@bjoernrochel/sevro 0.1.0-rc.8 → 1.1.0

package/src/hosts/isolation-common.ts

@@ -1,7 +1,9 @@
 import { realpath } from "node:fs/promises";
-import { isAbsolute, relative, sep } from "node:path";
-import { insideRuntimeRoot } from "../runtime-paths";
-import { workspaceBoundaryException } from "../workspace-state";
+import { isAbsolute } from "node:path";
+import { insideRoot as inside } from "../paths";
+export { insideRoot as inside } from "../paths";
+import { insideRuntimeRoot } from "../runtime/paths";
+import { workspaceBoundaryException } from "../fixtures/workspace-state";
 import type { CandidateArtifactRoots } from "../candidate-artifacts";
 
 export class HostIsolationError extends Error {
@@ -18,11 +20,13 @@ export interface IsolationOptions {
   protectedRootsCanonical?: boolean;
   privateStateRoot: string;
   denyNetwork?: boolean;
+  localHttp?: boolean;
   readOnlyRoots?: string[];
   transcriptReadRoots?: string[];
   candidateArtifactRoots?: CandidateArtifactRoots;
   hookReadRoots?: string[];
   writableRuntimeRoot?: string;
+  writableCacheRoots?: string[];
 }
 
 export interface IsolatedCommand {
@@ -30,14 +34,6 @@ export interface IsolatedCommand {
   release(): Promise<void>;
 }
 
-export function inside(root: string, path: string): boolean {
-  const child = relative(root, path);
-  return (
-    child === "" ||
-    (child !== ".." && !child.startsWith(`..${sep}`) && !child.startsWith(sep))
-  );
-}
-
 export async function commandRuntimeRoot(
   stateRoot: string,
   path: string | undefined,
@@ -64,6 +60,7 @@ function absoluteIsolationPaths(options: IsolationOptions): boolean {
   return (
     isAbsolute(options.workspace) &&
     isAbsolute(options.privateStateRoot) &&
+    (options.writableCacheRoots ?? []).every(isAbsolute) &&
     options.protectedRoots.every(isAbsolute)
   );
 }

package/src/hosts/isolation-roots.ts

@@ -1,10 +1,11 @@
-import { isMissingFile } from "../fixture-tools";
+import { runnerRoot } from "../runner-paths";
+import { isMissingFile } from "../fixtures/tools";
 import { realpath } from "node:fs/promises";
 import { homedir, userInfo } from "node:os";
-import { isAbsolute, resolve } from "node:path";
+import { isAbsolute } from "node:path";
 import { protectedWorktrees } from "./protected-worktrees";
 import { nativeStateParent } from "../native-transcript-state";
-import { workspaceStateParent } from "../workspace-state";
+import { workspaceStateParent } from "../fixtures/workspace-state";
 
 /** Include source, results, host configuration, and every active peer fixture. */
 interface ProtectedRootsOptions {
@@ -23,7 +24,7 @@ async function protectedRootCandidates(options: ProtectedRootsOptions) {
   const candidates = [
     await nativeStateParent(),
     await workspaceStateParent(),
-    resolve(import.meta.dir, "../.."),
+    runnerRoot,
     options.projectRoot,
     options.resultsRoot,
     homedir(),

package/src/hosts/linux-sandbox.ts

@@ -6,7 +6,8 @@ import {
   requireNativeTranscriptViews,
   requireNativeHookRoots,
 } from "../native-transcript-state";
-import { requireRuntimeReadRoots } from "../runtime-paths";
+import { requireRuntimeReadRoots } from "../runtime/paths";
+import { requireWritableCacheRoots } from "../runtime/shared-cache";
 import { requireCandidateArtifactRoots } from "../candidate-artifacts";
 import {
   commandRuntimeRoot,
@@ -54,7 +55,7 @@ export async function prepareLinuxSandboxCommand(
   requireLinuxSandbox();
   await requireNativeTranscriptViews(options.transcriptReadRoots);
   await requireCandidateArtifactRoots(options.candidateArtifactRoots);
-  await requireNativeHookRoots(options.hookReadRoots);
+  await requireNativeHookRoots(options.hookReadRoots, options.privateStateRoot);
   requireIsolationPaths(options);
   const workspace = await realpath(options.workspace);
   const roots = options.protectedRootsCanonical
@@ -67,6 +68,10 @@ export async function prepareLinuxSandboxCommand(
     options.writableRuntimeRoot,
   );
   const readRoots = options.readOnlyRoots ?? [];
+  const writableCacheRoots = await cacheMountRoots(options, [
+    ...roots,
+    stateRoot,
+  ]);
   requireRuntimeReadRoots(readRoots, [...roots, stateRoot]);
   requireDisjointState(workspace, roots, stateRoot);
   const blockedFile = resolve(stateRoot, `blocked-${randomUUID()}`);
@@ -106,6 +111,7 @@ export async function prepareLinuxSandboxCommand(
         ...candidateArtifactMounts(options),
         ...hookMounts(options),
         ...(ownedRoot ? ["--bind", ownedRoot, ownedRoot] : []),
+        ...writableCacheRoots.flatMap((path) => ["--bind", path, path]),
         "--chdir",
         workspace,
         "--",
@@ -121,6 +127,13 @@ export async function prepareLinuxSandboxCommand(
   }
 }
 
+function cacheMountRoots(options: IsolationOptions, protectedRoots: string[]) {
+  return requireWritableCacheRoots(
+    options.writableCacheRoots ?? [],
+    protectedRoots,
+  );
+}
+
 function transcriptMounts(options: IsolationOptions): string[] {
   return (options.transcriptReadRoots ?? []).flatMap((path) => [
     "--ro-bind",

package/src/hosts/mac-sandbox.ts

@@ -1,15 +1,20 @@
 import { randomUUID } from "node:crypto";
+import { containsControl } from "../value-guards";
 import { existsSync } from "node:fs";
 import { mkdir, realpath, rm, writeFile } from "node:fs/promises";
-import { resolve } from "node:path";
-import { requireNativeTranscriptViews } from "../native-transcript-state";
+import { dirname, resolve } from "node:path";
+import {
+  requireNativeTranscriptViews,
+  requireNativeHookRoots,
+} from "../native-transcript-state";
 import { requireCandidateArtifactRoots } from "../candidate-artifacts";
-import { workspaceBoundaryException } from "../workspace-state";
+import { workspaceBoundaryException } from "../fixtures/workspace-state";
+import { requireWritableCacheRoots } from "../runtime/shared-cache";
 import {
   insideRuntimeRoot,
   isRuntimeHomeRoot,
   requireRuntimeReadRoots,
-} from "../runtime-paths";
+} from "../runtime/paths";
 import {
   commandRuntimeRoot,
   HostIsolationError,
@@ -25,17 +30,12 @@ export type { IsolatedCommand } from "./isolation-common";
 const SANDBOX_EXEC = "/usr/bin/sandbox-exec";
 
 function quoted(path: string): string {
-  if (
-    Array.from(path).some(
-      (character) =>
-        character.charCodeAt(0) < 0x20 || character.charCodeAt(0) === 0x7f,
-    )
-  )
+  if (containsControl(path))
     throw new HostIsolationError("sandbox path contains a control character");
   return path.replaceAll("\\", "\\\\").replaceAll('"', '\\"');
 }
 
-/** Deny both observation and mutation of every protected canonical root. */
+/** Protect canonical roots while preserving explicitly granted access. */
 export function macSandboxProfile(
   deniedRoots: string[],
   denyNetwork = false,
@@ -43,17 +43,20 @@ export function macSandboxProfile(
   writableRuntimeRoot?: string,
   transcriptReadRoots: string[] = [],
   workspace?: string,
+  localHttp?: boolean,
+  writableCacheRoots?: string[],
 ): string {
   requireProfileRoots(deniedRoots);
   return [
     "(version 1)",
     "(allow default)",
     ...(denyNetwork ? ["(deny network*)"] : []),
+    ...localHttpRules(localHttp),
     ...[...new Set(deniedRoots)]
       .sort()
       .flatMap((path) => [
-        `(deny file-read* ${workspaceReadFilter(path, [...readExceptions(path, readOnlyRoots, writableRuntimeRoot, transcriptReadRoots), ...workspaceBoundaryException(path, workspace)], workspace)})`,
-        `(deny file-write* ${rootFilter(path, [...ownedException(path, writableRuntimeRoot), ...workspaceBoundaryException(path, workspace)])})`,
+        `(deny file-read* ${workspaceReadFilter(path, readExceptions(path, readOnlyRoots, writableRuntimeRoot, transcriptReadRoots, workspace, writableCacheRoots), workspace)})`,
+        `(deny file-write* ${rootFilter(path, [...writableExceptions(path, writableRuntimeRoot, writableCacheRoots), ...workspaceBoundaryException(path, workspace)])})`,
       ]),
     ...deniedRoots.flatMap((path) =>
       workspaceBoundaryException(path, workspace).map(
@@ -63,10 +66,50 @@ export function macSandboxProfile(
     ...[...readOnlyRoots, ...transcriptReadRoots].map(
       (path) => `(deny file-write* (subpath "${quoted(path)}"))`,
     ),
+    ...deniedRoots.flatMap((root) =>
+      ancestorMetadataRules(
+        root,
+        readExceptions(
+          root,
+          readOnlyRoots,
+          writableRuntimeRoot,
+          transcriptReadRoots,
+          workspace,
+          writableCacheRoots,
+        ),
+      ),
+    ),
     "",
   ].join("\n");
 }
 
+function localHttpRules(enabled: boolean | undefined): string[] {
+  return enabled
+    ? [
+        '(allow network-bind (local ip "*:*"))',
+        '(allow network-inbound (local ip "localhost:*"))',
+        '(allow network-outbound (remote ip "localhost:*"))',
+      ]
+    : [];
+}
+
+function ancestorMetadataRules(root: string, readRoots: string[]): string[] {
+  const ancestors = new Set<string>();
+  for (const readRoot of readRoots) {
+    for (
+      let path = dirname(readRoot);
+      insideRuntimeRoot(root, path);
+      path = dirname(path)
+    ) {
+      ancestors.add(path);
+      if (path === resolve(root)) break;
+    }
+  }
+  return [...ancestors]
+    .sort()
+    .map((path) => `(allow file-read-metadata (literal "${quoted(path)}"))`);
+}
+
 function requireProfileRoots(roots: string[]): void {
   if (!roots.length || roots.some((path) => !path.startsWith("/")))
     throw new HostIsolationError("sandbox roots must be absolute and nonempty");
@@ -77,6 +120,8 @@ function readExceptions(
   readRoots: string[],
   writableRuntimeRoot: string | undefined,
   transcriptReadRoots: string[],
+  workspace?: string,
+  writableCacheRoots: string[] = [],
 ): string[] {
   const exceptions = isRuntimeHomeRoot(root)
     ? readRoots.filter((path) => insideRuntimeRoot(root, path))
@@ -84,7 +129,19 @@ function readExceptions(
   return [
     ...transcriptReadRoots.filter((path) => insideRuntimeRoot(root, path)),
     ...exceptions,
-    ...ownedException(root, writableRuntimeRoot),
+    ...writableExceptions(root, writableRuntimeRoot, writableCacheRoots),
+    ...workspaceBoundaryException(root, workspace),
+  ];
+}
+
+function writableExceptions(
+  root: string,
+  runtime: string | undefined,
+  caches: string[] = [],
+): string[] {
+  return [
+    ...ownedException(root, runtime),
+    ...caches.flatMap((cache) => ownedException(root, cache)),
   ];
 }
 
@@ -117,6 +174,7 @@ export async function prepareMacSandboxCommand(
   requireSandboxAvailable();
   await requireNativeTranscriptViews(options.transcriptReadRoots);
   await requireCandidateArtifactRoots(options.candidateArtifactRoots);
+  await requireNativeHookRoots(options.hookReadRoots, options.privateStateRoot);
   requireIsolationPaths(options);
   const workspace = await realpath(options.workspace);
   const roots = options.protectedRootsCanonical
@@ -129,6 +187,10 @@ export async function prepareMacSandboxCommand(
     options.writableRuntimeRoot,
   );
   const readRoots = options.readOnlyRoots ?? [];
+  const writableCacheRoots = await requireWritableCacheRoots(
+    options.writableCacheRoots ?? [],
+    [...roots, stateRoot],
+  );
   requireRuntimeReadRoots(readRoots, [...roots, stateRoot]);
   requireDisjointState(workspace, roots, stateRoot);
   const profilePath = resolve(stateRoot, `host-${randomUUID()}.sb`);
@@ -139,11 +201,10 @@ export async function prepareMacSandboxCommand(
       options.denyNetwork,
       readRoots,
       ownedRoot,
-      [
-        ...(options.transcriptReadRoots ?? []),
-        ...Object.values(options.candidateArtifactRoots ?? {}),
-      ],
+      curatedReadRoots(options),
       workspace,
+      options.localHttp,
+      writableCacheRoots,
     ),
     { flag: "wx", mode: 0o600 },
   );
@@ -155,6 +216,14 @@ export async function prepareMacSandboxCommand(
   };
 }
 
+function curatedReadRoots(options: IsolationOptions): string[] {
+  return [
+    ...(options.transcriptReadRoots ?? []),
+    ...(options.hookReadRoots ?? []),
+    ...Object.values(options.candidateArtifactRoots ?? {}),
+  ];
+}
+
 function requireSandboxAvailable(): void {
   if (process.platform !== "darwin" || !existsSync(SANDBOX_EXEC))
     throw new HostIsolationError("macOS sandbox-exec isolation is unavailable");

package/src/hosts/native-controls.ts

@@ -1,6 +1,11 @@
 import { isRecord, isUnknownArray } from "../value-guards";
-import { summarizeClaudeEvents } from "./claude-events";
+import {
+  summarizeClaudeEvents,
+  parseClaudeEvents,
+  type ClaudeEvents,
+} from "./claude-events";
 import type { codexNativeCallObservation } from "./codex-native-calls";
+import type { ExecCallReceipt } from "./codex-exec-controls";
 
 const MAX_CALLS = 128;
 type Call = { ordinal: number; namespace: string; name: string };
@@ -13,7 +18,14 @@ export interface NativeControlObservation {
     method: "native_control_calls";
     calls: Call[];
     acceptedAgentCount: number | null;
+    directAcceptedAgentCount?: number;
+    coverage?: {
+      nativeCalls: NativeControlObservation["completeness"];
+      execInspection: "complete" | "partial";
+      acceptedAgents: "direct_native_calls";
+    };
     submittedExecCalls: number | null;
+    execCalls?: ExecCallReceipt[];
     truncated: boolean | null;
   };
 }
@@ -30,10 +42,11 @@ function label(value: unknown, max: number): value is string {
 export function codexNativeControls(
   observation: Awaited<ReturnType<typeof codexNativeCallObservation>>,
 ): NativeControlObservation {
-  const complete = observation.completeness === "complete";
+  const complete =
+    observation.completeness === "complete" && inspectedExecCalls(observation);
   return {
     id: "sevro.host.native-controls",
-    completeness: observation.completeness,
+    completeness: controlCompleteness(observation.completeness, complete),
     data: {
       method: "native_control_calls",
       calls: observation.data.toolCalls.map(({ ordinal, namespace, name }) => ({
@@ -44,22 +57,59 @@ export function codexNativeControls(
       acceptedAgentCount: complete
         ? observation.data.acceptedSpawns.length
         : null,
-      submittedExecCalls: complete ? observation.data.submittedExecCalls : null,
-      truncated: complete ? false : null,
+      directAcceptedAgentCount: observation.data.acceptedSpawns.length,
+      coverage: {
+        nativeCalls: observation.completeness,
+        execInspection: inspectedExecCalls(observation)
+          ? "complete"
+          : "partial",
+        acceptedAgents: "direct_native_calls",
+      },
+      ...nativeCounts(observation),
+      ...execEvidence(observation.data.execCalls),
     },
   };
 }
+function nativeCounts(
+  observation: Awaited<ReturnType<typeof codexNativeCallObservation>>,
+) {
+  const complete = observation.completeness === "complete";
+  return {
+    submittedExecCalls: complete ? observation.data.submittedExecCalls : null,
+    truncated: complete ? false : null,
+  };
+}
+function controlCompleteness(
+  source: NativeControlObservation["completeness"],
+  complete: boolean,
+): NativeControlObservation["completeness"] {
+  return source === "complete" && !complete ? "partial" : source;
+}
+function execEvidence(receipts: ExecCallReceipt[] | undefined) {
+  return receipts ? { execCalls: receipts } : {};
+}
 
-const MALFORMED = Symbol("malformed native control event");
-
-function controlEvent(line: string): unknown {
-  try {
-    return JSON.parse(line) as unknown;
-  } catch {
-    return MALFORMED;
-  }
+function inspectedExecCalls(
+  observation: Awaited<ReturnType<typeof codexNativeCallObservation>>,
+): boolean {
+  const receipts = observation.data.execCalls ?? [];
+  const submissions = observation.data.toolCalls.filter(
+    (call) => call.name === "exec",
+  );
+  if (
+    submissions.length !== observation.data.submittedExecCalls ||
+    receipts.length !== submissions.length
+  )
+    return false;
+  return receipts.every(
+    (receipt, index) =>
+      receipt.completeness === "complete" &&
+      receipt.ordinal === submissions[index]?.ordinal,
+  );
 }
 
+const MALFORMED = Symbol("malformed native control event");
+
 function assistantBlocks(event: unknown): unknown[] | null | typeof MALFORMED {
   if (event === MALFORMED) return MALFORMED;
   if (!assistantEvent(event)) return null;
@@ -87,15 +137,14 @@ class ClaudeNativeControls {
   malformed = false;
   truncated = false;
 
-  parse(stream: string): void {
-    for (const line of stream.split("\n")) {
-      if (!line.trim()) continue;
-      if (!this.observeLine(line)) break;
+  parse(stream: ClaudeEvents): void {
+    for (const line of stream.lines) {
+      if (!this.observeEvent(line.parsed ? line.value : MALFORMED)) break;
     }
   }
 
-  private observeLine(line: string): boolean {
-    const blocks = assistantBlocks(controlEvent(line));
+  private observeEvent(event: unknown): boolean {
+    const blocks = assistantBlocks(event);
     if (blocks === null) return true;
     if (blocks === MALFORMED) {
       this.malformed = true;
@@ -133,12 +182,13 @@ class ClaudeNativeControls {
 
 /** Observe all native labels without retaining arguments or interpreting policy. */
 export function claudeNativeControls(
-  stream: string,
+  stream: string | ClaudeEvents,
   exitCode: number,
 ): NativeControlObservation {
-  const summary = summarizeClaudeEvents(stream, exitCode);
+  const events = parseClaudeEvents(stream);
+  const summary = summarizeClaudeEvents(events, exitCode);
   const controls = new ClaudeNativeControls();
-  controls.parse(stream);
+  controls.parse(events);
   return {
     id: "sevro.host.native-controls",
     completeness:

package/src/hosts/native-request.ts

@@ -0,0 +1,55 @@
+import { join } from "node:path";
+import type { HostAdapter } from "../engine";
+import {
+  requireCandidateRuntime,
+  requireCandidateArtifactRoots,
+} from "../candidate-artifacts";
+import { requireNativeTranscriptView } from "../native-transcript-state";
+import { isOptionalNonblankString } from "../value-guards";
+
+export const MAX_HOST_TIMEOUT_MS = 30 * 60_000;
+
+export function validHostTimeout(timeoutMs: number): boolean {
+  return (
+    Number.isSafeInteger(timeoutMs) &&
+    timeoutMs >= 1 &&
+    timeoutMs <= MAX_HOST_TIMEOUT_MS
+  );
+}
+
+/** Common admission checks run before native state or processes are allocated. */
+export async function validateNativeHostRequest(
+  request: Parameters<HostAdapter["run"]>[0],
+  host: "Codex" | "Claude",
+): Promise<void> {
+  requireFollowUp(request.followUpPrompt, host);
+  await requireNativeTranscriptView(request.candidateTranscriptRoot);
+  await requireCandidateRuntime(
+    request.candidateRuntimeRoot,
+    request.runtimeRole,
+  );
+  await requireCandidateArtifactRoots(request.candidateArtifactRoots);
+  requireFixtureBin(request);
+  requirePassiveRequest(request, host);
+}
+
+function requireFollowUp(prompt: string | undefined, host: string): void {
+  if (!isOptionalNonblankString(prompt))
+    throw new Error(`${host} follow-up prompt must be nonempty`);
+}
+
+function requireFixtureBin(request: Parameters<HostAdapter["run"]>[0]): void {
+  if (
+    request.fixtureBinDir !== undefined &&
+    request.fixtureBinDir !== join(request.workspace, ".git", "fixture-bin")
+  )
+    throw new Error("fixture binary path is outside the workspace");
+}
+
+function requirePassiveRequest(
+  request: Parameters<HostAdapter["run"]>[0],
+  host: string,
+): void {
+  if (request.instrumentation?.length || request.condition !== "passive")
+    throw new Error(`${host} enforcement instrumentation is unavailable`);
+}