feat: Experimental Sandbox Support (#101)

* feat: Sandbox implementation with seatbelt * refactor: Remove concept of PM_CACHE * fix: Misc fixes * refactor: Sandbox for separation of boundaries * fix: Apply API * fix: Add support for sandbox cleanup * test: Add variable interpolation test * fix: Misc cleanup fixes * chore: Cleanup sandbox registry * chore: Cleanup sandbox policy * chore: Cleanup sandbox * fix: Misc cleanup fixes * fix: Remove violation mode * fix: Update config template * chore: Go mod cleanup * fix: Handle the case when package manager policy is explicitly disabled * fix: Sandbox executor * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com> * test: Remove unused var * test: Add test for seatbelt sandbox driver * fix: Sandbox profile loader from file should use path for caching * test: Add policy test * feat: Add support for config templates * fix: Seatbelt translator handle glob * fix: Merge conflicts * fix: Fix sandbox policy generator for MacOS min permissions * fix: Sandbox path handling bugs * fix: Deny read to dangerous directories * fix: Deny read to dangerous directories * add sandbox e2e (#112) * fix: Sandbox E2E test * fix: Code review fixes * fix: Code review fixes * doc: Add sandbox debugging guide * doc: Update sandbox doc * docs: Add sandbox usage doc * fix: Use better error for sandbox without policy * fix: Add sandbox for npx * fix: Enable PTY for npm --------- Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Sahil Bansal <bansalsahil315@gmail.com>
2026-08-03 07:24:09 +02:00 · 2026-01-13 14:52:02 +05:30
parent c0122898ca
commit 9693428171
35 changed files with 3826 additions and 29 deletions
@@ -0,0 +1,74 @@
+package util
+
+import (
+	"os"
+	"path/filepath"
+)
+
+// DANGEROUS_FILES are files that should always be blocked from write access
+// to prevent credential theft and security compromise.
+var DANGEROUS_FILES = []string{
+	".env",
+	".env.*",
+	".aws",
+	".gcloud",
+	".kube",
+	".ssh",
+	".gnupg",
+	".docker/config.json",
+}
+
+// GetMandatoryDenyPatterns returns filesystem paths that should always be blocked
+// from write access for security reasons. These are automatically injected into
+// all sandbox policies regardless of user configuration.
+//
+// Parameters:
+//   - allowGitConfig: if false, blocks write access to .git/config (recommended)
+//
+// Returns patterns in both absolute (from HOME) and glob forms for comprehensive coverage.
+func GetMandatoryDenyPatterns(allowGitConfig bool) []string {
+	patterns := []string{}
+
+	// Get current working directory for CWD-relative patterns
+	cwd, err := os.Getwd()
+	if err != nil {
+		// Fallback to basic patterns if we can't get CWD
+		cwd = "."
+	}
+
+	// Get home directory for HOME-relative patterns
+	home, err := os.UserHomeDir()
+	if err != nil {
+		// If we can't get home, skip home-based patterns
+		home = ""
+	}
+
+	// Add dangerous files from CWD
+	for _, fileName := range DANGEROUS_FILES {
+		// Absolute path in CWD
+		patterns = append(patterns, filepath.Join(cwd, fileName))
+		// Glob pattern to catch in subdirectories
+		patterns = append(patterns, filepath.Join("**", fileName))
+	}
+
+	// Add dangerous files from HOME (if available)
+	if home != "" {
+		for _, fileName := range DANGEROUS_FILES {
+			patterns = append(patterns, filepath.Join(home, fileName))
+		}
+	}
+
+	// Git hooks are ALWAYS blocked for security (can execute arbitrary code)
+	patterns = append(patterns, filepath.Join(cwd, ".git/hooks"))
+	patterns = append(patterns, filepath.Join(cwd, ".git/hooks/**"))
+	patterns = append(patterns, "**/.git/hooks")
+	patterns = append(patterns, "**/.git/hooks/**")
+
+	// Git config is conditionally blocked
+	if !allowGitConfig {
+		patterns = append(patterns, filepath.Join(cwd, ".git/config"))
+		patterns = append(patterns, "**/.git/config")
+	}
+
+	return patterns
+}