@agenthippo-ai/agenthippo 0.2.3-dataplane → 1.110.11

package/out/cli/commands/sandbox.js

@@ -0,0 +1,351 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveSandboxWorkspace = resolveSandboxWorkspace;
+exports.isForeignWorkspace = isForeignWorkspace;
+exports.sandboxCommand = sandboxCommand;
+/**
+ * `agenthippo sandbox` — the in-sandbox runner entrypoint (PLAN/serve-v4-clean.md §3–§4).
+ *
+ * This is the process that runs INSIDE a sandbox. It owns the real engine and speaks the frame
+ * protocol out over either a unix socket (the `container` driver) or stdio (the `process`
+ * driver). It holds no credential: the model is reached through `baseUrl` + the per-sandbox
+ * `modelToken` that arrives on each run frame, and data through the gateway URL with a
+ * per-turn nonce. Nothing here can mint authority.
+ */
+const fs = __importStar(require("fs"));
+const net = __importStar(require("net"));
+const path = __importStar(require("path"));
+const headless_1 = require("../../headless");
+const utils_1 = require("../utils");
+const pack_loader_1 = require("../pack-loader");
+const pack_runtime_1 = require("../pack-runtime");
+const deps_1 = require("../deps");
+const serve_hardening_1 = require("../serve-hardening");
+const runtime_1 = require("../runtime");
+const host_1 = require("../../runner/host");
+/**
+ * The sandbox's OWN workspace is authoritative — never the one on the wire.
+ *
+ * serve sends its HOST workspace path on every run frame. Across a container boundary that path
+ * is meaningless, and honouring it was the bug behind "codex discards the write": the sandbox
+ * mkdir'd serve's host path INSIDE the sandbox and ran the engine there, so every file the engine
+ * wrote landed in a container-private directory — present via ls/cat inside the sandbox during the
+ * turn, absent on the host, gone when the sandbox died. The engine also ran in a directory holding
+ * none of the synced pack content. Proven with a probe: a sandbox handed a workspaceRoot that
+ * exists on no host created it and worked there.
+ *
+ * At tier 0 the two are the same path (serve passes `--workspace`), so nothing changes there.
+ */
+function resolveSandboxWorkspace(_wireRoot, sandboxWorkspace) {
+    return sandboxWorkspace;
+}
+/** True when the wire asked for a workspace this sandbox will not use — worth saying out loud once. */
+function isForeignWorkspace(wireRoot, sandboxWorkspace) {
+    if (!wireRoot) {
+        return false;
+    }
+    return path.resolve(wireRoot) !== path.resolve(sandboxWorkspace);
+}
+/**
+ * Adapts the headless runner to `AgentEngine` so `startRunnerHost` can drive it. The model
+ * credential is *per-run* — it rides each frame rather than the runner — and this process never
+ * persists a provider key of its own.
+ */
+class SandboxEngine {
+    defaults;
+    id = 'sandbox';
+    displayName = 'Sandbox runner';
+    runner;
+    builtWith;
+    /** Log the wire/sandbox workspace mismatch once, not once per turn. */
+    warnedWorkspace = false;
+    /** Last native engine session id — rides the terminal frame for resume after sandbox death. */
+    nativeSessionId;
+    constructor(defaults) {
+        this.defaults = defaults;
+    }
+    ensureRunner(opts) {
+        // Keyed on baseUrl ALONE. The warrant is re-minted every turn (runner/remoteEngine.ts), so
+        // including it rebuilt — and disposed — the runner on every single turn. Harmless while a
+        // sandbox held one session and turns arrived one at a time; with several of a user's
+        // sessions here, that dispose lands in the middle of another session's stream. The token
+        // now travels per run instead (`modelToken` below).
+        const key = opts.baseUrl ?? '';
+        if (this.runner && this.builtWith === key) {
+            return this.runner;
+        }
+        this.runner?.dispose();
+        // The same factory serve builds its own runner with — engine executables, bundled base
+        // prompts and the child env patch all resolve identically on both sides of the boundary.
+        this.runner = (0, pack_runtime_1.createPackRunner)({
+            storagePath: this.defaults.storagePath,
+            analyticsSessionsDir: this.defaults.analyticsSessionsDir,
+            packId: this.defaults.packId,
+            packVersion: this.defaults.packVersion,
+            provenance: () => (0, runtime_1.readProvenanceEnvFromProcess)(),
+            workspaceRoot: this.defaults.workspace,
+            credentials: {
+                baseUrl: opts.baseUrl,
+                // The warrant this runner was BUILT with, kept only as the fallback for a frame
+                // that carries none; every turn normally supplies its own.
+                litellmApiKey: opts.modelToken,
+                useLiteLLM: Boolean(opts.baseUrl),
+            },
+            claudeCheapModel: this.defaults.claudeCheapModel,
+            omitGatewayToken: true,
+        });
+        this.builtWith = key;
+        return this.runner;
+    }
+    async stream(message, options, emitter, _runtime, signal) {
+        const wire = options;
+        const wireRoot = wire.workspaceRoot;
+        const workspaceRoot = resolveSandboxWorkspace(wireRoot, this.defaults.workspace);
+        if (isForeignWorkspace(wireRoot, workspaceRoot) && !this.warnedWorkspace) {
+            this.warnedWorkspace = true;
+            console.warn(`[sandbox] ignoring workspaceRoot ${wireRoot} from the wire — this sandbox works in ${workspaceRoot}`);
+        }
+        try {
+            fs.mkdirSync(workspaceRoot, { recursive: true });
+            // Without the chdir the engine inherits the sandbox process's cwd and a tool that writes
+            // a RELATIVE path (codex runs `sh -lc 'printf ... > proof.txt'`) lands the file outside
+            // the workspace — it exits 0, the agent reports success, work is lost.
+            //
+            // INVARIANT: workspace scope must never be narrower than sandbox scope. chdir is
+            // process-global; concurrent turns in one sandbox are only safe when every session
+            // resolves to the same workspaceRoot (serve's sandboxFsFor must key writable mounts at
+            // sandbox scope, not session scope). The chdir is then idempotent. Per-session workspaces
+            // inside a shared sandbox would race here — stream demuxing would not fix it.
+            process.chdir(workspaceRoot);
+        }
+        catch (err) {
+            throw new Error(`sandbox cannot use workspace ${workspaceRoot}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        const runner = this.ensureRunner(wire);
+        // Permissions MUST cross: they decide the ENGINE's own sandbox mode (codex maps
+        // workspace-write → sandboxMode=workspace-write, read-only → read-only). Dropping them
+        // silently downgraded every sandbox turn to the default, so codex's shell exited 0 while its
+        // sandbox discarded the write — reads and commands worked, files never appeared.
+        // Observed live on tier 2. Accept either serve's nested `permissions` or a bare
+        // `fileAccess` on the options.
+        const loose = wire;
+        // Last resort is the PACK's own declared fileAccess, not the engine default: a frame that
+        // somehow arrives without permissions must not hand the engine more access than the
+        // manifest asks for.
+        const perms = loose.permissions
+            ?? (loose.fileAccess ? { fileAccess: loose.fileAccess } : { fileAccess: this.defaults.fileAccess });
+        const result = await runner.run({
+            engineId: wire.engineId ?? this.defaults.engineId,
+            modelId: wire.modelId ?? this.defaults.modelId,
+            message,
+            workspaceRoot,
+            additionalDirectories: wire.additionalDirectories,
+            sessionId: wire.sessionId,
+            // Per-turn warrant, not the one this runner was built with — see ensureRunner.
+            modelToken: wire.modelToken,
+            permissions: perms,
+            // Parity with serve's in-process runner: attribution for evidence, the per-turn
+            // data-plane nonce (without which a sandbox cannot reach the data gateway at all), and
+            // the bound gateway session.
+            analyticsUserId: wire.analyticsUserId,
+            // The credential does not cross into this process by design, so the per-user engine
+            // home key arrives pre-computed on the frame. Absent ⇒ unscoped, which is correct for
+            // a single-tenant run and is what every multi-user sandbox turn used to get.
+            engineHomeUserKey: wire.engineHomeUserKey,
+            turnEnv: wire.turnEnv,
+            gatewaySessionKey: wire.gatewaySessionKey,
+            emitter,
+            signal,
+        });
+        // A failed run must reject so the host emits `failed`, not `result` — otherwise serve
+        // would record a successful turn for a turn that errored.
+        if (!result.success && result.error) {
+            throw new Error(result.error);
+        }
+    }
+    onMaintenance() { }
+    dispose() { this.runner?.dispose(); }
+}
+/**
+ * A sandbox outlives every turn it runs — and under user scope holds several of one person's
+ * sessions — so an engine-side async error must not take the process down: that would lose every
+ * conversation here, not just the turn. Vendor SDKs reject outside the
+ * `engine.stream()` await chain (observed: the Claude SDK's `streamInput` rejecting after its
+ * child process dies), which Node treats as fatal by default. Log and stay up; the turn's own
+ * catch still emits `failed`, and serve can always destroy the sandbox if it wants it gone.
+ *
+ * `uncaughtException` is NOT swallowed: after one the process state is unreliable, so exit and
+ * let the driver create a fresh sandbox.
+ */
+function installSandboxResilience() {
+    process.on('unhandledRejection', (reason) => {
+        const msg = reason instanceof Error ? reason.message : String(reason);
+        console.error(`[sandbox] unhandled rejection (session kept alive): ${msg}`);
+    });
+    process.on('uncaughtException', (err) => {
+        console.error(`[sandbox] uncaught exception — exiting so the driver recreates this sandbox: ${err.message}`);
+        process.exit(1);
+    });
+}
+async function sandboxCommand(options) {
+    // Every other command does this in its action; a sandbox needs it too, or a dev-box sandbox has no
+    // engine SDKs at all. In a self-contained image AGENTHIPPO_NO_AUTO_INSTALL=1 makes it a no-op.
+    await (0, deps_1.ensureDeps)(false);
+    const stateDir = options.stateDir ?? '/state';
+    const workspaceForLoad = options.workspace ?? path.join(stateDir, 'workspace');
+    fs.mkdirSync(workspaceForLoad, { recursive: true });
+    // The real loader, exactly as serve uses it — and `--agent` is a name-OR-path for the same
+    // reason it is everywhere else. The previous code resolved it as a path and demanded
+    // agent.yaml there, so `serve --agent joker1 --sandbox process` handed the sandbox a bare name
+    // it turned into <cwd>/joker1 and every turn died with "No agent.yaml". The hand-rolled regex
+    // before that only matched block-style YAML, so a flow-style manifest (`metadata: { name: x }`)
+    // silently fell back to 'default' — which is how CODEX_HOME ended up at agents/default instead
+    // of agents/<pack>, breaking per-pack engine isolation inside sandboxes.
+    const pack = await (0, pack_loader_1.loadAgentPack)(options.agent, workspaceForLoad);
+    const manifest = {
+        name: pack.manifest.metadata.name,
+        version: pack.manifest.metadata.version,
+        engine: pack.manifest.spec?.engine ?? 'claude',
+    };
+    // A sandbox runs on a read-only root by design, so every writable path must live under the one
+    // mounted state directory. `--state-dir` is authoritative here and OVERRIDES the image's
+    // baked AGENTHIPPO_HOME (the runtime image sets /state, which is read-only unless mounted);
+    // otherwise the engine's cache lands on the read-only root and the first turn dies with
+    // EROFS — observed live on Linux.
+    if (options.stateDir) {
+        process.env.AGENTHIPPO_HOME = stateDir;
+    }
+    else {
+        process.env.AGENTHIPPO_HOME = process.env.AGENTHIPPO_HOME ?? stateDir;
+    }
+    // HOME too, not just AGENTHIPPO_HOME: engine SDKs write to dot-directories under $HOME
+    // (the Cursor SDK uses ~/.cursor, codex/claude keep caches there), and the image's default
+    // HOME sits on the read-only root — so every such write fails with ENOENT/EROFS inside a
+    // sandbox. Observed live on tier 2 with the Cursor SDK.
+    // Declare that a sandbox surrounds this process. This says WHERE we are, not how confined we
+    // are: whether an engine may stand its own boundary down is answered by AGENTHIPPO_SANDBOX_TIER
+    // (see sandbox/types.ts), which only the driver sets and only tier 2 satisfies. Deriving
+    // "unconfined is safe" from this flag is what made `--sandbox process` weaker than no sandbox.
+    process.env.AGENTHIPPO_SANDBOX = '1';
+    const sandboxHome = path.join(stateDir, 'home');
+    fs.mkdirSync(sandboxHome, { recursive: true });
+    process.env.HOME = sandboxHome;
+    // Hydrate the workspace from the mounted pack — the SAME call serve makes at boot. A sandbox
+    // holds exactly one user's session, so it should look exactly like the single-user case:
+    // pack content (skills, rules, engine config) lives IN the workspace, and every downstream
+    // path (`getSkillsSignature(workspaceRoot)`, engine homes) resolves off that one root.
+    // Without this the pack stayed a read-only mount the engines never looked at, so no pack
+    // skill was ever visible inside a sandbox — observed live on tier 2.
+    const workspace = workspaceForLoad;
+    await (0, headless_1.syncPackToWorkspace)(workspace, pack.packPath, manifest.name, manifest.engine, console, (0, utils_1.findBundledBasePromptsDir)());
+    console.log(`[sandbox] pack ${manifest.name}@${manifest.version ?? '?'} synced into ${workspace} (engine ${manifest.engine})`);
+    // Only NOW: everything above is boot, and a boot failure must be fatal so the driver sees a
+    // dead sandbox and reports the real error. Swallowing it would leave a sandbox that answers every
+    // turn with "channel closed" and no cause.
+    installSandboxResilience();
+    const rawCheapModel = pack.manifest.spec?.cheapModel?.trim();
+    const engine = new SandboxEngine({
+        storagePath: stateDir,
+        // Land evidence where serve and Spotlight already scan, rather than the headless default.
+        analyticsSessionsDir: (0, serve_hardening_1.resolveAnalyticsSessionsDir)(stateDir, false),
+        packId: manifest.name,
+        packVersion: manifest.version,
+        engineId: manifest.engine,
+        // serve normally sends modelId on every frame; this is the fallback, and it comes from the
+        // pack the same way serve's does instead of a hardcoded alias.
+        modelId: (0, headless_1.resolveModelAlias)(pack.manifest.spec?.model?.trim() || 'ah-auto'),
+        claudeCheapModel: rawCheapModel ? (0, headless_1.resolveModelAlias)(rawCheapModel) : undefined,
+        fileAccess: (0, pack_loader_1.getFileAccess)(pack),
+        workspace,
+    });
+    const runtime = { logger: console };
+    if (options.stdio) {
+        const host = (0, host_1.startRunnerHost)({
+            engine, runtime,
+            input: process.stdin,
+            output: { write: (c) => process.stdout.write(c) },
+            nativeSessionId: () => engine.nativeSessionId,
+        });
+        await host.done;
+        return;
+    }
+    const socketPath = options.socket;
+    if (!socketPath) {
+        throw new Error('sandbox requires --socket <path> or --stdio');
+    }
+    // A stale socket from a previous sandbox would make bind fail; the sandbox owns this path.
+    try {
+        fs.unlinkSync(socketPath);
+    }
+    catch { /* not there — fine */ }
+    const server = net.createServer((conn) => {
+        (0, host_1.startRunnerHost)({
+            engine, runtime,
+            input: conn,
+            output: { write: (c) => conn.write(c) },
+            nativeSessionId: () => engine.nativeSessionId,
+        });
+    });
+    // Binding is fatal: a sandbox nobody can reach is useless, and exiting 0 would tell the driver
+    // the sandbox is healthy while every turn fails on a dead channel (observed live).
+    try {
+        await new Promise((resolve, reject) => {
+            server.once('error', reject);
+            server.listen(socketPath, () => resolve());
+        });
+    }
+    catch (err) {
+        console.error(`[sandbox] FATAL: cannot listen at ${socketPath}: ${err instanceof Error ? err.message : String(err)}`);
+        process.exit(1);
+    }
+    // 0o660: the sandbox owns the socket; serve connects from the host. serve manages the container
+    // runtime (already root-equivalent), so it can connect; no other local uid can. Only the
+    // sandbox's own mount namespace has this path at all — the mode is defence in depth.
+    try {
+        fs.chmodSync(socketPath, 0o660);
+    }
+    catch { /* best effort */ }
+    console.log(`[sandbox] ${options.sandboxId ?? 'sandbox'} listening on ${socketPath} (pack ${manifest.name}@${manifest.version ?? '?'})`);
+    await new Promise((resolve) => {
+        const shutdown = () => { server.close(() => resolve()); engine.dispose(); };
+        process.once('SIGTERM', shutdown);
+        process.once('SIGINT', shutdown);
+        server.once('close', () => resolve());
+    });
+}