@theokit/sdk 5.13.0 → 5.15.0

package/dist/sandbox/index.js

@@ -1,11 +1,12 @@
-import { shellEscapePosix, LocalSandbox, SandboxNotAvailableError } from '../chunk-QGDPMM3C.js';
+import { SandboxBackend, SandboxNotAvailableError, SandboxSecurityError, shellEscapePosix, LocalSandbox } from '../chunk-QGDPMM3C.js';
 export { LocalSandbox, SandboxBackend, SandboxNotAvailableError, SandboxSecurityError, resolveSandbox, shellEscapePosix } from '../chunk-QGDPMM3C.js';
 import '../chunk-HKCKOAIO.js';
 import { TheokitAgentError } from '../chunk-TNFOU6SB.js';
 import { redactSecrets } from '../chunk-3OY6H3I7.js';
-import { execFileSync } from 'child_process';
+import { execFileSync, spawn } from 'child_process';
 import { existsSync, mkdtempSync, writeFileSync, statSync, realpathSync, rmSync } from 'fs';
-import path, { dirname, join, resolve } from 'path';
+import path, { join, resolve, posix, dirname } from 'path';
+import { randomBytes } from 'crypto';
 import { tmpdir } from 'os';
 
 var KEPT_ROOTS_ALWAYS = ["/tmp"];
@@ -182,6 +183,132 @@ function detectBwrapMemoized(probes = realProbes) {
 function resetBwrapMemo() {
   memo = void 0;
 }
+var CONTAINER_WORKDIR = "/workspace";
+function defaultRunner(bin) {
+  return (args, { input, timeoutMs, maxOutputBytes }) => new Promise((resolve2, reject) => {
+    const child = spawn(bin, [...args], { stdio: ["pipe", "pipe", "pipe"] });
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    const cap = (s, chunk) => s.length >= maxOutputBytes ? s : s + chunk.toString("utf-8");
+    child.stdout.on("data", (c) => {
+      stdout = cap(stdout, c);
+    });
+    child.stderr.on("data", (c) => {
+      stderr = cap(stderr, c);
+    });
+    const timer = setTimeout(() => {
+      timedOut = true;
+      child.kill("SIGKILL");
+    }, timeoutMs);
+    child.on("error", (e) => {
+      clearTimeout(timer);
+      reject(e);
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      resolve2({ stdout, stderr, code, timedOut });
+    });
+    child.stdin.on("error", () => {
+    });
+    child.stdin.end(input);
+  });
+}
+var DockerSandbox = class extends SandboxBackend {
+  networkPolicy;
+  image;
+  network;
+  runner;
+  hostDir;
+  user;
+  constructor(config = {}) {
+    super({
+      ...config,
+      workDir: config.workDir ?? mkdtempSync(join(tmpdir(), "theokit-docker-ws-"))
+    });
+    this.image = config.image ?? "alpine:3";
+    this.network = config.network ?? false;
+    this.networkPolicy = { mode: this.network ? "unrestricted" : "none" };
+    this.runner = config.runner ?? defaultRunner(config.dockerBin ?? "docker");
+    this.hostDir = resolve(this.config.workDir ?? "/tmp");
+    this.user = config.user ?? (typeof process.getuid === "function" && typeof process.getgid === "function" ? `${process.getuid()}:${process.getgid()}` : void 0);
+  }
+  /** The `docker run` argv for one command; exposed shape is covered by tests. */
+  runArgs(name, interactive, argv) {
+    return [
+      "run",
+      "--rm",
+      ...interactive ? ["-i"] : [],
+      "--name",
+      name,
+      "--read-only",
+      "--tmpfs",
+      "/tmp",
+      "--cap-drop",
+      "ALL",
+      "--security-opt",
+      "no-new-privileges",
+      "--pids-limit",
+      "512",
+      "--network",
+      this.network ? "bridge" : "none",
+      ...this.user ? ["--user", this.user] : [],
+      "-v",
+      `${this.hostDir}:${CONTAINER_WORKDIR}:rw`,
+      "-w",
+      CONTAINER_WORKDIR,
+      "-e",
+      "HOME=/tmp",
+      this.image,
+      ...argv
+    ];
+  }
+  async run(interactive, argv, timeoutMs, input) {
+    const name = `theokit-sbx-${randomBytes(6).toString("hex")}`;
+    const max = this.config.maxOutputBytes ?? 5 * 1024 * 1024;
+    let r;
+    try {
+      r = await this.runner(this.runArgs(name, interactive, argv), {
+        input,
+        timeoutMs,
+        maxOutputBytes: max
+      });
+    } catch (e) {
+      throw new SandboxNotAvailableError(
+        `docker could not be started: ${e instanceof Error ? e.message : String(e)}`
+      );
+    }
+    if (r.timedOut) {
+      await this.runner(["rm", "-f", name], { timeoutMs: 1e4, maxOutputBytes: 4096 }).catch(
+        () => void 0
+      );
+    }
+    return r;
+  }
+  async execute(command, opts) {
+    const timeoutMs = opts?.timeoutMs ?? this.config.timeoutMs ?? 3e4;
+    const r = await this.run(false, ["sh", "-c", command], timeoutMs);
+    return {
+      stdout: this.truncateOutput(r.stdout),
+      stderr: this.truncateOutput(r.stderr),
+      exitCode: r.timedOut ? 124 : r.code === 0 ? 0 : 1,
+      timedOut: r.timedOut
+    };
+  }
+  async uploadFile(path3, content) {
+    const target = path3.startsWith("/") ? posix.normalize(path3) : posix.normalize(`${CONTAINER_WORKDIR}/${path3}`);
+    if (target !== CONTAINER_WORKDIR && !target.startsWith(`${CONTAINER_WORKDIR}/`)) {
+      throw new SandboxSecurityError(`uploadFile path escapes the workspace: ${path3}`);
+    }
+    const r = await this.run(
+      true,
+      ["sh", "-c", 'mkdir -p "$(dirname "$1")" && cat > "$1"', "sh", target],
+      this.config.timeoutMs ?? 3e4,
+      content
+    );
+    if (r.code !== 0) throw new Error(`uploadFile failed: ${r.stderr.trim() || "docker error"}`);
+  }
+};
 
 // src/sandbox/seccomp.ts
 var BPF_LD = 0;
@@ -294,7 +421,7 @@ function assertSeccompProgramShape(program) {
     );
   }
 }
-var PIPE_SCRIPT = '{ p=$1; shift; printf "$p" | exec "$@" 3<&0 0<&4 4<&-; } 4<&0';
+var PIPE_SCRIPT = 'r() { p=$1; shift; printf "$p" | exec "$@" 3<&0 0<&4 4<&-; }; if { true 5<&0; } 2>/dev/null; then r "$@" 4<&0; else r "$@" 4</dev/null; fi';
 function wrapWithSeccompProgram(bwrapArgv, command, program) {
   assertSeccompProgramShape(program);
   const words = [octalPrintfArg(program), ...bwrapArgv, "--seccomp", "3", "--", "/bin/sh", "-c"];
@@ -594,6 +721,6 @@ async function provisionRepo(sandboxOrOpts, maybeOpts) {
   return { repoDir };
 }
 
-export { LinuxSandbox, RepoProvisionError, allowlistedEnv, buildBwrapArgv, buildSeccompFilter, createSandboxBackend, detectBwrap, detectBwrapMemoized, interactiveWrapCommand, provisionRepo, realProbeCount, realProbes, resetBwrapMemo, __resetInteractiveWarnLatchForTests as resetInteractiveWarnLatch, __resetSandboxWarnLatchForTests as resetSandboxWarnLatch, resolveSandboxPosture, restrictedSeccompPath, seccompPathForArch, wrapCommandForSandbox, writableRootsFor };
+export { DockerSandbox, LinuxSandbox, RepoProvisionError, allowlistedEnv, buildBwrapArgv, buildSeccompFilter, createSandboxBackend, detectBwrap, detectBwrapMemoized, interactiveWrapCommand, provisionRepo, realProbeCount, realProbes, resetBwrapMemo, __resetInteractiveWarnLatchForTests as resetInteractiveWarnLatch, __resetSandboxWarnLatchForTests as resetSandboxWarnLatch, resolveSandboxPosture, restrictedSeccompPath, seccompPathForArch, wrapCommandForSandbox, writableRootsFor };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map