@theokit/sdk 4.19.4 → 4.21.0

package/dist/sandbox/index.js

@@ -1,8 +1,236 @@
-import { execFile } from 'child_process';
+import { execFileSync, execFile } from 'child_process';
+import { existsSync, mkdtempSync, writeFileSync, rmSync } from 'fs';
+import path, { dirname, join } from 'path';
+import { tmpdir } from 'os';
 import { mkdir, writeFile } from 'fs/promises';
-import { dirname } from 'path';
 
-// src/sandbox/local-sandbox.ts
+// src/sandbox/bwrap.ts
+function buildBwrapArgv(mode, opts) {
+  if (mode === "danger-full-access") return null;
+  const cwd = path.resolve(opts.cwd);
+  const gitDir = path.join(cwd, ".git");
+  const hasGit = opts.gitDirExists ?? existsSync(gitDir);
+  const argv = [
+    // core, always (bwrap.rs:318-332; user+pid namespaces explicit so it works as root in containers)
+    "--new-session",
+    "--die-with-parent",
+    "--unshare-user",
+    "--unshare-pid",
+    // full-read filesystem base (bwrap.rs:446-452)
+    "--ro-bind",
+    "/",
+    "/",
+    "--dev",
+    "/dev",
+    "--proc",
+    "/proc"
+  ];
+  if (!opts.network) argv.push("--unshare-net");
+  if (opts.env) argv.push("--clearenv");
+  const setenv = {
+    ...opts.env ?? {},
+    // the flag signals the child that network is unshared (spawn.rs:20,79)
+    ...opts.network ? {} : { CODEX_SANDBOX_NETWORK_DISABLED: "1" }
+  };
+  for (const [k, v] of Object.entries(setenv)) argv.push("--setenv", k, v);
+  if (mode === "workspace-write") {
+    argv.push("--bind", cwd, cwd, "--bind", "/tmp", "/tmp");
+    if (hasGit) argv.push("--ro-bind", gitDir, gitDir);
+  }
+  argv.push("--chdir", cwd, "--");
+  return argv;
+}
+function detectBwrap(probes = realProbes) {
+  try {
+    const bin = probes.which();
+    if (!bin) return { ok: false, reason: "bwrap not found in PATH" };
+    const help = probes.helpText(bin);
+    if (!help?.includes("--perms")) {
+      return { ok: false, reason: `bwrap at ${bin} lacks --perms support (too old)` };
+    }
+    if (!probes.userns(bin)) {
+      return { ok: false, reason: "user namespaces unavailable (container/kernel restriction)" };
+    }
+    return { ok: true, bin };
+  } catch (err) {
+    return {
+      ok: false,
+      reason: `bwrap probe failed: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+}
+var sondagensReais = 0;
+function realProbeCount() {
+  return sondagensReais;
+}
+var realProbes = {
+  which: () => {
+    sondagensReais++;
+    try {
+      const out = execFileSync("which", ["bwrap"], { encoding: "utf8", timeout: 2e3 }).trim();
+      if (!out || out.startsWith(process.cwd() + path.sep)) return null;
+      return out;
+    } catch {
+      return null;
+    }
+  },
+  helpText: (bin) => {
+    try {
+      return execFileSync(bin, ["--help"], { encoding: "utf8", timeout: 2e3 });
+    } catch (err) {
+      const e = err;
+      return [e.stdout, e.stderr].filter(Boolean).join("\n") || null;
+    }
+  },
+  userns: (bin) => {
+    try {
+      execFileSync(bin, ["--unshare-user", "--unshare-net", "--ro-bind", "/", "/", "/bin/true"], {
+        timeout: 500,
+        stdio: "ignore"
+      });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+};
+var memo;
+function detectBwrapMemoizado(probes = realProbes) {
+  memo ??= detectBwrap(probes);
+  if (memo.ok && !existsSync(memo.bin)) {
+    memo = { ok: false, reason: `bwrap disappeared from ${memo.bin} after detection` };
+  }
+  return memo;
+}
+function resetBwrapMemo() {
+  memo = void 0;
+}
+
+// src/internal/security/redact.ts
+var REDACT_ENABLED = readEnvOnce();
+function readEnvOnce() {
+  const raw = process.env.THEOKIT_REDACT_SECRETS;
+  if (raw === void 0) return true;
+  return ["1", "true", "yes", "on"].includes(raw.toLowerCase());
+}
+var warnedOptOut = false;
+if (!REDACT_ENABLED && !warnedOptOut) {
+  process.stderr.write(
+    "[theokit-sdk] Secret redaction is DISABLED via THEOKIT_REDACT_SECRETS. Credentials may leak into errors, telemetry, logs, transcripts.\n"
+  );
+  warnedOptOut = true;
+}
+var BUILTIN_PATTERNS = [
+  // T5.4: 30+ vendor prefixes (was 12 pre-T5.4). Order matters — more
+  // specific prefixes precede generic ones (e.g., sk-ant-admin01 before
+  // sk-ant-, sk-proj- before sk-). PEM block deliberately first so its
+  // multi-line span runs before any per-line patterns can fire.
+  /-----BEGIN[ ]+(?:RSA |EC |DSA |OPENSSH |ENCRYPTED |)PRIVATE KEY-----[\s\S]+?-----END[ ]+(?:RSA |EC |DSA |OPENSSH |ENCRYPTED |)PRIVATE KEY-----/g,
+  // JWT — exact 3-segment base64url. Dotted; the body floor of 4 chars per
+  // segment matches the minimum legal payload while skipping `a.b.c` noise.
+  /eyJ[A-Za-z0-9_-]{4,}\.eyJ[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}/g,
+  // Azure Storage SAS — match the sig= component (URL-encoded base64).
+  /(?<=[?&]sig=)[A-Za-z0-9%+/]{20,}/g,
+  // Anthropic
+  /sk-ant-admin01-[A-Za-z0-9_-]{10,}/g,
+  //   Anthropic admin keys (must precede sk-ant-)
+  /sk-ant-[A-Za-z0-9_-]{10,}/g,
+  //           Anthropic regular
+  // OpenAI family + clones (sk- generic must come AFTER all sk-foo- variants)
+  /sk-proj-[A-Za-z0-9_-]{10,}/g,
+  //  OpenAI project key (must precede sk- generic)
+  /sk-[A-Za-z0-9_-]{10,}/g,
+  //       OpenAI / OpenRouter / DeepInfra / Together / DeepSeek
+  // Provider prefixes (alphabetized for maintainability)
+  /AIza[A-Za-z0-9_-]{35}/g,
+  //       Google API key
+  /AKIA[A-Z0-9]{16}/g,
+  //            AWS access key
+  /fw_[A-Za-z0-9]{20,}/g,
+  //         Fireworks
+  /glpat-[A-Za-z0-9_-]{20}/g,
+  //     GitLab PAT
+  /ghp_[A-Za-z0-9]{36}/g,
+  //         GitHub PAT classic
+  /github_pat_[A-Za-z0-9_]{82}/g,
+  // GitHub PAT fine-grained
+  /gsk_[A-Za-z0-9]{20,}/g,
+  //        Groq
+  /hf_[A-Za-z0-9]{20,}/g,
+  //         HuggingFace
+  /\bpa-[A-Za-z0-9_-]{20,}/g,
+  //     Voyage AI (word-boundary to skip CSS / kebab IDs)
+  /pcsk_[A-Za-z0-9_-]{20,}/g,
+  //     Pinecone
+  /pplx-[A-Za-z0-9_-]{20,}/g,
+  //     Perplexity
+  /r8_[A-Za-z0-9_-]{20,}/g,
+  //       Replicate
+  /rk_live_[A-Za-z0-9]{20,}/g,
+  //    Stripe restricted
+  /sk_live_[A-Za-z0-9]{20,}/g,
+  //    Stripe secret
+  /sntrys_[A-Za-z0-9]{40,}/g,
+  //     Sentry user auth
+  /xai-[A-Za-z0-9_-]{20,}/g,
+  //      xAI (Grok)
+  /xox[bpasr]-[A-Za-z0-9-]{10,}/g,
+  //Slack tokens
+  // Additional unique-prefix tokens with low false-positive risk
+  /npm_[A-Za-z0-9]{36}/g,
+  //         npm access token
+  /SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/g,
+  // SendGrid
+  /\bSK[A-Za-z0-9]{32}\b/g,
+  //       Twilio API SID (word-boundary to skip CSS class noise)
+  /\bkey-[a-f0-9]{32}\b/g,
+  //        Mailgun (hex-only narrows false positives)
+  /MT[A-Za-z0-9_-]{23}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27}/g,
+  // Discord bot
+  /\b(?:sdk|mob)-[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\b/g
+  // LaunchDarkly
+];
+var BEARER_PATTERN = /\b(Bearer\s+)([A-Za-z0-9_\-.+/=]{8,})/g;
+var PARAM_PATTERN = /(\b(?:access_token|api_key|api-key|client_secret|credential|credentials|id_token|jwt|password|private_key|refresh_token|secret|service_account|session_token|token|x-api-key)\b["']?\s*[:=]\s*["']?)([A-Za-z0-9_\-.+/]+)/gi;
+var _extraPatterns = [];
+function maskToken(token) {
+  if (token.length < 18) return "***";
+  return `${token.slice(0, 6)}...${token.slice(-4)}`;
+}
+var MASK_SHAPE = /^.{6}\.\.\..{4}$/s;
+function coerceToString(value) {
+  if (typeof value === "string") return value;
+  if (value === null || value === void 0) return null;
+  if (typeof value === "object") {
+    try {
+      const s = JSON.stringify(value);
+      return s === void 0 ? null : s;
+    } catch {
+      return "[unredactable: circular]";
+    }
+  }
+  return String(value);
+}
+function redactSecrets(text, opts) {
+  const coerced = coerceToString(text);
+  if (coerced === null) return "";
+  if (!REDACT_ENABLED) return coerced;
+  let s = coerced;
+  for (const re of BUILTIN_PATTERNS) {
+    s = s.replace(re, (m) => maskToken(m));
+  }
+  for (const re of _extraPatterns) {
+    s = s.replace(re, (m) => maskToken(m));
+  }
+  {
+    s = s.replace(BEARER_PATTERN, (_, prefix) => `${prefix}***`);
+    s = s.replace(PARAM_PATTERN, (whole, prefix, value) => {
+      if (MASK_SHAPE.test(value)) return whole;
+      return `${prefix}***`;
+    });
+  }
+  return s;
+}
 
 // src/internal/runtime/lifecycle/env-policy.ts
 var SECRET_PATTERNS = [
@@ -89,15 +317,15 @@ var SandboxBackend = class {
       env: config.env ?? "inherit-scrubbed"
     };
   }
-  async readFile(path) {
-    const result = await this.execute(`cat ${this.shellEscape(path)}`);
+  async readFile(path2) {
+    const result = await this.execute(`cat ${this.shellEscape(path2)}`);
     if (result.exitCode !== 0) {
       throw new Error(`readFile failed: ${result.stderr}`);
     }
     return result.stdout;
   }
-  async writeFile(path, content) {
-    await this.uploadFile(path, content);
+  async writeFile(path2, content) {
+    await this.uploadFile(path2, content);
   }
   async glob(pattern, cwd) {
     const dir = cwd ?? this.config.workDir ?? ".";
@@ -107,16 +335,16 @@ var SandboxBackend = class {
     if (result.exitCode !== 0) return [];
     return result.stdout.trim().split("\n").filter(Boolean);
   }
-  async grep(pattern, path) {
-    const target = path ?? ".";
+  async grep(pattern, path2) {
+    const target = path2 ?? ".";
     const result = await this.execute(
       `grep -rn ${this.shellEscape(pattern)} ${this.shellEscape(target)} 2>/dev/null`
     );
     if (result.exitCode !== 0) return [];
     return result.stdout.trim().split("\n").filter(Boolean);
   }
-  async listDir(path) {
-    const result = await this.execute(`ls -1 ${this.shellEscape(path)}`);
+  async listDir(path2) {
+    const result = await this.execute(`ls -1 ${this.shellEscape(path2)}`);
     if (result.exitCode !== 0) return [];
     return result.stdout.trim().split("\n").filter(Boolean);
   }
@@ -174,13 +402,258 @@ var LocalSandbox = class extends SandboxBackend {
       timedOut
     };
   }
-  async uploadFile(path, content) {
-    const fullPath = path.startsWith("/") ? path : `${this.config.workDir}/${path}`;
+  async uploadFile(path2, content) {
+    const fullPath = path2.startsWith("/") ? path2 : `${this.config.workDir}/${path2}`;
     await mkdir(dirname(fullPath), { recursive: true });
     await writeFile(fullPath, content, "utf-8");
   }
 };
 
+// src/sandbox/seccomp.ts
+var BPF_LD = 0;
+var BPF_W = 0;
+var BPF_ABS = 32;
+var BPF_JMP = 5;
+var BPF_JEQ = 16;
+var BPF_JGE = 48;
+var BPF_K = 0;
+var BPF_RET = 6;
+var LD_ABS_W = BPF_LD | BPF_W | BPF_ABS;
+var JEQ_K = BPF_JMP | BPF_JEQ | BPF_K;
+var JGE_K = BPF_JMP | BPF_JGE | BPF_K;
+var RET_K = BPF_RET | BPF_K;
+var OFF_NR = 0;
+var OFF_ARCH = 4;
+var OFF_ARG0 = 16;
+var AUDIT_ARCH_X86_64 = 3221225534;
+var X32_BIT = 1073741824;
+var SECCOMP_RET_ALLOW = 2147418112;
+var SECCOMP_RET_ERRNO = 327680;
+var EPERM = 1;
+var RET_EPERM = SECCOMP_RET_ERRNO | EPERM & 65535;
+var SECCOMP_RET_KILL_PROCESS = 2147483648;
+var AF_UNIX = 1;
+var ALWAYS_DENIED = [101, 310, 311, 425, 426, 427];
+var NETWORK_DENIED = [42, 43, 288, 49, 50, 52, 51, 48, 44, 307, 299, 55, 54];
+var SOCKET_SYSCALLS = [41, 53];
+var stmt = (code, k) => ({ code, jt: 0, jf: 0, k });
+var jmp = (code, k, jt, jf) => ({ code, jt, jf, k });
+function buildSeccompFilter(opts) {
+  const insns = [];
+  const ALLOW = /* @__PURE__ */ Symbol("ALLOW");
+  const DENY = /* @__PURE__ */ Symbol("DENY");
+  const KILL = /* @__PURE__ */ Symbol("KILL");
+  const body = [];
+  const push = (code, k, jt = 0, jf = 0) => {
+    body.push({ code, k, jt, jf });
+  };
+  push(LD_ABS_W, OFF_ARCH);
+  push(JEQ_K, AUDIT_ARCH_X86_64, 0, KILL);
+  push(LD_ABS_W, OFF_NR);
+  push(JGE_K, X32_BIT, KILL, 0);
+  const denied = opts.networkRestricted ? [...ALWAYS_DENIED, ...NETWORK_DENIED] : [...ALWAYS_DENIED];
+  for (const nr of denied) push(JEQ_K, nr, DENY, 0);
+  if (opts.networkRestricted) {
+    for (const sysno of SOCKET_SYSCALLS) {
+      push(JEQ_K, sysno, 0, 2);
+      push(LD_ABS_W, OFF_ARG0);
+      push(JEQ_K, AF_UNIX, ALLOW, DENY);
+    }
+  }
+  push(RET_K, SECCOMP_RET_ALLOW);
+  const allowIdx = body.length - 1;
+  push(RET_K, RET_EPERM);
+  const denyIdx = body.length - 1;
+  push(RET_K, SECCOMP_RET_KILL_PROCESS);
+  const killIdx = body.length - 1;
+  const resolve = (i, t) => {
+    const abs = t === ALLOW ? allowIdx : t === DENY ? denyIdx : t === KILL ? killIdx : i + 1 + t;
+    const off = abs - (i + 1);
+    if (off < 0 || off > 255) throw new RangeError(`seccomp jump out of range at ${i}: ${off}`);
+    return off;
+  };
+  for (const [i, b] of body.entries()) {
+    if (b.code === JEQ_K || b.code === JGE_K) {
+      insns.push(jmp(b.code, b.k, resolve(i, b.jt), resolve(i, b.jf)));
+    } else {
+      insns.push(stmt(b.code, b.k));
+    }
+  }
+  const buf = Buffer.alloc(insns.length * 8);
+  insns.forEach((ins, i) => {
+    buf.writeUInt16LE(ins.code, i * 8);
+    buf.writeUInt8(ins.jt, i * 8 + 2);
+    buf.writeUInt8(ins.jf, i * 8 + 3);
+    buf.writeUInt32LE(ins.k >>> 0, i * 8 + 4);
+  });
+  return buf;
+}
+
+// src/sandbox/linux-sandbox.ts
+function shellQuote(s) {
+  return `'${s.replaceAll("'", `'\\''`)}'`;
+}
+function wrapCommandForSandbox(mode, opts, command) {
+  const argv = buildBwrapArgv(mode, { cwd: opts.cwd, network: opts.network, env: opts.env });
+  if (argv === null) return null;
+  const bin = opts.bin ?? "bwrap";
+  const seccompArgv = opts.seccompPath !== void 0 ? ["--seccomp", "3"] : [];
+  const base = `${shellQuote(bin)} ${[...argv.slice(0, -1), ...seccompArgv, "--"].map(shellQuote).join(" ")} /bin/sh -c ${shellQuote(command)}`;
+  return opts.seccompPath !== void 0 ? `${base} 3< ${shellQuote(opts.seccompPath)}` : base;
+}
+var ENV_ALLOWLIST = [
+  "PATH",
+  "HOME",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "TERM",
+  "USER",
+  "TMPDIR",
+  "SHELL"
+];
+function allowlistedEnv(source = process.env) {
+  const out = {};
+  for (const k of ENV_ALLOWLIST) {
+    const v = source[k];
+    if (v !== void 0) out[k] = v;
+  }
+  return out;
+}
+var LinuxSandbox = class extends LocalSandbox {
+  mode;
+  network;
+  cwd;
+  bin;
+  env;
+  /** M63 — path to the cBPF seccomp program written host-side; passed to `bwrap --seccomp 3` via a
+   * shell redirect. `undefined` when the network is unrestricted OR generation failed (honest fallback). */
+  seccompPath;
+  constructor(config, opts) {
+    super(config);
+    this.mode = opts.mode;
+    this.network = opts.network ?? false;
+    this.cwd = config.workDir ?? process.cwd();
+    this.bin = opts.bin ?? "bwrap";
+    this.env = opts.env ?? allowlistedEnv();
+    this.seccompPath = this.network ? void 0 : restrictedSeccompPath();
+  }
+  /** Extracted for test visibility — delegates to the pure `wrapCommandForSandbox` (M57, single wrap SoT). */
+  wrapCommand(command) {
+    return wrapCommandForSandbox(
+      this.mode,
+      {
+        cwd: this.cwd,
+        network: this.network,
+        env: this.env,
+        bin: this.bin,
+        seccompPath: this.seccompPath
+      },
+      command
+    );
+  }
+  execute(command, opts) {
+    const wrapped = this.wrapCommand(command);
+    if (wrapped === null) return super.execute(command, opts);
+    return super.execute(wrapped, opts);
+  }
+};
+var warnedNonX64 = false;
+function seccompPathForArch(arch, warn) {
+  if (arch !== "x64") {
+    if (!warnedNonX64) {
+      warnedNonX64 = true;
+      warn(
+        `[sandbox] seccomp syscall filter unsupported on ${arch} (x86_64 only in v1) \u2014 running without the filter; bwrap FS/network confinement still applies.`
+      );
+    }
+    return void 0;
+  }
+  try {
+    const dir = mkdtempSync(join(tmpdir(), "ab-seccomp-"));
+    const path2 = join(dir, "filter.bpf");
+    writeFileSync(path2, buildSeccompFilter({ networkRestricted: true }));
+    const cleanup = () => rmSync(dir, { recursive: true, force: true });
+    process.once("exit", cleanup);
+    process.once("SIGINT", cleanup);
+    process.once("SIGTERM", cleanup);
+    return path2;
+  } catch (err) {
+    warn(
+      `[sandbox] seccomp filter unavailable (${err instanceof Error ? err.message : String(err)}) \u2014 running without syscall filter (bwrap FS/network confinement still applies).`
+    );
+    return void 0;
+  }
+}
+var seccompFilterPath;
+function restrictedSeccompPath() {
+  if (seccompFilterPath !== void 0) return seccompFilterPath ?? void 0;
+  const path2 = seccompPathForArch(process.arch, (m) => console.warn(redactSecrets(m)));
+  seccompFilterPath = path2 ?? null;
+  return path2;
+}
+var warnedUnavailable = false;
+function resetSandboxWarnLatch() {
+  warnedUnavailable = false;
+}
+function resolveSandboxPosture(opts) {
+  if (opts.mode === "danger-full-access") {
+    return { mode: opts.mode, enforced: false, detail: "no confinement (danger-full-access)" };
+  }
+  const detection = (opts.detect ?? detectBwrapMemoizado)();
+  if (!detection.ok) {
+    return { mode: opts.mode, enforced: false, detail: `tool-gating only \u2014 ${detection.reason}` };
+  }
+  return { mode: opts.mode, enforced: true, detail: "kernel (bwrap)" };
+}
+function createSandboxBackend(opts) {
+  const config = { workDir: opts.workDir, timeoutMs: opts.timeoutMs };
+  if (opts.mode === "danger-full-access") return new LocalSandbox(config);
+  const detection = (opts.detect ?? detectBwrapMemoizado)();
+  if (!detection.ok) {
+    if (!warnedUnavailable) {
+      warnedUnavailable = true;
+      const warn = opts.warn ?? ((m) => console.warn(redactSecrets(m)));
+      warn(
+        `[sandbox] OS-level enforcement unavailable (${detection.reason}) \u2014 falling back to tool-level gating only (sandbox_mode=${opts.mode}).`
+      );
+    }
+    return new LocalSandbox(config);
+  }
+  return new LinuxSandbox(config, { mode: opts.mode, network: opts.network, bin: detection.bin });
+}
+var avisouInterativo = false;
+function resetInteractiveWarnLatch() {
+  avisouInterativo = false;
+}
+function interactiveWrapCommand(opts) {
+  return (command, cwd) => {
+    if (opts.mode === "danger-full-access") return null;
+    const detection = (opts.detect ?? detectBwrapMemoizado)();
+    if (!detection.ok) {
+      if (!avisouInterativo) {
+        avisouInterativo = true;
+        const warn = opts.warn ?? ((m) => console.warn(redactSecrets(m)));
+        warn(
+          `[sandbox] OS-level enforcement unavailable (${detection.reason}) \u2014 interactive session runs WITHOUT kernel confinement (sandbox_mode=${opts.mode}).`
+        );
+      }
+      return null;
+    }
+    return wrapCommandForSandbox(
+      opts.mode,
+      {
+        cwd,
+        network: opts.network ?? false,
+        env: allowlistedEnv(),
+        bin: detection.bin,
+        seccompPath: restrictedSeccompPath()
+      },
+      command
+    );
+  };
+}
+
 // src/errors.ts
 var TheokitAgentError = class extends Error {
   name = "TheokitAgentError";
@@ -246,6 +719,6 @@ async function provisionRepo(sandboxOrOpts, maybeOpts) {
   return { repoDir };
 }
 
-export { LocalSandbox, RepoProvisionError, SandboxBackend, SandboxNotAvailableError, SandboxSecurityError, provisionRepo, resolveSandbox };
+export { LinuxSandbox, LocalSandbox, RepoProvisionError, SandboxBackend, SandboxNotAvailableError, SandboxSecurityError, allowlistedEnv, buildBwrapArgv, buildSeccompFilter, createSandboxBackend, detectBwrap, detectBwrapMemoizado, interactiveWrapCommand, provisionRepo, realProbeCount, realProbes, resetBwrapMemo, resetInteractiveWarnLatch, resetSandboxWarnLatch, resolveSandbox, resolveSandboxPosture, restrictedSeccompPath, seccompPathForArch, wrapCommandForSandbox };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map