Harden runtime source isolation

Author: chubes4

.github/scripts/run-agent-task/execute-native-agent-task.mjs

@@ -196,6 +196,19 @@ const runtimeInputPath = join(workspace, ".codebox", "native-agent-task-input.js
 const resultPath = join(workspace, ".codebox", "agent-task-workflow-result.json")
 const controlledCodeboxPath = resolve(requestPath, "..")
 const nativeResultPath = join(controlledCodeboxPath, "native-agent-task-result.json")
+let privateRuntimeSourceRoot = ""
+let cleaningPrivateRuntimeSources = false
+async function cleanupPrivateRuntimeSources() {
+  if (cleaningPrivateRuntimeSources || !privateRuntimeSourceRoot) return
+  cleaningPrivateRuntimeSources = true
+  const root = privateRuntimeSourceRoot
+  privateRuntimeSourceRoot = ""
+  await rm(root, { recursive: true, force: true })
+}
+process.once("exit", () => { if (privateRuntimeSourceRoot) rmSync(privateRuntimeSourceRoot, { recursive: true, force: true }) })
+for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) {
+  process.once(signal, () => { cleanupPrivateRuntimeSources().finally(() => process.exit(128)) })
+}
 const runnerWorkspaceTools = [
   "workspace-read", "workspace-ls", "workspace-grep", "workspace-write", "workspace-edit", "workspace-apply-patch",
   "workspace-git-status", "workspace-git-diff", "workspace-git-add", "workspace-git-commit", "workspace-git-push",
@@ -223,9 +236,9 @@ const materializedPackage = request.run_agent && !request.dry_run
   ? await materializeExternalNativePackage(externalPackageSource, { policy: externalPackagePolicy })
   : undefined
 const materializedRuntimeSources = request.run_agent && !request.dry_run
-  ? await materializeRuntimeSources(runtimeSources, { policy: externalPackagePolicy })
+  ? await materializeRuntimeSources(runtimeSources, { policy: externalPackagePolicy, forbiddenRoots: [workspace, artifactsPath] })
   : undefined
-process.once("exit", () => { if (materializedRuntimeSources?.root) rmSync(materializedRuntimeSources.root, { recursive: true, force: true }) })
+privateRuntimeSourceRoot = materializedRuntimeSources?.root ?? ""
 const runtimeSourceInputs = (materializedRuntimeSources?.lowered ?? []).reduce((input, lowered) => {
   for (const [key, entries] of Object.entries(lowered)) input[key] = [...(input[key] ?? []), ...entries]
   return input
@@ -276,7 +289,7 @@ const taskInput = {
         artifact_declarations: request.artifacts?.declarations || [],
         required_artifacts: request.artifacts?.expected || [],
         output_projections: [],
-        metadata: { workload: request.workload, ...(materializedPackage ? { imported_agent: materializedPackage.identity } : {}), runtime_sources: materializedRuntimeSources?.descriptors.map(({ metadata, ...provenance }) => ({ ...provenance, metadata })) ?? [] },
+        metadata: { workload: request.workload, ...(materializedPackage ? { imported_agent: materializedPackage.identity } : {}), runtime_sources: materializedRuntimeSources?.descriptors ?? [] },
       },
     },
   },
@@ -296,7 +309,7 @@ const runtimeResult = request.run_agent && !request.dry_run
   ? await readNativeResult(nativeResultPath, controlledCodeboxPath, secretValues, redact)
   : {}
 await rm(nativeResultPath, { force: true })
-await rm(materializedRuntimeSources?.root ?? "", { recursive: true, force: true })
+await cleanupPrivateRuntimeSources()
 
 await redactArtifactFiles(artifactsPath)
 

.github/scripts/run-agent-task/materialize-external-native-package.mjs

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto"
 import { mkdtemp, rm, mkdir, writeFile } from "node:fs/promises"
 import { tmpdir } from "node:os"
-import { join } from "node:path"
+import { isAbsolute, join, relative, resolve } from "node:path"
 import { spawn } from "node:child_process"
 
 const REPOSITORY = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/
@@ -178,6 +178,7 @@ export async function materializeRuntimeSources(sources, options = {}) {
   const descriptors = normalizeRuntimeSources(sources, options.policy)
   const root = await mkdtemp(join(options.tempRoot ?? tmpdir(), "wp-codebox-runtime-sources-"))
   try {
+    assertPrivateRuntimeRoot(root, options.forbiddenRoots)
     const lowered = []
     for (const [index, descriptor] of descriptors.entries()) {
       const checkout = join(root, `source-${index}`)
@@ -189,25 +190,42 @@ export async function materializeRuntimeSources(sources, options = {}) {
       await run("git", ["-c", "credential.helper=", "-c", "http.extraHeader=", "fetch", "--depth=1", "origin", descriptor.revision], { cwd: checkout, env: environment })
       const commit = (await run("git", ["rev-parse", "FETCH_HEAD^{commit}"], { cwd: checkout, env: environment })).toString("utf8").trim().toLowerCase()
       if (commit !== descriptor.revision) throw new Error("Runtime source revision did not resolve to the requested immutable commit.")
-      const objectType = (await run("git", ["cat-file", "-t", `${descriptor.revision}:${descriptor.path}`], { cwd: checkout, env: environment })).toString("utf8").trim()
+      const sourceObject = descriptor.path === "." ? `${descriptor.revision}^{tree}` : `${descriptor.revision}:${descriptor.path}`
+      const objectType = (await run("git", ["cat-file", "-t", sourceObject], { cwd: checkout, env: environment })).toString("utf8").trim()
       if (objectType !== "tree") throw new Error("Runtime source path must identify a directory.")
-      const entries = (await run("git", ["ls-tree", "-r", "-z", descriptor.revision, "--", descriptor.path], { cwd: checkout, env: environment })).toString("utf8").split("\0").filter(Boolean)
+      const entries = (await run("git", descriptor.path === "." ? ["ls-tree", "-r", "-z", descriptor.revision] : ["ls-tree", "-r", "-z", descriptor.revision, "--", descriptor.path], { cwd: checkout, env: environment })).toString("utf8").split("\0").filter(Boolean)
       if (entries.length === 0 || entries.some((entry) => !/^100(?:644|755)\s+blob\s+[0-9a-f]{40}\t/.test(entry))) throw new Error("Runtime source must contain only regular files; symlinks and special files are rejected.")
-      const archive = await run("git", ["archive", "--format=tar", descriptor.revision, descriptor.path], { cwd: checkout, env: environment })
+      const archive = await run("git", descriptor.path === "." ? ["archive", "--format=tar", descriptor.revision] : ["archive", "--format=tar", descriptor.revision, descriptor.path], { cwd: checkout, env: environment })
       if (descriptor.digest && sha256GitArchiveV1(archive) !== descriptor.digest) throw new Error("Runtime source archive digest does not match the trusted descriptor.")
       await mkdir(source, { recursive: true })
       const archivePath = join(checkout, "source.tar")
       await writeFile(archivePath, archive)
       await run("tar", ["-xf", archivePath, "-C", source], { cwd: checkout, env: environment })
-      const materializedPath = join(source, descriptor.path)
+      const materializedPath = descriptor.path === "." ? source : join(source, descriptor.path)
       lowered.push(lowerRuntimeSource(descriptor, materializedPath))
     }
-    return { root, descriptors, lowered }
+    return { root, descriptors: descriptors.map(runtimeSourceProvenance), lowered }
   } catch (error) { await rm(root, { recursive: true, force: true }); throw error }
 }
 
+export function runtimeSourceProvenance(descriptor) {
+  return { role: descriptor.role, repository: descriptor.repository, revision: descriptor.revision, path: descriptor.path, ...(descriptor.digest ? { digest: descriptor.digest } : {}) }
+}
+
+export function assertPrivateRuntimeRoot(root, forbiddenRoots = []) {
+  const privateRoot = resolve(root)
+  for (const forbiddenRoot of forbiddenRoots) {
+    if (!forbiddenRoot) continue
+    const boundary = resolve(forbiddenRoot)
+    const path = relative(boundary, privateRoot)
+    if (privateRoot === boundary || (!path.startsWith(`..${String.fromCharCode(47)}`) && path !== ".." && !isAbsolute(path))) {
+      throw new Error("Runtime sources must be materialized outside target workspaces and artifacts.")
+    }
+  }
+}
+
 export function lowerRuntimeSource(descriptor, source) {
-  const provenance = { role: descriptor.role, repository: descriptor.repository, revision: descriptor.revision, path: descriptor.path, ...(descriptor.digest ? { digest: descriptor.digest } : {}) }
+  const provenance = runtimeSourceProvenance(descriptor)
   if (descriptor.role === "component") return { component_contracts: [{ path: source, ...descriptor.metadata, metadata: { runtime_source: provenance } }] }
   if (descriptor.role === "provider_plugin") return { provider_plugin_paths: [source], provider_plugins: [{ source, ...descriptor.metadata, metadata: { runtime_source: provenance } }] }
   return { runtime_overlays: [{ kind: "bundled-library", source, ...descriptor.metadata, metadata: { runtime_source: provenance } }] }

.github/scripts/run-agent-task/prepare-agent-task-upload.mjs

@@ -8,12 +8,16 @@ const workspace = resolve(process.env.AGENT_TASK_WORKSPACE || process.cwd())
 const uploadPath = resolve(process.env.AGENT_TASK_UPLOAD_PATH || join(workspace, ".codebox", "agent-task-upload"))
 const requestPath = resolve(process.env.AGENT_TASK_REQUEST_PATH || join(workspace, ".codebox", "agent-task-request.json"))
 const secretValues = ["OPENAI_API_KEY", "MODEL_PROVIDER_SECRET_1", "MODEL_PROVIDER_SECRET_2", "MODEL_PROVIDER_SECRET_3", "MODEL_PROVIDER_SECRET_4", "MODEL_PROVIDER_SECRET_5", "GITHUB_TOKEN", "GH_TOKEN", "ACCESS_TOKEN", "EXTERNAL_PACKAGE_SOURCE_POLICY"].map((name) => process.env[name]).filter(Boolean)
+const runtimeSourceRoot = process.env.WP_CODEBOX_RUNTIME_SOURCE_ROOT ? resolve(process.env.WP_CODEBOX_RUNTIME_SOURCE_ROOT) : ""
 
 function redact(value) {
   return secretValues.reduce((output, secret) => output.split(secret).join("[REDACTED]"), value)
 }
 
 async function stageFile(source, destination) {
+  if (runtimeSourceRoot && resolve(source).startsWith(runtimeSourceRoot)) {
+    throw new Error("Runtime source files must never be staged for artifact upload.")
+  }
   const metadata = await lstat(source).catch(() => null)
   if (!metadata?.isFile() || metadata.size > MAX_UPLOAD_FILE_BYTES) return false
   const handle = await open(source, constants.O_RDONLY | constants.O_NOFOLLOW).catch(() => null)
@@ -23,7 +27,9 @@ async function stageFile(source, destination) {
   await handle.close()
   if (!contents || contents.includes(0) || !isUtf8(contents)) return false
   await mkdir(resolve(destination, ".."), { recursive: true })
-  await writeFile(destination, redact(contents.toString("utf8")))
+  const text = contents.toString("utf8")
+  if (runtimeSourceRoot && text.includes(runtimeSourceRoot)) throw new Error("Runtime source paths must never be persisted in artifact uploads.")
+  await writeFile(destination, redact(text))
   return true
 }
 

.github/workflows/agent-task-contracts.yml

@@ -10,6 +10,7 @@ on:
       - "contracts/run-agent-task-reusable-workflow-interface.v1.json"
       - "docs/agent-task-reusable-workflow.md"
       - "fixtures/agent-task-reusable-workflow-consumer*.yml"
+      - "fixtures/agent-task-runtime-sources-run-29299109269.json"
       - "package-lock.json"
       - "package.json"
       - "tests/agent-task-*.test.ts"
@@ -26,6 +27,7 @@ on:
       - "contracts/run-agent-task-reusable-workflow-interface.v1.json"
       - "docs/agent-task-reusable-workflow.md"
       - "fixtures/agent-task-reusable-workflow-consumer*.yml"
+      - "fixtures/agent-task-runtime-sources-run-29299109269.json"
       - "package-lock.json"
       - "package.json"
       - "tests/agent-task-*.test.ts"

.github/workflows/run-agent-task.yml

@@ -283,6 +283,7 @@ jobs:
           AGENT_TASK_WORKSPACE: ${{ github.workspace }}/workspace
           AGENT_TASK_REQUEST_PATH: ${{ github.workspace }}/.codebox/agent-task-request.json
           AGENT_TASK_UPLOAD_PATH: ${{ github.workspace }}/workspace/.codebox/agent-task-upload
+          WP_CODEBOX_RUNTIME_SOURCE_ROOT: ${{ runner.temp }}/wp-codebox-runtime-sources-
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
           MODEL_PROVIDER_SECRET_1: ${{ secrets.MODEL_PROVIDER_SECRET_1 }}
           MODEL_PROVIDER_SECRET_2: ${{ secrets.MODEL_PROVIDER_SECRET_2 }}

tests/runtime-sources-materialization.test.ts

@@ -35,6 +35,9 @@ await withTempDir("wp-codebox-runtime-sources-", async (repository) => {
   assert.equal(materialized.lowered[1].provider_plugins[0].slug, "example-provider")
   assert.equal(materialized.lowered[2].runtime_overlays[0].strategy, "scoped-bundle")
   assert.ok(relative(repository, materialized.root).startsWith(".."), "sources are outside the target workspace")
+  assert.deepEqual(Object.keys(materialized.descriptors[0]).sort(), ["path", "repository", "revision", "role"])
+  await mkdir(join(repository, "artifacts"), { recursive: true })
+  await assert.rejects(materializeRuntimeSources(sources, { policy, remotes: { "example/runtime": repository }, tempRoot: join(repository, "artifacts"), forbiddenRoots: [repository] }), /outside target workspaces and artifacts/)
   const loweredInput = materialized.lowered.reduce((input, lowered) => {
     for (const [key, entries] of Object.entries(lowered)) (input as Record<string, unknown[]>)[key] = [...((input as Record<string, unknown[]>)[key] ?? []), ...(entries as unknown[])]
     return input
@@ -56,4 +59,25 @@ await withTempDir("wp-codebox-runtime-sources-", async (repository) => {
   await rm(materialized.root, { recursive: true, force: true })
 })
 
+await withTempDir("wp-codebox-runtime-source-upload-", async (directory) => {
+  const workspace = join(directory, "workspace")
+  const artifacts = join(workspace, ".codebox", "agent-task-artifacts")
+  const upload = join(workspace, ".codebox", "agent-task-upload")
+  const privateRoot = join(directory, "private-runtime-source")
+  await mkdir(artifacts, { recursive: true })
+  await mkdir(privateRoot, { recursive: true })
+  await writeFile(join(privateRoot, "source.php"), "<?php // private runtime source\n")
+  await writeFile(join(artifacts, "safe.json"), JSON.stringify({ provenance: { role: "component", repository: "example/runtime", revision: "a".repeat(40), path: "plugin" } }))
+  const script = new URL("../.github/scripts/run-agent-task/prepare-agent-task-upload.mjs", import.meta.url)
+  await execFileAsync(process.execPath, [script.pathname], { env: { ...process.env, AGENT_TASK_WORKSPACE: workspace, AGENT_TASK_UPLOAD_PATH: upload, WP_CODEBOX_RUNTIME_SOURCE_ROOT: privateRoot } })
+  const staged = await readFile(join(upload, ".codebox", "agent-task-artifacts", "safe.json"), "utf8")
+  assert.doesNotMatch(staged, /private-runtime-source|private runtime source/)
+  await writeFile(join(artifacts, "leak.json"), privateRoot)
+  await assert.rejects(execFileAsync(process.execPath, [script.pathname], { env: { ...process.env, AGENT_TASK_WORKSPACE: workspace, AGENT_TASK_UPLOAD_PATH: upload, WP_CODEBOX_RUNTIME_SOURCE_ROOT: privateRoot } }), /Runtime source paths must never be persisted/)
+})
+
+const executor = await readFile(new URL("../.github/scripts/run-agent-task/execute-native-agent-task.mjs", import.meta.url), "utf8")
+assert.match(executor, /for \(const signal of \["SIGINT", "SIGTERM", "SIGHUP"\]\)/)
+assert.match(executor, /cleanupPrivateRuntimeSources\(\)\.finally\(\(\) => process\.exit\(128\)\)/)
+
 console.log("runtime sources materialization ok")