voratiq 0.1.0-beta.2 → 0.1.0-beta.21

package/dist/agents/runtime/policy.js

@@ -0,0 +1,240 @@
+import { isAbsolute, relative, resolve as resolveAbsolute } from "node:path";
+import { resolveWorkspacePath, VORATIQ_AGENTS_FILE, VORATIQ_ENVIRONMENT_FILE, VORATIQ_HISTORY_LOCK_FILENAME, VORATIQ_ORCHESTRATION_FILE, VORATIQ_REDUCTION_DIR, VORATIQ_RUN_DIR, VORATIQ_RUN_FILE, VORATIQ_SANDBOX_FILE, VORATIQ_SPEC_DIR, VORATIQ_VERIFICATION_DIR, } from "../../workspace/structure.js";
+export function buildSandboxPolicy(input) {
+    const { stageId, root, workspacePath, sandboxHomePath, sandboxSettingsPath, runtimePath, artifactsPath, repoRootPath, providerFilesystem, providerNetwork, policyOverrides, stageDenyWritePaths = [], stageDenyReadPaths = [], } = input;
+    const baseline = buildBaselineFilesystemPolicy({
+        root,
+        stageId,
+    });
+    const providerResolved = resolveFilesystemPaths(providerFilesystem, workspacePath);
+    const overridesResolved = resolveFilesystemOverrides(policyOverrides, workspacePath);
+    const stageResolved = {
+        allowWrite: [],
+        denyRead: resolvePaths(stageDenyReadPaths, workspacePath),
+        denyWrite: resolvePaths(stageDenyWritePaths, workspacePath),
+    };
+    // Keep denyRead/denyWrite symmetric by default. Runtime metadata stays
+    // write-protected via allowWrite blockers to keep the shim boot path readable.
+    const runtimeDenyPaths = [artifactsPath];
+    const denyReadRaw = [
+        ...baseline.denyRead,
+        ...stageResolved.denyRead,
+        ...providerResolved.denyRead,
+        ...runtimeDenyPaths,
+        ...overridesResolved.denyRead,
+    ];
+    const denyWriteRaw = [
+        ...baseline.denyWrite,
+        ...stageResolved.denyWrite,
+        ...providerResolved.denyWrite,
+        ...runtimeDenyPaths,
+        ...overridesResolved.denyWrite,
+    ];
+    const allowWriteRaw = [
+        ...providerResolved.allowWrite,
+        ...stageResolved.allowWrite,
+        ...overridesResolved.allowWrite,
+        sandboxHomePath,
+        workspacePath,
+    ];
+    const normalizedRepoRootPath = repoRootPath
+        ? normalizeAbsolutePath(repoRootPath, workspacePath)
+        : undefined;
+    const allowWriteBlockers = normalizePaths({
+        entries: [sandboxSettingsPath, runtimePath, artifactsPath, ...denyWriteRaw],
+        workspacePath,
+        collapseChildren: true,
+    });
+    const allowWriteFiltered = allowWriteRaw.filter((entry) => {
+        const normalized = normalizeAbsolutePath(entry, workspacePath);
+        if (normalizedRepoRootPath && normalized === normalizedRepoRootPath) {
+            return false;
+        }
+        return !allowWriteBlockers.some((blocked) => isParentOrSamePath(blocked, normalized));
+    });
+    const filesystem = normalizeFilesystemPolicy({
+        workspacePath,
+        filesystem: {
+            denyRead: denyReadRaw,
+            allowWrite: allowWriteFiltered,
+            denyWrite: denyWriteRaw,
+        },
+    });
+    const network = normalizeNetworkPolicy({
+        workspacePath,
+        network: providerNetwork,
+    });
+    return { filesystem, network };
+}
+export function normalizeFilesystemPolicy(input) {
+    const { workspacePath, filesystem } = input;
+    return {
+        denyRead: normalizePaths({
+            entries: filesystem.denyRead,
+            workspacePath,
+            collapseChildren: true,
+        }),
+        allowWrite: normalizePaths({
+            entries: filesystem.allowWrite,
+            workspacePath,
+            collapseChildren: false,
+        }),
+        denyWrite: normalizePaths({
+            entries: filesystem.denyWrite,
+            workspacePath,
+            collapseChildren: true,
+        }),
+    };
+}
+export function normalizeNetworkPolicy(input) {
+    const { workspacePath, network } = input;
+    const allowUnixSockets = network.allowUnixSockets
+        ? normalizePaths({
+            entries: network.allowUnixSockets,
+            workspacePath,
+            collapseChildren: false,
+        })
+        : undefined;
+    return {
+        allowedDomains: normalizeStrings(network.allowedDomains),
+        deniedDomains: normalizeStrings(network.deniedDomains),
+        allowLocalBinding: network.allowLocalBinding === true,
+        ...(allowUnixSockets && allowUnixSockets.length > 0
+            ? { allowUnixSockets }
+            : {}),
+        ...(network.allowAllUnixSockets === true
+            ? { allowAllUnixSockets: true }
+            : {}),
+    };
+}
+function buildBaselineFilesystemPolicy(options) {
+    const { root, stageId } = options;
+    const commonSensitivePaths = [
+        resolveWorkspacePath(root, VORATIQ_AGENTS_FILE),
+        resolveWorkspacePath(root, VORATIQ_ENVIRONMENT_FILE),
+        resolveWorkspacePath(root, VORATIQ_ORCHESTRATION_FILE),
+        resolveWorkspacePath(root, VORATIQ_SANDBOX_FILE),
+    ];
+    const stageRoots = resolveStageRoots(stageId, root);
+    // Default deny rules stay symmetric; read-only divergences are explicit.
+    const symmetricDeny = [...commonSensitivePaths, ...stageRoots.symmetric];
+    return {
+        allowWrite: [],
+        denyRead: [...symmetricDeny, ...stageRoots.readOnly],
+        denyWrite: [...symmetricDeny],
+    };
+}
+function resolveStageRoots(stageId, root) {
+    if (stageId === "run") {
+        return {
+            symmetric: [
+                resolveAbsolute(root, ".git"),
+                resolveWorkspacePath(root, VORATIQ_RUN_FILE),
+                resolveWorkspacePath(root, VORATIQ_RUN_DIR, VORATIQ_HISTORY_LOCK_FILENAME),
+                resolveWorkspacePath(root, VORATIQ_VERIFICATION_DIR),
+            ],
+            readOnly: [],
+        };
+    }
+    if (stageId === "spec") {
+        return {
+            symmetric: [
+                resolveWorkspacePath(root, VORATIQ_RUN_DIR),
+                resolveWorkspacePath(root, VORATIQ_VERIFICATION_DIR),
+                resolveWorkspacePath(root, VORATIQ_REDUCTION_DIR),
+            ],
+            readOnly: [],
+        };
+    }
+    if (stageId === "verify") {
+        return {
+            symmetric: [
+                resolveWorkspacePath(root, VORATIQ_RUN_DIR),
+                resolveWorkspacePath(root, VORATIQ_SPEC_DIR),
+                resolveWorkspacePath(root, VORATIQ_REDUCTION_DIR),
+            ],
+            // Verification agents should never inspect repository metadata during
+            // blinded review.
+            readOnly: [resolveAbsolute(root, ".git")],
+        };
+    }
+    return {
+        symmetric: [
+            resolveWorkspacePath(root, VORATIQ_RUN_DIR),
+            resolveWorkspacePath(root, VORATIQ_SPEC_DIR),
+        ],
+        readOnly: [resolveAbsolute(root, ".git")],
+    };
+}
+function resolveFilesystemOverrides(overrides, workspacePath) {
+    return {
+        allowWrite: resolvePaths(overrides?.allowWrite ?? [], workspacePath),
+        denyRead: resolvePaths(overrides?.denyRead ?? [], workspacePath),
+        denyWrite: resolvePaths(overrides?.denyWrite ?? [], workspacePath),
+    };
+}
+function resolveFilesystemPaths(filesystem, workspacePath) {
+    return {
+        allowWrite: resolvePaths(filesystem.allowWrite, workspacePath),
+        denyRead: resolvePaths(filesystem.denyRead, workspacePath),
+        denyWrite: resolvePaths(filesystem.denyWrite, workspacePath),
+    };
+}
+function resolvePaths(entries, workspacePath) {
+    return entries.map((entry) => normalizeAbsolutePath(entry, workspacePath));
+}
+function normalizeAbsolutePath(entry, workspacePath) {
+    if (isAbsolute(entry)) {
+        return resolveAbsolute(entry);
+    }
+    return resolveAbsolute(workspacePath, entry);
+}
+function normalizePaths(options) {
+    const { entries, workspacePath, collapseChildren } = options;
+    const canonical = entries.map((entry) => normalizeAbsolutePath(entry, workspacePath));
+    const deduped = dedupeAndSortPaths(canonical);
+    if (!collapseChildren) {
+        return deduped;
+    }
+    return collapseChildPaths(deduped);
+}
+function dedupeAndSortPaths(paths) {
+    const deduped = Array.from(new Set(paths));
+    deduped.sort(compareCanonicalPaths);
+    return deduped;
+}
+function compareCanonicalPaths(left, right) {
+    const depthDelta = countSegments(left) - countSegments(right);
+    if (depthDelta !== 0) {
+        return depthDelta;
+    }
+    return left.localeCompare(right);
+}
+function countSegments(value) {
+    return value.split(/[\\/]+/u).filter(Boolean).length;
+}
+function collapseChildPaths(paths) {
+    const collapsed = [];
+    for (const candidate of paths) {
+        if (collapsed.some((parent) => isParentOrSamePath(parent, candidate))) {
+            continue;
+        }
+        collapsed.push(candidate);
+    }
+    return collapsed;
+}
+function isParentOrSamePath(parent, candidate) {
+    const rel = relative(parent, candidate);
+    if (rel === "" || rel === ".") {
+        return true;
+    }
+    if (rel.startsWith("..")) {
+        return false;
+    }
+    return !isAbsolute(rel);
+}
+function normalizeStrings(entries) {
+    const deduped = Array.from(new Set(entries));
+    deduped.sort((left, right) => left.localeCompare(right));
+    return deduped;
+}

package/dist/agents/runtime/registry.d.ts

@@ -0,0 +1,4 @@
+import type { StagedAuthContext } from "./auth.js";
+export declare function registerStagedAuthContext(sessionId: string, context: StagedAuthContext): void;
+export declare function teardownRegisteredAuthContext(sessionId: string, context: StagedAuthContext | undefined): Promise<void>;
+export declare function teardownSessionAuth(sessionId: string | undefined): Promise<void>;

package/dist/agents/runtime/registry.js

@@ -0,0 +1,54 @@
+import { teardownAuthContext } from "./auth.js";
+const registry = new Map();
+export function registerStagedAuthContext(sessionId, context) {
+    const existing = registry.get(sessionId);
+    if (existing) {
+        existing.add(context);
+        return;
+    }
+    registry.set(sessionId, new Set([context]));
+}
+export async function teardownRegisteredAuthContext(sessionId, context) {
+    if (!context) {
+        return;
+    }
+    await teardownAuthContext(context);
+    removeContext(sessionId, context);
+}
+export async function teardownSessionAuth(sessionId) {
+    if (!sessionId) {
+        return;
+    }
+    const contexts = registry.get(sessionId);
+    if (!contexts || contexts.size === 0) {
+        registry.delete(sessionId);
+        return;
+    }
+    const failures = [];
+    const stagedContexts = Array.from(contexts);
+    for (const context of stagedContexts) {
+        try {
+            await teardownAuthContext(context);
+            removeContext(sessionId, context);
+        }
+        catch (error) {
+            failures.push(error);
+        }
+    }
+    if (failures.length === 1) {
+        throw failures[0];
+    }
+    if (failures.length > 1) {
+        throw new AggregateError(failures, `Failed to teardown ${failures.length} auth contexts for session ${sessionId}`);
+    }
+}
+function removeContext(sessionId, context) {
+    const contexts = registry.get(sessionId);
+    if (!contexts) {
+        return;
+    }
+    contexts.delete(context);
+    if (contexts.size === 0) {
+        registry.delete(sessionId);
+    }
+}

package/dist/{commands/run → agents/runtime}/sandbox.d.ts

@@ -1,5 +1,7 @@
 import type { SandboxRuntimeConfig } from "@voratiq/sandbox-runtime";
 import type { DenialBackoffConfig } from "../../configs/sandbox/types.js";
+import { type SandboxStageId } from "./policy.js";
+import type { SandboxPolicyOverrides } from "./types.js";
 export type SandboxSettings = SandboxRuntimeConfig;
 export type DenialOperationType = "network-connect" | "file-read" | "file-write";
 export interface SandboxFailFastInfo {
@@ -8,14 +10,18 @@ export interface SandboxFailFastInfo {
 }
 export declare const DEFAULT_DENIAL_BACKOFF: DenialBackoffConfig;
 export interface SandboxSettingsOptions {
+    stageId?: SandboxStageId;
     sandboxHomePath: string;
     workspacePath: string;
-    provider: string;
+    providerId: string;
     root: string;
+    repoRootPath?: string;
     sandboxSettingsPath: string;
     runtimePath: string;
     artifactsPath: string;
-    evalsPath: string;
+    policyOverrides?: SandboxPolicyOverrides;
+    extraWriteProtectedPaths?: readonly string[];
+    extraReadProtectedPaths?: readonly string[];
 }
 export declare function generateSandboxSettings(options: SandboxSettingsOptions): SandboxSettings;
 export declare function resolveDenialBackoffConfig(config: DenialBackoffConfig | undefined): DenialBackoffConfig;

package/dist/{commands/run → agents/runtime}/sandbox.js

@@ -1,7 +1,8 @@
 import { mkdir, writeFile } from "node:fs/promises";
-import { dirname, isAbsolute } from "node:path";
+import { dirname } from "node:path";
 import { loadSandboxProviderConfig } from "../../configs/sandbox/loader.js";
 import { resolvePath } from "../../utils/path.js";
+import { buildSandboxPolicy } from "./policy.js";
 export const DEFAULT_DENIAL_BACKOFF = {
     enabled: true,
     warningThreshold: 2,
@@ -11,41 +12,40 @@ export const DEFAULT_DENIAL_BACKOFF = {
     windowMs: 120000,
 };
 export function generateSandboxSettings(options) {
-    const { sandboxHomePath, workspacePath, provider, root, sandboxSettingsPath, runtimePath, artifactsPath, evalsPath, } = options;
+    const { stageId = "run", sandboxHomePath, workspacePath, providerId, root, repoRootPath, sandboxSettingsPath, runtimePath, artifactsPath, policyOverrides, extraWriteProtectedPaths = [], extraReadProtectedPaths = [], } = options;
     const providerConfig = loadSandboxProviderConfig({
         root,
-        providerId: provider,
+        providerId,
+    });
+    const { filesystem, network } = buildSandboxPolicy({
+        stageId,
+        root,
+        workspacePath,
+        sandboxHomePath,
+        sandboxSettingsPath,
+        runtimePath,
+        artifactsPath,
+        repoRootPath,
+        providerFilesystem: providerConfig.filesystem,
+        providerNetwork: providerConfig.network,
+        policyOverrides,
+        stageDenyWritePaths: extraWriteProtectedPaths,
+        stageDenyReadPaths: extraReadProtectedPaths,
     });
-    const { network: networkSettings, filesystem } = providerConfig;
-    const resolvedFilesystem = resolveFilesystemPaths(filesystem, workspacePath);
-    const runtimeWriteProtectedPaths = [runtimePath, artifactsPath, evalsPath];
-    const runtimeReadProtectedPaths = [artifactsPath, evalsPath];
-    const allowWrite = buildAllowWriteSet(resolvedFilesystem, sandboxHomePath, workspacePath, [sandboxSettingsPath, ...runtimeWriteProtectedPaths]);
-    const denyRead = dedupePaths([
-        ...resolvedFilesystem.denyRead,
-        ...runtimeReadProtectedPaths,
-    ]);
-    const denyWrite = dedupePaths([
-        ...resolvedFilesystem.denyWrite,
-        ...runtimeWriteProtectedPaths,
-    ]);
     return {
         network: {
-            allowedDomains: [...networkSettings.allowedDomains],
-            deniedDomains: [...networkSettings.deniedDomains],
-            ...(networkSettings.allowLocalBinding ? { allowLocalBinding: true } : {}),
-            ...(networkSettings.allowUnixSockets &&
-                networkSettings.allowUnixSockets.length > 0
-                ? { allowUnixSockets: [...networkSettings.allowUnixSockets] }
-                : {}),
-            ...(networkSettings.allowAllUnixSockets
-                ? { allowAllUnixSockets: true }
+            allowedDomains: [...network.allowedDomains],
+            deniedDomains: [...network.deniedDomains],
+            ...(network.allowLocalBinding ? { allowLocalBinding: true } : {}),
+            ...(network.allowUnixSockets && network.allowUnixSockets.length > 0
+                ? { allowUnixSockets: [...network.allowUnixSockets] }
                 : {}),
+            ...(network.allowAllUnixSockets ? { allowAllUnixSockets: true } : {}),
         },
         filesystem: {
-            denyRead,
-            allowWrite: Array.from(allowWrite),
-            denyWrite,
+            denyRead: [...filesystem.denyRead],
+            allowWrite: [...filesystem.allowWrite],
+            denyWrite: [...filesystem.denyWrite],
         },
     };
 }
@@ -150,45 +150,6 @@ function countWithinMs(timestamps, now, windowMs) {
     }
     return count;
 }
-function getDefaultSandboxWritePaths() {
-    return [];
-}
-function buildAllowWriteSet(filesystem, sandboxHomePath, workspacePath, blockedPaths) {
-    const allowWrite = new Set([
-        // Auth providers copy credentials/configs into the sandbox directory;
-        // we only need to allow writes within the sandbox plus the runtime defaults.
-        ...getDefaultSandboxWritePaths(),
-        ...filesystem.allowWrite,
-    ]);
-    allowWrite.add(sandboxHomePath);
-    allowWrite.add(workspacePath);
-    for (const blockedPath of blockedPaths) {
-        allowWrite.delete(blockedPath);
-    }
-    return allowWrite;
-}
-function dedupePaths(paths) {
-    const seen = new Set();
-    const result = [];
-    for (const path of paths) {
-        if (seen.has(path)) {
-            continue;
-        }
-        seen.add(path);
-        result.push(path);
-    }
-    return result;
-}
-function resolveFilesystemPaths(filesystem, workspacePath) {
-    return {
-        allowWrite: resolvePaths(filesystem.allowWrite, workspacePath),
-        denyRead: resolvePaths(filesystem.denyRead, workspacePath),
-        denyWrite: resolvePaths(filesystem.denyWrite, workspacePath),
-    };
-}
-function resolvePaths(entries, workspacePath) {
-    return entries.map((entry) => isAbsolute(entry) ? entry : resolvePath(workspacePath, entry));
-}
 export async function writeSandboxSettings(sandboxSettingsPath, settings) {
     await mkdir(dirname(sandboxSettingsPath), { recursive: true });
     const settingsJson = `${JSON.stringify(settings, null, 2)}\n`;

package/dist/agents/runtime/shim/run-agent-shim.d.ts

@@ -0,0 +1 @@
+export declare function main(argv?: string[]): Promise<number>;