@agentswf/sandbox 0.1.0-beta.0 → 0.1.0-beta.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentswf/sandbox",
-  "version": "0.1.0-beta.0",
+  "version": "0.1.0-beta.2",
   "description": "agents.wf: the sandboxes a workflow opens, and their providers",
   "license": "MIT",
   "homepage": "https://github.com/romanlv/agentswf",
@@ -28,7 +28,7 @@
     "docker"
   ],
   "dependencies": {
-    "@agentswf/contract": "0.1.0-beta.0"
+    "@agentswf/contract": "0.1.0-beta.2"
   },
   "publishConfig": {
     "access": "public"

package/src/docker/index.ts

@@ -133,6 +133,11 @@ async function openBox(
     }
     return result.stdout.trim();
   };
+  if (spec.sockets.length > 0) {
+    throw new Error(
+      `docker: a box cannot reach host sockets (${spec.sockets.join(", ")}); use srt`,
+    );
+  }
   const socket = daemonSocket(client.environment);
   for (const path of [spec.cwd, ...spec.read, ...spec.write]) {
     // A box that can reach the daemon can start a container with the host mounted.

package/src/resolve.ts

@@ -5,7 +5,7 @@ import { isRecord } from "@agentswf/contract";
 import { SANDBOX_ENVIRONMENTS, type SandboxEnvironmentKey } from "@agentswf/contract/workflow";
 import type { Gitdir, ResolvedSandbox, SandboxProviders } from "./seam";
 
-const REACH_KEYS = ["read", "write", "network"] as const;
+const REACH_KEYS = ["read", "write", "network", "sockets", "webSearch"] as const;
 
 export type SandboxResolution = {
   /** The environment key the sandbox runs under: the one the spec named, else the default. */
@@ -110,7 +110,7 @@ export async function resolveSandbox(
     await resolvePath(spec.cwd === undefined ? "." : spec.cwd, options.cwd, home, "cwd"),
     "cwd",
   );
-  const paths = (field: "read" | "write") =>
+  const paths = (field: "read" | "write" | "sockets") =>
     Promise.all(
       list(spec[field], field).map(async (path) =>
         forbidden(await resolvePath(path, cwd, home, field), field),
@@ -118,6 +118,10 @@ export async function resolveSandbox(
     );
   const write = unique(await paths("write"));
   const read = unique(await paths("read")).filter((path) => !write.includes(path));
+  const sockets = unique(await paths("sockets"));
+  if (spec.webSearch !== undefined && typeof spec.webSearch !== "boolean") {
+    throw new Error("sandbox webSearch must be true or false");
+  }
   const network = unique(
     list(spec.network, "network").map((domain) => {
       if (!isDomain(domain)) throw new Error(`not a sandbox domain: ${JSON.stringify(domain)}`);
@@ -174,6 +178,8 @@ export async function resolveSandbox(
       read,
       write,
       network,
+      sockets,
+      webSearch: spec.webSearch === true,
       hidden: holdsRunRoot ? [runRoot] : [],
       gitdirs: [...gitdirs].map(([path, { own, linked }]): Gitdir => {
         // A submodule's gitdir is in its superproject's `modules`, which is guarded whole: it is

package/src/srt/index.ts

@@ -247,6 +247,8 @@ async function probe(options: SrtOptions, context: SandboxContext): Promise<void
       read: [],
       write: [],
       network: [],
+      sockets: [],
+      webSearch: false,
       hidden: [],
       gitdirs: [],
       environment: {},
@@ -302,7 +304,8 @@ async function probe(options: SrtOptions, context: SandboxContext): Promise<void
 }
 
 /**
- * srt as installed on this machine: 1.0.0 or later on `PATH`. `undefined` when absent. The
+ * srt as installed on this machine: the `srt` on `PATH` that answers `--version` (npm releases are
+ * 0.0.x; older ones print 1.0.0 outside npm). `undefined` when absent. The
  * toolchain is what `PATH`'s executables under `~` need: their `bin` directories, and each one's
  * install tree (X19): a node package's root, a `bin/` beside a `lib/` (a node or a Python venv),
  * or the executable alone. Never a whole parent of `bin`: `~/.local` holds `state/` and
@@ -324,8 +327,8 @@ export async function findSrt(
     stderr: "pipe",
     timeout: VERSION_MS,
   });
-  const [major] = version.stdout.toString().trim().split(".").map(Number);
-  if (version.exitCode !== 0 || major === undefined || !(major >= 1)) return undefined;
+  if (version.exitCode !== 0 || !/^\d+\.\d+\.\d+/.test(version.stdout.toString().trim()))
+    return undefined;
   const real = [
     ...new Set(
       (await Promise.all(path.map((entry) => realpath(entry).catch(() => undefined)))).filter(

package/src/srt/profile.ts

@@ -63,7 +63,11 @@ export function baseProfile(
   const gitdirs = spec.gitdirs.map((gitdir) => gitdir.path);
   return {
     enableWeakerNetworkIsolation: true,
-    network: { allowedDomains: [...spec.network], deniedDomains: [], allowUnixSockets: [] },
+    network: {
+      allowedDomains: [...spec.network],
+      deniedDomains: [],
+      allowUnixSockets: [...spec.sockets],
+    },
     filesystem: {
       denyRead: unique([host.home, ...DENIED, context.runRoot, ...spec.hidden]),
       allowRead: unique([
@@ -117,7 +121,11 @@ export function agentProfile(
     network: {
       ...base.network,
       allowedDomains: unique([...base.network.allowedDomains, ...agent.harness.domains]),
-      allowUnixSockets: [agent.door.endpoint, ...(short ? [short] : [])],
+      allowUnixSockets: unique([
+        ...base.network.allowUnixSockets,
+        agent.door.endpoint,
+        ...(short ? [short] : []),
+      ]),
     },
     filesystem: {
       ...base.filesystem,