@agenthippo-ai/agenthippo 1.110.11 → 1.110.20

package/out/cli/commands/sandbox.js

@@ -1,351 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolveSandboxWorkspace = resolveSandboxWorkspace;
-exports.isForeignWorkspace = isForeignWorkspace;
-exports.sandboxCommand = sandboxCommand;
-/**
- * `agenthippo sandbox` — the in-sandbox runner entrypoint (PLAN/serve-v4-clean.md §3–§4).
- *
- * This is the process that runs INSIDE a sandbox. It owns the real engine and speaks the frame
- * protocol out over either a unix socket (the `container` driver) or stdio (the `process`
- * driver). It holds no credential: the model is reached through `baseUrl` + the per-sandbox
- * `modelToken` that arrives on each run frame, and data through the gateway URL with a
- * per-turn nonce. Nothing here can mint authority.
- */
-const fs = __importStar(require("fs"));
-const net = __importStar(require("net"));
-const path = __importStar(require("path"));
-const headless_1 = require("../../headless");
-const utils_1 = require("../utils");
-const pack_loader_1 = require("../pack-loader");
-const pack_runtime_1 = require("../pack-runtime");
-const deps_1 = require("../deps");
-const serve_hardening_1 = require("../serve-hardening");
-const runtime_1 = require("../runtime");
-const host_1 = require("../../runner/host");
-/**
- * The sandbox's OWN workspace is authoritative — never the one on the wire.
- *
- * serve sends its HOST workspace path on every run frame. Across a container boundary that path
- * is meaningless, and honouring it was the bug behind "codex discards the write": the sandbox
- * mkdir'd serve's host path INSIDE the sandbox and ran the engine there, so every file the engine
- * wrote landed in a container-private directory — present via ls/cat inside the sandbox during the
- * turn, absent on the host, gone when the sandbox died. The engine also ran in a directory holding
- * none of the synced pack content. Proven with a probe: a sandbox handed a workspaceRoot that
- * exists on no host created it and worked there.
- *
- * At tier 0 the two are the same path (serve passes `--workspace`), so nothing changes there.
- */
-function resolveSandboxWorkspace(_wireRoot, sandboxWorkspace) {
-    return sandboxWorkspace;
-}
-/** True when the wire asked for a workspace this sandbox will not use — worth saying out loud once. */
-function isForeignWorkspace(wireRoot, sandboxWorkspace) {
-    if (!wireRoot) {
-        return false;
-    }
-    return path.resolve(wireRoot) !== path.resolve(sandboxWorkspace);
-}
-/**
- * Adapts the headless runner to `AgentEngine` so `startRunnerHost` can drive it. The model
- * credential is *per-run* — it rides each frame rather than the runner — and this process never
- * persists a provider key of its own.
- */
-class SandboxEngine {
-    defaults;
-    id = 'sandbox';
-    displayName = 'Sandbox runner';
-    runner;
-    builtWith;
-    /** Log the wire/sandbox workspace mismatch once, not once per turn. */
-    warnedWorkspace = false;
-    /** Last native engine session id — rides the terminal frame for resume after sandbox death. */
-    nativeSessionId;
-    constructor(defaults) {
-        this.defaults = defaults;
-    }
-    ensureRunner(opts) {
-        // Keyed on baseUrl ALONE. The warrant is re-minted every turn (runner/remoteEngine.ts), so
-        // including it rebuilt — and disposed — the runner on every single turn. Harmless while a
-        // sandbox held one session and turns arrived one at a time; with several of a user's
-        // sessions here, that dispose lands in the middle of another session's stream. The token
-        // now travels per run instead (`modelToken` below).
-        const key = opts.baseUrl ?? '';
-        if (this.runner && this.builtWith === key) {
-            return this.runner;
-        }
-        this.runner?.dispose();
-        // The same factory serve builds its own runner with — engine executables, bundled base
-        // prompts and the child env patch all resolve identically on both sides of the boundary.
-        this.runner = (0, pack_runtime_1.createPackRunner)({
-            storagePath: this.defaults.storagePath,
-            analyticsSessionsDir: this.defaults.analyticsSessionsDir,
-            packId: this.defaults.packId,
-            packVersion: this.defaults.packVersion,
-            provenance: () => (0, runtime_1.readProvenanceEnvFromProcess)(),
-            workspaceRoot: this.defaults.workspace,
-            credentials: {
-                baseUrl: opts.baseUrl,
-                // The warrant this runner was BUILT with, kept only as the fallback for a frame
-                // that carries none; every turn normally supplies its own.
-                litellmApiKey: opts.modelToken,
-                useLiteLLM: Boolean(opts.baseUrl),
-            },
-            claudeCheapModel: this.defaults.claudeCheapModel,
-            omitGatewayToken: true,
-        });
-        this.builtWith = key;
-        return this.runner;
-    }
-    async stream(message, options, emitter, _runtime, signal) {
-        const wire = options;
-        const wireRoot = wire.workspaceRoot;
-        const workspaceRoot = resolveSandboxWorkspace(wireRoot, this.defaults.workspace);
-        if (isForeignWorkspace(wireRoot, workspaceRoot) && !this.warnedWorkspace) {
-            this.warnedWorkspace = true;
-            console.warn(`[sandbox] ignoring workspaceRoot ${wireRoot} from the wire — this sandbox works in ${workspaceRoot}`);
-        }
-        try {
-            fs.mkdirSync(workspaceRoot, { recursive: true });
-            // Without the chdir the engine inherits the sandbox process's cwd and a tool that writes
-            // a RELATIVE path (codex runs `sh -lc 'printf ... > proof.txt'`) lands the file outside
-            // the workspace — it exits 0, the agent reports success, work is lost.
-            //
-            // INVARIANT: workspace scope must never be narrower than sandbox scope. chdir is
-            // process-global; concurrent turns in one sandbox are only safe when every session
-            // resolves to the same workspaceRoot (serve's sandboxFsFor must key writable mounts at
-            // sandbox scope, not session scope). The chdir is then idempotent. Per-session workspaces
-            // inside a shared sandbox would race here — stream demuxing would not fix it.
-            process.chdir(workspaceRoot);
-        }
-        catch (err) {
-            throw new Error(`sandbox cannot use workspace ${workspaceRoot}: ${err instanceof Error ? err.message : String(err)}`);
-        }
-        const runner = this.ensureRunner(wire);
-        // Permissions MUST cross: they decide the ENGINE's own sandbox mode (codex maps
-        // workspace-write → sandboxMode=workspace-write, read-only → read-only). Dropping them
-        // silently downgraded every sandbox turn to the default, so codex's shell exited 0 while its
-        // sandbox discarded the write — reads and commands worked, files never appeared.
-        // Observed live on tier 2. Accept either serve's nested `permissions` or a bare
-        // `fileAccess` on the options.
-        const loose = wire;
-        // Last resort is the PACK's own declared fileAccess, not the engine default: a frame that
-        // somehow arrives without permissions must not hand the engine more access than the
-        // manifest asks for.
-        const perms = loose.permissions
-            ?? (loose.fileAccess ? { fileAccess: loose.fileAccess } : { fileAccess: this.defaults.fileAccess });
-        const result = await runner.run({
-            engineId: wire.engineId ?? this.defaults.engineId,
-            modelId: wire.modelId ?? this.defaults.modelId,
-            message,
-            workspaceRoot,
-            additionalDirectories: wire.additionalDirectories,
-            sessionId: wire.sessionId,
-            // Per-turn warrant, not the one this runner was built with — see ensureRunner.
-            modelToken: wire.modelToken,
-            permissions: perms,
-            // Parity with serve's in-process runner: attribution for evidence, the per-turn
-            // data-plane nonce (without which a sandbox cannot reach the data gateway at all), and
-            // the bound gateway session.
-            analyticsUserId: wire.analyticsUserId,
-            // The credential does not cross into this process by design, so the per-user engine
-            // home key arrives pre-computed on the frame. Absent ⇒ unscoped, which is correct for
-            // a single-tenant run and is what every multi-user sandbox turn used to get.
-            engineHomeUserKey: wire.engineHomeUserKey,
-            turnEnv: wire.turnEnv,
-            gatewaySessionKey: wire.gatewaySessionKey,
-            emitter,
-            signal,
-        });
-        // A failed run must reject so the host emits `failed`, not `result` — otherwise serve
-        // would record a successful turn for a turn that errored.
-        if (!result.success && result.error) {
-            throw new Error(result.error);
-        }
-    }
-    onMaintenance() { }
-    dispose() { this.runner?.dispose(); }
-}
-/**
- * A sandbox outlives every turn it runs — and under user scope holds several of one person's
- * sessions — so an engine-side async error must not take the process down: that would lose every
- * conversation here, not just the turn. Vendor SDKs reject outside the
- * `engine.stream()` await chain (observed: the Claude SDK's `streamInput` rejecting after its
- * child process dies), which Node treats as fatal by default. Log and stay up; the turn's own
- * catch still emits `failed`, and serve can always destroy the sandbox if it wants it gone.
- *
- * `uncaughtException` is NOT swallowed: after one the process state is unreliable, so exit and
- * let the driver create a fresh sandbox.
- */
-function installSandboxResilience() {
-    process.on('unhandledRejection', (reason) => {
-        const msg = reason instanceof Error ? reason.message : String(reason);
-        console.error(`[sandbox] unhandled rejection (session kept alive): ${msg}`);
-    });
-    process.on('uncaughtException', (err) => {
-        console.error(`[sandbox] uncaught exception — exiting so the driver recreates this sandbox: ${err.message}`);
-        process.exit(1);
-    });
-}
-async function sandboxCommand(options) {
-    // Every other command does this in its action; a sandbox needs it too, or a dev-box sandbox has no
-    // engine SDKs at all. In a self-contained image AGENTHIPPO_NO_AUTO_INSTALL=1 makes it a no-op.
-    await (0, deps_1.ensureDeps)(false);
-    const stateDir = options.stateDir ?? '/state';
-    const workspaceForLoad = options.workspace ?? path.join(stateDir, 'workspace');
-    fs.mkdirSync(workspaceForLoad, { recursive: true });
-    // The real loader, exactly as serve uses it — and `--agent` is a name-OR-path for the same
-    // reason it is everywhere else. The previous code resolved it as a path and demanded
-    // agent.yaml there, so `serve --agent joker1 --sandbox process` handed the sandbox a bare name
-    // it turned into <cwd>/joker1 and every turn died with "No agent.yaml". The hand-rolled regex
-    // before that only matched block-style YAML, so a flow-style manifest (`metadata: { name: x }`)
-    // silently fell back to 'default' — which is how CODEX_HOME ended up at agents/default instead
-    // of agents/<pack>, breaking per-pack engine isolation inside sandboxes.
-    const pack = await (0, pack_loader_1.loadAgentPack)(options.agent, workspaceForLoad);
-    const manifest = {
-        name: pack.manifest.metadata.name,
-        version: pack.manifest.metadata.version,
-        engine: pack.manifest.spec?.engine ?? 'claude',
-    };
-    // A sandbox runs on a read-only root by design, so every writable path must live under the one
-    // mounted state directory. `--state-dir` is authoritative here and OVERRIDES the image's
-    // baked AGENTHIPPO_HOME (the runtime image sets /state, which is read-only unless mounted);
-    // otherwise the engine's cache lands on the read-only root and the first turn dies with
-    // EROFS — observed live on Linux.
-    if (options.stateDir) {
-        process.env.AGENTHIPPO_HOME = stateDir;
-    }
-    else {
-        process.env.AGENTHIPPO_HOME = process.env.AGENTHIPPO_HOME ?? stateDir;
-    }
-    // HOME too, not just AGENTHIPPO_HOME: engine SDKs write to dot-directories under $HOME
-    // (the Cursor SDK uses ~/.cursor, codex/claude keep caches there), and the image's default
-    // HOME sits on the read-only root — so every such write fails with ENOENT/EROFS inside a
-    // sandbox. Observed live on tier 2 with the Cursor SDK.
-    // Declare that a sandbox surrounds this process. This says WHERE we are, not how confined we
-    // are: whether an engine may stand its own boundary down is answered by AGENTHIPPO_SANDBOX_TIER
-    // (see sandbox/types.ts), which only the driver sets and only tier 2 satisfies. Deriving
-    // "unconfined is safe" from this flag is what made `--sandbox process` weaker than no sandbox.
-    process.env.AGENTHIPPO_SANDBOX = '1';
-    const sandboxHome = path.join(stateDir, 'home');
-    fs.mkdirSync(sandboxHome, { recursive: true });
-    process.env.HOME = sandboxHome;
-    // Hydrate the workspace from the mounted pack — the SAME call serve makes at boot. A sandbox
-    // holds exactly one user's session, so it should look exactly like the single-user case:
-    // pack content (skills, rules, engine config) lives IN the workspace, and every downstream
-    // path (`getSkillsSignature(workspaceRoot)`, engine homes) resolves off that one root.
-    // Without this the pack stayed a read-only mount the engines never looked at, so no pack
-    // skill was ever visible inside a sandbox — observed live on tier 2.
-    const workspace = workspaceForLoad;
-    await (0, headless_1.syncPackToWorkspace)(workspace, pack.packPath, manifest.name, manifest.engine, console, (0, utils_1.findBundledBasePromptsDir)());
-    console.log(`[sandbox] pack ${manifest.name}@${manifest.version ?? '?'} synced into ${workspace} (engine ${manifest.engine})`);
-    // Only NOW: everything above is boot, and a boot failure must be fatal so the driver sees a
-    // dead sandbox and reports the real error. Swallowing it would leave a sandbox that answers every
-    // turn with "channel closed" and no cause.
-    installSandboxResilience();
-    const rawCheapModel = pack.manifest.spec?.cheapModel?.trim();
-    const engine = new SandboxEngine({
-        storagePath: stateDir,
-        // Land evidence where serve and Spotlight already scan, rather than the headless default.
-        analyticsSessionsDir: (0, serve_hardening_1.resolveAnalyticsSessionsDir)(stateDir, false),
-        packId: manifest.name,
-        packVersion: manifest.version,
-        engineId: manifest.engine,
-        // serve normally sends modelId on every frame; this is the fallback, and it comes from the
-        // pack the same way serve's does instead of a hardcoded alias.
-        modelId: (0, headless_1.resolveModelAlias)(pack.manifest.spec?.model?.trim() || 'ah-auto'),
-        claudeCheapModel: rawCheapModel ? (0, headless_1.resolveModelAlias)(rawCheapModel) : undefined,
-        fileAccess: (0, pack_loader_1.getFileAccess)(pack),
-        workspace,
-    });
-    const runtime = { logger: console };
-    if (options.stdio) {
-        const host = (0, host_1.startRunnerHost)({
-            engine, runtime,
-            input: process.stdin,
-            output: { write: (c) => process.stdout.write(c) },
-            nativeSessionId: () => engine.nativeSessionId,
-        });
-        await host.done;
-        return;
-    }
-    const socketPath = options.socket;
-    if (!socketPath) {
-        throw new Error('sandbox requires --socket <path> or --stdio');
-    }
-    // A stale socket from a previous sandbox would make bind fail; the sandbox owns this path.
-    try {
-        fs.unlinkSync(socketPath);
-    }
-    catch { /* not there — fine */ }
-    const server = net.createServer((conn) => {
-        (0, host_1.startRunnerHost)({
-            engine, runtime,
-            input: conn,
-            output: { write: (c) => conn.write(c) },
-            nativeSessionId: () => engine.nativeSessionId,
-        });
-    });
-    // Binding is fatal: a sandbox nobody can reach is useless, and exiting 0 would tell the driver
-    // the sandbox is healthy while every turn fails on a dead channel (observed live).
-    try {
-        await new Promise((resolve, reject) => {
-            server.once('error', reject);
-            server.listen(socketPath, () => resolve());
-        });
-    }
-    catch (err) {
-        console.error(`[sandbox] FATAL: cannot listen at ${socketPath}: ${err instanceof Error ? err.message : String(err)}`);
-        process.exit(1);
-    }
-    // 0o660: the sandbox owns the socket; serve connects from the host. serve manages the container
-    // runtime (already root-equivalent), so it can connect; no other local uid can. Only the
-    // sandbox's own mount namespace has this path at all — the mode is defence in depth.
-    try {
-        fs.chmodSync(socketPath, 0o660);
-    }
-    catch { /* best effort */ }
-    console.log(`[sandbox] ${options.sandboxId ?? 'sandbox'} listening on ${socketPath} (pack ${manifest.name}@${manifest.version ?? '?'})`);
-    await new Promise((resolve) => {
-        const shutdown = () => { server.close(() => resolve()); engine.dispose(); };
-        process.once('SIGTERM', shutdown);
-        process.once('SIGINT', shutdown);
-        server.once('close', () => resolve());
-    });
-}