enforce env-aware workspace reads

Author: eersnington

packages/agent-container/src/container.ts

@@ -153,8 +153,10 @@ export class LocalAgentContainer implements AgentContainer {
 export async function createAgentContainer(
   options: AgentContainerOptions,
 ): Promise<AgentContainer> {
-  const workspace = await LocalWorkspaceController.create(options.workspace, (event) =>
-    emitWithSink(options, event),
+  const workspace = await LocalWorkspaceController.create(
+    options.workspace,
+    (event) => emitWithSink(options, event),
+    { env: options.env },
   );
   const env = await resolveEnv(workspace.root, options.env);
   const exec = new LocalExecController({

packages/agent-container/src/workspace.ts

@@ -12,9 +12,11 @@ import {
   writeFile,
 } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { basename, dirname, join, resolve, sep } from "node:path";
+import { basename, dirname, join, matchesGlob, relative, resolve, sep } from "node:path";
 
 import type {
+  EnvPolicy,
+  EnvSource,
   MountAccessMode,
   ObservabilityEvent,
   WorkspaceController,
@@ -24,6 +26,14 @@ import type {
   WorkspaceSearchResult,
 } from "@agent-container/types";
 
+import {
+  filterEnvValues,
+  parseEnvFile,
+  type ResolvedEnvPolicy,
+  resolveEnvPolicy,
+  serializeEnvFile,
+} from "./env.js";
+
 interface MountBinding {
   mountPath: string;
   sourcePath: string;
@@ -41,6 +51,17 @@ function isWorkspaceWriteDeniedError(error: unknown): error is WorkspaceWriteDen
   return error instanceof Error && error.name === "WorkspaceWriteDeniedError";
 }
 
+class WorkspaceReadDeniedError extends Error {
+  public constructor(message: string) {
+    super(message);
+    this.name = "WorkspaceReadDeniedError";
+  }
+}
+
+function isWorkspaceReadDeniedError(error: unknown): error is WorkspaceReadDeniedError {
+  return error instanceof Error && error.name === "WorkspaceReadDeniedError";
+}
+
 type EmitEvent = (event: Omit<ObservabilityEvent, "timestamp">) => Promise<void>;
 
 function normalizeMountPath(value: string): string {
@@ -140,6 +161,19 @@ function entryKindFromStat(
   return "other";
 }
 
+function sourceLogicalPath(
+  root: string,
+  source: Extract<EnvSource, { type: "file" }>,
+): string | undefined {
+  const sourcePath = resolve(root, source.path);
+  const relativePath = relative(root, sourcePath);
+  if (relativePath === "" || relativePath.startsWith("..") || relativePath.startsWith(`..${sep}`)) {
+    return undefined;
+  }
+
+  return normalizeLogicalPath(relativePath.replace(/\\/gu, "/"));
+}
+
 export class LocalWorkspaceController implements WorkspaceController {
   public readonly root: string;
 
@@ -151,23 +185,40 @@ export class LocalWorkspaceController implements WorkspaceController {
 
   readonly #shadowRoot: string | undefined;
 
+  readonly #envPolicy: ResolvedEnvPolicy | undefined;
+
+  readonly #envSourcePaths: ReadonlySet<string>;
+
+  readonly #denyRead: readonly string[];
+
   private constructor(options: {
     root: string;
     mode: "live" | "shadow";
     mounts: readonly MountBinding[];
     shadowRoot?: string;
     emit?: EmitEvent;
+    envPolicy?: ResolvedEnvPolicy;
+    denyRead: readonly string[];
   }) {
     this.root = options.root;
     this.mode = options.mode;
     this.#mounts = options.mounts;
     this.#shadowRoot = options.shadowRoot;
     this.#emit = options.emit;
+    this.#envPolicy = options.envPolicy;
+    this.#denyRead = options.denyRead;
+    this.#envSourcePaths = new Set(
+      options.envPolicy?.sources
+        .filter((source): source is Extract<EnvSource, { type: "file" }> => source.type === "file")
+        .map((source) => sourceLogicalPath(options.root, source))
+        .filter((path): path is string => path !== undefined) ?? [],
+    );
   }
 
   public static async create(
     options: WorkspaceOptions,
     emit?: EmitEvent,
+    policy?: { env?: EnvPolicy },
   ): Promise<LocalWorkspaceController> {
     const workspaceRoot = resolve(options.root);
     const mode = options.mode ?? "live";
@@ -198,19 +249,37 @@ export class LocalWorkspaceController implements WorkspaceController {
     }
 
     mounts.sort((left, right) => right.mountPath.length - left.mountPath.length);
+    const envPolicy =
+      policy?.env === undefined ? undefined : await resolveEnvPolicy(activeRoot, policy.env);
 
     return new LocalWorkspaceController({
       root: activeRoot,
       mode,
       mounts,
       shadowRoot,
       emit,
+      envPolicy,
+      denyRead: options.denyRead ?? [],
     });
   }
 
   public async read(path: string): Promise<Uint8Array> {
     try {
       const target = await this.#resolveTarget(path);
+      const envContent = await this.#tryReadEnvSource(target);
+      if (envContent !== undefined) {
+        const content = Buffer.from(envContent, "utf8");
+        await this.#emitEvent({
+          scope: "workspace",
+          action: "read",
+          outcome: "success",
+          target: target.logicalPath,
+          detail: `${content.byteLength} bytes`,
+        });
+        return content;
+      }
+
+      await this.#assertReadable(target.logicalPath);
       const content = await readFile(target.physicalPath);
       await this.#emitEvent({
         scope: "workspace",
@@ -221,7 +290,9 @@ export class LocalWorkspaceController implements WorkspaceController {
       });
       return content;
     } catch (error) {
-      await this.#emitFailure("read", path, error);
+      if (!isWorkspaceReadDeniedError(error)) {
+        await this.#emitFailure("read", path, error);
+      }
       throw error;
     }
   }
@@ -359,7 +430,16 @@ export class LocalWorkspaceController implements WorkspaceController {
           continue;
         }
 
-        const content = await this.readText(path);
+        let content: string;
+        try {
+          content = await this.readText(path);
+        } catch (error) {
+          if (isWorkspaceReadDeniedError(error)) {
+            continue;
+          }
+
+          throw error;
+        }
         const lines = content.split(/\r?\n/u);
         for (const [index, line] of lines.entries()) {
           const haystack = caseSensitive ? line : line.toLowerCase();
@@ -484,6 +564,32 @@ export class LocalWorkspaceController implements WorkspaceController {
     };
   }
 
+  async #tryReadEnvSource(target: ResolvedTarget): Promise<string | undefined> {
+    if (!this.#envSourcePaths.has(target.logicalPath) || this.#envPolicy === undefined) {
+      return undefined;
+    }
+
+    const content = await readFile(target.physicalPath, "utf8");
+    const filtered = filterEnvValues(parseEnvFile(content), this.#envPolicy);
+    return serializeEnvFile(filtered);
+  }
+
+  async #assertReadable(logicalPath: string): Promise<void> {
+    const isEnvLike = logicalPath
+      .split("/")
+      .some((segment) => segment === ".env" || segment.startsWith(".env."));
+    const isDenied = this.#denyRead.some((pattern) => matchesGlob(logicalPath, pattern));
+    if (isEnvLike || isDenied) {
+      await this.#emitEvent({
+        scope: "workspace",
+        action: "read-denied",
+        outcome: "denied",
+        target: logicalPath,
+      });
+      throw new WorkspaceReadDeniedError(`Path is not readable: ${logicalPath}`);
+    }
+  }
+
   async #emitEvent(event: Omit<ObservabilityEvent, "timestamp">): Promise<void> {
     if (this.#emit === undefined) {
       return;

packages/agent-container/tests/workspace.integration.test.ts

@@ -156,4 +156,94 @@ describe("workspace integration", () => {
       },
     ]);
   });
+
+  it("returns filtered content for default root env sources", async () => {
+    const workspaceRoot = await createTempWorkspace("agent-container-workspace-env-default-");
+    await writeWorkspaceFiles(workspaceRoot.root, {
+      ".env": "PUBLIC_READ_KEY=hello-world\nPRIVATE_API_KEY=foobarbaz\n",
+      ".env.local": "PUBLIC_LOCAL_MODE=demo\nPRIVATE_LOCAL_TOKEN=hidden\n",
+      "package.json": "{\"name\":\"demo\"}\n",
+      "src/index.ts": "export const value = 1;\n",
+      "src/.env.prod": "PRIVATE_NESTED_TOKEN=hidden\n",
+    });
+
+    const events: ObservabilityEvent[] = [];
+    const workspace = await LocalWorkspaceController.create(
+      {
+        root: workspaceRoot.root,
+        mode: "live",
+      },
+      async (event) => {
+        events.push({ timestamp: new Date().toISOString(), ...event });
+      },
+      {
+        env: {
+          include: ["PUBLIC_*"],
+          processEnv: "none",
+        },
+      },
+    );
+    resources.add({ workspaces: [workspaceRoot], controller: workspace });
+
+    expect(await workspace.readText("package.json")).toBe("{\"name\":\"demo\"}\n");
+    expect(await workspace.readText("src/index.ts")).toBe("export const value = 1;\n");
+    expect(await workspace.readText(".env")).toBe("PUBLIC_READ_KEY=\"hello-world\"");
+    expect(await workspace.readText(".env.local")).toBe("PUBLIC_LOCAL_MODE=\"demo\"");
+    expect(await workspace.grep("PRIVATE_API_KEY", { include: [".env", ".env.local"] })).toEqual([]);
+    await expect(workspace.readText("src/.env.prod")).rejects.toThrow(
+      "Path is not readable: src/.env.prod",
+    );
+    expect(
+      events.some((event) => event.scope === "workspace" && event.action === "read-denied"),
+    ).toBe(true);
+  });
+
+  it("uses explicit env file sources as the only readable env-like files", async () => {
+    const workspaceRoot = await createTempWorkspace("agent-container-workspace-env-explicit-");
+    await writeWorkspaceFiles(workspaceRoot.root, {
+      ".env": "PUBLIC_READ_KEY=hello-world\nPRIVATE_API_KEY=foobarbaz\n",
+      ".env.local": "PUBLIC_LOCAL_MODE=demo\n",
+    });
+
+    const workspace = await LocalWorkspaceController.create(
+      {
+        root: workspaceRoot.root,
+        mode: "live",
+      },
+      undefined,
+      {
+        env: {
+          sources: [{ type: "file", path: ".env" }],
+          include: ["PUBLIC_*"],
+          processEnv: "none",
+        },
+      },
+    );
+    resources.add({ workspaces: [workspaceRoot], controller: workspace });
+
+    expect(await workspace.readText(".env")).toBe("PUBLIC_READ_KEY=\"hello-world\"");
+    await expect(workspace.readText(".env.local")).rejects.toThrow(
+      "Path is not readable: .env.local",
+    );
+  });
+
+  it("applies custom denyRead patterns to non-env files", async () => {
+    const workspaceRoot = await createTempWorkspace("agent-container-workspace-deny-read-");
+    await writeWorkspaceFiles(workspaceRoot.root, {
+      "package.json": "{\"name\":\"demo\"}\n",
+      "config/app.secret": "hidden\n",
+    });
+
+    const workspace = await LocalWorkspaceController.create({
+      root: workspaceRoot.root,
+      mode: "live",
+      denyRead: ["**/*.secret"],
+    });
+    resources.add({ workspaces: [workspaceRoot], controller: workspace });
+
+    expect(await workspace.readText("package.json")).toBe("{\"name\":\"demo\"}\n");
+    await expect(workspace.readText("config/app.secret")).rejects.toThrow(
+      "Path is not readable: config/app.secret",
+    );
+  });
 });

packages/types/src/index.ts

@@ -63,6 +63,7 @@ export interface WorkspaceOptions {
   root: string;
   mode?: WorkspaceMode;
   mounts?: readonly WorkspaceMount[];
+  denyRead?: readonly string[];
 }
 
 export type WorkspaceEntryKind = "file" | "directory" | "symlink" | "other";