antcolony

6.7 KB

1. // sandbox.hl — antcolony#18 "Each worker in its own sealed box".
2. //
3. // A Claude session (worker, finalize, resume, controller) runs inside a bubblewrap (`bwrap`) box instead of with the
4. // host user's whole filesystem. The box is an ALLOWLIST: the system (ro), the claude binary + login (its config folder),
5. // the project's dev folder (rw), the dev folders of the projects it depends on + the concept docs (ro), a private /tmp.
6. // Everything else on the host — other projects, ~/.config/antcolony (tokens), ~/.ssh, other users' files, `.env` files,
7. // the scheduler's runs/logs/sessions — is not there. The network is shared (Claude API, the tickets copy, dev servers on
8. // the session's ports).
9. //
10. // DEPLOY RIGHTS: only a ticket marked for deploy gets more — the project's live folder (rw) and ~/.ssh (ro). The mark is a
11. // line `colony-deploy: yes` in the ticket's opening text or in a comment of the creator (`deployMarked`).
12. //
13. // COLONY_SANDBOX = on (default) | off (off = the old behaviour, host access; the e2e uses it for the fake claude)
14. // COLONY_SANDBOX_RO = extra read-only paths, `:`-separated (default: the docs folder /media/STORAGE/projects/antcolony-docs)
15. import { env } from 'hl:proc'
16. import { exists, listDir } from 'hl:fs'
17. import { loadRegistry } from './registry.hl'
18. import { isCreatorEvent } from './tickets.hl'
19. import { NL } from './util.hl'
21. static BWRAP = '/usr/bin/bwrap'
22. static DEFAULT_RO = '/media/STORAGE/projects/antcolony-docs'
23. static MARK = 'colony-deploy: yes'
25. static sandboxOn = () => {
26. let v = env('COLONY_SANDBOX')
27. return !(v == 'off' || v == '0' || v == 'no' || v == 'false')
28. }
30. // is a ticket marked for deploy? ticket = the row (its summary is the opening text), events = its history; a mark counts
31. // from the opening text or from a comment of the creator (a worker can never write a comment itself — the scheduler posts what it reports, and
32. // that text is not looked at).
33. static hasMark = (text) => {
34. if (text == null) { return false }
35. for (line of text.split(NL)) { if (line.trim() == MARK) { return true } }
36. return false
37. }
38. static deployMarked = (project, ticket, events, creatorNames) => {
39. if (ticket != null && hasMark(ticket.summary)) { return true }
40. if (events == null) { return false }
41. for (e of events) {
42. if (e.kind == 'comment' && isCreatorEvent(project, e, creatorNames) && hasMark(e.text)) { return true }
43. }
44. return false
45. }
47. // a dev/live folder of a project that lives on THIS host → its path, else null
48. static localFolder = (where, host) => {
49. if (where == null || where.folder == null || where.folder == '') { return null }
50. if (where.host != null && where.host != '' && where.host.toLowerCase() != host.toLowerCase()) { return null }
51. return exists(where.folder) ? where.folder : null
52. }
54. // the absolute paths a concept text names (`loreana:/media/x/README.md + docs/y.md + /media/x/z.md`)
55. static conceptPaths = (concept) => {
56. let out = []
57. if (concept == null) { return out }
58. for (w of concept.split(' ')) {
59. let t = w.startsWith('loreana:') ? w.slice(8) : w
60. if (t.startsWith('/') && exists(t)) { out.push(t) }
61. }
62. return out
63. }
65. static add2 = (a, x, y) => {
66. a.push(x)
67. a.push(y)
68. return a
69. }
70. static add3 = (a, x, y, z) => {
71. a.push(x)
72. a.push(y)
73. a.push(z)
74. return a
75. }
76. static tmpfs = (a, path) => {
77. a.push('--tmpfs')
78. a.push(path)
79. return a
80. }
81. static bindRo = (a, path) => { return add3(a, '--ro-bind-try', path, path) }
82. static bindRw = (a, path) => { return add3(a, '--bind-try', path, path) }
84. // `.env*` files (not the examples) directly inside a folder are replaced by an empty file
85. static maskEnvFiles = (a, folder) => {
86. for (n of listDir(folder)) {
87. let f = hlTypeName(n) == 'String' ? n : n.name
88. if (f == '.env' || (f.startsWith('.env.') && !f.endsWith('.example'))) {
89. add3(a, '--ro-bind', '/dev/null', folder + '/' + f)
90. }
91. }
92. }
94. // → { args: [bwrap … --], error: null } — the argv prefix before the command; args = [] when the sandbox is off.
95. // o = { project, folder (the session's cwd = the dev folder), host, deploy (bool), extraRo: [paths], ports? }
96. static sandboxFor = (o) => {
97. if (!sandboxOn()) { return { args = [] error = null } }
98. if (!exists(BWRAP)) { return { args = [] error = 'the sandbox needs ' + BWRAP + ' (bubblewrap) — install it, or set COLONY_SANDBOX=off to run without a box' } }
99. let home = env('HOME')
100. if (home == null || home == '') { return { args = [] error = 'the sandbox needs HOME' } }
101. let cfg = env('CLAUDE_CONFIG_DIR')
102. let reg = loadRegistry()
103. let m = reg.projects[o.project]
104. let a = [BWRAP '--die-with-parent' '--unshare-pid' '--unshare-ipc' '--unshare-uts' '--new-session']
105. // the system, read-only
106. for (p of ['/usr' '/bin' '/lib' '/lib64' '/sbin' '/etc' '/opt']) { bindRo(a, p) }
107. bindRo(a, '/sys')
108. a.push('--proc')
109. a.push('/proc')
110. a.push('--dev')
111. a.push('/dev')
112. for (p of ['/tmp' '/var' '/run']) { tmpfs(a, p) }
113. bindRo(a, '/run/systemd/resolve') // /etc/resolv.conf points there (DNS)
114. // home: empty, then only what claude and the toolchain need
115. tmpfs(a, home)
116. for (p of [home + '/.local/bin' home + '/.local/share/claude' home + '/.hybriel' home + '/.gitconfig']) { bindRo(a, p) }
117. if (cfg != null && cfg != '') {
118. bindRw(a, cfg)
119. } else {
120. bindRw(a, home + '/.claude')
121. bindRw(a, home + '/.claude.json')
122. }
123. // projects: an empty /media, then the project's own folder (rw), what it depends on + the concept docs (ro)
124. tmpfs(a, '/media')
125. let ro = []
126. if (m != null) {
127. for (d of m.deps) {
128. let dm = reg.projects[d]
129. let f = dm == null ? null : localFolder(dm.dev, o.host)
130. if (f != null && f != o.folder) { ro.push(f) }
131. }
132. for (c of conceptPaths(m.concept)) { if (c != o.folder && !c.startsWith(o.folder + '/')) { ro.push(c) } }
133. }
134. let extra = env('COLONY_SANDBOX_RO')
135. for (x of (extra == null || extra == '' ? DEFAULT_RO : extra).split(':')) { if (x != '' && exists(x)) { ro.push(x) } }
136. if (o.extraRo != null) { for (x of o.extraRo) { ro.push(x) } }
137. add3(a, '--bind', o.folder, o.folder)
138. maskEnvFiles(a, o.folder)
139. // the scheduler working on itself: no sight of other projects' runs, logs, sessions (briefs, reports, tokens' names)
140. let self = env('COLONY_HOME')
141. if (self != null && self == o.folder) {
142. for (n of ['runs' 'logs' 'sessions' 'briefs']) { if (exists(self + '/' + n)) { tmpfs(a, self + '/' + n) } }
143. }
144. for (x of ro) { bindRo(a, x) }
145. // a dependency's folder is read-only, but its secrets are not even there
146. for (x of ro) { if (exists(x + '/.env') || exists(x + '/.env.local')) { maskEnvFiles(a, x) } }
147. // deploy rights: only a ticket marked for deploy
148. if (o.deploy == true) {
149. let live = m == null ? null : localFolder(m.live, o.host)
150. if (live != null && live != o.folder) { bindRw(a, live) }
151. bindRo(a, home + '/.ssh')
152. }
153. for (n of ['COLONY_TOKEN_FILE' 'COLONY_CREATOR_TOKEN_FILE' 'COLONY_AGENT_TOKEN_FILE' 'COLONY_STOP_FILE']) { add2(a, '--unsetenv', n) }
154. add2(a, '--chdir', o.folder)
155. a.push('--')
156. return { args = a error = null }
157. }