@kafca/agentdock 0.1.61 → 0.1.62

package/dist-electron/services/local-ai-core/src/automation/scripts/sandbox-runner.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist-electron/services/local-ai-core/src/automation/scripts/script-package.js

@@ -0,0 +1,475 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stageImmutableScriptPackage = stageImmutableScriptPackage;
+exports.verifyStagedScriptPackage = verifyStagedScriptPackage;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+function stageImmutableScriptPackage(input) {
+    const scriptId = validatePathToken(input.scriptId, 'Automation script id');
+    const sourceDir = (0, node_path_1.resolve)(input.sourceDir);
+    const sourceStat = (0, node_fs_1.lstatSync)(sourceDir);
+    if (sourceStat.isSymbolicLink() || !sourceStat.isDirectory()) {
+        throw new Error('Automation script package source must be a real directory.');
+    }
+    const entries = collectPackageEntries(sourceDir);
+    const manifestEntry = entries.find((entry) => entry.path === 'manifest.json');
+    if (!manifestEntry)
+        throw new Error('Automation script package manifest.json is required.');
+    const manifest = parseManifest(manifestEntry.content);
+    const entrypoint = normalizeRelativePosixPath(manifest.entrypoint, 'Automation script entrypoint');
+    const entry = entries.find((candidate) => candidate.path === entrypoint);
+    if (!entry)
+        throw new Error(`Automation script entrypoint not found: ${entrypoint}`);
+    const shebang = validateTextEntrypoint(entry.content);
+    manifest.entrypoint = entrypoint;
+    const packageSha256 = hashEntries(entries);
+    const root = (0, node_path_1.join)((0, node_path_1.resolve)(input.userDataPath), 'automations', 'scripts', scriptId);
+    const packagePath = (0, node_path_1.join)(root, packageSha256);
+    if ((0, node_fs_1.existsSync)(packagePath)) {
+        assertRealDirectory(packagePath, 'Existing automation script package');
+        verifyPackageHash(packagePath, packageSha256);
+        chmodPackageTreeReadOnly(packagePath);
+        return stagedPackage(packageSha256, packagePath, shebang, manifest, entries);
+    }
+    (0, node_fs_1.mkdirSync)(root, { recursive: true });
+    const tempPath = (0, node_path_1.join)(root, `.${packageSha256}.tmp-${(0, node_crypto_1.randomUUID)()}`);
+    try {
+        copyEntriesReadOnly(entries, tempPath);
+        verifyPackageHash(tempPath, packageSha256);
+        try {
+            (0, node_fs_1.renameSync)(tempPath, packagePath);
+            chmodPackageTreeReadOnly(packagePath);
+        }
+        catch (error) {
+            if (!(0, node_fs_1.existsSync)(packagePath))
+                throw error;
+            assertRealDirectory(packagePath, 'Existing automation script package');
+            verifyPackageHash(packagePath, packageSha256);
+            chmodPackageTreeReadOnly(packagePath);
+            (0, node_fs_1.rmSync)(tempPath, { recursive: true, force: true });
+        }
+        return stagedPackage(packageSha256, packagePath, shebang, manifest, entries);
+    }
+    catch (error) {
+        (0, node_fs_1.rmSync)(tempPath, { recursive: true, force: true });
+        throw error;
+    }
+}
+/** Re-check immutable package contents immediately before every execution. */
+function verifyStagedScriptPackage(packagePath, expectedSha256) {
+    verifyPackageHash(packagePath, expectedSha256);
+}
+function collectPackageEntries(sourceDir) {
+    assertRealDirectory(sourceDir, 'Automation script package source');
+    const rootRealPath = (0, node_fs_1.realpathSync)(sourceDir);
+    const entries = [];
+    const visit = (directory) => {
+        for (const item of readDirectoryEntriesStable(directory, rootRealPath)) {
+            const absolutePath = (0, node_path_1.join)(directory, item.name);
+            const stat = (0, node_fs_1.lstatSync)(absolutePath);
+            if (stat.isSymbolicLink()) {
+                throw new Error(`Automation script packages cannot contain symlinks: ${item.name}`);
+            }
+            if (stat.isDirectory()) {
+                assertContainedRealPath(absolutePath, rootRealPath, 'Automation script package directory');
+                visit(absolutePath);
+                continue;
+            }
+            if (!stat.isFile()) {
+                throw new Error(`Automation script packages can only contain regular files: ${item.name}`);
+            }
+            assertContainedRealPath(absolutePath, rootRealPath, 'Automation script package file');
+            const packagePath = normalizeFilesystemPackagePath(sourceDir, absolutePath);
+            const content = readRegularFileNoFollow(absolutePath, packagePath, rootRealPath);
+            if (content.includes(0)) {
+                throw new Error(`Automation script package file must be text, not binary: ${packagePath}`);
+            }
+            entries.push({
+                path: packagePath,
+                absolutePath,
+                content,
+                sha256: (0, node_crypto_1.createHash)('sha256').update(content).digest('hex'),
+                size: content.byteLength,
+            });
+        }
+    };
+    visit(sourceDir);
+    if (entries.length === 0)
+        throw new Error('Automation script package cannot be empty.');
+    return entries.sort(compareEntries);
+}
+function normalizeFilesystemPackagePath(sourceDir, absolutePath) {
+    const rawRelative = (0, node_path_1.relative)(sourceDir, absolutePath);
+    const parts = rawRelative.split(node_path_1.sep);
+    if (parts.some((part) => !part || part === '.' || part === '..')) {
+        throw new Error(`Automation script package path must be relative and normalized: ${rawRelative}`);
+    }
+    return normalizeRelativePosixPath(parts.join(node_path_1.posix.sep), 'Automation script package path');
+}
+function normalizeRelativePosixPath(value, label) {
+    if (typeof value !== 'string' || !value.trim())
+        throw new Error(`${label} is required.`);
+    const input = value.trim();
+    if ((0, node_path_1.isAbsolute)(input) || node_path_1.posix.isAbsolute(input) || node_path_1.win32.isAbsolute(input)) {
+        throw new Error(`${label} must be a relative POSIX path, not an absolute path.`);
+    }
+    if (input.includes('\\'))
+        throw new Error(`${label} must be a relative POSIX path.`);
+    const segments = input.split('/');
+    if (segments.some((segment) => !segment || segment === '.' || segment === '..')) {
+        throw new Error(`${label} must not contain path traversal.`);
+    }
+    const normalized = node_path_1.posix.normalize(input);
+    if (normalized !== input)
+        throw new Error(`${label} must already be normalized.`);
+    return normalized;
+}
+function validatePathToken(value, label) {
+    if (typeof value !== 'string' || !value.trim())
+        throw new Error(`${label} is required.`);
+    const token = value.trim();
+    if ((0, node_path_1.isAbsolute)(token) ||
+        node_path_1.posix.isAbsolute(token) ||
+        node_path_1.win32.isAbsolute(token) ||
+        token.includes('/') ||
+        token.includes('\\') ||
+        token === '.' ||
+        token === '..' ||
+        token.includes('..')) {
+        throw new Error(`${label} cannot contain path separators or traversal.`);
+    }
+    return token;
+}
+function parseManifest(content) {
+    let parsed;
+    try {
+        parsed = JSON.parse(content.toString('utf8'));
+    }
+    catch (error) {
+        throw withContext('Automation script manifest must be valid JSON', error);
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error('Automation script manifest must be an object.');
+    }
+    const manifest = parsed;
+    if (manifest.protocolVersion !== 1) {
+        throw new Error('Automation script manifest protocolVersion must be 1.');
+    }
+    const capabilities = parseCapabilities(manifest.capabilities);
+    const limits = parseLimits(manifest.limits);
+    return {
+        ...manifest,
+        protocolVersion: 1,
+        entrypoint: normalizeRelativePosixPath(manifest.entrypoint, 'Automation script entrypoint'),
+        config: asRecord(manifest.config, 'Automation script manifest config'),
+        configSchema: asRecord(manifest.configSchema, 'Automation script manifest configSchema'),
+        capabilities,
+        secretRefs: stringArray(manifest.secretRefs, 'Automation script manifest secretRefs'),
+        env: stringArray(manifest.env, 'Automation script manifest env'),
+        limits,
+    };
+}
+function parseCapabilities(value) {
+    const capabilities = asRecord(value, 'Automation script manifest capabilities');
+    const network = requiredString(capabilities.network, 'Automation script manifest capabilities.network');
+    if (network !== 'none' && network !== 'public') {
+        throw new Error('Automation script manifest capabilities.network must be none or public.');
+    }
+    if (typeof capabilities.internalAccess !== 'boolean') {
+        throw new Error('Automation script manifest capabilities.internalAccess must be a boolean.');
+    }
+    return {
+        ...capabilities,
+        network,
+        internalAccess: capabilities.internalAccess,
+        allowedReadDirs: stringArray(capabilities.allowedReadDirs, 'Automation script manifest capabilities.allowedReadDirs'),
+    };
+}
+function parseLimits(value) {
+    const limits = asRecord(value, 'Automation script manifest limits');
+    return {
+        ...limits,
+        timeoutMs: positiveSafeInteger(limits.timeoutMs, 'Automation script manifest limits.timeoutMs'),
+        stdoutBytes: positiveSafeInteger(limits.stdoutBytes, 'Automation script manifest limits.stdoutBytes'),
+        stderrBytes: positiveSafeInteger(limits.stderrBytes, 'Automation script manifest limits.stderrBytes'),
+        payloadBytes: positiveSafeInteger(limits.payloadBytes, 'Automation script manifest limits.payloadBytes'),
+        stateBytes: positiveSafeInteger(limits.stateBytes, 'Automation script manifest limits.stateBytes'),
+    };
+}
+function validateTextEntrypoint(content) {
+    if (content.includes(0))
+        throw new Error('Automation script entrypoint must be text, not binary.');
+    const text = content.toString('utf8');
+    const firstLine = text.split(/\r?\n/, 1)[0] ?? '';
+    if (!firstLine.startsWith('#!') || firstLine.trim().length <= 2) {
+        throw new Error('Automation script entrypoint must start with a valid shebang.');
+    }
+    return firstLine.trim();
+}
+function hashEntries(entries, root) {
+    const hash = (0, node_crypto_1.createHash)('sha256');
+    const rootRealPath = root ? (0, node_fs_1.realpathSync)(root) : undefined;
+    for (const entry of [...entries].sort(compareEntries)) {
+        const content = 'content' in entry
+            ? entry.content
+            : readPackageFileFromRoot(root || '', rootRealPath, entry.path);
+        hash.update(entry.path, 'utf8');
+        hash.update('\0');
+        hash.update((0, node_crypto_1.createHash)('sha256').update(content).digest('hex'), 'utf8');
+        hash.update('\0');
+        hash.update(String(content.byteLength), 'utf8');
+        hash.update('\0');
+    }
+    return hash.digest('hex');
+}
+function copyEntriesReadOnly(entries, destination) {
+    (0, node_fs_1.mkdirSync)(destination, { recursive: true });
+    const destinationRealPath = (0, node_fs_1.realpathSync)(destination);
+    for (const entry of entries) {
+        const target = (0, node_path_1.join)(destination, entry.path);
+        (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(target), { recursive: true });
+        (0, node_fs_1.writeFileSync)(target, entry.content, { mode: 0o444 });
+        chmodPathWithStableParent(target, 0o444, destinationRealPath, 'Automation script package file');
+    }
+}
+function verifyPackageHash(packagePath, expectedSha256) {
+    assertRealDirectory(packagePath, 'Automation script package');
+    const entries = collectPackageEntries(packagePath);
+    const actualSha256 = hashEntries(entries);
+    if (actualSha256 !== expectedSha256) {
+        throw new Error(`Copied automation script package hash mismatch for ${(0, node_path_1.basename)(packagePath)}.`);
+    }
+}
+function stagedPackage(packageSha256, packagePath, shebang, manifest, entries) {
+    return {
+        packageSha256,
+        packagePath,
+        shebang,
+        manifest,
+        entries: entries.map(({ path, sha256, size }) => ({ path, sha256, size })),
+    };
+}
+function compareEntries(left, right) {
+    return Buffer.compare(Buffer.from(left.path, 'utf8'), Buffer.from(right.path, 'utf8'));
+}
+function withContext(message, error) {
+    return new Error(`${message}: ${error instanceof Error ? error.message : String(error)}`);
+}
+function assertRealDirectory(path, label) {
+    const stat = (0, node_fs_1.lstatSync)(path);
+    if (stat.isSymbolicLink() || !stat.isDirectory()) {
+        throw new Error(`${label} must be a real directory.`);
+    }
+}
+function readRegularFileNoFollow(path, packagePath, rootRealPath) {
+    const parentDirectory = (0, node_path_1.dirname)(path);
+    const before = rootRealPath
+        ? assertDirectorySnapshot(parentDirectory, rootRealPath, 'Automation script package file parent directory')
+        : undefined;
+    if (rootRealPath) {
+        assertContainedRealPath(path, rootRealPath, 'Automation script package file');
+    }
+    const fileBefore = rootRealPath
+        ? assertPackagePathSnapshot(path, rootRealPath, 'Automation script package file')
+        : undefined;
+    runBeforeFileReadHook(path);
+    const noFollow = typeof node_fs_1.constants.O_NOFOLLOW === 'number' ? node_fs_1.constants.O_NOFOLLOW : 0;
+    const fd = (0, node_fs_1.openSync)(path, node_fs_1.constants.O_RDONLY | noFollow);
+    try {
+        const stat = (0, node_fs_1.fstatSync)(fd);
+        if (!stat.isFile()) {
+            throw new Error(`Automation script packages can only contain regular files: ${packagePath}`);
+        }
+        if (fileBefore) {
+            assertSameDeviceInode(fileBefore, stat, `Automation script package file changed before open: ${path}`);
+        }
+        const content = (0, node_fs_1.readFileSync)(fd);
+        if (rootRealPath && before) {
+            const after = assertDirectorySnapshot(parentDirectory, rootRealPath, 'Automation script package file parent directory');
+            assertSameDirectorySnapshot(before, after, `Automation script package file parent directory changed during read: ${parentDirectory}`);
+            const fileAfter = assertPackagePathSnapshot(path, rootRealPath, 'Automation script package file');
+            if (fileBefore) {
+                assertSameDirectorySnapshot(fileBefore, fileAfter, `Automation script package file changed during read: ${path}`);
+            }
+            assertContainedRealPath(path, rootRealPath, 'Automation script package file');
+        }
+        return content;
+    }
+    finally {
+        (0, node_fs_1.closeSync)(fd);
+    }
+}
+function chmodPackageTreeReadOnly(packagePath) {
+    const rootRealPath = (0, node_fs_1.realpathSync)(packagePath);
+    const directories = [];
+    const visit = (directory) => {
+        assertDirectorySnapshot(directory, rootRealPath, 'Automation script package directory');
+        directories.push(directory);
+        for (const item of readDirectoryEntriesStable(directory, rootRealPath)) {
+            const absolutePath = (0, node_path_1.join)(directory, item.name);
+            const stat = (0, node_fs_1.lstatSync)(absolutePath);
+            if (stat.isSymbolicLink()) {
+                throw new Error(`Automation script packages cannot contain symlinks: ${item.name}`);
+            }
+            if (stat.isDirectory()) {
+                assertContainedRealPath(absolutePath, rootRealPath, 'Automation script package directory');
+                visit(absolutePath);
+                continue;
+            }
+            if (!stat.isFile()) {
+                throw new Error(`Automation script packages can only contain regular files: ${item.name}`);
+            }
+            assertContainedRealPath(absolutePath, rootRealPath, 'Automation script package file');
+            chmodPathWithStableParent(absolutePath, 0o444, rootRealPath, 'Automation script package file');
+        }
+    };
+    visit(packagePath);
+    for (const directory of directories.reverse()) {
+        chmodPathWithStableParent(directory, 0o555, rootRealPath, 'Automation script package directory');
+    }
+}
+function asRecord(value, label) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error(`${label} must be an object.`);
+    }
+    return value;
+}
+function requiredString(value, label) {
+    if (typeof value !== 'string' || !value.trim())
+        throw new Error(`${label} is required.`);
+    return value.trim();
+}
+function stringArray(value, label) {
+    if (!Array.isArray(value) || value.some((item) => typeof item !== 'string' || !item.trim())) {
+        throw new Error(`${label} must be an array of strings.`);
+    }
+    return value.map((item) => item.trim());
+}
+function positiveSafeInteger(value, label) {
+    if (typeof value !== 'number' || !Number.isSafeInteger(value) || value <= 0) {
+        throw new Error(`${label} must be a positive integer.`);
+    }
+    return value;
+}
+function readDirectoryEntriesStable(directory, rootRealPath) {
+    const before = assertDirectorySnapshot(directory, rootRealPath, 'Automation script package directory');
+    runBeforeDirectoryReadHook(directory);
+    const entries = (0, node_fs_1.readdirSync)(directory, { withFileTypes: true });
+    const after = assertDirectorySnapshot(directory, rootRealPath, 'Automation script package directory');
+    assertSameDirectorySnapshot(before, after, `Automation script package directory changed during traversal: ${directory}`);
+    return entries;
+}
+function assertDirectorySnapshot(directory, rootRealPath, label) {
+    const stat = (0, node_fs_1.lstatSync)(directory);
+    if (stat.isSymbolicLink() || !stat.isDirectory()) {
+        throw new Error(`${label} must be a real directory.`);
+    }
+    const realPath = assertContainedRealPath(directory, rootRealPath, label);
+    return {
+        dev: stat.dev,
+        ino: stat.ino,
+        realPath,
+    };
+}
+function assertContainedRealPath(path, rootRealPath, label) {
+    const realPath = (0, node_fs_1.realpathSync)(path);
+    const relativePath = (0, node_path_1.relative)(rootRealPath, realPath);
+    if (relativePath && (relativePath === '..' || relativePath.startsWith(`..${node_path_1.sep}`) || (0, node_path_1.isAbsolute)(relativePath))) {
+        throw new Error(`${label} must stay within the automation script package root.`);
+    }
+    return realPath;
+}
+function readPackageFileFromRoot(root, rootRealPath, entryPath) {
+    const absolutePath = (0, node_path_1.join)(root, entryPath);
+    if (rootRealPath) {
+        assertContainedRealPath(absolutePath, rootRealPath, 'Automation script package file');
+    }
+    return readRegularFileNoFollow(absolutePath, entryPath, rootRealPath);
+}
+function chmodPathWithStableParent(path, mode, rootRealPath, label) {
+    const pathRealBefore = assertContainedRealPath(path, rootRealPath, label);
+    const protectsRootItself = pathRealBefore === rootRealPath;
+    const snapshotPath = protectsRootItself ? path : (0, node_path_1.dirname)(path);
+    const snapshotLabel = protectsRootItself ? label : `${label} parent directory`;
+    const before = assertDirectorySnapshot(snapshotPath, rootRealPath, snapshotLabel);
+    const targetBefore = assertPackagePathSnapshot(path, rootRealPath, label);
+    const fd = (0, node_fs_1.openSync)(path, chmodOpenFlags(targetBefore.kind));
+    try {
+        const fdStat = (0, node_fs_1.fstatSync)(fd);
+        if (targetBefore.kind === 'directory' && !fdStat.isDirectory()) {
+            throw new Error(`${label} changed before chmod: ${path}`);
+        }
+        if (targetBefore.kind === 'file' && !fdStat.isFile()) {
+            throw new Error(`${label} changed before chmod: ${path}`);
+        }
+        assertSameDeviceInode(targetBefore, fdStat, `${label} changed before chmod: ${path}`);
+        runBeforeChmodHook(path);
+        (0, node_fs_1.fchmodSync)(fd, mode);
+    }
+    catch (error) {
+        throw withContext(`${label} could not be chmodded safely`, error);
+    }
+    finally {
+        (0, node_fs_1.closeSync)(fd);
+    }
+    const after = assertDirectorySnapshot(snapshotPath, rootRealPath, snapshotLabel);
+    assertSameDirectorySnapshot(before, after, `${snapshotLabel} changed during chmod: ${snapshotPath}`);
+    const targetAfter = assertPackagePathSnapshot(path, rootRealPath, label);
+    assertSameDirectorySnapshot(targetBefore, targetAfter, `${label} changed during chmod: ${path}`);
+    assertContainedRealPath(path, rootRealPath, label);
+}
+function assertSameDirectorySnapshot(before, after, message) {
+    if (before.dev !== after.dev || before.ino !== after.ino || before.realPath !== after.realPath) {
+        throw new Error(message);
+    }
+}
+function assertSameDeviceInode(before, after, message) {
+    if (before.dev !== after.dev || before.ino !== after.ino) {
+        throw new Error(message);
+    }
+}
+function assertPackagePathSnapshot(path, rootRealPath, label) {
+    const stat = (0, node_fs_1.lstatSync)(path);
+    if (stat.isSymbolicLink()) {
+        throw new Error(`${label} must not be a symlink.`);
+    }
+    let kind;
+    if (stat.isDirectory()) {
+        kind = 'directory';
+    }
+    else if (stat.isFile()) {
+        kind = 'file';
+    }
+    else {
+        throw new Error(`${label} must be a regular file or directory.`);
+    }
+    const realPath = assertContainedRealPath(path, rootRealPath, label);
+    return {
+        dev: stat.dev,
+        ino: stat.ino,
+        realPath,
+        kind,
+    };
+}
+function chmodOpenFlags(kind) {
+    const noFollow = typeof node_fs_1.constants.O_NOFOLLOW === 'number' ? node_fs_1.constants.O_NOFOLLOW : 0;
+    if (kind === 'file')
+        return node_fs_1.constants.O_RDONLY | noFollow;
+    if (typeof node_fs_1.constants.O_DIRECTORY !== 'number') {
+        throw new Error('Directory chmod requires O_DIRECTORY support.');
+    }
+    return node_fs_1.constants.O_RDONLY | node_fs_1.constants.O_DIRECTORY | noFollow;
+}
+function runBeforeDirectoryReadHook(directory) {
+    const hooks = globalThis.__automationScriptPackageTestHooks;
+    hooks?.beforeDirectoryRead?.(directory);
+}
+function runBeforeFileReadHook(path) {
+    const hooks = globalThis.__automationScriptPackageTestHooks;
+    hooks?.beforeFileRead?.(path);
+}
+function runBeforeChmodHook(path) {
+    const hooks = globalThis.__automationScriptPackageTestHooks;
+    hooks?.beforeChmod?.(path);
+}