@agentswf/sandbox 0.0.0-stage → 0.1.0-beta.0

package/src/srt/index.ts

@@ -0,0 +1,425 @@
+import { randomUUID } from "node:crypto";
+import { constants } from "node:fs";
+import {
+  lstat,
+  mkdir,
+  mkdtemp,
+  open,
+  readdir,
+  realpath,
+  rm,
+  stat,
+  symlink,
+  writeFile,
+} from "node:fs/promises";
+import { homedir } from "node:os";
+import { basename, dirname, join } from "node:path";
+import type { SrtEnvironment } from "@agentswf/contract/workflow";
+import { protectedPaths } from "../git";
+import { LaunchedGroups } from "../groups";
+import { onceUnlessFailed } from "../once";
+import { panePrelude } from "../pane";
+import { contains, repositoryOf } from "../resolve";
+import type {
+  OpenedSandbox,
+  PaneTerminal,
+  ResolvedSandbox,
+  SandboxContext,
+  SandboxedCommand,
+  SandboxProvider,
+} from "../seam";
+import { removeSecrets, shellQuote, writeSecrets } from "../secrets";
+import {
+  agentProfile,
+  baseProfile,
+  checkProfile,
+  DENIED,
+  type SrtHost,
+  type SrtSettings,
+} from "./profile";
+
+export type SrtOptions = SrtHost & {
+  /** What runs srt: node and srt's `cli.js`, by real paths, as an agent's `PATH` may lack both. */
+  command: readonly string[];
+  /** An agent's `PATH` before the system's: the toolchain's `bin` directories and the like. */
+  path: readonly string[];
+  /** Runs the probe on the first open; a test of profiles alone turns it off. */
+  probe?: boolean;
+};
+
+/** How long `srt --version` may take before srt is taken to be missing. */
+const VERSION_MS = 10_000;
+
+/** The system's own directories, last on every agent's `PATH`; srt needs `bash` there (H6). */
+const SYSTEM_PATH = ["/usr/bin", "/bin", "/usr/sbin", "/sbin"];
+
+/** Where an agent's short directory is made: `/tmp` by its real path, which srt matches. */
+const SHORT_ROOT = "/private/tmp";
+
+/**
+ * Anthropic's sandbox-runtime on this machine. A sandbox is a base profile; each admitted agent
+ * gets a profile file built from it, and every process it runs is `srt -s {file} -- {command}`,
+ * with exactly the environment the provider sets.
+ */
+export function createSrtProvider(options: SrtOptions): SandboxProvider<SrtEnvironment> {
+  // Only a probe that passed is kept: a transient failure is tried again at the next open.
+  const probed = onceUnlessFailed((context: SandboxContext) => probe(options, context));
+  return {
+    environment(raw) {
+      if (
+        typeof raw !== "object" ||
+        raw === null ||
+        Array.isArray(raw) ||
+        Object.keys(raw).length > 0
+      ) {
+        throw new Error("srt takes no settings: name it as srt: {}");
+      }
+      return {};
+    },
+    async open(spec, context) {
+      // srt applies every allow, then every deny: a `write` inside a `read` inside a `write`
+      // would be denied, narrower than the spec says.
+      for (const path of spec.write) {
+        const read = spec.read.find((root) => root !== path && contains(root, path));
+        if (read && spec.write.some((root) => root !== read && contains(root, read))) {
+          throw new Error(
+            `srt cannot make ${path} writable inside ${read}, read-only inside a write`,
+          );
+        }
+      }
+      const temp = join(context.directory, "tmp");
+      const base = baseProfile(spec, context, options, temp, await protectedPaths(spec));
+      checkProfile(base, options, context, spec);
+      if (options.probe !== false) await probed(context);
+      await mkdir(join(temp, "npm"), { recursive: true, mode: 0o700 });
+      await mkdir(join(context.directory, "profiles"), { recursive: true, mode: 0o700 });
+      return openSandbox(spec, context, options, base, temp);
+    },
+  };
+}
+
+function openSandbox(
+  spec: ResolvedSandbox<unknown>,
+  context: SandboxContext,
+  options: SrtOptions,
+  base: SrtSettings,
+  temp: string,
+): OpenedSandbox {
+  const profiles = join(context.directory, "profiles");
+  const launched: LaunchedGroups[] = [];
+  /** Outside the sandbox's directory, so its close removes them by name. */
+  const shorts: string[] = [];
+  return {
+    record: { toolchain: [...options.toolchain] },
+    panes: true,
+    async admit(agent) {
+      if (!contains(context.directory, agent.home)) {
+        throw new Error(`srt: ${agent.home} is not one of this sandbox's homes`);
+      }
+      // `mkdtemp` makes it 0700, by a name no co-tenant can guess ahead.
+      const short = agent.harness.shortDirectory
+        ? await mkdtemp(join(SHORT_ROOT, "awf-"))
+        : undefined;
+      if (short) shorts.push(short);
+      for (const shared of agent.harness.sharedWrites ?? []) await sharedDirectory(shared);
+      const settings = agentProfile(base, agent, short);
+      checkProfile(settings, options, context, spec);
+      const profile = join(profiles, `${randomUUID()}.json`);
+      await writeFile(profile, JSON.stringify(settings, null, 2), { mode: 0o600 });
+      // git refuses an unreadable `~/.gitconfig`; this one is empty (X4). Made anew, never through
+      // a link a co-tenant planted in the home.
+      const gitconfig = join(agent.home, "gitconfig");
+      await (
+        await open(
+          gitconfig,
+          constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW | constants.O_WRONLY,
+          0o600,
+        )
+      ).close();
+      // The agent's whole environment: nothing of the engine's reaches it (X20).
+      const environment: Record<string, string> = {
+        HOME: options.home,
+        PATH: [...options.path, ...SYSTEM_PATH].join(":"),
+        CLAUDE_CODE_TMPDIR: temp,
+        // The `wf result <<'WF_JSON'` every prompt asks for needs a heredoc's temp file. zsh
+        // writes it under `TMPPREFIX`, `/tmp/zsh` by default, which is denied; macOS's bash 3.2
+        // writes it in `/var/tmp` whatever `TMPDIR` says, which is denied too (X22). So the
+        // harnesses' shell is zsh, its heredocs in the sandbox's temp.
+        SHELL: "/bin/zsh",
+        TMPPREFIX: join(temp, "zsh"),
+        GIT_CONFIG_GLOBAL: gitconfig,
+        npm_config_cache: join(temp, "npm"),
+        ...agent.harness.env,
+        ...(agent.harness.shortDirectory && short ? { [agent.harness.shortDirectory]: short } : {}),
+      };
+      const agentId = randomUUID();
+      const groups = new LaunchedGroups(join(context.directory, "pids", agentId));
+      launched.push(groups);
+      let released = false;
+      const unread: string[] = [];
+      return {
+        launch(root): SandboxedCommand {
+          if (released) throw new Error("srt: this agent was released");
+          const [first, ...rest] = root.argv;
+          // `~/.local/bin` and its links are denied, so the harness runs by its real path; `--`
+          // keeps srt from reading the harness's flags as its own (Task 0).
+          const command = first === agent.harness.command ? agent.harness.executable : first!;
+          const wrapped = groups.wrap([...options.command, "-s", profile, "--", command, ...rest]);
+          return {
+            ...root,
+            argv: wrapped.argv,
+            env: { ...environment, ...agent.harness.secrets, ...root.env },
+            group: true,
+            // Killing the group ends srt and everything it started (X1); this forgets it.
+            reap: () => groups.kill(wrapped.pidFile),
+          };
+        },
+        async pane(): Promise<PaneTerminal> {
+          if (released) throw new Error("srt: this agent was released");
+          // The harness by its name, which a person could type: a link in a directory of its own.
+          const bin = join(context.directory, "bin", agentId);
+          await mkdir(bin, { recursive: true, mode: 0o700 });
+          await symlink(agent.harness.executable, join(bin, agent.harness.command)).catch(
+            (error: NodeJS.ErrnoException) => {
+              if (error.code !== "EEXIST") throw error;
+            },
+          );
+          const paneProfile = join(profiles, `${agentId}-pane.json`);
+          await writeFile(paneProfile, JSON.stringify({ ...settings, allowPty: true }, null, 2), {
+            mode: 0o600,
+          });
+          const secretsFile = await writeSecrets(context, randomUUID(), agent.harness.secrets);
+          unread.push(secretsFile);
+          return {
+            herdr: "run",
+            // zsh, as srt's bash drops `PS1`.
+            ...panePrelude({
+              environment: {
+                ...environment,
+                PATH: [bin, ...options.path, ...SYSTEM_PATH].join(":"),
+              },
+              pidFile: await groups.pidFile(),
+              secretsFile,
+              through: [...options.command, "-s", paneProfile, "--"],
+            }),
+            harness: agent.harness.command,
+          };
+        },
+        async release() {
+          released = true;
+          await groups.killAll();
+          if (short) await rm(short, { recursive: true, force: true });
+          // A pane whose shell never took its prelude.
+          await Promise.all(unread.map((path) => rm(path, { force: true })));
+        },
+      };
+    },
+    async close() {
+      await Promise.all(launched.map((groups) => groups.killAll()));
+      await Promise.all([
+        rm(join(context.directory, "pids"), { recursive: true, force: true }),
+        rm(profiles, { recursive: true, force: true }),
+        rm(temp, { recursive: true, force: true }),
+        rm(join(context.directory, "bin"), { recursive: true, force: true }),
+        ...shorts.map((short) => rm(short, { recursive: true, force: true })),
+        removeSecrets(context),
+      ]);
+    },
+  };
+}
+
+/** A host the probe reaches for, from the host and from inside. */
+const PROBE_URL = "https://registry.npmjs.org";
+
+/**
+ * The first open in a process proves srt confines on this machine: a canary in the run root is
+ * unreadable, and a domain not allowed is unreachable, where the host reaches it at all (offline,
+ * a refusal proves nothing, and the network half is skipped). Bound by the sandbox's deadline.
+ */
+async function probe(options: SrtOptions, context: SandboxContext): Promise<void> {
+  const canary = join(context.runRoot, `.srt-probe-${randomUUID()}`);
+  const token = randomUUID();
+  const profile = join(context.directory, `.srt-probe-${randomUUID()}.json`);
+  const settings = baseProfile(
+    {
+      key: "probe",
+      cwd: context.directory,
+      read: [],
+      write: [],
+      network: [],
+      hidden: [],
+      gitdirs: [],
+      environment: {},
+    },
+    context,
+    options,
+    join(context.directory, "tmp"),
+    [],
+  );
+  await writeFile(canary, token, { mode: 0o600 });
+  await writeFile(profile, JSON.stringify(settings), { mode: 0o600 });
+  const reachable =
+    (await Bun.spawn(["/usr/bin/curl", "-s", "-m", "5", "-o", "/dev/null", PROBE_URL]).exited) ===
+    0;
+  try {
+    const child = Bun.spawn({
+      cmd: [
+        ...options.command,
+        "-s",
+        profile,
+        "--",
+        "/bin/sh",
+        "-c",
+        `echo ran; cat ${shellQuote(canary)} 2>/dev/null; ${reachable ? `/usr/bin/curl -s -m 5 -o /dev/null ${PROBE_URL} && echo reached` : "true"}`,
+      ],
+      cwd: context.directory,
+      env: { PATH: SYSTEM_PATH.join(":"), HOME: options.home },
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const timer = setTimeout(
+      () => child.kill("SIGKILL"),
+      // A timer overflows past 2^31 - 1 ms, and would fire at once.
+      Math.min(Math.max(0, context.deadline.unixMilliseconds - Date.now()), 2_147_483_647),
+    );
+    const [output, stderr] = await Promise.all([
+      new Response(child.stdout).text(),
+      new Response(child.stderr).text(),
+      child.exited,
+    ]).finally(() => clearTimeout(timer));
+    // srt failing to start is no proof of confinement either.
+    if (!output.startsWith("ran")) {
+      throw new Error(`srt's probe did not run: ${stderr.trim().slice(0, 300)}`);
+    }
+    if (output.includes(token) || output.includes("reached")) {
+      throw new Error(
+        "srt does not confine on this machine: its probe read a denied file or domain",
+      );
+    }
+  } finally {
+    await Promise.all([rm(canary, { force: true }), rm(profile, { force: true })]);
+  }
+}
+
+/**
+ * srt as installed on this machine: 1.0.0 or later on `PATH`. `undefined` when absent. The
+ * toolchain is what `PATH`'s executables under `~` need: their `bin` directories, and each one's
+ * install tree (X19): a node package's root, a `bin/` beside a `lib/` (a node or a Python venv),
+ * or the executable alone. Never a whole parent of `bin`: `~/.local` holds `state/` and
+ * credentials, and `~/.orbstack` an SSH key.
+ */
+export async function findSrt(
+  environment: Readonly<Record<string, string | undefined>>,
+  harnessState: readonly string[],
+): Promise<SrtOptions | undefined> {
+  const home = await realpath(environment.HOME ?? homedir());
+  const state = await Promise.all(harnessState.map((root) => realpath(root).catch(() => root)));
+  const path = (environment.PATH ?? "").split(":").filter(Boolean);
+  const cli = await firstExecutable("srt", path);
+  const node = await firstExecutable("node", path);
+  if (!cli || !node) return undefined;
+  const version = Bun.spawnSync({
+    cmd: [node, cli, "--version"],
+    stdout: "pipe",
+    stderr: "pipe",
+    timeout: VERSION_MS,
+  });
+  const [major] = version.stdout.toString().trim().split(".").map(Number);
+  if (version.exitCode !== 0 || major === undefined || !(major >= 1)) return undefined;
+  const real = [
+    ...new Set(
+      (await Promise.all(path.map((entry) => realpath(entry).catch(() => undefined)))).filter(
+        (entry): entry is string => entry !== undefined,
+      ),
+    ),
+  ];
+  const overlapsState = (root: string) =>
+    state.some((entry) => contains(root, entry) || contains(entry, root));
+  const bins = real.filter(
+    (entry) => contains(home, entry) && entry !== home && !overlapsState(entry),
+  );
+  const trees = new Set<string>();
+  for (const bin of bins) {
+    for (const name of await readdir(bin).catch(() => [])) {
+      const target = await realpath(join(bin, name)).catch(() => undefined);
+      // Outside `~` it is readable anyway; inside a repository it is that repository's source,
+      // a link on `PATH` to a script under development, not an install.
+      if (
+        !target ||
+        !contains(home, target) ||
+        (await repositoryOf(target, home).catch(() => true))
+      )
+        continue;
+      const tree = await installTree(target);
+      if (tree !== home && !contains(tree, home) && !overlapsState(tree)) trees.add(tree);
+    }
+  }
+  // The rest of `PATH` that a sandbox can read: outside `~` and the temp directories.
+  const outside = real.filter((entry) => !DENIED.some((root) => contains(root, entry)));
+  const xcrunCache = await findXcrunCache();
+  return {
+    command: [node, cli],
+    home,
+    harnessState: state,
+    ...(xcrunCache ? { xcrunCache } : {}),
+    toolchain: outermost([...bins, ...trees]),
+    path: [...bins, ...outside].filter((entry) => !SYSTEM_PATH.includes(entry)),
+  };
+}
+
+/**
+ * `path` as a directory of this user's, 0700, made where it is missing: never through a link, nor
+ * one another user made, as anyone may write `/tmp`.
+ */
+async function sharedDirectory(path: string): Promise<void> {
+  await mkdir(path, { recursive: true, mode: 0o700 });
+  for (let at = path; at !== SHORT_ROOT && at !== dirname(at); at = dirname(at)) {
+    const found = await lstat(at);
+    if (!found.isDirectory() || found.uid !== process.getuid?.()) {
+      throw new Error(`srt: ${at} is not a directory of this user's`);
+    }
+  }
+}
+
+/** The operator's `xcrun` cache, where macOS keeps one: `DARWIN_USER_TEMP_DIR/xcrun_db`. */
+async function findXcrunCache(): Promise<string | undefined> {
+  if (process.platform !== "darwin") return undefined;
+  const temp = Bun.spawnSync({ cmd: ["getconf", "DARWIN_USER_TEMP_DIR"], stdout: "pipe" });
+  const directory = temp.stdout.toString().trim();
+  if (temp.exitCode !== 0 || !directory) return undefined;
+  const cache = await realpath(join(directory, "xcrun_db")).catch(() => undefined);
+  return cache && (await stat(cache)).isFile() ? cache : undefined;
+}
+
+/** Each path once, and none inside another. */
+function outermost(paths: readonly string[]): string[] {
+  const unique = [...new Set(paths)];
+  return unique.filter((path) => !unique.some((other) => other !== path && contains(other, path)));
+}
+
+/** What an executable needs to run besides itself, by where it lies. */
+async function installTree(executable: string): Promise<string> {
+  const parts = executable.split("/");
+  const modules = parts.lastIndexOf("node_modules");
+  if (modules >= 0 && modules + 1 < parts.length) {
+    const scoped = parts[modules + 1]!.startsWith("@");
+    return parts.slice(0, modules + (scoped ? 3 : 2)).join("/");
+  }
+  const parent = dirname(executable);
+  if (
+    basename(parent) === "bin" &&
+    (await stat(join(dirname(parent), "lib")).catch(() => undefined))
+  ) {
+    return dirname(parent);
+  }
+  return executable;
+}
+
+async function firstExecutable(name: string, path: readonly string[]): Promise<string | undefined> {
+  for (const directory of path) {
+    const candidate = join(directory, name);
+    const found = await stat(candidate).catch(() => undefined);
+    if (found?.isFile() && (found.mode & 0o111) !== 0) return realpath(candidate);
+  }
+  return undefined;
+}

package/src/srt/profile.ts

@@ -0,0 +1,191 @@
+import { dirname, join } from "node:path";
+import { contains, KEY_DIRECTORIES } from "../resolve";
+import type { AgentContext, ResolvedSandbox, SandboxContext } from "../seam";
+
+/** srt's settings file, as much of it as a sandbox uses. */
+export type SrtSettings = {
+  enableWeakerNetworkIsolation: true;
+  /** A pane's only: zsh cannot take the terminal without it, and nothing is detected (H6). */
+  allowPty?: true;
+  network: {
+    allowedDomains: string[];
+    deniedDomains: string[];
+    allowUnixSockets: string[];
+  };
+  filesystem: {
+    denyRead: string[];
+    allowRead: string[];
+    allowWrite: string[];
+    denyWrite: string[];
+  };
+};
+
+/** What srt needs to know of the host, found once when the provider is made. */
+export type SrtHost = {
+  /** The operator's home, real. */
+  home: string;
+  /** The operator's harness state, which no allowed path may overlap. */
+  harnessState: readonly string[];
+  /** What the project's tools under `~` need (X19): their `bin` directories and install trees. */
+  toolchain: readonly string[];
+  /**
+   * macOS's `xcrun` cache, in the operator's temp directory, which `/usr/bin/git` reads on every
+   * call: without it each call starts `xcodebuild`, 1.2 s instead of 0.1 s (story 019). It holds
+   * tool paths only, and is read, never written.
+   */
+  xcrunCache?: string;
+};
+
+/** Regions no agent reads, besides `~`, before a sandbox re-allows its own paths inside them. */
+export const DENIED = [
+  "/Users",
+  "/home",
+  "/Volumes",
+  "/tmp",
+  "/private/tmp",
+  "/private/var/folders",
+  "/private/var/tmp",
+];
+
+/**
+ * A sandbox's base: reach and the toolchain readable, `write`, homes and its temp writable, and
+ * nothing of the network but `network`. `enableWeakerNetworkIsolation` is the one trustd lookup
+ * codex's TLS needs (Task 0); `allowLocalBinding` stays off.
+ */
+export function baseProfile(
+  spec: ResolvedSandbox<unknown>,
+  context: SandboxContext,
+  host: SrtHost,
+  temp: string,
+  /** What the host runs or follows, which no agent writes: `protectedPaths`. */
+  protectedGit: readonly string[],
+): SrtSettings {
+  const gitdirs = spec.gitdirs.map((gitdir) => gitdir.path);
+  return {
+    enableWeakerNetworkIsolation: true,
+    network: { allowedDomains: [...spec.network], deniedDomains: [], allowUnixSockets: [] },
+    filesystem: {
+      denyRead: unique([host.home, ...DENIED, context.runRoot, ...spec.hidden]),
+      allowRead: unique([
+        spec.cwd,
+        ...spec.read,
+        ...spec.write,
+        ...gitdirs,
+        context.directory,
+        ...host.toolchain,
+        ...(host.xcrunCache ? [host.xcrunCache] : []),
+      ]),
+      allowWrite: unique([
+        ...spec.write,
+        ...spec.gitdirs.filter((gitdir) => gitdir.writable).map((gitdir) => gitdir.path),
+        join(context.directory, "homes"),
+        temp,
+      ]),
+      // What is hidden, which srt denies though an allowed path holds it: it applies a deny nested
+      // in an allowed path after the allow. What the host's git runs or follows, and a `read` path
+      // inside a `write` one, which the more specific path makes read-only.
+      denyWrite: unique([
+        ...spec.hidden,
+        ...protectedGit,
+        ...spec.read.filter((path) =>
+          spec.write.some((root) => root !== path && contains(root, path)),
+        ),
+      ]),
+    },
+  };
+}
+
+/**
+ * One agent's profile: the base, its harness's model domains and install tree, its executable,
+ * and its door: the launcher's directory readable and never writable, and its own socket alone.
+ */
+export function agentProfile(
+  base: SrtSettings,
+  agent: AgentContext,
+  /** The agent's short directory, which it alone reads, writes and binds sockets in. */
+  short?: string,
+): SrtSettings {
+  const writes = [...(short ? [short] : []), ...(agent.harness.sharedWrites ?? [])];
+  // A harness that names a shared directory through `/tmp`, as cursor does, follows that link,
+  // which srt denies with the rest of `/tmp`; the link alone opens nothing behind it (story 019).
+  const tmpLink = (agent.harness.sharedWrites ?? []).some((path) => contains("/private/tmp", path))
+    ? ["/tmp"]
+    : [];
+  const launcherDirectory = dirname(agent.door.launcher);
+  return {
+    ...base,
+    network: {
+      ...base.network,
+      allowedDomains: unique([...base.network.allowedDomains, ...agent.harness.domains]),
+      allowUnixSockets: [agent.door.endpoint, ...(short ? [short] : [])],
+    },
+    filesystem: {
+      ...base.filesystem,
+      allowRead: unique([
+        ...base.filesystem.allowRead,
+        ...agent.harness.reads,
+        agent.harness.executable,
+        ...agent.door.reads,
+        launcherDirectory,
+        ...writes,
+        ...tmpLink,
+      ]),
+      allowWrite: unique([...base.filesystem.allowWrite, ...writes]),
+      denyWrite: unique([...base.filesystem.denyWrite, launcherDirectory]),
+    },
+  };
+}
+
+/**
+ * The pure check every profile passes before srt sees it, against the spec it was made from: `~`
+ * and the run root denied, each `hidden` path denied for reads and writes, and no allowed path exposing `~` or the run root,
+ * reaching into the run root outside this sandbox's directory, or overlapping the operator's
+ * harness state. A harness's install tree may lie inside its state (codex's `~/.codex/packages`),
+ * never contain it. An allowed path may hold the run root only when it is hidden.
+ */
+export function checkProfile(
+  settings: SrtSettings,
+  host: SrtHost,
+  context: SandboxContext,
+  { hidden }: Pick<ResolvedSandbox<unknown>, "hidden">,
+): void {
+  const { denyRead, allowRead, allowWrite, denyWrite } = settings.filesystem;
+  for (const denied of [host.home, context.runRoot]) {
+    if (!denyRead.includes(denied)) throw new Error(`srt profile does not deny ${denied}`);
+  }
+  for (const path of hidden) {
+    if (!denyRead.includes(path) || !denyWrite.includes(path)) {
+      throw new Error(`srt profile does not hide ${path}`);
+    }
+    // srt's deny, applied after every allow, would hide this sandbox's own directory with it.
+    if (contains(path, context.directory)) {
+      throw new Error(`srt profile would hide its own directory ${context.directory} in ${path}`);
+    }
+  }
+  for (const path of [...allowRead, ...allowWrite]) {
+    if (contains(path, host.home)) throw new Error(`srt profile would expose ~ through ${path}`);
+    if (
+      path === context.runRoot ||
+      (contains(path, context.runRoot) && !hidden.includes(context.runRoot))
+    ) {
+      throw new Error(`srt profile would expose the run root through ${path}`);
+    }
+    if (contains(context.runRoot, path) && !contains(context.directory, path)) {
+      throw new Error(`srt profile reaches into the run root at ${path}`);
+    }
+    const state = host.harnessState.find((root) => contains(path, root));
+    if (state) throw new Error(`srt profile would expose harness state ${state} through ${path}`);
+    const keys = KEY_DIRECTORIES.map((name) => join(host.home, name)).find(
+      (root) => contains(path, root) || contains(root, path),
+    );
+    if (keys) throw new Error(`srt profile would expose ${keys} through ${path}`);
+  }
+  for (const path of allowWrite) {
+    const state = host.harnessState.find((root) => contains(root, path));
+    if (state) throw new Error(`srt profile would let ${path} in harness state be written`);
+  }
+}
+
+function unique(values: readonly string[]): string[] {
+  return [...new Set(values)];
+}