kern-sandbox 0.2.27 → 0.2.28

package/README.md

@@ -21,8 +21,9 @@ unenforceable cap FATAL: the box refuses to start rather than run uncapped. It a
 other refusal does, as `fault.type === "startup_failed"` on the result, NOT as an exception from the
 constructor, so a caller that only catches exceptions will walk past it.
 
-Dependency-free: it shells out to the `kern` binary and does not re-implement isolation in
-JavaScript.
+The runtime this drives, its tests and the other bindings are one repository:
+**[github.com/getkern/kern](https://github.com/getkern/kern)**. Dependency-free: it shells out to
+the `kern` binary and does not re-implement isolation in JavaScript.
 
 **Your loop reads a field, not a stack trace.** A timeout, an OOM-kill, a blocked syscall or a missing
 interpreter each arrive as a typed `fault` on the result, beside stdout and the exit code, so the
@@ -176,7 +177,9 @@ Every relaxing option says so in its name or docs:
   line, so a credential in `env` does not leak into `ps`.
 - **mounts refused**: the host's own sources (`/`, `/etc`, `/root`, `/boot`, `/proc`, `/sys`, `/dev`,
   `$HOME`, the docker socket), any path with a **credential directory** in it (`.ssh`, `.aws`, `.gnupg`,
-  `.kube`, `.docker`, `.azure`, `.password-store`, `.netrc`, `.git-credentials`, `.pypirc`, `.npmrc`),
+  `.kube`, `.docker`, `.azure`, `.oci`, `.terraform.d`, `.password-store`, `.netrc`, `.git-credentials`,
+  `.pypirc`, `.npmrc`, `.databrickscfg`, `.boto`, `.s3cfg`, `.rclone.conf`, and under `.config`:
+  `gcloud`, `gh`, `doctl`, `rclone`),
   **kern's own state** (`$XDG_RUNTIME_DIR/kern`, the image cache, the config dir, the data dir that
   holds every named volume: the sandbox's control plane), and escaping targets.
 - **workspace I/O contained**: `writeFile`/`readFile` reject `..` escapes, open the final component

package/index.js

@@ -36,7 +36,7 @@ const crypto = require("crypto");
 const zlib = require("zlib");
 const { spawn, spawnSync } = require("child_process");
 
-const VERSION = "0.2.27";
+const VERSION = "0.2.28";
 
 const DEFAULT_IMAGE = "python:3.12-slim";
 const WORKSPACE = "/workspace"; // where the persistent workspace is mounted inside every box
@@ -493,6 +493,22 @@ function kernStateDirs() {
  * wrong way round, and it is the scenario a prompt-injected agent is steered into ("read ~/.aws"). These
  * match by NAME because they live under a per-user home. No escape hatch, same as `/etc`: a job that
  * needs one credential should be given that one file in the workspace. */
+//
+// THE LIST WAS SHORT OF THE PROMISE ABOVE IT, and the asymmetry is what gave it away: AWS refused,
+// Azure refused, GCP accepted. MEASURED against the published SDK with each directory CREATED first,
+// because a refusal that is really "source does not exist" is a skip wearing a pass - that is how
+// `~/.config/gcloud` read as covered on a host that has no gcloud.
+//
+// `~/.config/<tool>` NEEDS THE PARENT, which is why there is a second set below: `gcloud` and `gh`
+// are not dotfiles, and refusing a bare `gh` component anywhere would refuse `~/projects/gh/src` - a
+// guard that fires on ordinary work gets switched off, and then it guards nothing.
+//
+// DELIBERATELY NOT ADDED: `.cargo`, `.m2`, `.gem`. Each holds ONE credential file next to a package
+// cache people legitimately mount, so refusing the directory would break a real use and push callers
+// off the guard. The residual gap is named rather than papered over.
+//
+// KEPT IDENTICAL TO THE PYTHON BINDING on purpose: two spellings of one rule drift, and a caller who
+// moved between the two SDKs would meet a different boundary in each.
 const REFUSED_MOUNT_COMPONENTS = new Set([
   ".ssh",
   ".aws",
@@ -505,6 +521,20 @@ const REFUSED_MOUNT_COMPONENTS = new Set([
   ".git-credentials",
   ".pypirc",
   ".npmrc",
+  ".oci",
+  ".terraform.d",
+  ".databrickscfg",
+  ".boto",
+  ".s3cfg",
+  ".rclone.conf",
+]);
+
+// `parent/child` pairs, refused when they appear CONSECUTIVELY in the source.
+const REFUSED_MOUNT_PAIRS = new Set([
+  ".config/gcloud",
+  ".config/gh",
+  ".config/doctl",
+  ".config/rclone",
 ]);
 
 /** A PROGRAMMER/config error, THROWN: bad argument, illegal mount, `kern` not installed, or the box
@@ -908,13 +938,23 @@ function validateMount(source, target) {
           "docker socket is refused",
       );
   }
-  for (const part of real.split(path.sep))
-    if (REFUSED_MOUNT_COMPONENTS.has(part))
-      throw new MountRefused(
-        `refusing to mount ${JSON.stringify(real)}: ${JSON.stringify(part)} holds credentials, and code ` +
-          "in the box would read them. If the job needs one secret, write THAT FILE into the workspace " +
-          "(sbx.writeFile) or mount a directory that holds only it",
-      );
+  const parts = real.split(path.sep);
+  let hit = parts.find((p) => REFUSED_MOUNT_COMPONENTS.has(p));
+  if (hit === undefined)
+    // The `parent/child` form, consecutive so `~/.config/gh` is refused and `~/gh` is not.
+    for (let i = 0; i + 1 < parts.length; i++) {
+      const pair = `${parts[i]}/${parts[i + 1]}`;
+      if (REFUSED_MOUNT_PAIRS.has(pair)) {
+        hit = pair;
+        break;
+      }
+    }
+  if (hit !== undefined)
+    throw new MountRefused(
+      `refusing to mount ${JSON.stringify(real)}: ${JSON.stringify(hit)} holds credentials, and code ` +
+        "in the box would read them. If the job needs one secret, write THAT FILE into the workspace " +
+        "(sbx.writeFile) or mount a directory that holds only it",
+    );
   return [real, target];
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kern-sandbox",
-  "version": "0.2.27",
+  "version": "0.2.28",
   "description": "kern is a fast, rootless sandbox and virtual resource runtime for any workload, including untrusted and LLM-generated code; kern-sandbox is its Node/TypeScript binding. Run untrusted or agent-generated code (Python/JS/Bash) in a real, kernel-enforced box, one per call, with no cloud, no account and no VM.",
   "keywords": [
     "sandbox",