Add opt-in native subprocess sandbox

Author: haowu1234

src/autoresearch/state.ts

@@ -21,6 +21,7 @@ export interface AutoresearchRun {
   parsed_metrics: Record<string, number>;
   parsed_primary: number | null;
   asi: JsonObject;
+  sandbox?: JsonObject;
   completed_at: string;
 }
 
@@ -34,6 +35,7 @@ export interface HarnessValidation {
   output_resource_uri?: string;
   timed_out?: boolean;
   output_truncated?: boolean;
+  sandbox?: JsonObject;
   message: string;
   validated_at: string;
 }
@@ -436,6 +438,7 @@ function cloneHarnessValidation(status: HarnessValidation): HarnessValidation {
   return {
     ...status,
     parsed_metrics: { ...status.parsed_metrics },
+    sandbox: status.sandbox ? { ...status.sandbox } : undefined,
   };
 }
 
@@ -460,6 +463,7 @@ function parseRun(value: unknown): AutoresearchRun | undefined {
     parsed_metrics: numericRecord(data.parsed_metrics),
     parsed_primary: typeof data.parsed_primary === "number" && Number.isFinite(data.parsed_primary) ? data.parsed_primary : null,
     asi: objectRecord(data.asi),
+    sandbox: objectRecordOrUndefined(data.sandbox),
     completed_at: typeof data.completed_at === "string" ? data.completed_at : "",
   };
 }
@@ -484,6 +488,7 @@ function parseHarnessValidation(value: unknown): HarnessValidation | undefined {
     output_resource_uri: typeof data.output_resource_uri === "string" ? data.output_resource_uri : undefined,
     timed_out: data.timed_out === true ? true : undefined,
     output_truncated: data.output_truncated === true ? true : undefined,
+    sandbox: objectRecordOrUndefined(data.sandbox),
     message,
     validated_at: typeof data.validated_at === "string" ? data.validated_at : "",
   };
@@ -603,6 +608,10 @@ function objectRecord(value: unknown): JsonObject {
   return value && typeof value === "object" && !Array.isArray(value) ? (value as JsonObject) : {};
 }
 
+function objectRecordOrUndefined(value: unknown): JsonObject | undefined {
+  return value && typeof value === "object" && !Array.isArray(value) ? (value as JsonObject) : undefined;
+}
+
 function positiveIntOrUndefined(value: unknown): number | undefined {
   return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : undefined;
 }

src/code-intelligence/codegraph-engine.ts

@@ -155,6 +155,7 @@ export class CodeGraphContextEngine {
   constructor(
     private readonly config: ContextEngineConfig,
     private readonly workspace: WorkspaceIdentity,
+    private readonly agentConfig?: VllmAgentConfig,
   ) {
     this.statusSnapshot = this.enabled()
       ? { provider: "codegraph", state: "idle", watcher: "inactive" }
@@ -247,7 +248,7 @@ export class CodeGraphContextEngine {
   private async runIndexLifecycle(reason: string, options: { force?: boolean; signal?: AbortSignal }): Promise<ContextEngineStatus> {
     this.update({ provider: "codegraph", state: "indexing", phase: "initializing", current: undefined, total: undefined, error: undefined, reason });
     try {
-      await ensureCodeGraphIgnored(this.workspace.root);
+      await ensureCodeGraphIgnored(this.workspace, this.agentConfig);
       const { CodeGraph } = loadCodeGraphModule();
       const initialized = CodeGraph.isInitialized(this.workspace.root);
       const cg = initialized ? await CodeGraph.open(this.workspace.root) : await CodeGraph.init(this.workspace.root, { index: false });
@@ -772,8 +773,12 @@ function languagesFromStats(stats: CodeGraphStats): string[] | undefined {
     .sort();
 }
 
-async function ensureCodeGraphIgnored(workspaceRoot: string): Promise<void> {
-  const result = await runSmallCommand("git", ["rev-parse", "--git-dir"], workspaceRoot, 2000);
+async function ensureCodeGraphIgnored(workspace: WorkspaceIdentity, config?: VllmAgentConfig): Promise<void> {
+  if (config?.sandbox.mode && config.sandbox.mode !== "off") {
+    return;
+  }
+  const workspaceRoot = workspace.root;
+  const result = await runSmallCommand("git", ["rev-parse", "--git-dir"], workspaceRoot, 2000, config ? { config, workspace } : undefined);
   if (result.code !== 0 || !result.stdout.trim()) {
     return;
   }

src/code-intelligence/hub.ts

@@ -27,7 +27,7 @@ export class CodeIntelligenceHub {
     private readonly config: VllmAgentConfig,
     private readonly workspace: WorkspaceIdentity,
   ) {
-    this.codegraph = new CodeGraphContextEngine(normalizeContextEngineConfig(config), workspace);
+    this.codegraph = new CodeGraphContextEngine(normalizeContextEngineConfig(config), workspace, config);
   }
 
   dispose(): void {

src/config/config.ts

@@ -222,7 +222,7 @@ function stringValue(value: unknown): string | undefined {
 }
 
 function pruneConfig(config: VllmAgentConfig): void {
-  pruneKeys(config, ["workspace", "model_setup", "model_retry", "omni", "permissions", "context", "skills", "web_search", "rtk", "daemon"]);
+  pruneKeys(config, ["workspace", "model_setup", "model_retry", "omni", "permissions", "sandbox", "context", "skills", "web_search", "rtk", "daemon"]);
   pruneKeys(config.workspace, ["root"]);
   pruneKeys(config.model_setup, ["mode", "provider", "provider_id", "profile", "router", "base_url", "model", "api_key_ref", "api_key", "headers", "context_window"]);
   pruneKeys(config.model_retry, [
@@ -251,6 +251,7 @@ function pruneConfig(config: VllmAgentConfig): void {
   for (const policy of Object.values(config.permissions?.workspaces ?? {})) {
     pruneKeys(policy, ["mode", "custom"]);
   }
+  pruneKeys(config.sandbox, ["mode", "backend", "network", "fail_if_unavailable", "extra_writable_roots", "env_passthrough"]);
   pruneKeys(config.context, ["compression_threshold", "context_window", "protected_recent_loops", "force_compression", "engine"]);
   pruneKeys(config.context?.engine, ["provider", "startup", "require_ready_before_chat", "watch"]);
   pruneKeys(config.skills, ["enabled", "managed_installs"]);

src/config/defaults.ts

@@ -21,6 +21,14 @@ export const DEFAULT_CONFIG: VllmAgentConfig = {
   permissions: {
     mode: "full_access",
   },
+  sandbox: {
+    mode: "off",
+    backend: "auto",
+    network: "restricted",
+    fail_if_unavailable: true,
+    extra_writable_roots: [],
+    env_passthrough: [],
+  },
   context: {
     compression_threshold: 0.8,
     context_window: 32_768,

src/rtk/command.ts

@@ -1,10 +1,12 @@
 import { spawn } from "node:child_process";
 import path from "node:path";
 import { ensureDir } from "../util/fs.js";
-import type { VllmAgentConfig } from "../types.js";
+import type { VllmAgentConfig, WorkspaceIdentity } from "../types.js";
 import type { SessionStore } from "../session/store.js";
 import { resolveRtkStatus, rtkDbPath, rtkEnv, type RtkRuntime } from "./manager.js";
 import { readRtkCommandStats, type RtkCommandStats } from "./stats.js";
+import { runSandboxedProcess } from "../sandbox/runner.js";
+import type { SandboxExecutionInfo } from "../sandbox/types.js";
 
 export interface RtkShellCommandOptions {
   config: VllmAgentConfig;
@@ -15,6 +17,7 @@ export interface RtkShellCommandOptions {
   tool_name: string;
   command: string;
   cwd: string;
+  workspace: WorkspaceIdentity;
   env?: NodeJS.ProcessEnv;
   timeout_ms: number;
 }
@@ -27,6 +30,7 @@ export interface RtkShellCommandResult {
   command: string;
   rewritten_command?: string;
   rtk?: RtkCommandStats;
+  sandbox?: SandboxExecutionInfo;
 }
 
 interface PreparedRtkCommand {
@@ -40,7 +44,7 @@ interface PreparedRtkCommand {
 
 export async function runRtkAwareShellCommand(options: RtkShellCommandOptions): Promise<RtkShellCommandResult> {
   const prepared = await prepareCommand(options);
-  const result = await runShell(prepared.command, options.cwd, prepared.env, options.timeout_ms);
+  const result = await runShell(prepared.command, options.cwd, prepared.env, options.timeout_ms, options.config, options.workspace, prepared.original_command, prepared.rewritten_command);
   const rtk = await recordRtkSavings(options, prepared);
   return {
     ...result,
@@ -146,39 +150,26 @@ async function recordRtkSavings(options: RtkShellCommandOptions, prepared: Prepa
   return stats;
 }
 
-function runShell(command: string, cwd: string, env: NodeJS.ProcessEnv, timeoutMs: number): Promise<Omit<RtkShellCommandResult, "command">> {
-  return new Promise((resolve) => {
-    const child = spawn(command, {
-      cwd,
-      env,
-      shell: true,
-    });
-    let stdout = "";
-    let stderr = "";
-    let timedOut = false;
-    const timeout = setTimeout(() => {
-      timedOut = true;
-      child.kill("SIGTERM");
-      setTimeout(() => {
-        if (!child.killed) {
-          child.kill("SIGKILL");
-        }
-      }, 2000).unref();
-    }, timeoutMs);
-    child.stdout.on("data", (chunk) => {
-      stdout += String(chunk);
-    });
-    child.stderr.on("data", (chunk) => {
-      stderr += String(chunk);
-    });
-    child.on("close", (code) => {
-      clearTimeout(timeout);
-      resolve({ code, stdout, stderr, timed_out: timedOut });
-    });
-    child.on("error", (error) => {
-      clearTimeout(timeout);
-      resolve({ code: 127, stdout, stderr: error.message, timed_out: timedOut });
-    });
+async function runShell(
+  command: string,
+  cwd: string,
+  env: NodeJS.ProcessEnv,
+  timeoutMs: number,
+  config: VllmAgentConfig,
+  workspace: WorkspaceIdentity,
+  originalCommand: string,
+  rewrittenCommand?: string,
+): Promise<Omit<RtkShellCommandResult, "command">> {
+  return await runSandboxedProcess({
+    config,
+    workspace,
+    command,
+    shell: true,
+    cwd,
+    env,
+    timeoutMs,
+    originalCommand,
+    rewrittenCommand,
   });
 }