@theokit/sdk 5.12.0 → 5.13.0

package/dist/sandbox/index.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkBRWI4HLK_cjs = require('../chunk-BRWI4HLK.cjs');
+var chunkFLDHYF5C_cjs = require('../chunk-FLDHYF5C.cjs');
 require('../chunk-2ZPEDVLM.cjs');
 var chunkCEGU5AVD_cjs = require('../chunk-CEGU5AVD.cjs');
 var chunkRNXXYF22_cjs = require('../chunk-RNXXYF22.cjs');
@@ -13,6 +13,64 @@ function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
 var path__default = /*#__PURE__*/_interopDefault(path);
 
+var KEPT_ROOTS_ALWAYS = ["/tmp"];
+function isSameOrInside(outer, inner) {
+  const rel = path__default.default.relative(outer, inner);
+  return rel === "" || !rel.startsWith("..") && !path__default.default.isAbsolute(rel);
+}
+function resolveEntry(entry) {
+  if (!path__default.default.isAbsolute(entry)) {
+    throw new TypeError(`denyReadPaths: "${entry}" is not an absolute path`);
+  }
+  try {
+    return fs.realpathSync(entry);
+  } catch (cause) {
+    throw new TypeError(`denyReadPaths: "${entry}" cannot be resolved: ${String(cause)}`);
+  }
+}
+function keptRoots(cwd) {
+  let real = cwd;
+  try {
+    real = fs.realpathSync(cwd);
+  } catch {
+  }
+  return [.../* @__PURE__ */ new Set([cwd, real, ...KEPT_ROOTS_ALWAYS])];
+}
+function denyReadFlags(paths, policy) {
+  if (paths === void 0 || paths.length === 0) return [];
+  if (policy.mode === "danger-full-access") {
+    throw new TypeError(
+      "denyReadPaths cannot be honoured under danger-full-access: no sandbox is applied"
+    );
+  }
+  const roots = keptRoots(policy.cwd);
+  const resolved = /* @__PURE__ */ new Set();
+  for (const entry of paths) {
+    const target = resolveEntry(entry);
+    const covered = roots.find((root) => isSameOrInside(target, root));
+    if (covered !== void 0) {
+      throw new TypeError(
+        `denyReadPaths: "${entry}" would hide "${covered}", which the command needs`
+      );
+    }
+    resolved.add(target);
+  }
+  return [...resolved].flatMap(
+    (target) => fs.statSync(target).isDirectory() ? ["--tmpfs", target] : ["--ro-bind", "/dev/null", target]
+  );
+}
+function refuseUnhonourableDenyRead(paths, mode, detect) {
+  if (paths === void 0 || paths.length === 0) return;
+  if (mode === "danger-full-access") denyReadFlags(paths, { mode, cwd: "/" });
+  const detection = detect();
+  if (!detection.ok) {
+    throw new chunkFLDHYF5C_cjs.SandboxNotAvailableError(
+      `denyReadPaths needs kernel confinement and it is unavailable (${detection.reason}); refusing to run unconfined`
+    );
+  }
+}
+
+// src/sandbox/bwrap.ts
 function pushWorkspaceBinds(argv, cwd, hasGit, gitDir) {
   for (const root of workspaceWriteRoots(cwd)) argv.push("--bind", root, root);
   if (hasGit) argv.push("--ro-bind", gitDir, gitDir);
@@ -31,8 +89,9 @@ function writableRootsFor(mode, cwd) {
   }
 }
 function buildBwrapArgv(mode, opts) {
-  if (mode === "danger-full-access") return null;
   const cwd = path__default.default.resolve(opts.cwd);
+  const denyFlags = denyReadFlags(opts.denyReadPaths, { mode, cwd });
+  if (mode === "danger-full-access") return null;
   const gitDir = path__default.default.join(cwd, ".git");
   const hasGit = opts.gitDirExists ?? fs.existsSync(gitDir);
   const argv = [
@@ -59,6 +118,7 @@ function buildBwrapArgv(mode, opts) {
   };
   for (const [k, v] of Object.entries(setenv)) argv.push("--setenv", k, v);
   if (mode === "workspace-write") pushWorkspaceBinds(argv, cwd, hasGit, gitDir);
+  argv.push(...denyFlags);
   argv.push("--chdir", cwd, "--");
   return argv;
 }
@@ -185,7 +245,7 @@ function buildSeccompFilter(opts) {
   const denyIdx = body.length - 1;
   push(RET_K, SECCOMP_RET_KILL_PROCESS);
   const killIdx = body.length - 1;
-  const resolve = (i, t) => {
+  const resolve2 = (i, t) => {
     const abs = t === ALLOW ? allowIdx : t === DENY ? denyIdx : t === KILL ? killIdx : i + 1 + t;
     const off = abs - (i + 1);
     if (off < 0 || off > 255) throw new RangeError(`seccomp jump out of range at ${i}: ${off}`);
@@ -193,7 +253,7 @@ function buildSeccompFilter(opts) {
   };
   for (const [i, b] of body.entries()) {
     if (b.code === JEQ_K || b.code === JGE_K) {
-      insns.push(jmp(b.code, b.k, resolve(i, b.jt), resolve(i, b.jf)));
+      insns.push(jmp(b.code, b.k, resolve2(i, b.jt), resolve2(i, b.jf)));
     } else {
       insns.push(stmt(b.code, b.k));
     }
@@ -207,15 +267,90 @@ function buildSeccompFilter(opts) {
   });
   return buf;
 }
+function nonX64SeccompWarning(arch) {
+  return `[sandbox] seccomp syscall filter unsupported on ${arch} (x86_64 only in v1) \u2014 running without the filter; bwrap FS/network confinement still applies.`;
+}
+var warnedNonX64Program = false;
+function seccompProgramForArch(arch, warn) {
+  if (arch !== "x64") {
+    if (!warnedNonX64Program) {
+      warnedNonX64Program = true;
+      warn(nonX64SeccompWarning(arch));
+    }
+    return void 0;
+  }
+  return buildSeccompFilter({ networkRestricted: true });
+}
+var memoizedProgram;
+function restrictedSeccompProgram(warn) {
+  if (memoizedProgram === void 0)
+    memoizedProgram = seccompProgramForArch(process.arch, warn) ?? null;
+  return memoizedProgram ?? void 0;
+}
+function octalPrintfArg(program) {
+  let out = "";
+  for (const byte of program) out += `\\${byte.toString(8).padStart(3, "0")}`;
+  return out;
+}
+function assertSeccompProgramShape(program) {
+  if (program.length === 0 || program.length % 8 !== 0) {
+    throw new TypeError(
+      `seccompProgram must be a positive multiple of 8 bytes, got ${program.length}`
+    );
+  }
+}
+var PIPE_SCRIPT = '{ p=$1; shift; printf "$p" | exec "$@" 3<&0 0<&4 4<&-; } 4<&0';
+function wrapWithSeccompProgram(bwrapArgv, command, program) {
+  assertSeccompProgramShape(program);
+  const words = [octalPrintfArg(program), ...bwrapArgv, "--seccomp", "3", "--", "/bin/sh", "-c"];
+  return `exec /bin/sh -c ${chunkFLDHYF5C_cjs.shellEscapePosix(PIPE_SCRIPT)} sh ${[...words, command].map(chunkFLDHYF5C_cjs.shellEscapePosix).join(" ")}`;
+}
+var programsWritten = /* @__PURE__ */ new Map();
+function rememberSeccompFile(path3, program) {
+  programsWritten.set(path.resolve(path3), Buffer.from(program));
+}
+function removeDirOnExit(dir) {
+  const cleanup = () => fs.rmSync(dir, { recursive: true, force: true });
+  process.once("exit", cleanup);
+  for (const signal of ["SIGINT", "SIGTERM"]) {
+    process.prependOnceListener(signal, () => {
+      cleanup();
+      if (process.listenerCount(signal) === 0) process.kill(process.pid, signal);
+    });
+  }
+}
+function wrapWithSeccompPath(bwrapArgv, policy, command, seccompPath) {
+  const program = programsWritten.get(path.resolve(seccompPath));
+  const bind = program === void 0 ? "--ro-bind" : "--ro-bind-try";
+  const flags = [
+    ...bwrapArgv.slice(0, -3),
+    ...readOnlyBindForSeccompPath(policy.mode, policy.cwd, seccompPath, bind),
+    ...bwrapArgv.slice(-3, -1)
+  ];
+  if (program !== void 0) return wrapWithSeccompProgram(flags, command, program);
+  return `${[...flags, "--seccomp", "3", "--"].map(chunkFLDHYF5C_cjs.shellEscapePosix).join(" ")} /bin/sh -c ${chunkFLDHYF5C_cjs.shellEscapePosix(command)} 3< ${chunkFLDHYF5C_cjs.shellEscapePosix(seccompPath)}`;
+}
+function readOnlyBindForSeccompPath(mode, cwd, seccompPath, bind) {
+  const file = path.resolve(seccompPath);
+  const dir = path.dirname(file);
+  const roots = writableRootsFor(mode, path.resolve(cwd)) ?? [];
+  const covers = (root) => dir === "/" || root === dir || root.startsWith(`${dir}/`);
+  const target = roots.some(covers) ? file : dir;
+  return [bind, target, target];
+}
 
 // src/sandbox/linux-sandbox.ts
 function wrapCommandForSandbox(mode, opts, command) {
-  const argv = buildBwrapArgv(mode, { cwd: opts.cwd, network: opts.network, env: opts.env });
+  const argv = buildBwrapArgv(mode, opts);
   if (argv === null) return null;
   const bin = opts.bin ?? "bwrap";
-  const seccompArgv = opts.seccompPath !== void 0 ? ["--seccomp", "3"] : [];
-  const base = `${chunkBRWI4HLK_cjs.shellEscapePosix(bin)} ${[...argv.slice(0, -1), ...seccompArgv, "--"].map(chunkBRWI4HLK_cjs.shellEscapePosix).join(" ")} /bin/sh -c ${chunkBRWI4HLK_cjs.shellEscapePosix(command)}`;
-  return opts.seccompPath !== void 0 ? `${base} 3< ${chunkBRWI4HLK_cjs.shellEscapePosix(opts.seccompPath)}` : base;
+  if (opts.seccompProgram !== void 0) {
+    return wrapWithSeccompProgram([bin, ...argv.slice(0, -1)], command, opts.seccompProgram);
+  }
+  if (opts.seccompPath === void 0) {
+    return `${[bin, ...argv].map(chunkFLDHYF5C_cjs.shellEscapePosix).join(" ")} /bin/sh -c ${chunkFLDHYF5C_cjs.shellEscapePosix(command)}`;
+  }
+  return wrapWithSeccompPath([bin, ...argv], { mode, cwd: opts.cwd }, command, opts.seccompPath);
 }
 var ENV_ALLOWLIST = [
   "PATH",
@@ -236,23 +371,35 @@ function allowlistedEnv(source = process.env) {
   }
   return out;
 }
-var LinuxSandbox = class extends chunkBRWI4HLK_cjs.LocalSandbox {
+var LinuxSandbox = class extends chunkFLDHYF5C_cjs.LocalSandbox {
   mode;
   network;
   cwd;
   bin;
   env;
-  /** M63 — path to the cBPF seccomp program written host-side; passed to `bwrap --seccomp 3` via a
-   * shell redirect. `undefined` when the network is unrestricted OR generation failed (honest fallback). */
-  seccompPath;
+  /** B-600 — the cBPF seccomp program, piped to `bwrap --seccomp 3` from memory (never a file a
+   * confined command could replace). `undefined` when the network is unrestricted or the arch is not
+   * x86_64 (honest fallback). */
+  seccompProgram;
+  denyReadPaths;
+  /**
+   * `"none"` exactly when the wrap passes `--unshare-net` (see `buildBwrapArgv`): a confined mode and
+   * `network` not set. With `network: true`, or under `danger-full-access` where nothing is wrapped,
+   * the command reaches whatever the host does.
+   */
+  networkPolicy;
+  /** `denyReadPaths`: see `BwrapArgvOptions`; a list that cannot be honoured throws `TypeError` here. */
   constructor(config, opts) {
     super(config);
     this.mode = opts.mode;
     this.network = opts.network ?? false;
+    this.networkPolicy = this.network || this.mode === "danger-full-access" ? { mode: "unrestricted" } : { mode: "none" };
     this.cwd = config.workDir ?? process.cwd();
     this.bin = opts.bin ?? "bwrap";
     this.env = opts.env ?? allowlistedEnv();
-    this.seccompPath = seccompPathForNetwork(this.network);
+    this.seccompProgram = seccompProgramForNetwork(this.network);
+    this.denyReadPaths = opts.denyReadPaths;
+    denyReadFlags(this.denyReadPaths, { mode: this.mode, cwd: this.cwd });
   }
   /** Extracted for test visibility — delegates to the pure `wrapCommandForSandbox` (M57, single wrap SoT). */
   wrapCommand(command) {
@@ -263,7 +410,8 @@ var LinuxSandbox = class extends chunkBRWI4HLK_cjs.LocalSandbox {
         network: this.network,
         env: this.env,
         bin: this.bin,
-        seccompPath: this.seccompPath
+        seccompProgram: this.seccompProgram,
+        denyReadPaths: this.denyReadPaths
       },
       command
     );
@@ -281,12 +429,12 @@ var LinuxSandbox = class extends chunkBRWI4HLK_cjs.LocalSandbox {
    * policy as everything else — if bwrap denies the path, the write fails, as it should. The content
    * goes over stdin (not argv) because argv has a size limit and file content does not.
    */
-  async uploadFile(path2, content) {
-    if (this.mode === "danger-full-access") return super.uploadFile(path2, content);
-    const target = path2.startsWith("/") ? path2 : `${this.cwd}/${path2}`;
+  async uploadFile(path3, content) {
+    if (this.mode === "danger-full-access") return super.uploadFile(path3, content);
+    const target = path3.startsWith("/") ? path3 : `${this.cwd}/${path3}`;
     const b64 = Buffer.from(content).toString("base64");
     const r = await this.execute(
-      `mkdir -p ${chunkBRWI4HLK_cjs.shellEscapePosix(path.dirname(target))} && printf %s ${chunkBRWI4HLK_cjs.shellEscapePosix(b64)} | base64 -d > ${chunkBRWI4HLK_cjs.shellEscapePosix(target)}`
+      `mkdir -p ${chunkFLDHYF5C_cjs.shellEscapePosix(path.dirname(target))} && printf %s ${chunkFLDHYF5C_cjs.shellEscapePosix(b64)} | base64 -d > ${chunkFLDHYF5C_cjs.shellEscapePosix(target)}`
     );
     if (r.exitCode !== 0) {
       throw new Error(
@@ -305,21 +453,18 @@ function seccompPathForArch(arch, warn) {
   if (arch !== "x64") {
     if (!warnedNonX64) {
       warnedNonX64 = true;
-      warn(
-        `[sandbox] seccomp syscall filter unsupported on ${arch} (x86_64 only in v1) \u2014 running without the filter; bwrap FS/network confinement still applies.`
-      );
+      warn(nonX64SeccompWarning(arch));
     }
     return void 0;
   }
   try {
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), "ab-seccomp-"));
-    const path2 = path.join(dir, "filter.bpf");
-    fs.writeFileSync(path2, buildSeccompFilter({ networkRestricted: true }));
-    const cleanup = () => fs.rmSync(dir, { recursive: true, force: true });
-    process.once("exit", cleanup);
-    process.once("SIGINT", cleanup);
-    process.once("SIGTERM", cleanup);
-    return path2;
+    const path3 = path.join(dir, "filter.bpf");
+    const program = buildSeccompFilter({ networkRestricted: true });
+    fs.writeFileSync(path3, program);
+    rememberSeccompFile(path3, program);
+    removeDirOnExit(dir);
+    return path3;
   } catch (err) {
     warn(
       `[sandbox] seccomp filter unavailable (${err instanceof Error ? err.message : String(err)}) \u2014 running without syscall filter (bwrap FS/network confinement still applies).`
@@ -330,9 +475,9 @@ function seccompPathForArch(arch, warn) {
 var seccompFilterPath;
 function restrictedSeccompPath() {
   if (seccompFilterPath !== void 0) return seccompFilterPath ?? void 0;
-  const path2 = seccompPathForArch(process.arch, (m) => console.warn(chunkRNXXYF22_cjs.redactSecrets(m)));
-  seccompFilterPath = path2 ?? null;
-  return path2;
+  const path3 = seccompPathForArch(process.arch, (m) => console.warn(chunkRNXXYF22_cjs.redactSecrets(m)));
+  seccompFilterPath = path3 ?? null;
+  return path3;
 }
 var warnedUnavailable = false;
 function __resetSandboxWarnLatchForTests() {
@@ -350,7 +495,8 @@ function resolveSandboxPosture(opts) {
 }
 function createSandboxBackend(opts) {
   const config = { workDir: opts.workDir, timeoutMs: opts.timeoutMs };
-  if (opts.mode === "danger-full-access") return new chunkBRWI4HLK_cjs.LocalSandbox(config);
+  refuseUnhonourableDenyRead(opts.denyReadPaths, opts.mode, opts.detect ?? detectBwrapMemoized);
+  if (opts.mode === "danger-full-access") return new chunkFLDHYF5C_cjs.LocalSandbox(config);
   const detection = (opts.detect ?? detectBwrapMemoized)();
   if (!detection.ok) {
     if (!warnedUnavailable) {
@@ -360,18 +506,19 @@ function createSandboxBackend(opts) {
         `[sandbox] OS-level enforcement unavailable (${detection.reason}) \u2014 falling back to tool-level gating only (sandbox_mode=${opts.mode}).`
       );
     }
-    return new chunkBRWI4HLK_cjs.LocalSandbox(config);
+    return new chunkFLDHYF5C_cjs.LocalSandbox(config);
   }
-  return new LinuxSandbox(config, { mode: opts.mode, network: opts.network, bin: detection.bin });
+  return new LinuxSandbox(config, { ...opts, bin: detection.bin });
 }
 var interactiveWarned = false;
 function __resetInteractiveWarnLatchForTests() {
   interactiveWarned = false;
 }
-function seccompPathForNetwork(networkOpen) {
-  return networkOpen ? void 0 : restrictedSeccompPath();
+function seccompProgramForNetwork(networkOpen) {
+  return networkOpen ? void 0 : restrictedSeccompProgram((m) => console.warn(chunkRNXXYF22_cjs.redactSecrets(m)));
 }
 function decideConfinement(opts) {
+  refuseUnhonourableDenyRead(opts.denyReadPaths, opts.mode, opts.detect ?? detectBwrapMemoized);
   if (opts.mode === "danger-full-access") return null;
   const detection = (opts.detect ?? detectBwrapMemoized)();
   if (detection.ok) return detection.bin;
@@ -395,7 +542,8 @@ function interactiveWrapCommand(opts) {
         network: opts.network ?? false,
         env: allowlistedEnv(),
         bin,
-        seccompPath: seccompPathForNetwork(opts.network ?? false)
+        seccompProgram: seccompProgramForNetwork(opts.network ?? false),
+        denyReadPaths: opts.denyReadPaths
       },
       command
     );
@@ -417,7 +565,7 @@ var RepoProvisionError = class extends chunkCEGU5AVD_cjs.TheokitAgentError {
 };
 var SAFE_INSTANCE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 async function provisionRepo(sandboxOrOpts, maybeOpts) {
-  const sandbox = maybeOpts !== void 0 ? sandboxOrOpts : new chunkBRWI4HLK_cjs.LocalSandbox();
+  const sandbox = maybeOpts !== void 0 ? sandboxOrOpts : new chunkFLDHYF5C_cjs.LocalSandbox();
   const opts = maybeOpts ?? sandboxOrOpts;
   const { repoUrl, ref, instanceId } = opts;
   if (!SAFE_INSTANCE_ID.test(instanceId)) {
@@ -430,20 +578,20 @@ async function provisionRepo(sandboxOrOpts, maybeOpts) {
     throw new RepoProvisionError(instanceId, `invalid ref: must not begin with '-' (got ${ref})`);
   }
   const clone = await sandbox.execute(
-    `git -c protocol.ext.allow=never clone --quiet -- ${chunkBRWI4HLK_cjs.shellEscapePosix(repoUrl)} ${chunkBRWI4HLK_cjs.shellEscapePosix(instanceId)}`
+    `git -c protocol.ext.allow=never clone --quiet -- ${chunkFLDHYF5C_cjs.shellEscapePosix(repoUrl)} ${chunkFLDHYF5C_cjs.shellEscapePosix(instanceId)}`
   );
   if (clone.exitCode !== 0) {
     throw new RepoProvisionError(instanceId, `clone failed: ${clone.stderr.trim()}`);
   }
   const top = await sandbox.execute(
-    `git -C ${chunkBRWI4HLK_cjs.shellEscapePosix(instanceId)} rev-parse --show-toplevel`
+    `git -C ${chunkFLDHYF5C_cjs.shellEscapePosix(instanceId)} rev-parse --show-toplevel`
   );
   if (top.exitCode !== 0) {
     throw new RepoProvisionError(instanceId, `resolve repoDir failed: ${top.stderr.trim()}`);
   }
   const repoDir = top.stdout.trim();
   const checkout = await sandbox.execute(
-    `git -C ${chunkBRWI4HLK_cjs.shellEscapePosix(repoDir)} checkout --quiet ${chunkBRWI4HLK_cjs.shellEscapePosix(ref)}`
+    `git -C ${chunkFLDHYF5C_cjs.shellEscapePosix(repoDir)} checkout --quiet ${chunkFLDHYF5C_cjs.shellEscapePosix(ref)}`
   );
   if (checkout.exitCode !== 0) {
     throw new RepoProvisionError(instanceId, `checkout ${ref} failed: ${checkout.stderr.trim()}`);
@@ -453,23 +601,27 @@ async function provisionRepo(sandboxOrOpts, maybeOpts) {
 
 Object.defineProperty(exports, "LocalSandbox", {
   enumerable: true,
-  get: function () { return chunkBRWI4HLK_cjs.LocalSandbox; }
+  get: function () { return chunkFLDHYF5C_cjs.LocalSandbox; }
 });
 Object.defineProperty(exports, "SandboxBackend", {
   enumerable: true,
-  get: function () { return chunkBRWI4HLK_cjs.SandboxBackend; }
+  get: function () { return chunkFLDHYF5C_cjs.SandboxBackend; }
 });
 Object.defineProperty(exports, "SandboxNotAvailableError", {
   enumerable: true,
-  get: function () { return chunkBRWI4HLK_cjs.SandboxNotAvailableError; }
+  get: function () { return chunkFLDHYF5C_cjs.SandboxNotAvailableError; }
 });
 Object.defineProperty(exports, "SandboxSecurityError", {
   enumerable: true,
-  get: function () { return chunkBRWI4HLK_cjs.SandboxSecurityError; }
+  get: function () { return chunkFLDHYF5C_cjs.SandboxSecurityError; }
 });
 Object.defineProperty(exports, "resolveSandbox", {
   enumerable: true,
-  get: function () { return chunkBRWI4HLK_cjs.resolveSandbox; }
+  get: function () { return chunkFLDHYF5C_cjs.resolveSandbox; }
+});
+Object.defineProperty(exports, "shellEscapePosix", {
+  enumerable: true,
+  get: function () { return chunkFLDHYF5C_cjs.shellEscapePosix; }
 });
 exports.LinuxSandbox = LinuxSandbox;
 exports.RepoProvisionError = RepoProvisionError;