attocode 0.2.3 → 0.2.5

package/dist/src/integrations/safety/sandbox/docker.js

@@ -0,0 +1,294 @@
+/**
+ * Docker Sandbox (Linux/Cross-platform)
+ *
+ * Uses Docker containers for process isolation and resource limiting.
+ * Works on any platform with Docker installed.
+ *
+ * Key features:
+ * - Complete filesystem isolation
+ * - Network namespace separation
+ * - CPU and memory limits via cgroups
+ * - Capability dropping
+ *
+ * Note: Uses spawn() to invoke docker CLI commands with proper argument
+ * arrays - the sandbox provides security via containerization.
+ */
+import { spawn, execSync } from 'child_process';
+import { logger } from '../../utilities/logger.js';
+// =============================================================================
+// DOCKER SANDBOX
+// =============================================================================
+/**
+ * Docker-based sandbox implementation.
+ */
+export class DockerSandbox {
+    options;
+    image;
+    available = null;
+    containerId = null;
+    constructor(options, image = 'node:20-slim') {
+        this.options = options;
+        this.image = image;
+    }
+    /**
+     * Execute a command inside a Docker container.
+     *
+     * Uses spawn with explicit argument arrays for security.
+     */
+    async execute(command, options) {
+        const mergedOptions = { ...this.options, ...options };
+        const timeout = mergedOptions.timeout ?? 60000;
+        const workDir = mergedOptions.workingDir ?? process.cwd();
+        // Build docker run arguments
+        const dockerArgs = this.buildDockerArgs(command, mergedOptions, workDir);
+        return new Promise((resolve) => {
+            const proc = spawn('docker', dockerArgs, {
+                cwd: workDir,
+                env: process.env,
+                stdio: ['pipe', 'pipe', 'pipe'],
+            });
+            let stdout = '';
+            let stderr = '';
+            let killed = false;
+            let timedOut = false;
+            const timer = setTimeout(() => {
+                timedOut = true;
+                killed = true;
+                proc.kill('SIGKILL');
+                // Also try to stop the container
+                if (this.containerId) {
+                    try {
+                        execSync(`docker kill ${this.containerId}`, { stdio: 'pipe' });
+                    }
+                    catch {
+                        // Ignore - container may have already exited
+                    }
+                }
+            }, timeout);
+            proc.stdout?.on('data', (data) => {
+                stdout += data.toString();
+            });
+            proc.stderr?.on('data', (data) => {
+                stderr += data.toString();
+            });
+            proc.on('close', (code) => {
+                clearTimeout(timer);
+                this.containerId = null;
+                resolve({
+                    stdout,
+                    stderr,
+                    exitCode: code ?? 1,
+                    killed,
+                    timedOut,
+                });
+            });
+            proc.on('error', (err) => {
+                clearTimeout(timer);
+                this.containerId = null;
+                resolve({
+                    stdout,
+                    stderr,
+                    exitCode: 1,
+                    killed: false,
+                    timedOut: false,
+                    error: err.message,
+                });
+            });
+        });
+    }
+    /**
+     * Build docker run arguments.
+     */
+    buildDockerArgs(command, options, workDir) {
+        const args = ['run', '--rm'];
+        // Security: drop all capabilities
+        args.push('--cap-drop=ALL');
+        // Security: no new privileges
+        args.push('--security-opt=no-new-privileges');
+        // Network isolation
+        if (!options.networkAllowed) {
+            args.push('--network=none');
+        }
+        // Memory limit
+        if (options.maxMemoryMB) {
+            args.push(`--memory=${options.maxMemoryMB}m`);
+            args.push(`--memory-swap=${options.maxMemoryMB}m`); // No swap
+        }
+        // CPU limit
+        if (options.maxCpuSeconds) {
+            // Convert CPU seconds to CPU period/quota
+            // For simplicity, use cpus limit
+            args.push('--cpus=1');
+        }
+        // Mount working directory
+        args.push('-v', `${workDir}:/workspace:rw`);
+        // Mount additional readable paths
+        for (const path of options.readablePaths ?? []) {
+            if (path !== '/') {
+                const resolvedPath = this.resolvePath(path, workDir);
+                // Only mount if the path exists and is different from workspace
+                if (resolvedPath !== workDir) {
+                    args.push('-v', `${resolvedPath}:${resolvedPath}:ro`);
+                }
+            }
+        }
+        // Mount additional writable paths
+        for (const path of options.writablePaths ?? []) {
+            const resolvedPath = this.resolvePath(path, workDir);
+            // Only mount if different from workspace
+            if (resolvedPath !== workDir && path !== '.') {
+                args.push('-v', `${resolvedPath}:${resolvedPath}:rw`);
+            }
+        }
+        // Set working directory inside container
+        args.push('-w', '/workspace');
+        // Set environment variables
+        for (const [key, value] of Object.entries(options.env ?? {})) {
+            args.push('-e', `${key}=${value}`);
+        }
+        // Pass through common env vars
+        const passthrough = ['HOME', 'USER', 'PATH', 'NODE_ENV', 'npm_config_cache'];
+        for (const key of passthrough) {
+            if (process.env[key]) {
+                args.push('-e', `${key}=${process.env[key]}`);
+            }
+        }
+        // Image
+        args.push(this.image);
+        // Command (use sh -c for shell interpretation)
+        args.push('sh', '-c', command);
+        return args;
+    }
+    /**
+     * Resolve a path relative to working directory.
+     */
+    resolvePath(path, workDir) {
+        if (path.startsWith('/')) {
+            return path;
+        }
+        if (path === '.') {
+            return workDir;
+        }
+        return `${workDir}/${path}`;
+    }
+    /**
+     * Check if Docker is available.
+     */
+    async isAvailable() {
+        if (this.available !== null) {
+            return this.available;
+        }
+        try {
+            // Check if docker command exists and daemon is running
+            execSync('docker info', { stdio: 'pipe' });
+            this.available = true;
+            return true;
+        }
+        catch {
+            this.available = false;
+            return false;
+        }
+    }
+    /**
+     * Get sandbox type.
+     */
+    getType() {
+        return 'docker';
+    }
+    /**
+     * Cleanup resources.
+     */
+    async cleanup() {
+        if (this.containerId) {
+            try {
+                execSync(`docker kill ${this.containerId}`, { stdio: 'pipe' });
+            }
+            catch {
+                // Ignore - container may have already exited
+            }
+            this.containerId = null;
+        }
+    }
+    /**
+     * Pull the Docker image if not present.
+     */
+    async ensureImage() {
+        try {
+            execSync(`docker image inspect ${this.image}`, { stdio: 'pipe' });
+        }
+        catch {
+            // Image not found, pull it
+            logger.info(`[DockerSandbox] Pulling image: ${this.image}`);
+            execSync(`docker pull ${this.image}`, { stdio: 'inherit' });
+        }
+    }
+    /**
+     * Set the Docker image to use.
+     */
+    setImage(image) {
+        this.image = image;
+    }
+    /**
+     * Get the current Docker image.
+     */
+    getImage() {
+        return this.image;
+    }
+}
+// =============================================================================
+// PREDEFINED IMAGES
+// =============================================================================
+/**
+ * Recommended Docker images for different use cases.
+ */
+export const DOCKER_IMAGES = {
+    /** Minimal Node.js for JavaScript/TypeScript */
+    node: 'node:20-slim',
+    /** Python for Python scripts */
+    python: 'python:3.12-slim',
+    /** Alpine for general shell commands */
+    alpine: 'alpine:latest',
+    /** Ubuntu for full Linux environment */
+    ubuntu: 'ubuntu:22.04',
+    /** Deno for Deno scripts */
+    deno: 'denoland/deno:latest',
+    /** Bun for Bun scripts */
+    bun: 'oven/bun:latest',
+};
+// =============================================================================
+// DOCKER PROFILES
+// =============================================================================
+/**
+ * Strict Docker profile - minimal access.
+ */
+export const DOCKER_STRICT_PROFILE = {
+    writablePaths: [],
+    readablePaths: [],
+    networkAllowed: false,
+    timeout: 30000,
+    maxMemoryMB: 256,
+    maxCpuSeconds: 10,
+};
+/**
+ * Development Docker profile.
+ */
+export const DOCKER_DEV_PROFILE = {
+    writablePaths: ['.', 'node_modules'],
+    readablePaths: [],
+    networkAllowed: true,
+    timeout: 300000,
+    maxMemoryMB: 1024,
+    maxCpuSeconds: 120,
+};
+/**
+ * CI/CD Docker profile.
+ */
+export const DOCKER_CI_PROFILE = {
+    writablePaths: ['.'],
+    readablePaths: [],
+    networkAllowed: true, // For package downloads
+    timeout: 600000, // 10 minutes
+    maxMemoryMB: 2048,
+    maxCpuSeconds: 300,
+};
+//# sourceMappingURL=docker.js.map

package/dist/src/integrations/safety/sandbox/docker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker.js","sourceRoot":"","sources":["../../../../../src/integrations/safety/sandbox/docker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAEnD,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,OAAO,aAAa;IAChB,OAAO,CAAiB;IACxB,KAAK,CAAS;IACd,SAAS,GAAmB,IAAI,CAAC;IACjC,WAAW,GAAkB,IAAI,CAAC;IAE1C,YAAY,OAAuB,EAAE,QAAgB,cAAc;QACjE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,OAAe,EAAE,OAAiC;QAC9D,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;QACtD,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,IAAI,KAAK,CAAC;QAC/C,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAE1D,6BAA6B;QAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QAEzE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE;gBACvC,GAAG,EAAE,OAAO;gBACZ,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CAAC,CAAC;YAEH,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,IAAI,QAAQ,GAAG,KAAK,CAAC;YAErB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,QAAQ,GAAG,IAAI,CAAC;gBAChB,MAAM,GAAG,IAAI,CAAC;gBACd,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACrB,iCAAiC;gBACjC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;oBACrB,IAAI,CAAC;wBACH,QAAQ,CAAC,eAAe,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;oBACjE,CAAC;oBAAC,MAAM,CAAC;wBACP,6CAA6C;oBAC/C,CAAC;gBACH,CAAC;YACH,CAAC,EAAE,OAAO,CAAC,CAAC;YAEZ,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAC/B,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAC/B,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACxB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;gBAExB,OAAO,CAAC;oBACN,MAAM;oBACN,MAAM;oBACN,QAAQ,EAAE,IAAI,IAAI,CAAC;oBACnB,MAAM;oBACN,QAAQ;iBACT,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACvB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;gBAExB,OAAO,CAAC;oBACN,MAAM;oBACN,MAAM;oBACN,QAAQ,EAAE,CAAC;oBACX,MAAM,EAAE,KAAK;oBACb,QAAQ,EAAE,KAAK;oBACf,KAAK,EAAE,GAAG,CAAC,OAAO;iBACnB,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,eAAe,CACrB,OAAe,EACf,OAAuB,EACvB,OAAe;QAEf,MAAM,IAAI,GAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAEvC,kCAAkC;QAClC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAE5B,8BAA8B;QAC9B,IAAI,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QAE9C,oBAAoB;QACpB,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC9B,CAAC;QAED,eAAe;QACf,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC;YAC9C,IAAI,CAAC,IAAI,CAAC,iBAAiB,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,UAAU;QAChE,CAAC;QAED,YAAY;QACZ,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YAC1B,0CAA0C;YAC1C,iCAAiC;YACjC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC;QAED,0BAA0B;QAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,gBAAgB,CAAC,CAAC;QAE5C,kCAAkC;QAClC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;YAC/C,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACrD,gEAAgE;gBAChE,IAAI,YAAY,KAAK,OAAO,EAAE,CAAC;oBAC7B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,YAAY,IAAI,YAAY,KAAK,CAAC,CAAC;gBACxD,CAAC;YACH,CAAC;QACH,CAAC;QAED,kCAAkC;QAClC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;YAC/C,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACrD,yCAAyC;YACzC,IAAI,YAAY,KAAK,OAAO,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAC7C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,YAAY,IAAI,YAAY,KAAK,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAED,yCAAyC;QACzC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAE9B,4BAA4B;QAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7D,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;QACrC,CAAC;QAED,+BAA+B;QAC/B,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAC;QAC7E,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QAED,QAAQ;QACR,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAEtB,+CAA+C;QAC/C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAE/B,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,IAAY,EAAE,OAAe;QAC/C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,OAAO,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW;QACf,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,SAAS,CAAC;QACxB,CAAC;QAED,IAAI,CAAC;YACH,uDAAuD;YACvD,QAAQ,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACH,OAAO;QACL,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,QAAQ,CAAC,eAAe,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACjE,CAAC;YAAC,MAAM,CAAC;gBACP,6CAA6C;YAC/C,CAAC;YACD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAC1B,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW;QACf,IAAI,CAAC;YACH,QAAQ,CAAC,wBAAwB,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;YAC3B,MAAM,CAAC,IAAI,CAAC,kCAAkC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YAC5D,QAAQ,CAAC,eAAe,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,KAAa;QACpB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;CACF;AAED,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,gDAAgD;IAChD,IAAI,EAAE,cAAc;IAEpB,gCAAgC;IAChC,MAAM,EAAE,kBAAkB;IAE1B,wCAAwC;IACxC,MAAM,EAAE,eAAe;IAEvB,wCAAwC;IACxC,MAAM,EAAE,cAAc;IAEtB,4BAA4B;IAC5B,IAAI,EAAE,sBAAsB;IAE5B,0BAA0B;IAC1B,GAAG,EAAE,iBAAiB;CACd,CAAC;AAEX,gFAAgF;AAChF,kBAAkB;AAClB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAmB;IACnD,aAAa,EAAE,EAAE;IACjB,aAAa,EAAE,EAAE;IACjB,cAAc,EAAE,KAAK;IACrB,OAAO,EAAE,KAAK;IACd,WAAW,EAAE,GAAG;IAChB,aAAa,EAAE,EAAE;CAClB,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAmB;IAChD,aAAa,EAAE,CAAC,GAAG,EAAE,cAAc,CAAC;IACpC,aAAa,EAAE,EAAE;IACjB,cAAc,EAAE,IAAI;IACpB,OAAO,EAAE,MAAM;IACf,WAAW,EAAE,IAAI;IACjB,aAAa,EAAE,GAAG;CACnB,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAmB;IAC/C,aAAa,EAAE,CAAC,GAAG,CAAC;IACpB,aAAa,EAAE,EAAE;IACjB,cAAc,EAAE,IAAI,EAAE,wBAAwB;IAC9C,OAAO,EAAE,MAAM,EAAO,aAAa;IACnC,WAAW,EAAE,IAAI;IACjB,aAAa,EAAE,GAAG;CACnB,CAAC"}

package/dist/src/integrations/safety/sandbox/index.d.ts

@@ -0,0 +1,188 @@
+/**
+ * OS-Specific Sandbox Integration
+ *
+ * Provides platform-aware sandboxing for command execution:
+ * - macOS: Uses sandbox-exec with Seatbelt profiles
+ * - Linux: Uses Docker containers for isolation
+ * - Fallback: Basic allowlist-based validation
+ *
+ * Inspired by Codex's approach to secure code execution.
+ *
+ * Usage:
+ *   const sandbox = createSandbox({ writablePaths: ['.'], networkAllowed: false });
+ *   const result = await sandbox.execute('npm install');
+ */
+/**
+ * Sandbox execution result.
+ */
+export interface ExecResult {
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+    killed: boolean;
+    timedOut: boolean;
+    error?: string;
+}
+/**
+ * Sandbox configuration options.
+ */
+export interface SandboxOptions {
+    /** Paths that can be written to */
+    writablePaths?: string[];
+    /** Paths that can be read from */
+    readablePaths?: string[];
+    /** Whether network access is allowed */
+    networkAllowed?: boolean;
+    /** Execution timeout in milliseconds */
+    timeout?: number;
+    /** Working directory */
+    workingDir?: string;
+    /** Environment variables */
+    env?: Record<string, string>;
+    /** Maximum memory in MB */
+    maxMemoryMB?: number;
+    /** Maximum CPU time in seconds */
+    maxCpuSeconds?: number;
+    /** Allowed commands (for basic sandbox) */
+    allowedCommands?: string[];
+    /** Blocked commands (for basic sandbox) */
+    blockedCommands?: string[];
+    /** Bash policy mode */
+    bashMode?: 'disabled' | 'read_only' | 'task_scoped' | 'full';
+    /** Bash write protection behavior */
+    bashWriteProtection?: 'off' | 'block_file_mutation';
+    /** Legacy compatibility flag */
+    blockFileCreationViaBash?: boolean;
+}
+/**
+ * Sandbox mode.
+ */
+export type SandboxMode = 'auto' | 'seatbelt' | 'landlock' | 'docker' | 'basic' | 'none';
+/**
+ * Sandbox interface that all implementations must follow.
+ */
+export interface Sandbox {
+    /** Execute a command in the sandbox */
+    execute(command: string, options?: Partial<SandboxOptions>): Promise<ExecResult>;
+    /** Check if the sandbox is available on this system */
+    isAvailable(): Promise<boolean>;
+    /** Get the sandbox type name */
+    getType(): SandboxMode;
+    /** Cleanup any resources */
+    cleanup(): Promise<void>;
+}
+/**
+ * Sandbox manager configuration.
+ */
+export interface SandboxManagerConfig {
+    /** Sandbox mode to use */
+    mode?: SandboxMode;
+    /** Default sandbox options */
+    defaults?: SandboxOptions;
+    /** Docker image to use (for docker mode) */
+    dockerImage?: string;
+    /** Enable verbose logging */
+    verbose?: boolean;
+}
+/**
+ * Sandbox event types.
+ */
+export type SandboxEvent = {
+    type: 'sandbox.execute.start';
+    command: string;
+    mode: SandboxMode;
+} | {
+    type: 'sandbox.execute.complete';
+    command: string;
+    exitCode: number;
+    duration: number;
+} | {
+    type: 'sandbox.execute.error';
+    command: string;
+    error: string;
+} | {
+    type: 'sandbox.blocked';
+    command: string;
+    reason: string;
+} | {
+    type: 'sandbox.mode.changed';
+    from: SandboxMode;
+    to: SandboxMode;
+};
+export type SandboxEventListener = (event: SandboxEvent) => void;
+/**
+ * Manages sandbox selection and execution.
+ */
+export declare class SandboxManager {
+    private config;
+    private activeSandbox;
+    private eventListeners;
+    constructor(config?: SandboxManagerConfig);
+    /**
+     * Get or create the appropriate sandbox for this system.
+     */
+    getSandbox(): Promise<Sandbox>;
+    /**
+     * Execute a command in the sandbox.
+     */
+    execute(command: string, options?: Partial<SandboxOptions>): Promise<ExecResult>;
+    /**
+     * Check if a command should be blocked.
+     */
+    isCommandBlocked(command: string): {
+        blocked: boolean;
+        reason?: string;
+    };
+    /**
+     * Set the sandbox mode.
+     */
+    setMode(mode: SandboxMode): Promise<void>;
+    /**
+     * Get the current sandbox mode.
+     */
+    getMode(): SandboxMode;
+    /**
+     * Get info about available sandboxes.
+     */
+    getAvailableSandboxes(): Promise<{
+        mode: SandboxMode;
+        available: boolean;
+    }[]>;
+    /**
+     * Subscribe to sandbox events.
+     */
+    subscribe(listener: SandboxEventListener): () => void;
+    /**
+     * Cleanup resources.
+     */
+    cleanup(): Promise<void>;
+    /**
+     * Create a sandbox based on mode.
+     */
+    private createSandbox;
+    /**
+     * Auto-detect the best available sandbox.
+     */
+    private autoDetectSandbox;
+    /**
+     * Emit a sandbox event.
+     */
+    private emit;
+}
+/**
+ * Create a sandbox manager.
+ */
+export declare function createSandboxManager(config?: SandboxManagerConfig): SandboxManager;
+/**
+ * Create a sandbox directly with auto-detection.
+ */
+export declare function createSandbox(options?: SandboxOptions): Promise<Sandbox>;
+/**
+ * Quick execute with auto-detected sandbox.
+ */
+export declare function sandboxExec(command: string, options?: SandboxOptions): Promise<ExecResult>;
+export { SeatbeltSandbox } from './seatbelt.js';
+export { DockerSandbox } from './docker.js';
+export { BasicSandbox } from './basic.js';
+export { LandlockSandbox, createLandlockSandbox, checkLandlockSupport } from './landlock.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/integrations/safety/sandbox/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/integrations/safety/sandbox/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAYH;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,mCAAmC;IACnC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAEzB,kCAAkC;IAClC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAEzB,wCAAwC;IACxC,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB,wCAAwC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,wBAAwB;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,4BAA4B;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE7B,2BAA2B;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,kCAAkC;IAClC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,2CAA2C;IAC3C,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B,2CAA2C;IAC3C,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B,uBAAuB;IACvB,QAAQ,CAAC,EAAE,UAAU,GAAG,WAAW,GAAG,aAAa,GAAG,MAAM,CAAC;IAE7D,qCAAqC;IACrC,mBAAmB,CAAC,EAAE,KAAK,GAAG,qBAAqB,CAAC;IAEpD,gCAAgC;IAChC,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;AAEzF;;GAEG;AACH,MAAM,WAAW,OAAO;IACtB,uCAAuC;IACvC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAEjF,uDAAuD;IACvD,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAEhC,gCAAgC;IAChC,OAAO,IAAI,WAAW,CAAC;IAEvB,4BAA4B;IAC5B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,0BAA0B;IAC1B,IAAI,CAAC,EAAE,WAAW,CAAC;IAEnB,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,cAAc,CAAC;IAE1B,4CAA4C;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,6BAA6B;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,uBAAuB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,0BAA0B,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACzF;IAAE,IAAI,EAAE,uBAAuB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjE;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,EAAE,EAAE,WAAW,CAAA;CAAE,CAAC;AAEzE,MAAM,MAAM,oBAAoB,GAAG,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;AA2CjE;;GAEG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAAiC;IAC/C,OAAO,CAAC,aAAa,CAAwB;IAC7C,OAAO,CAAC,cAAc,CAAwC;gBAElD,MAAM,GAAE,oBAAyB;IAS7C;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC;IASpC;;OAEG;IACG,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;IA8BtF;;OAEG;IACH,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IA4BxE;;OAEG;IACG,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAe/C;;OAEG;IACH,OAAO,IAAI,WAAW;IAItB;;OAEG;IACG,qBAAqB,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IAwBnF;;OAEG;IACH,SAAS,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,IAAI;IAKrD;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAU9B;;OAEG;YACW,aAAa;IAyC3B;;OAEG;YACW,iBAAiB;IAuC/B;;OAEG;IACH,OAAO,CAAC,IAAI;CASb;AAoFD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,CAAC,EAAE,oBAAoB,GAAG,cAAc,CAElF;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAG9E;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,CAOrB;AAMD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC"}