saferun-cli 0.0.2__py3-none-any.whl

saferun/sandbox/images.py

@@ -0,0 +1,110 @@
+"""Pinned container images (Phase 5A): data and pure helpers only (no Docker calls, no imports from the rest of the package).
+
+Every image SafeRun runs is referenced as `repository:tag@sha256:<digest>`. The digest is the manifest (index)
+digest, which is content-addressed: Docker resolves the reference by digest and the tag is only a label for humans.
+`saferun verify-images` and `docker.resolve_image` refuse to continue when the local image does not carry the pinned digest.
+
+How a digest becomes a pin: (1) read it from the local image (`docker image inspect`) that the test suite ran against,
+(2) confirm the registry serves that exact digest for the repository (`docker buildx imagetools inspect <repo>@<digest>`),
+(3) record it here together with the date. To update a pin, repeat these steps deliberately; nothing updates itself.
+"""
+from __future__ import annotations
+
+import json
+import re
+from dataclasses import dataclass
+
+DIGEST_RE = re.compile(r"^sha256:[0-9a-f]{64}$")
+_REF_RE = re.compile(r"^(?P<name>[^@]+)@(?P<digest>sha256:[0-9a-f]{64})$")
+
+
+@dataclass(frozen=True)
+class PinnedImage:
+    name: str          # profile name
+    repository: str    # as Docker lists it in RepoDigests, e.g. "python"
+    tag: str           # human-readable label; NOT trusted, the digest decides
+    digest: str        # sha256:<64 hex>, manifest-index digest
+    pinned_on: str     # ISO date the digest was verified against the registry
+
+    @property
+    def reference(self) -> str:
+        return f"{self.repository}:{self.tag}@{self.digest}"
+
+    @property
+    def pull_reference(self) -> str:
+        return f"{self.repository}@{self.digest}"
+
+
+PYTHON_IMAGE = PinnedImage("python", "python", "3.12-slim",
+                           "sha256:78387bc3881b8273120a12ebe6c1ab22b018ccc2c9adf565ae1ac9b536e184ea", "2026-10-29")
+NODE_IMAGE = PinnedImage("node", "node", "22-slim",
+                         "sha256:4b150b48b4116e2a22f2c39cc27025fbf4f153e2078fd3b14d159fdb5c7279da", "2026-10-29")
+PINNED_IMAGES: tuple[PinnedImage, ...] = (PYTHON_IMAGE, NODE_IMAGE)
+
+# Where the prebuilt analyzer image is published, and WHO may have signed it (Phase 5E).
+# The image is built and pushed by .github/workflows/release-analyzer.yml and signed with cosign "keyless": the signature is bound to
+# the workflow's GitHub OIDC identity, not to a key anyone holds. SafeRun accepts a signature only if the certificate identity matches
+# this expression: that exact repository, that exact workflow file, and a TAG ref `analyzer-v<number>(.<number>)*` (never a branch or
+# a pull request). tests/test_release_signature.py checks the expression against the workflow file.
+ANALYZER_REGISTRY_REPOSITORY = "ghcr.io/vinay-repalle/saferun-analyzer"
+ANALYZER_SIGNER_IDENTITY_REGEXP = (r"^https://github\.com/vinay-repalle/saferun/\.github/workflows/release-analyzer\.yml"
+                                   r"@refs/tags/analyzer-v[0-9]+(\.[0-9]+)*$")
+GITHUB_OIDC_ISSUER = "https://token.actions.githubusercontent.com"
+
+
+@dataclass(frozen=True)
+class AnalyzerRelease:
+    """An officially PUBLISHED prebuilt analyzer image: where it lives, the manifest digest it must have, and who must have signed it.
+    `saferun init` first verifies the cosign signature of `<repository>@<digest>` (identity + issuer below), then pulls that reference
+    (content-addressed: Docker rejects anything else), then applies the same label/tool/rules verification as for a locally built
+    image, and only then locks it. A release without a signer identity is refused: there is no unsigned install."""
+    repository: str      # e.g. ANALYZER_REGISTRY_REPOSITORY
+    digest: str          # sha256:<64 hex> of the published manifest
+    published_on: str
+    signer_identity_regexp: str = ANALYZER_SIGNER_IDENTITY_REGEXP
+    oidc_issuer: str = GITHUB_OIDC_ISSUER
+
+    @property
+    def reference(self) -> str:
+        return f"{self.repository}@{self.digest}"
+
+
+# The current release: tag analyzer-v1.0.1 (commit a275dce, rules unchanged since), signed by this repository's release workflow. The digest was read from
+# the registry and its cosign signature was verified with ANALYZER_SIGNER_IDENTITY_REGEXP before it was recorded (docs/release-images.md). A new analyzer
+# (new tool pins or rules) is a new tag, a new digest and a new commit here. Set to None to make `saferun init` build locally with docker/analyzer/build.sh.
+ANALYZER_RELEASE: AnalyzerRelease | None = AnalyzerRelease(
+    ANALYZER_REGISTRY_REPOSITORY,
+    "sha256:6f26c3e3fed1a8b2a981bdcb920c4da3b2829bce2679709ba8880789ce6f6fa4",
+    "2026-10-30",
+)
+
+# Tools baked into the analyzer image build recipe (docker/analyzer/). Not used at run time yet (Phase 5B).
+# The Dockerfile ARG defaults must equal these values; tests enforce it.
+SEMGREP_VERSION = "1.182.1"
+OSV_SCANNER_VERSION = "2.7.0"
+OSV_SCANNER_LINUX_AMD64_SHA256 = "160c6253e2922e9e0a6a9771c5c4c40a4b3c6090b34a3cdd5e80c96cc2e4218b"
+
+
+def digest_of(reference: str) -> str | None:
+    """The sha256 digest named by an image reference, or None for a tag-only reference."""
+    m = _REF_RE.match(reference)
+    return m.group("digest") if m else None
+
+
+def repo_digests(raw: str) -> list[str]:
+    """Digests (`sha256:...`) from the JSON of `docker image inspect --format {{json .RepoDigests}}`.
+
+    Raises ValueError for anything but a JSON list of `name@sha256:<64 hex>` strings (or null/empty).
+    """
+    data = json.loads(raw)
+    if data is None:
+        return []
+    if not isinstance(data, list):
+        raise ValueError("RepoDigests is not a list")
+    out = []
+    for item in data:
+        m = _REF_RE.match(item) if isinstance(item, str) else None
+        if not m:
+            raise ValueError(f"unexpected RepoDigests entry: {item!r}")
+        out.append(m.group("digest"))
+    return out

saferun/sandbox/profiles.py

@@ -0,0 +1,40 @@
+"""Runtime profiles: which image runs which kind of project.
+
+A profile is only a name for an image. The sandbox itself is image-agnostic: every profile gets
+exactly the same restrictions, verified the same way. A profile does NOT imply anything about
+dependency installation, test runners or analyzers (those belong to Phase 2+).
+
+Requirements for any image: Linux; `timeout` (coreutils or busybox) and `sh` on PATH; no VOLUME
+declarations; a `nobody` user is not required (the uid is set numerically).
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+from .config import SandboxError
+from .images import NODE_IMAGE, PYTHON_IMAGE
+
+
+@dataclass(frozen=True)
+class RuntimeProfile:
+    name: str
+    image: str          # pinned reference `repo:tag@sha256:...` (see images.py); the digest is verified before every run
+    interpreter: str    # binary used to run a project file / self-checks
+    description: str = ""
+
+    @property
+    def label(self) -> str:
+        """Human-readable `repo:tag` without the digest; used in report text so `tool` strings stay as before pinning."""
+        return self.image.split("@", 1)[0]
+
+
+PYTHON = RuntimeProfile("python", PYTHON_IMAGE.reference, "python", "CPython 3.12 (Debian slim)")
+NODE = RuntimeProfile("node", NODE_IMAGE.reference, "node", "Node.js 22 LTS (Debian slim)")
+PROFILES: dict[str, RuntimeProfile] = {p.name: p for p in (PYTHON, NODE)}
+
+
+def get_profile(name: str) -> RuntimeProfile:
+    try:
+        return PROFILES[name]
+    except KeyError:
+        raise SandboxError(f"unknown runtime profile {name!r}; known: {sorted(PROFILES)}") from None

saferun/sandbox/reaper.py

@@ -0,0 +1,127 @@
+"""Recovery of containers and workspaces abandoned by a crashed SafeRun process.
+
+Safety rules: only objects SafeRun itself created are considered (label +
+name prefix for containers; name prefix, ownership, real directory for
+workspaces), and live runs are never touched: containers carry a deadline
+label (timeout + grace + margin) and workspaces are protected by a flock.
+"""
+from __future__ import annotations
+
+import errno
+import os
+import shutil
+import tempfile
+import time
+from dataclasses import dataclass, field
+from pathlib import Path
+
+from .. import hostos
+from . import docker as dk
+from .config import CONTAINER_LABEL, DEADLINE_LABEL
+from .workspace import LOCK_NAME, WS_PREFIX
+
+if not hostos.IS_WINDOWS:
+    import fcntl
+
+NO_LOCK_MIN_AGE_S = 600  # a workspace with no lock file is only reaped once this old
+
+
+@dataclass
+class ReapReport:
+    containers: list[str] = field(default_factory=list)
+    workspaces: list[str] = field(default_factory=list)
+    errors: list[str] = field(default_factory=list)
+
+
+def _reap_containers(now: float, report: ReapReport) -> None:
+    try:
+        r = dk.docker("ps", "-a", "--filter", f"label={CONTAINER_LABEL}",
+                      "--format", '{{.Names}}\t{{.Label "' + DEADLINE_LABEL + '"}}')
+    except dk.SandboxError as e:  # daemon hung or the CLI missing: report it, but still reap workspaces
+        report.errors.append(f"could not list containers: {e}")
+        return
+    if r.returncode != 0:  # daemon down: say so, do not pretend there was nothing to reap
+        report.errors.append(f"could not list containers: {r.stderr.strip()}")
+        return
+    for line in r.stdout.splitlines():
+        name, _, raw = line.partition("\t")
+        if not name.startswith("saferun-"):
+            continue
+        try:
+            expired = float(raw) < now
+        except ValueError:
+            expired = True  # our label but no usable deadline: treat as abandoned
+        if not expired:
+            continue
+        try:
+            if dk.force_remove(name):
+                report.containers.append(name)
+            else:
+                report.errors.append(f"container {name} still present after removal")
+        except Exception as e:
+            report.errors.append(f"container {name}: {e}")
+
+
+def _reap_workspaces_windows(now: float, tmp_root: Path, report: ReapReport) -> None:
+    """Same rules as the POSIX version: our name prefix, a real directory (no reparse point) owned by this user, and a lock file that
+    nobody holds (the owner keeps it open with share mode 0, so it cannot be opened while the run is alive)."""
+    for entry in os.scandir(tmp_root):
+        if not entry.name.startswith(WS_PREFIX):
+            continue
+        try:
+            st = entry.stat(follow_symlinks=False)
+            if entry.is_symlink() or not entry.is_dir(follow_symlinks=False) or st.st_file_attributes & 0x400:
+                continue
+            if not hostos.owned_by_current_user(Path(entry.path)):
+                continue
+            state = hostos.workspace_lock_state(os.path.join(entry.path, LOCK_NAME))
+            if state == "busy" or (state == "absent" and now - st.st_mtime < NO_LOCK_MIN_AGE_S):
+                continue
+            shutil.rmtree(hostos.long_path(entry.path), onexc=hostos.rmtree_onexc)
+            report.workspaces.append(entry.name)
+        except OSError as e:
+            report.errors.append(f"workspace {entry.name}: {e}")
+
+
+def _reap_workspaces(now: float, tmp_root: Path, report: ReapReport) -> None:
+    if hostos.IS_WINDOWS:
+        return _reap_workspaces_windows(now, tmp_root, report)
+    for entry in os.scandir(tmp_root):
+        if not entry.name.startswith(WS_PREFIX) or entry.is_symlink() or not entry.is_dir(follow_symlinks=False):
+            continue
+        st = entry.stat(follow_symlinks=False)
+        if st.st_uid != os.getuid():
+            continue
+        try:
+            fd = os.open(os.path.join(entry.path, LOCK_NAME), os.O_RDWR | os.O_NOFOLLOW | os.O_CLOEXEC)
+        except FileNotFoundError:
+            if now - st.st_mtime < NO_LOCK_MIN_AGE_S:
+                continue  # may be mid-creation
+            fd = None
+        except OSError as e:
+            report.errors.append(f"workspace {entry.name}: {e}")
+            continue
+        try:
+            if fd is not None:
+                try:
+                    fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
+                except OSError as e:
+                    if e.errno in (errno.EWOULDBLOCK, errno.EAGAIN):
+                        continue  # owner is alive
+                    raise
+            shutil.rmtree(entry.path)
+            report.workspaces.append(entry.name)
+        except OSError as e:
+            report.errors.append(f"workspace {entry.name}: {e}")
+        finally:
+            if fd is not None:
+                os.close(fd)
+
+
+def reap_orphans(now: float | None = None, tmp_root: Path | None = None) -> ReapReport:
+    """Remove abandoned SafeRun containers and workspaces. `now`/`tmp_root` are for tests."""
+    now = time.time() if now is None else now
+    report = ReapReport()
+    _reap_containers(now, report)
+    _reap_workspaces(now, Path(tmp_root or tempfile.gettempdir()), report)
+    return report

saferun/sandbox/runner.py

@@ -0,0 +1,268 @@
+"""Run a command against an untrusted project inside a locked-down container."""
+from __future__ import annotations
+
+import math
+import re
+import subprocess
+import threading
+import time
+import uuid
+from pathlib import Path
+
+from .. import hostos
+from . import docker as dk
+from .config import (
+    CONTAINER_LABEL, DEADLINE_LABEL, DEFAULT_IMAGE, REAP_MARGIN_S, SANDBOX_UID,
+    ControlStatus, SandboxError, SandboxLimits, SandboxResult, SensitivePolicy, WorkspaceLimits,
+)
+from .controls import verify_applied_config
+from .secrets import drop_partial_tail
+from .workspace import Workspace, create_workspace
+
+MAX_ARGS, MAX_ARG_LEN = 4096, 64 * 1024
+
+
+def _check_mount_path(project: Path) -> None:
+    """--mount values are comma-separated key=value CSV; refuse paths that could inject options."""
+    s = str(project)
+    if not project.is_absolute() or any(c in s for c in ',"') or not s.isprintable():
+        raise SandboxError(f"workspace path contains unsupported characters: {s!r}")
+    problem = hostos.mount_source_problem(s)
+    if problem:
+        raise SandboxError(f"cannot mount {s!r}: {problem}")
+
+
+def validate_command(command) -> list[str]:
+    """argv for the container: a non-empty list of strings, argv[0] non-empty, no NUL bytes.
+    (Never passed through a shell.)"""
+    if (not isinstance(command, (list, tuple)) or not command or len(command) > MAX_ARGS
+            or not all(isinstance(a, str) and len(a) <= MAX_ARG_LEN and "\0" not in a for a in command)
+            or not command[0]):
+        raise SandboxError("command must be a non-empty list of strings with a non-empty first element")
+    return list(command)
+
+
+_RESERVED_TARGETS = frozenset({"/", "/workspace", "/tmp", "/proc", "/sys", "/dev", "/etc", "/bin", "/usr", "/lib", "/sbin", "/var", "/run"})
+_TARGET_RE = re.compile(r"^/[a-z][a-z0-9_-]{0,31}$")
+
+
+def validate_readonly_mounts(mounts) -> tuple[tuple[Path, str], ...]:
+    """Extra read-only bind mounts (host directory, container path), e.g. a vulnerability database.
+
+    Only existing, absolute host *directories* are accepted (never the filesystem root or a symlink), and the container
+    path must be a single fresh top-level name that is not a system location. They are always mounted read-only and
+    `verify_applied_config` re-checks the exact set Docker applied.
+    """
+    out, seen = [], set()
+    for item in mounts or ():
+        try:
+            src, dst = item
+            src = Path(src)
+        except (TypeError, ValueError):
+            raise SandboxError(f"invalid read-only mount specification: {item!r}") from None
+        if dst in _RESERVED_TARGETS or not isinstance(dst, str) or not _TARGET_RE.match(dst) or dst in seen:
+            raise SandboxError(f"invalid or duplicate read-only mount target: {dst!r}")
+        _check_mount_path(src)
+        if src == Path(src.anchor) or src.is_symlink() or not src.is_dir():
+            raise SandboxError(f"read-only mount source must be an existing real directory (not the root): {str(src)!r}")
+        seen.add(dst)
+        out.append((src, dst))
+    return tuple(out)
+
+
+def build_create_args(
+    name: str, project: Path, command: list[str], image: str, lim: SandboxLimits,
+    readonly_mounts: tuple[tuple[Path, str], ...] = (),
+) -> list[str]:
+    """docker-create arguments. Every security control lives here."""
+    _check_mount_path(project)
+    extra = []
+    for src, dst in readonly_mounts:
+        _check_mount_path(src)
+        extra += ["--mount", f"type=bind,src={src},dst={dst},readonly"]
+    mem = f"{lim.memory_mb}m"
+    container_timeout = math.ceil(lim.timeout_s + lim.container_grace_s)
+    deadline = int(time.time() + container_timeout + REAP_MARGIN_S)
+    return [
+        "create", "--name", name, "--label", CONTAINER_LABEL,
+        "--label", f"{DEADLINE_LABEL}={deadline}",
+        "--pull", "never",                        # never fetch an image (no host egress, no tag swap)
+        "--network", "none",                      # no network at all
+        "--read-only",                            # immutable root fs
+        "--tmpfs", f"/tmp:rw,noexec,nosuid,nodev,size={lim.tmpfs_mb}m",
+        "--shm-size", f"{lim.shm_mb}m",
+        "--mount", f"type=bind,src={project},dst=/workspace,readonly",
+        *extra,
+        "--workdir", "/workspace",
+        "--entrypoint", "",                       # the image's ENTRYPOINT must not reinterpret our argv
+        "--user", f"{SANDBOX_UID}:{SANDBOX_UID}",
+        "--cap-drop", "ALL",
+        "--security-opt", "no-new-privileges",    # daemon-default seccomp + AppArmor kept, checked in preflight
+        "--memory", mem, "--memory-swap", mem,    # no swap
+        "--cpus", str(lim.cpus),
+        "--pids-limit", str(lim.pids),
+        "--ulimit", f"nofile={lim.nofile}:{lim.nofile}",
+        "--ulimit", f"fsize={lim.fsize_mb * 1024 * 1024}",
+        "--ulimit", "core=0",
+        "--log-driver", "none",                   # no host-disk log growth
+        "--init",
+        "--env", "HOME=/tmp", "--env", "PYTHONDONTWRITEBYTECODE=1",
+        image,
+        # Container-side deadline: still fires if the SafeRun process dies mid-run.
+        "timeout", "-s", "KILL", str(container_timeout), *command,
+    ]
+
+
+def _drain(stream, cap: int, buf: bytearray, flag: list[bool]) -> None:
+    """Keep up to `cap` bytes; keep reading (and discarding) so the child never blocks."""
+    while chunk := stream.read(65536):
+        room = cap - len(buf)
+        if room > 0:
+            buf += chunk[:room]
+        if len(chunk) > room:
+            flag[0] = True
+
+
+def _execute(name: str, ws: Workspace, command: list[str], image: str, image_id: str,
+             daemon_statuses: list[ControlStatus], lim: SandboxLimits,
+             readonly_mounts: tuple[tuple[Path, str], ...] = ()) -> SandboxResult:
+    r = dk.docker(*build_create_args(name, ws.project, command, image_id, lim, readonly_mounts))
+    if r.returncode != 0:
+        raise SandboxError(f"docker create failed: {r.stderr.strip()}")
+
+    # Fail closed: verify what Docker actually created BEFORE any untrusted code can start.
+    info = dk.inspect(name)
+    if not info:
+        raise SandboxError("docker create succeeded but the container cannot be inspected")
+    checks = verify_applied_config(info, lim, image_id, tuple(dst for _s, dst in readonly_mounts))
+    bad = [c for c in checks if c.state != "verified"]
+    if bad:
+        raise SandboxError("container was not started: applied configuration violates the sandbox policy: "
+                           + "; ".join(f"{c.name} ({c.detail})" for c in bad))
+
+    out, err, trunc = bytearray(), bytearray(), [False]
+    t0 = time.monotonic()
+    try:
+        proc = subprocess.Popen(
+            [dk.docker_bin(), "start", "-a", name],
+            stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.DEVNULL,
+        )
+    except OSError as e:
+        raise SandboxError(f"could not start the docker client: {e}") from e
+    threads = [
+        threading.Thread(target=_drain, args=(s, lim.max_output_bytes, b, trunc), daemon=True)
+        for s, b in ((proc.stdout, out), (proc.stderr, err))
+    ]
+    for t in threads:
+        t.start()
+    timed_out = False
+    try:
+        try:
+            proc.wait(timeout=lim.timeout_s)
+        except subprocess.TimeoutExpired:
+            timed_out = True
+            try:
+                dk.docker("kill", name)
+            except SandboxError:
+                pass   # daemon hung or unreachable: the client is stopped below and the cleanup step reports what is left
+            try:
+                proc.wait(timeout=30)
+            except subprocess.TimeoutExpired:
+                raise SandboxError(f"container {name} did not stop within 30 s of being killed") from None
+    finally:
+        if proc.poll() is None:   # never leave our `docker start -a` client behind (hung daemon, error, interrupt)
+            proc.kill()
+            try:
+                proc.wait(timeout=10)
+            except subprocess.TimeoutExpired:
+                pass
+    for t in threads:
+        t.join(timeout=5)
+    duration = time.monotonic() - t0
+
+    info = dk.inspect(name)
+    state = info.get("State") if info else None
+    if not isinstance(state, dict) or not isinstance(state.get("ExitCode"), int):
+        raise SandboxError(f"could not read the final state of container {name}; outcome unknown")
+    texts, redactions = [], 0
+    for buf in (out, err):
+        text = buf.decode("utf-8", "replace")
+        if trunc[0]:
+            text = drop_partial_tail(text)  # a cut-off secret prefix would evade redaction
+        text, n = ws.redactor.redact(text)
+        texts.append(text)
+        redactions += n
+    return SandboxResult(
+        exit_code=state["ExitCode"],
+        stdout=texts[0],
+        stderr=texts[1],
+        redactions=redactions,
+        withheld=ws.withheld,
+        timed_out=timed_out,
+        oom_killed=bool(state.get("OOMKilled")),
+        output_truncated=trunc[0],
+        duration_s=duration,
+        container_name=name,
+        hardening=info.get("HostConfig", {}),
+        controls=[*daemon_statuses, *checks],
+        image_id=image_id,
+        skipped=ws.skipped,
+        entries_scanned=ws.entries_scanned,
+        copied_files=ws.copied_files,
+        copied_dirs=ws.copied_dirs,
+        copied_bytes=ws.copied_bytes,
+    )
+
+
+def _cleanup(name: str, ws: Workspace) -> list[str]:
+    """Run BOTH cleanup steps whatever happens to the first; return problems."""
+    problems = []
+    try:
+        if not dk.force_remove(name):
+            problems.append(f"container {name} still present")
+    except Exception as e:
+        problems.append(f"container {name}: {e}")
+    try:
+        ws.cleanup()
+    except Exception as e:
+        problems.append(f"workspace {ws.root}: {e}")
+    return problems
+
+
+def run_sandboxed(
+    project_dir: Path,
+    command: list[str],
+    limits: SandboxLimits | None = None,
+    image: str = DEFAULT_IMAGE,
+    workspace_limits: WorkspaceLimits | None = None,
+    sensitive_policy: SensitivePolicy | None = None,
+    allow_degraded: frozenset[str] = frozenset(),
+    readonly_mounts: tuple[tuple[Path, str], ...] = (),
+) -> SandboxResult:
+    """Run `command` (argv, no shell) against a sanitized copy of `project_dir`.
+
+    `allow_degraded` names daemon controls (see controls.REQUIRED_DAEMON) the caller accepts
+    as unavailable; they are still reported in `SandboxResult.controls`.
+    `readonly_mounts` adds (host directory, container path) bind mounts, always read-only (see validate_readonly_mounts);
+    the network stays disabled whatever is mounted.
+    """
+    lim = limits or SandboxLimits()
+    command = validate_command(command)
+    readonly_mounts = validate_readonly_mounts(readonly_mounts)
+    image_id, daemon_statuses = dk.preflight(image, frozenset(allow_degraded))
+    ws = create_workspace(project_dir, workspace_limits, sensitive_policy)
+    name = f"saferun-{uuid.uuid4().hex[:12]}"
+    primary: BaseException | None = None
+    try:
+        return _execute(name, ws, command, image, image_id, daemon_statuses, lim, readonly_mounts)
+    except BaseException as e:
+        primary = e
+        raise
+    finally:
+        problems = _cleanup(name, ws)
+        if problems:
+            msg = "; ".join(problems)
+            if primary is not None:
+                primary.add_note(f"SafeRun cleanup also failed: {msg}")  # keep the original error
+            else:
+                raise SandboxError(f"cleanup failed: {msg}")

saferun/sandbox/secrets.py

@@ -0,0 +1,91 @@
+"""Content-based detection of credential material, and output redaction.
+
+Detection is by *content signature*, never by filename. Signatures are high
+precision on purpose (a PEM private key must have a base64 body, tokens must
+match a vendor format); the list is not exhaustive. Redaction is best-effort
+defence in depth: sandboxed code can encode or split a secret before printing.
+"""
+from __future__ import annotations
+
+import re
+
+MASK = "[REDACTED]"
+OVERLAP = 1024          # bytes carried between chunks so a signature can span a boundary
+LEARN_MAX = 256 * 1024  # only files up to this size are mined for secret-looking assignments
+MAX_LEARNED = 500
+
+_PEM_HDR = r"-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----"
+_PEM_BODY = r"(?:[ \t]*\r?\n|\\n)(?:[A-Za-z0-9-]+:[^\n]*\n)*\s*[A-Za-z0-9+/=]{40,}"
+_PEM_END = r"-----END (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----"
+
+# (kind, byte anchors that must appear before the regex is even tried, pattern)
+_SIGNATURES: list[tuple[str, tuple[bytes, ...], str]] = [
+    ("private-key", (b"-----BEGIN",), _PEM_HDR + _PEM_BODY),
+    ("token:aws-access-key", (b"AKIA", b"ASIA"), r"(?<![A-Za-z0-9])(?:AKIA|ASIA)[0-9A-Z]{16}(?![A-Za-z0-9])"),
+    ("token:github", (b"ghp_", b"gho_", b"ghu_", b"ghs_", b"ghr_", b"github_pat_"),
+     r"(?<![A-Za-z0-9])(?:gh[pousr]_[A-Za-z0-9]{36,255}|github_pat_[A-Za-z0-9_]{22,255})"),
+    ("token:slack", (b"xox",), r"(?<![A-Za-z0-9])xox[abprs]-[0-9A-Za-z-]{10,}"),
+    ("token:google-api-key", (b"AIza",), r"(?<![A-Za-z0-9])AIza[0-9A-Za-z_\-]{35}"),
+    ("token:stripe-live", (b"_live_",), r"(?<![A-Za-z0-9])[sr]k_live_[0-9A-Za-z]{16,}"),
+    ("token:pypi", (b"pypi-AgEI",), r"(?<![A-Za-z0-9])pypi-AgEIcHlwaS5vcmc[A-Za-z0-9_\-]{50,}"),
+    ("token:anthropic", (b"sk-ant-",), r"(?<![A-Za-z0-9])sk-ant-[A-Za-z0-9_\-]{40,}"),
+]
+_BYTES = [(k, a, re.compile(p.encode())) for k, a, p in _SIGNATURES]
+
+# Full-block redaction for output: header + body (lookahead) through END marker or end of text.
+_REDACT = [re.compile(_PEM_HDR + "(?=" + _PEM_BODY + ").*?(?:" + _PEM_END + r"|\Z)", re.S)]
+_REDACT += [re.compile(p) for k, _, p in _SIGNATURES if k != "private-key"]
+
+_KEY = (r"^[ \t]*(?:export[ \t]+)?['\"]?[A-Za-z0-9_.\-]*"
+        r"(?:secret|token|passw(?:or)?d|api[_\-]?key|private[_\-]?key|access[_\-]?key|credentials?)"
+        r"[A-Za-z0-9_.\-]*['\"]?[ \t]*[=:][ \t]*")
+_VALUE = r"(?P<q>['\"]?)(?P<v>[A-Za-z0-9_\-+/=.:@!%^*~]{8,})(?P=q)(?=[\s#,;]|$)"
+_ASSIGN = re.compile((_KEY + _VALUE).encode(), re.I | re.M)
+
+
+class SignatureScanner:
+    """Feed a file's chunks in order; returns the first matching kind (never the value)."""
+
+    def __init__(self) -> None:
+        self._tail = b""
+
+    def feed(self, chunk: bytes) -> str | None:
+        data = self._tail + chunk
+        self._tail = data[-OVERLAP:]
+        for kind, anchors, rx in _BYTES:
+            if any(a in data for a in anchors) and rx.search(data):
+                return kind
+        return None
+
+
+class Redactor:
+    """Masks secrets in sandbox output. Holds secret values in memory only."""
+
+    def __init__(self) -> None:
+        self._values: set[str] = set()
+
+    def learn(self, data: bytes) -> None:
+        """Remember values of secret-looking `KEY=value` lines in a file the sandbox can read."""
+        if len(data) > LEARN_MAX or b"\0" in data:
+            return
+        for m in _ASSIGN.finditer(data):
+            if len(self._values) >= MAX_LEARNED:
+                return
+            self._values.add(m.group("v").decode("utf-8", "ignore"))
+
+    def redact(self, text: str) -> tuple[str, int]:
+        n = 0
+        for v in sorted(self._values, key=len, reverse=True):
+            c = text.count(v)
+            if c:
+                text, n = text.replace(v, MASK), n + c
+        for rx in _REDACT:
+            text, c = rx.subn(MASK, text)
+            n += c
+        return text, n
+
+
+def drop_partial_tail(text: str) -> str:
+    """After truncation the last token may be a cut-off secret prefix: drop back to whitespace."""
+    cut = max(text.rfind(c) for c in " \t\r\n")
+    return text[: cut + 1] if cut >= 0 else ""