fix: prove Linux Agent sandbox boundary

2026-07-10 17:59:56 +08:00
parent f4968d6657
commit f07f280b8f
19 changed files with 381 additions and 55 deletions
@@ -0,0 +1,115 @@
+const MAX_LOGGED_CHARS = 8_000;
+const MAX_LOGGED_LINES = 20;
+const MAX_LINE_CHARS = 2_000;
+const MAX_PENDING_LINE_CHARS = 16_000;
+
+interface DiagnosticLogger {
+  warn(bindings: Readonly<Record<string, unknown>>, message: string): void;
+}
+
+export interface AgentSdkStderrSink {
+  readonly write: (data: string) => void;
+  readonly flush: () => void;
+}
+
+/**
+ * Turn the SDK subprocess stderr stream into bounded, run-correlated logs.
+ * Complete lines are buffered so a credential split across chunks is still
+ * removed before anything reaches the logger.
+ */
+export function createAgentSdkStderrSink(input: {
+  readonly logger: DiagnosticLogger;
+  readonly runId: string;
+  readonly projectId: string;
+  readonly sensitiveValues: readonly (string | undefined)[];
+}): AgentSdkStderrSink {
+  const secrets = [...new Set(input.sensitiveValues.filter((value): value is string => value !== undefined && value !== ""))]
+    .sort((left, right) => right.length - left.length);
+  let pending = "";
+  let droppingOversizedLine = false;
+  let remainingChars = MAX_LOGGED_CHARS;
+  let remainingLines = MAX_LOGGED_LINES;
+  let limitReported = false;
+
+  const reportLimit = (): void => {
+    if (limitReported) return;
+    limitReported = true;
+    input.logger.warn(
+      { runId: input.runId, projectId: input.projectId },
+      "agent SDK stderr log limit reached; further diagnostics omitted",
+    );
+  };
+
+  const emit = (line: string): void => {
+    if (line.trim() === "") return;
+    if (remainingChars <= 0 || remainingLines <= 0) {
+      reportLimit();
+      return;
+    }
+    const redacted = redactDiagnostic(line, secrets);
+    const allowed = Math.min(MAX_LINE_CHARS, remainingChars);
+    const diagnostic = boundedDiagnostic(redacted, allowed);
+    remainingChars -= diagnostic.length;
+    remainingLines--;
+    input.logger.warn(
+      { runId: input.runId, projectId: input.projectId, sdkStderr: diagnostic },
+      "agent SDK stderr",
+    );
+    if (redacted.length > allowed || remainingChars <= 0 || remainingLines <= 0) reportLimit();
+  };
+
+  const append = (fragment: string): void => {
+    if (fragment === "" || droppingOversizedLine) return;
+    if (pending.length + fragment.length > MAX_PENDING_LINE_CHARS) {
+      pending = "";
+      droppingOversizedLine = true;
+      emit("[oversized stderr line omitted]");
+      return;
+    }
+    pending += fragment;
+  };
+
+  const write = (data: string): void => {
+    let lineStart = 0;
+    for (let index = 0; index < data.length; index++) {
+      const character = data[index];
+      if (character !== "\n" && character !== "\r") continue;
+      append(data.slice(lineStart, index));
+      if (!droppingOversizedLine) emit(pending);
+      pending = "";
+      droppingOversizedLine = false;
+      if (character === "\r" && data[index + 1] === "\n") index++;
+      lineStart = index + 1;
+    }
+    append(data.slice(lineStart));
+  };
+
+  const flush = (): void => {
+    if (droppingOversizedLine) {
+      droppingOversizedLine = false;
+    } else {
+      emit(pending);
+    }
+    pending = "";
+  };
+
+  return { write, flush };
+}
+
+function boundedDiagnostic(value: string, limit: number): string {
+  if (value.length <= limit) return value;
+  const marker = "…[truncated]";
+  if (limit <= marker.length) return marker.slice(0, limit);
+  return `${value.slice(0, limit - marker.length)}${marker}`;
+}
+
+function redactDiagnostic(value: string, secrets: readonly string[]): string {
+  let redacted = value;
+  for (const secret of secrets) redacted = redacted.replaceAll(secret, "[REDACTED]");
+  return redacted
+    .replace(/\u001B\[[0-?]*[ -/]*[@-~]/g, "")
+    .replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F]/g, " ")
+    .replace(/\b(postgres(?:ql)?):\/\/([^:\s/@]+):([^@\s]+)@/gi, "$1://$2:[REDACTED]@")
+    .replace(/\b((?:api[_-]?key|token|secret|password)\s*[:=]\s*)\S+/gi, "$1[REDACTED]")
+    .trim();
+}