Merge pull request #11603 from Kilo-Org/feat-macos-network-sandbox

feat(sandbox): enforce macOS network isolation

Author: marius-kilocode

.changeset/macos-network-sandbox.md

@@ -0,0 +1,6 @@
+---
+"@kilocode/cli": minor
+"kilo-code": minor
+---
+
+Block outbound network access from agent commands and in-process HTTP tools with the optional macOS sandbox, with a Sandboxing setting to allow network access when needed.

.github/workflows/check-opencode-annotations.yml

@@ -41,6 +41,9 @@ jobs:
       - name: Check Effect Promise facade allowlist
         run: bun run script/check-opencode-promise-facades.ts
 
+      - name: Check model tool network boundary
+        run: bun run script/check-model-tool-network.ts
+
       - name: Check workflow allowlist
         run: bun run script/check-workflows.ts
       # kilocode_change end

packages/kilo-docs/public/img/screenshot-tests/kilo-vscode/visual-regression/settings/sandboxing-panel-chromium-linux.png

@@ -14,7 +14,8 @@
   ],
   "scripts": {
     "typecheck": "tsgo --noEmit",
-    "test": "bun test --timeout 30000"
+    "test": "bun test --timeout 30000",
+    "test:ci": "mkdir -p .artifacts/unit && bun test --timeout 30000 --reporter=junit --reporter-outfile=.artifacts/unit/junit.xml"
   },
   "dependencies": {
     "effect": "catalog:"

packages/kilo-sandbox/package.json

@@ -2,6 +2,7 @@ import { Effect, PlatformError, Scope } from "effect"
 import { ChildProcess } from "effect/unstable/process"
 import { current } from "./context"
 import type { Profile } from "./profile"
+import { assertProcessNetwork, networkEnvironment } from "./network"
 import { seatbelt } from "./seatbelt"
 
 export interface Launch {
@@ -47,16 +48,18 @@ const backend = select()
 function environment(profile: Profile, launch: Launch) {
   const source = { ...launch.environment, ...profile.environment.set }
   const denied = new Set(profile.environment.deny)
-  return Object.fromEntries(
-    Object.entries(source).filter(([key, value]) => value !== undefined && !denied.has(key)),
-  ) as Record<string, string>
+  const entries = Object.entries(source).filter(
+    (entry): entry is [string, string] => entry[1] !== undefined && !denied.has(entry[0]),
+  )
+  return networkEnvironment(profile, Object.fromEntries(entries))
 }
 
 export function prepare(launch: Launch) {
   return Effect.gen(function* () {
     const profile = yield* current
     if (!profile) return launch
     const next = { ...launch, environment: environment(profile, launch) }
+    yield* assertProcessNetwork(profile, launch.command)
     if (!backend.support.available) return next
     return yield* backend.prepare(profile, next)
   })

packages/kilo-sandbox/src/backend.ts

@@ -1,4 +1,5 @@
 export type { Profile } from "./profile"
 export { assertWrite, enabled, run } from "./context"
 export { decorateFileSystem } from "./filesystem"
+export { assertNetwork, decorateHttpClient, httpLayer as networkHttpLayer } from "./network"
 export { prepareCommand } from "./backend"

packages/kilo-sandbox/src/index.ts

@@ -0,0 +1,89 @@
+import { Effect, Layer, PlatformError } from "effect"
+import { HttpClient, HttpClientError, type HttpClientRequest } from "effect/unstable/http"
+import { current } from "./context"
+import type { Profile } from "./profile"
+
+const proxies = new Set([
+  "HTTP_PROXY",
+  "HTTPS_PROXY",
+  "ALL_PROXY",
+  "NO_PROXY",
+  "http_proxy",
+  "https_proxy",
+  "all_proxy",
+  "no_proxy",
+])
+
+function target(value: string) {
+  if (!URL.canParse(value)) return value
+  const url = new URL(value)
+  return url.origin
+}
+
+function denied(value: string, method: string) {
+  return PlatformError.systemError({
+    _tag: "PermissionDenied",
+    module: "Sandbox",
+    method,
+    pathOrDescriptor: target(value),
+    description: "Sandbox denied outbound network access",
+  })
+}
+
+function unsupported(value: string, method: string) {
+  return PlatformError.systemError({
+    _tag: "BadResource",
+    module: "Sandbox",
+    method,
+    pathOrDescriptor: target(value),
+    description: "Sandbox proxy network mode and allowedHosts are not supported",
+  })
+}
+
+function unsupportedProfile(profile: Profile) {
+  return profile.network.mode === "proxy" || profile.network.allowedHosts.length > 0
+}
+
+export function networkEnvironment(profile: Profile, environment: Record<string, string>) {
+  if (profile.network.mode === "allow" && profile.network.allowedHosts.length === 0) return environment
+  return Object.fromEntries(Object.entries(environment).filter(([key]) => !proxies.has(key)))
+}
+
+export function assertProcessNetwork(profile: Profile, command: string) {
+  if (!unsupportedProfile(profile)) return Effect.void
+  return Effect.fail(unsupported(command, "prepareNetwork"))
+}
+
+export function assertNetwork(value: string, method = "network") {
+  return Effect.gen(function* () {
+    const profile = yield* current
+    if (!profile) return
+    if (unsupportedProfile(profile)) yield* Effect.fail(unsupported(value, method))
+    if (profile.network.mode === "allow") return
+    yield* Effect.fail(denied(value, method))
+  })
+}
+
+function requestError(request: HttpClientRequest.HttpClientRequest, description: string) {
+  return new HttpClientError.HttpClientError({
+    reason: new HttpClientError.TransportError({ request, description }),
+  })
+}
+
+function assertRequest(request: HttpClientRequest.HttpClientRequest) {
+  return Effect.gen(function* () {
+    const profile = yield* current
+    if (!profile) return request
+    if (profile.network.mode === "allow" && profile.network.allowedHosts.length === 0) return request
+    const description = unsupportedProfile(profile)
+      ? "Sandbox proxy network mode and allowedHosts are not supported"
+      : "Sandbox denied outbound network access"
+    return yield* Effect.fail(requestError(request, description))
+  })
+}
+
+export function decorateHttpClient(http: HttpClient.HttpClient): HttpClient.HttpClient {
+  return HttpClient.mapRequestEffect(http, assertRequest)
+}
+
+export const httpLayer = Layer.effect(HttpClient.HttpClient, Effect.map(HttpClient.HttpClient, decorateHttpClient))

packages/kilo-sandbox/src/network.ts

@@ -97,9 +97,7 @@ export const base = `(version 1)
   (local-name "com.apple.cfprefsd.agent"))
 (allow user-preference-read)
 
-; network is not confined by the file-level sandbox; allow it fully
-(allow network-outbound)
-(allow network-inbound)
+; system services required by common command-line runtimes
 (allow system-socket)
 (allow mach-lookup
   (global-name "com.apple.bsd.dirhelper")

packages/kilo-sandbox/src/seatbelt-base.ts

@@ -0,0 +1,12 @@
+import type { Profile } from "./profile"
+
+export function networkPolicy(profile: Profile) {
+  if (profile.network.mode === "allow") {
+    return "; sandbox network mode: allow\n(allow network-outbound)\n(allow network-inbound)"
+  }
+  return [
+    `; sandbox network mode: ${profile.network.mode}`,
+    '(deny network-outbound (with message "Sandbox denied outbound network access"))',
+    "(allow network-inbound)",
+  ].join("\n")
+}

packages/kilo-sandbox/src/seatbelt-network.ts

@@ -3,6 +3,7 @@ import { Effect } from "effect"
 import type { Backend, Launch, Support } from "./backend"
 import type { PathRule, Profile } from "./profile"
 import { base } from "./seatbelt-base"
+import { networkPolicy } from "./seatbelt-network"
 
 const executable = "/usr/bin/sandbox-exec"
 
@@ -47,7 +48,12 @@ function policy(profile: Profile) {
       ? ""
       : `(allow file-write*\n  (require-all\n    (require-any ${allow.join(" ")})\n    ${[...deny, ...names].join("\n    ")}\n  )\n)`
   return {
-    value: [base, "; reads are not confined by the file-level sandbox\n(allow file-read*)", write].join("\n"),
+    value: [
+      base,
+      networkPolicy(profile),
+      "; reads are not confined by the file-level sandbox\n(allow file-read*)",
+      write,
+    ].join("\n"),
     params,
   }
 }