@vzn/vx 0.0.651 → 0.0.652

package/src/exec/sandbox-runtime.ts

@@ -44,6 +44,7 @@ import {
   writeFileSync,
 } from 'node:fs'
 import { mkdir, unlink } from 'node:fs/promises'
+import { createConnection } from 'node:net'
 import type { SandboxConfig } from '../config.js'
 import {
   armTimeout,
@@ -62,6 +63,7 @@ import {
   type RunResult,
 } from './runner.js'
 import { TaskPipes } from './pipes.js'
+import { startTaskProxy, type TaskProxy } from './task-proxy.js'
 import { watchTree } from './proc-sample.js'
 import {
   BUN_GLOB_WILDCARDS,
@@ -664,6 +666,124 @@ function hostHelpers(): { dirs: string[]; files: string[] } {
   return { dirs: unique(dirs), files: files.map(toRealPath) }
 }
 
+/**
+ * What a hermetic task reads outside the workspace without naming it: the
+ * programs vx and the runtime run around its command (the runtime's bash,
+ * the task shell, setsid, strace, env, socat, the seccomp helper, and the
+ * grep and sleep its network wait runs) and what the
+ * loader maps for them. Anything else outside the workspace is the task's
+ * to grant. Learned once per PATH: the files a host's shell links are
+ * fixed for the process.
+ */
+interface HermeticReads {
+  /** What is denied: `/`, spelled as the runtime can mount it. */
+  deny: string[]
+  allow: string[]
+}
+let hermeticMemo: { path: string; reads: Promise<HermeticReads> } | undefined
+function hermeticReads(): Promise<HermeticReads> {
+  const PATH = process.env['PATH'] ?? ''
+  if (hermeticMemo?.path !== PATH) hermeticMemo = { path: PATH, reads: learnHermeticReads() }
+  return hermeticMemo.reads
+}
+
+async function learnHermeticReads(): Promise<HermeticReads> {
+  return { deny: rootDenies(), allow: await hermeticAllows() }
+}
+
+/**
+ * `/` as the runtime can deny it. Given `/`, it lays a tmpfs over every
+ * entry of the root, and bwrap cannot mount one on a link: a merged-/usr
+ * host's `/sbin -> usr/sbin` failed every hermetic task. A link at the
+ * root leads into a directory denied here, so it is left as it is. `/proc`,
+ * `/dev` and `/sys` are the runtime's own mounts; macOS denies by path, so
+ * `/` stands.
+ */
+function rootDenies(): string[] {
+  if (process.platform !== 'linux') return ['/']
+  const skip = new Set(['proc', 'dev', 'sys'])
+  return readdirSync('/', { withFileTypes: true })
+    .filter((e) => !skip.has(e.name) && !e.isSymbolicLink())
+    .map((e) => `/${e.name}`)
+}
+
+async function hermeticAllows(): Promise<string[]> {
+  const programs: string[] = []
+  for (const name of ['bash', 'setsid', 'strace', 'env', 'socat', 'grep', 'sleep']) {
+    try {
+      programs.push(executablePath(name))
+    } catch {
+      // The runtime's dependency check names a missing one.
+    }
+  }
+  programs.push(taskShell())
+  if (process.platform === 'darwin') {
+    // dyld and the shared cache every macOS binary maps.
+    return unique([...programs.flatMap(bothSpellings), '/usr/lib', '/System'])
+  }
+  const { getApplySeccompBinaryPath } =
+    await import('@anthropic-ai/sandbox-runtime/dist/sandbox/generate-seccomp-filter.js')
+  const seccomp = getApplySeccompBinaryPath(undefined)
+  if (seccomp) programs.push(seccomp)
+  const files = [...programs]
+  // The loader and the libraries each program links, by `ldd`'s answer.
+  let ldd: string
+  try {
+    ldd = executablePath('ldd')
+  } catch {
+    throw new UserError(
+      'exec.sandbox.hermetic: no `ldd` on PATH, so vx cannot tell which libraries the ' +
+        "task's shell needs — install it (glibc's libc-bin), or drop hermetic",
+    )
+  }
+  const r = Bun.spawnSync({ cmd: [ldd, ...programs], stdout: 'pipe', stderr: 'ignore' })
+  for (const m of r.stdout.toString().matchAll(/(\/\S+)\s+\(0x/g)) files.push(m[1]!)
+  return unique(files.flatMap(bothSpellings))
+}
+
+/**
+ * Every spelling the loader walks from `p` to its file: a link (the
+ * loader's `/lib64/ld-linux-x86-64.so.2` is one, then `/usr/lib64`'s is
+ * another) is bound as the file it reaches, so each hop needs its own
+ * grant, named under its directory's real path, where the mount lands.
+ */
+function bothSpellings(p: string): string[] {
+  const hops: string[] = []
+  for (let at = p; hops.length < 40;) {
+    const here = path.join(toRealPath(path.dirname(at)), path.basename(at))
+    hops.push(here)
+    let next: string
+    try {
+      if (!lstatSync(here).isSymbolicLink()) break
+      next = path.resolve(path.dirname(here), readlinkSync(here))
+    } catch {
+      break
+    }
+    at = next
+  }
+  return hops
+}
+
+/**
+ * The runtime's own sockets a hermetic task's command reaches: the write
+ * observer's and the network proxy's, under the host's temp directory.
+ * The runtime binds each before the read denies, so the deny's tmpfs over
+ * that directory hid them (`connect …/srt-obs-…: No such file`), and no
+ * call names the observer's. They are read off the wrap, once per run
+ * each: the observer listens after the runtime starts, so a later wrap may
+ * name one the first did not.
+ */
+const runtimeOwn = new Set<string>()
+function runtimeBinds(wrapped: string): string[] {
+  const tmp = toRealPath(os.tmpdir()) + path.sep
+  const out: string[] = []
+  for (const m of wrapped.matchAll(/--bind (?:'([^']*)'|(\S+)) (?:'([^']*)'|(\S+))/g)) {
+    const from = m[1] ?? m[2]!
+    if (from === (m[3] ?? m[4]) && from.startsWith(tmp)) out.push(from)
+  }
+  return out
+}
+
 function linuxToolPaths(): { bwrapPath?: string; socatPath?: string } {
   if (process.platform !== 'linux') return {}
   const paths: { bwrapPath?: string; socatPath?: string } = {}
@@ -815,16 +935,14 @@ function assertDomains(
  * @param opts.allowedDomains every domain any sandboxed task in this run
  * declared. SRT's filtering proxy is per-RUN and reads its allowlist from
  * this call, never from the per-task config, so the union is the only
- * place a domain list can take effect. Per-task precision survives where
- * it matters: a task that declared none is never handed the proxy port.
+ * place a domain list can take effect; each task's own front
+ * (`ownProxy`) narrows it to the task's list.
  */
 export async function initSandbox(opts?: {
   allowedDomains?: readonly string[]
   /**
-   * Every domain any sandboxed task of the run denies. The proxy is the
-   * run's, so a deny refuses it for every task, as the allowlist is the
-   * union's; before B-21 the list was always empty and a `deny.network`
-   * refused nothing.
+   * Every domain any sandboxed task of the run denies, checked here and
+   * never handed to the run's proxy: each task's front refuses its own.
    */
   deniedDomains?: readonly string[]
   /**
@@ -853,7 +971,9 @@ export async function initSandbox(opts?: {
   const config: Parameters<typeof SandboxManager.initialize>[0] = {
     network: {
       allowedDomains: [...(opts?.allowedDomains ?? [])],
-      deniedDomains: [...(opts?.deniedDomains ?? [])],
+      // Each task's own front refuses its own denies; the run's proxy
+      // refusing the union denied one task's host to every task.
+      deniedDomains: [],
       ...(opts?.allowAllUnixSockets === true ? { allowAllUnixSockets: true } : {}),
     },
     filesystem: { denyRead: [], allowWrite: [], denyWrite: [] },
@@ -862,6 +982,8 @@ export async function initSandbox(opts?: {
     ...(scopedDenyScan ? scopedScanConfig() : {}),
     ...bundledJavaAgent(),
   }
+  runAllowed = config.network.allowedDomains
+  runAllowsHosts = runAllowed.length > 0
   const wasUp = srtUp
   if (!wasUp) await unlinkStaleMuxSockets()
   const listening = srtCleanupAdopted ? undefined : cleanupListeners()
@@ -920,6 +1042,7 @@ export async function resetSandbox(): Promise<void> {
 
 function srtDown(): void {
   srtUp = false
+  runtimeOwn.clear()
   perTaskRun = undefined
   availabilityCache.clear()
   straceAvailableCache = undefined
@@ -1108,6 +1231,8 @@ export interface ResolvedSandboxConfig {
   gitConfig?: boolean
   weakerWhenNested?: boolean
   weakerNetworkIsolation?: boolean
+  /** Reads outside the workspace are refused too (`hermeticReads`). */
+  hermetic?: boolean
   /** macOS: the walls a glob grant reaches, by kind (`darwinWallRules`). */
   wallsReached?: { read: readonly string[]; write: readonly string[] }
   ignore?: {
@@ -1266,6 +1391,7 @@ export function resolveSandboxConfig(
   if (cfg.weakerNetworkIsolation !== undefined) {
     r.weakerNetworkIsolation = cfg.weakerNetworkIsolation
   }
+  if (cfg.hermetic === true) r.hermetic = true
   if (cfg.ignore !== undefined) {
     // Relative patterns anchor at the project dir, `~` ones at the home
     // directory, as a grant's are (a `~` pattern kept as written matched no
@@ -1434,6 +1560,11 @@ async function wrapIn(
     baselines.cwd,
   )
   customConfig!.filesystem!.denyRead!.push(toRealPath(taskTmpRoot()))
+  if (args.config.hermetic === true) {
+    const reads = await hermeticReads()
+    customConfig!.filesystem!.denyRead!.push(...reads.deny)
+    customConfig!.filesystem!.allowRead!.push(...reads.allow, ...runtimeOwn)
+  }
   const helpers = hostHelpers()
   customConfig!.filesystem!.denyRead!.push(...helpers.dirs)
   customConfig!.filesystem!.allowRead!.push(...helpers.files)
@@ -1502,6 +1633,29 @@ async function wrapIn(
     ports.length > 0 || asksUnixSockets(args.config),
     args.config.gitConfig === true,
   )
+  if (process.platform === 'linux' && args.config.hermetic === true) {
+    const own = runtimeBinds(wrapped).filter((p) => !runtimeOwn.has(p))
+    if (own.length > 0) {
+      for (const p of own) runtimeOwn.add(p)
+      customConfig!.filesystem!.allowRead!.push(...own)
+      wrapped = await wrapForTask(
+        SandboxManager,
+        inner,
+        literalReadPaths(customConfig),
+        ports.length > 0 || asksUnixSockets(args.config),
+        args.config.gitConfig === true,
+      )
+    }
+  }
+  if (runAllowsHosts) {
+    try {
+      wrapped = await ownProxy(SandboxManager, wrapped, inner, tag, args.config)
+    } catch (err) {
+      releaseBridges(tag)
+      afterCommand(SandboxManager)
+      throw err
+    }
+  }
   if (process.platform === 'darwin') {
     const rules = [
       ...macProfileRules(args.config),
@@ -1821,6 +1975,77 @@ export function bridgedPorts(c: Pick<ResolvedSandboxConfig, 'localBinding'>): nu
 const PROXY_BRIDGE_WAIT =
   "( i=0; until grep -qsE ':0C38 [0-9A-F]+:0000 0A' /proc/net/tcp /proc/net/tcp6 && grep -qsE ':0438 [0-9A-F]+:0000 0A' /proc/net/tcp /proc/net/tcp6; do [ $i -ge 500 ] && break; i=$((i+1)); sleep 0.01; done );"
 
+/** Each networked task's own proxy front, by tag, closed when its bridges go. */
+const taskProxies = new Map<string, TaskProxy>()
+/** Whether the run's proxy allows any host: one that allows none refuses every task alike, front or not. */
+let runAllowsHosts = false
+/** The run's union: what a `network: true` task's front allows. */
+let runAllowed: readonly string[] = []
+
+/**
+ * A networked task's own proxy front (task-proxy.ts). The runtime's proxy
+ * is the run's and filters by the union of every task's lists, so a task
+ * reached a host only another task of the run declared. The front judges
+ * by this task's own lists and passes what it allows on to the run's
+ * proxy. Linux: it listens on a socket in the task's tmpdir, bound over
+ * the runtime's bridge socket, so the task's side dials the same path.
+ * macOS: it listens on a loopback port of its own, and the task's proxy
+ * variables and profile name that port in place of the run's, so the
+ * profile refuses the run's. A task that lists no network gets a front
+ * that refuses every host; `network: true` gets one that allows the
+ * run's union. Each front refuses only its own task's denies. Fails closed: a task the front cannot take does not run.
+ */
+async function ownProxy(
+  SandboxManager: SrtModule['SandboxManager'],
+  wrapped: string,
+  inner: string,
+  tag: string,
+  config: ResolvedSandboxConfig,
+): Promise<string> {
+  const port = SandboxManager.getProxyPort()
+  const token = SandboxManager.getProxyAuthToken()
+  const linux = process.platform === 'linux'
+  const bridge = linux ? SandboxManager.getLinuxHttpSocketPath() : undefined
+  const bind = bridge === undefined ? undefined : `--bind ${bridge} ${bridge}`
+  const runPort = new RegExp(`localhost:${port}(?!\\d)`, 'g')
+  const handed =
+    port !== undefined &&
+    token !== undefined &&
+    (linux ? bind !== undefined && wrapped.includes(bind) : runPort.test(wrapped))
+  // A task that lists no network is handed the run's proxy too when another
+  // task of the run lists some; it gets a front that refuses every host.
+  if (!handed) {
+    if (config.network === undefined) return wrapped
+    throw new Error('sandbox: the runtime gave this networked task no proxy to replace')
+  }
+  const socket = path.join(taskTmpdir(tag), 'vx-net.sock')
+  const key = Buffer.from(inner.slice(0, 100)).toString('base64')
+  const front = await startTaskProxy({
+    endpoint: linux ? socket : 0,
+    allowed:
+      config.network === true
+        ? runAllowed
+        : config.network === undefined
+          ? []
+          : (config.network as string[]),
+    denied: config.denyNetwork ?? [],
+    runProxyPort: port!,
+    token: token!,
+    encodedCommand: key,
+    refused: (line) => collecting.get(key)?.push({ line, timestamp: new Date() }),
+  })
+  taskProxies.set(tag, front)
+  if (!linux) return wrapped.replace(runPort, `localhost:${front.port}`)
+  // After the root's read-only bind, which would mask a bind made before it
+  // with the host's own file: the runtime's socket, reachable as itself.
+  const own = `--bind ${socket} ${bridge}`
+  const root = ' --ro-bind / / '
+  const at = wrapped.indexOf(root)
+  return at === -1
+    ? wrapped.replace(bind!, own)
+    : `${wrapped.slice(0, at + root.length)}${own} ${wrapped.slice(at + root.length)}`
+}
+
 /** Where a bridge's unix socket lives: the sandbox tmpdir, bound read-write on both sides. */
 export function portBridgeSocket(tag: string, port: number): string {
   return path.join(taskTmpdir(tag), `vx-port-${tag}-${port}.sock`)
@@ -2004,6 +2229,12 @@ export function releaseBridges(tag: string): void {
     afterCommand(srtLoaded!.SandboxManager)
     if (liveServers.size === 0 && resetDeferred) void resetSandbox().catch(() => {})
   }
+  const front = taskProxies.get(tag)
+  if (front !== undefined) {
+    taskProxies.delete(tag)
+    // quiet: a front that will not close holds only its own socket, gone with the tmpdir
+    void front.close().catch(() => undefined)
+  }
   const bridges = hostBridges.get(tag)
   if (bridges === undefined) return
   hostBridges.delete(tag)
@@ -2028,6 +2259,18 @@ export function releaseBridges(tag: string): void {
 const TRACER_RETRY_LINE =
   "[vx] the sandbox's tracer (strace) failed on its own; running the task again\n"
 
+/** What a task's output says when a mount went away as bwrap set the sandbox up. */
+const MOUNT_RACE_RETRY_LINE =
+  '[vx] a mount went away as the sandbox was set up; running the task again\n'
+
+/**
+ * bwrap's own refusal of a mount gone between its read of the mount table
+ * and its remount: a container runtime's transient mount under /tmp
+ * (`/newroot/tmp/containerd-mount…`, a `docker build` beside the task on
+ * CI). The command never started.
+ */
+const BWRAP_MOUNT_GONE = /^bwrap: Can't .*: No such file or directory$/
+
 /**
  * Run a single task wrapped in the sandbox. Caller must have called
  * `initSandbox()` first.
@@ -2053,20 +2296,21 @@ export async function runSandboxed(args: SandboxedRunArgs): Promise<SandboxedRun
       if (chunk.length > 0) midLine = !chunk.endsWith('\n')
       on?.(chunk)
     }
-  const { tracerFailed, ranMs, ...first } = await runSandboxedOnce({
+  const { tracerFailed, mountGone, ranMs, ...first } = await runSandboxedOnce({
     ...args,
     onStdout: seen(args.onStdout),
     onStderr: seen(args.onStderr),
   })
   // A stopping run has killed the children it holds; a retry would be one
   // spawned after that kill.
-  if (!tracerFailed || args.signal?.aborted === true) return first
-  const notice = (midLine ? '\n' : '') + TRACER_RETRY_LINE
+  if (!(tracerFailed || mountGone) || args.signal?.aborted === true) return first
+  const notice = (midLine ? '\n' : '') + (mountGone ? MOUNT_RACE_RETRY_LINE : TRACER_RETRY_LINE)
   args.onStderr?.(notice)
   // `timeout` bounds the task's whole run (schema.md), so the retry gets
   // what the first attempt left of it, not a fresh window.
   const {
     tracerFailed: _again,
+    mountGone: _gone,
     ranMs: _ran,
     ...second
   } = await runSandboxedOnce(
@@ -2088,18 +2332,21 @@ let collectorOn = false
 
 /**
  * Start collecting SRT's store records for `command`; the returned function
- * stops and hands them over. The store is a 100-record ring the whole run
- * shares, and on Linux its write observer reports every write any task
+ * stops and hands them over, with `settle` once every record the task's
+ * Linux observer (`observer`, its socket) sent is read. The store is a
+ * 100-record ring the whole run shares, and on Linux its write observer
+ * reports every write any task
  * makes, so a refused write followed by 150 declared ones was gone before
  * the task's exit read it (B-7). One subscription takes each record as it
  * arrives and keeps it only for a command still running. SRT keys a record
  * by the base64 of the command's first 100 characters
  * (`encodeSandboxedCommand`, not exported).
  */
-function collectRecords(
+export function collectRecords(
   store: ReturnType<SrtModule['SandboxManager']['getSandboxViolationStore']>,
   command: string,
-): () => SandboxViolation[] {
+  observer: string | undefined,
+): (settle: boolean) => Promise<SandboxViolation[]> {
   if (!collectorOn) {
     collectorOn = true
     let seen = store.getTotalCount()
@@ -2115,12 +2362,44 @@ function collectRecords(
   const key = Buffer.from(command.slice(0, 100)).toString('base64')
   const list: SandboxViolation[] = []
   collecting.set(key, list)
-  return () => {
+  return async (settle) => {
+    if (settle && observer !== undefined) await observerCaughtUp(observer)
     collecting.delete(key)
     return list
   }
 }
 
+/**
+ * The Unix socket SRT's Linux write observer listens on, from the command
+ * it wrapped (`--setenv SRT_OBSERVE_SOCK <path>`); none when the listener
+ * failed or on macOS.
+ */
+function observerSocket(wrapped: string): string | undefined {
+  return /--setenv SRT_OBSERVE_SOCK (?:'([^']*)'|(\S+))/.exec(wrapped)?.slice(1).find(Boolean)
+}
+
+/**
+ * Resolves once SRT has read every record sent to `socket` before the call.
+ * A task's observer sends its records before the task exits, but they are
+ * read when this process gets to that connection: a fixed count of event
+ * loop turns after the exit (2) lost 4 of 24 refusals on a loaded CI
+ * worker. So a connection of ours goes in after them: the kernel queues
+ * connections in order, so SRT accepts it no earlier than the task's, and
+ * the task's bytes were already there when it did. SRT's server is not
+ * half-open, so it ends ours once it reads our end, and that end coming
+ * back means the task's bytes were read first. A socket that is gone
+ * answers at once with an error.
+ */
+function observerCaughtUp(socket: string): Promise<void> {
+  return new Promise((resolve) => {
+    const conn = createConnection(socket)
+    conn.on('connect', () => conn.end())
+    conn.on('error', () => resolve())
+    conn.on('close', () => resolve())
+    conn.resume()
+  })
+}
+
 /**
  * strace's own message, a line of a traced task's stderr. strace names
  * itself by its argv[0], the absolute path vx runs it by
@@ -2140,7 +2419,7 @@ const STRACE_OWN_ERROR = /^(?:[^\s:]*\/)?strace: /
  */
 async function runSandboxedOnce(
   args: SandboxedRunArgs,
-): Promise<SandboxedRunResult & { tracerFailed: boolean; ranMs: number }> {
+): Promise<SandboxedRunResult & { tracerFailed: boolean; mountGone: boolean; ranMs: number }> {
   const start = Date.now()
   const { SandboxManager } = await loadSrt()
   // Linux: SRT's store sees only writes (below), so read denials need
@@ -2174,12 +2453,16 @@ async function runSandboxedOnce(
       ...(useStrace ? { trace: useStrace } : {}),
       ...(widened !== undefined && widened.size > 0 ? { tracePaths: true } : {}),
     })
-  const takeRecords = collectRecords(SandboxManager.getSandboxViolationStore(), srtCommand)
+  const takeRecords = collectRecords(
+    SandboxManager.getSandboxViolationStore(),
+    srtCommand,
+    observerSocket(wrapped),
+  )
   // A stop that landed during the awaits above leaves nothing to kill yet:
   // spawned now, the task ran after the teardown swept the run's children.
   if (args.signal?.aborted === true) {
     releaseBridges(tag)
-    takeRecords()
+    void takeRecords(false)
     afterCommand(SandboxManager)
     const signal = stopSignal(args.signal.reason)
     return {
@@ -2190,6 +2473,7 @@ async function runSandboxedOnce(
       signal,
       violations: [],
       tracerFailed: false,
+      mountGone: false,
       ranMs: 0,
     }
   }
@@ -2234,7 +2518,7 @@ async function runSandboxedOnce(
     const stderr = spawnFailureText(err, args.cwd, SANDBOXED_TASK, wrapped)
     args.onStderr?.(stderr)
     releaseBridges(tag)
-    takeRecords()
+    void takeRecords(false)
     afterCommand(SandboxManager)
     return {
       exitCode: 127,
@@ -2244,6 +2528,7 @@ async function runSandboxedOnce(
       spawnFailed: true,
       violations: [],
       tracerFailed: false,
+      mountGone: false,
       ranMs: 0,
     }
   } finally {
@@ -2261,6 +2546,7 @@ async function runSandboxedOnce(
   // The unfinished last line of stderr, and whether a line was strace's.
   let partial = ''
   let straceSpoke = false
+  let mountGone = false
   const [out, err] = pipes.streams(proc)
   const ends = lineEnds(args.onStdout, args.onStderr)
   const streams = Promise.all([
@@ -2273,6 +2559,7 @@ async function runSandboxedOnce(
         const lines = (partial + chunk).split('\n')
         partial = (lines.pop() ?? '').slice(0, 512)
         if (lines.some((l) => STRACE_OWN_ERROR.test(l))) straceSpoke = true
+        if (lines.some((l) => BWRAP_MOUNT_GONE.test(l))) mountGone = true
         ends.onStderr?.(chunk)
       },
       ac.signal,
@@ -2324,15 +2611,9 @@ async function runSandboxedOnce(
   // (2026-09-05). A sandboxed task that fails must say what it was denied;
   // deciding on the user's behalf that a record was "just traversal" is how
   // a failure ends up with an empty violations section and no explanation.
-  // Linux: the write observer's records reach the store over a Unix socket
-  // this process serves, not with the child's exit. The observer sent them
-  // before the task exited, but a task that ends quickly is seen to exit
-  // in the turn its connection is accepted, before it is read: a turn to
-  // accept and a turn to read take them in (40 fast refused mkdirs at
-  // once: 38 of 200 unreported, 33 with one turn, none with two).
-  if (process.platform === 'linux')
-    for (let turn = 0; turn < 2; turn++) await new Promise((r) => setImmediate(r))
-  const records = takeRecords()
+  // Linux: the write observer's records arrive over a socket, not with the
+  // exit; `takeRecords(true)` waits until all it sent are read.
+  const records = await takeRecords(true)
   // Read as is on darwin only. Since SRT 0.0.75 the store is fed on Linux
   // too, by the seccomp helper's write observer — but SRT judges those
   // reports against the GLOBAL `filesystem.allowWrite` from `initialize`
@@ -2481,6 +2762,7 @@ async function runSandboxedOnce(
         ? {}
         : { cpuMs: looked.cpuMs, peakRssBytes: looked.rssBytes }),
     ranMs,
+    mountGone: exitCode !== 0 && (mountGone || BWRAP_MOUNT_GONE.test(partial)),
     tracerFailed:
       straceLog !== undefined &&
       !timeout.timedOut() &&
@@ -2634,7 +2916,7 @@ function sbplToken(value: string, field: string): string {
  *
  * `systemInfo` has no SRT field at any level. The rest DO have fields,
  * but SRT reads `network.allowLocalBinding` / `allowUnixSockets` /
- * `allowMachLookup` off the config given to `initialize()` and never off
+ * `allowMachLookup` / `enableWeakerNetworkIsolation` off the config given to `initialize()` and never off
  * the per-call one (`sandbox-manager.js` getters, 0.0.75 and 0.0.76) — so a per-task
  * grant passed there is silently dropped. vx is per-task by definition,
  * so it emits them itself. The rule text mirrors SRT's own.
@@ -2657,6 +2939,9 @@ export function macProfileRules(c: ResolvedSandboxConfig): string[] {
     rules.push('(allow network-inbound (local ip "*:*"))')
     rules.push('(allow network-outbound (remote ip "localhost:*"))')
   }
+  if (c.weakerNetworkIsolation === true) {
+    rules.push('(allow mach-lookup (global-name "com.apple.trustd.agent"))')
+  }
   if (c.unixSockets === true) {
     rules.push('(allow system-socket (socket-domain AF_UNIX))')
     rules.push('(allow network-bind (local unix-socket (path-regex #"^/")))')

package/src/exec/task-proxy.ts

@@ -0,0 +1,93 @@
+// One task's own proxy: the runtime's proxy is the run's and judges every
+// connection by the union of all tasks' network lists, so a task reached a
+// host only another task of the run declared. Each networked task gets this
+// front on its own socket, which judges by the task's lists and hands what
+// it allows to the run's proxy as its parent (that proxy still applies the
+// union and its address guard). A task names itself to a proxy by a
+// username it writes, so only the socket it was given says which task it is.
+
+import { BlockList } from 'node:net'
+
+/** The deep modules of the runtime the front is built from: its own proxy code, not a copy. */
+async function loadProxyParts() {
+  // Literal specifiers: `bun build --compile` embeds only what it can see.
+  const [http, socks, mux, pattern, parent] = await Promise.all([
+    import('@anthropic-ai/sandbox-runtime/dist/sandbox/http-proxy.js'),
+    import('@anthropic-ai/sandbox-runtime/dist/sandbox/socks-proxy.js'),
+    import('@anthropic-ai/sandbox-runtime/dist/sandbox/mux-proxy.js'),
+    import('@anthropic-ai/sandbox-runtime/dist/sandbox/domain-pattern.js'),
+    import('@anthropic-ai/sandbox-runtime/dist/sandbox/parent-proxy.js'),
+  ])
+  return { http, socks, mux, pattern, parent }
+}
+
+export interface TaskProxy {
+  close(): Promise<void>
+}
+
+/**
+ * Listen at `endpoint` (a unix socket path, or 0 for a localhost port) for
+ * one task. Returns the bound port when `endpoint` is 0.
+ */
+export async function startTaskProxy(opts: {
+  endpoint: string | 0
+  allowed: readonly string[]
+  denied: readonly string[]
+  /** The run's proxy: its port and the session token both legs carry. */
+  runProxyPort: number
+  token: string
+  /** The task's attribution key (`srt.<encodedCommand>`'s suffix). */
+  encodedCommand: string
+  /** A refusal this front made, in the runtime's own record form. */
+  refused(line: string): void
+}): Promise<TaskProxy & { port: number | undefined }> {
+  const { http, socks, mux, pattern, parent } = await loadProxyParts()
+  const filter = (port: number, host: string): boolean => {
+    const deny = (reason: string) => {
+      opts.refused(`deny network-outbound ${host}:${port} (${reason})`)
+      return false
+    }
+    if (!parent.isValidHost(host)) return deny('malformed host')
+    const canonical: string = parent.canonicalizeHost(host) ?? host
+    if (opts.denied.some((d) => pattern.matchesDomainPatternWithPort(canonical, port, d)))
+      return deny('host is on the deny list')
+    if (opts.allowed.some((a) => pattern.matchesDomainPatternWithPort(canonical, port, a)))
+      return true
+    return deny('host is not on the allow list')
+  }
+  const user = encodeURIComponent(`srt.${opts.encodedCommand}`)
+  const up = new URL(
+    `http://${user}:${encodeURIComponent(opts.token)}@127.0.0.1:${opts.runProxyPort}`,
+  )
+  // Every allowed connection goes on to the run's proxy, which applies the
+  // run's lists and address guard again; only a loopback host, which the
+  // runtime never sends to a parent, is dialed from here, and only one the
+  // task named.
+  const parentProxy = {
+    httpUrl: up,
+    httpsUrl: up,
+    noProxy: { all: false, suffixes: [], cidr: new BlockList() },
+  }
+  const httpServer = http.createHttpProxyServer({
+    filter: (port: number, host: string) => filter(port, host),
+    parentProxy,
+    proxyAuthToken: opts.token,
+  })
+  const socksServer = socks.createSocksProxyServer({
+    filter: (port: number, host: string) => filter(port, host),
+    parentProxy,
+    proxyAuthToken: opts.token,
+  })
+  const front = mux.createMuxProxyServer({
+    httpServer,
+    handleSocksConnection: (s) => socksServer.handleConnection(s),
+  })
+  await front.listenHttpBackend()
+  await new Promise<void>((resolve, reject) => {
+    front.server.once('error', reject)
+    if (opts.endpoint === 0) front.server.listen(0, '127.0.0.1', () => resolve())
+    else front.server.listen(opts.endpoint, () => resolve())
+  })
+  front.unref()
+  return { port: front.getPort(), close: () => front.close() }
+}