instabox 0.5.4 → 0.6.1

package/skills/instabox-basic-setup/scripts/install-files.py

@@ -0,0 +1,82 @@
+# One-time config copying, run as the sandbox user. This is not Secret delivery.
+import json
+import os
+import stat
+import sys
+
+HOME = '/data/home'
+MARKER = 'INSTABOX-BASIC-SETUP '
+DIRECTORY = os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW
+
+
+def valid_path(path):
+    return (isinstance(path, str) and 0 < len(path) <= 255
+            and not any(ord(c) < 32 or ord(c) == 127 or c == '\\' for c in path)
+            and all(p and p != '.' and not p.startswith('..') for p in path.split('/')))
+
+
+def install_files(files, home=HOME):
+    results = []
+    for entry in files:
+        path = entry.get('path')
+        result = {'path': path, 'status': 'failed'}
+        results.append(result)
+        if not valid_path(path) or not isinstance(entry.get('text'), str):
+            continue
+        data = entry['text'].encode('utf-8')
+        if len(data) > 64 * 1024 or b'\x00' in data:
+            continue
+        fd = None
+        temporary = None
+        try:
+            fd = os.open(home, DIRECTORY)
+            parts = path.split('/')
+            for part in parts[:-1]:
+                try:
+                    os.mkdir(part, 0o700, dir_fd=fd)
+                except FileExistsError:
+                    pass
+                child = os.open(part, DIRECTORY, dir_fd=fd)
+                os.close(fd)
+                fd = child
+            name = parts[-1]
+            try:
+                current = os.stat(name, dir_fd=fd, follow_symlinks=False)
+                if not stat.S_ISREG(current.st_mode):
+                    continue
+            except FileNotFoundError:
+                pass
+            temporary = '.instabox-setup-' + os.urandom(8).hex()
+            output = os.open(temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600, dir_fd=fd)
+            with os.fdopen(output, 'wb') as stream:
+                stream.write(data)
+                stream.flush()
+                os.fsync(stream.fileno())
+                os.fchmod(stream.fileno(), 0o600)
+            os.rename(temporary, name, src_dir_fd=fd, dst_dir_fd=fd)
+            temporary = None
+            result['status'] = 'written'
+        except Exception:
+            # The remote shell and filesystem are untrusted. Return only fixed
+            # outcomes; exception text and config contents never reach logs.
+            pass
+        finally:
+            if fd is not None:
+                if temporary:
+                    try:
+                        os.unlink(temporary, dir_fd=fd)
+                    except OSError:
+                        pass
+                os.close(fd)
+    return results
+
+
+if __name__ == '__main__':
+    try:
+        payload = json.load(sys.stdin)
+        result = install_files(payload['files'])
+        sys.stdout.write(MARKER + json.dumps({'files': result}) + '\n')
+        sys.exit(0 if all(item['status'] == 'written' for item in result) else 1)
+    except Exception:
+        sys.stdout.write(MARKER + '{"error":"config copy failed"}\n')
+        sys.exit(1)

package/skills/instabox-basic-setup/scripts/lib.mjs

@@ -3,6 +3,7 @@
 // The one rule every function here keeps: a credential's value is never
 // returned to the agent, stored in a file or printed. Code that looks at a
 // secret returns names, places and sizes only.
+import { isIP } from 'node:net';
 import { spawnSync } from 'node:child_process';
 import { lstatSync, readdirSync, readFileSync, realpathSync, statSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
@@ -82,9 +83,23 @@ export const WELL_KNOWN = new Set([
   'DIGITALOCEAN_ACCESS_TOKEN',
 ]);
 
-// Names the Vault refuses for env items (docs/vault.md).
-const RESERVED = new Set(['HOME', 'PATH', 'USER', 'LOGNAME', 'SHELL', 'TERM', 'XDG_RUNTIME_DIR', 'DBUS_SESSION_BUS_ADDRESS']);
-export function vaultEnvNameOK(name) {
+// Reserved Secret variable names (internal/secrets/validate.go).
+const RESERVED = new Set([
+  'HOME',
+  'PATH',
+  'USER',
+  'LOGNAME',
+  'SHELL',
+  'TERM',
+  'XDG_RUNTIME_DIR',
+  'DBUS_SESSION_BUS_ADDRESS',
+  'SSL_CERT_FILE',
+  'SSL_CERT_DIR',
+  'REQUESTS_CA_BUNDLE',
+  'CURL_CA_BUNDLE',
+  'NODE_EXTRA_CA_CERTS',
+]);
+export function secretNameOK(name) {
   return (
     /^[A-Za-z_][A-Za-z0-9_]*$/.test(name) &&
     name.length <= 128 &&
@@ -100,12 +115,13 @@ export const isSecretName = (name) => SECRET_NAME.test(name);
 export const MACOS_ONLY =
   /\/opt\/homebrew|\/usr\/local\/Cellar|\/usr\/local\/Homebrew|\/Applications\/|\/Library\/|\bosxkeychain\b|\bUseKeychain\b|\bpbcopy\b|\bpbpaste\b|\bosascript\b|\breattach-to-user-namespace\b|\bterminal-notifier\b|\bafplay\b|\/System\/|\.orbstack\/|1password.*agent\.sock|\bsecurity (?:find|add)-[a-z-]*password\b/i;
 
-// The Vault's limits (docs/vault.md, pkg/instaboxapi MaxVaultValueBytes); the server's own
-// come from `instabox usage --json` (.limits.vault) when it answers.
-export const VAULT_MAX_VALUE = 64 * 1024;
-export const VAULT_MAX_TOTAL = 256 * 1024;
-export const VAULT_MAX_ITEMS = 100;
+// Org Secret limits; the server may override these in .limits.vault (legacy wire name).
+export const SECRET_MAX_VALUE = 64 * 1024;
+export const SECRET_MAX_TOTAL = 256 * 1024;
+export const SECRET_MAX_ITEMS = 100;
 
+export const FILE_MAX_VALUE = 64 * 1024;
+export const FILE_MAX_TOTAL = 512 * 1024;
 export const BOX_HOME = '/data/home';
 
 // Runs a command without a shell; never throws. stdout is returned to the caller only:
@@ -184,43 +200,49 @@ export function human(bytes) {
   return `${v >= 10 ? Math.round(v) : v.toFixed(1)} ${u[i]}`;
 }
 
-// The Vault item name for a file item: its path with / as -, as `instabox vault set-file` does.
-export function vaultFileName(path) {
-  return path
-    .replace(/^\./, '')
-    .replaceAll('/', '-')
-    .replace(/[^A-Za-z0-9._-]/g, '-')
-    .replace(/^-+|-+$/g, '')
-    .slice(0, 128);
-}
-
-// A Vault file path must be relative, clean, without .. components (docs/vault.md).
-export function vaultPathOK(p) {
-  if (!p || p.startsWith('/') || p.length > 255 || /[\0\\\n]/.test(p)) return false;
+// Paths are relative to the guest home. Config copying never follows symlinks.
+export function configPathOK(p) {
+  if (typeof p !== 'string' || !p || p.startsWith('/') || p.length > 255 || /[\x00-\x1f\x7f\\]/.test(p)) return false;
   return p.split('/').every((c) => c !== '' && c !== '.' && !c.startsWith('..'));
 }
 
-// A selector as the plan writes it: `*` (every box) or `key=value,key=value`.
-export function parseSelector(s) {
-  s = s.trim();
-  if (s === '*' || s === '') return {};
-  const out = {};
-  for (const part of s.split(',')) {
-    const m = part.trim().match(/^([A-Za-z0-9_.-]{1,63})=([^,]{0,512})$/);
-    if (!m) throw new Error(`selector ${JSON.stringify(s)}: write * or key=value,key=value`);
-    out[m[1]] = m[2];
-  }
-  if (Object.keys(out).length > 32) throw new Error('selector: 32 labels at most');
-  return out;
+export function deliveryPolicy(delivery, hosts = []) {
+  if (!['env', 'proxy'].includes(delivery) || !Array.isArray(hosts)) throw new Error('delivery must be env or proxy');
+  if (delivery === 'env' && hosts.length) throw new Error('env delivery cannot enforce hosts; use -');
+  if (delivery === 'proxy' && (!hosts.length || hosts.length > 32))
+    throw new Error('proxy delivery requires 1-32 exact hosts');
+  const normalized = hosts.map((name) => {
+    if (typeof name !== 'string') throw new Error('hosts must be exact public DNS names');
+    const h = name.toLowerCase().replace(/\.$/, '');
+    if (
+      h.length > 253 ||
+      !h.includes('.') ||
+      isIP(h) ||
+      /(?:^|\.)(?:local|localhost)$/.test(h) ||
+      h.split('.').some((label) => !/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label))
+    ) {
+      throw new Error('hosts must be exact public DNS names without a scheme, port, path, IP address or wildcard');
+    }
+    return h;
+  });
+  return { delivery, hosts: [...new Set(normalized)].sort() };
 }
 
-export function selectorString(sel) {
-  const e = Object.entries(sel || {}).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
-  return e.length ? e.map(([k, v]) => `${k}=${v}`).join(',') : '*';
+export function validID(s) {
+  return typeof s === 'string' && /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(s);
 }
-
-export function sameSelector(a, b) {
-  return selectorString(a) === selectorString(b);
+export function secretIdentity(s) {
+  return {
+    id: s.id,
+    name: s.name,
+    orgId: s.orgId,
+    version: s.version,
+    delivery: s.delivery,
+    hosts: [...(s.hosts || [])].sort(),
+  };
+}
+export function sameSecret(a, b) {
+  return !!a && !!b && JSON.stringify(secretIdentity(a)) === JSON.stringify(secretIdentity(b));
 }
 
 // True when the module is the script node was started with (not imported by a test).