@machina.ai/cell-cli 1.59.0-rc2 → 1.64.0-rc1

package/dist/src/utils/sandbox.test.js

@@ -118,7 +118,11 @@ describe('sandbox', () => {
         vi.mocked(os.tmpdir).mockReturnValue('/tmp');
         vi.mocked(fs.existsSync).mockReturnValue(true);
         vi.mocked(fs.realpathSync).mockImplementation((p) => p);
+        vi.mocked(fs.mkdtempSync).mockImplementation((prefix) => `${prefix}test-tmp`);
+        vi.mocked(fs.chmodSync).mockImplementation(() => { });
+        vi.mocked(fs.rmSync).mockImplementation(() => { });
         vi.mocked(execSync).mockReturnValue(Buffer.from(''));
+        mockedHomedir.mockReturnValue('/home/user');
     });
     afterEach(() => {
         process.env = originalEnv;
@@ -146,6 +150,73 @@ describe('sandbox', () => {
                 expect.stringContaining('sandbox-macos-permissive-open.sb'),
             ]), expect.objectContaining({ stdio: 'inherit' }));
         });
+        it('should isolate temporary directory for macOS seatbelt (sandbox-exec)', async () => {
+            vi.mocked(os.platform).mockReturnValue('darwin');
+            vi.mocked(os.tmpdir).mockReturnValue('/var/folders/test/T');
+            vi.mocked(fs.realpathSync).mockImplementation((p) => p);
+            vi.mocked(fs.mkdtempSync).mockReturnValue('/var/folders/test/T/cell-sandbox-tmp-123456');
+            const config = createMockSandboxConfig({
+                command: 'sandbox-exec',
+                image: 'some-image',
+            });
+            const mockSpawnProcess = new EventEmitter();
+            mockSpawnProcess.stdout = new EventEmitter();
+            mockSpawnProcess.stderr = new EventEmitter();
+            vi.mocked(spawn).mockReturnValue(mockSpawnProcess);
+            const onSpy = vi.spyOn(process, 'on');
+            const offSpy = vi.spyOn(process, 'off');
+            const promise = start_sandbox(config, [], undefined, ['arg1']);
+            setTimeout(() => {
+                mockSpawnProcess.emit('close', 0);
+            }, 10);
+            await expect(promise).resolves.toBe(0);
+            // Verify that an isolated temporary directory was created
+            expect(fs.mkdtempSync).toHaveBeenCalledWith(expect.stringContaining(path.join('/var/folders/test/T', 'cell-sandbox-')));
+            const spawnCalls = vi.mocked(spawn).mock.calls;
+            const spawnArgs = spawnCalls[0]?.[1];
+            // Verify that TMP_DIR argument passed to seatbelt is the isolated temp directory, NOT host tmpdir
+            expect(spawnArgs).toContain('TMP_DIR=/var/folders/test/T/cell-sandbox-tmp-123456');
+            expect(spawnArgs).not.toContain('TMP_DIR=/var/folders/test/T');
+            // Verify that TMPDIR environment variable is set in the sandboxed shell execution
+            const shCommand = spawnArgs[spawnArgs.indexOf('sh') + 2];
+            expect(shCommand).toContain('TMPDIR=');
+            expect(shCommand).toContain('/var/folders/test/T/cell-sandbox-tmp-123456');
+            // Verify cleanup of the isolated temporary directory
+            expect(fs.rmSync).toHaveBeenCalledWith('/var/folders/test/T/cell-sandbox-tmp-123456', expect.objectContaining({ recursive: true, force: true }));
+            // Verify that exit and signal cleanup hooks are registered and unregistered
+            expect(onSpy).toHaveBeenCalledWith('exit', expect.any(Function));
+            expect(onSpy).toHaveBeenCalledWith('SIGINT', expect.any(Function));
+            expect(onSpy).toHaveBeenCalledWith('SIGTERM', expect.any(Function));
+            expect(offSpy).toHaveBeenCalledWith('exit', expect.any(Function));
+            expect(offSpy).toHaveBeenCalledWith('SIGINT', expect.any(Function));
+            expect(offSpy).toHaveBeenCalledWith('SIGTERM', expect.any(Function));
+            onSpy.mockRestore();
+            offSpy.mockRestore();
+        });
+        it('should safely swallow errors if fs.rmSync fails during cleanup', async () => {
+            vi.mocked(os.platform).mockReturnValue('darwin');
+            vi.mocked(os.tmpdir).mockReturnValue('/var/folders/test/T');
+            vi.mocked(fs.realpathSync).mockImplementation((p) => p);
+            vi.mocked(fs.mkdtempSync).mockReturnValue('/var/folders/test/T/cell-sandbox-tmp-error');
+            vi.mocked(fs.rmSync).mockImplementation(() => {
+                throw new Error('EPERM: operation not permitted');
+            });
+            const config = createMockSandboxConfig({
+                command: 'sandbox-exec',
+                image: 'some-image',
+            });
+            const mockSpawnProcess = new EventEmitter();
+            mockSpawnProcess.stdout = new EventEmitter();
+            mockSpawnProcess.stderr = new EventEmitter();
+            vi.mocked(spawn).mockReturnValue(mockSpawnProcess);
+            const promise = start_sandbox(config, [], undefined, ['arg1']);
+            setTimeout(() => {
+                mockSpawnProcess.emit('close', 0);
+            }, 10);
+            // Even if fs.rmSync throws, start_sandbox should resolve successfully and not crash
+            await expect(promise).resolves.toBe(0);
+            expect(fs.rmSync).toHaveBeenCalled();
+        });
         it('should resolve custom seatbelt profile from user home directory', async () => {
             vi.mocked(os.platform).mockReturnValue('darwin');
             vi.stubEnv('SEATBELT_PROFILE', 'custom-test');
@@ -330,6 +401,122 @@ describe('sandbox', () => {
                 `SANDBOX=${containerName}`,
             ]), expect.objectContaining({ stdio: 'inherit' }));
         });
+        it('should not attempt to create a temporary settings directory when homedir is empty', async () => {
+            mockedHomedir.mockReturnValue('');
+            vi.mocked(os.tmpdir).mockReturnValue('/mock/tmp');
+            const config = createMockSandboxConfig({
+                command: 'docker',
+                image: 'cell-cli-sandbox',
+            });
+            const mockImageCheckProcess = new EventEmitter();
+            mockImageCheckProcess.stdout = new EventEmitter();
+            vi.mocked(spawn).mockImplementationOnce(() => {
+                setTimeout(() => {
+                    mockImageCheckProcess.stdout.emit('data', Buffer.from('image-id'));
+                    mockImageCheckProcess.emit('close', 0);
+                }, 1);
+                return mockImageCheckProcess;
+            });
+            const mockSpawnProcess = new EventEmitter();
+            mockSpawnProcess.on = vi.fn().mockImplementation((event, cb) => {
+                if (event === 'close') {
+                    setTimeout(() => cb(0), 10);
+                }
+                return mockSpawnProcess;
+            });
+            vi.mocked(spawn).mockImplementationOnce(() => mockSpawnProcess);
+            await expect(start_sandbox(config, [], undefined, ['arg1'])).resolves.toBe(0);
+            // Should only create the sandbox temp directory, not the settings fallback directory
+            expect(fs.mkdtempSync).toHaveBeenCalledTimes(1);
+            expect(fs.mkdtempSync).toHaveBeenCalledWith(path.join('/mock/tmp', 'cell-sandbox-'));
+            expect(fs.writeFileSync).toHaveBeenCalledWith(expect.stringMatching(/settings\.json$/), expect.any(String), { mode: 0o600 });
+            const dockerCall = vi.mocked(spawn).mock.calls.find((call) => {
+                const args = call[1];
+                return args && args.includes('run');
+            });
+            expect(dockerCall).toBeDefined();
+            const dockerArgs = dockerCall[1];
+            expect(dockerArgs.some((arg) => arg.includes('.config/gcloud'))).toBe(false);
+        });
+        it('should not mount gcloud config directory when homedir is empty even if relative path exists', async () => {
+            mockedHomedir.mockReturnValue('');
+            vi.mocked(os.tmpdir).mockReturnValue('/mock/tmp');
+            vi.mocked(fs.existsSync).mockImplementation((p) => {
+                if (typeof p === 'string' && p.includes('.config')) {
+                    return true;
+                }
+                return false;
+            });
+            const config = createMockSandboxConfig({
+                command: 'docker',
+                image: 'cell-cli-sandbox',
+            });
+            const mockImageCheckProcess = new EventEmitter();
+            mockImageCheckProcess.stdout = new EventEmitter();
+            vi.mocked(spawn).mockImplementationOnce(() => {
+                setTimeout(() => {
+                    mockImageCheckProcess.stdout.emit('data', Buffer.from('image-id'));
+                    mockImageCheckProcess.emit('close', 0);
+                }, 1);
+                return mockImageCheckProcess;
+            });
+            const mockSpawnProcess = new EventEmitter();
+            mockSpawnProcess.on = vi.fn().mockImplementation((event, cb) => {
+                if (event === 'close') {
+                    setTimeout(() => cb(0), 10);
+                }
+                return mockSpawnProcess;
+            });
+            vi.mocked(spawn).mockImplementationOnce(() => mockSpawnProcess);
+            await expect(start_sandbox(config, [], undefined, ['arg1'])).resolves.toBe(0);
+            const dockerCall = vi.mocked(spawn).mock.calls.find((call) => {
+                const args = call[1];
+                return args && args.includes('run');
+            });
+            expect(dockerCall).toBeDefined();
+            const dockerArgs = dockerCall[1];
+            expect(dockerArgs.some((arg) => arg.includes('.config/gcloud'))).toBe(false);
+        });
+        it('should mount gcloud config directory when homedir is defined and config exists', async () => {
+            mockedHomedir.mockReturnValue('/home/user');
+            vi.mocked(os.tmpdir).mockReturnValue('/mock/tmp');
+            const expectedConfigDir = path.join('/home/user', '.config', 'gcloud');
+            vi.mocked(fs.existsSync).mockImplementation((p) => {
+                if (typeof p === 'string' && p === expectedConfigDir) {
+                    return true;
+                }
+                return false;
+            });
+            const config = createMockSandboxConfig({
+                command: 'docker',
+                image: 'cell-cli-sandbox',
+            });
+            const mockImageCheckProcess = new EventEmitter();
+            mockImageCheckProcess.stdout = new EventEmitter();
+            vi.mocked(spawn).mockImplementationOnce(() => {
+                setTimeout(() => {
+                    mockImageCheckProcess.stdout.emit('data', Buffer.from('image-id'));
+                    mockImageCheckProcess.emit('close', 0);
+                }, 1);
+                return mockImageCheckProcess;
+            });
+            const mockSpawnProcess = new EventEmitter();
+            mockSpawnProcess.on = vi.fn().mockImplementation((event, cb) => {
+                if (event === 'close') {
+                    setTimeout(() => cb(0), 10);
+                }
+                return mockSpawnProcess;
+            });
+            vi.mocked(spawn).mockImplementationOnce(() => mockSpawnProcess);
+            await expect(start_sandbox(config, [], undefined, ['arg1'])).resolves.toBe(0);
+            const dockerCall = vi.mocked(spawn).mock.calls.find((call) => {
+                const args = call[1];
+                return args && args.includes('run');
+            });
+            expect(dockerCall).toBeDefined();
+            const dockerArgs = dockerCall[1];
+            expect(dockerArgs.some((arg) => arg.includes(expectedConfigDir) && arg.endsWith(':ro'))).toBe(true);
+        });
         it('should preserve the integration-test prefix for random container names', async () => {
             const config = createMockSandboxConfig({
                 command: 'docker',
@@ -464,12 +651,78 @@ describe('sandbox', () => {
             // The second call is 'docker run ...'
             expect(spawn).toHaveBeenNthCalledWith(2, 'docker', expect.arrayContaining([
                 'run',
+                '--env',
+                'HOME=/home/node',
                 '--volume',
                 '/host/path:/container/path:ro',
                 '--volume',
-                expect.stringMatching(/[\\/]home[\\/]user[\\/]\.cell-cli/),
+                expect.stringMatching(/[\\/]home[\\/]node[\\/]\.cell-cli:rw$/),
             ]), expect.any(Object));
         });
+        it('should mount an isolated settings directory rather than exposing host credentials', async () => {
+            const config = createMockSandboxConfig({
+                command: 'docker',
+                image: 'cell-cli-sandbox',
+            });
+            vi.mocked(fs.existsSync).mockReturnValue(true);
+            const mockImageCheckProcess = new EventEmitter();
+            mockImageCheckProcess.stdout = new EventEmitter();
+            vi.mocked(spawn).mockImplementationOnce(() => {
+                setTimeout(() => {
+                    mockImageCheckProcess.stdout.emit('data', Buffer.from('image-id'));
+                    mockImageCheckProcess.emit('close', 0);
+                }, 1);
+                return mockImageCheckProcess;
+            });
+            const mockSpawnProcess = new EventEmitter();
+            mockSpawnProcess.on = vi.fn().mockImplementation((event, cb) => {
+                if (event === 'close') {
+                    setTimeout(() => cb(0), 10);
+                }
+                return mockSpawnProcess;
+            });
+            vi.mocked(spawn).mockImplementationOnce(() => mockSpawnProcess);
+            await start_sandbox(config);
+            // Verify that docker run does NOT mount the raw host settings directory directly
+            expect(spawn).toHaveBeenNthCalledWith(2, 'docker', expect.not.arrayContaining([
+                '/home/user/.cell-cli:/home/node/.cell-cli',
+            ]), expect.any(Object));
+            // Verify that docker run mounts the isolated sanitized settings directory
+            expect(spawn).toHaveBeenNthCalledWith(2, 'docker', expect.arrayContaining([
+                '--volume',
+                expect.stringMatching(/cell-sandbox.*:[\\/]home[\\/]node[\\/]\.cell-cli:rw$/),
+            ]), expect.any(Object));
+            // Verify that ephemeral sandbox directory permissions are restricted to owner (0o700)
+            expect(fs.chmodSync).toHaveBeenCalledWith(expect.stringContaining('cell-sandbox-'), 0o700);
+        });
+        it('should tolerate chmod errors on non-POSIX filesystems without crashing', async () => {
+            const config = createMockSandboxConfig({
+                command: 'docker',
+                image: 'cell-cli-sandbox',
+            });
+            vi.mocked(fs.existsSync).mockReturnValue(true);
+            vi.mocked(fs.chmodSync).mockImplementationOnce(() => {
+                throw new Error('EPERM: operation not permitted');
+            });
+            const mockImageCheckProcess = new EventEmitter();
+            mockImageCheckProcess.stdout = new EventEmitter();
+            vi.mocked(spawn).mockImplementationOnce(() => {
+                setTimeout(() => {
+                    mockImageCheckProcess.stdout.emit('data', Buffer.from('image-id'));
+                    mockImageCheckProcess.emit('close', 0);
+                }, 1);
+                return mockImageCheckProcess;
+            });
+            const mockSpawnProcess = new EventEmitter();
+            mockSpawnProcess.on = vi.fn().mockImplementation((event, cb) => {
+                if (event === 'close') {
+                    setTimeout(() => cb(0), 10);
+                }
+                return mockSpawnProcess;
+            });
+            vi.mocked(spawn).mockImplementationOnce(() => mockSpawnProcess);
+            await expect(start_sandbox(config)).resolves.toBe(0);
+        });
         it('should handle allowedPaths in Docker', async () => {
             const config = createMockSandboxConfig({
                 command: 'docker',
@@ -497,6 +750,161 @@ describe('sandbox', () => {
             await start_sandbox(config);
             expect(spawn).toHaveBeenCalledWith('docker', expect.arrayContaining(['--volume', '/extra/path:/extra/path:ro']), expect.any(Object));
         });
+        it('should reject sensitive host mounts in SANDBOX_MOUNTS with FatalSandboxError', async () => {
+            const config = createMockSandboxConfig({
+                command: 'docker',
+                image: 'cell-cli-sandbox',
+            });
+            vi.stubEnv('SANDBOX_MOUNTS', '/home/user/.cell-cli:/mnt:rw');
+            const mockImageCheckProcess = new EventEmitter();
+            mockImageCheckProcess.stdout = new EventEmitter();
+            vi.mocked(spawn).mockImplementationOnce(() => {
+                setTimeout(() => {
+                    mockImageCheckProcess.stdout.emit('data', Buffer.from('image-id'));
+                    mockImageCheckProcess.emit('close', 0);
+                }, 1);
+                return mockImageCheckProcess;
+            });
+            await expect(start_sandbox(config)).rejects.toThrow(FatalSandboxError);
+        });
+        it('should reject running container sandbox from a sensitive working directory with FatalSandboxError', async () => {
+            const config = createMockSandboxConfig({
+                command: 'docker',
+                image: 'cell-cli-sandbox',
+            });
+            const cwdSpy = vi.spyOn(process, 'cwd').mockReturnValue('/home/user');
+            try {
+                const mockImageCheckProcess = new EventEmitter();
+                mockImageCheckProcess.stdout = new EventEmitter();
+                vi.mocked(spawn).mockImplementationOnce(() => {
+                    setTimeout(() => {
+                        mockImageCheckProcess.stdout.emit('data', Buffer.from('image-id'));
+                        mockImageCheckProcess.emit('close', 0);
+                    }, 1);
+                    return mockImageCheckProcess;
+                });
+                const targetWorkdir = path.resolve('/home/user');
+                await expect(start_sandbox(config)).rejects.toThrow(new RegExp(`Running sandbox from a sensitive host directory '${targetWorkdir.replace(/\\/g, '\\\\')}' is strictly prohibited`));
+            }
+            finally {
+                cwdSpy.mockRestore();
+            }
+        });
+        it('should reject running container sandbox when cliConfig targetDir is sensitive with FatalSandboxError', async () => {
+            const config = createMockSandboxConfig({
+                command: 'docker',
+                image: 'cell-cli-sandbox',
+            });
+            const targetDir = path.resolve('/home/user/.cell-cli');
+            const mockCliConfig = {
+                getTargetDir: vi.fn().mockReturnValue(targetDir),
+                getDebugMode: vi.fn().mockReturnValue(false),
+            };
+            const mockImageCheckProcess = new EventEmitter();
+            mockImageCheckProcess.stdout = new EventEmitter();
+            vi.mocked(spawn).mockImplementationOnce(() => {
+                setTimeout(() => {
+                    mockImageCheckProcess.stdout.emit('data', Buffer.from('image-id'));
+                    mockImageCheckProcess.emit('close', 0);
+                }, 1);
+                return mockImageCheckProcess;
+            });
+            await expect(start_sandbox(config, [], mockCliConfig)).rejects.toThrow(new RegExp(`Running sandbox from a sensitive host directory '${targetDir.replace(/\\/g, '\\\\')}' is strictly prohibited`));
+        });
+        it('should reject running macOS seatbelt sandbox from a sensitive working directory with FatalSandboxError', async () => {
+            vi.mocked(os.platform).mockReturnValue('darwin');
+            const config = createMockSandboxConfig({
+                command: 'sandbox-exec',
+                image: 'some-image',
+            });
+            const targetDir = path.resolve('/home/user');
+            const cwdSpy = vi.spyOn(process, 'cwd').mockReturnValue(targetDir);
+            try {
+                await expect(start_sandbox(config)).rejects.toThrow(new RegExp(`Running sandbox from a sensitive host directory '${targetDir.replace(/\\/g, '\\\\')}' is strictly prohibited`));
+            }
+            finally {
+                cwdSpy.mockRestore();
+            }
+        });
+        it('should reject running LXC sandbox from a sensitive working directory with FatalSandboxError', async () => {
+            const config = createMockSandboxConfig({
+                command: 'lxc',
+                image: 'cell-sandbox',
+            });
+            const targetDir = path.resolve('/home/user');
+            const cwdSpy = vi.spyOn(process, 'cwd').mockReturnValue(targetDir);
+            try {
+                await expect(start_sandbox(config)).rejects.toThrow(new RegExp(`Running sandbox from a sensitive host directory '${targetDir.replace(/\\/g, '\\\\')}' is strictly prohibited`));
+            }
+            finally {
+                cwdSpy.mockRestore();
+            }
+        });
+        it('should skip sensitive workspace directory in macOS seatbelt includedDirs', async () => {
+            vi.mocked(os.platform).mockReturnValue('darwin');
+            const config = createMockSandboxConfig({
+                command: 'sandbox-exec',
+                image: 'some-image',
+            });
+            const safeWorkspace = path.resolve('/safe/workspace');
+            const safeOther = path.resolve('/safe/other');
+            const sensitiveUser = path.resolve('/home/user');
+            const mockCliConfig = {
+                getTargetDir: vi.fn().mockReturnValue(safeWorkspace),
+                getDebugMode: vi.fn().mockReturnValue(false),
+                getWorkspaceContext: vi.fn().mockReturnValue({
+                    getDirectories: vi
+                        .fn()
+                        .mockReturnValue([safeWorkspace, sensitiveUser, safeOther]),
+                }),
+            };
+            const mockSpawnProcess = new EventEmitter();
+            mockSpawnProcess.stdout = new EventEmitter();
+            mockSpawnProcess.stderr = new EventEmitter();
+            vi.mocked(spawn).mockReturnValue(mockSpawnProcess);
+            const promise = start_sandbox(config, [], mockCliConfig);
+            setTimeout(() => mockSpawnProcess.emit('close', 0), 10);
+            await promise;
+            const spawnArgs = vi.mocked(spawn).mock.calls[0][1];
+            expect(spawnArgs).toContain(`INCLUDE_DIR_0=${safeOther}`);
+            const includeDirs = spawnArgs.filter((arg) => arg.startsWith('INCLUDE_DIR_'));
+            expect(includeDirs.some((arg) => arg.includes(sensitiveUser))).toBe(false);
+        });
+        it('should ignore sensitive paths in allowedPaths', async () => {
+            const config = createMockSandboxConfig({
+                command: 'docker',
+                image: 'cell-cli-sandbox',
+                allowedPaths: ['/home/user/.cell-cli', '/safe/extra/path'],
+            });
+            vi.mocked(fs.existsSync).mockReturnValue(true);
+            const mockImageCheckProcess = new EventEmitter();
+            mockImageCheckProcess.stdout = new EventEmitter();
+            vi.mocked(spawn).mockImplementationOnce(() => {
+                setTimeout(() => {
+                    mockImageCheckProcess.stdout.emit('data', Buffer.from('image-id'));
+                    mockImageCheckProcess.emit('close', 0);
+                }, 1);
+                return mockImageCheckProcess;
+            });
+            const mockSpawnProcess = new EventEmitter();
+            mockSpawnProcess.on = vi.fn().mockImplementation((event, cb) => {
+                if (event === 'close') {
+                    setTimeout(() => cb(0), 10);
+                }
+                return mockSpawnProcess;
+            });
+            vi.mocked(spawn).mockImplementationOnce(() => mockSpawnProcess);
+            await start_sandbox(config);
+            const runCalls = vi
+                .mocked(spawn)
+                .mock.calls.filter((call) => call[0] === 'docker' &&
+                Array.isArray(call[1]) &&
+                call[1].includes('run'));
+            expect(runCalls.length).toBe(1);
+            const runArgs = runCalls[0][1];
+            expect(runArgs).toContain('/safe/extra/path:/safe/extra/path:ro');
+            expect(runArgs.some((arg) => typeof arg === 'string' && arg.includes('/home/user/.cell-cli:'))).toBe(false);
+        });
         it('should handle networkAccess: false in Docker', async () => {
             const config = createMockSandboxConfig({
                 command: 'docker',
@@ -606,7 +1014,7 @@ describe('sandbox', () => {
             });
             vi.mocked(spawn).mockImplementationOnce(() => mockSpawnProcess);
             await start_sandbox(config);
-            expect(spawn).toHaveBeenCalledWith('docker', expect.arrayContaining(['--user', 'root', '--env', 'HOME=/home/user']), expect.any(Object));
+            expect(spawn).toHaveBeenCalledWith('docker', expect.arrayContaining(['--user', 'root', '--env', 'HOME=/home/node']), expect.any(Object));
             // Check that the entrypoint command includes the defensive useradd check
             const args = vi.mocked(spawn).mock.calls[1][1];
             const entrypointCmd = args[args.length - 1];