cowork-os 0.3.21

package/dist/electron/electron/agent/sandbox/runner.js

@@ -0,0 +1,410 @@
+"use strict";
+/**
+ * SandboxRunner - Secure execution environment for shell commands
+ *
+ * This file maintains backward compatibility by re-exporting the refactored sandbox system.
+ *
+ * The sandbox system now supports:
+ * - macOS sandbox-exec profiles (native, preferred on macOS)
+ * - Docker containers (cross-platform, Linux/Windows)
+ * - No sandbox fallback (with timeout and output limits)
+ *
+ * Use createSandbox() from sandbox-factory.ts for new code.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SandboxRunner = exports.DockerSandbox = exports.MacOSSandbox = exports.NoSandbox = exports.isDockerAvailable = exports.detectAvailableSandbox = exports.createSandbox = void 0;
+exports.createSandboxRunner = createSandboxRunner;
+// Re-export the sandbox factory and types for backward compatibility
+// Note: SandboxOptions and SandboxResult are defined locally below to avoid conflicts
+var sandbox_factory_1 = require("./sandbox-factory");
+Object.defineProperty(exports, "createSandbox", { enumerable: true, get: function () { return sandbox_factory_1.createSandbox; } });
+Object.defineProperty(exports, "detectAvailableSandbox", { enumerable: true, get: function () { return sandbox_factory_1.detectAvailableSandbox; } });
+Object.defineProperty(exports, "isDockerAvailable", { enumerable: true, get: function () { return sandbox_factory_1.isDockerAvailable; } });
+Object.defineProperty(exports, "NoSandbox", { enumerable: true, get: function () { return sandbox_factory_1.NoSandbox; } });
+var macos_sandbox_1 = require("./macos-sandbox");
+Object.defineProperty(exports, "MacOSSandbox", { enumerable: true, get: function () { return macos_sandbox_1.MacOSSandbox; } });
+var docker_sandbox_1 = require("./docker-sandbox");
+Object.defineProperty(exports, "DockerSandbox", { enumerable: true, get: function () { return docker_sandbox_1.DockerSandbox; } });
+const child_process_1 = require("child_process");
+const path = __importStar(require("path"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+/**
+ * Default sandbox options
+ */
+const DEFAULT_OPTIONS = {
+    cwd: process.cwd(),
+    timeout: 5 * 60 * 1000, // 5 minutes
+    maxOutputSize: 100 * 1024, // 100KB
+    allowNetwork: false,
+    allowedReadPaths: [],
+    allowedWritePaths: [],
+    envPassthrough: ['PATH', 'HOME', 'USER', 'SHELL', 'LANG', 'TERM', 'TMPDIR'],
+};
+/**
+ * SandboxRunner manages secure command execution
+ */
+class SandboxRunner {
+    constructor(workspace) {
+        this.workspace = workspace;
+    }
+    /**
+     * Initialize sandbox environment
+     */
+    async initialize() {
+        // Generate sandbox profile for this workspace
+        this.sandboxProfile = this.generateSandboxProfile();
+    }
+    /**
+     * Execute a command in the sandbox
+     */
+    async execute(command, args = [], options = {}) {
+        const opts = { ...DEFAULT_OPTIONS, ...options };
+        // Determine working directory
+        const cwd = opts.cwd || this.workspace.path;
+        // Validate working directory is within allowed paths
+        if (!this.isPathAllowed(cwd, 'read')) {
+            return {
+                exitCode: 1,
+                stdout: '',
+                stderr: `Working directory not allowed: ${cwd}`,
+                killed: false,
+                timedOut: false,
+                error: 'Path access denied',
+            };
+        }
+        // Build minimal, safe environment
+        const env = this.buildSafeEnvironment(opts.envPassthrough);
+        // Check if we can use macOS sandbox-exec
+        const useSandboxExec = process.platform === 'darwin' && this.sandboxProfile;
+        let proc;
+        const spawnOptions = {
+            cwd,
+            env,
+            shell: true,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        };
+        if (useSandboxExec && this.sandboxProfile) {
+            // Use sandbox-exec on macOS
+            const profilePath = this.writeTempProfile();
+            proc = (0, child_process_1.spawn)('sandbox-exec', ['-f', profilePath, '/bin/sh', '-c', `${command} ${args.join(' ')}`], spawnOptions);
+        }
+        else {
+            // Fallback: execute without OS-level sandboxing (still has resource limits)
+            proc = (0, child_process_1.spawn)('/bin/sh', ['-c', `${command} ${args.join(' ')}`], spawnOptions);
+        }
+        return new Promise((resolve) => {
+            let stdout = '';
+            let stderr = '';
+            let killed = false;
+            let timedOut = false;
+            // Timeout handler
+            const timeoutHandle = setTimeout(() => {
+                timedOut = true;
+                killed = true;
+                proc.kill('SIGKILL');
+            }, opts.timeout);
+            // Collect stdout
+            proc.stdout?.on('data', (data) => {
+                const chunk = data.toString();
+                if (stdout.length + chunk.length <= opts.maxOutputSize) {
+                    stdout += chunk;
+                }
+                else if (stdout.length < opts.maxOutputSize) {
+                    stdout += chunk.slice(0, opts.maxOutputSize - stdout.length);
+                    stdout += '\n[Output truncated]';
+                }
+            });
+            // Collect stderr
+            proc.stderr?.on('data', (data) => {
+                const chunk = data.toString();
+                if (stderr.length + chunk.length <= opts.maxOutputSize) {
+                    stderr += chunk;
+                }
+                else if (stderr.length < opts.maxOutputSize) {
+                    stderr += chunk.slice(0, opts.maxOutputSize - stderr.length);
+                    stderr += '\n[Output truncated]';
+                }
+            });
+            // Process completion
+            proc.on('close', (code) => {
+                clearTimeout(timeoutHandle);
+                resolve({
+                    exitCode: code ?? 1,
+                    stdout,
+                    stderr,
+                    killed,
+                    timedOut,
+                });
+            });
+            // Process error
+            proc.on('error', (err) => {
+                clearTimeout(timeoutHandle);
+                resolve({
+                    exitCode: 1,
+                    stdout,
+                    stderr: err.message,
+                    killed,
+                    timedOut,
+                    error: err.message,
+                });
+            });
+        });
+    }
+    /**
+     * Execute code in sandbox (for future scripting support)
+     */
+    async executeCode(code, language) {
+        // Create temp file with code
+        const ext = language === 'python' ? '.py' : '.js';
+        const tempFile = path.join(os.tmpdir(), `cowork_script_${Date.now()}${ext}`);
+        try {
+            fs.writeFileSync(tempFile, code, 'utf8');
+            const interpreter = language === 'python' ? 'python3' : 'node';
+            return await this.execute(interpreter, [tempFile], {
+                timeout: 60 * 1000, // 1 minute for scripts
+                allowNetwork: false,
+            });
+        }
+        finally {
+            // Cleanup temp file
+            try {
+                fs.unlinkSync(tempFile);
+            }
+            catch {
+                // Ignore cleanup errors
+            }
+        }
+    }
+    /**
+     * Cleanup sandbox resources
+     */
+    cleanup() {
+        // Clean up any temp files or resources
+        this.sandboxProfile = undefined;
+    }
+    /**
+     * Check if a path is allowed based on workspace permissions
+     */
+    isPathAllowed(targetPath, mode) {
+        const normalizedTarget = path.resolve(targetPath);
+        const normalizedWorkspace = path.resolve(this.workspace.path);
+        // Always allow paths within workspace
+        if (normalizedTarget.startsWith(normalizedWorkspace)) {
+            return true;
+        }
+        // Check unrestricted access
+        if (this.workspace.permissions.unrestrictedFileAccess) {
+            return true;
+        }
+        // Check allowed paths
+        const allowedPaths = this.workspace.permissions.allowedPaths || [];
+        for (const allowed of allowedPaths) {
+            const normalizedAllowed = path.resolve(allowed);
+            if (normalizedTarget.startsWith(normalizedAllowed)) {
+                return true;
+            }
+        }
+        // System paths for read-only access
+        if (mode === 'read') {
+            const systemReadPaths = [
+                '/usr/bin',
+                '/usr/local/bin',
+                '/bin',
+                '/usr/lib',
+                '/System',
+                os.tmpdir(),
+            ];
+            for (const sysPath of systemReadPaths) {
+                if (normalizedTarget.startsWith(sysPath)) {
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+    /**
+     * Build a minimal, safe environment for command execution
+     */
+    buildSafeEnvironment(passthrough) {
+        const safeEnv = {};
+        // Only pass through allowed environment variables
+        for (const key of passthrough) {
+            if (process.env[key]) {
+                safeEnv[key] = process.env[key];
+            }
+        }
+        // Set safe defaults
+        safeEnv.HOME = process.env.HOME || os.homedir();
+        safeEnv.USER = process.env.USER || os.userInfo().username;
+        safeEnv.SHELL = process.env.SHELL || '/bin/bash';
+        safeEnv.TERM = 'xterm-256color';
+        safeEnv.LANG = process.env.LANG || 'en_US.UTF-8';
+        safeEnv.TMPDIR = os.tmpdir();
+        // Minimal PATH with only standard locations
+        safeEnv.PATH = [
+            '/usr/local/bin',
+            '/usr/bin',
+            '/bin',
+            '/usr/sbin',
+            '/sbin',
+        ].join(':');
+        // Add homebrew paths on macOS
+        if (process.platform === 'darwin') {
+            safeEnv.PATH = `/opt/homebrew/bin:/opt/homebrew/sbin:${safeEnv.PATH}`;
+        }
+        return safeEnv;
+    }
+    /**
+     * Generate macOS sandbox-exec profile
+     */
+    generateSandboxProfile() {
+        const workspacePath = this.workspace.path;
+        const permissions = this.workspace.permissions;
+        const tempDir = os.tmpdir();
+        const homeDir = os.homedir();
+        let profile = `(version 1)
+(deny default)
+
+; Allow basic process operations
+(allow process-fork)
+(allow process-exec)
+(allow signal)
+
+; Allow sysctl for system info
+(allow sysctl-read)
+
+; Allow reading system libraries and binaries
+(allow file-read*
+  (subpath "/usr/lib")
+  (subpath "/usr/bin")
+  (subpath "/bin")
+  (subpath "/usr/local")
+  (subpath "/System")
+  (subpath "/Library/Frameworks")
+  (subpath "/Applications/Xcode.app")
+  (subpath "/private/var/db")
+  (literal "/dev/null")
+  (literal "/dev/urandom")
+  (literal "/dev/random")
+  (subpath "/private/tmp")
+  (subpath "${tempDir}")
+)
+
+; Allow homebrew on macOS
+(allow file-read* (subpath "/opt/homebrew"))
+
+; Allow reading workspace
+(allow file-read* (subpath "${workspacePath}"))
+`;
+        // Allow writing to workspace if permitted
+        if (permissions.write) {
+            profile += `
+; Allow writing to workspace
+(allow file-write* (subpath "${workspacePath}"))
+`;
+        }
+        // Allow writing to temp directories
+        profile += `
+; Allow writing to temp directories
+(allow file-write*
+  (subpath "/private/tmp")
+  (subpath "${tempDir}")
+  (subpath "/private/var/folders")
+)
+`;
+        // Allow network if permitted
+        if (permissions.network) {
+            profile += `
+; Allow network access
+(allow network*)
+`;
+        }
+        else {
+            profile += `
+; Deny network access (except localhost)
+(deny network*)
+(allow network* (local ip "localhost:*"))
+`;
+        }
+        // Allow additional read paths
+        const allowedPaths = permissions.allowedPaths || [];
+        for (const allowedPath of allowedPaths) {
+            profile += `(allow file-read* (subpath "${allowedPath}"))\n`;
+            if (permissions.write) {
+                profile += `(allow file-write* (subpath "${allowedPath}"))\n`;
+            }
+        }
+        // Allow mach services needed for basic operation
+        profile += `
+; Allow essential mach services
+(allow mach-lookup
+  (global-name "com.apple.CoreServices.coreservicesd")
+  (global-name "com.apple.SecurityServer")
+  (global-name "com.apple.system.logger")
+  (global-name "com.apple.cfprefsd.daemon")
+  (global-name "com.apple.cfprefsd.agent")
+)
+`;
+        return profile;
+    }
+    /**
+     * Write sandbox profile to temp file
+     */
+    writeTempProfile() {
+        const profilePath = path.join(os.tmpdir(), `cowork_sandbox_${Date.now()}.sb`);
+        fs.writeFileSync(profilePath, this.sandboxProfile, 'utf8');
+        // Schedule cleanup
+        setTimeout(() => {
+            try {
+                fs.unlinkSync(profilePath);
+            }
+            catch {
+                // Ignore cleanup errors
+            }
+        }, 60 * 1000); // Clean up after 1 minute
+        return profilePath;
+    }
+}
+exports.SandboxRunner = SandboxRunner;
+/**
+ * Create a sandboxed command executor for a workspace
+ */
+async function createSandboxRunner(workspace) {
+    const runner = new SandboxRunner(workspace);
+    await runner.initialize();
+    return runner;
+}

package/dist/electron/electron/agent/sandbox/sandbox-factory.js

@@ -0,0 +1,228 @@
+"use strict";
+/**
+ * Sandbox Factory
+ *
+ * Provides a unified interface for sandbox implementations and factory
+ * function to create the appropriate sandbox based on platform and availability.
+ *
+ * Supports:
+ * - macOS sandbox-exec (native, preferred on macOS)
+ * - Docker containers (cross-platform)
+ * - No sandbox (fallback)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NoSandbox = void 0;
+exports.isDockerAvailable = isDockerAvailable;
+exports.detectAvailableSandbox = detectAvailableSandbox;
+exports.createSandbox = createSandbox;
+exports.resetDockerCache = resetDockerCache;
+const macos_sandbox_1 = require("./macos-sandbox");
+const docker_sandbox_1 = require("./docker-sandbox");
+const child_process_1 = require("child_process");
+const security_utils_1 = require("./security-utils");
+/**
+ * No-op sandbox implementation for when sandboxing is unavailable
+ * Still enforces timeouts and output limits, but no OS-level isolation
+ */
+class NoSandbox {
+    constructor(workspace) {
+        this.type = 'none';
+        this.workspace = workspace;
+    }
+    async initialize() {
+        // No initialization needed
+    }
+    async execute(command, args = [], options = {}) {
+        const timeout = options.timeout ?? 5 * 60 * 1000;
+        const maxOutputSize = options.maxOutputSize ?? 100 * 1024;
+        const cwd = options.cwd || this.workspace.path;
+        return new Promise((resolve) => {
+            let stdout = '';
+            let stderr = '';
+            let killed = false;
+            let timedOut = false;
+            const proc = (0, child_process_1.spawn)('/bin/sh', ['-c', `${command} ${args.join(' ')}`], {
+                cwd,
+                shell: true,
+                stdio: ['ignore', 'pipe', 'pipe'],
+            });
+            const timeoutHandle = setTimeout(() => {
+                timedOut = true;
+                killed = true;
+                proc.kill('SIGKILL');
+            }, timeout);
+            proc.stdout?.on('data', (data) => {
+                const chunk = data.toString();
+                if (stdout.length + chunk.length <= maxOutputSize) {
+                    stdout += chunk;
+                }
+                else if (stdout.length < maxOutputSize) {
+                    stdout += chunk.slice(0, maxOutputSize - stdout.length);
+                    stdout += '\n[Output truncated]';
+                }
+            });
+            proc.stderr?.on('data', (data) => {
+                const chunk = data.toString();
+                if (stderr.length + chunk.length <= maxOutputSize) {
+                    stderr += chunk;
+                }
+                else if (stderr.length < maxOutputSize) {
+                    stderr += chunk.slice(0, maxOutputSize - stderr.length);
+                    stderr += '\n[Output truncated]';
+                }
+            });
+            proc.on('close', (code) => {
+                clearTimeout(timeoutHandle);
+                resolve({
+                    exitCode: code ?? 1,
+                    stdout,
+                    stderr,
+                    killed,
+                    timedOut,
+                });
+            });
+            proc.on('error', (err) => {
+                clearTimeout(timeoutHandle);
+                resolve({
+                    exitCode: 1,
+                    stdout,
+                    stderr: err.message,
+                    killed,
+                    timedOut,
+                    error: err.message,
+                });
+            });
+        });
+    }
+    async executeCode(code, language) {
+        const ext = language === 'python' ? '.py' : '.js';
+        const { filePath, cleanup } = (0, security_utils_1.createSecureTempFile)(ext, code);
+        try {
+            const interpreter = language === 'python' ? 'python3' : 'node';
+            return await this.execute(interpreter, [filePath], {
+                timeout: 60 * 1000,
+                allowNetwork: false,
+            });
+        }
+        finally {
+            cleanup();
+        }
+    }
+    cleanup() {
+        // No cleanup needed
+    }
+}
+exports.NoSandbox = NoSandbox;
+/**
+ * Cached Docker availability status
+ */
+let dockerAvailable = null;
+let dockerCheckPromise = null;
+/**
+ * Check if Docker is available and running
+ */
+async function isDockerAvailable() {
+    // Return cached result if available
+    if (dockerAvailable !== null) {
+        return dockerAvailable;
+    }
+    // Return existing promise if check is in progress
+    if (dockerCheckPromise) {
+        return dockerCheckPromise;
+    }
+    dockerCheckPromise = new Promise((resolve) => {
+        const proc = (0, child_process_1.spawn)('docker', ['info'], {
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        let resolved = false;
+        const timeout = setTimeout(() => {
+            if (!resolved) {
+                resolved = true;
+                proc.kill();
+                dockerAvailable = false;
+                resolve(false);
+            }
+        }, 5000);
+        proc.on('close', (code) => {
+            clearTimeout(timeout);
+            if (!resolved) {
+                resolved = true;
+                dockerAvailable = code === 0;
+                resolve(dockerAvailable);
+            }
+        });
+        proc.on('error', () => {
+            clearTimeout(timeout);
+            if (!resolved) {
+                resolved = true;
+                dockerAvailable = false;
+                resolve(false);
+            }
+        });
+    });
+    return dockerCheckPromise;
+}
+/**
+ * Detect the best available sandbox type for the current platform
+ */
+async function detectAvailableSandbox() {
+    // On macOS, prefer native sandbox-exec
+    if (process.platform === 'darwin') {
+        return 'macos';
+    }
+    // On other platforms, check for Docker
+    if (await isDockerAvailable()) {
+        return 'docker';
+    }
+    // Fallback to no sandbox
+    return 'none';
+}
+/**
+ * Create a sandbox instance for the given workspace
+ *
+ * @param workspace - The workspace to create a sandbox for
+ * @param preferredType - Optional preferred sandbox type (overrides auto-detection)
+ * @returns An initialized sandbox instance
+ */
+async function createSandbox(workspace, preferredType) {
+    let sandboxType;
+    if (preferredType && preferredType !== 'auto') {
+        // Validate the preferred type is available
+        if (preferredType === 'macos' && process.platform !== 'darwin') {
+            console.warn('macOS sandbox requested but not on macOS, falling back to auto-detect');
+            sandboxType = await detectAvailableSandbox();
+        }
+        else if (preferredType === 'docker' && !(await isDockerAvailable())) {
+            console.warn('Docker sandbox requested but Docker not available, falling back to auto-detect');
+            sandboxType = await detectAvailableSandbox();
+        }
+        else {
+            sandboxType = preferredType;
+        }
+    }
+    else {
+        sandboxType = await detectAvailableSandbox();
+    }
+    let sandbox;
+    switch (sandboxType) {
+        case 'macos':
+            sandbox = new macos_sandbox_1.MacOSSandbox(workspace);
+            break;
+        case 'docker':
+            sandbox = new docker_sandbox_1.DockerSandbox(workspace);
+            break;
+        case 'none':
+        default:
+            sandbox = new NoSandbox(workspace);
+            break;
+    }
+    await sandbox.initialize();
+    return sandbox;
+}
+/**
+ * Reset Docker availability cache (useful for testing or after Docker installation)
+ */
+function resetDockerCache() {
+    dockerAvailable = null;
+    dockerCheckPromise = null;
+}