@agentswf/sandbox 0.1.0-beta.0 → 0.1.0-beta.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentswf/sandbox",
-  "version": "0.1.0-beta.0",
+  "version": "0.1.0-beta.1",
   "description": "agents.wf: the sandboxes a workflow opens, and their providers",
   "license": "MIT",
   "homepage": "https://github.com/romanlv/agentswf",

package/src/docker/index.ts

@@ -133,6 +133,11 @@ async function openBox(
     }
     return result.stdout.trim();
   };
+  if (spec.sockets.length > 0) {
+    throw new Error(
+      `docker: a box cannot reach host sockets (${spec.sockets.join(", ")}); use srt`,
+    );
+  }
   const socket = daemonSocket(client.environment);
   for (const path of [spec.cwd, ...spec.read, ...spec.write]) {
     // A box that can reach the daemon can start a container with the host mounted.

package/src/resolve.ts

@@ -5,7 +5,7 @@ import { isRecord } from "@agentswf/contract";
 import { SANDBOX_ENVIRONMENTS, type SandboxEnvironmentKey } from "@agentswf/contract/workflow";
 import type { Gitdir, ResolvedSandbox, SandboxProviders } from "./seam";
 
-const REACH_KEYS = ["read", "write", "network"] as const;
+const REACH_KEYS = ["read", "write", "network", "sockets", "webSearch"] as const;
 
 export type SandboxResolution = {
   /** The environment key the sandbox runs under: the one the spec named, else the default. */
@@ -110,7 +110,7 @@ export async function resolveSandbox(
     await resolvePath(spec.cwd === undefined ? "." : spec.cwd, options.cwd, home, "cwd"),
     "cwd",
   );
-  const paths = (field: "read" | "write") =>
+  const paths = (field: "read" | "write" | "sockets") =>
     Promise.all(
       list(spec[field], field).map(async (path) =>
         forbidden(await resolvePath(path, cwd, home, field), field),
@@ -118,6 +118,10 @@ export async function resolveSandbox(
     );
   const write = unique(await paths("write"));
   const read = unique(await paths("read")).filter((path) => !write.includes(path));
+  const sockets = unique(await paths("sockets"));
+  if (spec.webSearch !== undefined && typeof spec.webSearch !== "boolean") {
+    throw new Error("sandbox webSearch must be true or false");
+  }
   const network = unique(
     list(spec.network, "network").map((domain) => {
       if (!isDomain(domain)) throw new Error(`not a sandbox domain: ${JSON.stringify(domain)}`);
@@ -174,6 +178,8 @@ export async function resolveSandbox(
       read,
       write,
       network,
+      sockets,
+      webSearch: spec.webSearch === true,
       hidden: holdsRunRoot ? [runRoot] : [],
       gitdirs: [...gitdirs].map(([path, { own, linked }]): Gitdir => {
         // A submodule's gitdir is in its superproject's `modules`, which is guarded whole: it is

package/src/srt/index.ts

@@ -247,6 +247,8 @@ async function probe(options: SrtOptions, context: SandboxContext): Promise<void
       read: [],
       write: [],
       network: [],
+      sockets: [],
+      webSearch: false,
       hidden: [],
       gitdirs: [],
       environment: {},

package/src/srt/profile.ts

@@ -63,7 +63,11 @@ export function baseProfile(
   const gitdirs = spec.gitdirs.map((gitdir) => gitdir.path);
   return {
     enableWeakerNetworkIsolation: true,
-    network: { allowedDomains: [...spec.network], deniedDomains: [], allowUnixSockets: [] },
+    network: {
+      allowedDomains: [...spec.network],
+      deniedDomains: [],
+      allowUnixSockets: [...spec.sockets],
+    },
     filesystem: {
       denyRead: unique([host.home, ...DENIED, context.runRoot, ...spec.hidden]),
       allowRead: unique([
@@ -117,7 +121,11 @@ export function agentProfile(
     network: {
       ...base.network,
       allowedDomains: unique([...base.network.allowedDomains, ...agent.harness.domains]),
-      allowUnixSockets: [agent.door.endpoint, ...(short ? [short] : [])],
+      allowUnixSockets: unique([
+        ...base.network.allowUnixSockets,
+        agent.door.endpoint,
+        ...(short ? [short] : []),
+      ]),
     },
     filesystem: {
       ...base.filesystem,