cdx-manager 0.25.7 → 0.25.9

package/src/workspace_sandbox.py

@@ -5,9 +5,12 @@ Provider authentication is the only credential deliberately passed to the provid
 """
 from __future__ import annotations
 
+import ipaddress
 import json
 import os
 import shutil
+import socket
+import stat
 import tempfile
 from contextlib import contextmanager
 from pathlib import Path
@@ -28,7 +31,17 @@ NETWORK_RULES = """table inet mission_egress {
 PUBLIC_RESOLV_CONF = "nameserver 1.1.1.1\nnameserver 9.9.9.9\n"
 
 # Keep the trusted setup outside the agent's filesystem/PID/user namespaces.
-NETWORK_SETUP = """
+CLAUDE_STDIN_EXEC = """
+import json
+import os
+import sys
+token = json.loads(sys.stdin.buffer.readline())
+os.environ["CLAUDE_CODE_OAUTH_TOKEN"] = token
+os.dup2(os.open(os.devnull, os.O_RDONLY), 0)
+os.execv(sys.argv[1], sys.argv[1:])
+"""
+
+NETWORK_SETUP = r"""
 import pathlib
 import subprocess
 import sys
@@ -68,24 +81,82 @@ def private_auth_home(auth):
         yield directory
 
 
+ANTIGRAVITY_TOKEN_PATH = ".gemini/antigravity-cli/antigravity-oauth-token"
+# Candidate endpoints extracted from agy 1.4.12; live acceptance is pending.
+ANTIGRAVITY_DESTINATIONS = ("oauth2.googleapis.com", "cloudcode-pa.googleapis.com",
+                            "daily-cloudcode-pa.googleapis.com")
+
+
+def antigravity_token():
+    path = Path.home() / ANTIGRAVITY_TOKEN_PATH
+    try:
+        info = path.lstat()
+    except FileNotFoundError:
+        raise RuntimeError("Antigravity worker is not signed in; sign in once on the worker.") from None
+    if (not stat.S_ISREG(info.st_mode) or info.st_uid != os.getuid()
+            or stat.S_IMODE(info.st_mode) != 0o600 or not info.st_size
+            or any(parent.is_symlink() for parent in path.parents)):
+        raise RuntimeError("Antigravity worker session file is unsafe; restore an owner-only regular token file.")
+    return path
+
+
+def antigravity_secrets():
+    text = antigravity_token().read_text().strip()
+
+    def values(value):
+        if isinstance(value, dict):
+            return [item for child in value.values() for item in values(child)]
+        if isinstance(value, list):
+            return [item for child in value for item in values(child)]
+        return [value] if isinstance(value, str) and value else []
+
+    try:
+        return [text, *values(json.loads(text))]
+    except ValueError:
+        return [text]
+
+
+@contextmanager
+def antigravity_attempt(parent="/dev/shm"):
+    import fcntl
+
+    location = Path(parent).resolve()
+    mounts = [row.split() for row in Path('/proc/mounts').read_text().splitlines()]
+    enclosing = [row for row in mounts if Path(row[1]) == location or Path(row[1]) in location.parents]
+    if not enclosing or max(enclosing, key=lambda row: len(row[1]))[2] != 'tmpfs':
+        raise RuntimeError('Antigravity attempts require memory-backed storage')
+    token = antigravity_token()
+    # Lock the file itself without modifying it; every cdx attempt uses this inode.
+    with token.open("rb") as lock:
+        try:
+            fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
+        except BlockingIOError:
+            raise RuntimeError("Antigravity worker session is busy with another attempt.") from None
+        with tempfile.TemporaryDirectory(prefix="cdx-agy-", dir=parent) as directory:
+            yield directory
+
+
 def clean_env(source: dict) -> dict:
     allowed = ("PATH", "LANG", "LC_ALL", "TERM", "TZ")
     env = {key: source[key] for key in allowed if key in source}
+    env["PATH"] = source.get("PATH", os.defpath) + os.pathsep + str(Path.home() / ".local/bin")
     env.update(HOME="/home/agent", XDG_CONFIG_HOME="/home/agent/.config",
                XDG_CACHE_HOME="/cache", GIT_CONFIG_NOSYSTEM="1",
                GIT_CONFIG_GLOBAL="/dev/null", GIT_TERMINAL_PROMPT="0", GIT_OPTIONAL_LOCKS="0",
                GIT_CONFIG_COUNT="1", GIT_CONFIG_KEY_0="credential.helper", GIT_CONFIG_VALUE_0="",
                GH_CONFIG_DIR="/home/agent/.config/gh", NPM_CONFIG_CACHE="/cache/npm",
                PIP_CACHE_DIR="/cache/pip", UV_CACHE_DIR="/cache/uv",
+               RTK_DB_PATH="/cache/rtk/history.db",
                # Cache users have different mount paths; their GC cannot identify each other's browsers.
                PLAYWRIGHT_BROWSERS_PATH="/cache/playwright", PLAYWRIGHT_SKIP_BROWSER_GC="1", CI="1")
     return env
 
 
 def sandbox_command(command: list[str], tree: Path, *, network: bool, writable: bool = True,
-                    source: dict | None = None, auth_home: str = "", provider: str = "", observation_home: str = "") -> tuple[list[str], dict]:
+                    source: dict | None = None, auth_home: str = "", provider: str = "", observation_home: str = "", ollama_relay: str = "", claude_token_stdin: bool = False) -> tuple[list[str], dict]:
     source = os.environ if source is None else source
-    binary = shutil.which(command[0], path=source.get("PATH"))
+    env = clean_env(source)
+    binary = shutil.which(command[0], path=env["PATH"])
     bwrap = shutil.which("bwrap", path=source.get("PATH"))
     if not binary or not bwrap:
         raise RuntimeError("Workspace isolation requires bubblewrap and " + command[0])
@@ -93,8 +164,9 @@ def sandbox_command(command: list[str], tree: Path, *, network: bool, writable:
         raise RuntimeError("Workspace must be a directory")
     tree = tree.resolve()
     CACHE.mkdir(parents=True, exist_ok=True)
+    (CACHE / "rtk").mkdir(exist_ok=True)
     # Provider transport uses the same restricted egress, even for read-only tools.
-    online = bool(network or provider)
+    online = bool(network or (provider and provider != "ollama"))
     if online:
         pasta = shutil.which("pasta", path=source.get("PATH"))
         nft = shutil.which("nft", path=os.defpath + ":/usr/sbin:/sbin")
@@ -108,6 +180,10 @@ def sandbox_command(command: list[str], tree: Path, *, network: bool, writable:
              if online else ["--unshare-all"])
     args += ["--cap-drop", "ALL"]
     args += ["--proc", "/proc", "--dev", "/dev", "--tmpfs", "/tmp", "--dir", "/home/agent"]
+    if (provider == "claude" and claude_token_stdin) or provider == "antigravity":
+        if not observation_home:
+            raise RuntimeError("Provider requires a volatile attempt home")
+        args += ["--bind", observation_home, "/home/agent"]
     # An allowlist avoids overlooking another secret file or a credential symlink.
     paths = [Path(p) for p in ("/usr", "/bin", "/sbin", "/lib", "/lib64")]
     home = Path.home()
@@ -137,15 +213,24 @@ def sandbox_command(command: list[str], tree: Path, *, network: bool, writable:
                 or common.is_relative_to(tree) or common.is_relative_to(CACHE.resolve())
                 or Path((gitdir / "gitdir").read_text().strip()).resolve() != marker):
             raise RuntimeError("Invalid external worktree Git directory")
-        args += ["--ro-bind", str(marker), str(marker), "--ro-bind", str(common), str(common),
-                 "--tmpfs", str(common / "worktrees"), "--ro-bind", str(gitdir), str(gitdir),
-                 "--ro-bind", "/dev/null", str(common / "config"),
-                 "--tmpfs", str(common / "hooks")]
-        if (gitdir / "config.worktree").exists():
-            args += ["--ro-bind", "/dev/null", str(gitdir / "config.worktree")]
+        # Use sandbox-owned parents rather than traversing private host homes.
+        # Do not expose repository config (remote URLs/helpers/includes), hooks,
+        # other worktrees, or the source checkout. Git remains read-only.
+        private_git = Path("/home/agent/.git")
+        args += ["--ro-bind", str(marker), str(marker), "--dir", str(private_git)]
+        # Combine this worktree's HEAD/index with shared history, without any
+        # commondir/gitdir pointers back into the host filesystem.
+        for origin, names in (
+            (gitdir, ["HEAD", "index", *[p.name for p in gitdir.glob("sharedindex.*")]]),
+            (common, ["objects", "refs", "packed-refs", "shallow", *[p.name for p in common.glob("sharedindex.*")]]),
+        ):
+            for name in names:
+                if (origin / name).exists():
+                    args += ["--ro-bind", str(origin / name), str(private_git / name)]
+        env.update(GIT_DIR=str(private_git), GIT_COMMON_DIR=str(private_git),
+                   GIT_WORK_TREE=str(tree))
     elif marker.exists():
         raise RuntimeError("Expected an isolated git worktree")
-    env = clean_env(source)
     if provider == "codex":
         auth_path = Path(auth_home) / "auth.json"
         if json.loads(auth_path.read_text()).get('tokens', {}).get('refresh_token') != '':
@@ -157,15 +242,63 @@ def sandbox_command(command: list[str], tree: Path, *, network: bool, writable:
         args += ["--ro-bind", str(Path(auth_home) / "auth.json"), "/home/agent/.codex/auth.json"]
     elif provider == "claude":
         token = source.get("CLAUDE_CODE_OAUTH_TOKEN")
-        if not token:
+        if not token and not claude_token_stdin:
             raise RuntimeError("Isolated Claude runs require a cdx OAuth setup token")
-        env.update(CLAUDE_CODE_OAUTH_TOKEN=token, CLAUDE_CODE_SUBPROCESS_ENV_SCRUB="1",
+        if claude_token_stdin:
+            env["XDG_CACHE_HOME"] = "/home/agent/.cache"
+            python = shutil.which("python3", path=os.defpath)
+            if not python:
+                raise RuntimeError("Remote Claude requires Python 3")
+            command = [python, "-I", "-c", CLAUDE_STDIN_EXEC, binary, *command[1:]]
+            binary = python
+        else:
+            env["CLAUDE_CODE_OAUTH_TOKEN"] = token
+        env.update(CLAUDE_CODE_SUBPROCESS_ENV_SCRUB="1",
                    CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC="1")
+    elif provider == "antigravity":
+        token = antigravity_token()
+        args += ["--ro-bind", str(token), "/home/agent/" + ANTIGRAVITY_TOKEN_PATH]
+        env["AGY_CLI_DISABLE_AUTO_UPDATE"] = "true"
+        env["XDG_CACHE_HOME"] = "/home/agent/.cache"
+    elif provider == "ollama":
+        if not ollama_relay:
+            raise RuntimeError("Isolated Ollama requires a supervisor-owned relay")
+        args += ["--ro-bind", ollama_relay, "/run/cdx-ollama"]
     elif provider:
         raise RuntimeError("Unsupported isolated provider: " + provider)
     args += ["--chdir", str(tree), "--", binary, *command[1:]]
     if online:
-        setup = "RULES = " + repr(NETWORK_RULES) + "\nRESOLVER = " + repr(PUBLIC_RESOLV_CONF) + "\n" + NETWORK_SETUP
+        rules = NETWORK_RULES
+        if provider == "claude" and claude_token_stdin and not network:
+            # Resolve on the trusted worker before pasta replaces the DNS namespace.
+            addresses = {entry[4][0] for entry in socket.getaddrinfo("api.anthropic.com", 443, type=socket.SOCK_STREAM)}
+            inference = []
+            for family, values in (("ip", sorted(address for address in addresses if ":" not in address)),
+                                   ("ip6", sorted(address for address in addresses if ":" in address))):
+                if values:
+                    inference.append(f"        {family} daddr {{ {', '.join(values)} }} tcp dport 443 accept")
+            if not inference:
+                raise RuntimeError("No Anthropic inference addresses")
+            rules = rules.replace("policy accept", "policy drop").replace(
+                "        oif", "        ct state established,related accept\n        oif")
+            rules = rules.replace("    }\n}", "        ip daddr { 1.1.1.1, 9.9.9.9 } udp dport 53 accept\n"
+                                  "        ip daddr { 1.1.1.1, 9.9.9.9 } tcp dport 53 accept\n"
+                                  + "\n".join(inference) + "\n    }\n}")
+        if provider == "antigravity":
+            addresses = {entry[4][0] for host in ANTIGRAVITY_DESTINATIONS
+                         for entry in socket.getaddrinfo(host, 443, type=socket.SOCK_STREAM)}
+            if not addresses or any(not ipaddress.ip_address(address).is_global for address in addresses):
+                raise RuntimeError("Antigravity destinations must resolve to public addresses")
+            rules = NETWORK_RULES.replace("policy accept", "policy drop")
+            inference = []
+            for family in ("ip", "ip6"):
+                values = sorted(a for a in addresses if (":" in a) == (family == "ip6"))
+                if values:
+                    inference.append(f"        {family} daddr {{ {', '.join(values)} }} tcp dport 443 accept")
+            rules = rules.replace("    }\n}", "        ip daddr { 1.1.1.1, 9.9.9.9 } udp dport 53 accept\n"
+                                  "        ip daddr { 1.1.1.1, 9.9.9.9 } tcp dport 53 accept\n"
+                                  + "\n".join(inference) + "\n    }\n}")
+        setup = "RULES = " + repr(rules) + "\nRESOLVER = " + repr(PUBLIC_RESOLV_CONF) + "\n" + NETWORK_SETUP
         # Disable both directions explicitly: automatic host-loopback splicing
         # bypasses output filtering unless -T/-U are also disabled.
         args = [pasta, "--config-net", "--no-map-gw", "-t", "none", "-u", "none",