nylorun 0.6.0-beta → 0.8.0-beta

package/dist/sandbox/commands.js

@@ -0,0 +1,281 @@
+import { createHash, randomBytes } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { CliError } from "../errors.js";
+import { parseStackFlags, reservedSandboxPorts, restartTenant, selectTenant, } from "../stack/commands.js";
+import { dockerPreflight } from "../stack/docker.js";
+import { stackImages } from "../stack/images.js";
+import { choosePort } from "../stack/ports.js";
+import { readStackEnv } from "../stack/prepare.js";
+import { apiRoute, readClusterFile, removeClusterFiles, writeClusterFiles, } from "./cluster-file.js";
+import { contexts, kube } from "./kubectl.js";
+import { CONTROLLER_DEPLOYMENT, CONTROLLER_NAMESPACE, CONTROLLER_SHA256, CONTROLLER_URL, CONTROLLER_VERSION, networkPolicy, SANDBOX_API_VERSION, SANDBOX_CRD, tenantLabel, tenantManifests, tenantNamespace, TOKEN_SECRET, } from "./manifests.js";
+import { assertIPv4, runProbe } from "./probe.js";
+export const sandboxUsage = `  sandbox enable --context <name> [--tenant <name>] [--host-address <ip>] [--bind-address <ip>] [--no-pull]
+                                      run the Tenant's sandboxes as pods on that kubeconfig context (agent-sandbox ${CONTROLLER_VERSION})
+  sandbox disable [--tenant <name>] [--delete-namespace]
+                                      stop the sandboxes service and forget the cluster
+  sandbox status [--tenant <name>] [--json]
+                                      the cluster, the sandboxes service's readiness and what it reports`;
+const ENABLE_USAGE = "nylorun sandbox enable --context <name> [--tenant <name>] [--host-address <ip>] [--bind-address <ip>] [--no-pull]";
+/** The default workload image (D36), pre-pulled with the Runtime image. */
+export const DEFAULT_SANDBOX_IMAGE = "python:3.13-slim";
+/** Preferred host ports for the Harness API, gates and egress (pods reach them). */
+const PREFERRED_PORTS = { harness: 8790, gates: 8791, egress: 8792 };
+const usageError = (message) => new CliError(message, 2);
+/** The context's API server and CA, from the kubeconfig. */
+async function readKubeconfig(k) {
+    const config = JSON.parse(await k.check("Reading the kubeconfig", ["config", "view", "--minify", "--raw", "-o", "json"]));
+    const cluster = config.clusters?.[0]?.cluster;
+    if (!cluster?.server)
+        throw new CliError(`Context ${k.context} has no API server.`, 6);
+    let caData = cluster["certificate-authority-data"];
+    if (!caData && cluster["certificate-authority"])
+        caData = (await readFile(cluster["certificate-authority"])).toString("base64");
+    if (!caData)
+        throw new CliError(`Context ${k.context} has no cluster CA: the sandboxes service only talks to an API server it can verify.`, 6);
+    return { server: cluster.server, caData };
+}
+/**
+ * agent-sandbox: install the pinned release when absent; accept it when the pinned version
+ * serves v1beta1; refuse anything else. Never upgrades or uninstalls.
+ */
+async function ensureController(k, fetch, err) {
+    const crd = await k.getJson(["crd", SANDBOX_CRD]);
+    if (crd) {
+        if (!crd.spec?.versions?.some((v) => v.name === SANDBOX_API_VERSION && v.served))
+            throw new CliError(`Refusing context ${k.context}: its agent-sandbox does not serve agents.x-k8s.io/${SANDBOX_API_VERSION}. Nylorun needs agent-sandbox ${CONTROLLER_VERSION}.`, 6);
+        const deployment = await k.getJson(["deployment", CONTROLLER_DEPLOYMENT, "-n", CONTROLLER_NAMESPACE]);
+        const image = deployment?.spec?.template?.spec?.containers?.[0]?.image ?? "";
+        const version = /:(v[^@:]+)(?:@.*)?$/.exec(image)?.[1];
+        if (version !== CONTROLLER_VERSION)
+            throw new CliError(`Refusing context ${k.context}: agent-sandbox ${version ?? "(controller not found)"} is installed; Nylorun needs ${CONTROLLER_VERSION} and never upgrades or removes it.`, 6);
+        return;
+    }
+    err(`Installing agent-sandbox ${CONTROLLER_VERSION} into ${k.context}.`);
+    const response = await fetch(CONTROLLER_URL, { signal: AbortSignal.timeout(60_000) });
+    if (!response.ok)
+        throw new CliError(`Downloading ${CONTROLLER_URL} failed (HTTP ${response.status}).`, 1);
+    const manifest = await response.text();
+    const digest = createHash("sha256").update(manifest).digest("hex");
+    if (digest !== CONTROLLER_SHA256)
+        throw new CliError(`${CONTROLLER_URL} has sha256 ${digest}, not the pinned ${CONTROLLER_SHA256}; not applying it.`, 1);
+    await k.check("Installing agent-sandbox", ["apply", "--server-side", "-f", "-"], { input: manifest });
+    await k.check("Waiting for the Sandbox CRD", ["wait", "--for=condition=Established", `crd/${SANDBOX_CRD}`, "--timeout=60s"]);
+    await k.check("Waiting for the agent-sandbox controller", ["rollout", "status", `deployment/${CONTROLLER_DEPLOYMENT}`, "-n", CONTROLLER_NAMESPACE, "--timeout=180s"], { timeoutMs: 200_000 });
+}
+/** The ServiceAccount token the token controller writes into the Secret. */
+async function serviceAccountToken(k, namespace, pollMs) {
+    const deadline = Date.now() + 60_000;
+    for (;;) {
+        const secret = await k.getJson(["secret", TOKEN_SECRET, "-n", namespace]);
+        if (secret?.data?.token)
+            return Buffer.from(secret.data.token, "base64").toString("utf8");
+        if (Date.now() > deadline)
+            throw new CliError(`The ServiceAccount token in ${namespace}/${TOKEN_SECRET} was not issued.`, 6);
+        await new Promise((resolve) => setTimeout(resolve, pollMs));
+    }
+}
+/**
+ * Steps 2–8 of `enable` against one context: controller, namespace and RBAC, NetworkPolicy
+ * probe, the namespace's policy, pre-pull. Returns what cluster.json records.
+ */
+export async function installCluster(deps, input) {
+    const { stack } = deps;
+    const k = kube(deps.kubectl, input.context);
+    const pollMs = deps.pollMs ?? 1000;
+    const { server, caData } = await readKubeconfig(k);
+    let route;
+    try {
+        route = apiRoute(server);
+    }
+    catch (error) {
+        throw new CliError(`Context ${input.context}: ${error instanceof Error ? error.message : String(error)}`, 6);
+    }
+    await ensureController(k, deps.fetch ?? stack.fetch, stack.err);
+    const namespace = tenantNamespace(input.tenant);
+    const existing = await k.getJson(["namespace", namespace]);
+    const owner = existing?.metadata?.labels?.["dev.nylorun.tenant"];
+    if (existing && owner !== tenantLabel(input.tenant))
+        throw new CliError(`Namespace ${namespace} exists in ${input.context} but belongs to ${owner ?? "something else"}.`, 6);
+    await k.apply("Creating the Tenant's namespace and RBAC", tenantManifests(namespace, input.tenant));
+    const token = await serviceAccountToken(k, namespace, pollMs);
+    stack.err(`Probing NetworkPolicy enforcement in ${input.context}.`);
+    const probe = await runProbe({
+        kube: k,
+        docker: stack.docker,
+        ports: stack.ports,
+        err: stack.err,
+        pollMs,
+        ...(deps.policyTimeoutMs !== undefined ? { policyTimeoutMs: deps.policyTimeoutMs } : {}),
+    }, {
+        ...(input.hostAddress ? { hostAddress: input.hostAddress } : {}),
+        ...(input.bindAddress ? { bindAddress: input.bindAddress } : {}),
+        prePull: input.prePull,
+    });
+    await k.apply("Applying the namespace's NetworkPolicy", [
+        networkPolicy(namespace, probe.hostAddress, [input.ports.harness, input.ports.gates, input.ports.egress]),
+    ]);
+    return {
+        cluster: {
+            context: input.context,
+            server,
+            dial: route.dial,
+            tlsServerName: route.tlsServerName,
+            caData,
+            namespace,
+            controllerVersion: CONTROLLER_VERSION,
+            hostAddress: probe.hostAddress,
+            bindAddress: probe.bindAddress,
+            ports: input.ports,
+            networkPolicy: { enforced: probe.enforced, probedAt: probe.probedAt },
+            enabledAt: new Date().toISOString(),
+        },
+        token,
+        notPulled: probe.notPulled,
+    };
+}
+async function enable(deps, args) {
+    const { stack } = deps;
+    const flags = parseStackFlags(args, { booleans: ["--no-pull"], values: ["--context", "--tenant", "--host-address", "--bind-address"] }, ENABLE_USAGE);
+    if (flags.rest.length)
+        throw usageError(`Usage: ${ENABLE_USAGE}`);
+    const context = flags.values.get("--context");
+    if (!context)
+        throw usageError(`nylorun sandbox enable needs --context <name>: the kubeconfig context to run pods in (never the current one implicitly). Usage: ${ENABLE_USAGE}`);
+    const hostAddress = flags.values.get("--host-address");
+    const bindAddress = flags.values.get("--bind-address");
+    if (hostAddress)
+        assertIPv4(hostAddress, "--host-address");
+    if (bindAddress)
+        assertIPv4(bindAddress, "--bind-address");
+    const name = flags.values.get("--tenant");
+    const tenant = await selectTenant(stack, name === undefined ? {} : { name });
+    await dockerPreflight(stack.docker);
+    const known = await contexts(deps.kubectl);
+    if (!known.includes(context))
+        throw usageError(`Context ${context} is not in your kubeconfig. Contexts: ${known.join(", ") || "(none)"}.`);
+    const persisted = (await readStackEnv(tenant.paths))?.sandboxes;
+    const reserved = await reservedSandboxPorts(stack, tenant.paths.root);
+    const taken = new Set();
+    const pick = async (preferred, kept) => {
+        const port = await choosePort(stack.ports, preferred, kept, new Set([...taken, ...(kept === undefined ? reserved : [])]));
+        taken.add(port);
+        return port;
+    };
+    const ports = {
+        harness: await pick(PREFERRED_PORTS.harness, persisted?.harnessPort),
+        gates: await pick(PREFERRED_PORTS.gates, persisted?.gatesPort),
+        egress: await pick(PREFERRED_PORTS.egress, persisted?.egressPort),
+    };
+    const images = stackImages(stack.env, { runtime: stack.runtimeVersion, studio: stack.studioVersion });
+    const installed = await installCluster(deps, {
+        context,
+        tenant: tenant.name,
+        ...(hostAddress ? { hostAddress } : {}),
+        ...(bindAddress ? { bindAddress } : {}),
+        prePull: flags.booleans.has("--no-pull") ? [] : [DEFAULT_SANDBOX_IMAGE, images.runtime],
+        ports,
+    });
+    for (const image of installed.notPulled)
+        stack.err(`Warning: could not pre-pull ${image} on the cluster's nodes; the first sandbox using it pulls it (or load it, e.g. kind load docker-image ${image}).`);
+    await writeClusterFiles(tenant.paths.root, installed.cluster, installed.token);
+    const settings = {
+        token: persisted?.token ?? randomBytes(32).toString("hex"),
+        image: images.sandboxes,
+        harnessPort: ports.harness,
+        gatesPort: ports.gates,
+        egressPort: ports.egress,
+        hostAddress: installed.cluster.hostAddress,
+        bind: installed.cluster.bindAddress,
+    };
+    await restartTenant(stack, { name: tenant.name, sandboxes: settings });
+    const ready = await stack.docker.stream(tenant.compose("up", "--detach", "--wait", "--wait-timeout", "120", "sandboxes"));
+    if (ready !== 0)
+        throw new CliError(`The sandboxes service did not become ready (image ${images.sandboxes}). See "nylorun logs sandboxes" and "nylorun sandbox status".`, 7);
+    const c = installed.cluster;
+    stack.out(`Sandboxes ${tenant.name}  enabled on ${c.context} (namespace ${c.namespace}, agent-sandbox ${c.controllerVersion})`);
+    stack.out(`Pods reach ${c.hostAddress} on ports ${c.ports.harness}, ${c.ports.gates}, ${c.ports.egress}; NetworkPolicy enforced (probed ${c.networkPolicy.probedAt})`);
+    return 0;
+}
+async function disable(deps, args) {
+    const { stack } = deps;
+    const usage = "nylorun sandbox disable [--tenant <name>] [--delete-namespace]";
+    const flags = parseStackFlags(args, { booleans: ["--delete-namespace"], values: ["--tenant"] }, usage);
+    if (flags.rest.length)
+        throw usageError(`Usage: ${usage}`);
+    const name = flags.values.get("--tenant");
+    const tenant = await selectTenant(stack, name === undefined ? {} : { name });
+    const cluster = await readClusterFile(tenant.paths.root);
+    const persisted = (await readStackEnv(tenant.paths))?.sandboxes;
+    if (!cluster && !persisted) {
+        stack.out(`Sandboxes are not enabled for Tenant ${tenant.name}.`);
+        return 0;
+    }
+    await dockerPreflight(stack.docker);
+    // While compose.yaml still names the service; absent after an earlier failed disable.
+    await stack.docker.run(tenant.compose("rm", "--stop", "--force", "sandboxes"));
+    await removeClusterFiles(tenant.paths.root);
+    await restartTenant(stack, { name: tenant.name, sandboxes: null });
+    if (flags.booleans.has("--delete-namespace") && cluster) {
+        await kube(deps.kubectl, cluster.context).check("Deleting the namespace", [
+            "delete", "namespace", cluster.namespace, "--ignore-not-found", "--wait=false",
+        ]);
+        stack.out(`Deleting namespace ${cluster.namespace} in ${cluster.context}.`);
+    }
+    stack.out(`Sandboxes disabled for Tenant ${tenant.name}.${cluster && !flags.booleans.has("--delete-namespace") ? ` Namespace ${cluster.namespace} in ${cluster.context} is kept (--delete-namespace removes it and every sandbox in it).` : ""}`);
+    return 0;
+}
+/** Asks the sandboxes service from inside the runtime container, which holds the token. */
+const INFO_SCRIPT = "fetch(process.env.NYLORUN_SANDBOXES_URL+'/v1/info',{headers:{authorization:'Bearer '+process.env.NYLORUN_SANDBOXES_TOKEN},signal:AbortSignal.timeout(5000)}).then(async r=>{process.stdout.write(await r.text());process.exit(r.ok?0:1)},()=>process.exit(1))";
+async function status(deps, args) {
+    const { stack } = deps;
+    const usage = "nylorun sandbox status [--tenant <name>] [--json]";
+    const flags = parseStackFlags(args, { booleans: ["--json"], values: ["--tenant"] }, usage);
+    if (flags.rest.length)
+        throw usageError(`Usage: ${usage}`);
+    const name = flags.values.get("--tenant");
+    const tenant = await selectTenant(stack, name === undefined ? {} : { name });
+    const cluster = await readClusterFile(tenant.paths.root);
+    if (!cluster) {
+        if (flags.booleans.has("--json"))
+            stack.out(JSON.stringify({ enabled: false }, null, 2));
+        else
+            stack.out(`Sandboxes are not enabled for Tenant ${tenant.name}. Run "nylorun sandbox enable --context <name>".`);
+        return 3;
+    }
+    await dockerPreflight(stack.docker);
+    const ready = (await stack.docker.run(tenant.compose("exec", "-T", "sandboxes", "/sandboxes", "healthcheck"))).code === 0;
+    const answer = await stack.docker.run(tenant.compose("exec", "-T", "runtime", "node", "-e", INFO_SCRIPT));
+    let info;
+    try {
+        info = answer.code === 0 ? JSON.parse(answer.stdout) : undefined;
+    }
+    catch {
+        info = undefined;
+    }
+    const { caData: _ca, ...recorded } = cluster;
+    if (flags.booleans.has("--json")) {
+        stack.out(JSON.stringify({ enabled: true, cluster: recorded, ready, ...(info ? { info } : {}) }, null, 2));
+    }
+    else {
+        stack.out(`Context     ${cluster.context}  (${cluster.server}, dialled at ${cluster.dial})`);
+        stack.out(`Namespace   ${cluster.namespace}  agent-sandbox ${cluster.controllerVersion}`);
+        stack.out(`Pods reach  ${cluster.hostAddress} ports ${cluster.ports.harness}, ${cluster.ports.gates}, ${cluster.ports.egress} (bound on ${cluster.bindAddress})`);
+        stack.out(`Policy      ${cluster.networkPolicy.enforced ? "enforced" : "NOT enforced"} (probed ${cluster.networkPolicy.probedAt})`);
+        stack.out(`Service     ${ready ? "ready" : "not ready"}${info ? "" : " (no /v1/info answer)"}`);
+    }
+    return ready ? 0 : 3;
+}
+const COMMANDS = {
+    enable,
+    disable,
+    status,
+};
+/** `nylorun sandbox <enable|disable|status>`. */
+export async function runSandboxCommand(args, deps) {
+    const [name, ...rest] = args;
+    const command = name === undefined ? undefined : COMMANDS[name];
+    if (!command)
+        throw usageError(`Usage:\n${sandboxUsage}`);
+    return await command(deps, rest);
+}

package/dist/sandbox/kubectl.d.ts

@@ -0,0 +1,39 @@
+export interface KubectlResult {
+    code: number;
+    stdout: string;
+    stderr: string;
+    /** The kubectl binary was not found. */
+    missing?: boolean;
+}
+/** Runs `kubectl`; replaced by a fake in tests. */
+export interface KubectlRunner {
+    run(args: readonly string[], options?: {
+        input?: string;
+        timeoutMs?: number;
+    }): Promise<KubectlResult>;
+}
+/** The real `kubectl` on PATH. */
+export declare function spawnKubectl(env: Readonly<Record<string, string | undefined>>, binary?: string): KubectlRunner;
+/**
+ * kubectl bound to one context: every call passes `--context`, so the current context is
+ * never used.
+ */
+export interface Kube {
+    context: string;
+    run(args: readonly string[], options?: {
+        input?: string;
+        timeoutMs?: number;
+    }): Promise<KubectlResult>;
+    /** Run and fail with a CliError naming `what` on a non-zero exit. */
+    check(what: string, args: readonly string[], options?: {
+        input?: string;
+        timeoutMs?: number;
+    }): Promise<string>;
+    /** `get -o json`; undefined when the object does not exist. */
+    getJson<T = unknown>(args: readonly string[]): Promise<T | undefined>;
+    /** `apply --server-side` of manifests. */
+    apply(what: string, manifests: readonly object[]): Promise<void>;
+}
+export declare function kube(runner: KubectlRunner, context: string): Kube;
+/** The kubeconfig's contexts (`kubectl config get-contexts -o name`). */
+export declare function contexts(runner: KubectlRunner): Promise<string[]>;

package/dist/sandbox/kubectl.js

@@ -0,0 +1,70 @@
+import { spawn } from "node:child_process";
+import { CliError } from "../errors.js";
+/** The real `kubectl` on PATH. */
+export function spawnKubectl(env, binary = "kubectl") {
+    const childEnv = Object.fromEntries(Object.entries(env).filter((entry) => entry[1] !== undefined));
+    return {
+        run(args, options = {}) {
+            return new Promise((resolve) => {
+                let stdout = "";
+                let stderr = "";
+                const child = spawn(binary, [...args], { env: childEnv, stdio: ["pipe", "pipe", "pipe"] });
+                const timer = setTimeout(() => child.kill("SIGKILL"), options.timeoutMs ?? 300_000);
+                child.stdout.on("data", (chunk) => (stdout += chunk));
+                child.stderr.on("data", (chunk) => (stderr += chunk));
+                child.once("error", (error) => {
+                    clearTimeout(timer);
+                    resolve({
+                        code: 127,
+                        stdout,
+                        stderr: error.message,
+                        ...(error.code === "ENOENT" ? { missing: true } : {}),
+                    });
+                });
+                child.once("close", (code) => {
+                    clearTimeout(timer);
+                    resolve({ code: code ?? 1, stdout, stderr });
+                });
+                child.stdin.on("error", () => { });
+                child.stdin.end(options.input ?? "");
+            });
+        },
+    };
+}
+export function kube(runner, context) {
+    const run = (args, options) => runner.run(["--context", context, ...args], options);
+    const check = async (what, args, options) => {
+        const result = await run(args, options);
+        if (result.missing)
+            throw new CliError("kubectl is not installed or not on PATH. Install it (https://kubernetes.io/docs/tasks/tools/).", 1);
+        if (result.code !== 0)
+            throw new CliError(`${what} failed (kubectl --context ${context} ${args.join(" ")}): ${result.stderr.trim() || result.stdout.trim()}`, 1);
+        return result.stdout;
+    };
+    return {
+        context,
+        run,
+        check,
+        async getJson(args) {
+            const result = await run(["get", ...args, "-o", "json"]);
+            if (result.code !== 0) {
+                if (/NotFound|not found/i.test(result.stderr))
+                    return undefined;
+                throw new CliError(`kubectl --context ${context} get ${args.join(" ")}: ${result.stderr.trim()}`, 1);
+            }
+            return JSON.parse(result.stdout);
+        },
+        async apply(what, manifests) {
+            await check(what, ["apply", "--server-side", "--field-manager", "nylorun", "--force-conflicts", "-f", "-"], { input: JSON.stringify({ apiVersion: "v1", kind: "List", items: manifests }) });
+        },
+    };
+}
+/** The kubeconfig's contexts (`kubectl config get-contexts -o name`). */
+export async function contexts(runner) {
+    const result = await runner.run(["config", "get-contexts", "-o", "name"]);
+    if (result.missing)
+        throw new CliError("kubectl is not installed or not on PATH. Install it (https://kubernetes.io/docs/tasks/tools/).", 1);
+    if (result.code !== 0)
+        throw new CliError(`kubectl config get-contexts failed: ${result.stderr.trim()}`, 1);
+    return result.stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+}

package/dist/sandbox/manifests.d.ts

@@ -0,0 +1,41 @@
+/**
+ * What `nylorun sandbox enable` installs into a cluster. The agent-sandbox controller is
+ * pinned (D32, Experiment 2): v1.0.5, API agents.x-k8s.io/v1beta1, its release manifest
+ * verified by sha256 before it is applied. It is never upgraded or uninstalled here.
+ */
+export declare const CONTROLLER_VERSION = "v1.0.5";
+export declare const CONTROLLER_URL = "https://github.com/kubernetes-sigs/agent-sandbox/releases/download/v1.0.5/sandbox.yaml";
+export declare const CONTROLLER_SHA256 = "e89fd95c0aa57609fa24be4112bd52ce67fe8939ecf6f3c17edf2f1e8f1eb860";
+export declare const CONTROLLER_NAMESPACE = "agent-sandbox-system";
+export declare const CONTROLLER_DEPLOYMENT = "agent-sandbox-controller";
+export declare const SANDBOX_CRD = "sandboxes.agents.x-k8s.io";
+export declare const SANDBOX_API_VERSION = "v1beta1";
+export declare const SERVICE_ACCOUNT = "nylorun-sandboxes";
+export declare const TOKEN_SECRET = "nylorun-sandboxes-token";
+export declare const NETWORK_POLICY = "nylorun-sandboxes";
+/**
+ * The Tenant's namespace, `nylorun-sbx-<tenant>`: a DNS label, so `_` becomes `-`; a name
+ * that had to change (or is too long) gets a short hash so two Tenants never share one.
+ */
+export declare function tenantNamespace(tenant: string): string;
+/** The `dev.nylorun.tenant` label value: a Tenant name, cut to a label's 63 characters. */
+export declare function tenantLabel(tenant: string): string;
+/** Namespace, ServiceAccount, Role, RoleBinding and the ServiceAccount's token Secret. */
+export declare function tenantManifests(namespace: string, tenant: string): object[];
+/**
+ * Every pod in the namespace: no ingress, and egress only to the Docker host on the
+ * Harness API, gates and egress ports. No DNS: pods address the host by IP (D42).
+ */
+export declare function networkPolicy(namespace: string, hostAddress: string, ports: readonly number[], options?: {
+    name?: string;
+    podSelector?: Record<string, string>;
+}): object;
+export declare const PROBE_IMAGE = "busybox:1.37.0";
+/** A small busybox pod; `nodeName` pins it (pre-pull), `serve` runs httpd on 8080. */
+export declare function probePod(namespace: string, name: string, options: {
+    role: string;
+    serve?: boolean;
+    image?: string;
+    nodeName?: string;
+    command?: string[];
+}): object;

package/dist/sandbox/manifests.js

@@ -0,0 +1,138 @@
+import { createHash } from "node:crypto";
+/**
+ * What `nylorun sandbox enable` installs into a cluster. The agent-sandbox controller is
+ * pinned (D32, Experiment 2): v1.0.5, API agents.x-k8s.io/v1beta1, its release manifest
+ * verified by sha256 before it is applied. It is never upgraded or uninstalled here.
+ */
+export const CONTROLLER_VERSION = "v1.0.5";
+export const CONTROLLER_URL = `https://github.com/kubernetes-sigs/agent-sandbox/releases/download/${CONTROLLER_VERSION}/sandbox.yaml`;
+export const CONTROLLER_SHA256 = "e89fd95c0aa57609fa24be4112bd52ce67fe8939ecf6f3c17edf2f1e8f1eb860";
+export const CONTROLLER_NAMESPACE = "agent-sandbox-system";
+export const CONTROLLER_DEPLOYMENT = "agent-sandbox-controller";
+export const SANDBOX_CRD = "sandboxes.agents.x-k8s.io";
+export const SANDBOX_API_VERSION = "v1beta1";
+export const SERVICE_ACCOUNT = "nylorun-sandboxes";
+export const TOKEN_SECRET = "nylorun-sandboxes-token";
+export const NETWORK_POLICY = "nylorun-sandboxes";
+const TENANT_LABEL = "dev.nylorun.tenant";
+const MANAGED = { "app.kubernetes.io/managed-by": "nylorun" };
+/**
+ * The Tenant's namespace, `nylorun-sbx-<tenant>`: a DNS label, so `_` becomes `-`; a name
+ * that had to change (or is too long) gets a short hash so two Tenants never share one.
+ */
+export function tenantNamespace(tenant) {
+    const base = tenant.replace(/_/g, "-").slice(0, 40).replace(/-+$/, "");
+    const suffix = base === tenant ? "" : `-${createHash("sha256").update(tenant).digest("hex").slice(0, 6)}`;
+    return `nylorun-sbx-${base}${suffix}`;
+}
+/** The `dev.nylorun.tenant` label value: a Tenant name, cut to a label's 63 characters. */
+export function tenantLabel(tenant) {
+    return tenant.slice(0, 63).replace(/[^a-z0-9]+$/, "");
+}
+/** Namespace, ServiceAccount, Role, RoleBinding and the ServiceAccount's token Secret. */
+export function tenantManifests(namespace, tenant) {
+    const labels = { ...MANAGED, [TENANT_LABEL]: tenantLabel(tenant) };
+    return [
+        { apiVersion: "v1", kind: "Namespace", metadata: { name: namespace, labels } },
+        {
+            apiVersion: "v1",
+            kind: "ServiceAccount",
+            metadata: { name: SERVICE_ACCOUNT, namespace, labels },
+            automountServiceAccountToken: false,
+        },
+        {
+            apiVersion: "rbac.authorization.k8s.io/v1",
+            kind: "Role",
+            metadata: { name: SERVICE_ACCOUNT, namespace, labels },
+            // Lifecycle only: no NetworkPolicies (enable owns the policy) and no pods/exec.
+            rules: [
+                {
+                    apiGroups: ["agents.x-k8s.io"],
+                    resources: ["sandboxes", "sandboxes/status"],
+                    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"],
+                },
+                {
+                    apiGroups: [""],
+                    resources: ["pods", "persistentvolumeclaims", "events"],
+                    verbs: ["get", "list", "watch"],
+                },
+                {
+                    apiGroups: [""],
+                    resources: ["secrets"],
+                    verbs: ["get", "create", "update", "patch", "delete"],
+                },
+            ],
+        },
+        {
+            apiVersion: "rbac.authorization.k8s.io/v1",
+            kind: "RoleBinding",
+            metadata: { name: SERVICE_ACCOUNT, namespace, labels },
+            roleRef: { apiGroup: "rbac.authorization.k8s.io", kind: "Role", name: SERVICE_ACCOUNT },
+            subjects: [{ kind: "ServiceAccount", name: SERVICE_ACCOUNT, namespace }],
+        },
+        {
+            apiVersion: "v1",
+            kind: "Secret",
+            type: "kubernetes.io/service-account-token",
+            metadata: {
+                name: TOKEN_SECRET,
+                namespace,
+                labels,
+                annotations: { "kubernetes.io/service-account.name": SERVICE_ACCOUNT },
+            },
+        },
+    ];
+}
+/**
+ * Every pod in the namespace: no ingress, and egress only to the Docker host on the
+ * Harness API, gates and egress ports. No DNS: pods address the host by IP (D42).
+ */
+export function networkPolicy(namespace, hostAddress, ports, options = {}) {
+    return {
+        apiVersion: "networking.k8s.io/v1",
+        kind: "NetworkPolicy",
+        metadata: { name: options.name ?? NETWORK_POLICY, namespace, labels: MANAGED },
+        spec: {
+            podSelector: options.podSelector ? { matchLabels: options.podSelector } : {},
+            policyTypes: ["Ingress", "Egress"],
+            ingress: [],
+            egress: [
+                {
+                    to: [{ ipBlock: { cidr: `${hostAddress}/32` } }],
+                    ports: ports.map((port) => ({ protocol: "TCP", port })),
+                },
+            ],
+        },
+    };
+}
+export const PROBE_IMAGE = "busybox:1.37.0";
+/** A small busybox pod; `nodeName` pins it (pre-pull), `serve` runs httpd on 8080. */
+export function probePod(namespace, name, options) {
+    const command = options.command ??
+        (options.serve
+            ? ["sh", "-c", "echo ok > /tmp/index.html; exec httpd -f -p 8080 -h /tmp"]
+            : ["sh", "-c", "trap 'exit 0' TERM; while :; do sleep 1; done"]);
+    return {
+        apiVersion: "v1",
+        kind: "Pod",
+        metadata: { name, namespace, labels: { ...MANAGED, "nylorun.dev/probe": options.role } },
+        spec: {
+            automountServiceAccountToken: false,
+            enableServiceLinks: false,
+            terminationGracePeriodSeconds: 1,
+            restartPolicy: options.command ? "Never" : "Always",
+            ...(options.nodeName ? { nodeName: options.nodeName } : {}),
+            securityContext: { runAsNonRoot: true, runAsUser: 1000, seccompProfile: { type: "RuntimeDefault" } },
+            containers: [
+                {
+                    name: "probe",
+                    image: options.image ?? PROBE_IMAGE,
+                    imagePullPolicy: "IfNotPresent",
+                    command,
+                    securityContext: { allowPrivilegeEscalation: false, capabilities: { drop: ["ALL"] } },
+                    resources: { limits: { cpu: "200m", memory: "64Mi" } },
+                },
+            ],
+        },
+    };
+}

package/dist/sandbox/probe.d.ts

@@ -0,0 +1,44 @@
+import type { DockerRunner } from "../stack/docker.js";
+import type { PortProbe } from "../stack/ports.js";
+import type { Kube } from "./kubectl.js";
+/**
+ * The NetworkPolicy probe `nylorun sandbox enable` runs before it trusts a cluster (D32), in
+ * a throwaway namespace `nylorun-sbx-probe-<random>`:
+ *
+ * - a `control` pod (no policy) must reach a `peer` pod and the allowed host port, which
+ *   proves the routes exist;
+ * - the `restricted` pod, under the same policy shape as the Tenant's namespace (egress only
+ *   to `<host>/32` on one port), must reach the allowed host port and nothing else: not the
+ *   peer pod, not another port on the host.
+ *
+ * The host ports are served by a temporary busybox container published on the bind address.
+ * The namespace and the container are always removed.
+ */
+export interface ProbeDeps {
+    kube: Kube;
+    docker: DockerRunner;
+    ports: PortProbe;
+    err(line: string): void;
+    /** Delay between polls; tests shorten it. */
+    pollMs?: number;
+    /** How long the policy may take to apply. */
+    policyTimeoutMs?: number;
+}
+export interface ProbeResult {
+    hostAddress: string;
+    bindAddress: string;
+    enforced: true;
+    probedAt: string;
+    /** Images the pre-pull could not pull (warnings, not failures). */
+    notPulled: string[];
+}
+/** Docker Desktop and OrbStack forward the host address to this machine's loopback. */
+export declare function defaultBind(context: string, hostAddress: string): string;
+export declare function assertIPv4(value: string, option: string): string;
+/** The last IPv4 address `nslookup` prints for the name (the first is the DNS server). */
+export declare function parseNslookup(output: string): string | undefined;
+export declare function runProbe(deps: ProbeDeps, options: {
+    hostAddress?: string;
+    bindAddress?: string;
+    prePull?: readonly string[];
+}): Promise<ProbeResult>;