@gjermundgaraba/clankerbox-rivet-sandbox-agent 0.19.0 → 0.20.0

package/dist/index.d.mts

@@ -22,13 +22,19 @@ interface Options {
   readonly namePrefix?: string | undefined;
   /** The machine's own login user by default. */
   readonly sshUser?: string | undefined;
+  /**
+   * The path of a public-key file, such as your `id_ed25519.pub`, whose keys the host installs for
+   * the login user after a profile's setup, as the client config's `authorizedKeys` does: the key
+   * the tunnel's ssh logs in with. A profile with a setup needs it.
+   */
+  readonly authorizedKeys?: string | undefined;
   /**
    * Such as `["-i", "/path/to/key"]`. Neither these nor ssh config may fork the forward (`-f`,
    * `-N`, `ForkAfterAuthentication`, `SessionType none`) or give it to a connection master (`-M`,
    * `-S`): the tunnel ends with its ssh, and those would outlive it.
    */
   readonly sshArguments?: ReadonlyArray<string> | undefined;
-  /** `/home/sandbox` by default, as the recipes make it. */
+  /** `/home/user` by default, the login user's home, where the Ubuntu recipe runs the server. */
   readonly cwd?: string | undefined;
 }
 /**

package/dist/index.mjs

@@ -198,7 +198,7 @@ const make = (options, ssh = "ssh") => {
 			machine: from.machine,
 			name: named
 		});
-		const { spec, host } = yield* specRequest("create", yield* loadProfile(from.profile), {});
+		const { spec, host } = yield* specRequest("create", yield* loadProfile(from.profile), { authorizedKeys: options.authorizedKeys });
 		const { machine } = yield* Prebuild.create(client, named, spec, {
 			host,
 			fresh: options.fresh
@@ -244,7 +244,7 @@ const provider = (options, layer, ssh) => {
 	const sandboxes = make(options, ssh);
 	return {
 		name,
-		defaultCwd: options.cwd ?? "/home/sandbox",
+		defaultCwd: options.cwd ?? "/home/user",
 		create: () => runtime.runPromise(sandboxes.create),
 		destroy: (id) => runtime.runPromise(sandboxes.destroy(id)),
 		pause: (id) => runtime.runPromise(sandboxes.pause(id)),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gjermundgaraba/clankerbox-rivet-sandbox-agent",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "description": "clankerbox machines as sandboxes for Rivet's Sandbox Agent",
   "license": "MIT",
   "repository": {
@@ -25,7 +25,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@gjermundgaraba/clankerbox-sdk": "0.19.0"
+    "@gjermundgaraba/clankerbox-sdk": "0.20.0"
   },
   "devDependencies": {
     "@effect/platform-node": "4.0.5",

package/recipes/macos/setup.sh

@@ -1,13 +1,13 @@
 #!/bin/sh
 # A clankerbox setup that makes a macOS machine (Tart, a Cirrus base) a sandbox for Rivet's
-# Sandbox Agent: your key for `admin`, the Sandbox Agent's server and Claude Code under `admin`,
-# a LaunchDaemon that runs the server on the guest's loopback, port 2468, and an
-# /etc/clankerbox/start that keeps it running. Give the provider `cwd: "/Users/admin"`.
+# Sandbox Agent: the Sandbox Agent's server and Claude Code under `admin`, the login user, for
+# whom the host then installs your keys, a LaunchDaemon that runs the server on the guest's
+# loopback, port 2468, and an /etc/clankerbox/start that keeps it running. Give the provider
+# `cwd: "/Users/admin"`.
 #
-# Copy this directory, put the public keys that may log in into `authorized_keys` beside this
-# file, and name the copy as a profile's `setup.path`. An optional `agent.env` beside it, of
-# `NAME=value` lines such as `ANTHROPIC_API_KEY=…`, becomes the server's environment, which is
-# where the agents it launches find their credentials.
+# Name this directory, or a copy, as a profile's `setup.path`. An optional `agent.env` beside
+# it, of `NAME=value` lines such as `ANTHROPIC_API_KEY=…`, becomes the server's environment,
+# which is where the agents it launches find their credentials.
 set -eu
 PATH=/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin
 
@@ -18,19 +18,11 @@ agent_sha256=58417cf5fa1e2dc417fc4a92d11840cc245ad599b87dd4c9a41686b05c36d877
 node_version=22.23.3
 node_sha256=23b25245dcfb9af7262f8ff142e9e2e0af025368117329e7a7458a51e5922f53
 
-if [ ! -s authorized_keys ]; then
-  echo "this recipe needs an authorized_keys file beside setup.sh, holding your public key"
-  exit 1
-fi
-
 # Softnet blocks the gateway's DNS, so public resolvers come first.
 networksetup -listallnetworkservices | tail -n +2 | sed 's/^\*//' | while IFS= read -r service; do
   networksetup -setdnsservers "$service" 1.1.1.1 9.9.9.9
 done
 
-install -d -m 700 -o admin -g staff /Users/admin/.ssh
-install -m 600 -o admin -g staff authorized_keys /Users/admin/.ssh/authorized_keys
-
 # Downloads $1 to $3 and refuses it unless its sha256 is $2.
 fetch() {
   curl -fsSL "$1" -o "$3"

package/recipes/ubuntu/setup.sh

@@ -1,12 +1,13 @@
 #!/bin/sh
 # A clankerbox setup that makes an x86_64 Ubuntu machine a sandbox for Rivet's Sandbox Agent:
-# sshd with your key, the Sandbox Agent's server and Claude Code under a `sandbox` user, and an
-# /etc/clankerbox/start that keeps the server running on the guest's loopback, port 2468.
+# the login user `user` with passwordless sudo, for whom the host then installs your keys, sshd
+# with root's login off where this recipe installs it, the Sandbox Agent's server and Claude Code
+# under `user`, and an /etc/clankerbox/start that keeps the server running on the guest's
+# loopback, port 2468.
 #
-# Copy this directory, put the public keys that may log in into `authorized_keys` beside this
-# file, and name the copy as a profile's `setup.path`. An optional `agent.env` beside it, of
-# `NAME=value` lines such as `ANTHROPIC_API_KEY=…`, becomes the server's environment, which is
-# where the agents it launches find their credentials.
+# Name this directory, or a copy, as a profile's `setup.path`. An optional `agent.env` beside
+# it, of `NAME=value` lines such as `ANTHROPIC_API_KEY=…`, becomes the server's environment,
+# which is where the agents it launches find their credentials.
 set -eu
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 export DEBIAN_FRONTEND=noninteractive
@@ -19,17 +20,27 @@ agent_sha256=5ebefccb130cccb0aa7972eacc8ff7c55550b959b2dd682a232a21a5712d955e
 node_version=22.23.3
 node_sha256=df450af89261115ef9f9e3830c3eeb2cc9213b63c720b1af623cb5dcbe2e02de
 
-if [ ! -s authorized_keys ]; then
-  echo "this recipe needs an authorized_keys file beside setup.sh, holding your public key"
-  exit 1
-fi
+# A base with its own sshd, such as boat's, keeps it as it is.
+if [ -x /usr/sbin/sshd ]; then own_sshd=false; else own_sshd=true; fi
 
 apt-get update -qq
 apt-get install -y -qq --no-install-recommends \
-  openssh-server curl ca-certificates xz-utils procps >/dev/null
+  openssh-server sudo curl ca-certificates xz-utils procps >/dev/null
 
-install -d -m 700 /root/.ssh
-install -m 600 authorized_keys /root/.ssh/authorized_keys
+if [ "$own_sshd" = true ]; then
+  install -d /etc/ssh/sshd_config.d
+  echo "PermitRootLogin no" >/etc/ssh/sshd_config.d/10-clankerbox.conf
+fi
+
+# The login user, which boat's bases already have.
+if ! id user >/dev/null 2>&1; then
+  useradd -m -s /bin/bash user
+fi
+
+echo "user ALL=(ALL) NOPASSWD: ALL" >/var/tmp/sudoers-user
+visudo -cf /var/tmp/sudoers-user >/dev/null
+install -m 440 /var/tmp/sudoers-user /etc/sudoers.d/user
+rm /var/tmp/sudoers-user
 
 # Downloads $1 to $3 and refuses it unless its sha256 is $2.
 fetch() {
@@ -47,18 +58,16 @@ fetch "https://nodejs.org/dist/v$node_version/node-v$node_version-linux-x64.tar.
 tar -xJf /var/tmp/node.tar.xz -C /usr/local --strip-components=1 --no-same-owner
 rm /var/tmp/node.tar.xz
 
-# The agents run as their own user: as root, Claude Code offers no bypass-permissions mode.
-useradd -m -s /bin/bash sandbox
-
+# The agents run as `user`: as root, Claude Code offers no bypass-permissions mode.
 if [ -s agent.env ]; then
-  install -m 600 -o sandbox -g sandbox agent.env /etc/sandbox-agent.env
+  install -m 600 -o user -g "$(id -gn user)" agent.env /etc/sandbox-agent.env
 fi
 
 # Claude Code at its latest release, and its adapter at the version the server pins. Other
 # agents install the same way; `install-agent codex` hangs in its own check at this version, so
 # give it a timeout too, and end what it leaves running. Claude's install takes about 30 s; 300 s
 # leaves room for a slow mirror.
-timeout 300 su - sandbox -c 'sandbox-agent install-agent claude' >/var/tmp/install-agent.log 2>&1 || {
+timeout 300 su - user -c 'sandbox-agent install-agent claude' >/var/tmp/install-agent.log 2>&1 || {
   tail -n 15 /var/tmp/install-agent.log
   exit 1
 }
@@ -94,17 +103,17 @@ answers_within() {
 }
 
 running() {
-  pgrep -u sandbox -f 'sandbox-agent server' >/dev/null
+  pgrep -u user -f 'sandbox-agent server' >/dev/null
 }
 
 # A running server gets 10 s to answer, since this runs at every start, a running machine's too,
 # before it is ended as hung: TERM, then KILL after 5 s, as a hung one may ignore TERM.
 if running && ! answers_within 10; then
-  pkill -u sandbox -f 'sandbox-agent server' || true
+  pkill -u user -f 'sandbox-agent server' || true
   for tries in $(seq 40); do
     running || break
     if [ "$tries" -eq 20 ]; then
-      pkill -KILL -u sandbox -f 'sandbox-agent server' || true
+      pkill -KILL -u user -f 'sandbox-agent server' || true
     fi
     sleep 0.25
   done
@@ -112,7 +121,7 @@ fi
 
 # The server listens on loopback alone, with no token: guest port 22 is the only way to it.
 if ! running; then
-  su - sandbox -c '
+  su - user -c '
     if [ -r /etc/sandbox-agent.env ]; then set -a; . /etc/sandbox-agent.env; set +a; fi
     setsid -f sandbox-agent server --no-token --no-telemetry >/dev/null 2>&1
   '