@theokit/sdk 5.12.1 → 5.13.0

package/dist/sandbox/index.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkEPANMGH7_cjs = require('../chunk-EPANMGH7.cjs');
+var chunkFLDHYF5C_cjs = require('../chunk-FLDHYF5C.cjs');
 require('../chunk-2ZPEDVLM.cjs');
 var chunkCEGU5AVD_cjs = require('../chunk-CEGU5AVD.cjs');
 var chunkRNXXYF22_cjs = require('../chunk-RNXXYF22.cjs');
@@ -13,6 +13,64 @@ function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
 var path__default = /*#__PURE__*/_interopDefault(path);
 
+var KEPT_ROOTS_ALWAYS = ["/tmp"];
+function isSameOrInside(outer, inner) {
+  const rel = path__default.default.relative(outer, inner);
+  return rel === "" || !rel.startsWith("..") && !path__default.default.isAbsolute(rel);
+}
+function resolveEntry(entry) {
+  if (!path__default.default.isAbsolute(entry)) {
+    throw new TypeError(`denyReadPaths: "${entry}" is not an absolute path`);
+  }
+  try {
+    return fs.realpathSync(entry);
+  } catch (cause) {
+    throw new TypeError(`denyReadPaths: "${entry}" cannot be resolved: ${String(cause)}`);
+  }
+}
+function keptRoots(cwd) {
+  let real = cwd;
+  try {
+    real = fs.realpathSync(cwd);
+  } catch {
+  }
+  return [.../* @__PURE__ */ new Set([cwd, real, ...KEPT_ROOTS_ALWAYS])];
+}
+function denyReadFlags(paths, policy) {
+  if (paths === void 0 || paths.length === 0) return [];
+  if (policy.mode === "danger-full-access") {
+    throw new TypeError(
+      "denyReadPaths cannot be honoured under danger-full-access: no sandbox is applied"
+    );
+  }
+  const roots = keptRoots(policy.cwd);
+  const resolved = /* @__PURE__ */ new Set();
+  for (const entry of paths) {
+    const target = resolveEntry(entry);
+    const covered = roots.find((root) => isSameOrInside(target, root));
+    if (covered !== void 0) {
+      throw new TypeError(
+        `denyReadPaths: "${entry}" would hide "${covered}", which the command needs`
+      );
+    }
+    resolved.add(target);
+  }
+  return [...resolved].flatMap(
+    (target) => fs.statSync(target).isDirectory() ? ["--tmpfs", target] : ["--ro-bind", "/dev/null", target]
+  );
+}
+function refuseUnhonourableDenyRead(paths, mode, detect) {
+  if (paths === void 0 || paths.length === 0) return;
+  if (mode === "danger-full-access") denyReadFlags(paths, { mode, cwd: "/" });
+  const detection = detect();
+  if (!detection.ok) {
+    throw new chunkFLDHYF5C_cjs.SandboxNotAvailableError(
+      `denyReadPaths needs kernel confinement and it is unavailable (${detection.reason}); refusing to run unconfined`
+    );
+  }
+}
+
+// src/sandbox/bwrap.ts
 function pushWorkspaceBinds(argv, cwd, hasGit, gitDir) {
   for (const root of workspaceWriteRoots(cwd)) argv.push("--bind", root, root);
   if (hasGit) argv.push("--ro-bind", gitDir, gitDir);
@@ -31,8 +89,9 @@ function writableRootsFor(mode, cwd) {
   }
 }
 function buildBwrapArgv(mode, opts) {
-  if (mode === "danger-full-access") return null;
   const cwd = path__default.default.resolve(opts.cwd);
+  const denyFlags = denyReadFlags(opts.denyReadPaths, { mode, cwd });
+  if (mode === "danger-full-access") return null;
   const gitDir = path__default.default.join(cwd, ".git");
   const hasGit = opts.gitDirExists ?? fs.existsSync(gitDir);
   const argv = [
@@ -59,6 +118,7 @@ function buildBwrapArgv(mode, opts) {
   };
   for (const [k, v] of Object.entries(setenv)) argv.push("--setenv", k, v);
   if (mode === "workspace-write") pushWorkspaceBinds(argv, cwd, hasGit, gitDir);
+  argv.push(...denyFlags);
   argv.push("--chdir", cwd, "--");
   return argv;
 }
@@ -243,17 +303,17 @@ var PIPE_SCRIPT = '{ p=$1; shift; printf "$p" | exec "$@" 3<&0 0<&4 4<&-; } 4<&0
 function wrapWithSeccompProgram(bwrapArgv, command, program) {
   assertSeccompProgramShape(program);
   const words = [octalPrintfArg(program), ...bwrapArgv, "--seccomp", "3", "--", "/bin/sh", "-c"];
-  return `exec /bin/sh -c ${chunkEPANMGH7_cjs.shellEscapePosix(PIPE_SCRIPT)} sh ${[...words, command].map(chunkEPANMGH7_cjs.shellEscapePosix).join(" ")}`;
+  return `exec /bin/sh -c ${chunkFLDHYF5C_cjs.shellEscapePosix(PIPE_SCRIPT)} sh ${[...words, command].map(chunkFLDHYF5C_cjs.shellEscapePosix).join(" ")}`;
 }
 var programsWritten = /* @__PURE__ */ new Map();
-function rememberSeccompFile(path2, program) {
-  programsWritten.set(path.resolve(path2), Buffer.from(program));
+function rememberSeccompFile(path3, program) {
+  programsWritten.set(path.resolve(path3), Buffer.from(program));
 }
 function removeDirOnExit(dir) {
   const cleanup = () => fs.rmSync(dir, { recursive: true, force: true });
   process.once("exit", cleanup);
   for (const signal of ["SIGINT", "SIGTERM"]) {
-    process.once(signal, () => {
+    process.prependOnceListener(signal, () => {
       cleanup();
       if (process.listenerCount(signal) === 0) process.kill(process.pid, signal);
     });
@@ -268,7 +328,7 @@ function wrapWithSeccompPath(bwrapArgv, policy, command, seccompPath) {
     ...bwrapArgv.slice(-3, -1)
   ];
   if (program !== void 0) return wrapWithSeccompProgram(flags, command, program);
-  return `${[...flags, "--seccomp", "3", "--"].map(chunkEPANMGH7_cjs.shellEscapePosix).join(" ")} /bin/sh -c ${chunkEPANMGH7_cjs.shellEscapePosix(command)} 3< ${chunkEPANMGH7_cjs.shellEscapePosix(seccompPath)}`;
+  return `${[...flags, "--seccomp", "3", "--"].map(chunkFLDHYF5C_cjs.shellEscapePosix).join(" ")} /bin/sh -c ${chunkFLDHYF5C_cjs.shellEscapePosix(command)} 3< ${chunkFLDHYF5C_cjs.shellEscapePosix(seccompPath)}`;
 }
 function readOnlyBindForSeccompPath(mode, cwd, seccompPath, bind) {
   const file = path.resolve(seccompPath);
@@ -281,14 +341,14 @@ function readOnlyBindForSeccompPath(mode, cwd, seccompPath, bind) {
 
 // src/sandbox/linux-sandbox.ts
 function wrapCommandForSandbox(mode, opts, command) {
-  const argv = buildBwrapArgv(mode, { cwd: opts.cwd, network: opts.network, env: opts.env });
+  const argv = buildBwrapArgv(mode, opts);
   if (argv === null) return null;
   const bin = opts.bin ?? "bwrap";
   if (opts.seccompProgram !== void 0) {
     return wrapWithSeccompProgram([bin, ...argv.slice(0, -1)], command, opts.seccompProgram);
   }
   if (opts.seccompPath === void 0) {
-    return `${[bin, ...argv].map(chunkEPANMGH7_cjs.shellEscapePosix).join(" ")} /bin/sh -c ${chunkEPANMGH7_cjs.shellEscapePosix(command)}`;
+    return `${[bin, ...argv].map(chunkFLDHYF5C_cjs.shellEscapePosix).join(" ")} /bin/sh -c ${chunkFLDHYF5C_cjs.shellEscapePosix(command)}`;
   }
   return wrapWithSeccompPath([bin, ...argv], { mode, cwd: opts.cwd }, command, opts.seccompPath);
 }
@@ -311,7 +371,7 @@ function allowlistedEnv(source = process.env) {
   }
   return out;
 }
-var LinuxSandbox = class extends chunkEPANMGH7_cjs.LocalSandbox {
+var LinuxSandbox = class extends chunkFLDHYF5C_cjs.LocalSandbox {
   mode;
   network;
   cwd;
@@ -321,14 +381,25 @@ var LinuxSandbox = class extends chunkEPANMGH7_cjs.LocalSandbox {
    * confined command could replace). `undefined` when the network is unrestricted or the arch is not
    * x86_64 (honest fallback). */
   seccompProgram;
+  denyReadPaths;
+  /**
+   * `"none"` exactly when the wrap passes `--unshare-net` (see `buildBwrapArgv`): a confined mode and
+   * `network` not set. With `network: true`, or under `danger-full-access` where nothing is wrapped,
+   * the command reaches whatever the host does.
+   */
+  networkPolicy;
+  /** `denyReadPaths`: see `BwrapArgvOptions`; a list that cannot be honoured throws `TypeError` here. */
   constructor(config, opts) {
     super(config);
     this.mode = opts.mode;
     this.network = opts.network ?? false;
+    this.networkPolicy = this.network || this.mode === "danger-full-access" ? { mode: "unrestricted" } : { mode: "none" };
     this.cwd = config.workDir ?? process.cwd();
     this.bin = opts.bin ?? "bwrap";
     this.env = opts.env ?? allowlistedEnv();
     this.seccompProgram = seccompProgramForNetwork(this.network);
+    this.denyReadPaths = opts.denyReadPaths;
+    denyReadFlags(this.denyReadPaths, { mode: this.mode, cwd: this.cwd });
   }
   /** Extracted for test visibility — delegates to the pure `wrapCommandForSandbox` (M57, single wrap SoT). */
   wrapCommand(command) {
@@ -339,7 +410,8 @@ var LinuxSandbox = class extends chunkEPANMGH7_cjs.LocalSandbox {
         network: this.network,
         env: this.env,
         bin: this.bin,
-        seccompProgram: this.seccompProgram
+        seccompProgram: this.seccompProgram,
+        denyReadPaths: this.denyReadPaths
       },
       command
     );
@@ -357,12 +429,12 @@ var LinuxSandbox = class extends chunkEPANMGH7_cjs.LocalSandbox {
    * policy as everything else — if bwrap denies the path, the write fails, as it should. The content
    * goes over stdin (not argv) because argv has a size limit and file content does not.
    */
-  async uploadFile(path2, content) {
-    if (this.mode === "danger-full-access") return super.uploadFile(path2, content);
-    const target = path2.startsWith("/") ? path2 : `${this.cwd}/${path2}`;
+  async uploadFile(path3, content) {
+    if (this.mode === "danger-full-access") return super.uploadFile(path3, content);
+    const target = path3.startsWith("/") ? path3 : `${this.cwd}/${path3}`;
     const b64 = Buffer.from(content).toString("base64");
     const r = await this.execute(
-      `mkdir -p ${chunkEPANMGH7_cjs.shellEscapePosix(path.dirname(target))} && printf %s ${chunkEPANMGH7_cjs.shellEscapePosix(b64)} | base64 -d > ${chunkEPANMGH7_cjs.shellEscapePosix(target)}`
+      `mkdir -p ${chunkFLDHYF5C_cjs.shellEscapePosix(path.dirname(target))} && printf %s ${chunkFLDHYF5C_cjs.shellEscapePosix(b64)} | base64 -d > ${chunkFLDHYF5C_cjs.shellEscapePosix(target)}`
     );
     if (r.exitCode !== 0) {
       throw new Error(
@@ -387,12 +459,12 @@ function seccompPathForArch(arch, warn) {
   }
   try {
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), "ab-seccomp-"));
-    const path2 = path.join(dir, "filter.bpf");
+    const path3 = path.join(dir, "filter.bpf");
     const program = buildSeccompFilter({ networkRestricted: true });
-    fs.writeFileSync(path2, program);
-    rememberSeccompFile(path2, program);
+    fs.writeFileSync(path3, program);
+    rememberSeccompFile(path3, program);
     removeDirOnExit(dir);
-    return path2;
+    return path3;
   } catch (err) {
     warn(
       `[sandbox] seccomp filter unavailable (${err instanceof Error ? err.message : String(err)}) \u2014 running without syscall filter (bwrap FS/network confinement still applies).`
@@ -403,9 +475,9 @@ function seccompPathForArch(arch, warn) {
 var seccompFilterPath;
 function restrictedSeccompPath() {
   if (seccompFilterPath !== void 0) return seccompFilterPath ?? void 0;
-  const path2 = seccompPathForArch(process.arch, (m) => console.warn(chunkRNXXYF22_cjs.redactSecrets(m)));
-  seccompFilterPath = path2 ?? null;
-  return path2;
+  const path3 = seccompPathForArch(process.arch, (m) => console.warn(chunkRNXXYF22_cjs.redactSecrets(m)));
+  seccompFilterPath = path3 ?? null;
+  return path3;
 }
 var warnedUnavailable = false;
 function __resetSandboxWarnLatchForTests() {
@@ -423,7 +495,8 @@ function resolveSandboxPosture(opts) {
 }
 function createSandboxBackend(opts) {
   const config = { workDir: opts.workDir, timeoutMs: opts.timeoutMs };
-  if (opts.mode === "danger-full-access") return new chunkEPANMGH7_cjs.LocalSandbox(config);
+  refuseUnhonourableDenyRead(opts.denyReadPaths, opts.mode, opts.detect ?? detectBwrapMemoized);
+  if (opts.mode === "danger-full-access") return new chunkFLDHYF5C_cjs.LocalSandbox(config);
   const detection = (opts.detect ?? detectBwrapMemoized)();
   if (!detection.ok) {
     if (!warnedUnavailable) {
@@ -433,9 +506,9 @@ function createSandboxBackend(opts) {
         `[sandbox] OS-level enforcement unavailable (${detection.reason}) \u2014 falling back to tool-level gating only (sandbox_mode=${opts.mode}).`
       );
     }
-    return new chunkEPANMGH7_cjs.LocalSandbox(config);
+    return new chunkFLDHYF5C_cjs.LocalSandbox(config);
   }
-  return new LinuxSandbox(config, { mode: opts.mode, network: opts.network, bin: detection.bin });
+  return new LinuxSandbox(config, { ...opts, bin: detection.bin });
 }
 var interactiveWarned = false;
 function __resetInteractiveWarnLatchForTests() {
@@ -445,6 +518,7 @@ function seccompProgramForNetwork(networkOpen) {
   return networkOpen ? void 0 : restrictedSeccompProgram((m) => console.warn(chunkRNXXYF22_cjs.redactSecrets(m)));
 }
 function decideConfinement(opts) {
+  refuseUnhonourableDenyRead(opts.denyReadPaths, opts.mode, opts.detect ?? detectBwrapMemoized);
   if (opts.mode === "danger-full-access") return null;
   const detection = (opts.detect ?? detectBwrapMemoized)();
   if (detection.ok) return detection.bin;
@@ -468,7 +542,8 @@ function interactiveWrapCommand(opts) {
         network: opts.network ?? false,
         env: allowlistedEnv(),
         bin,
-        seccompProgram: seccompProgramForNetwork(opts.network ?? false)
+        seccompProgram: seccompProgramForNetwork(opts.network ?? false),
+        denyReadPaths: opts.denyReadPaths
       },
       command
     );
@@ -490,7 +565,7 @@ var RepoProvisionError = class extends chunkCEGU5AVD_cjs.TheokitAgentError {
 };
 var SAFE_INSTANCE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 async function provisionRepo(sandboxOrOpts, maybeOpts) {
-  const sandbox = maybeOpts !== void 0 ? sandboxOrOpts : new chunkEPANMGH7_cjs.LocalSandbox();
+  const sandbox = maybeOpts !== void 0 ? sandboxOrOpts : new chunkFLDHYF5C_cjs.LocalSandbox();
   const opts = maybeOpts ?? sandboxOrOpts;
   const { repoUrl, ref, instanceId } = opts;
   if (!SAFE_INSTANCE_ID.test(instanceId)) {
@@ -503,20 +578,20 @@ async function provisionRepo(sandboxOrOpts, maybeOpts) {
     throw new RepoProvisionError(instanceId, `invalid ref: must not begin with '-' (got ${ref})`);
   }
   const clone = await sandbox.execute(
-    `git -c protocol.ext.allow=never clone --quiet -- ${chunkEPANMGH7_cjs.shellEscapePosix(repoUrl)} ${chunkEPANMGH7_cjs.shellEscapePosix(instanceId)}`
+    `git -c protocol.ext.allow=never clone --quiet -- ${chunkFLDHYF5C_cjs.shellEscapePosix(repoUrl)} ${chunkFLDHYF5C_cjs.shellEscapePosix(instanceId)}`
   );
   if (clone.exitCode !== 0) {
     throw new RepoProvisionError(instanceId, `clone failed: ${clone.stderr.trim()}`);
   }
   const top = await sandbox.execute(
-    `git -C ${chunkEPANMGH7_cjs.shellEscapePosix(instanceId)} rev-parse --show-toplevel`
+    `git -C ${chunkFLDHYF5C_cjs.shellEscapePosix(instanceId)} rev-parse --show-toplevel`
   );
   if (top.exitCode !== 0) {
     throw new RepoProvisionError(instanceId, `resolve repoDir failed: ${top.stderr.trim()}`);
   }
   const repoDir = top.stdout.trim();
   const checkout = await sandbox.execute(
-    `git -C ${chunkEPANMGH7_cjs.shellEscapePosix(repoDir)} checkout --quiet ${chunkEPANMGH7_cjs.shellEscapePosix(ref)}`
+    `git -C ${chunkFLDHYF5C_cjs.shellEscapePosix(repoDir)} checkout --quiet ${chunkFLDHYF5C_cjs.shellEscapePosix(ref)}`
   );
   if (checkout.exitCode !== 0) {
     throw new RepoProvisionError(instanceId, `checkout ${ref} failed: ${checkout.stderr.trim()}`);
@@ -526,23 +601,27 @@ async function provisionRepo(sandboxOrOpts, maybeOpts) {
 
 Object.defineProperty(exports, "LocalSandbox", {
   enumerable: true,
-  get: function () { return chunkEPANMGH7_cjs.LocalSandbox; }
+  get: function () { return chunkFLDHYF5C_cjs.LocalSandbox; }
 });
 Object.defineProperty(exports, "SandboxBackend", {
   enumerable: true,
-  get: function () { return chunkEPANMGH7_cjs.SandboxBackend; }
+  get: function () { return chunkFLDHYF5C_cjs.SandboxBackend; }
 });
 Object.defineProperty(exports, "SandboxNotAvailableError", {
   enumerable: true,
-  get: function () { return chunkEPANMGH7_cjs.SandboxNotAvailableError; }
+  get: function () { return chunkFLDHYF5C_cjs.SandboxNotAvailableError; }
 });
 Object.defineProperty(exports, "SandboxSecurityError", {
   enumerable: true,
-  get: function () { return chunkEPANMGH7_cjs.SandboxSecurityError; }
+  get: function () { return chunkFLDHYF5C_cjs.SandboxSecurityError; }
 });
 Object.defineProperty(exports, "resolveSandbox", {
   enumerable: true,
-  get: function () { return chunkEPANMGH7_cjs.resolveSandbox; }
+  get: function () { return chunkFLDHYF5C_cjs.resolveSandbox; }
+});
+Object.defineProperty(exports, "shellEscapePosix", {
+  enumerable: true,
+  get: function () { return chunkFLDHYF5C_cjs.shellEscapePosix; }
 });
 exports.LinuxSandbox = LinuxSandbox;
 exports.RepoProvisionError = RepoProvisionError;