lastlight 0.15.0 → 0.16.1

package/dist/sandbox/egress-firewall-config.js

@@ -1,434 +0,0 @@
-import { mkdirSync, writeFileSync } from "fs";
-import { join } from "path";
-import { DEFAULT_ALLOWLIST, mergeAllowlist } from "./egress-allowlist.js";
-/**
- * Egress firewall config generation for the docker sandbox backend.
- *
- * Architecture (replaces the earlier tinyproxy CONNECT-proxy):
- *
- *   sandbox-egress (internal: true, subnet 172.30.0.0/24)
- *     ├─ sandbox containers              (docker run --dns <coredns-ip>)
- *     ├─ coredns-strict   172.30.0.10    → returns nginx-strict IP for allowlist hosts, NXDOMAIN otherwise
- *     ├─ coredns-open     172.30.0.11    → returns nginx-open IP for ANY hostname (except hard-deny SSRF magnets)
- *     ├─ nginx-egress-strict 172.30.0.20 → ssl_preread, SNI must match allowlist; tunnel upstream via proxy-egress
- *     └─ nginx-egress-open   172.30.0.21 → tunnel any SNI; client DNS already gated through coredns-open
- *
- * Why this instead of a forward proxy (tinyproxy/smokescreen): clients
- * inside the sandbox (especially the OpenAI/Anthropic SDKs that build
- * their own undici dispatchers) don't honour HTTP_PROXY / HTTPS_PROXY.
- * Forcing them to cooperate is a losing battle. By spoofing DNS and
- * peeking SNI at the network layer, the sandbox sees no proxy at all —
- * it dials `api.openai.com:443` directly. The firewall intercepts the
- * connection by virtue of being the only thing the spoofed DNS pointed
- * at.
- *
- * Inspired by Vercel Sandbox's egress firewall (SNI peeking, no env
- * vars). Their implementation also handles TLS termination for
- * credentials brokering and Postgres STARTTLS — we don't (yet).
- *
- * ## Wildcards
- *
- * Entries in egress-allowlist.ts with a leading dot (`".github.com"`)
- * match the apex plus every subdomain. nginx's `map` directive supports
- * this syntax natively. CoreDNS uses the `template` plugin with an
- * anchored regex to do the same.
- */
-/** Fixed IPs assigned in docker-compose.yml so `--dns` and nginx upstreams can reference them. */
-export const COREDNS_STRICT_IP = "172.30.0.10";
-export const COREDNS_OPEN_IP = "172.30.0.11";
-export const NGINX_STRICT_IP = "172.30.0.20";
-export const NGINX_OPEN_IP = "172.30.0.21";
-/**
- * Static IP of the in-network OTEL collector (docker backend). Sandboxes
- * dial it directly by IP — it lives on `sandbox-egress` alongside the
- * firewalls, so no DNS lookup (and therefore no coredns allowlist entry)
- * is involved. The collector is the ONLY OTLP endpoint a sandbox ever
- * sees: it terminates the sandbox's telemetry and re-exports to the real
- * backend over `proxy-egress` using credentials that stay host-side. This
- * is why the strict SNI firewall no longer needs to know about collector
- * hosts or non-443 ports — that hop happens on the trusted outbound leg,
- * not through `ssl_preread`.
- */
-export const OTEL_COLLECTOR_IP = "172.30.0.30";
-/** OTLP/HTTP + OTLP/gRPC receiver ports the in-network collector listens on. */
-export const OTEL_COLLECTOR_OTLP_HTTP_PORT = 4318;
-export const OTEL_COLLECTOR_OTLP_GRPC_PORT = 4317;
-/** Endpoint a docker sandbox is told to export OTLP to (HTTP/protobuf). */
-export const OTEL_COLLECTOR_SANDBOX_ENDPOINT = `http://${OTEL_COLLECTOR_IP}:${OTEL_COLLECTOR_OTLP_HTTP_PORT}`;
-/**
- * UID the `otel/opentelemetry-collector` image runs as (its Dockerfile
- * `USER`). The collector reads the OTLP config (which can hold backend auth
- * headers) as this non-root user. To let it read a mode-0600 file from the
- * shared volume WITHOUT running as root or making the secret world-readable,
- * the harness's own `lastlight` user is pinned to this same UID (see the
- * Dockerfile `useradd -u`), so the collector reads files it wrote as their
- * owner. The Dockerfile and the collector image tag in docker-compose.yml
- * must move together if a future image bumps the UID — enforced by a test in
- * docker-compose.test.ts.
- */
-export const OTEL_COLLECTOR_UID = 10001;
-/** Subnet for sandbox-egress. Compose declares this CIDR so the IPs above are valid. */
-export const SANDBOX_EGRESS_SUBNET = "172.30.0.0/24";
-/**
- * Hostnames the open coredns explicitly NXDOMAINs even in unrestricted
- * mode — known SSRF magnets. nginx's `ssl_preread` SNI inspection alone
- * can't catch hostnames that resolve to private IPs (the DNS server
- * we control gets the first say), so this is the right layer to enforce
- * "no cloud metadata, no internal services" even with `unrestricted_egress`.
- */
-const OPEN_MODE_HARD_DENY = [
-    "metadata.google.internal",
-    "169.254.169.254", // GCP / AWS / Azure metadata service IP literal
-];
-/**
- * Convert one allowlist entry to its nginx `map` line.
- *
- *   "openai.com" → '.openai.com  $ssl_preread_server_name:443;'
- *
- * Every entry is treated as apex+subdomain (see egress-allowlist.ts).
- * The generated line uses nginx's `.foo.com` leading-dot syntax,
- * which is its built-in "match this domain and all subdomains" form.
- * Upstream is whatever SNI the client sent — we don't know which
- * subdomain they're targeting at config-gen time.
- */
-function nginxMapLine(entry) {
-    return `        .${entry} $ssl_preread_server_name:443;`;
-}
-/**
- * Build one CoreDNS `match` regex per allowlist entry. All entries
- * share a SINGLE `template` block (see renderCorefileStrict) because
- * CoreDNS only honours one `template` per zone — multiple blocks
- * silently shadow each other.
- *
- * The `(^|\.)` prefix matches the apex (`openai.com.`) or any subdomain
- * (`api.openai.com.`) — same semantics as nginx's leading-dot form.
- */
-function corednsMatchLineForEntry(entry) {
-    const escapedHost = entry.replaceAll(".", "\\.");
-    return `        match (^|\\.)${escapedHost}\\.$`;
-}
-/** Build the strict nginx.conf — ssl_preread + map on SNI allowlist. */
-export function renderNginxStrictConf() {
-    const mapLines = mergeAllowlist(DEFAULT_ALLOWLIST).map(nginxMapLine).join("\n");
-    return `# Generated by lastlight at harness boot. DO NOT EDIT BY HAND —
-# source of truth is src/sandbox/egress-allowlist.ts.
-
-error_log /dev/stderr warn;
-pid /tmp/nginx.pid;
-
-events { worker_connections 1024; }
-
-# Streams (TCP/UDP). \`ssl_preread\` reads the TLS ClientHello without
-# terminating the session, exposing the SNI hostname as
-# \`$ssl_preread_server_name\`. We \`map\` that to an upstream — anything
-# unmatched is sunk to 127.0.0.1:1 (no listener, instant reset).
-stream {
-  log_format basic '$remote_addr -> $ssl_preread_server_name -> $upstream_addr status=$status';
-  access_log /dev/stdout basic;
-
-  # Runtime resolver for upstream hostnames (docker's embedded DNS).
-  resolver 127.0.0.11 valid=30s ipv6=off;
-
-  # Allowlist. The \`hostnames\` directive enables nginx's wildcard
-  # hostname match: a key like ".github.com" matches "github.com" AND
-  # any subdomain. WITHOUT \`hostnames\`, map does exact string match
-  # only and ".github.com" never matches anything real (we hit this
-  # exact bug in prod — every allowlisted host fell through to the
-  # black hole).
-  map $ssl_preread_server_name $upstream_target {
-    hostnames;
-${mapLines}
-    # Anything else → black hole. The connection resets immediately;
-    # no data ever leaves the sandbox-egress network.
-    default 127.0.0.1:1;
-  }
-
-  server {
-    listen 443;
-    ssl_preread on;
-    proxy_pass $upstream_target;
-    proxy_connect_timeout 5s;
-    proxy_timeout 60s;
-  }
-}
-`;
-}
-/** Build the open nginx.conf — no SNI allowlist, just tunnel whatever DNS pointed at. */
-export function renderNginxOpenConf() {
-    return `# Generated by lastlight at harness boot. DO NOT EDIT BY HAND.
-# This nginx is used only by phases that declared \`unrestricted_egress: true\`.
-# No SNI allowlist — every host is tunnelled. The corresponding coredns-open
-# refuses to resolve the cloud-metadata hostnames so SSRF to them is blocked
-# even in this mode.
-
-error_log /dev/stderr warn;
-pid /tmp/nginx.pid;
-
-events { worker_connections 1024; }
-
-stream {
-  log_format basic '$remote_addr -> $ssl_preread_server_name -> $upstream_addr status=$status';
-  access_log /dev/stdout basic;
-  resolver 127.0.0.11 valid=30s ipv6=off;
-
-  server {
-    listen 443;
-    ssl_preread on;
-    # $ssl_preread_server_name is whatever SNI the client sent. Tunnel
-    # to that hostname on :443. No allowlist check.
-    proxy_pass $ssl_preread_server_name:443;
-    proxy_connect_timeout 5s;
-    proxy_timeout 60s;
-  }
-}
-`;
-}
-/** Build the Corefile that returns the strict nginx IP for allowlist hosts. */
-export function renderCorefileStrict() {
-    // ALL allowlist entries share a SINGLE template block. CoreDNS only
-    // honours one `template` per (class, type, zone), so multiple blocks
-    // silently overwrite each other — we learned this in prod when only
-    // the first host in the list resolved.
-    const matchLines = mergeAllowlist(DEFAULT_ALLOWLIST).map(corednsMatchLineForEntry).join("\n");
-    return `# Generated by lastlight from src/sandbox/egress-allowlist.ts.
-# All allowlist hosts live in a single \`template IN A\` block (multiple
-# template blocks per zone are NOT additive — they shadow each other).
-# Queries that don't match any \`match\` regex fall through to the
-# catch-all NXDOMAIN at the end.
-.:53 {
-    template IN A {
-${matchLines}
-        answer "{{ .Name }} 60 IN A ${NGINX_STRICT_IP}"
-    }
-    # Catch-all: NXDOMAIN for everything else (including AAAA queries,
-    # since nginx-egress only binds 443 on IPv4).
-    template IN ANY {
-        rcode NXDOMAIN
-    }
-    errors
-    log
-}
-`;
-}
-/** Build the Corefile that returns the open nginx IP for ANY hostname (except hard-denies). */
-export function renderCorefileOpen() {
-    // Hard-deny hosts each get their OWN zone block. CoreDNS routes queries
-    // to the longest-suffix-matching zone, so `metadata.google.internal:53`
-    // catches both the apex and every subdomain before the catch-all `.`
-    // zone ever sees them. We do NOT use a multi-`template` layout inside
-    // the catch-all zone because CoreDNS only honours one template per
-    // (class, type) and prior templates with non-matching `match` clauses
-    // silently drop the query — leaving sandboxes with no DNS answer at
-    // all (which is exactly what failed in prod the first time explore
-    // ran on the open path).
-    const hardDenyZones = OPEN_MODE_HARD_DENY.map((host) => `# Hard-deny zone for ${host} (SSRF floor — NXDOMAIN even in unrestricted mode).
-${host}:53 {
-    template IN ANY {
-        rcode NXDOMAIN
-    }
-    errors
-    log
-}
-`).join("\n");
-    return `# Generated by lastlight. Used by sandbox phases with unrestricted_egress: true.
-# Returns nginx-egress-open's IP for every hostname EXCEPT the SSRF hard-denies
-# (cloud metadata literals etc).
-.:53 {
-    # Everything → nginx-egress-open IP. Hard-deny names are intercepted
-    # by the per-host zones declared below (longest-suffix zone match).
-    template IN A {
-        answer "{{ .Name }} 60 IN A ${NGINX_OPEN_IP}"
-    }
-    # AAAA returns empty (we route only via IPv4).
-    template IN AAAA {
-        rcode NOERROR
-    }
-    errors
-    log
-}
-
-${hardDenyZones}`;
-}
-/**
- * Write the four config files under $STATE_DIR/proxy/. Idempotent.
- * Returns the directory path. Compose bind-mounts this dir into the
- * coredns + nginx containers read-only.
- */
-export function writeEgressFirewallConfigs(stateDir) {
-    const dir = join(stateDir, "proxy");
-    mkdirSync(dir, { recursive: true });
-    writeFileSync(join(dir, "nginx-strict.conf"), renderNginxStrictConf());
-    writeFileSync(join(dir, "nginx-open.conf"), renderNginxOpenConf());
-    writeFileSync(join(dir, "Corefile.strict"), renderCorefileStrict());
-    writeFileSync(join(dir, "Corefile.open"), renderCorefileOpen());
-    return dir;
-}
-/**
- * Parse an OTLP headers string (`key1=val1,key2=val2`, the OTEL spec format
- * used by `OTEL_EXPORTER_OTLP_HEADERS`) into an ordered list of pairs.
- * Malformed segments (no `=`, empty key) are dropped. Values keep any inner
- * `=` so bearer tokens survive intact.
- */
-function parseOtlpHeaders(raw) {
-    if (!raw)
-        return [];
-    const out = [];
-    for (const segment of raw.split(",")) {
-        const eq = segment.indexOf("=");
-        if (eq <= 0)
-            continue;
-        const key = segment.slice(0, eq).trim();
-        const value = segment.slice(eq + 1).trim();
-        // Reject CR/LF in either part: a real newline in an HTTP header value is
-        // header injection on the collector→backend leg, and would also break the
-        // YAML scalar. A header carrying a newline is corruption/injection, not a
-        // valid OTLP config — drop the pair rather than emit something dangerous.
-        if (!key || /[\r\n]/.test(key) || /[\r\n]/.test(value))
-            continue;
-        out.push([key, value]);
-    }
-    return out;
-}
-/**
- * YAML double-quoted-scalar escape. Backslash and quote are the cases that
- * appear in tokens/URLs; CR/LF/TAB are escaped too as a hard guarantee that
- * we NEVER emit a syntactically invalid collector config regardless of input
- * (header values are already CR/LF-filtered in parseOtlpHeaders, but a stray
- * control char in any other field must not be able to break the file).
- */
-function yamlQuote(s) {
-    return `"${s
-        .replace(/\\/g, "\\\\")
-        .replace(/"/g, '\\"')
-        .replace(/\n/g, "\\n")
-        .replace(/\r/g, "\\r")
-        .replace(/\t/g, "\\t")}"`;
-}
-/** OTLP signals the collector pipelines cover, in stable output order. */
-const OTLP_SIGNALS = ["traces", "metrics", "logs"];
-/**
- * Resolve one signal's backend per the OTEL env precedence: a
- * signal-specific endpoint/headers var wins, otherwise the generic one.
- * Returns null when neither is set — that signal's pipeline then drops to
- * the `debug` exporter instead of being misrouted to another signal's URL.
- */
-function resolveSignalBackend(env, signal) {
-    const SIG = signal.toUpperCase();
-    const specificEndpoint = (env[`OTEL_EXPORTER_OTLP_${SIG}_ENDPOINT`] || "").trim();
-    const genericEndpoint = (env.OTEL_EXPORTER_OTLP_ENDPOINT || "").trim();
-    if (!specificEndpoint && !genericEndpoint)
-        return null;
-    const specificHeaders = (env[`OTEL_EXPORTER_OTLP_${SIG}_HEADERS`] || "").trim();
-    const genericHeaders = env.OTEL_EXPORTER_OTLP_HEADERS;
-    return specificEndpoint
-        ? { endpointField: `${signal}_endpoint`, endpoint: specificEndpoint, headers: parseOtlpHeaders(specificHeaders || genericHeaders) }
-        : { endpointField: "endpoint", endpoint: genericEndpoint, headers: parseOtlpHeaders(specificHeaders || genericHeaders) };
-}
-/**
- * Render the in-network OTEL collector config (docker backend).
- *
- * `opts.active` gates whether the collector forwards anywhere. It MUST track
- * the harness's effective `otel.enabled && otel.forwardToSandbox` — when
- * false, every pipeline is wired to a `debug` exporter (drops data) and NO
- * backend endpoint or credential is emitted, even if `OTEL_EXPORTER_OTLP_*`
- * env vars are present. This is the security floor: the collector listens on
- * a static IP that sandboxes can reach, so if forwarding weren't gated, a
- * sandbox could POST directly to it and exfil to the real backend regardless
- * of the documented `LASTLIGHT_OTEL_ENABLED` / `FORWARD_TO_SANDBOX` opt-outs.
- *
- * When active, the collector re-exports to the REAL backend — the standard
- * `OTEL_EXPORTER_OTLP_ENDPOINT` / `OTEL_EXPORTER_OTLP_HEADERS` plus their
- * per-signal `OTEL_EXPORTER_OTLP_<SIGNAL>_ENDPOINT` / `_HEADERS` overrides,
- * resolved with the spec's precedence. Each signal gets its own exporter so
- * a split traces/metrics/logs setup is routed correctly rather than all
- * collapsing onto whichever endpoint won a fallback chain. Those credentials
- * live here, in a file on the host mounted read-only into the collector, and
- * are NEVER forwarded into an untrusted sandbox. The sandbox can only
- * influence span *content* sent to the harness's own fixed backend — it
- * cannot redirect where the collector exports, so this adds no SSRF/exfil
- * surface.
- *
- * A signal with no configured endpoint (neither specific nor generic) is
- * likewise wired to `debug` so the collector still boots cleanly and accepts
- * connections — sandboxes simply never send what isn't routed.
- */
-export function renderOtelCollectorConfig(opts) {
-    const env = opts.env ?? process.env;
-    const exporterBlocks = [];
-    const pipelineBlocks = [];
-    let needsDebug = false;
-    for (const signal of OTLP_SIGNALS) {
-        // When inactive, resolve NO backend — every signal drops to debug and
-        // not a single OTEL_* value reaches the generated file.
-        const backend = opts.active ? resolveSignalBackend(env, signal) : null;
-        let exporterName;
-        if (!backend) {
-            exporterName = "debug";
-            needsDebug = true;
-        }
-        else {
-            exporterName = `otlphttp/${signal}`;
-            const headerLines = backend.headers.length
-                ? `\n    headers:\n${backend.headers.map(([k, v]) => `      ${yamlQuote(k)}: ${yamlQuote(v)}`).join("\n")}`
-                : "";
-            exporterBlocks.push(`  ${exporterName}:\n    ${backend.endpointField}: ${yamlQuote(backend.endpoint)}${headerLines}`);
-        }
-        pipelineBlocks.push(`    ${signal}:\n      receivers: [otlp]\n      processors: [batch]\n      exporters: [${exporterName}]`);
-    }
-    if (needsDebug)
-        exporterBlocks.push(`  debug:\n    verbosity: normal`);
-    const statusComment = opts.active
-        ? `# Sandboxes export OTLP to this collector (reached by its internal IP on
-# sandbox-egress); the collector re-exports to the configured backend over
-# proxy-egress. Backend credentials below stay host-side — they are never
-# forwarded into a sandbox.`
-        : `# Telemetry forwarding is DISABLED (LASTLIGHT_OTEL_ENABLED is off, or
-# LASTLIGHT_OTEL_FORWARD_TO_SANDBOX is false). The collector still listens so
-# sandboxes don't get connection errors, but every signal drops to a local
-# debug exporter — nothing is forwarded to any backend, and no OTEL_* endpoint
-# or credential is emitted here. This is the egress floor for the static
-# collector IP regardless of any OTEL_* env vars present.`;
-    return `# Generated by lastlight at harness boot. DO NOT EDIT BY HAND —
-# source of truth is src/sandbox/egress-firewall-config.ts.
-#
-${statusComment}
-receivers:
-  otlp:
-    protocols:
-      http:
-        endpoint: 0.0.0.0:${OTEL_COLLECTOR_OTLP_HTTP_PORT}
-      grpc:
-        endpoint: 0.0.0.0:${OTEL_COLLECTOR_OTLP_GRPC_PORT}
-
-processors:
-  batch: {}
-
-exporters:
-${exporterBlocks.join("\n")}
-
-service:
-  pipelines:
-${pipelineBlocks.join("\n")}
-`;
-}
-/**
- * Write the in-network collector config to $STATE_DIR/proxy/otel-collector.yaml.
- * Mode 0600 — it can contain backend auth headers. Called at harness boot
- * (and by the compose `egress-init` one-shot) so the file exists before the
- * `otel-collector` service reads it. `opts.active` gates forwarding — see
- * `renderOtelCollectorConfig`. The harness passes its parsed
- * `otel.enabled && otel.forwardToSandbox`; the env-only callers compute it
- * via `otelForwardActiveFromEnv`.
- */
-export function writeOtelCollectorConfig(stateDir, opts) {
-    const dir = join(stateDir, "proxy");
-    mkdirSync(dir, { recursive: true });
-    const path = join(dir, "otel-collector.yaml");
-    // Mode 0600 — it can carry backend auth headers. In the docker deployment
-    // the writer (harness/egress-init, gosu'd to `lastlight`) and the collector
-    // share UID 10001 (see OTEL_COLLECTOR_UID + the Dockerfile pin), so the
-    // collector reads this file as its owner without it being world-readable.
-    writeFileSync(path, renderOtelCollectorConfig(opts), { mode: 0o600 });
-    return path;
-}
-//# sourceMappingURL=egress-firewall-config.js.map

package/dist/sandbox/egress-firewall-config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"egress-firewall-config.js","sourceRoot":"","sources":["../../src/sandbox/egress-firewall-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,kGAAkG;AAClG,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAC/C,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAC;AAC7C,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAC;AAC7C,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAC;AAE3C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAC/C,gFAAgF;AAChF,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAAC;AAClD,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAAC;AAClD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,+BAA+B,GAAG,UAAU,iBAAiB,IAAI,6BAA6B,EAAE,CAAC;AAE9G;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAExC,wFAAwF;AACxF,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAsB;IAC7C,0BAA0B;IAC1B,iBAAiB,EAAE,gDAAgD;CACpE,CAAC;AAEF;;;;;;;;;;GAUG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,YAAY,KAAK,gCAAgC,CAAC;AAC3D,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,wBAAwB,CAAC,KAAa;IAC7C,MAAM,WAAW,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACjD,OAAO,wBAAwB,WAAW,MAAM,CAAC;AACnD,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,qBAAqB;IACnC,MAAM,QAAQ,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChF,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2BP,QAAQ;;;;;;;;;;;;;;CAcT,CAAC;AACF,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,mBAAmB;IACjC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BR,CAAC;AACF,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB;IAClC,oEAAoE;IACpE,qEAAqE;IACrE,oEAAoE;IACpE,uCAAuC;IACvC,MAAM,UAAU,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9F,OAAO;;;;;;;EAOP,UAAU;sCAC0B,eAAe;;;;;;;;;;CAUpD,CAAC;AACF,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,kBAAkB;IAChC,wEAAwE;IACxE,wEAAwE;IACxE,qEAAqE;IACrE,sEAAsE;IACtE,mEAAmE;IACnE,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,yBAAyB;IACzB,MAAM,aAAa,GAAG,mBAAmB,CAAC,GAAG,CAC3C,CAAC,IAAI,EAAE,EAAE,CAAC,wBAAwB,IAAI;EACxC,IAAI;;;;;;;CAOL,CACE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO;;;;;;;sCAO6B,aAAa;;;;;;;;;;EAUjD,aAAa,EAAE,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAgB;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACpC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACvE,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACnE,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC;IACpE,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,GAAuB;IAC/C,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,EAAE,IAAI,CAAC;YAAE,SAAS;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,IAAI,CAAC,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QACjE,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,IAAI,CAAC;SACT,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;SACpB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;SACrB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;SACrB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;AAC9B,CAAC;AAED,0EAA0E;AAC1E,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAU,CAAC;AAoB5D;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,GAAsB,EAAE,MAAkB;IACtE,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,gBAAgB,GAAG,CAAC,GAAG,CAAC,sBAAsB,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClF,MAAM,eAAe,GAAG,CAAC,GAAG,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvE,IAAI,CAAC,gBAAgB,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IAEvD,MAAM,eAAe,GAAG,CAAC,GAAG,CAAC,sBAAsB,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChF,MAAM,cAAc,GAAG,GAAG,CAAC,0BAA0B,CAAC;IACtD,OAAO,gBAAgB;QACrB,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,MAAM,WAAW,EAAE,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,CAAC,eAAe,IAAI,cAAc,CAAC,EAAE;QACnI,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,gBAAgB,CAAC,eAAe,IAAI,cAAc,CAAC,EAAE,CAAC;AAC7H,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAkD;IAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,IAAI,UAAU,GAAG,KAAK,CAAC;IAEvB,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QAClC,sEAAsE;QACtE,wDAAwD;QACxD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACvE,IAAI,YAAoB,CAAC;QACzB,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,YAAY,GAAG,OAAO,CAAC;YACvB,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,YAAY,GAAG,YAAY,MAAM,EAAE,CAAC;YACpC,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM;gBACxC,CAAC,CAAC,mBAAmB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,SAAS,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC3G,CAAC,CAAC,EAAE,CAAC;YACP,cAAc,CAAC,IAAI,CAAC,KAAK,YAAY,UAAU,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,WAAW,EAAE,CAAC,CAAC;QACxH,CAAC;QACD,cAAc,CAAC,IAAI,CAAC,OAAO,MAAM,4EAA4E,YAAY,GAAG,CAAC,CAAC;IAChI,CAAC;IAED,IAAI,UAAU;QAAE,cAAc,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAEvE,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM;QAC/B,CAAC,CAAC;;;4BAGsB;QACxB,CAAC,CAAC;;;;;0DAKoD,CAAC;IAEzD,OAAO;;;EAGP,aAAa;;;;;4BAKa,6BAA6B;;4BAE7B,6BAA6B;;;;;;EAMvD,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;;;;EAIzB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;CAC1B,CAAC;AACF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAgB,EAAE,IAAkD;IAC3G,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACpC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;IAC9C,0EAA0E;IAC1E,4EAA4E;IAC5E,wEAAwE;IACxE,0EAA0E;IAC1E,aAAa,CAAC,IAAI,EAAE,yBAAyB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/sandbox/images.d.ts

@@ -1,23 +0,0 @@
-/**
- * Sandbox image names + the docker availability probes. Kept in this
- * dependency-light module (only `child_process`, no `./docker.js`) so callers
- * like the workflow runner can check image availability without importing the
- * full `DockerSandbox` machinery — `docker.ts` runs `promisify(execFile)` at
- * module load, which trips test suites that mock `child_process`.
- */
-/** The lean default sandbox image (`sandbox.Dockerfile`). */
-export declare const SANDBOX_IMAGE = "lastlight-sandbox:latest";
-/**
- * The enriched browser-QA image (Playwright + Chromium baked in). Built only
- * when QA is enabled (`sandbox-qa.Dockerfile`); a phase opts into it with
- * `sandbox_image: qa`. Fixed name, deliberately not overridable.
- */
-export declare const SANDBOX_IMAGE_QA = "lastlight-sandbox-qa:latest";
-/** Check if Docker sandbox mode is available (docker up + lean image built). */
-export declare function isSandboxAvailable(): boolean;
-/**
- * Whether the browser-QA sandbox image is present on this host. Used by the
- * runner to gracefully skip a `sandbox_image: qa` phase when the image hasn't
- * been built (the lean default deploy), rather than failing the run.
- */
-export declare function qaImageAvailable(): boolean;

package/dist/sandbox/images.js

@@ -1,55 +0,0 @@
-import { execFileSync } from "child_process";
-/**
- * Sandbox image names + the docker availability probes. Kept in this
- * dependency-light module (only `child_process`, no `./docker.js`) so callers
- * like the workflow runner can check image availability without importing the
- * full `DockerSandbox` machinery — `docker.ts` runs `promisify(execFile)` at
- * module load, which trips test suites that mock `child_process`.
- */
-/** The lean default sandbox image (`sandbox.Dockerfile`). */
-export const SANDBOX_IMAGE = "lastlight-sandbox:latest";
-/**
- * The enriched browser-QA image (Playwright + Chromium baked in). Built only
- * when QA is enabled (`sandbox-qa.Dockerfile`); a phase opts into it with
- * `sandbox_image: qa`. Fixed name, deliberately not overridable.
- */
-export const SANDBOX_IMAGE_QA = "lastlight-sandbox-qa:latest";
-/** Check if Docker sandbox mode is available (docker up + lean image built). */
-export function isSandboxAvailable() {
-    return dockerAvailable() && sandboxImageExists(SANDBOX_IMAGE);
-}
-/** Cached check — only probe for the QA image once per process. */
-let _qaImageAvailable = null;
-/**
- * Whether the browser-QA sandbox image is present on this host. Used by the
- * runner to gracefully skip a `sandbox_image: qa` phase when the image hasn't
- * been built (the lean default deploy), rather than failing the run.
- */
-export function qaImageAvailable() {
-    if (_qaImageAvailable === null) {
-        _qaImageAvailable = dockerAvailable() && sandboxImageExists(SANDBOX_IMAGE_QA);
-    }
-    return _qaImageAvailable;
-}
-function dockerAvailable() {
-    try {
-        execFileSync("docker", ["info"], { stdio: "ignore", timeout: 5000 });
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function sandboxImageExists(imageName) {
-    try {
-        const out = execFileSync("docker", ["images", "-q", imageName], {
-            encoding: "utf-8",
-            stdio: ["pipe", "pipe", "pipe"],
-        });
-        return out.trim().length > 0;
-    }
-    catch {
-        return false;
-    }
-}
-//# sourceMappingURL=images.js.map

package/dist/sandbox/images.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"images.js","sourceRoot":"","sources":["../../src/sandbox/images.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C;;;;;;GAMG;AAEH,6DAA6D;AAC7D,MAAM,CAAC,MAAM,aAAa,GAAG,0BAA0B,CAAC;AAExD;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AAE9D,gFAAgF;AAChF,MAAM,UAAU,kBAAkB;IAChC,OAAO,eAAe,EAAE,IAAI,kBAAkB,CAAC,aAAa,CAAC,CAAC;AAChE,CAAC;AAED,mEAAmE;AACnE,IAAI,iBAAiB,GAAmB,IAAI,CAAC;AAE7C;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC9B,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,iBAAiB,GAAG,eAAe,EAAE,IAAI,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,YAAY,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,SAAiB;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE;YAC9D,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/sandbox/index.d.ts

@@ -1,112 +0,0 @@
-import { DockerSandbox } from "./docker.js";
-export { DockerSandbox } from "./docker.js";
-export { SANDBOX_IMAGE, SANDBOX_IMAGE_QA, isSandboxAvailable, qaImageAvailable, } from "./images.js";
-/**
- * Clean up orphaned sandbox containers from previous runs.
- * Called on startup to remove containers that survived a harness restart.
- */
-export declare function cleanupOrphanedSandboxes(): void;
-export declare function sandboxAvailable(): boolean;
-/**
- * Set up the per-task worktree directory (mkdir + optional pre-clone) without
- * touching Docker. Used by the non-docker sandbox modes (gondolin / none) where
- * agentic-pi runs in-process or in a VM rather than a container, but still
- * wants a per-task workspace cloned from the target branch.
- */
-export declare function setupTaskWorktree(opts: {
-    taskId: string;
-    stateDir: string;
-    sandboxDir?: string;
-    prePopulate?: {
-        owner: string;
-        repo: string;
-        branch: string;
-        token: string;
-        /** Owning run id — stamped into a marker so a reused per-PR workspace
-         * refreshes across runs but is preserved between phases of one run. */
-        runId?: string;
-        /** Clone shallowly (`--depth 1 --single-branch`) for read-only workflows. */
-        shallow?: boolean;
-    };
-}): string;
-/**
- * Create a sandbox for a task. Returns the sandbox and a cleanup function.
- * If Docker is not available, returns null (caller should fall back to direct execution).
- */
-export declare function createTaskSandbox(opts: {
-    taskId: string;
-    stateDir: string;
-    sandboxDir?: string;
-    env?: Record<string, string>;
-    /**
-     * When set, the harness clones the repo into workDir at the named branch
-     * before starting the sandbox container. The agent then enters a
-     * workspace that's already checked out, avoiding a redundant
-     * `clone_repo` MCP call inside the session.
-     *
-     * Token must be alphanumeric (shape asserted upstream) and is embedded
-     * into the clone URL just for this one-shot operation — git's own
-     * credential.helper inside the sandbox covers subsequent push/pull.
-     */
-    prePopulate?: {
-        owner: string;
-        repo: string;
-        branch: string;
-        token: string;
-        /** Owning run id — stamped into a marker so a reused per-PR workspace
-         * refreshes across runs but is preserved between phases of one run. */
-        runId?: string;
-        /** Clone shallowly (`--depth 1 --single-branch`) for read-only workflows. */
-        shallow?: boolean;
-    };
-    /**
-     * IP of the coredns sidecar to use as the sandbox's DNS resolver.
-     * Selects the egress policy: `172.30.0.10` (coredns-strict) for the
-     * default allowlist, `172.30.0.11` (coredns-open) for phases that
-     * declared `unrestricted_egress: true`. Passed to `docker run` as
-     * `--dns <ip>`. See src/sandbox/egress-firewall-config.ts.
-     */
-    dnsIp?: string;
-    /**
-     * Override the container image. Defaults to the lean `SANDBOX_IMAGE`; a
-     * browser-QA phase passes `SANDBOX_IMAGE_QA`. The caller is responsible for
-     * ensuring the image exists (see `qaImageAvailable`).
-     */
-    imageName?: string;
-}): Promise<{
-    sandbox: DockerSandbox;
-    workDir: string;
-    cleanup: () => Promise<void>;
-} | null>;
-type PrePopulate = {
-    owner: string;
-    repo: string;
-    branch: string;
-    token: string;
-    runId?: string;
-    shallow?: boolean;
-    recreateFromBase?: boolean;
-};
-/**
- * Clone the repo into `<workDir>/<repo>` at the given branch.
- *
- * Cases:
- * - **Fresh dir** (no `.git`): clone. `--depth 1 --single-branch` for
- *   read-only workflows (`pre.shallow`), `--depth 50` otherwise. For
- *   `recreateFromBase` the branch is cut from the default branch directly
- *   (never `clone --branch <feature>`).
- * - **Same run revisiting the workspace** (`.git` exists, run marker matches
- *   `pre.runId`): preserve — this is a later phase of the same run reading
- *   what an earlier phase wrote (architect's `plan.md`, the reviewer's
- *   checkout). No git ops.
- * - **A fresh run reusing an old per-target workspace** (`.git` exists, marker
- *   differs/absent):
- *   - default (pr-review / pr-fix): fetch + hard-reset to the remote branch +
- *     `git clean` that **keeps `node_modules`** so the next `npm install` is
- *     incremental (the re-review fast path from issue #107).
- *   - `recreateFromBase` (build): delete the stale checkout and re-clone from
- *     the default branch — a re-triggered incomplete build starts again off
- *     current `main` (issue #153).
- */
-export { prePopulateWorkspace as __prePopulateWorkspaceForTest };
-export declare function prePopulateWorkspace(workDir: string, pre: PrePopulate): void;