@agenthippo-ai/agenthippo 1.110.9 → 1.110.19

package/out/test/sandbox-hardening.test.js

@@ -1,395 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *
- *  The three sandbox properties audited: the socket channel is not raceable by another local
- *  account, the tier reported is the tier delivered, and a raw provider key does not cross into a
- *  sandbox by accident.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-require("mocha");
-const assert = __importStar(require("assert"));
-const fs = __importStar(require("node:fs"));
-const net = __importStar(require("node:net"));
-const os = __importStar(require("node:os"));
-const path = __importStar(require("node:path"));
-const containerDriver_1 = require("../sandbox/containerDriver");
-const processDriver_1 = require("../sandbox/processDriver");
-const types_1 = require("../sandbox/types");
-const support_1 = require("../sandbox/support");
-const IMAGE = 'ghcr.io/agenthippoai/pack@sha256:' + 'b'.repeat(64);
-function tmpdir() {
-    return fs.mkdtempSync(path.join(os.tmpdir(), 'ah-sandbox-hard-'));
-}
-function spec(over = {}) {
-    return {
-        sessionKey: 'sess-1',
-        image: IMAGE,
-        tier: 2,
-        routes: [{ kind: 'inference', target: 'litellm:4000' }],
-        fs: { readonly: [], writable: [] },
-        limits: { ttlSeconds: 0 },
-        ...over,
-    };
-}
-/** docker stub: network internal-ness is configurable, everything else succeeds. */
-function execStub(internal, calls = []) {
-    return async (args) => {
-        calls.push(args);
-        if (args[0] === 'network' && args[1] === 'inspect') {
-            return { stdout: internal ? 'true\n' : 'false\n', code: 0 };
-        }
-        if (args[0] === 'run') {
-            return { stdout: 'container-id\n', code: 0 };
-        }
-        return { stdout: '', code: 0 };
-    };
-}
-suite('sandbox socket directory permissions', () => {
-    test('without a known sandbox uid, the directory is sticky (0o1733) — not the old 0o733', () => {
-        if (process.platform === 'win32') {
-            return;
-        }
-        const dir = path.join(tmpdir(), 'sandbox-x');
-        try {
-            (0, containerDriver_1.prepareSocketDir)(dir);
-            const mode = fs.statSync(dir).mode & 0o7777;
-            assert.strictEqual(mode, 0o1733, `expected sticky 1733, got ${mode.toString(8)}`);
-            // The sticky bit is the whole point: it stops another local account from unlinking or
-            // renaming the socket the sandbox bound and substituting its own.
-            assert.strictEqual(mode & 0o1000, 0o1000, 'sticky bit is set');
-        }
-        finally {
-            fs.rmSync(path.dirname(dir), { recursive: true, force: true });
-        }
-    });
-    test('when the sandbox uid is our own, the directory is 0o700 — nothing else can even traverse', () => {
-        if (process.platform === 'win32' || typeof process.getuid !== 'function') {
-            return;
-        }
-        const dir = path.join(tmpdir(), 'sandbox-y');
-        try {
-            (0, containerDriver_1.prepareSocketDir)(dir, { uid: process.getuid(), gid: process.getgid() });
-            const mode = fs.statSync(dir).mode & 0o7777;
-            assert.strictEqual(mode, 0o700, `expected 0700, got ${mode.toString(8)}`);
-        }
-        finally {
-            fs.rmSync(path.dirname(dir), { recursive: true, force: true });
-        }
-    });
-    test('preparing an existing directory still tightens it', () => {
-        if (process.platform === 'win32') {
-            return;
-        }
-        const dir = path.join(tmpdir(), 'sandbox-z');
-        try {
-            fs.mkdirSync(dir, { recursive: true });
-            fs.chmodSync(dir, 0o777);
-            (0, containerDriver_1.prepareSocketDir)(dir);
-            assert.strictEqual(fs.statSync(dir).mode & 0o7777, 0o1733);
-        }
-        finally {
-            fs.rmSync(path.dirname(dir), { recursive: true, force: true });
-        }
-    });
-});
-suite('sandbox socket identity', () => {
-    test('a real socket we own is accepted', async () => {
-        if (process.platform === 'win32') {
-            return;
-        }
-        const dir = tmpdir();
-        const sockPath = path.join(dir, 'sandbox.sock');
-        const server = net.createServer();
-        try {
-            await new Promise((resolve) => server.listen(sockPath, resolve));
-            assert.doesNotThrow(() => (0, containerDriver_1.assertOwnSocket)(sockPath));
-        }
-        finally {
-            await new Promise((resolve) => server.close(() => resolve()));
-            fs.rmSync(dir, { recursive: true, force: true });
-        }
-    });
-    test('a regular file at the socket path is refused — existence is not readiness', () => {
-        const dir = tmpdir();
-        const sockPath = path.join(dir, 'sandbox.sock');
-        try {
-            fs.writeFileSync(sockPath, 'not a socket');
-            assert.throws(() => (0, containerDriver_1.assertOwnSocket)(sockPath), /not a unix socket/);
-        }
-        finally {
-            fs.rmSync(dir, { recursive: true, force: true });
-        }
-    });
-    test('a symlink at the socket path is refused rather than followed', () => {
-        if (process.platform === 'win32') {
-            return;
-        }
-        const dir = tmpdir();
-        const target = path.join(dir, 'real.sock');
-        const sockPath = path.join(dir, 'sandbox.sock');
-        try {
-            fs.writeFileSync(target, '');
-            fs.symlinkSync(target, sockPath);
-            // lstat, not stat: a stat-based check would follow this to the attacker's choice.
-            assert.throws(() => (0, containerDriver_1.assertOwnSocket)(sockPath), /symlink|not a unix socket/);
-        }
-        finally {
-            fs.rmSync(dir, { recursive: true, force: true });
-        }
-    });
-    test('a socket owned by a third local account is refused', async () => {
-        if (process.platform === 'win32' || typeof process.getuid !== 'function') {
-            return;
-        }
-        const dir = tmpdir();
-        const sockPath = path.join(dir, 'sandbox.sock');
-        const server = net.createServer();
-        try {
-            await new Promise((resolve) => server.listen(sockPath, resolve));
-            // Simulate "another uid won the bind" by telling the check we are someone else and the
-            // sandbox is someone else again. Real uid manipulation needs root; the decision logic is
-            // what matters and it is exactly this comparison.
-            assert.throws(() => (0, containerDriver_1.assertOwnSocket)(sockPath, { uid: 4242, gid: 4242 }, 9999), /owned by uid/);
-        }
-        finally {
-            await new Promise((resolve) => server.close(() => resolve()));
-            fs.rmSync(dir, { recursive: true, force: true });
-        }
-    });
-});
-suite('tier-2 egress containment is reported honestly', () => {
-    test('an internal route network yields the requested tier 2', async () => {
-        const dir = tmpdir();
-        try {
-            const driver = new containerDriver_1.ContainerSandboxDriver({
-                exec: execStub(true),
-                socketDir: dir,
-                socketWaitMs: 0,
-                connectFn: () => ({ input: null, output: { write: () => true }, closed: Promise.resolve() }),
-                strictEgress: false,
-            });
-            const handle = await driver.create(spec());
-            assert.strictEqual(handle.tier, 2);
-        }
-        finally {
-            fs.rmSync(dir, { recursive: true, force: true });
-        }
-    });
-    test('a NAT\'d route network is reported as tier 1, not the requested 2', async () => {
-        const dir = tmpdir();
-        const warnings = [];
-        const calls = [];
-        try {
-            const driver = new containerDriver_1.ContainerSandboxDriver({
-                exec: execStub(false, calls),
-                socketDir: dir,
-                socketWaitMs: 0,
-                connectFn: () => ({ input: null, output: { write: () => true }, closed: Promise.resolve() }),
-                logger: { info: () => { }, warn: (m) => warnings.push(m) },
-                strictEgress: false,
-            });
-            const handle = await driver.create(spec());
-            // The runtime must never advertise a containment level it is not enforcing.
-            assert.strictEqual(handle.tier, 1, 'the reported tier reflects what was actually built');
-            assert.ok(warnings.some((w) => w.includes('not --internal')), 'the disclosure survives');
-            // And the sandbox itself is told the honest tier, so an engine that stands its own
-            // boundary down at tier >= 2 keeps it.
-            const runCall = calls.find((c) => c[0] === 'run');
-            assert.ok(runCall.includes(`${types_1.SANDBOX_TIER_ENV}=1`), `expected ${types_1.SANDBOX_TIER_ENV}=1 in the run args, got: ${runCall.join(' ')}`);
-        }
-        finally {
-            fs.rmSync(dir, { recursive: true, force: true });
-        }
-    });
-    test('strict mode REFUSES a non-internal route network', async () => {
-        const dir = tmpdir();
-        try {
-            const driver = new containerDriver_1.ContainerSandboxDriver({
-                exec: execStub(false),
-                socketDir: dir,
-                socketWaitMs: 0,
-                strictEgress: true,
-            });
-            await assert.rejects(driver.create(spec()), /strict egress containment is enabled/);
-        }
-        finally {
-            fs.rmSync(dir, { recursive: true, force: true });
-        }
-    });
-    test('strict mode is opt-in via the environment', () => {
-        assert.strictEqual((0, containerDriver_1.strictEgressFromEnv)({}), false);
-        assert.strictEqual((0, containerDriver_1.strictEgressFromEnv)({ AGENTHIPPO_SANDBOX_STRICT_EGRESS: '1' }), true);
-    });
-    test('a missing route network is still a hard failure, strict or not', async () => {
-        const dir = tmpdir();
-        try {
-            const driver = new containerDriver_1.ContainerSandboxDriver({
-                exec: async (args) => args[0] === 'network' && args[1] === 'inspect'
-                    ? { stdout: 'no such network', code: 1 }
-                    : { stdout: '', code: 0 },
-                socketDir: dir,
-                socketWaitMs: 0,
-            });
-            await assert.rejects(driver.create(spec()), /does not exist/);
-        }
-        finally {
-            fs.rmSync(dir, { recursive: true, force: true });
-        }
-    });
-});
-suite('provider key passthrough into a sandbox', () => {
-    test('CURSOR_API_KEY does NOT cross by default', () => {
-        const warnings = [];
-        const env = (0, processDriver_1.baseSandboxEnv)({ logger: { warn: (m) => warnings.push(m) } }, { PATH: '/usr/bin', CURSOR_API_KEY: 'sk-cursor-live' });
-        assert.strictEqual(env.CURSOR_API_KEY, undefined, 'the provider key must not cross by default');
-        assert.strictEqual(env.PATH, '/usr/bin', 'the non-secret allowlist is unaffected');
-        assert.ok(warnings.some((w) => w.includes('AGENTHIPPO_SANDBOX_ALLOW_PROVIDER_KEY')), 'the refusal is actionable, not silent');
-    });
-    test('the explicit opt-in lets it cross', () => {
-        const env = (0, processDriver_1.baseSandboxEnv)({ allowProviderKeyPassthrough: true }, { PATH: '/usr/bin', CURSOR_API_KEY: 'sk-cursor-live' });
-        assert.strictEqual(env.CURSOR_API_KEY, 'sk-cursor-live');
-    });
-    test('the env-var opt-in is read the same way', () => {
-        assert.strictEqual((0, processDriver_1.providerKeyPassthroughFromEnv)({}), false);
-        assert.strictEqual((0, processDriver_1.providerKeyPassthroughFromEnv)({ AGENTHIPPO_SANDBOX_ALLOW_PROVIDER_KEY: '1' }), true);
-    });
-    test('no other secret is in the allowlist', () => {
-        const env = (0, processDriver_1.baseSandboxEnv)({ allowProviderKeyPassthrough: true }, {
-            PATH: '/usr/bin',
-            ANTHROPIC_API_KEY: 'sk-ant',
-            OPENAI_API_KEY: 'sk-oai',
-            AGENTHIPPO_LITELLM_API_KEY: 'ahk',
-            AGENTHIPPO_TURN_NONCE: 'nonce',
-        });
-        assert.deepStrictEqual(Object.keys(env).sort(), ['PATH']);
-    });
-    test('a sandbox holding a provider key is flagged in its own environment', async () => {
-        const spawned = [];
-        const driver = new processDriver_1.ProcessSandboxDriver({
-            command: 'node',
-            allowProviderKeyPassthrough: true,
-            env: { CURSOR_API_KEY: 'sk-cursor-live' },
-            spawnFn: ((_cmd, _args, opts) => {
-                spawned.push(opts);
-                return {
-                    stdout: null, stdin: null, exitCode: null, killed: false,
-                    once: () => undefined, kill: () => true,
-                };
-            }),
-        });
-        await driver.create(spec({ tier: 0, routes: [] }));
-        assert.strictEqual(spawned[0].env?.[types_1.SANDBOX_PROVIDER_KEY_ENV], '1');
-        assert.strictEqual((0, types_1.sandboxHoldsProviderKey)(spawned[0].env), true);
-    });
-    test('a sandbox without one carries no such flag', async () => {
-        const spawned = [];
-        const driver = new processDriver_1.ProcessSandboxDriver({
-            command: 'node',
-            spawnFn: ((_cmd, _args, opts) => {
-                spawned.push(opts);
-                return {
-                    stdout: null, stdin: null, exitCode: null, killed: false,
-                    once: () => undefined, kill: () => true,
-                };
-            }),
-        });
-        await driver.create(spec({ tier: 0, routes: [] }));
-        assert.strictEqual(spawned[0].env?.[types_1.SANDBOX_PROVIDER_KEY_ENV], undefined);
-        assert.strictEqual((0, types_1.sandboxHoldsProviderKey)(spawned[0].env), false);
-    });
-    test('the detector looks at the actual child env', () => {
-        assert.strictEqual((0, processDriver_1.sandboxEnvCarriesProviderKey)({ PATH: '/usr/bin' }), false);
-        assert.strictEqual((0, processDriver_1.sandboxEnvCarriesProviderKey)({ CURSOR_API_KEY: 'x' }), true);
-    });
-});
-suite('cell → sandbox environment migration', () => {
-    test('a stale AGENTHIPPO_CELL_* variable still works, and says so loudly', () => {
-        const env = { AGENTHIPPO_CELL_TIER: '2' };
-        const warnings = [];
-        const applied = (0, support_1.applyDeprecatedSandboxEnvAliases)(env, (m) => warnings.push(m), new Set());
-        assert.deepStrictEqual(applied, ['AGENTHIPPO_SANDBOX_TIER']);
-        assert.strictEqual(env.AGENTHIPPO_SANDBOX_TIER, '2', 'the operator gets the tier they asked for');
-        assert.strictEqual(warnings.length, 1);
-        assert.ok(warnings[0].includes('DEPRECATED'));
-        assert.ok(warnings[0].includes('AGENTHIPPO_SANDBOX_TIER'), 'the warning names the new spelling');
-    });
-    test('the bare AGENTHIPPO_CELL flag is aliased too', () => {
-        const env = { AGENTHIPPO_CELL: '1' };
-        (0, support_1.applyDeprecatedSandboxEnvAliases)(env, () => { }, new Set());
-        assert.strictEqual(env.AGENTHIPPO_SANDBOX, '1');
-    });
-    test('a migrated operator is never overridden by a leftover old variable', () => {
-        const env = {
-            AGENTHIPPO_CELL_SOCKET_DIR: '/old/path',
-            AGENTHIPPO_SANDBOX_SOCKET_DIR: '/new/path',
-        };
-        const warnings = [];
-        (0, support_1.applyDeprecatedSandboxEnvAliases)(env, (m) => warnings.push(m), new Set());
-        assert.strictEqual(env.AGENTHIPPO_SANDBOX_SOCKET_DIR, '/new/path', 'the new name wins');
-        assert.ok(warnings[0].includes('IGNORING'), 'and the conflict is still reported');
-    });
-    test('an unset old variable produces no warning and no alias', () => {
-        const env = {};
-        const warnings = [];
-        assert.deepStrictEqual((0, support_1.applyDeprecatedSandboxEnvAliases)(env, (m) => warnings.push(m), new Set()), []);
-        assert.deepStrictEqual(warnings, []);
-    });
-    test('the warning is emitted once per process, not once per turn', () => {
-        const once = new Set();
-        const warnings = [];
-        for (let i = 0; i < 3; i++) {
-            (0, support_1.applyDeprecatedSandboxEnvAliases)({ AGENTHIPPO_CELL_TIER: '2' }, (m) => warnings.push(m), once);
-        }
-        assert.strictEqual(warnings.length, 1);
-    });
-});
-suite('single-file build script detection', () => {
-    test('a real script path is forwarded', () => {
-        assert.deepStrictEqual((0, support_1.sandboxScriptArg)(['node', '/app/out/cli/index.js'], 'node'), ['/app/out/cli/index.js']);
-    });
-    test('the bun and pkg virtual roots are not forwarded', () => {
-        assert.deepStrictEqual((0, support_1.sandboxScriptArg)(['bin', '/$bunfs/root/index.js'], 'bin'), []);
-        assert.deepStrictEqual((0, support_1.sandboxScriptArg)(['bin', '/snapshot/app/index.js'], 'bin'), []);
-    });
-    test("pkg's Windows form is recognised too", () => {
-        // `C:\snapshot\app\index.js` used to slip through the startsWith('/snapshot') check.
-        assert.deepStrictEqual((0, support_1.sandboxScriptArg)(['bin.exe', 'C:\\snapshot\\app\\index.js'], 'bin.exe'), []);
-    });
-    test('argv[1] equal to the exec path (a compiled binary) yields no script', () => {
-        assert.deepStrictEqual((0, support_1.sandboxScriptArg)(['/usr/local/bin/agenthippo', '/usr/local/bin/agenthippo'], '/usr/local/bin/agenthippo'), []);
-    });
-});