@theokit/sdk 5.12.0 → 5.13.0

package/dist/sandbox/index.js

@@ -1,13 +1,71 @@
-import { shellEscapePosix, LocalSandbox } from '../chunk-EEK7S77K.js';
-export { LocalSandbox, SandboxBackend, SandboxNotAvailableError, SandboxSecurityError, resolveSandbox } from '../chunk-EEK7S77K.js';
+import { shellEscapePosix, LocalSandbox, SandboxNotAvailableError } from '../chunk-QGDPMM3C.js';
+export { LocalSandbox, SandboxBackend, SandboxNotAvailableError, SandboxSecurityError, resolveSandbox, shellEscapePosix } from '../chunk-QGDPMM3C.js';
 import '../chunk-HKCKOAIO.js';
 import { TheokitAgentError } from '../chunk-TNFOU6SB.js';
 import { redactSecrets } from '../chunk-3OY6H3I7.js';
 import { execFileSync } from 'child_process';
-import { existsSync, mkdtempSync, writeFileSync, rmSync } from 'fs';
-import path, { dirname, join } from 'path';
+import { existsSync, mkdtempSync, writeFileSync, statSync, realpathSync, rmSync } from 'fs';
+import path, { dirname, join, resolve } from 'path';
 import { tmpdir } from 'os';
 
+var KEPT_ROOTS_ALWAYS = ["/tmp"];
+function isSameOrInside(outer, inner) {
+  const rel = path.relative(outer, inner);
+  return rel === "" || !rel.startsWith("..") && !path.isAbsolute(rel);
+}
+function resolveEntry(entry) {
+  if (!path.isAbsolute(entry)) {
+    throw new TypeError(`denyReadPaths: "${entry}" is not an absolute path`);
+  }
+  try {
+    return realpathSync(entry);
+  } catch (cause) {
+    throw new TypeError(`denyReadPaths: "${entry}" cannot be resolved: ${String(cause)}`);
+  }
+}
+function keptRoots(cwd) {
+  let real = cwd;
+  try {
+    real = realpathSync(cwd);
+  } catch {
+  }
+  return [.../* @__PURE__ */ new Set([cwd, real, ...KEPT_ROOTS_ALWAYS])];
+}
+function denyReadFlags(paths, policy) {
+  if (paths === void 0 || paths.length === 0) return [];
+  if (policy.mode === "danger-full-access") {
+    throw new TypeError(
+      "denyReadPaths cannot be honoured under danger-full-access: no sandbox is applied"
+    );
+  }
+  const roots = keptRoots(policy.cwd);
+  const resolved = /* @__PURE__ */ new Set();
+  for (const entry of paths) {
+    const target = resolveEntry(entry);
+    const covered = roots.find((root) => isSameOrInside(target, root));
+    if (covered !== void 0) {
+      throw new TypeError(
+        `denyReadPaths: "${entry}" would hide "${covered}", which the command needs`
+      );
+    }
+    resolved.add(target);
+  }
+  return [...resolved].flatMap(
+    (target) => statSync(target).isDirectory() ? ["--tmpfs", target] : ["--ro-bind", "/dev/null", target]
+  );
+}
+function refuseUnhonourableDenyRead(paths, mode, detect) {
+  if (paths === void 0 || paths.length === 0) return;
+  if (mode === "danger-full-access") denyReadFlags(paths, { mode, cwd: "/" });
+  const detection = detect();
+  if (!detection.ok) {
+    throw new SandboxNotAvailableError(
+      `denyReadPaths needs kernel confinement and it is unavailable (${detection.reason}); refusing to run unconfined`
+    );
+  }
+}
+
+// src/sandbox/bwrap.ts
 function pushWorkspaceBinds(argv, cwd, hasGit, gitDir) {
   for (const root of workspaceWriteRoots(cwd)) argv.push("--bind", root, root);
   if (hasGit) argv.push("--ro-bind", gitDir, gitDir);
@@ -26,8 +84,9 @@ function writableRootsFor(mode, cwd) {
   }
 }
 function buildBwrapArgv(mode, opts) {
-  if (mode === "danger-full-access") return null;
   const cwd = path.resolve(opts.cwd);
+  const denyFlags = denyReadFlags(opts.denyReadPaths, { mode, cwd });
+  if (mode === "danger-full-access") return null;
   const gitDir = path.join(cwd, ".git");
   const hasGit = opts.gitDirExists ?? existsSync(gitDir);
   const argv = [
@@ -54,6 +113,7 @@ function buildBwrapArgv(mode, opts) {
   };
   for (const [k, v] of Object.entries(setenv)) argv.push("--setenv", k, v);
   if (mode === "workspace-write") pushWorkspaceBinds(argv, cwd, hasGit, gitDir);
+  argv.push(...denyFlags);
   argv.push("--chdir", cwd, "--");
   return argv;
 }
@@ -180,7 +240,7 @@ function buildSeccompFilter(opts) {
   const denyIdx = body.length - 1;
   push(RET_K, SECCOMP_RET_KILL_PROCESS);
   const killIdx = body.length - 1;
-  const resolve = (i, t) => {
+  const resolve2 = (i, t) => {
     const abs = t === ALLOW ? allowIdx : t === DENY ? denyIdx : t === KILL ? killIdx : i + 1 + t;
     const off = abs - (i + 1);
     if (off < 0 || off > 255) throw new RangeError(`seccomp jump out of range at ${i}: ${off}`);
@@ -188,7 +248,7 @@ function buildSeccompFilter(opts) {
   };
   for (const [i, b] of body.entries()) {
     if (b.code === JEQ_K || b.code === JGE_K) {
-      insns.push(jmp(b.code, b.k, resolve(i, b.jt), resolve(i, b.jf)));
+      insns.push(jmp(b.code, b.k, resolve2(i, b.jt), resolve2(i, b.jf)));
     } else {
       insns.push(stmt(b.code, b.k));
     }
@@ -202,15 +262,90 @@ function buildSeccompFilter(opts) {
   });
   return buf;
 }
+function nonX64SeccompWarning(arch) {
+  return `[sandbox] seccomp syscall filter unsupported on ${arch} (x86_64 only in v1) \u2014 running without the filter; bwrap FS/network confinement still applies.`;
+}
+var warnedNonX64Program = false;
+function seccompProgramForArch(arch, warn) {
+  if (arch !== "x64") {
+    if (!warnedNonX64Program) {
+      warnedNonX64Program = true;
+      warn(nonX64SeccompWarning(arch));
+    }
+    return void 0;
+  }
+  return buildSeccompFilter({ networkRestricted: true });
+}
+var memoizedProgram;
+function restrictedSeccompProgram(warn) {
+  if (memoizedProgram === void 0)
+    memoizedProgram = seccompProgramForArch(process.arch, warn) ?? null;
+  return memoizedProgram ?? void 0;
+}
+function octalPrintfArg(program) {
+  let out = "";
+  for (const byte of program) out += `\\${byte.toString(8).padStart(3, "0")}`;
+  return out;
+}
+function assertSeccompProgramShape(program) {
+  if (program.length === 0 || program.length % 8 !== 0) {
+    throw new TypeError(
+      `seccompProgram must be a positive multiple of 8 bytes, got ${program.length}`
+    );
+  }
+}
+var PIPE_SCRIPT = '{ p=$1; shift; printf "$p" | exec "$@" 3<&0 0<&4 4<&-; } 4<&0';
+function wrapWithSeccompProgram(bwrapArgv, command, program) {
+  assertSeccompProgramShape(program);
+  const words = [octalPrintfArg(program), ...bwrapArgv, "--seccomp", "3", "--", "/bin/sh", "-c"];
+  return `exec /bin/sh -c ${shellEscapePosix(PIPE_SCRIPT)} sh ${[...words, command].map(shellEscapePosix).join(" ")}`;
+}
+var programsWritten = /* @__PURE__ */ new Map();
+function rememberSeccompFile(path3, program) {
+  programsWritten.set(resolve(path3), Buffer.from(program));
+}
+function removeDirOnExit(dir) {
+  const cleanup = () => rmSync(dir, { recursive: true, force: true });
+  process.once("exit", cleanup);
+  for (const signal of ["SIGINT", "SIGTERM"]) {
+    process.prependOnceListener(signal, () => {
+      cleanup();
+      if (process.listenerCount(signal) === 0) process.kill(process.pid, signal);
+    });
+  }
+}
+function wrapWithSeccompPath(bwrapArgv, policy, command, seccompPath) {
+  const program = programsWritten.get(resolve(seccompPath));
+  const bind = program === void 0 ? "--ro-bind" : "--ro-bind-try";
+  const flags = [
+    ...bwrapArgv.slice(0, -3),
+    ...readOnlyBindForSeccompPath(policy.mode, policy.cwd, seccompPath, bind),
+    ...bwrapArgv.slice(-3, -1)
+  ];
+  if (program !== void 0) return wrapWithSeccompProgram(flags, command, program);
+  return `${[...flags, "--seccomp", "3", "--"].map(shellEscapePosix).join(" ")} /bin/sh -c ${shellEscapePosix(command)} 3< ${shellEscapePosix(seccompPath)}`;
+}
+function readOnlyBindForSeccompPath(mode, cwd, seccompPath, bind) {
+  const file = resolve(seccompPath);
+  const dir = dirname(file);
+  const roots = writableRootsFor(mode, resolve(cwd)) ?? [];
+  const covers = (root) => dir === "/" || root === dir || root.startsWith(`${dir}/`);
+  const target = roots.some(covers) ? file : dir;
+  return [bind, target, target];
+}
 
 // src/sandbox/linux-sandbox.ts
 function wrapCommandForSandbox(mode, opts, command) {
-  const argv = buildBwrapArgv(mode, { cwd: opts.cwd, network: opts.network, env: opts.env });
+  const argv = buildBwrapArgv(mode, opts);
   if (argv === null) return null;
   const bin = opts.bin ?? "bwrap";
-  const seccompArgv = opts.seccompPath !== void 0 ? ["--seccomp", "3"] : [];
-  const base = `${shellEscapePosix(bin)} ${[...argv.slice(0, -1), ...seccompArgv, "--"].map(shellEscapePosix).join(" ")} /bin/sh -c ${shellEscapePosix(command)}`;
-  return opts.seccompPath !== void 0 ? `${base} 3< ${shellEscapePosix(opts.seccompPath)}` : base;
+  if (opts.seccompProgram !== void 0) {
+    return wrapWithSeccompProgram([bin, ...argv.slice(0, -1)], command, opts.seccompProgram);
+  }
+  if (opts.seccompPath === void 0) {
+    return `${[bin, ...argv].map(shellEscapePosix).join(" ")} /bin/sh -c ${shellEscapePosix(command)}`;
+  }
+  return wrapWithSeccompPath([bin, ...argv], { mode, cwd: opts.cwd }, command, opts.seccompPath);
 }
 var ENV_ALLOWLIST = [
   "PATH",
@@ -237,17 +372,29 @@ var LinuxSandbox = class extends LocalSandbox {
   cwd;
   bin;
   env;
-  /** M63 — path to the cBPF seccomp program written host-side; passed to `bwrap --seccomp 3` via a
-   * shell redirect. `undefined` when the network is unrestricted OR generation failed (honest fallback). */
-  seccompPath;
+  /** B-600 — the cBPF seccomp program, piped to `bwrap --seccomp 3` from memory (never a file a
+   * confined command could replace). `undefined` when the network is unrestricted or the arch is not
+   * x86_64 (honest fallback). */
+  seccompProgram;
+  denyReadPaths;
+  /**
+   * `"none"` exactly when the wrap passes `--unshare-net` (see `buildBwrapArgv`): a confined mode and
+   * `network` not set. With `network: true`, or under `danger-full-access` where nothing is wrapped,
+   * the command reaches whatever the host does.
+   */
+  networkPolicy;
+  /** `denyReadPaths`: see `BwrapArgvOptions`; a list that cannot be honoured throws `TypeError` here. */
   constructor(config, opts) {
     super(config);
     this.mode = opts.mode;
     this.network = opts.network ?? false;
+    this.networkPolicy = this.network || this.mode === "danger-full-access" ? { mode: "unrestricted" } : { mode: "none" };
     this.cwd = config.workDir ?? process.cwd();
     this.bin = opts.bin ?? "bwrap";
     this.env = opts.env ?? allowlistedEnv();
-    this.seccompPath = seccompPathForNetwork(this.network);
+    this.seccompProgram = seccompProgramForNetwork(this.network);
+    this.denyReadPaths = opts.denyReadPaths;
+    denyReadFlags(this.denyReadPaths, { mode: this.mode, cwd: this.cwd });
   }
   /** Extracted for test visibility — delegates to the pure `wrapCommandForSandbox` (M57, single wrap SoT). */
   wrapCommand(command) {
@@ -258,7 +405,8 @@ var LinuxSandbox = class extends LocalSandbox {
         network: this.network,
         env: this.env,
         bin: this.bin,
-        seccompPath: this.seccompPath
+        seccompProgram: this.seccompProgram,
+        denyReadPaths: this.denyReadPaths
       },
       command
     );
@@ -276,9 +424,9 @@ var LinuxSandbox = class extends LocalSandbox {
    * policy as everything else — if bwrap denies the path, the write fails, as it should. The content
    * goes over stdin (not argv) because argv has a size limit and file content does not.
    */
-  async uploadFile(path2, content) {
-    if (this.mode === "danger-full-access") return super.uploadFile(path2, content);
-    const target = path2.startsWith("/") ? path2 : `${this.cwd}/${path2}`;
+  async uploadFile(path3, content) {
+    if (this.mode === "danger-full-access") return super.uploadFile(path3, content);
+    const target = path3.startsWith("/") ? path3 : `${this.cwd}/${path3}`;
     const b64 = Buffer.from(content).toString("base64");
     const r = await this.execute(
       `mkdir -p ${shellEscapePosix(dirname(target))} && printf %s ${shellEscapePosix(b64)} | base64 -d > ${shellEscapePosix(target)}`
@@ -300,21 +448,18 @@ function seccompPathForArch(arch, warn) {
   if (arch !== "x64") {
     if (!warnedNonX64) {
       warnedNonX64 = true;
-      warn(
-        `[sandbox] seccomp syscall filter unsupported on ${arch} (x86_64 only in v1) \u2014 running without the filter; bwrap FS/network confinement still applies.`
-      );
+      warn(nonX64SeccompWarning(arch));
     }
     return void 0;
   }
   try {
     const dir = mkdtempSync(join(tmpdir(), "ab-seccomp-"));
-    const path2 = join(dir, "filter.bpf");
-    writeFileSync(path2, buildSeccompFilter({ networkRestricted: true }));
-    const cleanup = () => rmSync(dir, { recursive: true, force: true });
-    process.once("exit", cleanup);
-    process.once("SIGINT", cleanup);
-    process.once("SIGTERM", cleanup);
-    return path2;
+    const path3 = join(dir, "filter.bpf");
+    const program = buildSeccompFilter({ networkRestricted: true });
+    writeFileSync(path3, program);
+    rememberSeccompFile(path3, program);
+    removeDirOnExit(dir);
+    return path3;
   } catch (err) {
     warn(
       `[sandbox] seccomp filter unavailable (${err instanceof Error ? err.message : String(err)}) \u2014 running without syscall filter (bwrap FS/network confinement still applies).`
@@ -325,9 +470,9 @@ function seccompPathForArch(arch, warn) {
 var seccompFilterPath;
 function restrictedSeccompPath() {
   if (seccompFilterPath !== void 0) return seccompFilterPath ?? void 0;
-  const path2 = seccompPathForArch(process.arch, (m) => console.warn(redactSecrets(m)));
-  seccompFilterPath = path2 ?? null;
-  return path2;
+  const path3 = seccompPathForArch(process.arch, (m) => console.warn(redactSecrets(m)));
+  seccompFilterPath = path3 ?? null;
+  return path3;
 }
 var warnedUnavailable = false;
 function __resetSandboxWarnLatchForTests() {
@@ -345,6 +490,7 @@ function resolveSandboxPosture(opts) {
 }
 function createSandboxBackend(opts) {
   const config = { workDir: opts.workDir, timeoutMs: opts.timeoutMs };
+  refuseUnhonourableDenyRead(opts.denyReadPaths, opts.mode, opts.detect ?? detectBwrapMemoized);
   if (opts.mode === "danger-full-access") return new LocalSandbox(config);
   const detection = (opts.detect ?? detectBwrapMemoized)();
   if (!detection.ok) {
@@ -357,16 +503,17 @@ function createSandboxBackend(opts) {
     }
     return new LocalSandbox(config);
   }
-  return new LinuxSandbox(config, { mode: opts.mode, network: opts.network, bin: detection.bin });
+  return new LinuxSandbox(config, { ...opts, bin: detection.bin });
 }
 var interactiveWarned = false;
 function __resetInteractiveWarnLatchForTests() {
   interactiveWarned = false;
 }
-function seccompPathForNetwork(networkOpen) {
-  return networkOpen ? void 0 : restrictedSeccompPath();
+function seccompProgramForNetwork(networkOpen) {
+  return networkOpen ? void 0 : restrictedSeccompProgram((m) => console.warn(redactSecrets(m)));
 }
 function decideConfinement(opts) {
+  refuseUnhonourableDenyRead(opts.denyReadPaths, opts.mode, opts.detect ?? detectBwrapMemoized);
   if (opts.mode === "danger-full-access") return null;
   const detection = (opts.detect ?? detectBwrapMemoized)();
   if (detection.ok) return detection.bin;
@@ -390,7 +537,8 @@ function interactiveWrapCommand(opts) {
         network: opts.network ?? false,
         env: allowlistedEnv(),
         bin,
-        seccompPath: seccompPathForNetwork(opts.network ?? false)
+        seccompProgram: seccompProgramForNetwork(opts.network ?? false),
+        denyReadPaths: opts.denyReadPaths
       },
       command
     );