tsugite-sandbox 0.17.0__tar.gz

tsugite_sandbox-0.17.0/.gitignore

@@ -0,0 +1,184 @@
+# ---> Python
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#  Usually these files are written by a python script from a template
+#  before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py,cover
+.hypothesis/
+.pytest_cache/
+cover/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+.pybuilder/
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+#   For a library or package, you might want to ignore these files since the code is
+#   intended to run in multiple environments; otherwise, check them in:
+# .python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don't work, or not
+#   install all needed dependencies.
+#Pipfile.lock
+
+# poetry
+#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
+#poetry.lock
+
+# pdm
+#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
+#pdm.lock
+#   pdm stores project-wide configurations in .pdm.toml, but it is recommended to not include it
+#   in version control.
+#   https://pdm.fming.dev/latest/usage/project/#working-with-version-control
+.pdm.toml
+.pdm-python
+.pdm-build/
+
+# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule
+celerybeat.pid
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# pytype static type analyzer
+.pytype/
+
+# Cython debug symbols
+cython_debug/
+
+# PyCharm
+#  JetBrains specific template is maintained in a separate JetBrains.gitignore that can
+#  be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
+#  and can be added to the global gitignore or merged into this file.  For a more nuclear
+#  option (not recommended) you can uncomment the following to ignore the entire idea folder.
+#.idea/
+
+.env
+.env
+benchmark_results/
+test_output/
+.claude/settings.local.json
+std*.txt
+secrets/*
+
+
+# TODO: temp - I need to clean up the docs
+docs-old/
+docs/design/
+examples/*
+!examples/tsugite-example-plugin/
+agents/
+.claude/
+.tsugite/
+benchmarks/
+docker-compose.test.yml
+#### TODO ^^^

tsugite_sandbox-0.17.0/PKG-INFO

@@ -0,0 +1,6 @@
+Metadata-Version: 2.4
+Name: tsugite-sandbox
+Version: 0.17.0
+Summary: Tsugite plugin: bubblewrap sandbox backend (default-installed)
+Requires-Python: >=3.11
+Requires-Dist: tsugite-cli==0.17.0

tsugite_sandbox-0.17.0/pyproject.toml

@@ -0,0 +1,25 @@
+[project]
+name = "tsugite-sandbox"
+version = "0.17.0"
+description = "Tsugite plugin: bubblewrap sandbox backend (default-installed)"
+requires-python = ">=3.11"
+dependencies = ["tsugite-cli==0.17.0"]
+
+[project.entry-points."tsugite.sandbox"]
+bwrap = "tsugite_sandbox:BubblewrapSandbox"
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["tsugite_sandbox"]
+
+[tool.hatch.build.targets.sdist]
+include = [
+  "/tsugite_sandbox",
+  "/pyproject.toml",
+]
+
+[tool.uv.sources]
+tsugite-cli = { workspace = true }

tsugite_sandbox-0.17.0/tsugite_sandbox/__init__.py

@@ -0,0 +1,292 @@
+"""Tsugite plugin: bubblewrap (bwrap) sandbox backend.
+
+Builds bwrap command lines for isolating agent subprocess execution with filesystem
+restrictions and network namespace isolation. Registered under the `tsugite.sandbox`
+entry-point group as `bwrap`; core resolves it via `tsugite.core.sandbox.get_sandbox_class`.
+"""
+
+import os
+import shlex
+import shutil
+import sys
+import textwrap
+from pathlib import Path
+from typing import List, Optional
+
+from tsugite.core.sandbox import SandboxConfig
+
+# bwrap otherwise inherits the parent's full environment (API keys, tokens, ssh-agent
+# socket, ...). We --clearenv and re-add only this safe set, so agent code in the sandbox
+# can reach secrets only through the allowlisted, masked get_secret tool.
+_ENV_ALLOWLIST = (
+    "PATH",
+    "HOME",
+    "USER",
+    "LOGNAME",
+    "TERM",
+    "TZ",
+    "LANG",
+    "LANGUAGE",
+    "PYTHONPATH",
+    "PYTHONHOME",
+    "PYTHONIOENCODING",
+    "PYTHONDONTWRITEBYTECODE",
+    "VIRTUAL_ENV",
+    "SSL_CERT_FILE",
+    "SSL_CERT_DIR",
+    "REQUESTS_CA_BUNDLE",
+)
+
+# TCP->UDS bridge script: listens on localhost, forwards to UDS proxy socket.
+# Runs as a background process inside the sandbox so HTTP_PROXY works.
+_TCP_UDS_BRIDGE = textwrap.dedent("""\
+    import socket, threading, sys
+    PROXY_SOCK = '/run/proxy.sock'
+    LISTEN_PORT = 12345
+
+    def handle(client):
+        try:
+            upstream = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+            upstream.connect(PROXY_SOCK)
+            def relay(src, dst):
+                try:
+                    while True:
+                        data = src.recv(8192)
+                        if not data:
+                            break
+                        dst.sendall(data)
+                except Exception:
+                    pass
+                finally:
+                    try: dst.shutdown(socket.SHUT_WR)
+                    except Exception: pass
+            t1 = threading.Thread(target=relay, args=(client, upstream), daemon=True)
+            t2 = threading.Thread(target=relay, args=(upstream, client), daemon=True)
+            t1.start(); t2.start()
+            t1.join(); t2.join()
+        except Exception:
+            pass
+        finally:
+            client.close()
+
+    srv = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+    srv.bind(('127.0.0.1', LISTEN_PORT))
+    srv.listen(16)
+    while True:
+        c, _ = srv.accept()
+        threading.Thread(target=handle, args=(c,), daemon=True).start()
+""")
+
+# SSH ProxyCommand helper: connects to the HTTP CONNECT proxy to tunnel SSH.
+# Usage: ssh -o ProxyCommand='python3 _ssh_proxy.py %h %p' user@host
+_SSH_PROXY_CONNECT = textwrap.dedent("""\
+    import socket, sys
+    host, port = sys.argv[1], sys.argv[2]
+    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    s.connect(('127.0.0.1', 12345))
+    s.sendall(f'CONNECT {host}:{port} HTTP/1.1\\r\\nHost: {host}:{port}\\r\\n\\r\\n'.encode())
+    resp = b''
+    while b'\\r\\n\\r\\n' not in resp:
+        resp += s.recv(4096)
+    if b'200' not in resp.split(b'\\r\\n')[0]:
+        sys.exit(1)
+    import os, select
+    while True:
+        r, _, _ = select.select([sys.stdin.buffer, s], [], [])
+        if sys.stdin.buffer in r:
+            data = os.read(sys.stdin.buffer.fileno(), 8192)
+            if not data: break
+            s.sendall(data)
+        if s in r:
+            data = s.recv(8192)
+            if not data: break
+            sys.stdout.buffer.write(data)
+            sys.stdout.buffer.flush()
+""")
+
+
+class BubblewrapSandbox:
+    """Wraps a command with bubblewrap for filesystem and network isolation.
+
+    Args:
+        config: Sandbox configuration
+        proxy_socket: Path to the HTTP proxy Unix domain socket
+        workspace_dir: Working directory for the sandboxed process
+        state_dir: Directory for harness temp files (read-write)
+    """
+
+    def __init__(
+        self,
+        config: SandboxConfig,
+        proxy_socket: Optional[Path] = None,
+        workspace_dir: Optional[Path] = None,
+        state_dir: Optional[Path] = None,
+    ):
+        self.config = config
+        self.proxy_socket = proxy_socket
+        self.workspace_dir = workspace_dir or Path.cwd()
+        self.state_dir = state_dir
+
+    @property
+    def _use_proxy(self) -> bool:
+        """Whether to set up network proxy (socket provided and network not fully disabled)."""
+        return bool(self.proxy_socket and not self.config.no_network)
+
+    def build_command(self, inner_cmd: List[str]) -> List[str]:
+        """Wrap inner command with bwrap arguments.
+
+        Args:
+            inner_cmd: The command to run inside the sandbox
+
+        Returns:
+            Full command list starting with 'bwrap'
+        """
+        cmd = ["bwrap"]
+
+        cmd += ["--unshare-pid", "--die-with-parent"]
+        if self.config.no_network or self.proxy_socket:
+            cmd += ["--unshare-net"]
+
+        # Default-deny the environment. Set the XDG defaults first (isolated, writable tmpfs
+        # dirs - otherwise --clearenv drops XDG_* and in-child tools fall back to the operator's
+        # real, unbound, read-only home). Then re-add the safe allowlist plus any names the
+        # operator opted into via config.pass_env (values read from the parent env, so secret
+        # values never live in config). The allowlist/pass_env pass comes last, so passing an
+        # XDG var through naturally overrides its default (bwrap --setenv is last-wins).
+        cmd += [
+            "--clearenv",
+            "--setenv",
+            "XDG_CONFIG_HOME",
+            "/tmp/.config",
+            "--setenv",
+            "XDG_CACHE_HOME",
+            "/tmp/.cache",
+            "--setenv",
+            "XDG_DATA_HOME",
+            "/tmp/.local/share",
+            "--setenv",
+            "XDG_STATE_HOME",
+            "/tmp/.local/state",
+        ]
+        for _k, _v in os.environ.items():
+            if _k in _ENV_ALLOWLIST or _k in self.config.pass_env or _k.startswith("LC_"):
+                cmd += ["--setenv", _k, _v]
+
+        # Basic filesystem
+        cmd += ["--tmpfs", "/tmp", "--proc", "/proc", "--dev", "/dev"]
+
+        # System read-only binds
+        for sys_dir in ["/usr", "/lib", "/lib64", "/bin", "/sbin", "/etc/ssl", "/etc/resolv.conf"]:
+            p = Path(sys_dir)
+            if p.exists():
+                cmd += ["--ro-bind", sys_dir, sys_dir]
+
+        # CA certificates: resolve symlinks to find the real path (varies by distro).
+        # Check both bundle files and the cert.pem symlink (Arch/EndeavourOS uses
+        # /etc/ssl/cert.pem -> /etc/ca-certificates/extracted/tls-ca-bundle.pem).
+        for cert_path in [
+            "/etc/ssl/cert.pem",
+            "/etc/ssl/certs/ca-certificates.crt",
+            "/etc/ssl/certs/ca-bundle.crt",
+            "/etc/pki/tls/certs/ca-bundle.crt",
+        ]:
+            p = Path(cert_path)
+            if p.exists():
+                real = p.resolve().parent
+                if real.exists() and not any(str(real).startswith(d) for d in ["/usr", "/etc/ssl"]):
+                    cmd += ["--ro-bind", str(real), str(real)]
+                break
+
+        # Python venv (read-only)
+        venv_path = Path(sys.prefix)
+        if venv_path.exists():
+            cmd += ["--ro-bind", str(venv_path), str(venv_path)]
+
+        # If venv is a symlink or different from base prefix, bind base too
+        base_prefix = Path(sys.base_prefix)
+        if base_prefix != venv_path and base_prefix.exists():
+            cmd += ["--ro-bind", str(base_prefix), str(base_prefix)]
+
+        # Editable installs: venv .pth files reference the project source directory.
+        # Bind all sys.path entries so imports work inside the sandbox.
+        bound = {str(venv_path), str(base_prefix), str(self.workspace_dir)}
+        for p in sys.path:
+            if not p or p in bound:
+                continue
+            pp = Path(p)
+            if pp.exists() and str(pp) not in bound:
+                cmd += ["--ro-bind", str(pp), str(pp)]
+                bound.add(str(pp))
+
+        # Project/workspace directory (read-write)
+        cmd += ["--bind", str(self.workspace_dir), str(self.workspace_dir)]
+
+        # State directory for harness files (read-write)
+        if self.state_dir:
+            cmd += ["--bind", str(self.state_dir), str(self.state_dir)]
+
+        if self._use_proxy:
+            cmd += ["--ro-bind", str(self.proxy_socket), "/run/proxy.sock"]
+
+        # Extra binds
+        for path in self.config.extra_ro_binds:
+            if path.exists():
+                cmd += ["--ro-bind", str(path), str(path)]
+        for path in self.config.extra_rw_binds:
+            if path.exists():
+                cmd += ["--bind", str(path), str(path)]
+
+        # Working directory
+        cmd += ["--chdir", str(self.workspace_dir)]
+
+        if self._use_proxy:
+            scripts_dir = self.state_dir or Path("/tmp")
+
+            # Write bridge + SSH proxy scripts (state_dir is bind-mounted into sandbox)
+            bridge_path = scripts_dir / "_bridge.py"
+            bridge_path.write_text(_TCP_UDS_BRIDGE)
+            ssh_proxy_path = scripts_dir / "_ssh_proxy.py"
+            ssh_proxy_path.write_text(_SSH_PROXY_CONNECT)
+
+            cmd += [
+                "--setenv",
+                "HTTP_PROXY",
+                "http://127.0.0.1:12345",
+                "--setenv",
+                "HTTPS_PROXY",
+                "http://127.0.0.1:12345",
+                # Lowercase variants too (curl/libcurl and many tools only read these).
+                "--setenv",
+                "http_proxy",
+                "http://127.0.0.1:12345",
+                "--setenv",
+                "https_proxy",
+                "http://127.0.0.1:12345",
+                # Don't route loopback (incl. the in-sandbox bridge) through the egress proxy.
+                "--setenv",
+                "NO_PROXY",
+                "localhost,127.0.0.1,::1",
+                "--setenv",
+                "no_proxy",
+                "localhost,127.0.0.1,::1",
+                "--setenv",
+                "GIT_SSH_COMMAND",
+                f"ssh -o StrictHostKeyChecking=accept-new -o ProxyCommand='python3 {ssh_proxy_path} %h %p'",
+            ]
+            actual_cmd = shlex.join(inner_cmd)
+            # Start bridge in background, wait for it to bind, then run harness
+            cmd += [
+                "sh",
+                "-c",
+                f"python3 {bridge_path} & sleep 0.1; exec {actual_cmd}",
+            ]
+        else:
+            cmd += inner_cmd
+
+        return cmd
+
+    @staticmethod
+    def check_available() -> bool:
+        """Check if bwrap is installed."""
+        return shutil.which("bwrap") is not None