@bjoernrochel/sevro 0.1.0-rc.2 → 0.1.0-rc.21

package/src/hosts/isolation-common.ts

@@ -0,0 +1,94 @@
+import { realpath } from "node:fs/promises";
+import { isAbsolute, relative, sep } from "node:path";
+import { insideRuntimeRoot } from "../runtime/paths";
+import { workspaceBoundaryException } from "../fixtures/workspace-state";
+import type { CandidateArtifactRoots } from "../candidate-artifacts";
+
+export class HostIsolationError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "HostIsolationError";
+  }
+}
+
+export interface IsolationOptions {
+  argv: string[];
+  workspace: string;
+  protectedRoots: string[];
+  protectedRootsCanonical?: boolean;
+  privateStateRoot: string;
+  denyNetwork?: boolean;
+  localHttp?: boolean;
+  readOnlyRoots?: string[];
+  transcriptReadRoots?: string[];
+  candidateArtifactRoots?: CandidateArtifactRoots;
+  hookReadRoots?: string[];
+  writableRuntimeRoot?: string;
+  writableCacheRoots?: string[];
+}
+
+export interface IsolatedCommand {
+  argv: string[];
+  release(): Promise<void>;
+}
+
+export function inside(root: string, path: string): boolean {
+  const child = relative(root, path);
+  return (
+    child === "" ||
+    (child !== ".." && !child.startsWith(`..${sep}`) && !child.startsWith(sep))
+  );
+}
+
+export async function commandRuntimeRoot(
+  stateRoot: string,
+  path: string | undefined,
+): Promise<string | undefined> {
+  if (!path) return undefined;
+  const root = await realpath(path);
+  if (root === stateRoot || !insideRuntimeRoot(stateRoot, root))
+    throw new HostIsolationError(
+      "command runtime must be contained in private state",
+    );
+  return root;
+}
+
+export function requireIsolationPaths(options: IsolationOptions): void {
+  if (!options.argv.length || options.argv.some((part) => !part))
+    throw new HostIsolationError("isolated command must be nonempty");
+  if (!options.protectedRoots.length)
+    throw new HostIsolationError("isolated command needs protected roots");
+  if (!absoluteIsolationPaths(options))
+    throw new HostIsolationError("isolation paths must be absolute");
+}
+
+function absoluteIsolationPaths(options: IsolationOptions): boolean {
+  return (
+    isAbsolute(options.workspace) &&
+    isAbsolute(options.privateStateRoot) &&
+    (options.writableCacheRoots ?? []).every(isAbsolute) &&
+    options.protectedRoots.every(isAbsolute)
+  );
+}
+
+export function requireDisjointState(
+  workspace: string,
+  roots: string[],
+  stateRoot: string,
+): void {
+  if (
+    roots.some(
+      (root) =>
+        inside(root, workspace) &&
+        !workspaceBoundaryException(root, workspace).length,
+    ) ||
+    inside(stateRoot, workspace)
+  )
+    throw new HostIsolationError(
+      "protected root includes the candidate workspace",
+    );
+  if (inside(workspace, stateRoot))
+    throw new HostIsolationError(
+      "sandbox state is inside the candidate workspace",
+    );
+}

package/src/hosts/isolation-roots.ts

@@ -1,21 +1,28 @@
-import { readdir, realpath } from "node:fs/promises";
-import { homedir, tmpdir, userInfo } from "node:os";
-import { isAbsolute, join, resolve } from "node:path";
+import { isMissingFile } from "../fixtures/tools";
+import { realpath } from "node:fs/promises";
+import { homedir, userInfo } from "node:os";
+import { isAbsolute, resolve } from "node:path";
 import { protectedWorktrees } from "./protected-worktrees";
+import { nativeStateParent } from "../native-transcript-state";
+import { workspaceStateParent } from "../fixtures/workspace-state";
 
 /** Include source, results, host configuration, and every active peer fixture. */
-export async function evaluationProtectedRoots(options: {
+interface ProtectedRootsOptions {
   workspace: string;
   projectRoot: string;
   resultsRoot: string;
   additionalRoots: string[];
-}): Promise<string[]> {
-  const workspace = await realpath(options.workspace);
+  ownedStateRoot?: string;
+}
+
+async function protectedRootCandidates(options: ProtectedRootsOptions) {
   const optionalConfigRoots = [
     process.env.CODEX_HOME,
     process.env.CLAUDE_CONFIG_DIR,
   ].filter((value): value is string => Boolean(value));
   const candidates = [
+    await nativeStateParent(),
+    await workspaceStateParent(),
     resolve(import.meta.dir, "../.."),
     options.projectRoot,
     options.resultsRoot,
@@ -26,29 +33,29 @@ export async function evaluationProtectedRoots(options: {
   ];
   if (candidates.some((root) => !isAbsolute(root)))
     throw new Error("evaluation protected roots must be absolute");
-  const peers = (await readdir(tmpdir(), { withFileTypes: true }))
-    .filter(
-      (entry) => entry.isDirectory() && entry.name.startsWith("sevro-case-"),
-    )
-    .map((entry) => join(tmpdir(), entry.name));
+  return { candidates, optionalConfigRoots };
+}
+
+/** Include source, results, host configuration, and every active peer fixture. */
+export async function evaluationProtectedRoots(
+  options: ProtectedRootsOptions,
+): Promise<string[]> {
+  const workspace = await realpath(options.workspace);
+  const { candidates, optionalConfigRoots } =
+    await protectedRootCandidates(options);
+  const namespace = await workspaceStateParent();
+  const nativeNamespace = await nativeStateParent();
   const roots: string[] = [];
-  for (const candidate of [...candidates, ...peers]) {
-    let canonical: string;
-    try {
-      canonical = await realpath(candidate);
-    } catch (error) {
-      if (
-        (peers.includes(candidate) ||
-          optionalConfigRoots.includes(candidate)) &&
-        (error as NodeJS.ErrnoException).code === "ENOENT"
-      )
-        continue;
-      throw new Error("evaluation protected root is unreadable");
-    }
-    if (canonical !== workspace) {
+  for (const candidate of candidates) {
+    const canonical = await canonicalProtectedRoot(candidate, [
+      ...optionalConfigRoots,
+    ]);
+    if (!includedProtectedRoot(canonical, workspace, options.ownedStateRoot))
+      continue;
+    {
       roots.push(canonical);
-      // Peers are denied directly; their Git preparation may still be in progress.
-      if (!peers.includes(candidate))
+      // Private namespaces are boundaries, not Git source trees to traverse.
+      if (canonical !== namespace && canonical !== nativeNamespace)
         roots.push(
           ...(await protectedWorktrees(canonical)).filter(
             (root) => root !== workspace,
@@ -58,3 +65,23 @@ export async function evaluationProtectedRoots(options: {
   }
   return [...new Set(roots)];
 }
+
+function includedProtectedRoot(
+  root: string | null,
+  workspace: string,
+  state: string | undefined,
+): root is string {
+  return root !== null && root !== workspace && root !== state;
+}
+
+async function canonicalProtectedRoot(
+  candidate: string,
+  optionalRoots: string[],
+): Promise<string | null> {
+  try {
+    return await realpath(candidate);
+  } catch (cause) {
+    if (optionalRoots.includes(candidate) && isMissingFile(cause)) return null;
+    throw new Error("evaluation protected root is unreadable", { cause });
+  }
+}

package/src/hosts/isolation.ts

@@ -0,0 +1,10 @@
+import { HostIsolationError, type IsolationOptions } from "./isolation-common";
+import { prepareMacSandboxCommand } from "./mac-sandbox";
+import { prepareLinuxSandboxCommand } from "./linux-sandbox";
+
+/** Select the native filesystem boundary for evaluator-owned commands. */
+export function prepareIsolatedCommand(options: IsolationOptions) {
+  if (process.platform === "darwin") return prepareMacSandboxCommand(options);
+  if (process.platform === "linux") return prepareLinuxSandboxCommand(options);
+  throw new HostIsolationError("host isolation is unavailable");
+}

package/src/hosts/linux-sandbox.ts

@@ -0,0 +1,159 @@
+import { randomUUID } from "node:crypto";
+import { existsSync } from "node:fs";
+import { mkdir, realpath, rm, stat, writeFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import {
+  requireNativeTranscriptViews,
+  requireNativeHookRoots,
+} from "../native-transcript-state";
+import { requireRuntimeReadRoots } from "../runtime/paths";
+import { requireWritableCacheRoots } from "../runtime/shared-cache";
+import { requireCandidateArtifactRoots } from "../candidate-artifacts";
+import {
+  commandRuntimeRoot,
+  HostIsolationError,
+  requireDisjointState,
+  requireIsolationPaths,
+  type IsolatedCommand,
+  type IsolationOptions,
+} from "./isolation-common";
+
+const BWRAP = "/usr/bin/bwrap";
+
+async function protectedKind(path: string): Promise<"file" | "directory"> {
+  try {
+    return (await stat(path)).isDirectory() ? "directory" : "file";
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return "directory";
+    throw error;
+  }
+}
+
+function requireLinuxSandbox(): void {
+  if (process.platform !== "linux" || !existsSync(BWRAP))
+    throw new HostIsolationError("Linux bubblewrap isolation is unavailable");
+}
+
+function networkArgs(denyNetwork: boolean): string[] {
+  return denyNetwork ? ["--unshare-net"] : [];
+}
+
+function mountProtectedRoot(
+  path: string,
+  kind: "file" | "directory" | undefined,
+  blockedFile: string,
+): string[] {
+  return kind === "directory"
+    ? ["--tmpfs", path, "--chmod", "0111", path]
+    : ["--ro-bind", blockedFile, path];
+}
+
+/** Mask protected inputs before launching an evaluator-owned command. */
+export async function prepareLinuxSandboxCommand(
+  options: IsolationOptions,
+): Promise<IsolatedCommand> {
+  requireLinuxSandbox();
+  await requireNativeTranscriptViews(options.transcriptReadRoots);
+  await requireCandidateArtifactRoots(options.candidateArtifactRoots);
+  await requireNativeHookRoots(options.hookReadRoots, options.privateStateRoot);
+  requireIsolationPaths(options);
+  const workspace = await realpath(options.workspace);
+  const roots = options.protectedRootsCanonical
+    ? options.protectedRoots
+    : await Promise.all(options.protectedRoots.map((path) => realpath(path)));
+  await mkdir(options.privateStateRoot, { recursive: true, mode: 0o700 });
+  const stateRoot = await realpath(options.privateStateRoot);
+  const ownedRoot = await commandRuntimeRoot(
+    stateRoot,
+    options.writableRuntimeRoot,
+  );
+  const readRoots = options.readOnlyRoots ?? [];
+  const writableCacheRoots = await cacheMountRoots(options, [
+    ...roots,
+    stateRoot,
+  ]);
+  requireRuntimeReadRoots(readRoots, [...roots, stateRoot]);
+  requireDisjointState(workspace, roots, stateRoot);
+  const blockedFile = resolve(stateRoot, `blocked-${randomUUID()}`);
+  await writeFile(blockedFile, "", { flag: "wx", mode: 0o000 });
+  try {
+    const protectedRoots = [...new Set([...roots, stateRoot])].sort(
+      (left, right) => left.length - right.length,
+    );
+    const kinds = await Promise.all(protectedRoots.map(protectedKind));
+    const masks = protectedRoots.flatMap((path, index) =>
+      mountProtectedRoot(path, kinds[index], blockedFile),
+    );
+    return {
+      argv: [
+        BWRAP,
+        "--die-with-parent",
+        "--unshare-user",
+        "--unshare-pid",
+        ...networkArgs(Boolean(options.denyNetwork)),
+        "--ro-bind",
+        "/",
+        "/",
+        "--dev-bind",
+        "/dev",
+        "/dev",
+        "--proc",
+        "/proc",
+        "--bind",
+        "/tmp",
+        "/tmp",
+        ...masks,
+        "--bind",
+        workspace,
+        workspace,
+        ...readRoots.flatMap((path) => ["--ro-bind", path, path]),
+        ...transcriptMounts(options),
+        ...candidateArtifactMounts(options),
+        ...hookMounts(options),
+        ...(ownedRoot ? ["--bind", ownedRoot, ownedRoot] : []),
+        ...writableCacheRoots.flatMap((path) => ["--bind", path, path]),
+        "--chdir",
+        workspace,
+        "--",
+        ...options.argv,
+      ],
+      release: async () => {
+        await rm(blockedFile, { force: true });
+      },
+    };
+  } catch (error) {
+    await rm(blockedFile, { force: true });
+    throw error;
+  }
+}
+
+function cacheMountRoots(options: IsolationOptions, protectedRoots: string[]) {
+  return requireWritableCacheRoots(
+    options.writableCacheRoots ?? [],
+    protectedRoots,
+  );
+}
+
+function transcriptMounts(options: IsolationOptions): string[] {
+  return (options.transcriptReadRoots ?? []).flatMap((path) => [
+    "--ro-bind",
+    path,
+    path,
+  ]);
+}
+
+function candidateArtifactMounts(options: IsolationOptions): string[] {
+  return Object.values(options.candidateArtifactRoots ?? {}).flatMap((path) => [
+    "--ro-bind",
+    path,
+    path,
+  ]);
+}
+
+function hookMounts(options: IsolationOptions): string[] {
+  return (options.hookReadRoots ?? []).flatMap((path) => [
+    "--ro-bind",
+    path,
+    path,
+  ]);
+}

package/src/hosts/mac-sandbox.ts

@@ -1,103 +1,216 @@
 import { randomUUID } from "node:crypto";
 import { existsSync } from "node:fs";
 import { mkdir, realpath, rm, writeFile } from "node:fs/promises";
-import { isAbsolute, relative, resolve, sep } from "node:path";
+import { dirname, resolve } from "node:path";
+import {
+  requireNativeTranscriptViews,
+  requireNativeHookRoots,
+} from "../native-transcript-state";
+import { requireCandidateArtifactRoots } from "../candidate-artifacts";
+import { workspaceBoundaryException } from "../fixtures/workspace-state";
+import { requireWritableCacheRoots } from "../runtime/shared-cache";
+import {
+  insideRuntimeRoot,
+  isRuntimeHomeRoot,
+  requireRuntimeReadRoots,
+} from "../runtime/paths";
+import {
+  commandRuntimeRoot,
+  HostIsolationError,
+  requireDisjointState,
+  requireIsolationPaths,
+  type IsolatedCommand,
+  type IsolationOptions,
+} from "./isolation-common";
 
-const SANDBOX_EXEC = "/usr/bin/sandbox-exec";
-
-export class HostIsolationError extends Error {
-  constructor(message: string) {
-    super(message);
-    this.name = "HostIsolationError";
-  }
-}
+export { HostIsolationError } from "./isolation-common";
+export type { IsolatedCommand } from "./isolation-common";
 
-function inside(root: string, path: string): boolean {
-  const child = relative(root, path);
-  return (
-    child === "" ||
-    (child !== ".." && !child.startsWith(`..${sep}`) && !child.startsWith(sep))
-  );
-}
+const SANDBOX_EXEC = "/usr/bin/sandbox-exec";
 
 function quoted(path: string): string {
-  if (/[\x00-\x1f\x7f]/.test(path))
+  if (
+    Array.from(path).some(
+      (character) =>
+        character.charCodeAt(0) < 0x20 || character.charCodeAt(0) === 0x7f,
+    )
+  )
     throw new HostIsolationError("sandbox path contains a control character");
   return path.replaceAll("\\", "\\\\").replaceAll('"', '\\"');
 }
 
-/** Deny both observation and mutation of every protected canonical root. */
+/** Protect canonical roots while preserving explicitly granted access. */
 export function macSandboxProfile(
   deniedRoots: string[],
   denyNetwork = false,
+  readOnlyRoots: string[] = [],
+  writableRuntimeRoot?: string,
+  transcriptReadRoots: string[] = [],
+  workspace?: string,
+  localHttp?: boolean,
+  writableCacheRoots?: string[],
 ): string {
-  if (!deniedRoots.length || deniedRoots.some((path) => !path.startsWith("/")))
-    throw new HostIsolationError("sandbox roots must be absolute and nonempty");
+  requireProfileRoots(deniedRoots);
   return [
     "(version 1)",
     "(allow default)",
     ...(denyNetwork ? ["(deny network*)"] : []),
+    ...localHttpRules(localHttp),
     ...[...new Set(deniedRoots)]
       .sort()
       .flatMap((path) => [
-        `(deny file-read* (subpath "${quoted(path)}"))`,
-        `(deny file-write* (subpath "${quoted(path)}"))`,
+        `(deny file-read* ${workspaceReadFilter(path, readExceptions(path, readOnlyRoots, writableRuntimeRoot, transcriptReadRoots, workspace, writableCacheRoots), workspace)})`,
+        `(deny file-write* ${rootFilter(path, [...writableExceptions(path, writableRuntimeRoot, writableCacheRoots), ...workspaceBoundaryException(path, workspace)])})`,
       ]),
+    ...deniedRoots.flatMap((path) =>
+      workspaceBoundaryException(path, workspace).map(
+        () => `(deny file-read-data (literal "${quoted(path)}"))`,
+      ),
+    ),
+    ...[...readOnlyRoots, ...transcriptReadRoots].map(
+      (path) => `(deny file-write* (subpath "${quoted(path)}"))`,
+    ),
+    ...deniedRoots.flatMap((root) =>
+      ancestorMetadataRules(
+        root,
+        readExceptions(
+          root,
+          readOnlyRoots,
+          writableRuntimeRoot,
+          transcriptReadRoots,
+          workspace,
+          writableCacheRoots,
+        ),
+      ),
+    ),
     "",
   ].join("\n");
 }
 
-export interface IsolatedCommand {
-  argv: string[];
-  release(): Promise<void>;
+function localHttpRules(enabled: boolean | undefined): string[] {
+  return enabled
+    ? [
+        '(allow network-bind (local ip "*:*"))',
+        '(allow network-inbound (local ip "localhost:*"))',
+        '(allow network-outbound (remote ip "localhost:*"))',
+      ]
+    : [];
+}
+
+function ancestorMetadataRules(root: string, readRoots: string[]): string[] {
+  const ancestors = new Set<string>();
+  for (const readRoot of readRoots) {
+    for (
+      let path = dirname(readRoot);
+      insideRuntimeRoot(root, path);
+      path = dirname(path)
+    ) {
+      ancestors.add(path);
+      if (path === resolve(root)) break;
+    }
+  }
+  return [...ancestors]
+    .sort()
+    .map((path) => `(allow file-read-metadata (literal "${quoted(path)}"))`);
+}
+
+function requireProfileRoots(roots: string[]): void {
+  if (!roots.length || roots.some((path) => !path.startsWith("/")))
+    throw new HostIsolationError("sandbox roots must be absolute and nonempty");
+}
+
+function readExceptions(
+  root: string,
+  readRoots: string[],
+  writableRuntimeRoot: string | undefined,
+  transcriptReadRoots: string[],
+  workspace?: string,
+  writableCacheRoots: string[] = [],
+): string[] {
+  const exceptions = isRuntimeHomeRoot(root)
+    ? readRoots.filter((path) => insideRuntimeRoot(root, path))
+    : [];
+  return [
+    ...transcriptReadRoots.filter((path) => insideRuntimeRoot(root, path)),
+    ...exceptions,
+    ...writableExceptions(root, writableRuntimeRoot, writableCacheRoots),
+    ...workspaceBoundaryException(root, workspace),
+  ];
+}
+
+function writableExceptions(
+  root: string,
+  runtime: string | undefined,
+  caches: string[] = [],
+): string[] {
+  return [
+    ...ownedException(root, runtime),
+    ...caches.flatMap((cache) => ownedException(root, cache)),
+  ];
+}
+
+function rootFilter(root: string, exceptions: string[]): string {
+  const base = `(subpath "${quoted(root)}")`;
+  if (!exceptions.length) return base;
+  return `(require-all ${base} ${exceptions.map((path) => `(require-not (subpath "${quoted(path)}"))`).join(" ")})`;
+}
+
+function workspaceReadFilter(
+  root: string,
+  exceptions: string[],
+  workspace?: string,
+): string {
+  const filter = rootFilter(root, exceptions);
+  return workspaceBoundaryException(root, workspace).length
+    ? `(require-all ${filter} (require-not (literal "${quoted(root)}")))`
+    : filter;
+}
+
+function ownedException(root: string, ownedRoot: string | undefined): string[] {
+  if (ownedRoot && insideRuntimeRoot(root, ownedRoot)) return [ownedRoot];
+  return [];
 }
 
 /** Build the outer boundary before launching an agent or candidate-controlled code. */
-export async function prepareMacSandboxCommand(options: {
-  argv: string[];
-  workspace: string;
-  protectedRoots: string[];
-  protectedRootsCanonical?: boolean;
-  privateStateRoot: string;
-  denyNetwork?: boolean;
-}): Promise<IsolatedCommand> {
-  if (process.platform !== "darwin" || !existsSync(SANDBOX_EXEC))
-    throw new HostIsolationError("macOS sandbox-exec isolation is unavailable");
-  if (!options.argv.length || options.argv.some((part) => !part))
-    throw new HostIsolationError("isolated command must be nonempty");
-  if (!options.protectedRoots.length)
-    throw new HostIsolationError("isolated command needs protected roots");
-  if (
-    !isAbsolute(options.workspace) ||
-    !isAbsolute(options.privateStateRoot) ||
-    options.protectedRoots.some((path) => !isAbsolute(path))
-  )
-    throw new HostIsolationError("isolation paths must be absolute");
+export async function prepareMacSandboxCommand(
+  options: IsolationOptions,
+): Promise<IsolatedCommand> {
+  requireSandboxAvailable();
+  await requireNativeTranscriptViews(options.transcriptReadRoots);
+  await requireCandidateArtifactRoots(options.candidateArtifactRoots);
+  await requireNativeHookRoots(options.hookReadRoots, options.privateStateRoot);
+  requireIsolationPaths(options);
   const workspace = await realpath(options.workspace);
   const roots = options.protectedRootsCanonical
     ? options.protectedRoots
     : await Promise.all(options.protectedRoots.map((path) => realpath(path)));
   await mkdir(options.privateStateRoot, { recursive: true, mode: 0o700 });
   const stateRoot = await realpath(options.privateStateRoot);
-  if (
-    roots.some((root) => inside(root, workspace)) ||
-    inside(stateRoot, workspace)
-  )
-    throw new HostIsolationError(
-      "protected root includes the candidate workspace",
-    );
-  if (inside(workspace, stateRoot))
-    throw new HostIsolationError(
-      "sandbox state is inside the candidate workspace",
-    );
+  const ownedRoot = await commandRuntimeRoot(
+    stateRoot,
+    options.writableRuntimeRoot,
+  );
+  const readRoots = options.readOnlyRoots ?? [];
+  const writableCacheRoots = await requireWritableCacheRoots(
+    options.writableCacheRoots ?? [],
+    [...roots, stateRoot],
+  );
+  requireRuntimeReadRoots(readRoots, [...roots, stateRoot]);
+  requireDisjointState(workspace, roots, stateRoot);
   const profilePath = resolve(stateRoot, `host-${randomUUID()}.sb`);
   await writeFile(
     profilePath,
-    macSandboxProfile([...roots, stateRoot], options.denyNetwork),
-    {
-      flag: "wx",
-      mode: 0o600,
-    },
+    macSandboxProfile(
+      [...roots, stateRoot],
+      options.denyNetwork,
+      readRoots,
+      ownedRoot,
+      curatedReadRoots(options),
+      workspace,
+      options.localHttp,
+      writableCacheRoots,
+    ),
+    { flag: "wx", mode: 0o600 },
   );
   return {
     argv: [SANDBOX_EXEC, "-f", profilePath, ...options.argv],
@@ -106,3 +219,16 @@ export async function prepareMacSandboxCommand(options: {
     },
   };
 }
+
+function curatedReadRoots(options: IsolationOptions): string[] {
+  return [
+    ...(options.transcriptReadRoots ?? []),
+    ...(options.hookReadRoots ?? []),
+    ...Object.values(options.candidateArtifactRoots ?? {}),
+  ];
+}
+
+function requireSandboxAvailable(): void {
+  if (process.platform !== "darwin" || !existsSync(SANDBOX_EXEC))
+    throw new HostIsolationError("macOS sandbox-exec isolation is unavailable");
+}