@phuetz/code-buddy 1.6.0 → 2.0.0

package/dist/sandbox/docker-sandbox.js

@@ -7,6 +7,8 @@
 import { execSync, spawn, spawnSync } from 'child_process';
 import { randomUUID } from 'crypto';
 import { EventEmitter } from 'events';
+import * as fs from 'fs';
+import * as path from 'path';
 // ============================================================================
 // Default Configuration
 // ============================================================================
@@ -17,7 +19,50 @@ const DEFAULT_CONFIG = {
     cpuLimit: '1.0',
     networkEnabled: false,
     readOnly: false,
+    runAsHostUser: true,
+    environment: {},
+    preserveWorkspacePath: false,
 };
+const DEFAULT_DOCKER_PROBE_TTL_MS = 30_000;
+const MAX_IMAGE_PROBE_CACHE_ENTRIES = 32;
+let availabilityProbeCache = null;
+let availabilityProbeInFlight = null;
+const imageProbeCache = new Map();
+const imageProbeInFlight = new Map();
+let probeCacheGeneration = 0;
+function dockerProbeContextKey() {
+    return JSON.stringify([
+        process.env.DOCKER_HOST || '',
+        process.env.DOCKER_CONTEXT || '',
+        process.env.DOCKER_TLS_VERIFY || '',
+        process.env.DOCKER_CERT_PATH || '',
+        process.env.DOCKER_CONFIG || '',
+    ]);
+}
+function resolveProbeTtlMs(options) {
+    const ttlMs = options.ttlMs ?? DEFAULT_DOCKER_PROBE_TTL_MS;
+    if (!Number.isFinite(ttlMs))
+        return DEFAULT_DOCKER_PROBE_TTL_MS;
+    return Math.max(0, Math.min(300_000, Math.trunc(ttlMs)));
+}
+/** Defer the synchronous compatibility probe so concurrent callers can join it. */
+function runSingleFlightProbe(probe) {
+    return new Promise(resolve => {
+        setImmediate(() => resolve(probe()));
+    });
+}
+function pruneImageProbeCache(now) {
+    for (const [key, entry] of imageProbeCache) {
+        if (entry.expiresAt <= now)
+            imageProbeCache.delete(key);
+    }
+    while (imageProbeCache.size > MAX_IMAGE_PROBE_CACHE_ENTRIES) {
+        const oldestKey = imageProbeCache.keys().next().value;
+        if (!oldestKey)
+            break;
+        imageProbeCache.delete(oldestKey);
+    }
+}
 // ============================================================================
 // Docker Sandbox
 // ============================================================================
@@ -68,16 +113,129 @@ export class DockerSandbox extends EventEmitter {
     }
     /**
      * Check if Docker is available on the system.
+     *
+     * The sandbox only ever runs Linux images with Linux-only flags
+     * (`--read-only`, `--tmpfs`, `--cap-drop`, `--pids-limit`), so a daemon in
+     * Windows-containers mode (the default on Windows CI runners) is reported as
+     * unavailable instead of failing every command with
+     * "read-only mode is not supported for Windows containers".
      */
     static isAvailable() {
         try {
-            execSync('docker info', { stdio: 'pipe', timeout: 10000 });
+            const output = execSync('docker info --format {{.OSType}}', { stdio: 'pipe', timeout: 10000 });
+            // Only an explicit Windows daemon degrades; an empty answer (older
+            // daemons, partial output) keeps "daemon answered ⇒ available".
+            return String(output ?? '').trim().toLowerCase() !== 'windows';
+        }
+        catch {
+            // The format probe itself may be unsupported (a docker→podman shim
+            // answers "can't evaluate field OSType", exit 125): fall back to the
+            // historical liveness probe so such daemons stay available.
+            try {
+                execSync('docker info', { stdio: 'pipe', timeout: 10000 });
+                return true;
+            }
+            catch {
+                return false;
+            }
+        }
+    }
+    /**
+     * Cached Docker daemon probe for hot command paths. Only successful probes
+     * are cached, and a launcher failure invalidates that success immediately.
+     */
+    static async isAvailableCached(options = {}) {
+        const key = dockerProbeContextKey();
+        const now = Date.now();
+        const ttlMs = resolveProbeTtlMs(options);
+        if (!options.force &&
+            availabilityProbeCache?.key === key &&
+            availabilityProbeCache.expiresAt > now) {
             return true;
         }
+        if (availabilityProbeInFlight?.key === key) {
+            return availabilityProbeInFlight.promise;
+        }
+        const generation = probeCacheGeneration;
+        const promise = runSingleFlightProbe(() => DockerSandbox.isAvailable())
+            .then(available => {
+            if (available && ttlMs > 0 && generation === probeCacheGeneration) {
+                availabilityProbeCache = { key, expiresAt: Date.now() + ttlMs };
+            }
+            return available;
+        })
+            .finally(() => {
+            if (availabilityProbeInFlight?.promise === promise) {
+                availabilityProbeInFlight = null;
+            }
+        });
+        availabilityProbeInFlight = { key, promise };
+        return promise;
+    }
+    /** Check for a pre-built local image without pulling or invoking a shell. */
+    static hasLocalImage(image) {
+        if (!image || image.includes('\0') || image.includes('\n') || image.includes('\r')) {
+            return false;
+        }
+        try {
+            const result = spawnSync('docker', ['image', 'inspect', image], {
+                stdio: 'ignore',
+                timeout: 10000,
+            });
+            return result.status === 0;
+        }
         catch {
             return false;
         }
     }
+    /** Cached, single-flight variant used by the workspace fallback selector. */
+    static async hasLocalImageCached(image, options = {}) {
+        if (!image || image.includes('\0') || image.includes('\n') || image.includes('\r')) {
+            return false;
+        }
+        const key = `${dockerProbeContextKey()}\0${image}`;
+        const now = Date.now();
+        const ttlMs = resolveProbeTtlMs(options);
+        pruneImageProbeCache(now);
+        if (!options.force && (imageProbeCache.get(key)?.expiresAt ?? 0) > now) {
+            return true;
+        }
+        const inFlight = imageProbeInFlight.get(key);
+        if (inFlight)
+            return inFlight;
+        const generation = probeCacheGeneration;
+        const promise = runSingleFlightProbe(() => DockerSandbox.hasLocalImage(image))
+            .then(available => {
+            if (available && ttlMs > 0 && generation === probeCacheGeneration) {
+                imageProbeCache.delete(key);
+                imageProbeCache.set(key, { expiresAt: Date.now() + ttlMs });
+                pruneImageProbeCache(Date.now());
+            }
+            return available;
+        })
+            .finally(() => {
+            if (imageProbeInFlight.get(key) === promise)
+                imageProbeInFlight.delete(key);
+        });
+        imageProbeInFlight.set(key, promise);
+        return promise;
+    }
+    /** Drop cached Docker assumptions after a daemon/launcher failure. */
+    static invalidateProbeCache(image) {
+        probeCacheGeneration++;
+        availabilityProbeCache = null;
+        availabilityProbeInFlight = null;
+        imageProbeInFlight.clear();
+        if (!image) {
+            imageProbeCache.clear();
+            return;
+        }
+        const suffix = `\0${image}`;
+        for (const key of imageProbeCache.keys()) {
+            if (key.endsWith(suffix))
+                imageProbeCache.delete(key);
+        }
+    }
     /**
      * Instance-level availability check (satisfies SandboxBackendInterface).
      */
@@ -89,6 +247,7 @@ export class DockerSandbox extends EventEmitter {
      */
     async execute(command, opts) {
         const merged = { ...this.config, ...opts };
+        const signal = opts && 'signal' in opts ? opts.signal : undefined;
         const containerName = `codebuddy-sandbox-${randomUUID().slice(0, 8)}`;
         const startTime = Date.now();
         const args = this.buildDockerArgs(containerName, merged, command);
@@ -97,7 +256,7 @@ export class DockerSandbox extends EventEmitter {
             let stdout = '';
             let stderr = '';
             let timedOut = false;
-            let killed = false;
+            let aborted = false;
             this.activeContainers.add(containerName);
             globalActiveContainers.add(containerName);
             this.emit('container:started', containerName);
@@ -109,7 +268,6 @@ export class DockerSandbox extends EventEmitter {
             });
             const timer = setTimeout(() => {
                 timedOut = true;
-                killed = true;
                 // Kill the container on timeout
                 try {
                     spawnSync('docker', ['kill', containerName], { stdio: 'pipe', timeout: 5000 });
@@ -119,14 +277,43 @@ export class DockerSandbox extends EventEmitter {
                 }
                 proc.kill('SIGKILL');
             }, merged.timeout);
+            const onAbort = () => {
+                aborted = true;
+                try {
+                    spawnSync('docker', ['kill', containerName], { stdio: 'pipe', timeout: 5000 });
+                }
+                catch {
+                    // Container may not have reached its running state yet.
+                }
+                try {
+                    proc.kill('SIGTERM');
+                }
+                catch { /* launcher already exited */ }
+            };
+            signal?.addEventListener('abort', onAbort, { once: true });
+            if (signal?.aborted)
+                onAbort();
             proc.on('close', (code) => {
                 clearTimeout(timer);
+                signal?.removeEventListener('abort', onAbort);
                 this.activeContainers.delete(containerName);
                 globalActiveContainers.delete(containerName);
                 this.emit('container:stopped', containerName);
                 const exitCode = code ?? 1;
+                if (exitCode === 125)
+                    DockerSandbox.invalidateProbeCache(merged.image);
                 const durationMs = Date.now() - startTime;
-                if (timedOut) {
+                if (aborted) {
+                    resolve({
+                        success: false,
+                        output: stdout,
+                        error: 'Command aborted by user',
+                        exitCode: 130,
+                        durationMs,
+                        containerId: containerName,
+                    });
+                }
+                else if (timedOut) {
                     resolve({
                         success: false,
                         output: stdout,
@@ -149,9 +336,11 @@ export class DockerSandbox extends EventEmitter {
             });
             proc.on('error', (err) => {
                 clearTimeout(timer);
+                signal?.removeEventListener('abort', onAbort);
                 this.activeContainers.delete(containerName);
                 globalActiveContainers.delete(containerName);
                 this.emit('container:stopped', containerName);
+                DockerSandbox.invalidateProbeCache(merged.image);
                 resolve({
                     success: false,
                     output: '',
@@ -212,6 +401,8 @@ export class DockerSandbox extends EventEmitter {
                 this.activeContainers.delete(containerName);
                 globalActiveContainers.delete(containerName);
                 this.emit('container:stopped', containerName);
+                if ((code ?? 1) === 125)
+                    DockerSandbox.invalidateProbeCache(merged.image);
                 if (resolveChunk) {
                     const r = resolveChunk;
                     resolveChunk = null;
@@ -225,6 +416,7 @@ export class DockerSandbox extends EventEmitter {
                 this.activeContainers.delete(containerName);
                 globalActiveContainers.delete(containerName);
                 this.emit('container:stopped', containerName);
+                DockerSandbox.invalidateProbeCache(merged.image);
                 if (resolveChunk) {
                     const r = resolveChunk;
                     resolveChunk = null;
@@ -239,7 +431,9 @@ export class DockerSandbox extends EventEmitter {
                 yield chunks.shift();
             }
             else if (!streamDone) {
-                await new Promise((r) => { resolveChunk = r; });
+                await new Promise((r) => {
+                    resolveChunk = r;
+                });
             }
         }
         const exitCode = await exitPromise;
@@ -247,7 +441,7 @@ export class DockerSandbox extends EventEmitter {
         return {
             success: timedOut ? false : exitCode === 0,
             output: stdout,
-            error: timedOut ? `Command timed out after ${merged.timeout}ms` : (stderr || undefined),
+            error: timedOut ? `Command timed out after ${merged.timeout}ms` : stderr || undefined,
             exitCode,
             durationMs,
             containerId: containerName,
@@ -273,7 +467,10 @@ export class DockerSandbox extends EventEmitter {
      */
     async prune() {
         try {
-            const output = execSync('docker container prune -f --filter label=codebuddy-sandbox=true', { stdio: 'pipe', timeout: 30000 }).toString();
+            const output = execSync('docker container prune -f --filter label=codebuddy-sandbox=true', {
+                stdio: 'pipe',
+                timeout: 30000,
+            }).toString();
             const match = output.match(/Deleted Containers:\n([\s\S]*?)\n\n/);
             if (match && match[1]) {
                 return match[1].split('\n').filter((l) => l.trim()).length;
@@ -315,30 +512,108 @@ export class DockerSandbox extends EventEmitter {
      * Build docker run arguments.
      */
     buildDockerArgs(containerName, config, command) {
+        const workspace = config.workspaceMount ? path.resolve(config.workspaceMount) : null;
+        const containerWorkspace = workspace
+            ? config.preserveWorkspacePath && process.platform !== 'win32'
+                ? workspace
+                : '/workspace'
+            : null;
         const args = [
-            'run', '--rm',
-            '--name', containerName,
-            '--label', 'codebuddy-sandbox=true',
-            '-m', config.memoryLimit,
-            '--cpus', config.cpuLimit,
+            'run',
+            '--rm',
+            '--name',
+            containerName,
+            '--label',
+            'codebuddy-sandbox=true',
+            '--init',
+            '--cap-drop',
+            'ALL',
+            '--security-opt',
+            'no-new-privileges:true',
+            '--pids-limit',
+            '512',
+            '-m',
+            config.memoryLimit,
+            '--cpus',
+            config.cpuLimit,
         ];
+        // A caller may intentionally select /tmp itself as the workspace. Docker
+        // rejects two mounts with that exact destination, so in that one case the
+        // bind mount supplies writable temporary storage instead of a tmpfs.
+        if (containerWorkspace !== '/tmp') {
+            args.push('--tmpfs', '/tmp:rw,nosuid,nodev,size=512m');
+        }
         if (!config.networkEnabled) {
             args.push('--network', 'none');
         }
         if (config.readOnly) {
             args.push('--read-only');
         }
+        if (config.runAsHostUser &&
+            process.platform !== 'win32' &&
+            typeof process.getuid === 'function' &&
+            typeof process.getgid === 'function') {
+            args.push('--user', `${process.getuid()}:${process.getgid()}`);
+        }
         if (config.workspaceMount) {
             if (config.workspaceMount.includes('..') || config.workspaceMount.includes('\0')) {
                 throw new Error('Invalid workspace mount path');
             }
-            args.push('-v', `${config.workspaceMount}:/workspace`, '-w', '/workspace');
+            if (!workspace || !containerWorkspace) {
+                throw new Error('Failed to resolve workspace mount path');
+            }
+            args.push('-v', `${workspace}:${containerWorkspace}`, '-w', containerWorkspace);
+            for (const relativePath of config.workspaceReadOnly ?? []) {
+                const normalizedRelative = relativePath.replace(/\\/g, '/').replace(/^\/+/, '');
+                if (!normalizedRelative ||
+                    normalizedRelative.includes('..') ||
+                    normalizedRelative.includes('\0')) {
+                    continue;
+                }
+                const hostPath = path.resolve(workspace, normalizedRelative);
+                const relative = path.relative(workspace, hostPath);
+                if (relative.startsWith('..') || path.isAbsolute(relative) || !fs.existsSync(hostPath)) {
+                    continue;
+                }
+                args.push('-v', `${hostPath}:${containerWorkspace}/${normalizedRelative}:ro`);
+            }
+        }
+        for (const mount of config.readOnlyMounts ?? []) {
+            const source = path.resolve(mount.source);
+            const rawTarget = mount.target.replace(/\\/g, '/');
+            if (!path.isAbsolute(rawTarget) ||
+                rawTarget.includes('\0') ||
+                rawTarget.split('/').includes('..') ||
+                !fs.existsSync(source)) {
+                continue;
+            }
+            const target = path.posix.normalize(rawTarget);
+            args.push('--mount', `type=bind,source=${source},target=${target},readonly`);
+        }
+        for (const mountPoint of config.tmpfsMounts ?? []) {
+            const target = mountPoint.replace(/\\/g, '/');
+            if (!path.isAbsolute(target) ||
+                target.includes('\0') ||
+                target.split('/').includes('..')) {
+                continue;
+            }
+            const ownership = process.platform !== 'win32' &&
+                typeof process.getuid === 'function' &&
+                typeof process.getgid === 'function'
+                ? `,uid=${process.getuid()},gid=${process.getgid()}`
+                : '';
+            args.push('--tmpfs', `${path.posix.normalize(target)}:rw,nosuid,nodev,size=64m${ownership}`);
         }
         // Inject CODEBUDDY_CLI env vars so child processes know they're inside Code Buddy
         args.push('-e', `CODEBUDDY_CLI=${process.env.CODEBUDDY_CLI || '1'}`);
         if (process.env.CODEBUDDY_CLI_VERSION) {
             args.push('-e', `CODEBUDDY_CLI_VERSION=${process.env.CODEBUDDY_CLI_VERSION}`);
         }
+        for (const [key, value] of Object.entries(config.environment ?? {})) {
+            if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(key) && !value.includes('\0')) {
+                args.push('-e', `${key}=${value}`);
+            }
+        }
         // Timezone override (Native Engine v2026.3.8 — CODEBUDDY_TZ env)
         const tz = config.timezone || process.env.CODEBUDDY_TZ;
         if (tz) {
@@ -347,7 +622,10 @@ export class DockerSandbox extends EventEmitter {
                 args.push('-e', `TZ=${tz}`);
             }
         }
-        args.push(config.image, 'sh', '-c', command);
+        // End Docker option parsing before the configurable image name. This
+        // prevents a value such as `--privileged` from being interpreted as a
+        // daemon flag even though spawn() itself does not invoke a shell.
+        args.push('--', config.image, 'sh', '-c', command);
         return args;
     }
 }

package/dist/sandbox/execpolicy.d.ts

@@ -77,6 +77,20 @@ export interface PolicyEvaluation {
     constraints: PolicyRule['constraints'];
     timestamp: number;
 }
+/**
+ * Result of evaluating a complete shell expression.
+ *
+ * Shell strings are never authorised from argv[0] alone: every parsed segment
+ * contributes a decision and the most restrictive one wins.  This mirrors the
+ * Codex exec-policy boundary and prevents an allowed prefix such as
+ * `git status` from hiding a later `rm`, a pipe to a shell, or a substitution.
+ */
+export interface ShellPolicyEvaluation extends PolicyEvaluation {
+    parsedSegments: string[][];
+    segmentEvaluations: PolicyEvaluation[];
+    complex: boolean;
+    approvalKey: string;
+}
 export interface ExecPolicyConfig {
     /** Default action when no rules match */
     defaultAction: PolicyAction;
@@ -110,7 +124,7 @@ export declare class ExecPolicy extends EventEmitter {
     isAllowed(command: string, args?: string[], workDir?: string): boolean;
     /**
      * Check argv against prefix rules (token-array matching).
-     * Returns the matching rule with the longest matching prefix, or null.
+     * Returns the strictest matching rule, then the longest prefix on ties.
      *
      * This is evaluated BEFORE regex/glob rules to give prefix rules higher
      * specificity. Call this from evaluate() or use checkPrefix() standalone.
@@ -131,6 +145,14 @@ export declare class ExecPolicy extends EventEmitter {
      * Prefix rules are checked first (longest-match wins).
      */
     evaluateArgv(argv: string[], workDir?: string): PolicyEvaluation;
+    /**
+     * Evaluate a complete shell expression, not just its first binary.
+     *
+     * Every AST segment is checked independently. Unknown commands and shell
+     * constructs with write redirections/substitutions are confined to the OS
+     * sandbox; explicit prompts and denials remain stronger.
+     */
+    evaluateShellCommand(shellCommand: string, workDir?: string): ShellPolicyEvaluation;
     /**
      * Add custom rule
      */
@@ -175,6 +197,19 @@ export declare class ExecPolicy extends EventEmitter {
      * Format policy dashboard
      */
     formatDashboard(): string;
+    /** `deny > ask > sandbox > allow` — the shared aggregation order. */
+    private actionRank;
+    private makeEvaluation;
+    /**
+     * Match well-known system binary paths by basename, but never reinterpret an
+     * arbitrary executable such as `/tmp/git` as the trusted `git` command.
+     */
+    private normalizeCommandName;
+    /** Detect substitutions/control structures that must never inherit a broad allow. */
+    private hasComplexShellSyntax;
+    /** Detect unquoted `>`, `>>` and `&>` while ignoring descriptor duplication (`2>&1`). */
+    private hasUnquotedWriteRedirection;
+    private buildApprovalKey;
     private matchesRule;
     private matchGlob;
     private detectDangerous;