comodor 0.8.2__tar.gz → 0.8.4__tar.gz

{comodor-0.8.2 → comodor-0.8.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: comodor
-Version: 0.8.2
+Version: 0.8.4
 Summary: Comodor — a self-improving terminal coding agent with a Rich TUI
 Project-URL: Homepage, https://comodor.ai
 Project-URL: Repository, https://github.com/ifekri/Comodor

{comodor-0.8.2 → comodor-0.8.4}/src/comodor/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.8.2'
-__version_tuple__ = version_tuple = (0, 8, 2)
+__version__ = version = '0.8.4'
+__version_tuple__ = version_tuple = (0, 8, 4)
 
 __commit_id__ = commit_id = None

{comodor-0.8.2 → comodor-0.8.4}/src/comodor/browser/launch.py

@@ -21,6 +21,7 @@ import shutil
 import socket
 import subprocess
 import sys
+import tempfile
 import time
 from pathlib import Path
 
@@ -94,12 +95,57 @@ def free_port() -> int:
         return probe.getsockname()[1]
 
 
+#: What Chromium says when it will not run unprotected and cannot protect
+#: itself. Matched against everything it printed rather than the first line:
+#: it does not put the useful part first, and which line comes first depends on
+#: how the container was started.
+_NO_SANDBOX_SIGNS = (
+    "no usable sandbox",
+    "failed to move to new namespace",
+    "setuid sandbox",
+    "sandboxhelper",
+    "chrome-sandbox",
+    "zygote_host",
+)
+
+
+class SandboxUnavailable(BrowserError):
+    """It will not start because it cannot isolate its renderers here.
+
+    Its own class rather than a string match at the call site, because the
+    decision belongs where the full output is: by the time this reaches a
+    caller the message has been trimmed to the one line worth showing.
+    """
+
+
+def _looks_like_a_sandbox_problem(output: str) -> bool:
+    lowered = output.lower()
+    return any(sign in lowered for sign in _NO_SANDBOX_SIGNS)
+
+
+def _read_all(handle) -> str:
+    try:
+        handle.seek(0)
+        return handle.read(20_000).decode("utf-8", "replace").strip()
+    except (OSError, ValueError):
+        return ""
+
+
+def _first_line(output: str) -> str:
+    """One line for a person. Forty lines of Chromium logging is not an error
+    message, it is a haystack."""
+    if not output:
+        return ""
+    first = next((line for line in output.splitlines() if line.strip()), "")
+    return f" It said: {first.strip()[:300]}"
+
+
 class Browser:
     """A browser process we started, and are responsible for stopping."""
 
     def __init__(self, executable: str, profile: Path, port: int,
                  headless: bool = True, process: subprocess.Popen | None = None,
-                 ours: bool = True) -> None:
+                 ours: bool = True, sandboxed: bool = True) -> None:
         self.executable = executable
         self.profile = profile
         self.port = port
@@ -108,6 +154,11 @@ class Browser:
         #: False when we attached to something already running, in which case
         #: stopping it is not ours to do.
         self.ours = ours
+        #: False when the renderer sandbox had to be given up to start at all.
+        #: Worth knowing rather than assuming: it is the difference between a
+        #: bad page being contained by Chromium and being contained only by
+        #: whatever is around Chromium.
+        self.sandboxed = sandboxed
 
     @classmethod
     def start(cls, profile: Path, executable: str = "", headless: bool = True,
@@ -116,9 +167,24 @@ class Browser:
         profile.mkdir(parents=True, exist_ok=True)
         chosen = port or free_port()
 
+        try:
+            return cls._spawn(binary, profile, chosen, headless, window,
+                              sandboxed=True)
+        except SandboxUnavailable:
+            pass
+        # It will not run its renderers in a user namespace here — almost
+        # always a container, whose own confinement is the stronger boundary
+        # anyway. Give up the inner one rather than weaken the outer one, and
+        # remember that this is what happened.
+        return cls._spawn(binary, profile, chosen, headless, window,
+                          sandboxed=False)
+
+    @classmethod
+    def _spawn(cls, binary: str, profile: Path, port: int, headless: bool,
+               window: tuple[int, int], sandboxed: bool) -> "Browser":
         arguments = [
             binary,
-            f"--remote-debugging-port={chosen}",
+            f"--remote-debugging-port={port}",
             # Loopback only. Without this Chrome will accept a debugging
             # connection from anything that can route to the port, which is a
             # remote code execution hole with a browser attached.
@@ -129,20 +195,38 @@ class Browser:
         ]
         if headless:
             arguments.append("--headless=new")
+        if not sandboxed:
+            arguments.append("--no-sandbox")
         arguments.append("about:blank")
 
+        # Kept, not discarded: when it exits at once the reason is in there,
+        # and the difference between "no sandbox available" and anything else
+        # decides whether retrying is sensible or dishonest.
+        complaints = tempfile.TemporaryFile()
         try:
             process = subprocess.Popen(
-                arguments, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
+                arguments, stdout=subprocess.DEVNULL, stderr=complaints,
                 stdin=subprocess.DEVNULL,
                 creationflags=getattr(subprocess, "CREATE_NO_WINDOW", 0)
                 if os.name == "nt" else 0,
             )
         except OSError as error:
+            complaints.close()
             raise BrowserError(f"could not start {binary}: {error}") from error
 
-        browser = cls(binary, profile, chosen, headless, process)
-        browser._await_port()
+        browser = cls(binary, profile, port, headless, process,
+                      sandboxed=sandboxed)
+        try:
+            browser._await_port()
+        except BrowserError as error:
+            printed = _read_all(complaints)
+            message = f"{error}{_first_line(printed)}"
+            # Judged on everything it printed; reported as one line.
+            if sandboxed and _looks_like_a_sandbox_problem(printed):
+                raise SandboxUnavailable(message) from None
+            raise BrowserError(message) from None
+        finally:
+            complaints.close()
         return browser
 
     def _await_port(self) -> None:
@@ -171,6 +255,16 @@ class Browser:
             raise BrowserError(f"nothing is listening for DevTools on port {port}")
         return cls("", Path(), port, headless=False, process=None, ours=False)
 
+    @property
+    def note(self) -> str:
+        """What is worth saying about how it started, if anything."""
+        if self.sandboxed:
+            return ""
+        return ("Chromium is running without its own renderer sandbox: it "
+                "could not create a user namespace here, which is normal "
+                "inside a container. The container's confinement is what is "
+                "holding a bad page, rather than the browser's.")
+
     @property
     def label(self) -> str:
         info = version(self.port)

{comodor-0.8.2 → comodor-0.8.4}/src/comodor/web/commands.py

@@ -70,6 +70,22 @@ def _announce(server: Server) -> None:
 
     if server.local:
         print("  Only this machine can reach it. Ctrl-C to stop.")
+    elif server.contained:
+        # Correct, and the warning above would be both alarming and wrong. The
+        # real boundary is one layer out, so that is what gets explained.
+        print("  Listening on every address inside this container, which is")
+        print("  the only way the machine running it can reach the port.")
+        print()
+        print("  What decides who else can is how the port was published:")
+        print(f"    -p 127.0.0.1:{server.port}:{server.port}   only this machine")
+        print(f"    -p {server.port}:{server.port}             anyone who can route to it")
+        print()
+        print("  The second form puts a shell on the network, and there is no")
+        print("  TLS here — the token and everything the agent reads would")
+        print("  cross in the clear. Use the first, and an SSH tunnel to reach")
+        print("  a remote host.")
+        print()
+        print("  Ctrl-C to stop.")
     else:
         print("  ⚠  This is bound to a public address.")
         print()

{comodor-0.8.2 → comodor-0.8.4}/src/comodor/web/server.py

@@ -32,6 +32,7 @@ from __future__ import annotations
 
 import hmac
 import json
+import os
 import secrets
 import threading
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
@@ -51,6 +52,25 @@ GUARD = "X-Comodor"
 MAX_BODY = 1_000_000
 
 
+def in_a_container() -> bool:
+    """Docker, Podman or a Kubernetes pod, as best as can be told from inside.
+
+    Docker leaves a marker file; Podman sets an environment variable; both, and
+    Kubernetes, show it in the process control groups. Any one of them is
+    enough, and being wrong in either direction only changes the wording of a
+    warning, never what is bound or who can reach it.
+    """
+    if Path("/.dockerenv").exists() or Path("/run/.containerenv").exists():
+        return True
+    if os.environ.get("container"):
+        return True
+    try:
+        groups = Path("/proc/self/cgroup").read_text(encoding="utf-8", errors="ignore")
+    except OSError:
+        return False
+    return any(marker in groups for marker in ("docker", "kubepods", "containerd"))
+
+
 def page() -> str:
     return (Path(__file__).parent / "index.html").read_text(encoding="utf-8")
 
@@ -71,6 +91,19 @@ class Server:
     def local(self) -> bool:
         return self.host in LOCAL
 
+    @property
+    def contained(self) -> bool:
+        """Whether this is running inside a container.
+
+        It changes what a wide bind means. A container has its own network
+        namespace, so binding 127.0.0.1 inside one hides the port from the
+        machine that started it — the interface becomes unreachable by the
+        person who asked for it. Binding everything is therefore the correct
+        thing to do, and who may reach it is decided one layer out, by how the
+        port was published.
+        """
+        return in_a_container()
+
     @property
     def url(self) -> str:
         shown = "127.0.0.1" if self.host in ("", "0.0.0.0", "::") else self.host

{comodor-0.8.2 → comodor-0.8.4}/tests/test_real_browser.py

@@ -470,3 +470,104 @@ def test_a_screenshot_is_a_real_png(tmp_path):
         page.close()
         close_tab(browser.port, session.target_id)
         browser.stop()
+
+
+# --------------------------------------------------------------------------- #
+# where the browser cannot have its own sandbox
+# --------------------------------------------------------------------------- #
+
+
+def test_only_a_missing_sandbox_causes_a_retry():
+    """Restarting a browser that failed for some other reason — with a weaker
+    configuration, silently — would be a bad way to hide a real problem."""
+    from comodor.browser.launch import _looks_like_a_sandbox_problem
+
+    assert _looks_like_a_sandbox_problem(
+        "No usable sandbox! If this is a Debian system...")
+    assert _looks_like_a_sandbox_problem(
+        "Failed to move to new namespace: Operation not permitted")
+    assert not _looks_like_a_sandbox_problem("could not start: file not found")
+    assert not _looks_like_a_sandbox_problem("the browser did not open a port")
+
+
+def test_the_useful_line_is_not_always_the_first_one():
+    """Chromium under compose says the setuid helper failed, and only mentions
+    the namespace four lines later. Matching the first line alone made the same
+    bug appear or not depending on how the container was started."""
+    from comodor.browser.launch import _first_line, _looks_like_a_sandbox_problem
+
+    printed = "\n".join([
+        "The setuid sandbox is not running as root. Common causes:",
+        "  * An unprivileged process using ptrace on it, like a debugger.",
+        "  * A parent process set prctl(PR_SET_NO_NEW_PRIVS, ...)",
+        "Failed to move to new namespace: ... errno = Operation not permitted",
+    ])
+
+    assert _looks_like_a_sandbox_problem(printed)
+    # And what a person is shown stays one line.
+    assert "\n" not in _first_line(printed)
+    assert "setuid sandbox is not running as root" in _first_line(printed)
+
+
+def test_a_browser_that_fails_for_another_reason_is_not_restarted(tmp_path,
+                                                                  monkeypatch):
+    from comodor.browser import BrowserError
+    from comodor.browser.launch import Browser
+
+    attempts = []
+
+    def refuse(cls, binary, profile, port, headless, window, sandboxed):
+        attempts.append(sandboxed)
+        raise BrowserError("the browser did not open a debugging port")
+
+    monkeypatch.setattr(Browser, "_spawn", classmethod(refuse))
+    monkeypatch.setattr("comodor.browser.launch.find", lambda hint="": "/bin/true")
+
+    with pytest.raises(BrowserError):
+        Browser.start(tmp_path / "profile")
+
+    assert attempts == [True], "it should not have tried again"
+
+
+def test_a_missing_sandbox_is_retried_once_without_one(tmp_path, monkeypatch):
+    from comodor.browser import BrowserError
+    from comodor.browser.launch import Browser
+
+    attempts = []
+
+    def once(cls, binary, profile, port, headless, window, sandboxed):
+        from comodor.browser.launch import SandboxUnavailable
+
+        attempts.append(sandboxed)
+        if sandboxed:
+            raise SandboxUnavailable("it exited. It said: No usable sandbox!")
+        return Browser("/bin/true", profile, port, sandboxed=False)
+
+    monkeypatch.setattr(Browser, "_spawn", classmethod(once))
+    monkeypatch.setattr("comodor.browser.launch.find", lambda hint="": "/bin/true")
+
+    browser = Browser.start(tmp_path / "profile")
+
+    assert attempts == [True, False]
+    assert browser.sandboxed is False
+    assert "without its own renderer sandbox" in browser.note
+
+
+def test_a_browser_that_kept_its_sandbox_says_nothing_about_it(tmp_path):
+    from comodor.browser.launch import Browser
+
+    assert Browser("/bin/true", tmp_path, 9222).note == ""
+
+
+@needs_browser
+def test_on_a_real_machine_the_sandbox_is_kept(tmp_path):
+    """The retry must not fire where the sandbox works — that would give up a
+    real protection on every laptop to make one container convenient."""
+    from comodor.browser import Browser
+
+    browser = Browser.start(tmp_path / "profile", headless=True)
+    try:
+        assert browser.sandboxed is True
+        assert browser.note == ""
+    finally:
+        browser.stop()

{comodor-0.8.2 → comodor-0.8.4}/tests/test_web.py

@@ -459,3 +459,73 @@ def test_a_body_over_the_cap_is_drained_rather_than_left_in_the_socket(served):
         assert second.status == 200
     finally:
         connection.close()
+
+
+# --------------------------------------------------------------------------- #
+# inside a container, a wide bind is the correct one
+# --------------------------------------------------------------------------- #
+
+
+def test_a_container_is_recognised(monkeypatch, tmp_path):
+    from comodor.web import server as module
+
+    marker = tmp_path / "dockerenv"
+    marker.write_text("", encoding="utf-8")
+    monkeypatch.setattr(module, "Path", lambda p: marker if p == "/.dockerenv"
+                        else tmp_path / "absent")
+
+    assert module.in_a_container() is True
+
+
+def test_a_plain_machine_is_not_mistaken_for_one(monkeypatch, tmp_path):
+    from comodor.web import server as module
+
+    monkeypatch.setattr(module, "Path", lambda p: tmp_path / "absent")
+    monkeypatch.delenv("container", raising=False)
+
+    assert module.in_a_container() is False
+
+
+def test_the_environment_variable_podman_sets_counts(monkeypatch, tmp_path):
+    from comodor.web import server as module
+
+    monkeypatch.setattr(module, "Path", lambda p: tmp_path / "absent")
+    monkeypatch.setenv("container", "podman")
+
+    assert module.in_a_container() is True
+
+
+def test_a_container_binding_wide_is_not_called_reckless(config, monkeypatch, capsys):
+    """A container has its own network namespace, so binding 127.0.0.1 there
+    hides the port from the machine that started it. Binding everything is
+    correct, and the boundary is how the port was published."""
+    from comodor.web import commands, server as module
+
+    monkeypatch.setattr(module, "in_a_container", lambda: True)
+    served = module.Server(config, host="0.0.0.0", port=8765)
+    try:
+        commands._announce(served)
+        printed = capsys.readouterr().out
+
+        assert "public address" not in printed
+        assert "-p 127.0.0.1:8765:8765" in printed
+        # And it still says what the careless form costs.
+        assert "shell on the network" in printed
+    finally:
+        served.session.close()
+
+
+def test_a_real_machine_binding_wide_still_gets_the_warning(config, monkeypatch,
+                                                            capsys):
+    from comodor.web import commands, server as module
+
+    monkeypatch.setattr(module, "in_a_container", lambda: False)
+    served = module.Server(config, host="0.0.0.0", port=8765)
+    try:
+        commands._announce(served)
+        printed = capsys.readouterr().out
+
+        assert "public address" in printed
+        assert "ssh -N -L" in printed
+    finally:
+        served.session.close()