.platform === 'win32' || typeof process.getuid !== 'function') {
+            return;
+        }
+        const dir = path.join(tmpdir(), 'sandbox-y');
+        try {
+            (0, containerDriver_1.prepareSocketDir)(dir, { uid: process.getuid(), gid: process.getgid() });
+            const mode = fs.statSync(dir).mode & 0o7777;
+            assert.strictEqual(mode, 0o700, `expected 0700, got ${mode.toString(8)}`);
+        }
+        finally {
+            fs.rmSync(path.dirname(dir), { recursive: true, force: true });
+        }
+    });
+    test('preparing an existing directory still tightens it', () => {
+        if (process.platform === 'win32') {
+            return;
+        }
+        const dir = path.join(tmpdir(), 'sandbox-z');
+        try {
+            fs.mkdirSync(dir, { recursive: true });
+            fs.chmodSync(dir, 0o777);
+            (0, containerDriver_1.prepareSocketDir)(dir);
+            assert.strictEqual(fs.statSync(dir).mode & 0o7777, 0o1733);
+        }
+        finally {
+            fs.rmSync(path.dirname(dir), { recursive: true, force: true });
+        }
+    });
+});
+suite('sandbox socket identity', () => {
+    test('a real socket we own is accepted', async () => {
+        if (process.platform === 'win32') {
+            return;
+        }
+        const dir = tmpdir();
+        const sockPath = path.join(dir, 'sandbox.sock');
+        const server = net.createServer();
+        try {
+            await new Promise((resolve) => server.listen(sockPath, resolve));
+            assert.doesNotThrow(() => (0, containerDriver_1.assertOwnSocket)(sockPath));
+        }
+        finally {
+            await new Promise((resolve) => server.close(() => resolve()));
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    test('a regular file at the socket path is refused — existence is not readiness', () => {
+        const dir = tmpdir();
+        const sockPath = path.join(dir, 'sandbox.sock');
+        try {
+            fs.writeFileSync(sockPath, 'not a socket');
+            assert.throws(() => (0, containerDriver_1.assertOwnSocket)(sockPath), /not a unix socket/);
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    test('a symlink at the socket path is refused rather than followed', () => {
+        if (process.platform === 'win32') {
+            return;
+        }
+        const dir = tmpdir();
+        const target = path.join(dir, 'real.sock');
+        const sockPath = path.join(dir, 'sandbox.sock');
+        try {
+            fs.writeFileSync(target, '');
+            fs.symlinkSync(target, sockPath);
+            // lstat, not stat: a stat-based check would follow this to the attacker's choice.
+            assert.throws(() => (0, containerDriver_1.assertOwnSocket)(sockPath), /symlink|not a unix socket/);
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    test('a socket owned by a third local account is refused', async () => {
+        if (process.platform === 'win32' || typeof process.getuid !== 'function') {
+            return;
+        }
+        const dir = tmpdir();
+        const sockPath = path.join(dir, 'sandbox.sock');
+        const server = net.createServer();
+        try {
+            await new Promise((resolve) => server.listen(sockPath, resolve));
+            // Simulate "another uid won the bind" by telling the check we are someone else and the
+            // sandbox is someone else again. Real uid manipulation needs root; the decision logic is
+            // what matters and it is exactly this comparison.
+            assert.throws(() => (0, containerDriver_1.assertOwnSocket)(sockPath, { uid: 4242, gid: 4242 }, 9999), /owned by uid/);
+        }
+        finally {
+            await new Promise((resolve) => server.close(() => resolve()));
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+});
+suite('tier-2 egress containment is reported honestly', () => {
+    test('an internal route network yields the requested tier 2', async () => {
+        const dir = tmpdir();
+        try {
+            const driver = new containerDriver_1.ContainerSandboxDriver({
+                exec: execStub(true),
+                socketDir: dir,
+                socketWaitMs: 0,
+                connectFn: () => ({ input: null, output: { write: () => true }, closed: Promise.resolve() }),
+                strictEgress: false,
+            });
+            const handle = await driver.create(spec());
+            assert.strictEqual(handle.tier, 2);
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    test('a NAT\'d route network is reported as tier 1, not the requested 2', async () => {
+        const dir = tmpdir();
+        const warnings = [];
+        const calls = [];
+        try {
+            const driver = new containerDriver_1.ContainerSandboxDriver({
+                exec: execStub(false, calls),
+                socketDir: dir,
+                socketWaitMs: 0,
+                connectFn: () => ({ input: null, output: { write: () => true }, closed: Promise.resolve() }),
+                logger: { info: () => { }, warn: (m) => warnings.push(m) },
+                strictEgress: false,
+            });
+            const handle = await driver.create(spec());
+            // The runtime must never advertise a containment level it is not enforcing.
+            assert.strictEqual(handle.tier, 1, 'the reported tier reflects what was actually built');
+            assert.ok(warnings.some((w) => w.includes('not --internal')), 'the disclosure survives');
+            // And the sandbox itself is told the honest tier, so an engine that stands its own
+            // boundary down at tier >= 2 keeps it.
+            const runCall = calls.find((c) => c[0] === 'run');
+            assert.ok(runCall.includes(`${types_1.SANDBOX_TIER_ENV}=1`), `expected ${types_1.SANDBOX_TIER_ENV}=1 in the run args, got: ${runCall.join(' ')}`);
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    test('strict mode REFUSES a non-internal route network', async () => {
+        const dir = tmpdir();
+        try {
+            const driver = new containerDriver_1.ContainerSandboxDriver({
+                exec: execStub(false),
+                socketDir: dir,
+                socketWaitMs: 0,
+                strictEgress: true,
+            });
+            await assert.rejects(driver.create(spec()), /strict egress containment is enabled/);
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    test('strict mode is opt-in via the environment', () => {
+        assert.strictEqual((0, containerDriver_1.strictEgressFromEnv)({}), false);
+        assert.strictEqual((0, containerDriver_1.strictEgressFromEnv)({ AGENTHIPPO_SANDBOX_STRICT_EGRESS: '1' }), true);
+    });
+    test('a missing route network is still a hard failure, strict or not', async () => {
+        const dir = tmpdir();
+        try {
+            const driver = new containerDriver_1.ContainerSandboxDriver({
+                exec: async (args) => args[0] === 'network' && args[1] === 'inspect'
+                    ? { stdout: 'no such network', code: 1 }
+                    : { stdout: '', code: 0 },
+                socketDir: dir,
+                socketWaitMs: 0,
+            });
+            await assert.rejects(driver.create(spec()), /does not exist/);
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+});
+suite('provider key passthrough into a sandbox', () => {
+    test('CURSOR_API_KEY does NOT cross by default', () => {
+        const warnings = [];
+        const env = (0, processDriver_1.baseSandboxEnv)({ logger: { warn: (m) => warnings.push(m) } }, { PATH: '/usr/bin', CURSOR_API_KEY: 'sk-cursor-live' });
+        assert.strictEqual(env.CURSOR_API_KEY, undefined, 'the provider key must not cross by default');
+        assert.strictEqual(env.PATH, '/usr/bin', 'the non-secret allowlist is unaffected');
+        assert.ok(warnings.some((w) => w.includes('AGENTHIPPO_SANDBOX_ALLOW_PROVIDER_KEY')), 'the refusal is actionable, not silent');
+    });
+    test('the explicit opt-in lets it cross', () => {
+        const env = (0, processDriver_1.baseSandboxEnv)({ allowProviderKeyPassthrough: true }, { PATH: '/usr/bin', CURSOR_API_KEY: 'sk-cursor-live' });
+        assert.strictEqual(env.CURSOR_API_KEY, 'sk-cursor-live');
+    });
+    test('the env-var opt-in is read the same way', () => {
+        assert.strictEqual((0, processDriver_1.providerKeyPassthroughFromEnv)({}), false);
+        assert.strictEqual((0, processDriver_1.providerKeyPassthroughFromEnv)({ AGENTHIPPO_SANDBOX_ALLOW_PROVIDER_KEY: '1' }), true);
+    });
+    test('no other secret is in the allowlist', () => {
+        const env = (0, processDriver_1.baseSandboxEnv)({ allowProviderKeyPassthrough: true }, {
+            PATH: '/usr/bin',
+            ANTHROPIC_API_KEY: 'sk-ant',
+            OPENAI_API_KEY: 'sk-oai',
+            AGENTHIPPO_LITELLM_API_KEY: 'ahk',
+            AGENTHIPPO_TURN_NONCE: 'nonce',
+        });
+        assert.deepStrictEqual(Object.keys(env).sort(), ['PATH']);
+    });
+    test('boot-stable route URLs cross into a tier-0 sandbox (MCP + inference proxy)', () => {
+        const env = (0, processDriver_1.baseSandboxEnv)({}, {
+            PATH: '/usr/bin',
+            AGENTHIPPO_DATA_MCP_URL: 'http://connector:9090/mcp',
+            AGENTHIPPO_LITELLM_BASE_URL: 'http://gateway:3456/v1',
+            ANTHROPIC_API_KEY: 'sk-ant',
+        });
+        assert.strictEqual(env.AGENTHIPPO_DATA_MCP_URL, 'http://connector:9090/mcp');
+        assert.strictEqual(env.AGENTHIPPO_LITELLM_BASE_URL, 'http://gateway:3456/v1');
+        assert.strictEqual(env.ANTHROPIC_API_KEY, undefined);
+    });
+    test('a sandbox holding a provider key is flagged in its own environment', async () => {
+        const spawned = [];
+        const driver = new processDriver_1.ProcessSandboxDriver({
+            command: 'node',
+            allowProviderKeyPassthrough: true,
+            env: { CURSOR_API_KEY: 'sk-cursor-live' },
+            spawnFn: ((_cmd, _args, opts) => {
+                spawned.push(opts);
+                return {
+                    stdout: null, stdin: null, exitCode: null, killed: false,
+                    once: () => undefined, kill: () => true,
+                };
+            }),
+        });
+        await driver.create(spec({ tier: 0, routes: [] }));
+        assert.strictEqual(spawned[0].env?.[types_1.SANDBOX_PROVIDER_KEY_ENV], '1');
+        assert.strictEqual((0, types_1.sandboxHoldsProviderKey)(spawned[0].env), true);
+    });
+    test('a sandbox without one carries no such flag', async () => {
+        const spawned = [];
+        const driver = new processDriver_1.ProcessSandboxDriver({
+            command: 'node',
+            spawnFn: ((_cmd, _args, opts) => {
+                spawned.push(opts);
+                return {
+                    stdout: null, stdin: null, exitCode: null, killed: false,
+                    once: () => undefined, kill: () => true,
+                };
+            }),
+        });
+        await driver.create(spec({ tier: 0, routes: [] }));
+        assert.strictEqual(spawned[0].env?.[types_1.SANDBOX_PROVIDER_KEY_ENV], undefined);
+        assert.strictEqual((0, types_1.sandboxHoldsProviderKey)(spawned[0].env), false);
+    });
+    test('the detector looks at the actual child env', () => {
+        assert.strictEqual((0, processDriver_1.sandboxEnvCarriesProviderKey)({ PATH: '/usr/bin' }), false);
+        assert.strictEqual((0, processDriver_1.sandboxEnvCarriesProviderKey)({ CURSOR_API_KEY: 'x' }), true);
+    });
+});
+suite('cell → sandbox environment migration', () => {
+    test('a stale AGENTHIPPO_CELL_* variable still works, and says so loudly', () => {
+        const env = { AGENTHIPPO_CELL_TIER: '2' };
+        const warnings = [];
+        const applied = (0, support_1.applyDeprecatedSandboxEnvAliases)(env, (m) => warnings.push(m), new Set());
+        assert.deepStrictEqual(applied, ['AGENTHIPPO_SANDBOX_TIER']);
+        assert.strictEqual(env.AGENTHIPPO_SANDBOX_TIER, '2', 'the operator gets the tier they asked for');
+        assert.strictEqual(warnings.length, 1);
+        assert.ok(warnings[0].includes('DEPRECATED'));
+        assert.ok(warnings[0].includes('AGENTHIPPO_SANDBOX_TIER'), 'the warning names the new spelling');
+    });
+    test('the bare AGENTHIPPO_CELL flag is aliased too', () => {
+        const env = { AGENTHIPPO_CELL: '1' };
+        (0, support_1.applyDeprecatedSandboxEnvAliases)(env, () => { }, new Set());
+        assert.strictEqual(env.AGENTHIPPO_SANDBOX, '1');
+    });
+    test('a migrated operator is never overridden by a leftover old variable', () => {
+        const env = {
+            AGENTHIPPO_CELL_SOCKET_DIR: '/old/path',
+            AGENTHIPPO_SANDBOX_SOCKET_DIR: '/new/path',
+        };
+        const warnings = [];
+        (0, support_1.applyDeprecatedSandboxEnvAliases)(env, (m) => warnings.push(m), new Set());
+        assert.strictEqual(env.AGENTHIPPO_SANDBOX_SOCKET_DIR, '/new/path', 'the new name wins');
+        assert.ok(warnings[0].includes('IGNORING'), 'and the conflict is still reported');
+    });
+    test('an unset old variable produces no warning and no alias', () => {
+        const env = {};
+        const warnings = [];
+        assert.deepStrictEqual((0, support_1.applyDeprecatedSandboxEnvAliases)(env, (m) => warnings.push(m), new Set()), []);
+        assert.deepStrictEqual(warnings, []);
+    });
+    test('the warning is emitted once per process, not once per turn', () => {
+        const once = new Set();
+        const warnings = [];
+        for (let i = 0; i < 3; i++) {
+            (0, support_1.applyDeprecatedSandboxEnvAliases)({ AGENTHIPPO_CELL_TIER: '2' }, (m) => warnings.push(m), once);
+        }
+        assert.strictEqual(warnings.length, 1);
+    });
+});
+suite('single-file build script detection', () => {
+    test('a real script path is forwarded', () => {
+        assert.deepStrictEqual((0, support_1.sandboxScriptArg)(['node', '/app/out/cli/index.js'], 'node'), ['/app/out/cli/index.js']);
+    });
+    test('the bun and pkg virtual roots are not forwarded', () => {
+        assert.deepStrictEqual((0, support_1.sandboxScriptArg)(['bin', '/$bunfs/root/index.js'], 'bin'), []);
+        assert.deepStrictEqual((0, support_1.sandboxScriptArg)(['bin', '/snapshot/app/index.js'], 'bin'), []);
+    });
+    test("pkg's Windows form is recognised too", () => {
+        // `C:\snapshot\app\index.js` used to slip through the startsWith('/snapshot') check.
+        assert.deepStrictEqual((0, support_1.sandboxScriptArg)(['bin.exe', 'C:\\snapshot\\app\\index.js'], 'bin.exe'), []);
+    });
+    test('argv[1] equal to the exec path (a compiled binary) yields no script', () => {
+        assert.deepStrictEqual((0, support_1.sandboxScriptArg)(['/usr/local/bin/agenthippo', '/usr/local/bin/agenthippo'], '/usr/local/bin/agenthippo'), []);
+    });
+});