@staix/agent-hub 0.10.0 → 0.12.0

package/src/local/sandbox.ts

@@ -1,5 +1,5 @@
 import { spawn, spawnSync } from "node:child_process";
-import { existsSync } from "node:fs";
+import { existsSync, mkdtempSync, rmSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { realPath } from "../hub/project.ts";
@@ -26,10 +26,16 @@ const HOME_READABLE = [".bun", ".cargo", ".rustup", ".local", ".npm", ".cache",
  */
 const CA_BUNDLES = ["/private/etc/ssl/cert.pem", "/opt/homebrew/etc/ca-certificates/cert.pem", "/opt/homebrew/etc/openssl@3/cert.pem", "/usr/local/etc/ca-certificates/cert.pem", "/usr/local/etc/openssl@3/cert.pem"];
 
-/** The selected Xcode or Command Line Tools dir: the `/usr/bin` shims (git, clang, make, python3) run what is in it. */
+/**
+ * The selected Xcode or Command Line Tools dir: the `/usr/bin` shims (git, clang, make, python3) run what is in it.
+ * Inside an app bundle that is the whole `Contents`: its tools load frameworks from `SharedFrameworks` next to it.
+ */
 function developerDir(): string | undefined {
   const out = spawnSync("xcode-select", ["-p"], { encoding: "utf8" });
-  return out.status === 0 && out.stdout.trim() ? out.stdout.trim() : undefined;
+  let dir = out.status === 0 ? out.stdout.trim() : "";
+  // Seatbelt matches real paths: an Xcode selected through a symlink (`Xcode.app` -> `Xcode-26.0.app`) needs its target.
+  try { dir = dir && realPath(dir); } catch { /* gone since it was selected: nothing the shims could run either */ }
+  return dir ? dir.replace(/(\.app\/Contents)\/Developer\/?$/, "$1") : undefined;
 }
 
 /** A submodule or worktree keeps its git dir outside the project; git needs it, minus the parts that execute or reconfigure. */
@@ -49,58 +55,60 @@ const SYSTEM_READABLE = ["/usr", "/bin", "/sbin", "/System", "/Library", "/opt",
  */
 const MACH_SERVICES = ["com.apple.system.opendirectoryd.libinfo", "com.apple.system.DirectoryService.libinfo_v1", "com.apple.system.logger", "com.apple.system.notification_center"];
 const NETWORK_MACH_SERVICES = ["com.apple.dnssd.service", "com.apple.trustd", "com.apple.trustd.agent", "com.apple.networkd"];
+/** Through the egress proxy (#65) the proxy resolves names: only TLS trust is looked up here, no DNS that could carry data. */
+const PROXY_MACH_SERVICES = ["com.apple.trustd", "com.apple.trustd.agent"];
+
+/**
+ * Network for the commands: none, direct (`local.bash_network: "direct"`, everything, until 0.13.0), or only
+ * the hub's egress proxy on a loopback port (#65), which opens allowlisted hosts.
+ */
+export type SandboxNetwork = boolean | { proxyPort: number };
 
 /**
- * `base` "deny" (issue #39) starts from `(deny default)` and allows only what commands need: running and reading the
- * system, toolchain and project directories, writing the project and temp. "allow" is the profile of 0.9 and earlier,
- * kept for one release behind `local.sandbox: "allow-default"`. The denies at the end apply to both.
+ * Starts from `(deny default)` (issue #39) and allows only what commands need: running and reading the system,
+ * toolchain and project directories, writing the project and a temp dir of their own. The allow-default profile of
+ * 0.9 and earlier was removed in 0.12.0 (issue #83).
  */
-export function profile(cwd: string, network: boolean, readAllow: string[] = [], deny: string[] = [], base: "deny" | "allow" = "deny"): string {
+export function profile(cwd: string, network: SandboxNetwork, readAllow: string[] = [], deny: string[] = []): string {
   const home = homedir();
   const inHome = (p: string) => (p.startsWith("~/") ? join(home, p.slice(2)) : p);
   const root = realPath(cwd);
-  const tmp = realPath(tmpdir());
   const gitDirs = externalGitDirs(root);
   const creds = [".ssh", ".aws", ".gnupg", ".config/gh", ".config/gcloud", ".kube", ".docker", ".netrc", ".npmrc", ".omniroute", ".claude", ".codex", ".kimi-code", "Library/Keychains"];
   const dev = developerDir();
   const readable = [root, ...HOME_READABLE.map((p) => join(home, p)), ...readAllow.map(inHome), ...gitDirs, ...(dev ? [dev] : [])];
   const subpaths = (paths: string[]) => paths.map((p) => `(subpath ${q(p)})`).join(" ");
   const globals = (names: string[]) => names.map((n) => `(global-name ${q(n)})`).join(" ");
-  const start = base === "deny"
-    ? [
-        "(deny default)",
-        "(allow process-fork)",
-        // Runs from the system, toolchain and project directories only; a script runs through an allowed interpreter.
-        `(allow process-exec ${subpaths([...SYSTEM_READABLE, ...readable, tmp, "/private/tmp"])})`,
-        "(allow signal (target same-sandbox))",
-        "(allow process-info* (target same-sandbox))",
-        "(allow sysctl-read)",
-        `(allow mach-lookup ${globals([...MACH_SERVICES, ...(network ? NETWORK_MACH_SERVICES : [])])})`,
-        '(allow ipc-posix-shm-read-data ipc-posix-shm-read-metadata (ipc-posix-name "apple.shm.notification_center"))',
-        "(allow file-read-metadata)",
-        `(allow file-read* (literal "/") ${subpaths([...SYSTEM_READABLE, tmp, "/private/tmp", "/dev"])} ${subpaths(readable)})`,
-        '(allow file-ioctl (regex #"^/dev/"))',
-        ...(network ? ["(allow network*)"] : []),
-      ]
-    : [
-        "(allow default)",
-        ...(network ? [] : ["(deny network*)"]),
-        // Home is default-deny for reads: whatever a command reads can end up in the model's answer, and that answer
-        // is shared with agents that run on cloud subscriptions (~/.claude.json, app tokens, browser profiles ...).
-        `(deny file-read* (subpath ${q(home)}))`,
-        `(allow file-read-metadata (subpath ${q(home)}))`,
-        `(allow file-read* ${subpaths(readable)})`,
-      ];
+  const proxy = typeof network === "object" ? `(allow network-outbound (remote ip ${q(`localhost:${network.proxyPort}`)}))` : undefined;
+  const start = [
+    "(deny default)",
+    "(allow process-fork)",
+    // Runs from the system, toolchain and project directories only; a script runs through an allowed interpreter.
+    // The user's temp dir and /private/tmp are shared with every other process: each command gets its own (#63).
+    `(allow process-exec ${subpaths([...SYSTEM_READABLE, ...readable])})`,
+    "(allow signal (target same-sandbox))",
+    "(allow process-info* (target same-sandbox))",
+    "(allow sysctl-read)",
+    `(allow mach-lookup ${globals([...MACH_SERVICES, ...(proxy ? PROXY_MACH_SERVICES : network ? NETWORK_MACH_SERVICES : [])])})`,
+    '(allow ipc-posix-shm-read-data ipc-posix-shm-read-metadata (ipc-posix-name "apple.shm.notification_center"))',
+    "(allow file-read-metadata)",
+    `(allow file-read* (literal "/") ${subpaths([...SYSTEM_READABLE, "/dev"])} ${subpaths(readable)})`,
+    '(allow file-ioctl (regex #"^/dev/"))',
+    ...(proxy ? [proxy] : network ? ["(allow network*)"] : []),
+  ];
+  const places = `${creds.map((c) => `(subpath ${q(join(home, c))})`).join(" ")} ${denyRegexes(root, deny, false).join(" ")}`;
   return [
     "(version 1)",
     ...start,
     "(deny file-write*)",
-    `(allow file-write* (subpath ${q(root)}) (subpath ${q(tmp)}) (subpath "/private/tmp") (regex #"^/dev/") ${gitDirs.map((d) => `(subpath ${q(d)})`).join(" ")})`,
+    `(allow file-write* (subpath ${q(root)}) (regex #"^/dev/") ${gitDirs.map((d) => `(subpath ${q(d)})`).join(" ")})`,
     // Inside cwd: nothing that runs later outside the sandbox, nothing that reconfigures the hub.
     `(deny file-write* (subpath ${q(join(root, ".agenthub"))}) ${[join(root, ".git"), ...gitDirs].map((d) => `(subpath ${q(join(d, "hooks"))}) (literal ${q(join(d, "config"))})`).join(" ")})`,
     `(deny file-read* file-write* ${creds.map((c) => `(subpath ${q(join(home, c))})`).join(" ")})`,
     `(deny file-read* file-write* ${denyRegexes(root, deny).join(" ")})`,
-    ...(network ? [`(allow file-read* ${CA_BUNDLES.map((p) => `(literal ${q(p)})`).join(" ")})`] : []),
+    // Python's own CA bundle (certifi, which pip vendors too): pip, requests and httpx read it instead of the system's (#64).
+    // The last match wins: the denied places come again after it, so it overrides only the `.pem` name rule.
+    ...(network ? [`(allow file-read* ${CA_BUNDLES.map((p) => `(literal ${q(p)})`).join(" ")} (regex ${q("/certifi/cacert\\.pem$")}))`, `(deny file-read* file-write* ${places})`] : []),
   ].join("\n");
 }
 
@@ -110,12 +118,16 @@ export interface ExecResult {
 }
 
 /** Run argv under seatbelt with a scrubbed environment. Never runs unsandboxed: no sandbox, no exec. */
-export function sandboxedExec(argv: string[], opts: { cwd: string; profile: string; timeoutMs?: number }): Promise<ExecResult> {
+export function sandboxedExec(argv: string[], opts: { cwd: string; profile: string; timeoutMs?: number; env?: Record<string, string> }): Promise<ExecResult> {
   if (!sandboxAvailable()) return Promise.resolve({ code: null, output: "error: command execution needs macOS sandbox-exec and is disabled on this host" });
   return new Promise((resolve) => {
-    const env = { PATH: process.env.PATH ?? "/usr/bin:/bin", HOME: homedir(), LANG: process.env.LANG ?? "en_US.UTF-8", TERM: "dumb", TMPDIR: tmpdir() };
+    // A temp dir of its own (#63): the user's is shared with every other process, and what a command reads can reach
+    // an answer shown to cloud peers. Allowed after the profile's denies, and gone when the command ends.
+    const own = realPath(mkdtempSync(join(tmpdir(), "ahub-cmd-")));
+    const sandbox = `${opts.profile}\n(allow file-read* file-write* process-exec (subpath ${q(own)}))`;
+    const env = { PATH: process.env.PATH ?? "/usr/bin:/bin", HOME: homedir(), LANG: process.env.LANG ?? "en_US.UTF-8", TERM: "dumb", ...opts.env, TMPDIR: `${own}/` };
     // Own process group: a timeout has to take the grandchildren too, or they keep the pipes open and the project writable.
-    const child = spawn(SANDBOX_EXEC, ["-p", opts.profile, ...argv], { cwd: opts.cwd, env, stdio: ["ignore", "pipe", "pipe"], detached: true });
+    const child = spawn(SANDBOX_EXEC, ["-p", sandbox, ...argv], { cwd: opts.cwd, env, stdio: ["ignore", "pipe", "pipe"], detached: true });
     let output = "";
     const take = (d: Buffer) => {
       if (output.length < OUTPUT_CAP) output += d.toString();
@@ -129,18 +141,33 @@ export function sandboxedExec(argv: string[], opts: { cwd: string; profile: stri
         child.kill("SIGKILL");
       }
     };
+    // Best effort, never in the way of the result: a command can mark its files immutable (`chflags uchg`), and then
+    // the plain remove throws. What still fails is left to the OS temp cleanup.
+    const dropOwn = () => {
+      try { rmSync(own, { recursive: true, force: true }); } catch {
+        try { spawnSync("chflags", ["-R", "nouchg", own]); rmSync(own, { recursive: true, force: true }); } catch { /* left behind */ }
+      }
+    };
     const timer = setTimeout(killGroup, opts.timeoutMs ?? 120_000);
     let done = false;
     const finish = (code: number | null, signal: NodeJS.Signals | null) => {
       if (done) return;
       done = true;
       clearTimeout(timer);
+      dropOwn();
       const clipped = output.length >= OUTPUT_CAP ? `${output.slice(0, OUTPUT_CAP)}\n(output truncated)` : output;
       resolve({ code, output: signal ? `${clipped}\n(killed: ${signal}, timeout?)` : clipped });
     };
-    child.on("error", (e) => (done || ((done = true), resolve({ code: null, output: `error: ${e.message}` }))));
+    child.on("error", (e) => (done || ((done = true), dropOwn(), resolve({ code: null, output: `error: ${e.message}` }))));
     child.on("close", finish);
     // `close` waits for every holder of the pipes; after `exit` give stragglers a moment, then stop waiting and reap them.
     child.on("exit", (code, signal) => setTimeout(() => (killGroup(), finish(code, signal)), 500).unref());
   });
 }
+
+/** The environment that sends a command's HTTPS through the egress proxy (#65); empty without one. */
+export function proxyEnv(network: SandboxNetwork): Record<string, string> {
+  if (typeof network !== "object") return {};
+  const url = `http://127.0.0.1:${network.proxyPort}`;
+  return { HTTPS_PROXY: url, https_proxy: url, HTTP_PROXY: url, http_proxy: url, ALL_PROXY: url, all_proxy: url, NO_PROXY: "", no_proxy: "" };
+}

package/src/local/tools.ts

@@ -12,6 +12,8 @@ export interface ToolContext {
   deny: string[];
   /** Seatbelt profile for this project, built once per worker (`profile()` in sandbox.ts): it spawns git and must not run per tool call. */
   sandboxProfile: string;
+  /** Extra environment for sandboxed commands: the egress proxy's variables when network goes through it (#65). */
+  sandboxEnv?: Record<string, string>;
   /** Ask the console. Resolves false on deny or timeout. */
   permit: (title: string) => Promise<boolean>;
   /** Publish a message to other peers mid-turn. Returns a one-line receipt. */
@@ -136,7 +138,7 @@ export async function runTool(name: string, rawArgs: string, ctx: ToolContext):
         // The approver sees the whole command, not a prefix: what is hidden cannot be approved.
         if (command.length > 4000) return "error: command longer than 4000 characters; put it in a script file with write, then run that";
         if (!(await ctx.permit(`bash: ${command}`))) return "error: the user did not approve this command";
-        const res = await sandboxedExec(["/bin/bash", "-c", command], { cwd: ctx.cwd, profile: ctx.sandboxProfile, timeoutMs: (Number(a.timeout_s) || 120) * 1000 });
+        const res = await sandboxedExec(["/bin/bash", "-c", command], { cwd: ctx.cwd, profile: ctx.sandboxProfile, timeoutMs: (Number(a.timeout_s) || 120) * 1000, ...(ctx.sandboxEnv ? { env: ctx.sandboxEnv } : {}) });
         return `${res.output}\n(exit ${res.code})`;
       }
       case "git": {
@@ -147,7 +149,7 @@ export async function runTool(name: string, rawArgs: string, ctx: ToolContext):
         if (problem) return `error: git ${sub}: ${problem}`;
         if (GIT_WRITE.has(sub) && !(await ctx.permit(`git ${args.join(" ")}`))) return "error: the user did not approve this git command";
         // Sandboxed like bash: flags such as --output or an editor cannot write outside the project or reach the network.
-        const res = await sandboxedExec(["git", "--no-pager", ...args], { cwd: ctx.cwd, profile: ctx.sandboxProfile });
+        const res = await sandboxedExec(["git", "--no-pager", ...args], { cwd: ctx.cwd, profile: ctx.sandboxProfile, ...(ctx.sandboxEnv ? { env: ctx.sandboxEnv } : {}) });
         return `${res.output}\n(exit ${res.code})`;
       }
       case "hub_send":

package/templates/config.json

@@ -23,7 +23,7 @@
     "cf_client_id_file": "",
     "cf_client_secret_file": ""
   },
-  "local": { "deny": [], "bash_network": false, "max_steps": 30, "read_allow": [], "sandbox": "deny-default" },
+  "local": { "deny": [], "bash_network": false, "max_steps": 30, "read_allow": [] },
   "approvals": { "timeout_s": 120 },
   "tasks": { "release_after_min": 30 },
   "checks": { "timeout_s": 600 },