@namzu/sandbox 2.0.1 → 2.0.3

package/dist/egress/__tests__/proxy.test.js

@@ -1,177 +0,0 @@
-import { createServer, request as nodeRequest } from 'node:http';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { EgressProxy } from '../proxy.js';
-/**
- * Until this existed, an egress policy could be declared and only two of
- * its four shapes could be honoured anywhere: the container backend
- * refused a host allowlist outright because it had no proxy to filter
- * through. `deny-all` and `allow-all` were the whole spectrum — all or
- * nothing.
- *
- * It also settles where credentials live. Any token the agent needed to
- * reach an allowed host had to be INSIDE the sandbox, in the environment,
- * readable by the untrusted code it is meant to be isolated from — via
- * `/proc/self/environ`, or via a prompt injection that exfiltrates it over
- * the very egress the policy permits.
- */
-/** A stand-in upstream that reports what it was sent. */
-function upstream() {
-    const seen = [];
-    const server = createServer((req, res) => {
-        seen.push(req);
-        res.writeHead(200, { 'content-type': 'text/plain' });
-        res.end('upstream ok');
-    });
-    return new Promise((resolve) => {
-        server.listen(0, '127.0.0.1', () => {
-            const address = server.address();
-            const port = typeof address === 'object' && address !== null ? address.port : 0;
-            resolve({ server, port, seen });
-        });
-    });
-}
-/**
- * Issue a request THROUGH the proxy, the way a proxied client does: the
- * absolute URL goes in the request line.
- *
- * `fetch` cannot express this — it owns the `Host` header and refuses an
- * override, so a request built with it names the proxy as its own target.
- * The first version of this helper did exactly that, and the proxy
- * forwarded to itself and hung. That hang is now a 400, and this helper
- * speaks the protocol properly.
- */
-function viaProxy(proxy, target, init = {}) {
-    const proxyUrl = new URL(proxy.url);
-    return new Promise((resolve, reject) => {
-        const req = nodeRequest({
-            host: proxyUrl.hostname,
-            port: Number(proxyUrl.port),
-            method: 'GET',
-            // Absolute-URI form: what distinguishes a proxied request.
-            path: target,
-            headers: init.headers ?? {},
-        }, (res) => {
-            let body = '';
-            res.setEncoding('utf-8');
-            res.on('data', (chunk) => {
-                body += chunk;
-            });
-            res.on('end', () => resolve({ status: res.statusCode ?? 0, body }));
-        });
-        req.on('error', reject);
-        req.end();
-    });
-}
-describe('the boundary', () => {
-    let proxy;
-    let allowed;
-    let denied;
-    let target;
-    beforeEach(async () => {
-        target = await upstream();
-        allowed = ['127.0.0.1'];
-        denied = [];
-        proxy = await new EgressProxy({
-            allowedHosts: async () => allowed,
-            // The stand-in upstream speaks plain HTTP.
-            upgradeToHttps: false,
-            onDenied: (host, reason) => denied.push({ host, reason }),
-        }).listen();
-    });
-    afterEach(async () => {
-        await proxy.close();
-        await new Promise((resolve) => target.server.close(() => resolve()));
-    });
-    it('lets an allowed host through', async () => {
-        const res = await viaProxy(proxy, `http://127.0.0.1:${target.port}/thing`);
-        expect(res.status).toBe(200);
-        expect(res.body).toBe('upstream ok');
-    });
-    it('refuses a host that is not on the list', async () => {
-        allowed = ['example.com'];
-        const res = await viaProxy(proxy, `http://127.0.0.1:${target.port}/thing`);
-        expect(res.status).toBe(403);
-        // Never reached the upstream at all — the refusal is the point, not
-        // the response code.
-        expect(target.seen).toHaveLength(0);
-    });
-    it('names the host it refused', async () => {
-        allowed = [];
-        const res = await viaProxy(proxy, `http://127.0.0.1:${target.port}/thing`);
-        // An agent that cannot tell "not permitted" from "network down"
-        // retries forever, and a human debugging it has nothing to go on.
-        expect(res.body).toContain('127.0.0.1');
-        expect(denied[0]?.host).toBe('127.0.0.1');
-    });
-    it('denies when the policy cannot be read', async () => {
-        // An allowlist that fails open is not an allowlist.
-        const failing = await new EgressProxy({
-            allowedHosts: async () => {
-                throw new Error('policy service unavailable');
-            },
-            upgradeToHttps: false,
-        }).listen();
-        try {
-            const res = await viaProxy(failing, `http://127.0.0.1:${target.port}/thing`);
-            expect(res.status).toBe(403);
-        }
-        finally {
-            await failing.close();
-        }
-    });
-    it('re-reads the policy per request, so a rotating allowlist is honoured', async () => {
-        allowed = [];
-        expect((await viaProxy(proxy, `http://127.0.0.1:${target.port}/a`)).status).toBe(403);
-        allowed = ['127.0.0.1'];
-        expect((await viaProxy(proxy, `http://127.0.0.1:${target.port}/b`)).status).toBe(200);
-    });
-    it('can be narrowed on a live proxy', async () => {
-        // "Clone with a token, then drop to deny-all before running
-        // untrusted build scripts" was not expressible at all: the policy
-        // was frozen at provider construction.
-        expect((await viaProxy(proxy, `http://127.0.0.1:${target.port}/a`)).status).toBe(200);
-        proxy.setAllowedHosts(async () => []);
-        expect((await viaProxy(proxy, `http://127.0.0.1:${target.port}/b`)).status).toBe(403);
-    });
-});
-describe('brokering a credential', () => {
-    let proxy;
-    let target;
-    beforeEach(async () => {
-        target = await upstream();
-    });
-    afterEach(async () => {
-        await proxy.close();
-        await new Promise((resolve) => target.server.close(() => resolve()));
-    });
-    const withCredentials = async (host) => {
-        proxy = await new EgressProxy({
-            allowedHosts: async () => ['127.0.0.1'],
-            upgradeToHttps: false,
-            credentials: [{ host, header: 'authorization', value: 'Bearer real-secret' }],
-        }).listen();
-        return proxy;
-    };
-    it('stamps the real value on at the boundary', async () => {
-        const p = await withCredentials('127.0.0.1');
-        await viaProxy(p, `http://127.0.0.1:${target.port}/thing`);
-        // The token never entered the sandbox — a placeholder did, and the
-        // value was applied here.
-        expect(target.seen[0]?.headers.authorization).toBe('Bearer real-secret');
-    });
-    it('sends it only to the host it belongs to', async () => {
-        // A credential attached to every request is a credential handed to
-        // whichever host the agent was talked into contacting.
-        const p = await withCredentials('other.example.com');
-        await viaProxy(p, `http://127.0.0.1:${target.port}/thing`);
-        expect(target.seen[0]?.headers.authorization).toBeUndefined();
-    });
-    it('does not forward the hop-by-hop proxy header onward', async () => {
-        const p = await withCredentials('127.0.0.1');
-        await viaProxy(p, `http://127.0.0.1:${target.port}/thing`, {
-            headers: { 'proxy-authorization': 'Basic should-not-travel' },
-        });
-        expect(target.seen[0]?.headers['proxy-authorization']).toBeUndefined();
-    });
-});
-//# sourceMappingURL=proxy.test.js.map

package/dist/egress/__tests__/proxy.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"proxy.test.js","sourceRoot":"","sources":["../../../src/egress/__tests__/proxy.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAA;AAEhE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAEpE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAGzC;;;;;;;;;;;;GAYG;AAEH,yDAAyD;AACzD,SAAS,QAAQ;IAChB,MAAM,IAAI,GAAsB,EAAE,CAAA;IAClC,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;QACzE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACd,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;QACpD,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IACvB,CAAC,CAAC,CAAA;IACF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YAClC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAA;YAChC,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;YAC/E,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAChC,CAAC,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,QAAQ,CAChB,KAAyB,EACzB,MAAc,EACd,OAA6C,EAAE;IAE/C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACnC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,GAAG,GAAG,WAAW,CACtB;YACC,IAAI,EAAE,QAAQ,CAAC,QAAQ;YACvB,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC3B,MAAM,EAAE,KAAK;YACb,2DAA2D;YAC3D,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE;SAC3B,EACD,CAAC,GAAG,EAAE,EAAE;YACP,IAAI,IAAI,GAAG,EAAE,CAAA;YACb,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;YACxB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAChC,IAAI,IAAI,KAAK,CAAA;YACd,CAAC,CAAC,CAAA;YACF,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QACpE,CAAC,CACD,CAAA;QACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACvB,GAAG,CAAC,GAAG,EAAE,CAAA;IACV,CAAC,CAAC,CAAA;AACH,CAAC;AAED,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC7B,IAAI,KAAyB,CAAA;IAC7B,IAAI,OAAiB,CAAA;IACrB,IAAI,MAA+C,CAAA;IACnD,IAAI,MAA4C,CAAA;IAEhD,UAAU,CAAC,KAAK,IAAI,EAAE;QACrB,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAA;QACzB,OAAO,GAAG,CAAC,WAAW,CAAC,CAAA;QACvB,MAAM,GAAG,EAAE,CAAA;QACX,KAAK,GAAG,MAAM,IAAI,WAAW,CAAC;YAC7B,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,OAAO;YACjC,2CAA2C;YAC3C,cAAc,EAAE,KAAK;YACrB,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;SACzD,CAAC,CAAC,MAAM,EAAE,CAAA;IACZ,CAAC,CAAC,CAAA;IAEF,SAAS,CAAC,KAAK,IAAI,EAAE;QACpB,MAAM,KAAK,CAAC,KAAK,EAAE,CAAA;QACnB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,oBAAoB,MAAM,CAAC,IAAI,QAAQ,CAAC,CAAA;QAC1E,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACvD,OAAO,GAAG,CAAC,aAAa,CAAC,CAAA;QACzB,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,oBAAoB,MAAM,CAAC,IAAI,QAAQ,CAAC,CAAA;QAE1E,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,oEAAoE;QACpE,qBAAqB;QACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IACpC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QAC1C,OAAO,GAAG,EAAE,CAAA;QACZ,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,oBAAoB,MAAM,CAAC,IAAI,QAAQ,CAAC,CAAA;QAE1E,gEAAgE;QAChE,kEAAkE;QAClE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;QACvC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACtD,oDAAoD;QACpD,MAAM,OAAO,GAAG,MAAM,IAAI,WAAW,CAAC;YACrC,YAAY,EAAE,KAAK,IAAI,EAAE;gBACxB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAC9C,CAAC;YACD,cAAc,EAAE,KAAK;SACrB,CAAC,CAAC,MAAM,EAAE,CAAA;QAEX,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,oBAAoB,MAAM,CAAC,IAAI,QAAQ,CAAC,CAAA;YAC5E,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC7B,CAAC;gBAAS,CAAC;YACV,MAAM,OAAO,CAAC,KAAK,EAAE,CAAA;QACtB,CAAC;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACrF,OAAO,GAAG,EAAE,CAAA;QACZ,MAAM,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,oBAAoB,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAErF,OAAO,GAAG,CAAC,WAAW,CAAC,CAAA;QACvB,MAAM,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,oBAAoB,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACtF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAChD,4DAA4D;QAC5D,kEAAkE;QAClE,uCAAuC;QACvC,MAAM,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,oBAAoB,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAErF,KAAK,CAAC,eAAe,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;QACrC,MAAM,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,oBAAoB,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACtF,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACvC,IAAI,KAAyB,CAAA;IAC7B,IAAI,MAA4C,CAAA;IAEhD,UAAU,CAAC,KAAK,IAAI,EAAE;QACrB,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,SAAS,CAAC,KAAK,IAAI,EAAE;QACpB,MAAM,KAAK,CAAC,KAAK,EAAE,CAAA;QACnB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;IAEF,MAAM,eAAe,GAAG,KAAK,EAAE,IAAY,EAAE,EAAE;QAC9C,KAAK,GAAG,MAAM,IAAI,WAAW,CAAC;YAC7B,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC;YACvC,cAAc,EAAE,KAAK;YACrB,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;SAC7E,CAAC,CAAC,MAAM,EAAE,CAAA;QACX,OAAO,KAAK,CAAA;IACb,CAAC,CAAA;IAED,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAA;QAC5C,MAAM,QAAQ,CAAC,CAAC,EAAE,oBAAoB,MAAM,CAAC,IAAI,QAAQ,CAAC,CAAA;QAE1D,mEAAmE;QACnE,0BAA0B;QAC1B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;IACzE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACxD,mEAAmE;QACnE,uDAAuD;QACvD,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,mBAAmB,CAAC,CAAA;QACpD,MAAM,QAAQ,CAAC,CAAC,EAAE,oBAAoB,MAAM,CAAC,IAAI,QAAQ,CAAC,CAAA;QAE1D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,aAAa,EAAE,CAAA;IAC9D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAA;QAC5C,MAAM,QAAQ,CAAC,CAAC,EAAE,oBAAoB,MAAM,CAAC,IAAI,QAAQ,EAAE;YAC1D,OAAO,EAAE,EAAE,qBAAqB,EAAE,yBAAyB,EAAE;SAC7D,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;IACvE,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA"}

package/dist/index.test.d.ts

@@ -1,28 +0,0 @@
-/**
- * Behavioural contract for `createSandboxProvider`, `resolveLayout`,
- * and `renderLayoutMountArgs`:
- *
- * - Builds a `SandboxProvider` for the `container:docker` tier
- *   without spawning anything (the container only spawns on
- *   `provider.create()`, not at construction time). The provider
- *   carries a layout baked in at construction; per-task hosts
- *   construct one provider per task.
- * - Throws `SandboxBackendNotImplementedError` for tiers the docker
- *   backend has not landed yet, with a label that names the missing
- *   tier and concrete service.
- * - Layout validation happens synchronously inside
- *   `createSandboxProvider`; `ContainerSandboxLayoutValidationError` exposes
- *   a `reasons` array so consumers see every violation in one
- *   round-trip.
- * - Every `--volume` source rendered by the docker backend traces
- *   back to a layout `hostDir.hostPath` declared by the consumer —
- *   pinned here as a regression guard against the old `mkdtemp`-
- *   allocated workspace path that hit EACCES in sibling-container
- *   deployments.
- *
- * Docker-touching integration tests live under
- * `backends/docker/__tests__/` and skip when `docker` isn't
- * available; this file stays pure-unit.
- */
-export {};
-//# sourceMappingURL=index.test.d.ts.map

package/dist/index.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.test.d.ts","sourceRoot":"","sources":["../src/index.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG"}