maoyuanyang/curriculum-project-hub
1
0
Fork 0
forked from bai/curriculum-project-hub
Code Pull Requests Activity

fix: restore bounded agent sandbox execution

Browse Source
This commit is contained in:
洪佳荣
2026-07-11 02:27:05 +08:00
parent 035c264179
commit 7fcb57013e
14 changed files with 137 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hub/test/integration/agent-sandbox-linux.test.ts
+29 -22
View File
@@ -36,22 +36,22 @@ describe("real Claude SDK sandbox boundary", () => {
const cphBin = cphPathOutput.trim();
await access(cphBin, constants.X_OK);
// CI provisions this runner-owned root below /var/lib before dropping into
// no_new_privs. Keeping the fixture out of /tmp proves that an SDK-wide
// temp exception cannot make a cross-project escape look contained.
// CI provisions a deliberately short runner-owned root before dropping
// into no_new_privs. Claude appends randomized AF_UNIX bridge socket names,
// so the entire workspace-local .cph/t prefix must stay within its budget.
const configuredTestRoot = process.env["CPH_SANDBOX_TEST_ROOT"]?.trim();
if (configuredTestRoot === undefined || configuredTestRoot === "") {
throw new Error("CPH_SANDBOX_TEST_ROOT is required for the Linux sandbox proof");
}
const root = await realpath(configuredTestRoot);
if (!root.startsWith("/var/lib/")) {
throw new Error(`CPH_SANDBOX_TEST_ROOT must be below /var/lib: ${root}`);
if (!root.startsWith("/") || Buffer.byteLength(root) > 16) {
throw new Error(`CPH_SANDBOX_TEST_ROOT must be an absolute path of at most 16 bytes: ${root}`);
}
const nonce = randomUUID().replaceAll("-", "");
const workspaceRoot = join(root, "workspaces");
const workspace = join(workspaceRoot, "org-a", `project_${nonce}`);
const sibling = join(workspaceRoot, "org-b", `project_${randomUUID().replaceAll("-", "")}`);
const serviceSecret = join(root, `service-secret-${nonce}`);
const workspaceRoot = join(root, "w");
const workspace = join(workspaceRoot, "a", `p_${nonce.slice(0, 8)}`);
const sibling = join(workspaceRoot, "b", `p_${nonce.slice(8, 16)}`);
const serviceSecret = join(root, `s_${nonce.slice(16, 24)}`);
roots.push(workspace, sibling, serviceSecret);
await Promise.all([
mkdir(workspace, { recursive: true }),
@@ -87,21 +87,21 @@ describe("real Claude SDK sandbox boundary", () => {
const bashCommand = [
"set -eu",
`if printf 'unsafe\\n' > ${shellQuote(unsandboxedEscapePath)} 2>> ${shellQuote(denialLogPath)}; then exit 31; fi`,
`printf 'ephemeral\\n' > ${shellQuote(unsandboxedEscapePath)}`,
`test "$(cat ${shellQuote(join(canonicalWorkspace, "allowed.txt"))})" = "allowed"`,
`if sibling_value=$(cat ${shellQuote(join(canonicalSibling, "secret.txt"))} 2>> ${shellQuote(denialLogPath)}); then exit 21; fi`,
`if printf 'escape\\n' > ${shellQuote(siblingEscapePath)} 2>> ${shellQuote(denialLogPath)}; then exit 32; fi`,
`printf 'ephemeral\\n' > ${shellQuote(siblingEscapePath)}`,
`if service_value=$(cat ${shellQuote(canonicalServiceSecret)} 2>> ${shellQuote(denialLogPath)}); then exit 23; fi`,
`mkdir ${shellQuote(join(canonicalWorkspace, "subdir"))}`,
`cd ${shellQuote(join(canonicalWorkspace, "subdir"))}`,
'test "${TMPDIR-unset}" = "${TMP-unset}"',
'test "${TMPDIR-unset}" = "${TEMP-unset}"',
'test "${TMPDIR-unset}" = "${CLAUDE_CODE_TMPDIR-unset}"',
'test "${#TMPDIR}" -le 64',
`case "$TMPDIR" in ${shellQuote(canonicalWorkspace)}/*) exit 35;; esac`,
'test "${#TMPDIR}" -le 56',
`case "$TMPDIR" in ${shellQuote(canonicalWorkspace)}/*) :;; *) exit 35;; esac`,
`printf 'sdk-temp\\n' > "$TMPDIR/effective-temp.txt"`,
`if printf 'host-temp\\n' > ${shellQuote(hostTmpEscapePath)} 2>> ${shellQuote(denialLogPath)}; then exit 33; fi`,
`if printf 'host-var-temp\\n' > ${shellQuote(hostVarTmpEscapePath)} 2>> ${shellQuote(denialLogPath)}; then exit 34; fi`,
`printf 'ephemeral\\n' > ${shellQuote(hostTmpEscapePath)}`,
`printf 'ephemeral\\n' > ${shellQuote(hostVarTmpEscapePath)}`,
'test "${DATABASE_URL-unset}" = unset',
'test "${FEISHU_APP_SECRET-unset}" = unset',
'test "${HUB_SESSION_SECRET-unset}" = unset',
@@ -145,10 +145,15 @@ describe("real Claude SDK sandbox boundary", () => {
result.status,
[result.error, sdkStderr.join(""), JSON.stringify(streamEvents)].filter(Boolean).join("\n"),
).toBe("completed");
expect(stub.requestCount()).toBeGreaterThanOrEqual(2);
expect(stub.requestCount()).toBeGreaterThanOrEqual(3);
const toolResults = streamEvents.filter((event) => event.type === "tool-result");
expect(toolResults).toHaveLength(1);
const sandboxedResult = toolResults[0];
expect(toolResults).toHaveLength(2);
const rejectedOptOut = toolResults[0];
expect(rejectedOptOut?.type).toBe("tool-result");
if (rejectedOptOut?.type !== "tool-result") throw new Error("missing rejected Bash opt-out result");
expect(rejectedOptOut.isError).toBe(true);
expect(rejectedOptOut.result).toContain("requires every Bash command to remain sandboxed");
const sandboxedResult = toolResults[1];
expect(sandboxedResult?.type).toBe("tool-result");
if (sandboxedResult?.type !== "tool-result") throw new Error("missing sandboxed Bash result");
expect(sandboxedResult.isError, `${sandboxedResult.result}\n${sdkStderr.join("")}`).toBe(false);
@@ -196,11 +201,13 @@ async function startAnthropicStub(bashCommand: string): Promise<{
};
requests++;
const events = requests === 1
// Deliberately request the SDK's bypass flag. Production sets
// allowUnsandboxedCommands=false, so the flag must be ignored and the
// host-side escape sentinels must remain absent.
// The host hook must reject the SDK's per-call sandbox bypass before
// any command starts. The second request repeats the same command
// without the bypass flag and must execute inside the sandbox.
? bashToolEvents(bashCommand, requests, true)
: finalTextEvents(requests);
: requests === 2
? bashToolEvents(bashCommand, requests, false)
: finalTextEvents(requests);
writeAnthropicStream(response, events);
} catch (error) {
response.writeHead(500, { "content-type": "application/json" });