@vzn/vx 0.0.651 → 0.0.653

package/src/exec/sandbox-binds.ts

@@ -13,7 +13,8 @@ import {
   toRealPath,
   unique,
 } from './sandbox-paths.js'
-import type { SandboxedRunArgs } from './sandbox-runtime.js'
+import { shellQuote } from './runner.js'
+import type { ResolvedSandboxConfig, SandboxedRunArgs } from './sandbox-runtime.js'
 import * as ui from '../ui/index.js'
 
 type SrtModule = typeof import('@anthropic-ai/sandbox-runtime')
@@ -40,6 +41,48 @@ export function bindableWrites(paths: readonly string[]): string[] {
   return unique(paths.filter((p) => !holdsGlobChar(p)).map(bindOf))
 }
 
+/**
+ * Linux: each write grant spelled through a link in the project, as the
+ * bind that puts it where the task names it: `[source, at]`, the grant's
+ * own bind and its twin under the link. A file grant binds its directory,
+ * so its twin is the link's; a link that is the file itself sits in the
+ * bound directory already and needs none. SRT skips a write path that is
+ * a sibling link (it reads one as leaving its tree), so vx lays these
+ * itself (`withLinkedWrites`).
+ */
+export function linkedWriteBinds(
+  linked: ResolvedSandboxConfig['linkedWrites'],
+): Array<readonly [string, string]> {
+  if (process.platform !== 'linux' || linked === undefined) return []
+  const out: Array<readonly [string, string]> = []
+  for (const { link, target } of linked) {
+    if (holdsGlobChar(target) || holdsGlobChar(link)) continue
+    const source = bindOf(target)
+    const at = source === target ? link : path.dirname(link)
+    if (at !== source && !out.some(([, a]) => a === at)) out.push([source, at])
+  }
+  return out
+}
+
+/**
+ * Linux: SRT's bwrap line with each `linkedWriteBinds` pair bound last,
+ * before the `--` that ends bwrap's options: after the masks and the read
+ * grants, so none lands over it. The link's directory is then a mount of
+ * its target, writable as the grant is.
+ */
+export function withLinkedWrites(
+  wrapped: string,
+  binds: ReadonlyArray<readonly [string, string]>,
+): string {
+  if (binds.length === 0) return wrapped
+  for (const m of wrapped.matchAll(/(?:'[^']*'|"[^"]*"|[^\s'"])+/g)) {
+    if (m[0] !== '--') continue
+    const words = binds.map(([s, a]) => `--bind ${shellQuote(s)} ${shellQuote(a)} `).join('')
+    return `${wrapped.slice(0, m.index)}${words}${wrapped.slice(m.index)}`
+  }
+  return wrapped
+}
+
 function bindOf(p: string): string {
   if (!isMountableLiteral(p)) return p
   try {
@@ -162,7 +205,12 @@ const warnedSymlinkPunch = new Set<string>()
  * A grant with no write path under it is returned untouched — the common
  * case costs nothing, not even a readdir.
  */
-export function punchWritePaths(readPath: string, writePaths: readonly string[]): string[] {
+export function punchWritePaths(
+  readPath: string,
+  writePaths: readonly string[],
+  /** Whether a link child's real path may be bound; one it may not is dropped. */
+  reachable: (real: string) => boolean = () => true,
+): string[] {
   // Linux only. The shadowing is a property of bwrap MOUNTS; macOS seatbelt
   // evaluates rules by precedence, so a read grant on a directory and a
   // write grant inside it coexist. Punching there costs the directory
@@ -193,25 +241,57 @@ export function punchWritePaths(readPath: string, writePaths: readonly string[])
     // SRT's config carries no `--symlink`, so the only fix is the grant:
     // say which one, loudly.
     try {
-      if (lstatSync(child).isSymbolicLink()) linked.push(child)
+      if (lstatSync(child).isSymbolicLink()) {
+        // Bound by its target, a link out to a denied place (`node_modules
+        // -> ..`, `shared -> ../b`) granted what the whole grant never did:
+        // bound unpunched, the link stays a link into the deny (item 1006's
+        // glob hit, through the punch).
+        if (!reachable(toRealPath(child))) continue
+        linked.push(child)
+      }
     } catch {
       // vanished between readdir and lstat: nothing to bind either way
     }
-    out.push(...punchWritePaths(child, under))
+    out.push(...punchWritePaths(child, under, reachable))
   }
   if (linked.length > 0 && !warnedSymlinkPunch.has(readPath)) {
     warnedSymlinkPunch.add(readPath)
-    ui.say(
-      'warn',
-      `[vx] sandbox: a write grant under ${readPath} makes its ${linked.length} symlinked ` +
-        `entr${linked.length === 1 ? 'y' : 'ies'} (${linked
-          .slice(0, 3)
-          .map((l) => path.basename(l))
-          .join(', ')}${linked.length > 3 ? ', …' : ''}) plain directories inside the sandbox — ` +
-        `a package resolved through one loses its siblings. Move the write grant (${under
-          .map((w) => path.relative(readPath, w))
-          .join(', ')}) out of it.\n`,
-    )
+    // A link INTO a write grant is that grant under a second name, mounted
+    // read-only: the remedy is to grant the name (`linkedWriteBinds` binds
+    // it writable), not to move the grant.
+    const plain: string[] = []
+    for (const l of linked) {
+      const w = writePaths.find((w) => atOrUnder(toRealPath(l), w))
+      if (w === undefined) {
+        plain.push(l)
+        continue
+      }
+      let dir = false
+      try {
+        dir = statSync(l).isDirectory()
+      } catch {
+        // dangling: granted as a file
+      }
+      ui.say(
+        'warn',
+        `[vx] sandbox: ${l} is a symlink into the write grant ${w}, and the Linux sandbox ` +
+          `mounts it read-only, so a write through it is refused. Grant the link itself to ` +
+          `write through it: ${l}${dir ? '/' : ''}\n`,
+      )
+    }
+    if (plain.length > 0) {
+      ui.say(
+        'warn',
+        `[vx] sandbox: a write grant under ${readPath} makes its ${plain.length} symlinked ` +
+          `entr${plain.length === 1 ? 'y' : 'ies'} (${plain
+            .slice(0, 3)
+            .map((l) => path.basename(l))
+            .join(', ')}${plain.length > 3 ? ', …' : ''}) plain directories inside the sandbox — ` +
+          `a package resolved through one loses its siblings. Move the write grant (${under
+            .map((w) => path.relative(readPath, w))
+            .join(', ')}) out of it.\n`,
+      )
+    }
   }
   return out
 }
@@ -300,9 +380,20 @@ export function buildCustomConfig(
   const c = args.config
   const denyRead = unique([...baselines.denyRead])
   const allowWrite = bindableWrites(unique([...c.allowWrite]))
-  const allowRead = unique(
-    [...baselines.allowRead, ...c.allowRead].flatMap((r) => punchWritePaths(r, allowWrite)),
-  )
+  // A link a write grant is spelled through is bound by vx, not SRT: a
+  // read grant above it is punched around it all the same.
+  const punched = [...allowWrite, ...linkedWriteBinds(c.linkedWrites).map(([, at]) => at)]
+  const reads = [...baselines.allowRead, ...c.allowRead]
+  // Asked only of a link a punch meets: a target under the deny anchor is
+  // bound only where some read grant already reaches it.
+  let fence: { denied: string[]; granted: string[] } | undefined
+  const reachable = (real: string): boolean => {
+    fence ??= { denied: denyRead.map(toRealPath), granted: reads.map(toRealPath) }
+    return (
+      !fence.denied.some((d) => atOrUnder(real, d)) || fence.granted.some((g) => atOrUnder(real, g))
+    )
+  }
+  const allowRead = unique(reads.flatMap((r) => punchWritePaths(r, punched, reachable)))
 
   const custom: Parameters<SrtModule['SandboxManager']['wrapWithSandbox']>[2] = {
     filesystem: {

package/src/exec/sandbox-paths.ts

@@ -102,6 +102,8 @@ export function sandboxReads(
     readonly config: {
       readonly allowRead: readonly string[]
       readonly allowWrite: readonly string[]
+      /** Denies the whole host, not only `baseDenyRead`: only a grant reads. */
+      readonly hermetic?: boolean
     }
   },
   file: string,
@@ -109,7 +111,7 @@ export function sandboxReads(
   const real = toRealPath(file)
   const under = (g: string): boolean => atOrUnder(real, toRealPath(g))
   return (
-    !sandbox.baseDenyRead.some(under) ||
+    (sandbox.config.hermetic !== true && !sandbox.baseDenyRead.some(under)) ||
     [...sandbox.baseAllowRead, ...sandbox.config.allowRead, ...sandbox.config.allowWrite].some(
       under,
     )