@guilz-dev/belay 0.8.1 → 0.9.1

package/dist/adapters/shared/gate-runtime.js

@@ -1,4 +1,4 @@
-import { createHash, randomUUID } from 'node:crypto';
+import { randomUUID } from 'node:crypto';
 import { existsSync } from 'node:fs';
 import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import path from 'node:path';
@@ -7,11 +7,14 @@ import { buildReplayHint, buildRetryInstructionForConfig, canAutoReplay, getExec
 import { claimApprovedForReplay, gateApprovalStoreFromDeps, recordApproval, } from '../../core/approval-service.js';
 import { issueApprovalToken } from '../../core/approval-token.js';
 import { buildAuditActionSnapshot, buildAuditReplayContext, } from '../../core/audit-replay-context.js';
+import { approvalCorrelationId, serializeAuditRecordV3 } from '../../core/audit-serialize.js';
+import { boundedUtf8Tail } from '../../core/bounded-output.js';
 import { mutateApprovalStateWithRetry } from '../../core/capability/approval-state-mutation.js';
 import { APPROVAL_STATE_VERSION_V3 } from '../../core/capability/approval-v3.js';
+import { readSignedAttestationFile } from '../../core/capability/boundary-attestation-sign.js';
 import { isEgressProxyActive } from '../../core/capability/boundary-egress.js';
 import { isBoundaryCleanupError, safeBoundaryCleanupResourceId, } from '../../core/capability/boundary-run.js';
-import { resolveBoundaryDriverContext, runBoundaryAgentCommand, } from '../../core/capability/boundary-session.js';
+import { boundaryAttestationPath, resolveBoundaryDriverContext, runBoundaryAgentCommand, } from '../../core/capability/boundary-session.js';
 import { hashCapabilityRequests } from '../../core/capability/capability-request-hash.js';
 import { recordGateApprovalAsk, scheduleGateShadowAudit, } from '../../core/capability/gate-shadow-audit.js';
 import { canConsumeCapabilityGrantLease } from '../../core/capability/grant-consumption.js';
@@ -19,20 +22,24 @@ import { approvalGrantBundleExhausted, consumeApprovedRecordGrantBundle, consume
 import { loadClassifierAuthorization } from '../../core/capability/grant-loader.js';
 import { collectOutsideRepoPaths, collectOutsideRepoPathsFromToolPayload, fsScopeAllowlistPath, isCapabilityBrokerDemotionActive, loadFsScopeAllowlistSync, loadTrustedWorkspaceRootsSync, shouldSkipBrokerApprovedOnce, shouldSkipBrokerApprovedRecord, trustedWorkspaceRootsPath, validateTrustedWorkspaceRootCandidate, } from '../../core/capability/index.js';
 import { resolveLayeredConfig, teamConfigPath } from '../../core/config-layers.js';
+import { ContainedDockerBoundaryUnavailableError, executeContainedDocker, } from '../../core/contained-execution/docker.js';
+import { isContainedUnknownExecutionEligible } from '../../core/contained-execution/eligibility.js';
+import { ContainedExecutionFailureError } from '../../core/contained-execution/failure.js';
+import { withContainedExecutionMirror, } from '../../core/contained-execution/mirror.js';
+import { CONTAINED_EXECUTION_OUTPUT_SCRUB_OPTIONS, isContainedExecutionApprovalFallbackReason, } from '../../core/contained-execution/policy.js';
 import { effectPlanAuditFields, hashEffectPlan } from '../../core/effect-ir/audit.js';
 import { buildCapabilityEffectPlan } from '../../core/effect-ir/build.js';
 import { classifyResultToGateVerdict, unnormalizedGateVerdict, } from '../../core/gate-contract.js';
 import { classifyGatedActionAsync, extractAgentAssessment, GateNormalizationError, gateEnabledForAction, normalizeGatedAction, } from '../../core/gate-engine.js';
-import { approvalCommandMatch, approvedApprovalsFile, belayStateDir, canonicalStringify, classifierOptionsFromConfig, configuredControlPlaneDir, hashValue, pendingApprovalsFile, resolveControlPlaneDir, scrubOptionsFromConfig, scrubValue, toolFingerprint, } from '../../core/index.js';
+import { approvalCommandMatch, approvedApprovalsFile, belayStateDir, canonicalStringify, classifierOptionsFromConfig, configuredControlPlaneDir, hashValue, pendingApprovalsFile, resolveControlPlaneDir, scrubOptionsFromConfig, scrubString, scrubValue, toolFingerprint, } from '../../core/index.js';
 import { extractJudgeFallbackReason, formatJudgeInfrastructureDenyMessage, inferProviderIdFromFallbackReason, isJudgeInfrastructureFailure, } from '../../core/judge-fallback-hints.js';
 import { notifyDeny } from '../../core/notify.js';
 import { canonicalPath } from '../../core/path-utils.js';
 import { recoveryFailClosedResult, recoveryFailReasonFromSkip, } from '../../core/recovery/fail-closed.js';
 import { fingerprintReplayPayload } from '../../core/replay-scrub.js';
-import { loadStandingAllow, resolveStandingAllowMatch, standingAllowFile, } from '../../core/standing-allow.js';
 import { FILE_CHECKPOINT_ISOLATION_UNAVAILABLE, isTransactionalEligible, runTransactionalExecution, TRANSACTIONAL_ALREADY_APPLIED, TRANSACTIONAL_APPROVAL_BYPASS_REASONS, } from '../../core/transactional/index.js';
+import { buildAuditProvenanceFields } from '../../runtime-provenance.js';
 import { egressStatus } from '../../services/egress-service.js';
-import { PACKAGE_VERSION } from '../../version.js';
 import { protectedArtifactRoots } from '../layouts/protected-paths.js';
 const EMPTY_APPROVALS = {
     version: 1,
@@ -41,15 +48,7 @@ const EMPTY_APPROVALS = {
 const RUNTIME_PROVENANCE_KEY = Symbol.for('agent-belay.runtime-provenance');
 function auditProvenance(config) {
     const runtime = globalThis[RUNTIME_PROVENANCE_KEY];
-    const runtimeVersion = typeof runtime?.runtimeVersion === 'string' ? runtime.runtimeVersion : PACKAGE_VERSION;
-    const runtimeBuildStamp = typeof runtime?.runtimeBuildStamp === 'string'
-        ? runtime.runtimeBuildStamp
-        : `${PACKAGE_VERSION}@source`;
-    return {
-        runtimeVersion,
-        runtimeBuildStamp,
-        configFingerprint: hashValue(canonicalStringify(config)),
-    };
+    return buildAuditProvenanceFields(config, runtime);
 }
 function adapterIdFromContext(ctx) {
     if (ctx.config.adapter === 'cursor' ||
@@ -62,6 +61,14 @@ function adapterIdFromContext(ctx) {
     }
     return undefined;
 }
+function extractShellCommandFromPayload(payload) {
+    const toolInput = payload.tool_input;
+    if (!toolInput || typeof toolInput !== 'object') {
+        return '';
+    }
+    const input = toolInput;
+    return typeof input.command === 'string' ? input.command : '';
+}
 const REPLAY_AUDIT_FAILURE_NOTE = ' Audit recording failed; inspect audit storage before the next approval.';
 async function appendReplayAuditSafely(ctx, deps, event) {
     try {
@@ -92,15 +99,15 @@ export function createDefaultGateRuntimeDeps() {
             const provenance = auditProvenance(ctx.config);
             const record = {
                 timestamp: new Date().toISOString(),
+                mode: ctx.config.mode,
                 ...event,
                 ...provenance,
             };
             if (!ctx.config.audit.includeAssessment) {
                 delete record.assessment;
             }
-            const scrubbed = scrubValue(record, scrubOptionsFromConfig(ctx.config));
-            Object.assign(scrubbed, provenance);
-            await writeFile(auditPath, `${JSON.stringify(scrubbed)}\n`, {
+            const serialized = serializeAuditRecordV3(record, scrubOptionsFromConfig(ctx.config));
+            await writeFile(auditPath, `${JSON.stringify(serialized)}\n`, {
                 encoding: 'utf8',
                 flag: 'a',
             });
@@ -135,6 +142,9 @@ export function createDefaultGateRuntimeDeps() {
                 runOptions: { mountReadOnly: false },
             });
         },
+        readSignedAttestation: readSignedAttestationFile,
+        withContainedExecutionMirror,
+        executeContainedDocker,
     };
 }
 export async function resolveGateConfig(ctx, deps) {
@@ -182,6 +192,22 @@ function gateAuditEventName(kind) {
     }
     return 'subagentGate';
 }
+function resolveGateAuditEvent(sourceEvent, kind) {
+    if (!sourceEvent) {
+        return gateAuditEventName(kind);
+    }
+    switch (sourceEvent.toLowerCase()) {
+        case 'beforeshellexecution':
+            return 'beforeShellExecution';
+        case 'pretooluse':
+            return 'preToolUse';
+        case 'subagentstart':
+        case 'subagentgate':
+            return 'subagentGate';
+        default:
+            return gateAuditEventName(kind);
+    }
+}
 async function ensurePendingApproval(ctx, deps, kind, result, approvalInput, scopeHint) {
     const candidate = createApprovalRecordWithEnvelope({
         kind,
@@ -217,17 +243,6 @@ async function ensurePendingApproval(ctx, deps, kind, result, approvalInput, sco
     }
     return outcome;
 }
-function approvalCorrelationId(approvalId) {
-    return createHash('sha256').update(approvalId).digest('hex').slice(0, 16);
-}
-function extractShellCommandFromPayload(payload) {
-    const toolInput = payload.tool_input;
-    if (!toolInput || typeof toolInput !== 'object') {
-        return '';
-    }
-    const input = toolInput;
-    return typeof input.command === 'string' ? input.command : '';
-}
 function deriveWorkspaceRootScopeHint(params) {
     if (params.result.reason !== 'outside_repo_mutation' &&
         params.result.reason !== 'outside_repo_redirect') {
@@ -364,6 +379,200 @@ async function discardApprovedApproval(ctx, deps, approvalId) {
         throw new Error(`Failed to discard rejected approval ${approvalId}`);
     }
 }
+function scrubMediatedOutput(value) {
+    const source = boundedUtf8Tail(value);
+    const scrubbed = boundedUtf8Tail(scrubString(source.value, CONTAINED_EXECUTION_OUTPUT_SCRUB_OPTIONS));
+    return { value: scrubbed.value, truncated: source.truncated || scrubbed.truncated };
+}
+function normalizeContainedFailure(error) {
+    if (error instanceof ContainedExecutionFailureError) {
+        return error;
+    }
+    if (error?.code === 'ENOENT') {
+        return new ContainedExecutionFailureError('contained_execution_capability_invalid', {
+            cause: error,
+        });
+    }
+    return new ContainedExecutionFailureError('contained_execution_boundary_failed', { cause: error });
+}
+function containedAuditBase(kind, mode, result, sourceEvent) {
+    const planFields = effectPlanAuditFields(result.effectPlan);
+    const rawSourceEvent = sourceEvent ?? gateAuditEventName(kind);
+    const auditEvent = resolveGateAuditEvent(rawSourceEvent, kind);
+    return {
+        event: auditEvent,
+        sourceEvent: rawSourceEvent,
+        kind,
+        fingerprint: result.fingerprint,
+        mode,
+        schemaVersion: result.axes ? 2 : 1,
+        effectPlanVersion: planFields.effectPlanVersion,
+        effectIRHash: planFields.effectIRHash,
+        effectPlanSignals: planFields.effectPlanSignals,
+        effectPlanOpacity: planFields.effectPlanOpacity,
+        effectPlanDisposition: planFields.effectPlanDisposition,
+        effectPlanCompleteness: planFields.effectPlanCompleteness,
+        wouldMediate: true,
+    };
+}
+async function mediateContainedUnknownExecution(params) {
+    const { ctx, deps, action, command, sourceEvent } = params;
+    const result = { ...params.result, wouldMediate: true };
+    if (ctx.config.mode === 'audit') {
+        await deps.appendAudit(ctx, {
+            ...containedAuditBase(action.kind, ctx.config.mode, result, sourceEvent),
+            verdict: result.verdict,
+            reason: result.reason,
+            wouldBlock: true,
+            permission: 'allow',
+        });
+        return classifyResultToGateVerdict({
+            result,
+            mode: ctx.config.mode,
+            permission: 'allow',
+            wouldBlock: true,
+        });
+    }
+    const controlPlaneDir = configuredControlPlaneDir(ctx.config);
+    const attestationPath = boundaryAttestationPath(ctx.repoRoot, ctx.config);
+    const protectedRoots = [
+        ...new Set([
+            ...protectedArtifactRoots(ctx.layout, ctx.repoRoot, controlPlaneDir),
+            attestationPath,
+        ]),
+    ];
+    const checkpoint = ctx.config.policy.transactional.fileCheckpoint;
+    const containedConfig = ctx.config.sandbox.containedExecution;
+    if (!containedConfig?.enabled) {
+        return null;
+    }
+    let execution;
+    let mirrorBackend;
+    try {
+        let signedAttestation;
+        try {
+            signedAttestation = await deps.readSignedAttestation(attestationPath);
+        }
+        catch (error) {
+            throw new ContainedExecutionFailureError('contained_execution_capability_invalid', {
+                cause: error,
+            });
+        }
+        execution = await deps.withContainedExecutionMirror({
+            sourceRoot: ctx.repoRoot,
+            controlPlaneRoots: protectedRoots,
+            limits: {
+                maxFiles: checkpoint.maxFiles,
+                maxSourceBytes: checkpoint.maxSourceBytes,
+                maxWorkspaceBytes: checkpoint.maxWorkspaceBytes,
+                prepareTimeoutMs: checkpoint.prepareTimeoutMs,
+            },
+        }, async (mirror) => {
+            mirrorBackend = mirror.backend;
+            return deps.executeContainedDocker({
+                repoRoot: ctx.repoRoot,
+                controlPlaneDir,
+                protectedRoots,
+                config: containedConfig,
+                mirror,
+                guestCwd: action.cwd,
+                command,
+                inputFingerprint: result.fingerprint,
+                signedAttestation,
+            });
+        });
+    }
+    catch (error) {
+        if (error instanceof ContainedDockerBoundaryUnavailableError &&
+            isContainedExecutionApprovalFallbackReason(error.reason)) {
+            return null;
+        }
+        const failure = normalizeContainedFailure(error);
+        const reason = failure.code;
+        const failedResult = {
+            ...result,
+            verdict: 'deny_pending_approval',
+            reason,
+        };
+        await deps.appendAudit(ctx, {
+            ...containedAuditBase(action.kind, ctx.config.mode, failedResult, sourceEvent),
+            verdict: failedResult.verdict,
+            reason,
+            wouldBlock: true,
+            permission: 'deny',
+            ...(mirrorBackend ? { mirrorBackend } : {}),
+        });
+        const sessionHint = failure.remediation === 'session-start' ? ' Run `belay session start`, then retry.' : '';
+        return classifyResultToGateVerdict({
+            result: failedResult,
+            mode: ctx.config.mode,
+            permission: 'deny',
+            wouldBlock: true,
+            user_message: `Belay could not confirm safe contained execution (${reason}).${sessionHint}`,
+            agent_message: `Belay denied the original host command because contained execution failed closed (${reason}).` +
+                sessionHint,
+        });
+    }
+    const stdout = scrubMediatedOutput(execution.stdout);
+    const stderr = scrubMediatedOutput(execution.stderr);
+    const mediatedExecution = {
+        exitCode: execution.exitCode,
+        signal: execution.signal,
+        timedOut: execution.timedOut,
+        stdout: stdout.value,
+        stderr: stderr.value,
+        stdoutTruncated: execution.stdoutTruncated || stdout.truncated,
+        stderrTruncated: execution.stderrTruncated || stderr.truncated,
+        receiptHash: execution.receiptHash,
+        workspaceChangesDiscarded: true,
+    };
+    const reason = execution.exitCode === 0 && !execution.timedOut
+        ? 'contained_execution_complete'
+        : 'contained_execution_failed';
+    const mediatedResult = {
+        ...result,
+        verdict: 'allow',
+        reason,
+        mediatedExecution,
+    };
+    await deps.appendAudit(ctx, {
+        ...containedAuditBase(action.kind, ctx.config.mode, mediatedResult, sourceEvent),
+        verdict: mediatedResult.verdict,
+        reason,
+        wouldBlock: false,
+        permission: 'deny',
+        receiptHash: execution.receiptHash,
+        imageId: execution.receipt.imageId,
+        mirrorBackend,
+        exitCode: execution.exitCode,
+        timedOut: execution.timedOut,
+    });
+    const status = execution.timedOut
+        ? 'timed out'
+        : execution.exitCode === 0
+            ? 'completed successfully'
+            : `failed with exit ${execution.exitCode}`;
+    const output = [
+        mediatedExecution.stdout
+            ? `stdout tail${mediatedExecution.stdoutTruncated ? ' (truncated)' : ''}:\n${mediatedExecution.stdout}`
+            : '',
+        mediatedExecution.stderr
+            ? `stderr tail${mediatedExecution.stderrTruncated ? ' (truncated)' : ''}:\n${mediatedExecution.stderr}`
+            : '',
+    ]
+        .filter(Boolean)
+        .join('\n');
+    return classifyResultToGateVerdict({
+        result: mediatedResult,
+        mode: ctx.config.mode,
+        permission: 'deny',
+        wouldBlock: false,
+        user_message: `Belay contained execution ${status}; the original host command was not run and workspace changes were discarded. Receipt: ${execution.receiptHash}.` +
+            (output ? `\n${output}` : ''),
+        agent_message: `Belay already ran this command once inside the contained boundary (${status}). Do not retry it on the host. Receipt: ${execution.receiptHash}.` +
+            (output ? `\n${output}` : ''),
+    });
+}
 export async function evaluateGatedAction(ctx, deps, params) {
     let action;
     try {
@@ -402,8 +611,10 @@ export async function evaluateGatedAction(ctx, deps, params) {
                 effectFree: false,
             }),
         };
+        const sourceEvent = params.sourceEvent ?? gateAuditEventName(params.kind);
         await deps.appendAudit(ctx, {
-            event: gateAuditEventName(params.kind),
+            event: resolveGateAuditEvent(sourceEvent, params.kind),
+            sourceEvent,
             kind: params.kind,
             fingerprint: verdict.fingerprint,
             verdict: verdict.verdict,
@@ -462,6 +673,21 @@ export async function evaluateGatedAction(ctx, deps, params) {
         egressProxyActive,
     };
     const predicted = await classifyGatedActionAsync(action, ctx.config, enrichedClassifierOptions);
+    if (action.kind === 'shell' &&
+        action.command &&
+        isContainedUnknownExecutionEligible(ctx.config, action, predicted)) {
+        const mediated = await mediateContainedUnknownExecution({
+            ctx,
+            deps,
+            action,
+            command: action.command,
+            result: predicted,
+            sourceEvent: params.sourceEvent,
+        });
+        if (mediated) {
+            return mediated;
+        }
+    }
     let result = predicted;
     let predictedAssessment;
     let observedAssessment;
@@ -552,6 +778,7 @@ export async function evaluateGatedAction(ctx, deps, params) {
     const scrubOpts = scrubOptionsFromConfig(ctx.config);
     const scrubbedPayload = fingerprintReplayPayload(params.kind, params.payload, scrubOpts);
     return gateDecisionToVerdict(ctx, deps, params.kind, result, {
+        sourceEvent: params.sourceEvent,
         predictedAssessment,
         observedAssessment,
         transactionalLayer,
@@ -671,8 +898,11 @@ async function gateDecisionToVerdict(ctx, deps, kind, result, auditExtras = {})
             (kind === 'shell' ? auditExtras.approvalInput?.input : undefined),
         stateDir,
     });
+    const sourceEvent = auditExtras.sourceEvent ?? gateAuditEventName(kind);
+    const auditEvent = resolveGateAuditEvent(sourceEvent, kind);
     const gateBase = {
-        event: gateAuditEventName(kind),
+        event: auditEvent,
+        sourceEvent,
         kind,
         fingerprint: result.fingerprint,
         summary: result.normalizedCommand ?? result.summary ?? '',
@@ -787,35 +1017,6 @@ async function gateDecisionToVerdict(ctx, deps, kind, result, auditExtras = {})
             agent_message: agentMessage,
         });
     }
-    if (kind !== 'shell' &&
-        result.verdict === 'deny_pending_approval' &&
-        ctx.config.mode === 'enforce' &&
-        !TRANSACTIONAL_APPROVAL_BYPASS_REASONS.has(result.reason)) {
-        const standingAllowPath = standingAllowFile(ctx.config, ctx.layout.repoLocalStateDir(ctx.repoRoot));
-        const standingState = await loadStandingAllow(standingAllowPath);
-        const standingMatch = resolveStandingAllowMatch({
-            kind,
-            result,
-            repoRoot: ctx.repoRoot,
-            state: standingState,
-        });
-        if (standingMatch) {
-            await deps.appendAudit(ctx, {
-                ...gateBase,
-                verdict: 'allow',
-                reason: 'standing_allow',
-                standingAllowSource: standingMatch.source,
-                wouldBlock: false,
-                permission: 'allow',
-            });
-            return classifyResultToGateVerdict({
-                result: { ...result, verdict: 'allow', reason: 'standing_allow' },
-                mode: ctx.config.mode,
-                permission: 'allow',
-                wouldBlock: false,
-            });
-        }
-    }
     const brokerActive = isCapabilityBrokerDemotionActive(ctx.config);
     let approved = null;
     if (!TRANSACTIONAL_APPROVAL_BYPASS_REASONS.has(result.reason) &&