openrod 0.0.0 → 0.1.0

package/server/cloud-transfer.js

@@ -0,0 +1,221 @@
+import fs from 'node:fs/promises'
+import path from 'node:path'
+import os from 'node:os'
+import { randomBytes } from 'node:crypto'
+import { spawn } from 'node:child_process'
+import { gateway, contextSelection, runWithContext, sandboxView } from './gateway.js'
+import { imageTemplateRoute, listImageTemplates, templateView } from './image-templates.js'
+import { newRecipe, recipeErrors, NAME_PATTERN } from '../src/lib/image-templates.js'
+import { defaultSession, isSession } from '../src/lib/sandbox-session.js'
+import { IMAGE_TEMPLATE_NAME } from '../src/lib/sandbox-images.js'
+import { groupIds } from '../shared/group-membership.js'
+import { assertSandboxGroup } from '../shared/group-network.js'
+import { cloudOrigin, cloudUnavailable } from './cloud-origin.js'
+import { agentAccessRules } from '../shared/agent-access.js'
+import { listGroups, planSandbox } from './org.js'
+import { listPolicies } from './egress.js'
+
+export const CLOUD_TRANSFER_LIMIT = 25 * 1024 * 1024
+export const CLOUD_TRANSFER_BODY_LIMIT = 36 * 1024 * 1024
+const MAX_FILES = 2000
+const fail = (message, status = 400) => Object.assign(new Error(message), { status })
+const excludedDirectories = ['.git', '.openshell', 'node_modules', '.cache', '__pycache__', '.venv', 'venv', '.ssh', '.aws', '.azure', '.config', '.local', '.npm', '.npm-global', '.claude', '.codex', '.cursor', '.opencode', '.kiro', '.docker', '.gnupg', '.kube', '.terraform', '.pytest_cache', '.mypy_cache', '.ruff_cache', '.turbo']
+const excluded = new Set(excludedDirectories)
+const secretName = /^(?:\.env(?:\..*)?|id_(?:rsa|dsa|ecdsa|ed25519)(?:\.pub)?|\.npmrc|\.pypirc|\.netrc|credentials(?:\..*)?|secrets?(?:\..*)?|auth\.json|\.claude\.json|\.git-credentials|\.(?:bash|zsh|python|sqlite)_history|.+\.(?:pem|key|p12|pfx|jks|keystore|tfstate)(?:\.backup)?)$/i
+const privateKey = /-----BEGIN (?:[A-Z ]*PRIVATE KEY|OPENSSH PRIVATE KEY)-----/
+
+export function transferPathAllowed(value) {
+  if (typeof value !== 'string' || !value || value.length > 1024 || /[\\\0\x01-\x1f\x7f]/.test(value)) return false
+  const parts = value.split('/')
+  if (parts.length > 64 || parts.some((part) => !part || part === '.' || part === '..' || Buffer.byteLength(part) > 255 || excluded.has(part.toLowerCase()))) return false
+  return parts.every((part) => !secretName.test(part) || /^\.env\.(?:example|sample|template)$/i.test(part))
+}
+
+export function validateTransfer(value) {
+  if (!value || value.version !== 1 || !Array.isArray(value.files) || value.files.length > MAX_FILES) throw fail('Invalid cloud transfer bundle.')
+  const launch = value.launch
+  if (!launch || Object.keys(launch).some((key) => !['name', 'image', 'session'].includes(key)) || !NAME_PATTERN.test(launch.name ?? '') || typeof launch.image !== 'string' || !/^[\w./:@-]{1,256}$/.test(launch.image) || !isSession(launch.session)) throw fail('Invalid cloud launch settings.')
+  let recipe
+  if (value.recipe !== undefined) {
+    if (!value.recipe || typeof value.recipe !== 'object' || !Array.isArray(value.recipe.environment) || value.recipe.environment.length) throw fail('Template environment is never transferred.')
+    recipe = newRecipe(Object.fromEntries(Object.keys(newRecipe()).filter((key) => key in value.recipe).map((key) => [key, value.recipe[key]])))
+    if (recipe.source !== 'build' || Object.keys(recipeErrors(recipe)).length || privateKey.test(JSON.stringify(recipe))) throw fail('Invalid cloud rebuild recipe.')
+  }
+  const seen = new Set()
+  let bytes = 0
+  const files = value.files.map((file) => {
+    if (!file || !transferPathAllowed(file.path)) throw fail('Invalid or sensitive transfer path.')
+    if (seen.has(file.path)) throw fail('Duplicate transfer path.')
+    seen.add(file.path)
+    if (typeof file.data !== 'string' || /[^A-Za-z0-9+/=]/.test(file.data) || file.data.length % 4 !== 0) throw fail('Invalid file encoding.')
+    // Check length before allocating the decoded buffer.
+    bytes += Buffer.byteLength(file.data, 'base64')
+    if (bytes > CLOUD_TRANSFER_LIMIT) throw fail('Cloud transfer supports up to 25 MiB of workspace files.', 413)
+    const content = Buffer.from(file.data, 'base64')
+    if (content.toString('base64') !== file.data || privateKey.test(content.toString('utf8'))) throw fail('A file contains a private key or invalid encoding.')
+    return { path: file.path, content, executable: file.executable === true }
+  })
+  // A file cannot also be a parent directory of another file.
+  for (const name of seen) { const parts = name.split('/'); parts.pop(); while (parts.length) { if (seen.has(parts.join('/'))) throw fail('Conflicting transfer paths.'); parts.pop() } }
+  return { launch: { ...launch }, recipe, files, bytes }
+}
+
+async function collect(client, workspace, name, script, limit) {
+  const chunks = []
+  let bytes = 0, exit = null
+  const controller = new AbortController()
+  try {
+    for await (const event of client.sandbox.execStream(name, ['/bin/sh', '-c', script], { workspace, noLoginShell: true, timeoutSecs: 300, signal: controller.signal })) {
+      if (event.stream === 'stdout') {
+        bytes += event.data.length
+        if (bytes > limit) throw fail('Cloud transfer supports up to 25 MiB and 2,000 files.', 413)
+        chunks.push(Buffer.from(event.data))
+      } else if (event.type === 'exit') exit = event.exitCode
+    }
+  } catch (error) { controller.abort(); throw error }
+  if (exit !== 0) throw fail('Could not read workspace files safely. Retry after file writes finish.', 502)
+  return Buffer.concat(chunks).toString('utf8')
+}
+const quote = (value) => "'" + value.replaceAll("'", "'\\''") + "'"
+
+// A source's memberships have no authority on another destination. Reuse the
+// destination's sole eligible group, or require a deliberate choice when its
+// policies offer multiple groups. Creation validates the policy again atomically.
+export async function resolveDestinationGroups({ destinationGroups, name, recipe }, dependencies = {}) {
+  const [groups, policies] = await Promise.all([(dependencies.listGroups ?? listGroups)(), (dependencies.listPolicies ?? listPolicies)()])
+  let selected
+  if (destinationGroups !== undefined) {
+    try { selected = groupIds(destinationGroups) } catch (error) { throw fail(error.message) }
+  } else {
+    const eligible = groups.filter(group => {
+      try { assertSandboxGroup([group.id], groups, policies); return true } catch { return false }
+    })
+    if (!eligible.length) throw fail('Add a network rule to a destination group before importing this workspace.', 409)
+    if (eligible.length !== 1) throw fail('Choose a destination group before importing this workspace.', 409)
+    selected = [eligible[0].id]
+  }
+  try { assertSandboxGroup(selected, groups, policies) } catch (error) { throw fail(error.message) }
+  const plan = await (dependencies.planSandbox ?? planSandbox)({ name, groups: selected, requireGroup: true, agentRules: recipe ? agentAccessRules(recipe) : [] })
+  return plan.groups
+}
+
+export async function exportTransfer(input, options = {}) {
+  if (!NAME_PATTERN.test(input?.name ?? '')) throw fail('Invalid workspace transfer request.')
+  const { client, workspace, workspaceScope } = await (options.connect ?? gateway)()
+  const sandbox = sandboxView((await client.raw.getSandbox({ name: input.name, workspaceScope })).sandbox)
+  if (sandbox.phase !== 'ready') throw fail('Start this sandbox before transferring its workspace.', 409)
+  const listed = await collect(client, workspace, input.name, `[ "$(realpath /sandbox)" = /sandbox ] || exit 1\nfind /sandbox \\( -type d \\( ${excludedDirectories.map((name) => '-iname ' + quote(name)).join(' -o ')} \\) -prune \\) -o \\( -type f -print0 \\)`, 512 * 1024)
+  const paths = listed.split('\0').filter(Boolean).filter((value) => value.startsWith('/sandbox/') && transferPathAllowed(value.slice(9)))
+  if (paths.length > MAX_FILES) throw fail('Cloud transfer supports up to 2,000 files.', 413)
+  // Recheck every path immediately before reading. find never follows links;
+  // realpath equality also refuses a parent replaced with a symlink.
+  const script = paths.length ? `set -eu\nfor f in ${paths.map(quote).join(' ')}; do\n[ -f "$f" ] && [ ! -L "$f" ] && [ "$(realpath "$f")" = "$f" ] || exit 1\nprintf '%s\\0' "\${f#/sandbox/}"\nbase64 < "$f"\nprintf '\\0'\nif [ -x "$f" ]; then printf 'true\\0'; else printf 'false\\0'; fi\ndone` : 'true'
+  const fields = (await collect(client, workspace, input.name, script, CLOUD_TRANSFER_BODY_LIMIT)).split('\0')
+  const files = []
+  for (let i = 0; i + 2 < fields.length; i += 3) files.push({ path: fields[i], data: fields[i + 1].replace(/\s/g, ''), executable: fields[i + 2] === 'true' })
+  if (fields.length !== files.length * 3 + 1 || fields.at(-1) !== '') throw fail('Incomplete workspace transfer.', 502)
+  let recipe, warning
+  const templateName = sandbox.workloadTemplate || sandbox.labels?.[IMAGE_TEMPLATE_NAME]
+  if (templateName) {
+    let template
+    try { template = templateView(await client.sandboxTemplates.get(templateName, { workspace })) } catch (error) { if (error.code !== 'not_found') throw error }
+    if (template?.managed && template.recipe.source === 'build') {
+      recipe = { ...template.recipe, environment: [], command: isSession(template.recipe.command) ? template.recipe.command : '', setups: [], setupRevisions: {} }
+      if (template.recipe.setups?.length) warning = 'Workspace and image recipe copied. Reconnect saved MCP and skill Setups, and agent credentials on the destination.'
+    }
+    else warning = 'Files copied into a fresh Ubuntu shell. Reinstall your custom image tools and reconnect credentials at the destination.'
+  }
+  const localImage = !sandbox.image || sandbox.image.startsWith('openshell-template/') || !sandbox.image.includes('/') && !/^(ubuntu|debian|alpine|node|python|busybox)(:|$)/.test(sandbox.image)
+  if (!recipe && localImage) warning ??= 'Files copied into a fresh Ubuntu shell. Rebuild your custom image and reconnect credentials at the destination.'
+  const value = { version: 1, launch: { name: sandbox.name, image: recipe || warning ? 'ubuntu:24.04' : sandbox.image, session: warning && !recipe ? 'shell' : defaultSession(sandbox) }, files, ...(recipe ? { recipe } : {}) }
+  validateTransfer(value)
+  return { bundle: value, ...(warning ? { warning } : {}) }
+}
+
+export async function localTransfer(input, options = {}) {
+  const origin = options.origin ?? cloudOrigin()
+  if (!origin) throw cloudUnavailable()
+  if (typeof input?.ticket !== 'string' || !/^openrod-user-[a-f0-9]{24}\.[a-f0-9]{64}$/.test(input.ticket)) throw fail('Invalid cloud transfer request.')
+  const { bundle, warning } = await exportTransfer(input, options)
+  if (input.destinationGroups !== undefined) {
+    try { bundle.destinationGroups = groupIds(input.destinationGroups) } catch (error) { throw fail(error.message) }
+  }
+  const response = await (options.fetch ?? fetch)(`${origin}/api/cloud/import`, {
+    method: 'POST', headers: { 'content-type': 'application/json', authorization: `Bearer ${input.ticket}` }, body: JSON.stringify(bundle), redirect: 'error', signal: AbortSignal.timeout(35 * 60_000),
+  })
+  const result = await response.json().catch(() => ({}))
+  if (!response.ok) throw fail(result.error || 'Cloud import failed. Your local workspace is unchanged.', response.status)
+  return { ...result, ...(warning ? { warning } : {}) }
+}
+
+async function rebuild(recipe) {
+  const name = `handoff-${randomBytes(5).toString('hex')}`
+  await imageTemplateRoute('POST', ['image-templates'], { recipe: { ...recipe, name, environment: [] } })
+  const deadline = Date.now() + 20 * 60_000
+  while (Date.now() < deadline) {
+    const template = (await listImageTemplates()).find((item) => item.name === name)
+    if (template?.status === 'ready') return name
+    if (template?.status === 'failed') throw fail(`Image rebuild failed. Open Templates on the destination and inspect ${name}.`, 502)
+    await new Promise((resolve) => setTimeout(resolve, 1000))
+  }
+  await imageTemplateRoute('POST', ['image-templates', name, 'cancel'], {}).catch(() => {})
+  throw fail('Image rebuild timed out. Check Docker on the destination and retry.', 504)
+}
+
+async function waitReady(name) {
+  const { client, workspaceScope } = await gateway()
+  const deadline = Date.now() + 180_000
+  while (Date.now() < deadline) {
+    const sandbox = sandboxView((await client.raw.getSandbox({ name, workspaceScope })).sandbox)
+    if (sandbox.phase === 'ready') return
+    if (['error', 'deleting', 'completed'].includes(sandbox.phase)) throw fail(`Sandbox ${name} did not start. Review its status on the destination.`, 502)
+    await new Promise((resolve) => setTimeout(resolve, 1000))
+  }
+  throw fail(`Sandbox ${name} startup timed out. Review its status on the destination.`, 504)
+}
+
+async function upload(name, root) {
+  const { target, client, workspace } = await gateway()
+  const relatives = []
+  const walk = async (folder, prefix = '') => { for (const entry of await fs.readdir(folder, { withFileTypes: true })) { const relative = prefix + entry.name; relatives.push('/sandbox/' + relative); if (entry.isDirectory()) await walk(path.join(folder, entry.name), relative + '/') } }
+  await walk(root)
+  const check = await client.sandbox.exec(name, ['/bin/sh', '-c', `set -eu\n[ \"$(realpath /sandbox)\" = /sandbox ] || exit 1\nfor p in ${relatives.map(quote).join(' ')}; do [ ! -L \"$p\" ] || exit 1; done`], { workspace, noLoginShell: true, timeoutSecs: 30 })
+  if (check.exitCode !== 0) throw fail('The destination contains a symlink. Review the template before transferring.', 409)
+  await new Promise((resolve, reject) => {
+    const child = spawn(process.env.OPENSHELL_BIN || 'openshell', ['--gateway', target.name, '--workspace', workspace, 'sandbox', 'upload', '--no-git-ignore', name, '.', '/sandbox'], { cwd: root, shell: false, stdio: ['ignore', 'ignore', 'ignore'] })
+    const timer = setTimeout(() => child.kill('SIGKILL'), 10 * 60_000)
+    child.once('error', () => { clearTimeout(timer); reject(fail('The workspace upload could not start on the destination.', 502)) })
+    child.once('close', (code) => { clearTimeout(timer); code === 0 ? resolve() : reject(fail('Workspace upload failed. Your source workspace is unchanged.', 502)) })
+  })
+}
+
+// createSandbox is injected by the router to avoid a circular API dependency.
+export async function importTransfer(req, options) {
+  return runWithContext(contextSelection(), async () => {
+    const chunks = []
+    let bytes = 0
+    for await (const chunk of req) { bytes += Buffer.byteLength(chunk); if (bytes > CLOUD_TRANSFER_BODY_LIMIT) throw fail('Cloud transfer request too large.', 413); chunks.push(Buffer.from(chunk)) }
+    let value
+    try { value = JSON.parse(Buffer.concat(chunks).toString('utf8')) } catch { throw fail('Invalid cloud transfer JSON.') }
+    const transfer = validateTransfer(value)
+    const name = `${transfer.launch.name.slice(0, 10).replace(/-+$/, '')}-${randomBytes(4).toString('hex')}`
+    const groups = await (options.resolveGroups ?? resolveDestinationGroups)({ destinationGroups: value.destinationGroups, name, recipe: transfer.recipe })
+    const temp = await fs.mkdtemp(path.join(os.tmpdir(), 'openrod-cloud-transfer-'))
+    try {
+      const root = path.join(temp, 'workspace')
+      await fs.mkdir(root, { mode: 0o755 })
+      for (const file of transfer.files) {
+        const target = path.join(root, ...file.path.split('/'))
+        await fs.mkdir(path.dirname(target), { recursive: true, mode: 0o755 })
+        await fs.writeFile(target, file.content, { flag: 'wx', mode: file.executable ? 0o755 : 0o644 })
+      }
+      const template = transfer.recipe ? await (options.rebuild ?? rebuild)(transfer.recipe) : null
+      // Each handoff creates a separate copy, including a return to the computer
+      // where the original workspace still exists. Never replace that sandbox.
+      const sandbox = await options.createSandbox(template ? { name, imageTemplate: template, session: transfer.launch.session, groups } : { ...transfer.launch, name, groups })
+      await (options.waitReady ?? waitReady)(sandbox.name)
+      if (transfer.files.length) await (options.upload ?? upload)(sandbox.name, root)
+      return { name: sandbox.name, files: transfer.files.length, bytes: transfer.bytes, reconnectCredentials: true }
+    } finally { await fs.rm(temp, { recursive: true, force: true }) }
+  })
+}

package/server/compute.js

@@ -0,0 +1,50 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import { getApps } from 'firebase-admin/app'
+export async function createCompute(config) {
+ const project=config.firebase.projectId,zone=process.env.OPENROD_WORKER_ZONE??'us-east1-b',subnet=process.env.OPENROD_WORKER_SUBNET
+ const artifactOrigin=process.env.OPENROD_WORKER_ARTIFACT_ORIGIN,artifactHash=process.env.OPENROD_WORKER_ARTIFACT_SHA256
+ if(!/^[a-z0-9-]+$/.test(zone)||!subnet?.startsWith(`projects/${project}/regions/`)||!/^http:\/\/10\.80\.0\.\d{1,3}:8080$/.test(artifactOrigin??'')||!/^[a-f0-9]{64}$/.test(artifactHash??''))throw Error('Worker deployment configuration is incomplete')
+ const source=fs.readFileSync(path.resolve(import.meta.dirname,'../../deploy/gcp/worker-startup.sh'),'utf8')
+ const base=`https://compute.googleapis.com/compute/v1/projects/${project}/zones/${zone}`
+ async function request(method,url,body) {
+  const token=await getApps()[0].options.credential.getAccessToken()
+  const response=await fetch(url,{method,headers:{Authorization:`Bearer ${token.access_token}`,'Content-Type':'application/json'},body:body?JSON.stringify(body):undefined,signal:AbortSignal.timeout(30000)})
+  if(response.status===404)return null
+  const value=await response.json()
+  if(!response.ok || value.error){const e=Error(value.error?.message??value.error?.errors?.[0]?.message??'Compute request failed');e.code=response.status;throw e}
+  return value
+ }
+ return {get:name=>request('GET',`${base}/instances/${name}`),async create(record){
+  const settings=Buffer.from(JSON.stringify({key:record.key,uid:record.uid,origin:config.origin,artifactOrigin,artifactHash,name:record.name})).toString('base64')
+  const script=Buffer.from(source.replace('__OPENROD_WORKER_SETTINGS__',settings)).toString('base64')
+  const startup=`#!/usr/bin/env bash
+set -euo pipefail
+umask 077
+printf '%s' '${script}' | base64 -d > /usr/local/sbin/openrod-worker-bootstrap
+chmod 700 /usr/local/sbin/openrod-worker-bootstrap
+cat > /etc/systemd/system/openrod-worker-bootstrap.service <<'UNIT'
+[Unit]
+Description=OpenRod private worker bootstrap
+After=network-online.target
+Wants=network-online.target
+StartLimitIntervalSec=7200
+StartLimitBurst=5
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/openrod-worker-bootstrap
+Restart=on-failure
+RestartSec=30
+TimeoutStartSec=2400
+[Install]
+WantedBy=multi-user.target
+UNIT
+systemctl daemon-reload
+systemctl enable --now openrod-worker-bootstrap
+`
+  const body={name:record.name,machineType:`zones/${zone}/machineTypes/e2-standard-2`,labels:{application:'openrod',managed_by:'openrod-console',openrod_owner:record.name.slice(9)},tags:{items:['openrod-user-worker']},serviceAccounts:[],canIpForward:false,
+   disks:[{boot:true,autoDelete:true,initializeParams:{sourceImage:'projects/ubuntu-os-cloud/global/images/family/ubuntu-2404-lts-amd64',diskSizeGb:'30',diskType:`zones/${zone}/diskTypes/pd-balanced`}},{boot:false,autoDelete:false,deviceName:'openrod-state',initializeParams:{diskName:`${record.name}-state`,diskSizeGb:'100',diskType:`zones/${zone}/diskTypes/pd-balanced`}}],
+   networkInterfaces:[{subnetwork:subnet,stackType:'IPV4_ONLY'}],metadata:{items:[{key:'enable-oslogin',value:'TRUE'},{key:'block-project-ssh-keys',value:'TRUE'},{key:'disable-legacy-endpoints',value:'TRUE'},{key:'startup-script',value:startup}]},shieldedInstanceConfig:{enableSecureBoot:true,enableVtpm:true,enableIntegrityMonitoring:true}}
+  try{return await request('POST',`${base}/instances?requestId=${record.requestId}`,body)}catch(error){if(error.code!==409)throw error;return request('GET',`${base}/instances/${record.name}`)}
+ }}
+}

package/server/editor.js

@@ -0,0 +1,114 @@
+import os from 'node:os'
+import path from 'node:path'
+import { findExecutable, reasonFrom, runCli, runOpenShell, serializeCli } from './openshell-cli.js'
+import { gateway } from './gateway.js'
+import { agentAccessRules } from '../shared/agent-access.js'
+import { policyRoute } from './policy.js'
+import { OPENSHELL_CA_BUNDLE } from '../src/lib/image-templates.js'
+
+// "Open in Cursor / VS Code" runs the command the CLI documents for it,
+// `openshell sandbox connect <name> --editor <editor>`. OpenShell installs its
+// managed SSH config (one Include line in ~/.ssh/config plus a Host block in
+// ~/.config/openshell/ssh_config) and starts the editor's Remote-SSH session.
+// The console runs on the operator's machine, so the editor opens there.
+
+const EDITORS = {
+  cursor: { label: 'Cursor', binary: 'cursor', app: 'Cursor.app', remoteSsh: 'anysphere.remote-ssh' },
+  vscode: { label: 'VS Code', binary: 'code', app: 'Visual Studio Code.app', remoteSsh: 'ms-vscode-remote.remote-ssh' },
+}
+
+const NAME = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/
+const fail = (message, status = 400) => Object.assign(new Error(message), { status })
+// On macOS the editor's command lives inside the app bundle and is only on
+// PATH after "Install 'cursor' command in PATH", so look there too. The
+// bundle comes first: Cursor installs a `code` command of its own, so a bare
+// `code` on PATH can be Cursor, not VS Code.
+export function editorDirs(id, { home = os.homedir(), pathValue = process.env.PATH ?? '' } = {}) {
+  const { app } = EDITORS[id]
+  const bundles = ['/Applications', path.join(home, 'Applications')].map((root) => path.join(root, app, 'Contents/Resources/app/bin'))
+  return [...bundles, ...pathValue.split(path.delimiter).filter(Boolean)]
+}
+function editorBinary(id) {
+  return findExecutable(EDITORS[id].binary, editorDirs(id))
+}
+function listEditors() {
+  return Object.entries(EDITORS).map(([id, editor]) => ({ id, label: editor.label, installed: Boolean(editorBinary(id)) }))
+}
+
+// Neither editor ships its Remote - SSH extension. Without it the editor opens
+// and then fails with "No remote extension installed to resolve ssh-remote".
+export async function ensureRemoteSsh(binary, { label, remoteSsh }, env, run = runCli) {
+  const listed = await run(binary, ['--list-extensions'], { env, timeoutMs: 30_000 })
+  if (listed.code === 0 && listed.stdout.split('\n').some((line) => line.trim().toLowerCase() === remoteSsh)) return
+  const installed = await run(binary, ['--install-extension', remoteSsh], { env, timeoutMs: 120_000 })
+  if (installed.code !== 0 || installed.timedOut) throw fail(`${label} needs its Remote - SSH extension (${remoteSsh}). Install it from ${label}’s Extensions view, then try again.`, 502)
+}
+
+// VS Code's Remote - SSH downloads its server from inside the sandbox, which
+// sandboxes block by default. Make sure this sandbox has the reviewed
+// GET-only rule for VS Code's two download hosts before opening it, whichever
+// way the sandbox was created. Idempotent, so it costs one read once present.
+const VSCODE_RULE = 'tool-vscode-server'
+// The download needs curl or wget inside the sandbox; the editor's fallback of
+// sending the archive over scp does not work through OpenShell's SSH proxy, so
+// without either tool it waits forever. wget is tried first and ignores the CA
+// variables curl uses. The sandbox user cannot write /etc, so trust the CA in
+// ~/.wgetrc, and only where wget exists. Prints which downloaders exist.
+const prepareScript = `d=''
+command -v curl >/dev/null 2>&1 && d="$d curl"
+if command -v wget >/dev/null 2>&1; then
+  d="$d wget"
+  grep -qs '^[[:space:]]*ca_certificate' /etc/wgetrc "$HOME/.wgetrc" 2>/dev/null || printf 'ca_certificate = %s\\n' '${OPENSHELL_CA_BUNDLE}' >> "$HOME/.wgetrc"
+fi
+echo "downloaders:$d"`
+export async function ensureVscodeAccess(name, { policy = policyRoute, exec } = {}) {
+  // Best effort: if the sandbox can't be asked, let the editor try anyway.
+  const found = await Promise.resolve(exec?.(prepareScript)).then((out) => /downloaders:(.*)/.exec(String(out ?? ''))?.[1], () => undefined)
+  if (found !== undefined && !found.trim()) throw fail(`${name} has neither curl nor wget, which VS Code needs to install its server in the sandbox. Use an image that includes curl or wget, such as any template built in OpenRod.`, 409)
+  const view = await policy('GET', ['policy', name])
+  if (!(view?.effective?.rules ?? []).some((rule) => rule.name === VSCODE_RULE)) {
+    const [rule] = agentAccessRules({ source: 'build', agents: [], runtimes: ['vscode'] })
+    await policy('POST', ['policy', name, 'ops'], { ops: [{ kind: 'addRule', rule }] })
+  }
+}
+
+async function openEditor(name, input) {
+  const id = String(input?.editor ?? '')
+  if (!Object.hasOwn(EDITORS, id)) throw fail('Unknown editor.')
+  const { label } = EDITORS[id]
+  const binary = editorBinary(id)
+  if (!binary) throw fail(`${label} is not installed on this machine.`, 409)
+  const args = ['sandbox', 'connect', name, '--editor', id]
+  // The editor app can start from this process tree and inherit its
+  // environment, so change nothing unless the CLI can't find the editor.
+  const dir = path.dirname(binary)
+  const pathDirs = (process.env.PATH ?? '').split(path.delimiter).filter(Boolean)
+  const env = pathDirs.includes(dir) ? process.env : { ...process.env, PATH: [dir, process.env.PATH].filter(Boolean).join(path.delimiter) }
+  const { target, workspace } = await gateway()
+  // The editor only reports an unreachable sandbox as a generic SSH failure,
+  // so check the sandbox answers first and show the gateway's reason here.
+  const probe = await runOpenShell(['sandbox', 'exec', '-n', name, '--timeout', '15', '--no-tty', '--', 'true'], { gateway: target.name, workspace, timeoutMs: 20_000 })
+  if (probe.timedOut) throw fail(`${name} did not respond.`, 504)
+  if (probe.code !== 0) throw fail(reasonFrom(probe.stderr) || `${name} is not reachable.`, 409)
+  if (id === 'vscode') {
+    await ensureVscodeAccess(name, {
+      exec: async (script) => (await runOpenShell(['sandbox', 'exec', '-n', name, '--timeout', '15', '--no-tty', '--', 'sh', '-c', script], { gateway: target.name, workspace, timeoutMs: 20_000 })).stdout,
+    })
+  }
+  const result = await serializeCli(async () => {
+    await ensureRemoteSsh(binary, EDITORS[id], env)
+    return runOpenShell(args, { env, gateway: target.name, workspace })
+  })
+  if (result.timedOut) throw fail(`Opening ${label} timed out.`, 504)
+  if (result.outputExceeded) throw fail(`Opening ${label} produced too much output.`, 502)
+  if (result.code !== 0) throw fail(reasonFrom(result.stderr) || `Could not open ${label}.`, 502)
+  return { ok: true, editor: id }
+}
+
+export async function editorRoute(method, parts, input) {
+  if (method === 'GET' && parts.length === 1 && parts[0] === 'editors') return listEditors()
+  if (method === 'POST' && parts[0] === 'sandboxes' && parts.length === 3 && NAME.test(parts[1]) && parts[2] === 'editor') {
+    return openEditor(parts[1], input)
+  }
+  return undefined
+}

package/server/egress.js

@@ -0,0 +1,204 @@
+import fs from 'node:fs/promises'
+import path from 'node:path'
+import { randomUUID } from 'node:crypto'
+import { ruleToProto } from './policy.js'
+import { appliesTo, blockHosts } from '../src/lib/egress.js'
+import { policyDirectory } from './paths.js'
+
+export { appliesTo, blockHosts }
+
+const fail = (message, status = 400) => Object.assign(new Error(message), { status })
+
+// ---- egress policies ---------------------------------------------------------
+//
+// A policy is a name, some destinations, and an action: allow or block. It
+// applies to everyone, to groups, to named sandboxes, or to the sandboxes that
+// use an MCPs & Skills setup (server/setup-egress.js). Sandboxes start
+// locked down, so nothing leaves one until an allow policy covers it, and a
+// block (a block policy or the organization's blocked hosts) beats every allow.
+//
+// OpenShell has no host-level deny, so a block is an inspected endpoint whose
+// deny rules match every request. It answers HTTP with policy_denied and
+// refuses anything that is not HTTP. It has to cover every port the sandbox's
+// other rules open, or a blocked host would stay open on the others.
+//
+// Stored as JSON in policies/egress/<id>.json, reviewed like code.
+
+const directory = async () => path.join(await policyDirectory(), 'egress')
+const ID = /^[a-z0-9]([a-z0-9-]{0,38}[a-z0-9])?$/
+const HOST = /^(\*\*?\.)?[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/i
+const SANDBOX = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/
+const SETUP = /^[a-f0-9]{24}$/
+const BINARY = /^\/[\w.+@*?/[\]-]{1,255}$/
+const CIDR = /^[0-9a-f:.]+(\/\d{1,3})?$/i
+const REQUESTS = ['any', 'read-only', 'read-write', 'custom']
+const METHODS = ['GET', 'HEAD', 'OPTIONS', 'POST', 'PUT', 'PATCH', 'DELETE', '*']
+
+export const PREFIX = 'egress_'
+export const BLOCK_ALL = [{ method: '*', path: '/' }, { method: '*', path: '/**' }]
+export const DEFAULT_ADVANCED = { ports: [443, 80], programs: [], requests: 'any', allow: [], deny: [], enforcement: 'enforce', privateIps: [] }
+const WEB_PORTS = [443, 80]
+
+const list = (v) => (Array.isArray(v) ? v : [])
+const uniq = (items) => [...new Set(items)]
+
+function requestList(input, where) {
+  return list(input).map((r) => {
+    const method = String(r?.method ?? '').toUpperCase()
+    const p = String(r?.path ?? '').trim()
+    if (!METHODS.includes(method)) throw fail(`${where}: unsupported method "${r?.method}".`)
+    if (!p.startsWith('/') || p.length > 512) throw fail(`${where}: a path must start with "/".`)
+    return { method, path: p }
+  })
+}
+
+function validateAdvanced(input) {
+  const a = { ...DEFAULT_ADVANCED, ...(input ?? {}) }
+  const ports = uniq(list(a.ports).map(Number))
+  if (!ports.length || ports.some((p) => !Number.isInteger(p) || p < 1 || p > 65535)) throw fail('Ports must be 1–65535.')
+  const programs = uniq(list(a.programs).map((p) => String(p).trim()).filter(Boolean))
+  for (const p of programs) if (!BINARY.test(p)) throw fail(`"${p}" is not an absolute program path.`)
+  if (!REQUESTS.includes(a.requests)) throw fail('Unknown request setting.')
+  const allow = a.requests === 'custom' ? requestList(a.allow, 'Allowed request') : []
+  if (a.requests === 'custom' && !allow.length) throw fail('Add at least one allowed request, or allow any request.')
+  const deny = requestList(a.deny, 'Blocked request')
+  const privateIps = uniq(list(a.privateIps).map((ip) => String(ip).trim()).filter(Boolean))
+  for (const ip of privateIps) if (!CIDR.test(ip)) throw fail(`"${ip}" is not an IP or CIDR.`)
+  return { ports, programs, requests: a.requests, allow, deny, enforcement: a.enforcement === 'audit' ? 'audit' : 'enforce', privateIps }
+}
+
+export function validatePolicy(input) {
+  const name = String(input?.name ?? '').trim().slice(0, 80)
+  if (!name) throw fail('Give the rule a name.')
+  const id = String(input?.id ?? '').trim()
+  if (!ID.test(id)) throw fail('Rule ids use lowercase letters, digits and dashes (up to 40).')
+  const action = input?.action === 'block' ? 'block' : input?.action === 'allow' ? 'allow' : null
+  if (!action) throw fail('Choose allow or block.')
+  const destinations = hostList(input.destinations)
+  if (!destinations.length) throw fail('Add at least one destination.')
+  const to = input.appliesTo ?? {}
+  const appliesTo = {
+    everyone: Boolean(to.everyone),
+    groups: uniq(list(to.groups).map(String)),
+    sandboxes: uniq(list(to.sandboxes).map(String)),
+    setups: uniq(list(to.setups).map(String)),
+  }
+  for (const s of appliesTo.sandboxes) if (!SANDBOX.test(s)) throw fail(`"${s}" is not a sandbox name.`)
+  for (const s of appliesTo.setups) if (!SETUP.test(s)) throw fail(`"${s}" is not an MCPs & Skills setup.`)
+  const policy = { id, name, action, destinations, appliesTo }
+  if (action === 'allow') policy.advanced = validateAdvanced(input.advanced)
+  if (input.setup != null) policy.setup = setupMarker(input.setup)
+  return policy
+}
+
+function hostList(input) {
+  const hosts = uniq(list(input).map((h) => String(h).trim().toLowerCase().replace(/\.$/, '')).filter(Boolean))
+  if (hosts.length > 200) throw fail('Too many destinations. Split them into several rules.')
+  for (const h of hosts) {
+    if (h === '*' || h === '**') throw fail('"All destinations" needs OpenShell support that does not exist yet. List the hosts instead.')
+    if (!HOST.test(h)) throw fail(`"${h}" is not a host (wildcards: *.example.com or **.example.com).`)
+    if (/^\*\*?\./.test(h) && h.split('.').length < 3) throw fail(`"${h}" is too broad. OpenShell needs at least two labels after the wildcard.`)
+  }
+  return hosts
+}
+
+// The console keeps one allow policy per MCPs & Skills setup. The marker names
+// the setup and the hosts and ports it needs, so a recompute keeps the ones
+// people added.
+function setupMarker(input) {
+  const id = String(input?.id ?? '')
+  if (!SETUP.test(id)) throw fail('Unknown MCPs & Skills setup.')
+  const name = String(input.name ?? '').trim().slice(0, 80)
+  if (/[\x00-\x1f\x7f]/.test(name)) throw fail('The setup name has control characters.')
+  const ports = uniq(list(input.ports).map(Number))
+  if (ports.some((p) => !Number.isInteger(p) || p < 1 || p > 65535)) throw fail('Ports must be 1–65535.')
+  return { id, name, required: hostList(input.required), ports }
+}
+
+// ---- storage -----------------------------------------------------------------
+
+async function readJson(file) {
+  try { return JSON.parse(await fs.readFile(file, 'utf8')) } catch (error) { if (error.code === 'ENOENT') return null; throw error }
+}
+
+// `dir` is for tests.
+export async function listPolicies(dir) {
+  dir ??= await directory()
+  let files = []
+  try { files = (await fs.readdir(dir)).filter((f) => f.endsWith('.json')) } catch (error) { if (error.code !== 'ENOENT') throw error }
+  const policies = await Promise.all(files.map(async (f) => { try { return validatePolicy(await readJson(path.join(dir, f))) } catch { return null } }))
+  return policies.filter(Boolean).sort((a, b) => a.name.localeCompare(b.name))
+}
+
+export async function writePolicy(policy, dir) {
+  dir ??= await directory()
+  await fs.mkdir(dir, { recursive: true })
+  const file = path.join(dir, `${policy.id}.json`), temporary = `${file}.${randomUUID()}.tmp`
+  try {
+    await fs.writeFile(temporary, `${JSON.stringify(policy, null, 2)}\n`, { flag: 'wx', mode: 0o600 })
+    await fs.rename(temporary, file)
+  } finally { await fs.rm(temporary, { force: true }) }
+}
+
+export async function removePolicy(id, dir) {
+  if (!ID.test(String(id))) throw fail('Unknown rule.')
+  dir ??= await directory()
+  await fs.rm(path.join(dir, `${id}.json`), { force: true })
+}
+
+// ---- compile -----------------------------------------------------------------
+
+function allowSpec(policy) {
+  const a = policy.advanced
+  // "Any request" with nothing blocked needs no inspection at all.
+  const inspect = a.requests !== 'any' || a.deny.length > 0
+  return {
+    name: PREFIX + policy.id,
+    binaries: a.programs.length ? a.programs : ['/**'],
+    endpoints: policy.destinations.map((host) => ({
+      host,
+      ports: a.ports,
+      protocol: inspect ? 'rest' : 'tcp',
+      access: !inspect ? null : a.requests === 'any' ? 'full' : a.requests === 'custom' ? null : a.requests,
+      allow: a.requests === 'custom' ? a.allow : [],
+      deny: inspect ? a.deny : [],
+      enforcement: a.enforcement,
+      allowedIps: a.privateIps,
+    })),
+  }
+}
+
+function blockSpec(name, hosts, ports) {
+  return {
+    name,
+    binaries: ['/**'],
+    endpoints: uniq(hosts.flatMap(blockHosts)).map((host) => ({ host, ports, protocol: 'rest', access: 'full', deny: BLOCK_ALL, enforcement: 'enforce' })),
+  }
+}
+
+// The console-owned rules for one sandbox, keyed by policy name: every allow
+// and block policy that applies to it, plus the organization's blocked hosts.
+// `openPorts` are the ports the sandbox's other rules (template, one-off,
+// provider) open, so a block covers those as well as the allows' ports.
+export function compileFor(sandbox, policies, orgBlocked = [], openPorts = []) {
+  const mine = policies.filter((p) => appliesTo(p, sandbox))
+  const allows = mine.filter((p) => p.action === 'allow')
+  const ports = uniq([...WEB_PORTS, ...allows.flatMap((p) => p.advanced.ports), ...openPorts.map(Number)]).sort((a, b) => a - b)
+  const specs = [
+    ...allows.map(allowSpec),
+    ...mine.filter((p) => p.action === 'block').map((p) => blockSpec(PREFIX + p.id, p.destinations, ports)),
+    ...(orgBlocked.length ? [blockSpec('org_blocked', orgBlocked, ports)] : []),
+  ]
+  const out = {}
+  for (const spec of specs) { const { rule } = ruleToProto(spec); out[spec.name] = { ...rule, name: spec.name } }
+  return out
+}
+
+// A request is settled by a block policy when one of its hosts is covered.
+export function blockedByPolicy(policies, sandbox, hosts, matches) {
+  for (const p of policies) {
+    if (p.action !== 'block' || !appliesTo(p, sandbox)) continue
+    for (const host of hosts) if (p.destinations.flatMap(blockHosts).some((d) => matches(d, host))) return { host, policy: p }
+  }
+  return null
+}