@bjoernrochel/sevro 0.1.0-rc.7 → 1.0.0

package/src/hosts/isolation-common.ts

@@ -1,6 +1,10 @@
 import { realpath } from "node:fs/promises";
-import { isAbsolute, relative, sep } from "node:path";
-import { insideRuntimeRoot } from "../runtime-paths";
+import { isAbsolute } from "node:path";
+import { insideRoot as inside } from "../paths";
+export { insideRoot as inside } from "../paths";
+import { insideRuntimeRoot } from "../runtime/paths";
+import { workspaceBoundaryException } from "../fixtures/workspace-state";
+import type { CandidateArtifactRoots } from "../candidate-artifacts";
 
 export class HostIsolationError extends Error {
   constructor(message: string) {
@@ -16,10 +20,13 @@ export interface IsolationOptions {
   protectedRootsCanonical?: boolean;
   privateStateRoot: string;
   denyNetwork?: boolean;
+  localHttp?: boolean;
   readOnlyRoots?: string[];
   transcriptReadRoots?: string[];
+  candidateArtifactRoots?: CandidateArtifactRoots;
   hookReadRoots?: string[];
   writableRuntimeRoot?: string;
+  writableCacheRoots?: string[];
 }
 
 export interface IsolatedCommand {
@@ -27,14 +34,6 @@ export interface IsolatedCommand {
   release(): Promise<void>;
 }
 
-export function inside(root: string, path: string): boolean {
-  const child = relative(root, path);
-  return (
-    child === "" ||
-    (child !== ".." && !child.startsWith(`..${sep}`) && !child.startsWith(sep))
-  );
-}
-
 export async function commandRuntimeRoot(
   stateRoot: string,
   path: string | undefined,
@@ -61,6 +60,7 @@ function absoluteIsolationPaths(options: IsolationOptions): boolean {
   return (
     isAbsolute(options.workspace) &&
     isAbsolute(options.privateStateRoot) &&
+    (options.writableCacheRoots ?? []).every(isAbsolute) &&
     options.protectedRoots.every(isAbsolute)
   );
 }
@@ -71,7 +71,11 @@ export function requireDisjointState(
   stateRoot: string,
 ): void {
   if (
-    roots.some((root) => inside(root, workspace)) ||
+    roots.some(
+      (root) =>
+        inside(root, workspace) &&
+        !workspaceBoundaryException(root, workspace).length,
+    ) ||
     inside(stateRoot, workspace)
   )
     throw new HostIsolationError(

package/src/hosts/isolation-roots.ts

@@ -1,9 +1,10 @@
-import { isMissingFile } from "../fixture-tools";
-import { readdir, realpath } from "node:fs/promises";
-import { homedir, tmpdir, userInfo } from "node:os";
-import { isAbsolute, join, resolve } from "node:path";
+import { isMissingFile } from "../fixtures/tools";
+import { realpath } from "node:fs/promises";
+import { homedir, userInfo } from "node:os";
+import { isAbsolute, resolve } from "node:path";
 import { protectedWorktrees } from "./protected-worktrees";
 import { nativeStateParent } from "../native-transcript-state";
+import { workspaceStateParent } from "../fixtures/workspace-state";
 
 /** Include source, results, host configuration, and every active peer fixture. */
 interface ProtectedRootsOptions {
@@ -21,6 +22,7 @@ async function protectedRootCandidates(options: ProtectedRootsOptions) {
   ].filter((value): value is string => Boolean(value));
   const candidates = [
     await nativeStateParent(),
+    await workspaceStateParent(),
     resolve(import.meta.dir, "../.."),
     options.projectRoot,
     options.resultsRoot,
@@ -31,17 +33,7 @@ async function protectedRootCandidates(options: ProtectedRootsOptions) {
   ];
   if (candidates.some((root) => !isAbsolute(root)))
     throw new Error("evaluation protected roots must be absolute");
-  const peers = (await readdir(tmpdir(), { withFileTypes: true }))
-    .filter(
-      (entry) =>
-        entry.isDirectory() &&
-        /^(sevro-case-|sevro-codex-state-|sevro-claude-state-|sevro-transcript-view-)/.test(
-          entry.name,
-        ),
-    )
-    .map((entry) => join(tmpdir(), entry.name))
-    .filter((path) => path !== options.ownedStateRoot);
-  return { candidates, peers, optionalConfigRoots };
+  return { candidates, optionalConfigRoots };
 }
 
 /** Include source, results, host configuration, and every active peer fixture. */
@@ -49,20 +41,21 @@ export async function evaluationProtectedRoots(
   options: ProtectedRootsOptions,
 ): Promise<string[]> {
   const workspace = await realpath(options.workspace);
-  const { candidates, peers, optionalConfigRoots } =
+  const { candidates, optionalConfigRoots } =
     await protectedRootCandidates(options);
+  const namespace = await workspaceStateParent();
+  const nativeNamespace = await nativeStateParent();
   const roots: string[] = [];
-  for (const candidate of [...candidates, ...peers]) {
+  for (const candidate of candidates) {
     const canonical = await canonicalProtectedRoot(candidate, [
-      ...peers,
       ...optionalConfigRoots,
     ]);
     if (!includedProtectedRoot(canonical, workspace, options.ownedStateRoot))
       continue;
     {
       roots.push(canonical);
-      // Peers are denied directly; their Git preparation may still be in progress.
-      if (!peers.includes(candidate))
+      // Private namespaces are boundaries, not Git source trees to traverse.
+      if (canonical !== namespace && canonical !== nativeNamespace)
         roots.push(
           ...(await protectedWorktrees(canonical)).filter(
             (root) => root !== workspace,

package/src/hosts/linux-sandbox.ts

@@ -6,7 +6,9 @@ import {
   requireNativeTranscriptViews,
   requireNativeHookRoots,
 } from "../native-transcript-state";
-import { requireRuntimeReadRoots } from "../runtime-paths";
+import { requireRuntimeReadRoots } from "../runtime/paths";
+import { requireWritableCacheRoots } from "../runtime/shared-cache";
+import { requireCandidateArtifactRoots } from "../candidate-artifacts";
 import {
   commandRuntimeRoot,
   HostIsolationError,
@@ -52,7 +54,8 @@ export async function prepareLinuxSandboxCommand(
 ): Promise<IsolatedCommand> {
   requireLinuxSandbox();
   await requireNativeTranscriptViews(options.transcriptReadRoots);
-  await requireNativeHookRoots(options.hookReadRoots);
+  await requireCandidateArtifactRoots(options.candidateArtifactRoots);
+  await requireNativeHookRoots(options.hookReadRoots, options.privateStateRoot);
   requireIsolationPaths(options);
   const workspace = await realpath(options.workspace);
   const roots = options.protectedRootsCanonical
@@ -65,6 +68,10 @@ export async function prepareLinuxSandboxCommand(
     options.writableRuntimeRoot,
   );
   const readRoots = options.readOnlyRoots ?? [];
+  const writableCacheRoots = await cacheMountRoots(options, [
+    ...roots,
+    stateRoot,
+  ]);
   requireRuntimeReadRoots(readRoots, [...roots, stateRoot]);
   requireDisjointState(workspace, roots, stateRoot);
   const blockedFile = resolve(stateRoot, `blocked-${randomUUID()}`);
@@ -95,14 +102,16 @@ export async function prepareLinuxSandboxCommand(
         "--bind",
         "/tmp",
         "/tmp",
+        ...masks,
         "--bind",
         workspace,
         workspace,
-        ...masks,
         ...readRoots.flatMap((path) => ["--ro-bind", path, path]),
         ...transcriptMounts(options),
+        ...candidateArtifactMounts(options),
         ...hookMounts(options),
         ...(ownedRoot ? ["--bind", ownedRoot, ownedRoot] : []),
+        ...writableCacheRoots.flatMap((path) => ["--bind", path, path]),
         "--chdir",
         workspace,
         "--",
@@ -118,6 +127,13 @@ export async function prepareLinuxSandboxCommand(
   }
 }
 
+function cacheMountRoots(options: IsolationOptions, protectedRoots: string[]) {
+  return requireWritableCacheRoots(
+    options.writableCacheRoots ?? [],
+    protectedRoots,
+  );
+}
+
 function transcriptMounts(options: IsolationOptions): string[] {
   return (options.transcriptReadRoots ?? []).flatMap((path) => [
     "--ro-bind",
@@ -126,6 +142,14 @@ function transcriptMounts(options: IsolationOptions): string[] {
   ]);
 }
 
+function candidateArtifactMounts(options: IsolationOptions): string[] {
+  return Object.values(options.candidateArtifactRoots ?? {}).flatMap((path) => [
+    "--ro-bind",
+    path,
+    path,
+  ]);
+}
+
 function hookMounts(options: IsolationOptions): string[] {
   return (options.hookReadRoots ?? []).flatMap((path) => [
     "--ro-bind",

package/src/hosts/mac-sandbox.ts

@@ -1,13 +1,20 @@
 import { randomUUID } from "node:crypto";
+import { containsControl } from "../value-guards";
 import { existsSync } from "node:fs";
 import { mkdir, realpath, rm, writeFile } from "node:fs/promises";
-import { resolve } from "node:path";
-import { requireNativeTranscriptViews } from "../native-transcript-state";
+import { dirname, resolve } from "node:path";
+import {
+  requireNativeTranscriptViews,
+  requireNativeHookRoots,
+} from "../native-transcript-state";
+import { requireCandidateArtifactRoots } from "../candidate-artifacts";
+import { workspaceBoundaryException } from "../fixtures/workspace-state";
+import { requireWritableCacheRoots } from "../runtime/shared-cache";
 import {
   insideRuntimeRoot,
   isRuntimeHomeRoot,
   requireRuntimeReadRoots,
-} from "../runtime-paths";
+} from "../runtime/paths";
 import {
   commandRuntimeRoot,
   HostIsolationError,
@@ -23,61 +30,119 @@ export type { IsolatedCommand } from "./isolation-common";
 const SANDBOX_EXEC = "/usr/bin/sandbox-exec";
 
 function quoted(path: string): string {
-  if (
-    Array.from(path).some(
-      (character) =>
-        character.charCodeAt(0) < 0x20 || character.charCodeAt(0) === 0x7f,
-    )
-  )
+  if (containsControl(path))
     throw new HostIsolationError("sandbox path contains a control character");
   return path.replaceAll("\\", "\\\\").replaceAll('"', '\\"');
 }
 
-/** Deny both observation and mutation of every protected canonical root. */
+/** Protect canonical roots while preserving explicitly granted access. */
 export function macSandboxProfile(
   deniedRoots: string[],
   denyNetwork = false,
   readOnlyRoots: string[] = [],
   writableRuntimeRoot?: string,
   transcriptReadRoots: string[] = [],
+  workspace?: string,
+  localHttp?: boolean,
+  writableCacheRoots?: string[],
 ): string {
   requireProfileRoots(deniedRoots);
   return [
     "(version 1)",
     "(allow default)",
     ...(denyNetwork ? ["(deny network*)"] : []),
+    ...localHttpRules(localHttp),
     ...[...new Set(deniedRoots)]
       .sort()
       .flatMap((path) => [
-        `(deny file-read* ${readFilter(path, readOnlyRoots, writableRuntimeRoot, transcriptReadRoots)})`,
-        `(deny file-write* ${rootFilter(path, ownedException(path, writableRuntimeRoot))})`,
+        `(deny file-read* ${workspaceReadFilter(path, readExceptions(path, readOnlyRoots, writableRuntimeRoot, transcriptReadRoots, workspace, writableCacheRoots), workspace)})`,
+        `(deny file-write* ${rootFilter(path, [...writableExceptions(path, writableRuntimeRoot, writableCacheRoots), ...workspaceBoundaryException(path, workspace)])})`,
       ]),
+    ...deniedRoots.flatMap((path) =>
+      workspaceBoundaryException(path, workspace).map(
+        () => `(deny file-read-data (literal "${quoted(path)}"))`,
+      ),
+    ),
     ...[...readOnlyRoots, ...transcriptReadRoots].map(
       (path) => `(deny file-write* (subpath "${quoted(path)}"))`,
     ),
+    ...deniedRoots.flatMap((root) =>
+      ancestorMetadataRules(
+        root,
+        readExceptions(
+          root,
+          readOnlyRoots,
+          writableRuntimeRoot,
+          transcriptReadRoots,
+          workspace,
+          writableCacheRoots,
+        ),
+      ),
+    ),
     "",
   ].join("\n");
 }
 
+function localHttpRules(enabled: boolean | undefined): string[] {
+  return enabled
+    ? [
+        '(allow network-bind (local ip "*:*"))',
+        '(allow network-inbound (local ip "localhost:*"))',
+        '(allow network-outbound (remote ip "localhost:*"))',
+      ]
+    : [];
+}
+
+function ancestorMetadataRules(root: string, readRoots: string[]): string[] {
+  const ancestors = new Set<string>();
+  for (const readRoot of readRoots) {
+    for (
+      let path = dirname(readRoot);
+      insideRuntimeRoot(root, path);
+      path = dirname(path)
+    ) {
+      ancestors.add(path);
+      if (path === resolve(root)) break;
+    }
+  }
+  return [...ancestors]
+    .sort()
+    .map((path) => `(allow file-read-metadata (literal "${quoted(path)}"))`);
+}
+
 function requireProfileRoots(roots: string[]): void {
   if (!roots.length || roots.some((path) => !path.startsWith("/")))
     throw new HostIsolationError("sandbox roots must be absolute and nonempty");
 }
 
-function readFilter(
+function readExceptions(
   root: string,
   readRoots: string[],
   writableRuntimeRoot: string | undefined,
   transcriptReadRoots: string[],
-): string {
+  workspace?: string,
+  writableCacheRoots: string[] = [],
+): string[] {
   const exceptions = isRuntimeHomeRoot(root)
     ? readRoots.filter((path) => insideRuntimeRoot(root, path))
     : [];
-  return rootFilter(root, [
+  return [
     ...transcriptReadRoots.filter((path) => insideRuntimeRoot(root, path)),
     ...exceptions,
-    ...ownedException(root, writableRuntimeRoot),
-  ]);
+    ...writableExceptions(root, writableRuntimeRoot, writableCacheRoots),
+    ...workspaceBoundaryException(root, workspace),
+  ];
+}
+
+function writableExceptions(
+  root: string,
+  runtime: string | undefined,
+  caches: string[] = [],
+): string[] {
+  return [
+    ...ownedException(root, runtime),
+    ...caches.flatMap((cache) => ownedException(root, cache)),
+  ];
 }
 
 function rootFilter(root: string, exceptions: string[]): string {
@@ -86,6 +151,17 @@ function rootFilter(root: string, exceptions: string[]): string {
   return `(require-all ${base} ${exceptions.map((path) => `(require-not (subpath "${quoted(path)}"))`).join(" ")})`;
 }
 
+function workspaceReadFilter(
+  root: string,
+  exceptions: string[],
+  workspace?: string,
+): string {
+  const filter = rootFilter(root, exceptions);
+  return workspaceBoundaryException(root, workspace).length
+    ? `(require-all ${filter} (require-not (literal "${quoted(root)}")))`
+    : filter;
+}
+
 function ownedException(root: string, ownedRoot: string | undefined): string[] {
   if (ownedRoot && insideRuntimeRoot(root, ownedRoot)) return [ownedRoot];
   return [];
@@ -97,6 +173,8 @@ export async function prepareMacSandboxCommand(
 ): Promise<IsolatedCommand> {
   requireSandboxAvailable();
   await requireNativeTranscriptViews(options.transcriptReadRoots);
+  await requireCandidateArtifactRoots(options.candidateArtifactRoots);
+  await requireNativeHookRoots(options.hookReadRoots, options.privateStateRoot);
   requireIsolationPaths(options);
   const workspace = await realpath(options.workspace);
   const roots = options.protectedRootsCanonical
@@ -109,6 +187,10 @@ export async function prepareMacSandboxCommand(
     options.writableRuntimeRoot,
   );
   const readRoots = options.readOnlyRoots ?? [];
+  const writableCacheRoots = await requireWritableCacheRoots(
+    options.writableCacheRoots ?? [],
+    [...roots, stateRoot],
+  );
   requireRuntimeReadRoots(readRoots, [...roots, stateRoot]);
   requireDisjointState(workspace, roots, stateRoot);
   const profilePath = resolve(stateRoot, `host-${randomUUID()}.sb`);
@@ -119,7 +201,10 @@ export async function prepareMacSandboxCommand(
       options.denyNetwork,
       readRoots,
       ownedRoot,
-      options.transcriptReadRoots,
+      curatedReadRoots(options),
+      workspace,
+      options.localHttp,
+      writableCacheRoots,
     ),
     { flag: "wx", mode: 0o600 },
   );
@@ -131,6 +216,14 @@ export async function prepareMacSandboxCommand(
   };
 }
 
+function curatedReadRoots(options: IsolationOptions): string[] {
+  return [
+    ...(options.transcriptReadRoots ?? []),
+    ...(options.hookReadRoots ?? []),
+    ...Object.values(options.candidateArtifactRoots ?? {}),
+  ];
+}
+
 function requireSandboxAvailable(): void {
   if (process.platform !== "darwin" || !existsSync(SANDBOX_EXEC))
     throw new HostIsolationError("macOS sandbox-exec isolation is unavailable");

package/src/hosts/native-controls.ts

@@ -1,6 +1,11 @@
 import { isRecord, isUnknownArray } from "../value-guards";
-import { summarizeClaudeEvents } from "./claude-events";
+import {
+  summarizeClaudeEvents,
+  parseClaudeEvents,
+  type ClaudeEvents,
+} from "./claude-events";
 import type { codexNativeCallObservation } from "./codex-native-calls";
+import type { ExecCallReceipt } from "./codex-exec-controls";
 
 const MAX_CALLS = 128;
 type Call = { ordinal: number; namespace: string; name: string };
@@ -13,7 +18,14 @@ export interface NativeControlObservation {
     method: "native_control_calls";
     calls: Call[];
     acceptedAgentCount: number | null;
+    directAcceptedAgentCount?: number;
+    coverage?: {
+      nativeCalls: NativeControlObservation["completeness"];
+      execInspection: "complete" | "partial";
+      acceptedAgents: "direct_native_calls";
+    };
     submittedExecCalls: number | null;
+    execCalls?: ExecCallReceipt[];
     truncated: boolean | null;
   };
 }
@@ -30,10 +42,11 @@ function label(value: unknown, max: number): value is string {
 export function codexNativeControls(
   observation: Awaited<ReturnType<typeof codexNativeCallObservation>>,
 ): NativeControlObservation {
-  const complete = observation.completeness === "complete";
+  const complete =
+    observation.completeness === "complete" && inspectedExecCalls(observation);
   return {
     id: "sevro.host.native-controls",
-    completeness: observation.completeness,
+    completeness: controlCompleteness(observation.completeness, complete),
     data: {
       method: "native_control_calls",
       calls: observation.data.toolCalls.map(({ ordinal, namespace, name }) => ({
@@ -44,22 +57,59 @@ export function codexNativeControls(
       acceptedAgentCount: complete
         ? observation.data.acceptedSpawns.length
         : null,
-      submittedExecCalls: complete ? observation.data.submittedExecCalls : null,
-      truncated: complete ? false : null,
+      directAcceptedAgentCount: observation.data.acceptedSpawns.length,
+      coverage: {
+        nativeCalls: observation.completeness,
+        execInspection: inspectedExecCalls(observation)
+          ? "complete"
+          : "partial",
+        acceptedAgents: "direct_native_calls",
+      },
+      ...nativeCounts(observation),
+      ...execEvidence(observation.data.execCalls),
     },
   };
 }
+function nativeCounts(
+  observation: Awaited<ReturnType<typeof codexNativeCallObservation>>,
+) {
+  const complete = observation.completeness === "complete";
+  return {
+    submittedExecCalls: complete ? observation.data.submittedExecCalls : null,
+    truncated: complete ? false : null,
+  };
+}
+function controlCompleteness(
+  source: NativeControlObservation["completeness"],
+  complete: boolean,
+): NativeControlObservation["completeness"] {
+  return source === "complete" && !complete ? "partial" : source;
+}
+function execEvidence(receipts: ExecCallReceipt[] | undefined) {
+  return receipts ? { execCalls: receipts } : {};
+}
 
-const MALFORMED = Symbol("malformed native control event");
-
-function controlEvent(line: string): unknown {
-  try {
-    return JSON.parse(line) as unknown;
-  } catch {
-    return MALFORMED;
-  }
+function inspectedExecCalls(
+  observation: Awaited<ReturnType<typeof codexNativeCallObservation>>,
+): boolean {
+  const receipts = observation.data.execCalls ?? [];
+  const submissions = observation.data.toolCalls.filter(
+    (call) => call.name === "exec",
+  );
+  if (
+    submissions.length !== observation.data.submittedExecCalls ||
+    receipts.length !== submissions.length
+  )
+    return false;
+  return receipts.every(
+    (receipt, index) =>
+      receipt.completeness === "complete" &&
+      receipt.ordinal === submissions[index]?.ordinal,
+  );
 }
 
+const MALFORMED = Symbol("malformed native control event");
+
 function assistantBlocks(event: unknown): unknown[] | null | typeof MALFORMED {
   if (event === MALFORMED) return MALFORMED;
   if (!assistantEvent(event)) return null;
@@ -87,15 +137,14 @@ class ClaudeNativeControls {
   malformed = false;
   truncated = false;
 
-  parse(stream: string): void {
-    for (const line of stream.split("\n")) {
-      if (!line.trim()) continue;
-      if (!this.observeLine(line)) break;
+  parse(stream: ClaudeEvents): void {
+    for (const line of stream.lines) {
+      if (!this.observeEvent(line.parsed ? line.value : MALFORMED)) break;
     }
   }
 
-  private observeLine(line: string): boolean {
-    const blocks = assistantBlocks(controlEvent(line));
+  private observeEvent(event: unknown): boolean {
+    const blocks = assistantBlocks(event);
     if (blocks === null) return true;
     if (blocks === MALFORMED) {
       this.malformed = true;
@@ -133,12 +182,13 @@ class ClaudeNativeControls {
 
 /** Observe all native labels without retaining arguments or interpreting policy. */
 export function claudeNativeControls(
-  stream: string,
+  stream: string | ClaudeEvents,
   exitCode: number,
 ): NativeControlObservation {
-  const summary = summarizeClaudeEvents(stream, exitCode);
+  const events = parseClaudeEvents(stream);
+  const summary = summarizeClaudeEvents(events, exitCode);
   const controls = new ClaudeNativeControls();
-  controls.parse(stream);
+  controls.parse(events);
   return {
     id: "sevro.host.native-controls",
     completeness:

package/src/hosts/native-request.ts

@@ -0,0 +1,55 @@
+import { join } from "node:path";
+import type { HostAdapter } from "../engine";
+import {
+  requireCandidateRuntime,
+  requireCandidateArtifactRoots,
+} from "../candidate-artifacts";
+import { requireNativeTranscriptView } from "../native-transcript-state";
+import { isOptionalNonblankString } from "../value-guards";
+
+export const MAX_HOST_TIMEOUT_MS = 30 * 60_000;
+
+export function validHostTimeout(timeoutMs: number): boolean {
+  return (
+    Number.isSafeInteger(timeoutMs) &&
+    timeoutMs >= 1 &&
+    timeoutMs <= MAX_HOST_TIMEOUT_MS
+  );
+}
+
+/** Common admission checks run before native state or processes are allocated. */
+export async function validateNativeHostRequest(
+  request: Parameters<HostAdapter["run"]>[0],
+  host: "Codex" | "Claude",
+): Promise<void> {
+  requireFollowUp(request.followUpPrompt, host);
+  await requireNativeTranscriptView(request.candidateTranscriptRoot);
+  await requireCandidateRuntime(
+    request.candidateRuntimeRoot,
+    request.runtimeRole,
+  );
+  await requireCandidateArtifactRoots(request.candidateArtifactRoots);
+  requireFixtureBin(request);
+  requirePassiveRequest(request, host);
+}
+
+function requireFollowUp(prompt: string | undefined, host: string): void {
+  if (!isOptionalNonblankString(prompt))
+    throw new Error(`${host} follow-up prompt must be nonempty`);
+}
+
+function requireFixtureBin(request: Parameters<HostAdapter["run"]>[0]): void {
+  if (
+    request.fixtureBinDir !== undefined &&
+    request.fixtureBinDir !== join(request.workspace, ".git", "fixture-bin")
+  )
+    throw new Error("fixture binary path is outside the workspace");
+}
+
+function requirePassiveRequest(
+  request: Parameters<HostAdapter["run"]>[0],
+  host: string,
+): void {
+  if (request.instrumentation?.length || request.condition !== "passive")
+    throw new Error(`${host} enforcement instrumentation is unavailable`);
+}