@kafca/agentdock 0.1.61 → 0.1.62

package/dist-electron/tests/electron/automation-sandbox-runner.test.js

@@ -0,0 +1,333 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = __importDefault(require("node:test"));
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const anthropic_sandbox_runner_js_1 = require("../../services/local-ai-core/src/automation/scripts/anthropic-sandbox-runner.js");
+class FakeManager {
+    config;
+    initialized = 0;
+    wrapped = [];
+    wrappedArgv = [];
+    dependencyErrors = [];
+    dependencyWarnings = [];
+    supported = true;
+    initializeError;
+    resetCalls = 0;
+    wrappedCommandOverride;
+    async initialize(config) {
+        this.initialized += 1;
+        this.config = config;
+        if (this.initializeError)
+            throw this.initializeError;
+    }
+    async wrapWithSandbox(command) {
+        this.wrapped.push(command);
+        return command;
+    }
+    async wrapWithSandboxArgv(command) {
+        this.wrappedArgv.push(command);
+        return { argv: ['/bin/sh', '-c', this.wrappedCommandOverride || command], env: { ...process.env } };
+    }
+    isSupportedPlatform() { return this.supported; }
+    isSandboxingEnabled() { return this.initialized > 0; }
+    checkDependencies() { return { errors: this.dependencyErrors, warnings: this.dependencyWarnings }; }
+    async reset() { this.resetCalls += 1; }
+    cleanupAfterCommand() { }
+}
+function input(root, overrides = {}) {
+    return {
+        command: 'printf sandbox-ok',
+        cwd: root,
+        packagePath: (0, node_path_1.join)(root, 'package'),
+        tempDir: (0, node_path_1.join)(root, 'tmp'),
+        tempRoot: root,
+        network: 'none',
+        ...overrides,
+    };
+}
+(0, node_test_1.default)('builds read-only package and temp-only write policy', () => {
+    const root = '/workspace/automation';
+    const config = (0, anthropic_sandbox_runner_js_1.buildSandboxRuntimeConfig)(input(root, {
+        allowedReadDirs: ['/workspace/automation/fixtures'],
+        denyRead: ['/workspace/automation/secret.txt'],
+    }));
+    strict_1.default.deepEqual(config.filesystem.allowWrite, ['/workspace/automation/tmp']);
+    strict_1.default.ok(config.filesystem.denyWrite.includes('/workspace/automation/package'));
+    strict_1.default.ok(config.filesystem.allowRead?.includes('/workspace/automation/package'));
+    strict_1.default.ok(config.filesystem.allowRead?.includes('/workspace/automation/fixtures'));
+    strict_1.default.ok(config.filesystem.denyRead.includes('/workspace/automation/secret.txt'));
+    strict_1.default.ok(config.filesystem.denyWrite.includes('/tmp/claude'));
+    strict_1.default.ok(config.filesystem.denyWrite.some((path) => path.endsWith('/.npm/_logs')));
+});
+(0, node_test_1.default)('rejects temp paths outside a controlled temporary root and explicit package denies win', () => {
+    const root = '/workspace/automation';
+    strict_1.default.throws(() => (0, anthropic_sandbox_runner_js_1.buildSandboxRuntimeConfig)(input(root, {
+        tempRoot: root,
+        tempDir: '/tmp',
+    })), /tempDir must be inside/);
+    const config = (0, anthropic_sandbox_runner_js_1.buildSandboxRuntimeConfig)(input(root, {
+        denyRead: [(0, node_path_1.join)(root, 'package', 'secret.txt')],
+    }));
+    strict_1.default.ok(!config.filesystem.allowRead?.some((path) => path === (0, node_path_1.join)(root, 'package')));
+});
+(0, node_test_1.default)('generates callback-gated public egress with explicit private/local denies', () => {
+    const config = (0, anthropic_sandbox_runner_js_1.buildSandboxRuntimeConfig)(input('/workspace/automation', {
+        network: 'public',
+    }));
+    strict_1.default.deepEqual(config.network.allowedDomains, []);
+    strict_1.default.equal(config.network.strictAllowlist, false);
+    for (const host of ['localhost', '127.0.0.1', '::1', '169.254.169.254']) {
+        strict_1.default.ok(config.network.deniedDomains.includes(host));
+    }
+    strict_1.default.ok(anthropic_sandbox_runner_js_1.PRIVATE_NETWORK_DENY_HOSTS.every((host) => config.network.deniedDomains.includes(host)));
+});
+(0, node_test_1.default)('generates restricted egress only from manifest domains', () => {
+    const config = (0, anthropic_sandbox_runner_js_1.buildSandboxRuntimeConfig)(input('/workspace/automation', {
+        network: 'restricted',
+        allowedDomains: ['api.example.com', '*.vendor.example'],
+    }));
+    strict_1.default.deepEqual(config.network.allowedDomains, []);
+    strict_1.default.equal(config.network.strictAllowlist, false);
+    strict_1.default.ok(config.network.deniedDomains.includes('localhost'));
+});
+(0, node_test_1.default)('private-address policy rejects numeric ranges and mapped IPv6 forms', async () => {
+    strict_1.default.equal(await (0, anthropic_sandbox_runner_js_1.isPrivateNetworkAddress)('10.0.0.2'), true);
+    strict_1.default.equal(await (0, anthropic_sandbox_runner_js_1.isPrivateNetworkAddress)('192.168.1.2'), true);
+    strict_1.default.equal(await (0, anthropic_sandbox_runner_js_1.isPrivateNetworkAddress)('::ffff:10.1.2.3'), true);
+    strict_1.default.equal(await (0, anthropic_sandbox_runner_js_1.isPrivateNetworkAddress)('::ffff:a01:203'), true);
+    strict_1.default.equal(await (0, anthropic_sandbox_runner_js_1.isPrivateNetworkAddress)('127.0.0.3'), true);
+});
+(0, node_test_1.default)('probe fails unverified Linux isolation capabilities when dependencies block behavioral proof', async () => {
+    const manager = new FakeManager();
+    manager.dependencyErrors = [
+        'ripgrep (rg) not found',
+        'bubblewrap (bwrap) not installed',
+        'socat not installed',
+    ];
+    manager.dependencyWarnings = ['seccomp not available - unix socket access not restricted'];
+    const runner = new anthropic_sandbox_runner_js_1.AnthropicSandboxRunner({
+        platform: 'linux',
+        manager,
+        appArmorUsernsRestricted: true,
+    });
+    const result = await runner.probe();
+    strict_1.default.equal(result.available, false);
+    strict_1.default.equal(result.platform, 'linux');
+    strict_1.default.deepEqual(result.missing, ['bwrap', 'socat', 'rg', 'seccomp', 'network.namespace', 'apparmor.userns']);
+    strict_1.default.deepEqual(result.unverified, ['seccomp', 'network.namespace', 'apparmor.userns']);
+    strict_1.default.equal(manager.initialized, 0);
+});
+(0, node_test_1.default)('a successful wrapped Linux probe overrides the restrictive AppArmor sysctl context', async () => {
+    const manager = new FakeManager();
+    const runner = new anthropic_sandbox_runner_js_1.AnthropicSandboxRunner({
+        platform: 'linux',
+        manager,
+        appArmorUsernsRestricted: true,
+    });
+    const result = await runner.probe();
+    strict_1.default.equal(result.available, true);
+    strict_1.default.deepEqual(result.missing, []);
+    strict_1.default.deepEqual(manager.wrappedArgv, ['true']);
+});
+(0, node_test_1.default)('disabling behavioral initialization cannot produce green Linux isolation capabilities', async () => {
+    const runner = new anthropic_sandbox_runner_js_1.AnthropicSandboxRunner({
+        platform: 'linux',
+        manager: new FakeManager(),
+        probeInitialization: false,
+    });
+    const result = await runner.probe();
+    strict_1.default.equal(result.available, false);
+    strict_1.default.deepEqual(result.missing, ['seccomp', 'network.namespace', 'sandbox_runtime', 'apparmor.userns']);
+    strict_1.default.deepEqual(result.unverified, ['seccomp', 'network.namespace', 'apparmor.userns']);
+});
+(0, node_test_1.default)('wrapped Linux probe classifies actual AppArmor, network namespace, and seccomp failures independently', async () => {
+    const cases = [
+        {
+            stderr: 'bwrap: Creating new namespace failed: Operation not permitted',
+            restricted: true,
+            expected: ['seccomp', 'network.namespace', 'apparmor.userns'],
+            unverified: ['seccomp', 'network.namespace'],
+        },
+        {
+            stderr: 'bwrap: unshare-net: network namespace operation not permitted',
+            restricted: false,
+            expected: ['seccomp', 'network.namespace'],
+            unverified: ['seccomp'],
+        },
+        {
+            stderr: 'apply-seccomp: seccomp filter installation failed',
+            restricted: false,
+            expected: ['seccomp'],
+            unverified: [],
+        },
+    ];
+    for (const item of cases) {
+        const manager = new FakeManager();
+        manager.wrappedCommandOverride = `printf '%s' '${item.stderr}' >&2; exit 1`;
+        const runner = new anthropic_sandbox_runner_js_1.AnthropicSandboxRunner({
+            platform: 'linux',
+            manager,
+            appArmorUsernsRestricted: item.restricted,
+        });
+        const result = await runner.probe();
+        strict_1.default.equal(result.available, false);
+        strict_1.default.deepEqual(result.missing, item.expected);
+        strict_1.default.deepEqual(result.unverified || [], item.unverified);
+        strict_1.default.equal(manager.resetCalls, 1);
+    }
+});
+(0, node_test_1.default)('probe reports macOS sandbox-exec and ripgrep capabilities', async () => {
+    const runner = new anthropic_sandbox_runner_js_1.AnthropicSandboxRunner({
+        platform: 'macos',
+        manager: new FakeManager(),
+        commandExists: (command) => command === 'sandbox-exec' || command === 'rg',
+    });
+    const result = await runner.probe();
+    strict_1.default.equal(result.available, true);
+    strict_1.default.deepEqual(result.missing, []);
+});
+(0, node_test_1.default)('probe reports missing macOS ripgrep independently', async () => {
+    const runner = new anthropic_sandbox_runner_js_1.AnthropicSandboxRunner({
+        platform: 'macos',
+        manager: new FakeManager(),
+        commandExists: (command) => command === 'sandbox-exec',
+    });
+    const result = await runner.probe();
+    strict_1.default.equal(result.available, false);
+    strict_1.default.deepEqual(result.missing, ['rg']);
+});
+(0, node_test_1.default)('Windows probes and runs fail closed with sandbox_unavailable', async () => {
+    const manager = new FakeManager();
+    const runner = new anthropic_sandbox_runner_js_1.AnthropicSandboxRunner({ platform: 'win32', manager });
+    const probe = await runner.probe();
+    strict_1.default.equal(probe.available, false);
+    strict_1.default.deepEqual(probe.missing, ['sandbox_unavailable']);
+    await strict_1.default.rejects(runner.run(input('/workspace/automation')), (error) => error instanceof Error && error.message.includes('sandbox_unavailable'));
+    strict_1.default.equal(manager.initialized, 0);
+});
+(0, node_test_1.default)('keeps wrapped shell command private to adapter and returns only execution result', async () => {
+    const root = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'automation-sandbox-runner-'));
+    try {
+        const manager = new FakeManager();
+        const runner = new anthropic_sandbox_runner_js_1.AnthropicSandboxRunner({ platform: process.platform, manager, tempRoot: root });
+        const result = await runner.run({ ...input(root), env: { PATH: (0, node_path_1.join)(root, 'fake-bin') }, allowedEnv: ['PATH'] });
+        strict_1.default.equal(result.exitCode, 0);
+        strict_1.default.equal(result.stdout, 'sandbox-ok');
+        strict_1.default.deepEqual(Object.keys(result).sort(), ['exitCode', 'signal', 'stderr', 'stdout']);
+        strict_1.default.deepEqual(manager.wrappedArgv, ['true', 'printf sandbox-ok']);
+    }
+    finally {
+        (0, node_fs_1.rmSync)(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('enforces streamed output ceilings before buffering unbounded output', async () => {
+    const root = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'automation-sandbox-runner-'));
+    try {
+        const runner = new anthropic_sandbox_runner_js_1.AnthropicSandboxRunner({ platform: process.platform, manager: new FakeManager(), tempRoot: root });
+        const result = await runner.run({ ...input(root, { command: 'yes output', stdoutBytes: 64, timeoutMs: 5_000 }) });
+        strict_1.default.equal(result.outputLimitExceeded, 'stdout');
+        strict_1.default.ok(Buffer.byteLength(result.stdout, 'utf8') <= 64);
+    }
+    finally {
+        (0, node_fs_1.rmSync)(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('stream truncation respects UTF-8 byte limits without replacement characters', async () => {
+    const root = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'automation-sandbox-runner-'));
+    try {
+        const runner = new anthropic_sandbox_runner_js_1.AnthropicSandboxRunner({ platform: process.platform, manager: new FakeManager(), tempRoot: root });
+        const result = await runner.run({ ...input(root, { command: "printf '€€'", stdoutBytes: 4, timeoutMs: 5_000 }) });
+        strict_1.default.equal(result.outputLimitExceeded, 'stdout');
+        strict_1.default.ok(Buffer.byteLength(result.stdout, 'utf8') <= 4);
+        strict_1.default.ok(!result.stdout.includes('\uFFFD'));
+    }
+    finally {
+        (0, node_fs_1.rmSync)(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('stream truncation preserves a complete replacement character before overflow', async () => {
+    const root = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'automation-sandbox-runner-'));
+    try {
+        const runner = new anthropic_sandbox_runner_js_1.AnthropicSandboxRunner({ platform: process.platform, manager: new FakeManager(), tempRoot: root });
+        const result = await runner.run({ ...input(root, { command: "printf '�€'", stdoutBytes: 5, timeoutMs: 5_000 }) });
+        strict_1.default.equal(result.stdout, '�');
+        strict_1.default.equal(Buffer.byteLength(result.stdout, 'utf8'), 3);
+    }
+    finally {
+        (0, node_fs_1.rmSync)(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('timeout terminates the sandbox command process group', { skip: process.platform === 'win32' }, async () => {
+    const root = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'automation-sandbox-runner-'));
+    try {
+        const runner = new anthropic_sandbox_runner_js_1.AnthropicSandboxRunner({ platform: process.platform, manager: new FakeManager(), tempRoot: root });
+        const started = Date.now();
+        const result = await runner.run({ ...input(root, { command: 'sleep 3 & wait', timeoutMs: 50 }) });
+        strict_1.default.ok(Date.now() - started < 2_000);
+        strict_1.default.notEqual(result.exitCode, 0);
+    }
+    finally {
+        (0, node_fs_1.rmSync)(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('serializes process-global SandboxManager operations across runners', async () => {
+    const root = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'automation-sandbox-lock-'));
+    try {
+        const manager = new FakeManager();
+        const first = new anthropic_sandbox_runner_js_1.AnthropicSandboxRunner({ platform: process.platform, manager, tempRoot: root });
+        const second = new anthropic_sandbox_runner_js_1.AnthropicSandboxRunner({ platform: process.platform, manager, tempRoot: root });
+        const [left, right] = await Promise.all([
+            first.run(input(root)),
+            second.run(input(root)),
+        ]);
+        strict_1.default.equal(left.exitCode, 0);
+        strict_1.default.equal(right.exitCode, 0);
+        strict_1.default.equal(manager.resetCalls >= 4, true);
+    }
+    finally {
+        (0, node_fs_1.rmSync)(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('sanitizes loader/startup/proxy environment variables while preserving approved data', async () => {
+    const root = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'automation-sandbox-env-'));
+    try {
+        const manager = new FakeManager();
+        const runner = new anthropic_sandbox_runner_js_1.AnthropicSandboxRunner({ platform: process.platform, manager, tempRoot: root });
+        const result = await runner.run({
+            ...input(root),
+            command: 'printf "%s-%s" "$TOKEN" "$BASH_ENV"',
+            env: { TOKEN: 'approved', BASH_ENV: '/tmp/evil', HTTP_PROXY: 'http://evil' },
+            allowedEnv: ['TOKEN', 'BASH_ENV', 'HTTP_PROXY'],
+        });
+        strict_1.default.equal(result.exitCode, 0);
+        strict_1.default.equal(result.stdout, 'approved-');
+    }
+    finally {
+        (0, node_fs_1.rmSync)(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('keeps an explicit empty environment allowlist empty', async () => {
+    const root = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'automation-sandbox-empty-env-'));
+    try {
+        const manager = new FakeManager();
+        const runner = new anthropic_sandbox_runner_js_1.AnthropicSandboxRunner({ platform: process.platform, manager, tempRoot: root });
+        const result = await runner.run({
+            ...input(root),
+            command: 'printf "%s" "$TOKEN"',
+            env: { TOKEN: 'must-not-pass' },
+            allowedEnv: [],
+            manifest: { env: ['TOKEN'] },
+        });
+        strict_1.default.equal(result.exitCode, 0);
+        strict_1.default.equal(result.stdout, '');
+    }
+    finally {
+        (0, node_fs_1.rmSync)(root, { recursive: true, force: true });
+    }
+});