@earendil-works/gondolin 0.0.1 → 0.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@earendil-works/gondolin",
-  "version": "0.0.1",
+  "version": "0.1.0",
   "description": "Alpine Linux sandbox for running untrusted code with controlled filesystem and network access",
   "type": "commonjs",
   "main": "./dist/src/index.js",

package/dist/bash.js

@@ -1,82 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const vm_1 = require("./vm");
-const WS_URL = process.env.WS_URL;
-const TOKEN = process.env.ELWING_TOKEN ?? process.env.SANDBOX_WS_TOKEN;
-const MAX_CHUNK = 32 * 1024;
-let shuttingDown = false;
-let exitCode = 1;
-function buildEnv() {
-    const env = [];
-    if (process.env.TERM)
-        env.push(`TERM=${process.env.TERM}`);
-    return env;
-}
-function wireStdin(exec) {
-    if (process.stdin.isTTY) {
-        process.stdin.setRawMode(true);
-    }
-    process.stdin.resume();
-    process.stdin.on("data", (chunk) => {
-        if (shuttingDown)
-            return;
-        for (let offset = 0; offset < chunk.length; offset += MAX_CHUNK) {
-            const slice = chunk.subarray(offset, offset + MAX_CHUNK);
-            void exec.sendStdin(slice);
-        }
-    });
-    process.stdin.on("end", () => {
-        if (shuttingDown)
-            return;
-        void exec.endStdin();
-    });
-}
-function cleanup() {
-    if (process.stdin.isTTY) {
-        process.stdin.setRawMode(false);
-    }
-    process.stdin.pause();
-}
-async function shutdown(vm) {
-    if (shuttingDown)
-        return;
-    shuttingDown = true;
-    cleanup();
-    await vm.stop();
-    process.exit(exitCode);
-}
-async function main() {
-    const vm = new vm_1.VM({ url: WS_URL ?? undefined, token: TOKEN ?? undefined });
-    try {
-        const exec = await vm.execStream(["bash", "-i"], {
-            env: buildEnv(),
-            stdin: true,
-            pty: true,
-            buffer: false,
-        });
-        exec.stdout.on("data", (chunk) => {
-            process.stdout.write(chunk);
-        });
-        exec.stderr.on("data", (chunk) => {
-            process.stderr.write(chunk);
-        });
-        wireStdin(exec);
-        const result = await exec.result;
-        exitCode = result.exitCode ?? 1;
-        if (result.signal !== undefined) {
-            process.stderr.write(`process exited due to signal ${result.signal}\n`);
-        }
-    }
-    catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        process.stderr.write(`${message}\n`);
-        exitCode = 1;
-    }
-    finally {
-        await shutdown(vm);
-    }
-}
-main().catch((err) => {
-    console.error(err.message);
-    process.exit(1);
-});

package/dist/bin/bad-bash.js

@@ -1,111 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.runBadBash = runBadBash;
-const vm_1 = require("../src/vm");
-const WS_URL = process.env.WS_URL;
-const TOKEN = process.env.ELWING_TOKEN ?? process.env.SANDBOX_WS_TOKEN;
-const MAX_CHUNK = 32 * 1024;
-let shuttingDown = false;
-let exitCode = 1;
-function buildEnv() {
-    const env = [];
-    if (process.env.TERM)
-        env.push(`TERM=${process.env.TERM}`);
-    return env;
-}
-function redirectExampleDotCom(input) {
-    const rawUrl = typeof input === "string" || input instanceof URL ? input.toString() : input.url;
-    let parsed;
-    try {
-        parsed = new URL(rawUrl);
-    }
-    catch {
-        return input;
-    }
-    if (parsed.hostname !== "example.com") {
-        return input;
-    }
-    const replacement = new URL("https://icanhazip.com/");
-    if (typeof input === "string" || input instanceof URL) {
-        return replacement.toString();
-    }
-    return new Request(replacement.toString(), input);
-}
-const redirectingFetch = async (input, init) => {
-    const redirectedInput = redirectExampleDotCom(input);
-    return fetch(redirectedInput, init);
-};
-function wireStdin(exec) {
-    if (process.stdin.isTTY) {
-        process.stdin.setRawMode(true);
-    }
-    process.stdin.resume();
-    process.stdin.on("data", (chunk) => {
-        if (shuttingDown)
-            return;
-        for (let offset = 0; offset < chunk.length; offset += MAX_CHUNK) {
-            const slice = chunk.subarray(offset, offset + MAX_CHUNK);
-            void exec.sendStdin(slice);
-        }
-    });
-    process.stdin.on("end", () => {
-        if (shuttingDown)
-            return;
-        void exec.endStdin();
-    });
-}
-function cleanup() {
-    if (process.stdin.isTTY) {
-        process.stdin.setRawMode(false);
-    }
-    process.stdin.pause();
-}
-async function shutdown(vm) {
-    if (shuttingDown)
-        return;
-    shuttingDown = true;
-    cleanup();
-    await vm.stop();
-    process.exit(exitCode);
-}
-async function runBadBash() {
-    const vm = new vm_1.VM({
-        url: WS_URL ?? undefined,
-        token: TOKEN ?? undefined,
-        fetch: redirectingFetch,
-    });
-    try {
-        const exec = await vm.execStream(["bash", "-i"], {
-            env: buildEnv(),
-            stdin: true,
-            pty: true,
-            buffer: false,
-        });
-        exec.stdout.on("data", (chunk) => {
-            process.stdout.write(chunk);
-        });
-        exec.stderr.on("data", (chunk) => {
-            process.stderr.write(chunk);
-        });
-        wireStdin(exec);
-        const result = await exec.result;
-        exitCode = result.exitCode ?? 1;
-        if (result.signal !== undefined) {
-            process.stderr.write(`process exited due to signal ${result.signal}\n`);
-        }
-    }
-    catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        process.stderr.write(`${message}\n`);
-        exitCode = 1;
-    }
-    finally {
-        await shutdown(vm);
-    }
-}
-if (require.main === module) {
-    runBadBash().catch((err) => {
-        console.error(err.message);
-        process.exit(1);
-    });
-}

package/dist/bin/bash.js

@@ -1,85 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.runBash = runBash;
-const vm_1 = require("../src/vm");
-const WS_URL = process.env.WS_URL;
-const TOKEN = process.env.ELWING_TOKEN ?? process.env.SANDBOX_WS_TOKEN;
-const MAX_CHUNK = 32 * 1024;
-let shuttingDown = false;
-let exitCode = 1;
-function buildEnv() {
-    const env = [];
-    if (process.env.TERM)
-        env.push(`TERM=${process.env.TERM}`);
-    return env;
-}
-function wireStdin(exec) {
-    if (process.stdin.isTTY) {
-        process.stdin.setRawMode(true);
-    }
-    process.stdin.resume();
-    process.stdin.on("data", (chunk) => {
-        if (shuttingDown)
-            return;
-        for (let offset = 0; offset < chunk.length; offset += MAX_CHUNK) {
-            const slice = chunk.subarray(offset, offset + MAX_CHUNK);
-            void exec.sendStdin(slice);
-        }
-    });
-    process.stdin.on("end", () => {
-        if (shuttingDown)
-            return;
-        void exec.endStdin();
-    });
-}
-function cleanup() {
-    if (process.stdin.isTTY) {
-        process.stdin.setRawMode(false);
-    }
-    process.stdin.pause();
-}
-async function shutdown(vm) {
-    if (shuttingDown)
-        return;
-    shuttingDown = true;
-    cleanup();
-    await vm.stop();
-    process.exit(exitCode);
-}
-async function runBash() {
-    const vm = new vm_1.VM({ url: WS_URL ?? undefined, token: TOKEN ?? undefined });
-    try {
-        const exec = await vm.execStream(["bash", "-i"], {
-            env: buildEnv(),
-            stdin: true,
-            pty: true,
-            buffer: false,
-        });
-        exec.stdout.on("data", (chunk) => {
-            process.stdout.write(chunk);
-        });
-        exec.stderr.on("data", (chunk) => {
-            process.stderr.write(chunk);
-        });
-        wireStdin(exec);
-        const result = await exec.result;
-        exitCode = result.exitCode ?? 1;
-        if (result.signal !== undefined) {
-            process.stderr.write(`process exited due to signal ${result.signal}\n`);
-        }
-    }
-    catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        process.stderr.write(`${message}\n`);
-        exitCode = 1;
-    }
-    finally {
-        await shutdown(vm);
-    }
-}
-if (require.main === module) {
-    runBash().catch((err) => {
-        console.error(err.message);
-        process.exit(1);
-    });
-}

package/dist/bin/eregion.js

@@ -1,41 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const bash_1 = require("./bash");
-const exec_1 = require("./exec");
-const ws_server_1 = require("./ws-server");
-function usage() {
-    console.log("Usage: eregion <command> [options]");
-    console.log("Commands:");
-    console.log("  exec         Run a command via the virtio socket");
-    console.log("  ws-server    Start the WebSocket bridge server");
-    console.log("  bash         Start an interactive bash session over WS");
-    console.log("  help         Show this help");
-    console.log("\nRun eregion <command> --help for command-specific flags.");
-}
-async function main() {
-    const [command, ...args] = process.argv.slice(2);
-    if (!command || command === "help" || command === "--help" || command === "-h") {
-        usage();
-        process.exit(command ? 0 : 1);
-    }
-    switch (command) {
-        case "exec":
-            (0, exec_1.runExec)(args);
-            return;
-        case "ws-server":
-        case "server":
-            await (0, ws_server_1.runWsServer)(args);
-            return;
-        case "bash":
-            await (0, bash_1.runBash)();
-            return;
-        default:
-            console.error(`Unknown command: ${command}`);
-            usage();
-            process.exit(1);
-    }
-}
-main().catch((err) => {
-    console.error(err.message);
-    process.exit(1);
-});

package/dist/bin/exec.js

@@ -1,212 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.runExec = runExec;
-const net_1 = __importDefault(require("net"));
-const virtio_protocol_1 = require("../src/virtio-protocol");
-function parseArgs(argv) {
-    const args = { commands: [] };
-    let current = null;
-    let nextId = 1;
-    const fail = (message) => {
-        console.error(message);
-        usage();
-        process.exit(1);
-    };
-    const parseId = (value) => {
-        const id = Number(value);
-        if (!Number.isFinite(id))
-            fail("--id must be a number");
-        if (id >= nextId)
-            nextId = id + 1;
-        return id;
-    };
-    const separatorIndex = argv.indexOf("--");
-    if (separatorIndex !== -1) {
-        const optionArgs = argv.slice(0, separatorIndex);
-        const commandArgs = argv.slice(separatorIndex + 1);
-        if (commandArgs.length === 0)
-            fail("missing command after --");
-        current = {
-            cmd: commandArgs[0],
-            argv: commandArgs.slice(1),
-            env: [],
-            id: nextId++,
-        };
-        args.commands.push(current);
-        for (let i = 0; i < optionArgs.length; i += 1) {
-            const arg = optionArgs[i];
-            switch (arg) {
-                case "--sock":
-                    args.sock = optionArgs[++i];
-                    break;
-                case "--env":
-                    current.env.push(optionArgs[++i]);
-                    break;
-                case "--cwd":
-                    current.cwd = optionArgs[++i];
-                    break;
-                case "--id":
-                    current.id = parseId(optionArgs[++i]);
-                    break;
-                case "--help":
-                case "-h":
-                    usage();
-                    process.exit(0);
-                default:
-                    fail(`Unknown argument: ${arg}`);
-            }
-        }
-        return args;
-    }
-    const requireCurrent = (flag) => {
-        if (!current)
-            fail(`${flag} requires --cmd`);
-        return current;
-    };
-    for (let i = 0; i < argv.length; i += 1) {
-        const arg = argv[i];
-        switch (arg) {
-            case "--sock":
-                args.sock = argv[++i];
-                break;
-            case "--cmd":
-                current = { cmd: argv[++i], argv: [], env: [], id: nextId++ };
-                args.commands.push(current);
-                break;
-            case "--arg": {
-                const command = requireCurrent("--arg");
-                command.argv.push(argv[++i]);
-                break;
-            }
-            case "--env": {
-                const command = requireCurrent("--env");
-                command.env.push(argv[++i]);
-                break;
-            }
-            case "--cwd": {
-                const command = requireCurrent("--cwd");
-                command.cwd = argv[++i];
-                break;
-            }
-            case "--id": {
-                const command = requireCurrent("--id");
-                command.id = parseId(argv[++i]);
-                break;
-            }
-            case "--help":
-            case "-h":
-                usage();
-                process.exit(0);
-            default:
-                fail(`Unknown argument: ${arg}`);
-        }
-    }
-    return args;
-}
-function usage() {
-    console.log("Usage:");
-    console.log("  gondolin exec --sock PATH -- CMD [ARGS...]");
-    console.log("  gondolin exec --sock PATH --cmd CMD [--arg ARG] [--env KEY=VALUE] [--cwd PATH] [--cmd CMD ...]");
-    console.log("Use -- to pass a command and its arguments directly.");
-    console.log("Arguments apply to the most recent --cmd.");
-}
-function buildCommandPayload(command) {
-    const payload = {
-        cmd: command.cmd,
-    };
-    if (command.argv.length > 0)
-        payload.argv = command.argv;
-    if (command.env.length > 0)
-        payload.env = command.env;
-    if (command.cwd)
-        payload.cwd = command.cwd;
-    return payload;
-}
-function runExec(argv = process.argv.slice(2)) {
-    const args = parseArgs(argv);
-    if (!args.sock || args.commands.length === 0) {
-        usage();
-        process.exit(1);
-    }
-    const socket = net_1.default.createConnection({ path: args.sock });
-    const reader = new virtio_protocol_1.FrameReader();
-    let currentIndex = 0;
-    let inflightId = null;
-    let exitCode = 0;
-    let closing = false;
-    const sendNext = () => {
-        const command = args.commands[currentIndex];
-        inflightId = command.id;
-        const payload = buildCommandPayload(command);
-        const message = (0, virtio_protocol_1.buildExecRequest)(command.id, payload);
-        socket.write((0, virtio_protocol_1.encodeFrame)(message));
-    };
-    const finish = (code) => {
-        if (code !== undefined && exitCode === 0)
-            exitCode = code;
-        if (closing)
-            return;
-        closing = true;
-        socket.end();
-    };
-    socket.on("connect", () => {
-        console.log(`connected to ${args.sock}`);
-        sendNext();
-    });
-    socket.on("data", (chunk) => {
-        reader.push(chunk, (frame) => {
-            const message = (0, virtio_protocol_1.decodeMessage)(frame);
-            if (message.t === "exec_output") {
-                const data = message.p.data;
-                if (message.p.stream === "stdout") {
-                    process.stdout.write(data);
-                }
-                else {
-                    process.stderr.write(data);
-                }
-            }
-            else if (message.t === "exec_response") {
-                if (inflightId !== null && message.id !== inflightId) {
-                    console.error(`unexpected response id ${message.id} (expected ${inflightId})`);
-                    finish(1);
-                    return;
-                }
-                const code = message.p.exit_code ?? 1;
-                const signal = message.p.signal;
-                if (signal !== undefined) {
-                    console.error(`process exited due to signal ${signal}`);
-                }
-                if (code !== 0 && exitCode === 0)
-                    exitCode = code;
-                currentIndex += 1;
-                if (currentIndex < args.commands.length) {
-                    sendNext();
-                }
-                else {
-                    finish();
-                }
-            }
-            else if (message.t === "error") {
-                console.error(`error ${message.p.code}: ${message.p.message}`);
-                finish(1);
-            }
-        });
-    });
-    socket.on("error", (err) => {
-        console.error(`socket error: ${err.message}`);
-        finish(1);
-    });
-    socket.on("end", () => {
-        if (!closing && exitCode === 0)
-            exitCode = 1;
-    });
-    socket.on("close", () => {
-        process.exit(exitCode);
-    });
-}
-if (require.main === module) {
-    runExec();
-}

package/dist/bin/ws-server.js

@@ -1,147 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.runWsServer = runWsServer;
-const sandbox_ws_server_1 = require("../src/sandbox-ws-server");
-function parseArgs(argv) {
-    const args = {};
-    const fail = (message) => {
-        console.error(message);
-        usage();
-        process.exit(1);
-    };
-    for (let i = 0; i < argv.length; i += 1) {
-        const arg = argv[i];
-        if (arg === "--") {
-            continue;
-        }
-        switch (arg) {
-            case "--host":
-                args.host = argv[++i] ?? args.host;
-                break;
-            case "--port":
-                args.port = Number(argv[++i]);
-                if (!Number.isFinite(args.port))
-                    fail("--port must be a number");
-                break;
-            case "--qemu":
-                args.qemuPath = argv[++i];
-                break;
-            case "--kernel":
-                args.kernelPath = argv[++i];
-                break;
-            case "--initrd":
-                args.initrdPath = argv[++i];
-                break;
-            case "--memory":
-                args.memory = argv[++i];
-                break;
-            case "--cpus":
-                args.cpus = Number(argv[++i]);
-                if (!Number.isFinite(args.cpus))
-                    fail("--cpus must be a number");
-                break;
-            case "--virtio-sock":
-                args.virtioSocketPath = argv[++i];
-                break;
-            case "--net-sock":
-                args.netSocketPath = argv[++i];
-                break;
-            case "--virtio-fs-sock":
-                args.virtioFsSocketPath = argv[++i];
-                break;
-            case "--net-mac":
-                args.netMac = argv[++i];
-                break;
-            case "--no-net":
-                args.netEnabled = false;
-                break;
-            case "--net-debug":
-                args.netDebug = true;
-                break;
-            case "--machine":
-                args.machineType = argv[++i];
-                break;
-            case "--accel":
-                args.accel = argv[++i];
-                break;
-            case "--cpu":
-                args.cpu = argv[++i];
-                break;
-            case "--console":
-                args.console = argv[++i] === "none" ? "none" : "stdio";
-                break;
-            case "--token":
-                args.token = argv[++i];
-                break;
-            case "--no-restart":
-                args.autoRestart = false;
-                break;
-            case "--help":
-            case "-h":
-                usage();
-                process.exit(0);
-            default:
-                fail(`Unknown argument: ${arg}`);
-        }
-    }
-    return args;
-}
-function usage() {
-    const defaults = (0, sandbox_ws_server_1.resolveSandboxWsServerOptions)();
-    console.log("Usage: gondolin ws-server [options]");
-    console.log("Options:");
-    console.log(`  --host HOST          Host to bind (default ${defaults.host})`);
-    console.log(`  --port PORT          Port to bind (default ${defaults.port})`);
-    console.log(`  --qemu PATH          QEMU binary (default ${defaults.qemuPath})`);
-    console.log("  --kernel PATH        Kernel path");
-    console.log("  --initrd PATH        Initrd path");
-    console.log(`  --memory SIZE        Memory size (default ${defaults.memory})`);
-    console.log(`  --cpus N             vCPU count (default ${defaults.cpus})`);
-    console.log("  --virtio-sock PATH   Virtio serial socket path");
-    console.log("  --virtio-fs-sock PATH Virtio filesystem socket path");
-    console.log("  --net-sock PATH      QEMU net socket path");
-    console.log("  --net-mac MAC        MAC address for virtio-net");
-    console.log("  --no-net             Disable QEMU net backend");
-    console.log("  --net-debug          Enable net backend debug logging");
-    console.log("                       (or set GONDOLIN_DEBUG=net)");
-    console.log("  --machine TYPE       Override QEMU machine type");
-    console.log("  --accel TYPE         Override QEMU accel (kvm/hvf/tcg)");
-    console.log("  --cpu TYPE           Override QEMU CPU type");
-    console.log("  --console stdio|none Console output");
-    console.log("  --token TOKEN        Require token in Authorization header");
-    console.log("  --no-restart          Disable auto restart on exit");
-}
-function formatLog(message) {
-    if (message.endsWith("\n"))
-        return message;
-    return `${message}\n`;
-}
-async function runWsServer(argv = process.argv.slice(2)) {
-    const args = parseArgs(argv);
-    const server = new sandbox_ws_server_1.SandboxWsServer(args);
-    server.on("log", (message) => {
-        process.stdout.write(formatLog(message));
-    });
-    server.on("error", (err) => {
-        const message = err instanceof Error ? err.message : String(err);
-        process.stdout.write(formatLog(message));
-    });
-    const address = await server.start();
-    console.log(`WebSocket server listening on ${address.url}`);
-    const shutdown = async () => {
-        await server.stop();
-        process.exit(0);
-    };
-    process.on("SIGINT", () => {
-        void shutdown();
-    });
-    process.on("SIGTERM", () => {
-        void shutdown();
-    });
-}
-if (require.main === module) {
-    runWsServer().catch((err) => {
-        console.error(err.message);
-        process.exit(1);
-    });
-}