windows-development-sandbox 1.5.0 → 1.7.0

package/dist/shared/vpn/kill-switch.js

@@ -0,0 +1,81 @@
+// The kill switch as netsh argument lists (pure, so it is tested without a firewall). Phase 1 runs BEFORE the tunnel
+// starts: everything that goes out is blocked except loopback, the VPN servers themselves, DHCP and the host's attach
+// channel. Phase 2 runs once the tunnel is up: traffic from the tunnel's own address is allowed, which is everything
+// that goes through the tunnel (DNS included). Windows keeps the block rules for private ranges
+// (network.blockPrivateRanges) on top of this: a block rule always beats an allow rule.
+import { isIPv4 } from '../network/firewall-rules.js';
+export const VPN_RULE_PREFIX = 'AgentSandbox-VPN-';
+const rule = (name, extra) => [
+    'advfirewall',
+    'firewall',
+    'add',
+    'rule',
+    'name=' + VPN_RULE_PREFIX + name,
+    'dir=out',
+    'action=allow',
+    'enable=yes',
+    'profile=any',
+    ...extra,
+];
+const drop = (name) => [
+    'advfirewall',
+    'firewall',
+    'delete',
+    'rule',
+    'name=' + VPN_RULE_PREFIX + name,
+];
+/** The rule names phase 1 and 2 may create (the servers get a number each). */
+export function ruleNames(serverCount) {
+    return [
+        'Loopback',
+        'DHCP',
+        'Host',
+        'Tunnel',
+        ...Array.from({ length: Math.max(serverCount, 0) }, (_v, i) => 'Server-' + (i + 1)),
+    ];
+}
+/** Servers worth a rule: valid IPv4 addresses and ports, each endpoint once. */
+export function cleanServers(servers) {
+    const seen = new Set();
+    return servers.filter((s) => {
+        const key = s.proto + ':' + s.ip + ':' + s.port;
+        if (!isIPv4(s.ip) || !Number.isInteger(s.port) || s.port < 1 || s.port > 65535 || seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+/** Phase 1: block everything that goes out, then allow only what the tunnel and the attach channel need. */
+export function killSwitchCommands(servers, ptyHostExe) {
+    const list = cleanServers(servers);
+    return [
+        ...ruleNames(Math.max(list.length, 8)).map(drop),
+        ['advfirewall', 'set', 'allprofiles', 'state', 'on'],
+        ['advfirewall', 'set', 'allprofiles', 'firewallpolicy', 'blockinbound,blockoutbound'],
+        rule('Loopback', ['protocol=any', 'remoteip=127.0.0.0/8']),
+        rule('DHCP', ['protocol=udp', 'localport=68', 'remoteport=67']),
+        ...(ptyHostExe ? [rule('Host', ['protocol=any', 'remoteip=LocalSubnet', 'program=' + ptyHostExe])] : []),
+        ...list.map((s, i) => rule('Server-' + (i + 1), ['protocol=' + s.proto, 'remoteip=' + s.ip, 'remoteport=' + s.port])),
+    ];
+}
+/** Phase 2: everything that leaves from the tunnel's own address goes (it is inside the tunnel). */
+export function tunnelCommands(tunnelIp) {
+    if (!isIPv4(tunnelIp))
+        throw new Error('Not an IPv4 address: ' + tunnelIp);
+    return [drop('Tunnel'), rule('Tunnel', ['protocol=any', 'localip=' + tunnelIp])];
+}
+/** Takes the kill switch away again: its rules go and outbound traffic is allowed by default as before. */
+export function removeKillSwitchCommands() {
+    return [
+        ...ruleNames(64).map(drop),
+        ['advfirewall', 'set', 'allprofiles', 'firewallpolicy', 'blockinbound,allowoutbound'],
+    ];
+}
+/** The tunnel's own IPv4 address from OpenVPN's log (its "net_addr_v4_add" or "ifconfig" line), or null. */
+export function tunnelAddressFromLog(log) {
+    const add = /net_addr_v4_add:\s*(\d{1,3}(?:\.\d{1,3}){3})\/\d+/.exec(log);
+    if (add && isIPv4(add[1]))
+        return add[1];
+    const ifconfig = /(?:ifconfig|ip addr add|Notified TAP-Windows driver to set a DHCP IP\/netmask of)\s+(\d{1,3}(?:\.\d{1,3}){3})/i.exec(log);
+    return ifconfig && isIPv4(ifconfig[1]) ? ifconfig[1] : null;
+}

package/dist/shared/vpn/ovpn.d.ts

@@ -0,0 +1,23 @@
+/** Directives that run a program, load code or touch a file on this machine. Refused with a clear reason. */
+export declare const PROGRAM_DIRECTIVES: readonly ["script-security", "up", "down", "up-restart", "down-pre", "route-up", "route-pre-down", "ipchange", "tls-verify", "plugin", "client-connect", "client-disconnect", "learn-address", "auth-user-pass-verify", "setenv-safe", "management", "management-client", "management-client-auth", "management-hold", "management-query-passwords", "config", "daemon", "service", "cd", "chroot", "setcon", "log", "log-append", "writepid", "status", "askpass", "engine", "bcast-dev", "dev-node", "cryptoapicert", "pkcs11-providers", "pkcs12", "http-proxy-user-pass", "tmp-dir"];
+export declare const MAX_OVPN_BYTES: number;
+/** Where the tunnel connects. `host` is an IPv4 address or a name. */
+export interface OvpnRemote {
+    readonly host: string;
+    readonly port: number;
+    readonly proto: 'udp' | 'tcp';
+}
+export type OvpnReport = {
+    readonly ok: true;
+    readonly remotes: readonly OvpnRemote[];
+} | {
+    readonly ok: false;
+    readonly problems: readonly string[];
+};
+/**
+ * Checks a profile. `ok: false` lists the problems; `ok: true` gives the servers it connects to. A profile must name at
+ * least one remote, and every certificate must be inside it.
+ */
+export declare function inspectOvpn(text: string): OvpnReport;
+/** The servers of a safe profile; throws, saying why, when it is not (`what` names the file or source). */
+export declare function assertSafeOvpn(text: string, what: string): readonly OvpnRemote[];

package/dist/shared/vpn/ovpn.js

@@ -0,0 +1,244 @@
+// An OpenVPN profile (.ovpn) is untrusted data: it comes from the internet or from a file you were given, and OpenVPN
+// can run programs from it (script-security, up, down, plugin ...) with administrator rights. Only directives on a
+// short list of harmless ones are accepted; anything else is refused by name. Also answers where the tunnel connects
+// (the `remote` lines), which the kill switch needs. Pure: no files, no network.
+/** Directives that run a program, load code or touch a file on this machine. Refused with a clear reason. */
+export const PROGRAM_DIRECTIVES = [
+    'script-security',
+    'up',
+    'down',
+    'up-restart',
+    'down-pre',
+    'route-up',
+    'route-pre-down',
+    'ipchange',
+    'tls-verify',
+    'plugin',
+    'client-connect',
+    'client-disconnect',
+    'learn-address',
+    'auth-user-pass-verify',
+    'setenv-safe',
+    'management',
+    'management-client',
+    'management-client-auth',
+    'management-hold',
+    'management-query-passwords',
+    'config',
+    'daemon',
+    'service',
+    'cd',
+    'chroot',
+    'setcon',
+    'log',
+    'log-append',
+    'writepid',
+    'status',
+    'askpass',
+    'engine',
+    'bcast-dev',
+    'dev-node',
+    'cryptoapicert',
+    'pkcs11-providers',
+    'pkcs12',
+    'http-proxy-user-pass',
+    'tmp-dir',
+];
+/** Directives that are only settings of the tunnel. Everything else is refused. */
+const ALLOWED = new Set([
+    'client',
+    'tls-client',
+    'dev',
+    'dev-type',
+    'proto',
+    'remote',
+    'remote-random',
+    'remote-random-hostname',
+    'resolv-retry',
+    'nobind',
+    'persist-key',
+    'persist-tun',
+    'remote-cert-tls',
+    'remote-cert-eku',
+    'ns-cert-type',
+    'verify-x509-name',
+    'cipher',
+    'data-ciphers',
+    'data-ciphers-fallback',
+    'ncp-ciphers',
+    'auth',
+    'verb',
+    'mute',
+    'mute-replay-warnings',
+    'reneg-sec',
+    'reneg-bytes',
+    'reneg-pkts',
+    'tun-mtu',
+    'tun-mtu-extra',
+    'ping-timer-rem',
+    'fast-io',
+    'tls-timeout',
+    'push-peer-info',
+    'comp-noadapt',
+    'link-mtu',
+    'fragment',
+    'mssfix',
+    'sndbuf',
+    'rcvbuf',
+    'comp-lzo',
+    'compress',
+    'allow-compression',
+    'key-direction',
+    'auth-user-pass',
+    'auth-nocache',
+    'explicit-exit-notify',
+    'pull',
+    'pull-filter',
+    'route-nopull',
+    'route',
+    'route-ipv6',
+    'route-delay',
+    'route-metric',
+    'redirect-gateway',
+    'redirect-private',
+    'dhcp-option',
+    'block-outside-dns',
+    'register-dns',
+    'topology',
+    'tls-version-min',
+    'tls-version-max',
+    'tls-cipher',
+    'tls-ciphersuites',
+    'tls-groups',
+    'tls-exit',
+    'ping',
+    'ping-restart',
+    'ping-exit',
+    'keepalive',
+    'connect-retry',
+    'connect-retry-max',
+    'connect-timeout',
+    'server-poll-timeout',
+    'float',
+    'ifconfig-nowarn',
+    'tun-ipv6',
+    'disable-dco',
+    'windows-driver',
+    'ignore-unknown-option',
+    'opt-verify',
+    'setenv',
+    'key-method',
+    'replay-window',
+    'hand-window',
+    'tran-window',
+    'inactive',
+    'socket-flags',
+    'auth-retry',
+    'ca',
+    'cert',
+    'key',
+    'tls-auth',
+    'tls-crypt',
+    'tls-crypt-v2',
+    'extra-certs',
+    'dh',
+]);
+/** Directives that name a file: only allowed as inline sections (the certificates must be inside the profile). */
+const FILE_DIRECTIVES = new Set(['ca', 'cert', 'key', 'tls-auth', 'tls-crypt', 'tls-crypt-v2', 'extra-certs', 'dh']);
+/** The inline sections (<ca> ... </ca>); their text is data, never parsed as directives. */
+const BLOCKS = new Set(['ca', 'cert', 'key', 'tls-auth', 'tls-crypt', 'tls-crypt-v2', 'extra-certs', 'dh']);
+export const MAX_OVPN_BYTES = 256 * 1024;
+const MAX_LINES = 4000;
+const HOST = /^(?:\d{1,3}(?:\.\d{1,3}){3}|[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?)$/;
+function directiveOf(line) {
+    const text = line.replace(/^\uFEFF/, '').trim();
+    if (text === '' || text.startsWith('#') || text.startsWith(';'))
+        return null;
+    // OpenVPN accepts "--client" too.
+    const parts = text.replace(/^-+/, '').split(/\s+/);
+    return { name: parts[0].toLowerCase(), args: parts.slice(1) };
+}
+/**
+ * Checks a profile. `ok: false` lists the problems; `ok: true` gives the servers it connects to. A profile must name at
+ * least one remote, and every certificate must be inside it.
+ */
+export function inspectOvpn(text) {
+    const problems = [];
+    const found = [];
+    const refuse = (message) => {
+        if (problems.length < 20 && !problems.includes(message))
+            problems.push(message);
+    };
+    if (Buffer.byteLength(text, 'utf8') > MAX_OVPN_BYTES)
+        return { ok: false, problems: ['the file is too big'] };
+    if (text.includes('\0'))
+        return { ok: false, problems: ['the file is not text'] };
+    const lines = text.split(/\r?\n/);
+    if (lines.length > MAX_LINES)
+        return { ok: false, problems: ['the file has too many lines'] };
+    let block = null;
+    let defaultProto = 'udp';
+    lines.forEach((line, i) => {
+        const at = 'line ' + (i + 1) + ': ';
+        const trimmed = line.trim();
+        if (block) {
+            if (trimmed.toLowerCase() === '</' + block + '>')
+                block = null;
+            else if (/^<\/?[A-Za-z-]+>$/.test(trimmed))
+                refuse(at + 'a section inside a section');
+            return;
+        }
+        const open = /^<([A-Za-z0-9-]+)>$/.exec(trimmed);
+        if (open) {
+            const tag = open[1].toLowerCase();
+            if (!BLOCKS.has(tag))
+                refuse(at + '<' + tag + '> is not allowed');
+            block = tag;
+            return;
+        }
+        const d = directiveOf(line);
+        if (!d)
+            return;
+        if (!/^[a-z0-9-]{1,40}$/.test(d.name))
+            return refuse(at + 'a directive name with odd characters');
+        if (PROGRAM_DIRECTIVES.includes(d.name))
+            return refuse(at + d.name + ' runs a program or reads or writes a file on this machine');
+        if (!ALLOWED.has(d.name))
+            return refuse(at + d.name + ' is not on the list of settings that are safe to accept');
+        if (FILE_DIRECTIVES.has(d.name))
+            return refuse(at + d.name + ' names a file: certificates must be inside the profile');
+        if (d.name === 'auth-user-pass' && d.args.length > 0)
+            return refuse(at + 'auth-user-pass names a file: the login is given separately');
+        if (d.name === 'setenv' && !(d.args[0] === 'CLIENT_CERT' && d.args.length === 2))
+            return refuse(at + 'setenv may only be CLIENT_CERT');
+        if (d.name === 'proto')
+            defaultProto = d.args[0]?.startsWith('tcp') ? 'tcp' : 'udp';
+        if (d.name === 'remote') {
+            const [host, port = '1194', proto] = d.args;
+            if (!host || !HOST.test(host))
+                return refuse(at + 'remote needs a host name or an IPv4 address');
+            const n = Number(port);
+            if (!Number.isInteger(n) || n < 1 || n > 65535)
+                return refuse(at + 'remote has an invalid port');
+            found.push({ host, port: n, ...(proto ? { proto: proto.startsWith('tcp') ? 'tcp' : 'udp' } : {}) });
+        }
+    });
+    // A remote without its own protocol uses the profile's proto line, wherever that line is.
+    const remotes = found.map((r) => ({ host: r.host, port: r.port, proto: r.proto ?? defaultProto }));
+    if (block)
+        refuse('a <' + block + '> section is never closed');
+    if (remotes.length === 0)
+        refuse('it names no remote server');
+    if (remotes.length > 64)
+        refuse('it names too many servers');
+    return problems.length ? { ok: false, problems } : { ok: true, remotes };
+}
+/** The servers of a safe profile; throws, saying why, when it is not (`what` names the file or source). */
+export function assertSafeOvpn(text, what) {
+    const report = inspectOvpn(text);
+    if (report.ok)
+        return report.remotes;
+    throw new Error(what +
+        ' was refused because it could run programs or is not a plain profile:\n  - ' +
+        report.problems.slice(0, 5).join('\n  - '));
+}

package/dist/shared/web/index.d.ts

@@ -0,0 +1 @@
+export * from './protocol.js';

package/dist/shared/web/index.js

@@ -0,0 +1 @@
+export * from './protocol.js';

package/dist/shared/web/protocol.d.ts

@@ -0,0 +1,61 @@
+/** The header every state-changing call carries (a browser page of another site cannot add it without CORS). */
+export declare const CSRF_HEADER = "x-sandbox-web";
+export declare const CSRF_VALUE = "1";
+export declare const COOKIE_NAME = "sbxweb";
+export interface WebSession {
+    readonly id: string;
+    readonly harness: string;
+    readonly project: string;
+    readonly cwd: string;
+    readonly phase: 'starting' | 'running' | 'exited' | 'failed';
+    readonly message: string;
+    readonly startedAt: string;
+    /** Terminals attached right now (null: the session could not be asked). */
+    readonly viewers: number | null;
+    /** The session can be opened here (running, and reachable from this PC). */
+    readonly canOpen: boolean;
+}
+export interface WebProject {
+    readonly name: string;
+    readonly guest: string;
+}
+export interface WebInfo {
+    readonly sandbox: 'running' | 'stopped';
+    /** "Running, started by alice (shared with you)" and the like; null for your own sandbox. */
+    readonly owner: string | null;
+    /** This user may open sessions and start new ones in the running sandbox. */
+    readonly canUse: boolean;
+    readonly harnesses: readonly string[];
+    readonly defaultHarness: string;
+    readonly projects: readonly WebProject[];
+}
+export interface NewSessionRequest {
+    readonly harness: string;
+    readonly project: string;
+}
+/** Browser -> server on the terminal socket: binary messages are keystrokes; text messages are these (JSON). */
+export type ClientMessage = {
+    readonly t: 'resize';
+    readonly cols: number;
+    readonly rows: number;
+};
+/** Server -> browser: binary messages are terminal output; text messages are these (JSON). */
+export type ServerMessage = {
+    readonly t: 'ready';
+} | {
+    readonly t: 'restarting';
+} | {
+    readonly t: 'exit';
+    readonly code: number;
+} | {
+    readonly t: 'error';
+    readonly message: string;
+};
+export declare const MIN_COLS = 10;
+export declare const MAX_COLS = 500;
+export declare const MIN_ROWS = 2;
+export declare const MAX_ROWS = 300;
+/** Biggest browser message the server accepts (a paste); more closes the socket. */
+export declare const MAX_CLIENT_MESSAGE_BYTES: number;
+/** A browser message that is JSON of a known shape and sane numbers, else null (the socket is then closed). */
+export declare function parseClientMessage(text: string): ClientMessage | null;

package/dist/shared/web/protocol.js

@@ -0,0 +1,35 @@
+// What the web UI's server and its browser app say to each other. Types and constants only (no Node, no DOM), so the
+// server (src/host/web) and the app (web/) share one definition.
+/** The header every state-changing call carries (a browser page of another site cannot add it without CORS). */
+export const CSRF_HEADER = 'x-sandbox-web';
+export const CSRF_VALUE = '1';
+export const COOKIE_NAME = 'sbxweb';
+export const MIN_COLS = 10;
+export const MAX_COLS = 500;
+export const MIN_ROWS = 2;
+export const MAX_ROWS = 300;
+/** Biggest browser message the server accepts (a paste); more closes the socket. */
+export const MAX_CLIENT_MESSAGE_BYTES = 256 * 1024;
+/** A browser message that is JSON of a known shape and sane numbers, else null (the socket is then closed). */
+export function parseClientMessage(text) {
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+    if (typeof value !== 'object' || value === null)
+        return null;
+    const m = value;
+    if (m.t !== 'resize')
+        return null;
+    const { cols, rows } = m;
+    if (!Number.isInteger(cols) || !Number.isInteger(rows))
+        return null;
+    const c = cols;
+    const r = rows;
+    if (c < MIN_COLS || c > MAX_COLS || r < MIN_ROWS || r > MAX_ROWS)
+        return null;
+    return { t: 'resize', cols: c, rows: r };
+}

package/dist/sync/sync-cycle.js

@@ -1,6 +1,7 @@
 import path from 'node:path';
 import { assertNoLinks } from '../core/util/index.js';
-import { hostClaudeDir } from '../host/profile/index.js';
+import { hostClaudeDir, PluginShare } from '../host/profile/index.js';
+import { storageOf } from '../host/storage/index.js';
 import { hostClaudeMemDir, syncClaudeMem } from './claude-mem.js';
 import { readSyncState, writeSyncState } from './sync-state.js';
 import { syncHistoryIn, syncHistoryOut } from './history.js';
@@ -58,6 +59,7 @@ export function syncBeforeLaunch(config, dataPath, hostWorkspace) {
         historyScope: profile.historyScope,
         syncClaudeMem: profile.syncClaudeMem,
         syncClaudeMemBack: profile.syncClaudeMemBack,
+        sharePlugins: profile.sharePluginsAcrossAccounts,
         projects: [],
     };
     if (profile.syncHistory)
@@ -78,6 +80,8 @@ export function syncBack(dataPath, final) {
         return summary;
     if (state.syncHistory)
         summary.history = syncHistoryOut(toPaths(state, dataPath));
+    if (final && state.sharePlugins)
+        PluginShare.in(storageOf(dataPath)).saveQuietly(dataPath, guestClaude(dataPath));
     if (final && state.syncClaudeMem && state.syncClaudeMemBack)
         summary.claudeMem = memSync(dataPath, state, 'out');
     writeSyncState(dataPath, state);

package/dist/sync/sync-state.d.ts

@@ -6,6 +6,7 @@ declare const SyncStateSchema: z.ZodObject<{
     syncHistory: z.ZodOptional<z.ZodBoolean>;
     syncClaudeMem: z.ZodOptional<z.ZodBoolean>;
     syncClaudeMemBack: z.ZodOptional<z.ZodBoolean>;
+    sharePlugins: z.ZodOptional<z.ZodBoolean>;
     historyScope: z.ZodOptional<z.ZodEnum<{
         project: "project";
         all: "all";

package/dist/sync/sync-state.js

@@ -14,6 +14,7 @@ const SyncStateSchema = z.object({
     syncHistory: z.boolean().optional(),
     syncClaudeMem: z.boolean().optional(),
     syncClaudeMemBack: z.boolean().optional(),
+    sharePlugins: z.boolean().optional(),
     historyScope: z.enum(['project', 'all']).optional(),
     /** Newest claude-mem database time on each side right after the last sync (detects edits on both sides). */
     memHostStamp: z.number().optional(),

package/dist/sync/watcher.js

@@ -17,6 +17,7 @@ import { autoRestartAllowed, causeSince, KeepAwake, LifeRecord, saveCrashReport,
 import { SandboxChannel } from '../host/channel/index.js';
 import { ProjectRegistry } from '../host/projects/registry.js';
 import { storageOf } from '../host/storage/index.js';
+import { clearSecrets } from '../host/secrets/index.js';
 import { endSharing, sharingDeps } from '../host/sharing/index.js';
 import { PACKAGE_ROOT } from '../core/package-info.js';
 import { syncBack } from './sync-cycle.js';
@@ -261,6 +262,15 @@ export class Watcher {
         catch {
             /* best effort */
         }
+        // One-shot secrets the sandbox never read (it stopped early) and any login copy left in a launch folder.
+        try {
+            // Not when a new sandbox already started: its own files are there.
+            if (!isSandboxRunning())
+                clearSecrets(this.storageRoot, this.dataPath);
+        }
+        catch (e) {
+            this.note('could not remove the one-shot secrets: ' + errMsg(e));
+        }
         // An all-users install: the record of whose sandbox this was goes, and the group loses access to the folders.
         const sharing = sharingDeps(PACKAGE_ROOT);
         if (sharing)

package/dist/web/index.html

@@ -0,0 +1,13 @@
+<!doctype html>
+<html lang="en" data-bs-theme="dark">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Sandbox</title>
+    <link rel="stylesheet" href="/main-VLR7DVQ4.css" />
+    <script type="module" src="/main-CXESL347.js"></script>
+  </head>
+  <body>
+    <div id="root"></div>
+  </body>
+</html>