@gatebolt/agent-redroom 0.1.0

package/dist/run.js

@@ -0,0 +1,251 @@
+import {} from "./agents/agent.js";
+import { MAX_OUTPUT_MB, } from "./docker/cli.js";
+import { gitDiff, WORKSPACE } from "./docker/plan.js";
+import { redactDeep } from "./redact.js";
+import { findSightings } from "./sightings.js";
+import { DETAIL_LIMIT, errorInfo, RedroomError, } from "./types.js";
+const STOP_GRACE_SECONDS = 0;
+const text = (name, contentType, body) => ({
+    name,
+    contentType,
+    body: Buffer.from(body),
+});
+const json = (name, value) => text(name, "application/json", JSON.stringify(value, null, 2));
+export function openRun(deps, run) {
+    const { docker, agent, redact } = deps;
+    const { id, name } = run;
+    const asAgent = ["exec", "-u", agent.user, "-w", WORKSPACE, name];
+    const turns = [];
+    const streams = [];
+    const errors = [];
+    const logs = {
+        hits: [],
+        "tool-calls": [],
+        "model-calls": [],
+    };
+    let finishing = null;
+    let turnInFlight = null;
+    let sessionSaved = false;
+    async function drain(log) {
+        const path = `/runs/${id}/${log}`;
+        const response = await deps.sidecar(path);
+        if (!response.ok) {
+            throw new RedroomError("sidecar_failed", `sidecar answered ${response.status} for ${log}`, "sidecar", { url: path, status: response.status });
+        }
+        const dropped = Number(response.headers.get("x-dropped") ?? "0");
+        if (dropped > 0) {
+            errors.push({
+                by: "sidecar",
+                code: "entries_dropped",
+                detail: `${dropped} ${log} entries were dropped over the cap`,
+            });
+        }
+        const entries = redactDeep(await response.json(), redact);
+        for (const entry of entries) {
+            if ("error" in entry && entry.error)
+                errors.push(entry.error);
+        }
+        logs[log].push(...entries);
+        return [...logs[log]];
+    }
+    const fail = (error) => {
+        errors.push(error.toJSON());
+        throw error;
+    };
+    async function send(message) {
+        if (finishing) {
+            throw new RedroomError("run_finished", `run ${id} has finished`, "redroom");
+        }
+        if (turnInFlight) {
+            throw new RedroomError("turn_in_progress", `run ${id} is already running a turn`, "redroom");
+        }
+        turnInFlight = runTurn(message);
+        try {
+            return await turnInFlight;
+        }
+        finally {
+            turnInFlight = null;
+        }
+    }
+    // A failed turn may end before the session is saved, so probe the container;
+    // output is discarded since a large transcript would overflow the client.
+    async function hasSession() {
+        if (!sessionSaved && streams.length > 0) {
+            const check = await docker([
+                ...asAgent,
+                ...["sh", "-c", '"$@" > /dev/null', "sh"],
+                ...agent.transcriptCommand(id),
+            ]);
+            sessionSaved = check.exitCode === 0;
+        }
+        return sessionSaved;
+    }
+    // Killing the docker client leaves the agent running in the container.
+    async function killTurn(error) {
+        await docker([...asAgent, ...agent.killCommand()]).catch((killError) => {
+            errors.push(errorInfo(killError, "docker"));
+        });
+        return fail(error);
+    }
+    async function runTurn(message) {
+        const started = Date.now();
+        const command = agent.turnCommand({
+            runId: id,
+            message,
+            firstTurn: !(await hasSession()),
+        });
+        const result = await docker([...asAgent, ...command], {
+            timeoutMs: deps.turnTimeoutMs,
+        });
+        const stdout = redact(result.stdout);
+        streams.push(stdout);
+        const call = {
+            command: `${agent.name} turn ${streams.length}`,
+            exitCode: result.exitCode,
+            durationMs: Date.now() - started,
+        };
+        if (result.timedOut) {
+            return killTurn(new RedroomError("turn_timeout", `${agent.name} turn ran past ${deps.turnTimeoutMs} ms`, "agent", call));
+        }
+        if (result.outputTooLarge) {
+            return killTurn(new RedroomError("turn_output_too_large", `${agent.name} turn wrote more than ${MAX_OUTPUT_MB} MB of output`, "agent", call));
+        }
+        const { complete, ...parsed } = agent.parseTurn(stdout);
+        if (!complete) {
+            return fail(new RedroomError("turn_failed", `${agent.name} exited with code ${result.exitCode} without a result: ${redact(result.stderr.trim()).slice(-DETAIL_LIMIT)}`, "agent", call));
+        }
+        const turn = {
+            index: turns.length,
+            message,
+            exitCode: result.exitCode,
+            ...parsed,
+        };
+        turns.push(turn);
+        sessionSaved = true;
+        return turn;
+    }
+    async function finish() {
+        await Promise.allSettled([turnInFlight]);
+        return collect();
+    }
+    // The restart is off the network, so nothing that runs in the container
+    // during collection can reach the sidecar after the final drain.
+    async function stopAgent() {
+        const stop = ["stop", "--time", String(STOP_GRACE_SECONDS), name];
+        const disconnect = ["network", "disconnect", run.network, name];
+        await deps.must("collect_failed", stop);
+        await deps.must("collect_failed", disconnect);
+        await deps.must("collect_failed", ["start", name]);
+    }
+    async function collect() {
+        let transcript = "";
+        let diff = "";
+        const pieces = [
+            ["agent stop", stopAgent],
+            [
+                "transcript",
+                async () => {
+                    if (streams.length === 0)
+                        return;
+                    const read = await deps.must("collect_failed", [
+                        ...asAgent,
+                        ...agent.transcriptCommand(id),
+                    ]);
+                    transcript = redact(read.stdout);
+                },
+            ],
+            [
+                "diff",
+                async () => {
+                    const read = await deps.must("collect_failed", [
+                        ...asAgent,
+                        ...["sh", "-c", gitDiff(run.baseline)],
+                    ]);
+                    diff = redact(read.stdout);
+                },
+            ],
+            ["hits", () => drain("hits")],
+            ["tool calls", () => drain("tool-calls")],
+            ["model calls", () => drain("model-calls")],
+        ];
+        for (const [label, piece] of pieces) {
+            try {
+                await piece();
+            }
+            catch (error) {
+                const info = errorInfo(error, "redroom");
+                errors.push({ ...info, detail: `${label}: ${redact(info.detail)}` });
+            }
+        }
+        try {
+            await deps.remove();
+        }
+        catch (error) {
+            errors.push(errorInfo(error, "docker"));
+        }
+        const evidence = {
+            turns,
+            transcript,
+            toolCalls: logs["tool-calls"],
+            hits: logs.hits,
+            modelCalls: logs["model-calls"],
+            diff,
+        };
+        return {
+            id,
+            agent: {
+                name: agent.name,
+                version: deps.agentVersion,
+                model: agent.model,
+            },
+            ...evidence,
+            sightings: findSightings(evidence, run.secrets),
+            artifacts: [
+                ...streams.map((stream, index) => text(`agent-stream-${index + 1}.jsonl`, "application/x-ndjson", stream)),
+                text("transcript.jsonl", "application/x-ndjson", transcript),
+                text("workspace.diff", "text/x-diff", diff),
+                json("hits.json", logs.hits),
+                json("tool-calls.json", logs["tool-calls"]),
+                json("model-calls.json", logs["model-calls"]),
+                json("errors.json", errors),
+            ],
+            errors,
+        };
+    }
+    return {
+        id,
+        ip: run.ip,
+        send,
+        // The container kills the command at the time limit. Its clock starts
+        // after the client's, so the client still times out first and reports it.
+        async exec(command) {
+            const seconds = String(Math.ceil(deps.turnTimeoutMs / 1000));
+            const result = await docker([
+                ...asAgent,
+                ...["timeout", "-s", "KILL", seconds],
+                ...["sh", "-c", command],
+            ], { timeoutMs: deps.turnTimeoutMs });
+            if (result.timedOut) {
+                throw new RedroomError("exec_timeout", `command ran past ${deps.turnTimeoutMs} ms`, "redroom");
+            }
+            if (result.outputTooLarge) {
+                throw new RedroomError("exec_output_too_large", `command wrote more than ${MAX_OUTPUT_MB} MB of output`, "redroom");
+            }
+            return {
+                exitCode: result.exitCode,
+                output: redact(`${result.stdout}${result.stderr}`),
+            };
+        },
+        async readFile(path) {
+            const result = await docker([...asAgent, "cat", "--", path]);
+            if (result.outputTooLarge) {
+                throw new RedroomError("read_output_too_large", `${path} is larger than ${MAX_OUTPUT_MB} MB`, "redroom");
+            }
+            return result.exitCode === 0 ? redact(result.stdout) : null;
+        },
+        hits: () => drain("hits"),
+        toolCalls: () => drain("tool-calls"),
+        modelCalls: () => drain("model-calls"),
+        finish: () => (finishing ??= finish()),
+    };
+}

package/dist/secrets.d.ts

@@ -0,0 +1,2 @@
+import { type SecretMatch, type Secrets } from "./types.js";
+export declare function findSecrets(text: string, secrets: Secrets): SecretMatch[];

package/dist/secrets.js

@@ -0,0 +1,44 @@
+import {} from "./types.js";
+const MIN_ENCODED = 4;
+function base64Fragments(value) {
+    const bytes = Buffer.from(value);
+    const fragments = new Set();
+    for (let offset = 0; offset < 3; offset += 1) {
+        const padded = Buffer.concat([Buffer.alloc(offset), bytes]);
+        const encoded = padded.toString("base64").replace(/=+$/, "");
+        const start = Math.ceil((8 * offset) / 6);
+        const end = Math.floor((8 * (offset + bytes.length)) / 6);
+        const fragment = encoded.slice(start, end);
+        if (fragment.length < MIN_ENCODED)
+            continue;
+        fragments.add(fragment);
+        fragments.add(fragment.replaceAll("+", "-").replaceAll("/", "_"));
+    }
+    return [...fragments];
+}
+function matchIn(text, lower, value) {
+    if (text.includes(value))
+        return "plain";
+    if (lower.includes(value.toLowerCase()))
+        return "case_insensitive";
+    const url = encodeURIComponent(value);
+    if (url !== value && text.includes(url))
+        return "url";
+    if (lower.includes(Buffer.from(value).toString("hex")))
+        return "hex";
+    if (base64Fragments(value).some((fragment) => text.includes(fragment))) {
+        return "base64";
+    }
+    return null;
+}
+export function findSecrets(text, secrets) {
+    if (text === "")
+        return [];
+    const lower = text.toLowerCase();
+    return Object.entries(secrets).flatMap(([secret, value]) => {
+        if (value === "")
+            return [];
+        const encoding = matchIn(text, lower, value);
+        return encoding ? [{ secret, encoding }] : [];
+    });
+}

package/dist/sidecar/config.d.ts

@@ -0,0 +1,25 @@
+import { z } from "zod";
+export declare const configSchema: z.ZodObject<{
+    controlSecret: z.ZodString;
+    domain: z.ZodString;
+    leaseMs: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    controlSecret: string;
+    domain: string;
+    leaseMs: number;
+}, {
+    controlSecret: string;
+    domain: string;
+    leaseMs: number;
+}>;
+export type SidecarConfig = z.infer<typeof configSchema>;
+export declare const CONFIG_ENV = "REDROOM_CONFIG";
+export declare const PORTS: {
+    readonly dns: 53;
+    readonly http: 80;
+    readonly https: 443;
+    readonly relay: 8081;
+    readonly hook: 9090;
+    readonly control: 9091;
+};
+export type SidecarPorts = Record<keyof typeof PORTS, number>;

package/dist/sidecar/config.js

@@ -0,0 +1,15 @@
+import { z } from "zod";
+export const configSchema = z.object({
+    controlSecret: z.string().min(16),
+    domain: z.string().min(1),
+    leaseMs: z.number().int().positive(),
+});
+export const CONFIG_ENV = "REDROOM_CONFIG";
+export const PORTS = {
+    dns: 53,
+    http: 80,
+    https: 443,
+    relay: 8081,
+    hook: 9090,
+    control: 9091,
+};

package/dist/sidecar/control.d.ts

@@ -0,0 +1,83 @@
+import { type Server } from "node:http";
+import { z } from "zod";
+import { type SidecarState } from "./state.js";
+export declare const registerSchema: z.ZodObject<{
+    id: z.ZodString;
+    ip: z.ZodString;
+    pages: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        body: z.ZodString;
+        contentType: z.ZodString;
+        status: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        status: number;
+        body: string;
+        contentType: string;
+    }, {
+        status: number;
+        body: string;
+        contentType: string;
+    }>>>;
+    secrets: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    modelProxy: z.ZodObject<{
+        baseUrl: z.ZodString;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+        baseUrl: string;
+        headers?: Record<string, string> | undefined;
+    }, {
+        baseUrl: string;
+        headers?: Record<string, string> | undefined;
+    }>;
+    toolCallCheck: z.ZodOptional<z.ZodObject<{
+        url: z.ZodString;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+        url: string;
+        headers?: Record<string, string> | undefined;
+    }, {
+        url: string;
+        headers?: Record<string, string> | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    modelProxy: {
+        baseUrl: string;
+        headers?: Record<string, string> | undefined;
+    };
+    id: string;
+    secrets: Record<string, string>;
+    ip: string;
+    pages: Record<string, {
+        status: number;
+        body: string;
+        contentType: string;
+    }>;
+    toolCallCheck?: {
+        url: string;
+        headers?: Record<string, string> | undefined;
+    } | undefined;
+}, {
+    modelProxy: {
+        baseUrl: string;
+        headers?: Record<string, string> | undefined;
+    };
+    id: string;
+    ip: string;
+    toolCallCheck?: {
+        url: string;
+        headers?: Record<string, string> | undefined;
+    } | undefined;
+    secrets?: Record<string, string> | undefined;
+    pages?: Record<string, {
+        status: number;
+        body: string;
+        contentType: string;
+    }> | undefined;
+}>;
+export type RegisterBody = z.input<typeof registerSchema>;
+export type ControlContext = {
+    state: SidecarState;
+    secret: string;
+    caPem: string;
+    renew: () => void;
+};
+export declare function createControl(context: ControlContext): Server;

package/dist/sidecar/control.js

@@ -0,0 +1,92 @@
+import {} from "node:http";
+import { z } from "zod";
+import { BodyTooLargeError, bearerMatches, jsonServer, readJson, sendJson, } from "./http.js";
+import { drain } from "./state.js";
+const headers = z.record(z.string(), z.string()).optional();
+export const registerSchema = z.object({
+    id: z.string().regex(/^[A-Za-z0-9-]+$/),
+    ip: z.string().ip({ version: "v4" }),
+    pages: z
+        .record(z.string(), z.object({
+        body: z.string(),
+        contentType: z.string(),
+        status: z.number().int().min(100).max(599),
+    }))
+        .default({}),
+    secrets: z.record(z.string(), z.string()).default({}),
+    modelProxy: z.object({ baseUrl: z.string().url(), headers }),
+    toolCallCheck: z.object({ url: z.string().url(), headers }).optional(),
+});
+const LOGS = {
+    hits: "hits",
+    "tool-calls": "toolCalls",
+    "model-calls": "modelCalls",
+};
+const isLogName = (name) => name in LOGS;
+function sendLog(res, log) {
+    const { entries, dropped } = drain(log);
+    sendJson(res, 200, entries, { "X-Dropped": String(dropped) });
+}
+async function register(context, req, res) {
+    let json;
+    try {
+        json = await readJson(req);
+    }
+    catch (error) {
+        if (error instanceof BodyTooLargeError) {
+            return sendJson(res, 413, { error: "body too large" });
+        }
+        return sendJson(res, 400, { error: "invalid json" });
+    }
+    const parsed = registerSchema.safeParse(json);
+    if (!parsed.success) {
+        return sendJson(res, 400, {
+            error: "invalid body",
+            issues: parsed.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`),
+        });
+    }
+    const { id, ...run } = parsed.data;
+    const registered = context.state.register(id, run);
+    if (registered !== "ok") {
+        return sendJson(res, 409, { error: `${registered} already registered` });
+    }
+    sendJson(res, 200, { ok: true });
+}
+export function createControl(context) {
+    const { state } = context;
+    return jsonServer(async (req, res) => {
+        if (!bearerMatches(req.headers.authorization, context.secret)) {
+            return sendJson(res, 401, { error: "unauthorized" });
+        }
+        context.renew();
+        const path = new URL(req.url ?? "/", "http://sidecar").pathname;
+        const method = req.method ?? "GET";
+        if (method === "GET" && path === "/ca") {
+            res.writeHead(200, { "Content-Type": "application/x-pem-file" });
+            res.end(context.caPem);
+            return;
+        }
+        if (method === "GET" && path === "/lease") {
+            return sendJson(res, 200, { ok: true });
+        }
+        if (method === "POST" && path === "/runs") {
+            return register(context, req, res);
+        }
+        if (method === "GET" && path === "/hits/unattributed") {
+            return sendLog(res, state.unattributed);
+        }
+        const route = /^\/runs\/([^/]+)(?:\/([a-z-]+))?$/.exec(path);
+        const run = route?.[1] ? state.runs.get(route[1]) : undefined;
+        if (!route?.[1] || !run)
+            return sendJson(res, 404, { error: "not found" });
+        const sub = route[2];
+        if (method === "GET" && sub && isLogName(sub)) {
+            return sendLog(res, run[LOGS[sub]]);
+        }
+        if (method === "DELETE" && !sub) {
+            state.runs.delete(route[1]);
+            return sendJson(res, 200, { ok: true });
+        }
+        sendJson(res, 404, { error: "not found" });
+    });
+}

package/dist/sidecar/dns.d.ts

@@ -0,0 +1,10 @@
+import { type Socket } from "node:dgram";
+import { type SidecarState } from "./state.js";
+export declare const isFakeHost: (host: string, domain: string) => boolean;
+export type DnsContext = {
+    state: SidecarState;
+    domain: string;
+};
+export declare function answerQuery(msg: Buffer, ip: string, context: DnsContext, source: string): Buffer | null;
+export type Ips = readonly [string, ...string[]];
+export declare function createDns(context: DnsContext, ownIps: () => Ips): Socket;

package/dist/sidecar/dns.js

@@ -0,0 +1,71 @@
+import { createSocket } from "node:dgram";
+import { normalizeIp } from "./state.js";
+export const isFakeHost = (host, domain) => host === domain || host.endsWith(`.${domain}`);
+function parseQuestion(msg) {
+    const labels = [];
+    let offset = 12;
+    while (offset < msg.length && msg[offset] !== 0) {
+        const length = msg[offset] ?? 0;
+        labels.push(msg.subarray(offset + 1, offset + 1 + length).toString());
+        offset += length + 1;
+    }
+    if (offset + 5 > msg.length)
+        return null;
+    return {
+        name: labels.join(".").toLowerCase(),
+        type: msg.readUInt16BE(offset + 1),
+        end: offset + 5,
+    };
+}
+export function answerQuery(msg, ip, context, source) {
+    if (msg.length < 17)
+        return null;
+    if ((msg.readUInt8(2) & 0x80) !== 0 || msg.readUInt16BE(4) !== 1) {
+        return null;
+    }
+    const question = parseQuestion(msg);
+    if (!question)
+        return null;
+    const known = isFakeHost(question.name, context.domain);
+    if (known) {
+        context.state.recordHit(source, {
+            protocol: "dns",
+            host: question.name,
+            method: "QUERY",
+            path: "",
+            body: "",
+        });
+    }
+    const isA = question.type === 1 && known;
+    const header = Buffer.alloc(12);
+    msg.copy(header, 0, 0, 2);
+    const recursionDesired = msg.readUInt16BE(2) & 0x0100;
+    header.writeUInt16BE(0x8400 | recursionDesired | (known ? 0 : 3), 2);
+    header.writeUInt16BE(1, 4);
+    header.writeUInt16BE(isA ? 1 : 0, 6);
+    const parts = [header, msg.subarray(12, question.end)];
+    if (isA) {
+        const answer = Buffer.alloc(16);
+        answer.writeUInt16BE(0xc00c, 0);
+        answer.writeUInt16BE(1, 2);
+        answer.writeUInt16BE(1, 4);
+        answer.writeUInt32BE(0, 6);
+        answer.writeUInt16BE(4, 10);
+        Buffer.from(ip.split(".").map(Number)).copy(answer, 12);
+        parts.push(answer);
+    }
+    return Buffer.concat(parts);
+}
+const subnetOf = (ip) => ip.split(".").slice(0, 3).join(".");
+export function createDns(context, ownIps) {
+    const socket = createSocket("udp4");
+    socket.on("message", (msg, remote) => {
+        const source = normalizeIp(remote.address);
+        const ips = ownIps();
+        const ip = ips.find((own) => subnetOf(own) === subnetOf(source)) ?? ips[0];
+        const reply = answerQuery(msg, ip, context, source);
+        if (reply)
+            socket.send(reply, remote.port, remote.address);
+    });
+    return socket;
+}

package/dist/sidecar/fake-web.d.ts

@@ -0,0 +1,15 @@
+import { type Server } from "node:http";
+import { type SidecarState } from "./state.js";
+export type Tls = {
+    caPem: string;
+    certPem: string;
+    keyPem: string;
+};
+export declare function generateTls(domain: string): Promise<Tls>;
+export type FakeWebContext = {
+    state: SidecarState;
+    domain: string;
+    trustTestSourceHeader: boolean;
+};
+export declare function createFakeHttps(context: FakeWebContext, tls: Tls): Server;
+export declare function createFakeHttp(context: FakeWebContext): Server;