@theokit/sdk 5.12.1 → 5.14.0

package/dist/sandbox/index.js

@@ -1,13 +1,71 @@
-import { shellEscapePosix, LocalSandbox } from '../chunk-NBNRQN6T.js';
-export { LocalSandbox, SandboxBackend, SandboxNotAvailableError, SandboxSecurityError, resolveSandbox } from '../chunk-NBNRQN6T.js';
+import { shellEscapePosix, LocalSandbox, SandboxNotAvailableError } from '../chunk-QGDPMM3C.js';
+export { LocalSandbox, SandboxBackend, SandboxNotAvailableError, SandboxSecurityError, resolveSandbox, shellEscapePosix } from '../chunk-QGDPMM3C.js';
 import '../chunk-HKCKOAIO.js';
 import { TheokitAgentError } from '../chunk-TNFOU6SB.js';
 import { redactSecrets } from '../chunk-3OY6H3I7.js';
 import { execFileSync } from 'child_process';
-import { existsSync, mkdtempSync, writeFileSync, rmSync } from 'fs';
+import { existsSync, mkdtempSync, writeFileSync, statSync, realpathSync, rmSync } from 'fs';
 import path, { dirname, join, resolve } from 'path';
 import { tmpdir } from 'os';
 
+var KEPT_ROOTS_ALWAYS = ["/tmp"];
+function isSameOrInside(outer, inner) {
+  const rel = path.relative(outer, inner);
+  return rel === "" || !rel.startsWith("..") && !path.isAbsolute(rel);
+}
+function resolveEntry(entry) {
+  if (!path.isAbsolute(entry)) {
+    throw new TypeError(`denyReadPaths: "${entry}" is not an absolute path`);
+  }
+  try {
+    return realpathSync(entry);
+  } catch (cause) {
+    throw new TypeError(`denyReadPaths: "${entry}" cannot be resolved: ${String(cause)}`);
+  }
+}
+function keptRoots(cwd) {
+  let real = cwd;
+  try {
+    real = realpathSync(cwd);
+  } catch {
+  }
+  return [.../* @__PURE__ */ new Set([cwd, real, ...KEPT_ROOTS_ALWAYS])];
+}
+function denyReadFlags(paths, policy) {
+  if (paths === void 0 || paths.length === 0) return [];
+  if (policy.mode === "danger-full-access") {
+    throw new TypeError(
+      "denyReadPaths cannot be honoured under danger-full-access: no sandbox is applied"
+    );
+  }
+  const roots = keptRoots(policy.cwd);
+  const resolved = /* @__PURE__ */ new Set();
+  for (const entry of paths) {
+    const target = resolveEntry(entry);
+    const covered = roots.find((root) => isSameOrInside(target, root));
+    if (covered !== void 0) {
+      throw new TypeError(
+        `denyReadPaths: "${entry}" would hide "${covered}", which the command needs`
+      );
+    }
+    resolved.add(target);
+  }
+  return [...resolved].flatMap(
+    (target) => statSync(target).isDirectory() ? ["--tmpfs", target] : ["--ro-bind", "/dev/null", target]
+  );
+}
+function refuseUnhonourableDenyRead(paths, mode, detect) {
+  if (paths === void 0 || paths.length === 0) return;
+  if (mode === "danger-full-access") denyReadFlags(paths, { mode, cwd: "/" });
+  const detection = detect();
+  if (!detection.ok) {
+    throw new SandboxNotAvailableError(
+      `denyReadPaths needs kernel confinement and it is unavailable (${detection.reason}); refusing to run unconfined`
+    );
+  }
+}
+
+// src/sandbox/bwrap.ts
 function pushWorkspaceBinds(argv, cwd, hasGit, gitDir) {
   for (const root of workspaceWriteRoots(cwd)) argv.push("--bind", root, root);
   if (hasGit) argv.push("--ro-bind", gitDir, gitDir);
@@ -26,8 +84,9 @@ function writableRootsFor(mode, cwd) {
   }
 }
 function buildBwrapArgv(mode, opts) {
-  if (mode === "danger-full-access") return null;
   const cwd = path.resolve(opts.cwd);
+  const denyFlags = denyReadFlags(opts.denyReadPaths, { mode, cwd });
+  if (mode === "danger-full-access") return null;
   const gitDir = path.join(cwd, ".git");
   const hasGit = opts.gitDirExists ?? existsSync(gitDir);
   const argv = [
@@ -54,6 +113,7 @@ function buildBwrapArgv(mode, opts) {
   };
   for (const [k, v] of Object.entries(setenv)) argv.push("--setenv", k, v);
   if (mode === "workspace-write") pushWorkspaceBinds(argv, cwd, hasGit, gitDir);
+  argv.push(...denyFlags);
   argv.push("--chdir", cwd, "--");
   return argv;
 }
@@ -241,14 +301,14 @@ function wrapWithSeccompProgram(bwrapArgv, command, program) {
   return `exec /bin/sh -c ${shellEscapePosix(PIPE_SCRIPT)} sh ${[...words, command].map(shellEscapePosix).join(" ")}`;
 }
 var programsWritten = /* @__PURE__ */ new Map();
-function rememberSeccompFile(path2, program) {
-  programsWritten.set(resolve(path2), Buffer.from(program));
+function rememberSeccompFile(path3, program) {
+  programsWritten.set(resolve(path3), Buffer.from(program));
 }
 function removeDirOnExit(dir) {
   const cleanup = () => rmSync(dir, { recursive: true, force: true });
   process.once("exit", cleanup);
   for (const signal of ["SIGINT", "SIGTERM"]) {
-    process.once(signal, () => {
+    process.prependOnceListener(signal, () => {
       cleanup();
       if (process.listenerCount(signal) === 0) process.kill(process.pid, signal);
     });
@@ -276,7 +336,7 @@ function readOnlyBindForSeccompPath(mode, cwd, seccompPath, bind) {
 
 // src/sandbox/linux-sandbox.ts
 function wrapCommandForSandbox(mode, opts, command) {
-  const argv = buildBwrapArgv(mode, { cwd: opts.cwd, network: opts.network, env: opts.env });
+  const argv = buildBwrapArgv(mode, opts);
   if (argv === null) return null;
   const bin = opts.bin ?? "bwrap";
   if (opts.seccompProgram !== void 0) {
@@ -316,14 +376,25 @@ var LinuxSandbox = class extends LocalSandbox {
    * confined command could replace). `undefined` when the network is unrestricted or the arch is not
    * x86_64 (honest fallback). */
   seccompProgram;
+  denyReadPaths;
+  /**
+   * `"none"` exactly when the wrap passes `--unshare-net` (see `buildBwrapArgv`): a confined mode and
+   * `network` not set. With `network: true`, or under `danger-full-access` where nothing is wrapped,
+   * the command reaches whatever the host does.
+   */
+  networkPolicy;
+  /** `denyReadPaths`: see `BwrapArgvOptions`; a list that cannot be honoured throws `TypeError` here. */
   constructor(config, opts) {
     super(config);
     this.mode = opts.mode;
     this.network = opts.network ?? false;
+    this.networkPolicy = this.network || this.mode === "danger-full-access" ? { mode: "unrestricted" } : { mode: "none" };
     this.cwd = config.workDir ?? process.cwd();
     this.bin = opts.bin ?? "bwrap";
     this.env = opts.env ?? allowlistedEnv();
     this.seccompProgram = seccompProgramForNetwork(this.network);
+    this.denyReadPaths = opts.denyReadPaths;
+    denyReadFlags(this.denyReadPaths, { mode: this.mode, cwd: this.cwd });
   }
   /** Extracted for test visibility — delegates to the pure `wrapCommandForSandbox` (M57, single wrap SoT). */
   wrapCommand(command) {
@@ -334,7 +405,8 @@ var LinuxSandbox = class extends LocalSandbox {
         network: this.network,
         env: this.env,
         bin: this.bin,
-        seccompProgram: this.seccompProgram
+        seccompProgram: this.seccompProgram,
+        denyReadPaths: this.denyReadPaths
       },
       command
     );
@@ -352,9 +424,9 @@ var LinuxSandbox = class extends LocalSandbox {
    * policy as everything else — if bwrap denies the path, the write fails, as it should. The content
    * goes over stdin (not argv) because argv has a size limit and file content does not.
    */
-  async uploadFile(path2, content) {
-    if (this.mode === "danger-full-access") return super.uploadFile(path2, content);
-    const target = path2.startsWith("/") ? path2 : `${this.cwd}/${path2}`;
+  async uploadFile(path3, content) {
+    if (this.mode === "danger-full-access") return super.uploadFile(path3, content);
+    const target = path3.startsWith("/") ? path3 : `${this.cwd}/${path3}`;
     const b64 = Buffer.from(content).toString("base64");
     const r = await this.execute(
       `mkdir -p ${shellEscapePosix(dirname(target))} && printf %s ${shellEscapePosix(b64)} | base64 -d > ${shellEscapePosix(target)}`
@@ -382,12 +454,12 @@ function seccompPathForArch(arch, warn) {
   }
   try {
     const dir = mkdtempSync(join(tmpdir(), "ab-seccomp-"));
-    const path2 = join(dir, "filter.bpf");
+    const path3 = join(dir, "filter.bpf");
     const program = buildSeccompFilter({ networkRestricted: true });
-    writeFileSync(path2, program);
-    rememberSeccompFile(path2, program);
+    writeFileSync(path3, program);
+    rememberSeccompFile(path3, program);
     removeDirOnExit(dir);
-    return path2;
+    return path3;
   } catch (err) {
     warn(
       `[sandbox] seccomp filter unavailable (${err instanceof Error ? err.message : String(err)}) \u2014 running without syscall filter (bwrap FS/network confinement still applies).`
@@ -398,9 +470,9 @@ function seccompPathForArch(arch, warn) {
 var seccompFilterPath;
 function restrictedSeccompPath() {
   if (seccompFilterPath !== void 0) return seccompFilterPath ?? void 0;
-  const path2 = seccompPathForArch(process.arch, (m) => console.warn(redactSecrets(m)));
-  seccompFilterPath = path2 ?? null;
-  return path2;
+  const path3 = seccompPathForArch(process.arch, (m) => console.warn(redactSecrets(m)));
+  seccompFilterPath = path3 ?? null;
+  return path3;
 }
 var warnedUnavailable = false;
 function __resetSandboxWarnLatchForTests() {
@@ -418,6 +490,7 @@ function resolveSandboxPosture(opts) {
 }
 function createSandboxBackend(opts) {
   const config = { workDir: opts.workDir, timeoutMs: opts.timeoutMs };
+  refuseUnhonourableDenyRead(opts.denyReadPaths, opts.mode, opts.detect ?? detectBwrapMemoized);
   if (opts.mode === "danger-full-access") return new LocalSandbox(config);
   const detection = (opts.detect ?? detectBwrapMemoized)();
   if (!detection.ok) {
@@ -430,7 +503,7 @@ function createSandboxBackend(opts) {
     }
     return new LocalSandbox(config);
   }
-  return new LinuxSandbox(config, { mode: opts.mode, network: opts.network, bin: detection.bin });
+  return new LinuxSandbox(config, { ...opts, bin: detection.bin });
 }
 var interactiveWarned = false;
 function __resetInteractiveWarnLatchForTests() {
@@ -440,6 +513,7 @@ function seccompProgramForNetwork(networkOpen) {
   return networkOpen ? void 0 : restrictedSeccompProgram((m) => console.warn(redactSecrets(m)));
 }
 function decideConfinement(opts) {
+  refuseUnhonourableDenyRead(opts.denyReadPaths, opts.mode, opts.detect ?? detectBwrapMemoized);
   if (opts.mode === "danger-full-access") return null;
   const detection = (opts.detect ?? detectBwrapMemoized)();
   if (detection.ok) return detection.bin;
@@ -463,7 +537,8 @@ function interactiveWrapCommand(opts) {
         network: opts.network ?? false,
         env: allowlistedEnv(),
         bin,
-        seccompProgram: seccompProgramForNetwork(opts.network ?? false)
+        seccompProgram: seccompProgramForNetwork(opts.network ?? false),
+        denyReadPaths: opts.denyReadPaths
       },
       command
     );