第十章：安全沙箱与隔离

// 来自 packages/sandbox/sandbox/src/index.ts（概念性）
interface SandboxService {
  /** 在沙箱中执行命令 */
  confine(command: string, options: SandboxOptions): Promise<SandboxResult>
  
  /** 检查沙箱是否可用 */
  isAvailable(): boolean
  
  /** 获取当前沙箱类型 */
  getType(): SandboxType
}

type SandboxType = 'landlock' | 'seatbelt' | 'bwrap' | 'none'

interface SandboxOptions {
  /** 工作目录 */
  cwd?: string
  /** 环境变量 */
  env?: Record<string, string>
  /** 超时（毫秒）*/
  timeout?: number
  /** 限制 */
  restrictions: SandboxRestrictions
}

interface SandboxRestrictions {
  /** 允许的路径 */
  allowedPaths?: string[]
  /** 禁止的路径 */
  deniedPaths?: string[]
  /** 允许的网络访问 */
  allowedNetwork?: boolean
  /** 允许的进程创建 */
  allowedProcessSpawn?: boolean
  /** 最大内存（字节）*/
  maxMemory?: number
  /** 最大 CPU 时间（毫秒）*/
  maxCpuTime?: number
}

interface SandboxResult {
  /** 退出码 */
  exitCode: number
  /** 标准输出 */
  stdout: string
  /** 标准错误 */
  stderr: string
  /** 是否被沙箱拦截 */
  confined: boolean
  /** 被拦截的原因（如果有）*/
  confinementReason?: string
}

// 来自 packages/sandbox/sandbox-local/src/landlock.ts（概念性）
class LandlockSandbox implements SandboxBackend {
  /** 创建 Landlock 限制 */
  async createRules(restrictions: SandboxRestrictions): Promise<LandlockRuleset> {
    const ruleset = new LandlockRuleset({
      handledAccess: [
        'file_read',
        'file_write',
        'file_execute',
        'directory_read'
      ]
    })
    
    // 添加允许的路径
    for (const path of restrictions.allowedPaths ?? []) {
      ruleset.addRule({
        type: 'path_beneath',
        path,
        access: ['file_read', 'file_write']
      })
    }
    
    return ruleset
  }
  
  /** 执行受限命令 */
  async exec(command: string, ruleset: LandlockRuleset): Promise<ProcessResult> {
    // 应用 Landlock 规则
    await ruleset.apply()
    
    // 执行命令
    return exec(command)
  }
}

// 来自 packages/sandbox/sandbox-local/src/seatbelt.ts（概念性）
class SeatbeltSandbox implements SandboxBackend {
  /** 生成 Seatbelt 配置 */
  generateProfile(restrictions: SandboxRestrictions): string {
    return `
      (version 1)
      (allow default)
      ${restrictions.deniedPaths?.map(p => `(deny file-read-data (regex "${p}"))`).join('\n')}
      ${restrictions.deniedPaths?.map(p => `(deny file-write-data (regex "${p}"))`).join('\n')}
      ${!restrictions.allowedNetwork ? '(deny network*)' : ''}
    `
  }
  
  /** 执行受限命令 */
  async exec(command: string, profile: string): Promise<ProcessResult> {
    // 使用 sandbox-exec 执行
    return exec(`sandbox-exec -f ${profile} ${command}`)
  }
}

// 来自 packages/sandbox/sandbox-local/src/bwrap.ts（概念性）
class BwrapSandbox implements SandboxBackend {
  /** 构建 bwrap 命令 */
  buildCommand(restrictions: SandboxRestrictions): string[] {
    const args = ['bwrap']
    
    // 只读绑定
    for (const path of restrictions.allowedPaths ?? []) {
      args.push('--ro-bind', path, path)
    }
    
    // 禁止网络
    if (!restrictions.allowedNetwork) {
      args.push('--unshare-net')
    }
    
    // 临时文件系统
    args.push('--tmpfs', '/tmp')
    
    // 要执行的命令
    args.push('--', 'sh', '-c', command)
    
    return args
  }
}

// 来自 packages/sandbox/sandbox-local/src/index.ts
class LocalSandboxProvider implements SandboxProvider {
  private backend: SandboxBackend
  
  constructor(private ctx: Context) {
    // 自动检测可用的后端
    this.backend = this.detectBackend()
  }
  
  /** 检测平台沙箱 */
  private detectBackend(): SandboxBackend {
    if (process.platform === 'linux') {
      if (this.isLandlockAvailable()) {
        return new LandlockSandbox()
      }
      return new BwrapSandbox()
    }
    
    if (process.platform === 'darwin') {
      return new SeatbeltSandbox()
    }
    
    return new NoopSandbox()
  }
  
  /** 在沙箱中执行 */
  async confine(command: string, options: SandboxOptions): Promise<SandboxResult> {
    // 1. 检查权限
    const escalation = await this.checkEscalation(options.restrictions)
    if (!escalation.approved) {
      return { exitCode: 1, stdout: '', stderr: 'Permission denied', confined: true }
    }
    
    // 2. 应用沙箱限制
    const result = await this.backend.exec(command, options)
    
    // 3. 记录审计日志
    await this.auditLog(command, options, result)
    
    return result
  }
  
  /** 检查权限提升 */
  private async checkEscalation(restrictions: SandboxRestrictions): Promise<EscalationResult> {
    // 检查是否需要权限提升
    if (this.needsEscalation(restrictions)) {
      return this.ctx.escalation.request({
        permissions: this.getRequiredPermissions(restrictions),
        reason: 'Command execution requires elevated permissions',
        risk: 'medium'
      })
    }
    
    return { approved: true, granted: [] }
  }
}

// 来自 packages/sandbox/sandbox/src/escalation.ts
interface EscalationApprover {
  /** 请求权限提升 */
  request(options: EscalationRequest): Promise<EscalationResult>
}

interface EscalationRequest {
  /** 请求的权限 */
  permissions: string[]
  /** 原因 */
  reason: string
  /** 风险等级 */
  risk: 'low' | 'medium' | 'high'
}

interface EscalationResult {
  /** 是否批准 */
  approved: boolean
  /** 授予的权限 */
  granted: string[]
}

type Permission =
  | 'file:read'           // 读取文件
  | 'file:write'          // 写入文件
  | 'file:execute'        // 执行文件
  | 'network:outbound'    // 出站网络
  | 'network:inbound'     // 入站网络
  | 'process:spawn'       // 创建进程
  | 'memory:unlimited'    // 无限内存

// 来自 packages/subprocess/subprocess-local/src/index.ts（概念性）
class LocalSubprocessProvider {
  /** 启动进程组 */
  async spawnGroup(command: string, options: SpawnOptions): Promise<RunningProcessGroup> {
    // 创建新的进程组
    const group = new ProcessGroup()
    
    // 启动主进程
    const mainProcess = spawn(command, {
      ...options,
      detached: true,  // 创建新进程组
      stdio: ['pipe', 'pipe', 'pipe']
    })
    
    group.add(mainProcess)
    
    // 监听子进程
    mainProcess.on('spawn', (child) => {
      group.add(child)
    })
    
    return {
      main: mainProcess,
      group,
      async kill(signal = 'SIGTERM') {
        // 杀死整个进程树
        group.killAll(signal)
      }
    }
  }
}

// 概念性描述：Guard 和 Sandbox 的集成
async function executeWithGuardAndSandbox(
  ctx: Context,
  command: string,
  options: ExecutionOptions
): Promise<ExecutionResult> {
  // 1. Guard 检查
  const guardResult = await ctx.guard.check(command, options)
  if (!guardResult.allowed) {
    return { error: guardResult.reason }
  }
  
  // 2. 沙箱执行
  const sandboxResult = await ctx.sandbox.confine(command, {
    ...options,
    restrictions: options.restrictions
  })
  
  // 3. 审计日志
  await ctx.audit.log({
    command,
    options,
    result: sandboxResult,
    timestamp: new Date()
  })
  
  return sandboxResult
}

# cordis.patch.yml
- id: sandbox
  config:
    # 沙箱类型
    type: 'auto'  # 'auto' | 'landlock' | 'seatbelt' | 'bwrap' | 'none'
    
    # 默认限制
    defaults:
      allowedPaths:
        - '/tmp'
        - '/workspace'
      deniedPaths:
        - '/etc/shadow'
        - '/root'
      allowedNetwork: false
      allowedProcessSpawn: true
      maxMemory: 536870912  # 512MB
      maxCpuTime: 30000     # 30s
    
    # 特定命令的覆盖
    overrides:
      'bash':
        allowedPaths:
          - '/tmp'
          - '/workspace'
          - '/usr'
        allowedNetwork: true

# cordis.patch.yml
- id: escalation
  config:
    # 审批模式
    mode: 'interactive'  # 'interactive' | 'auto-approve' | 'auto-deny'
    
    # 自动批准的权限
    autoApprove:
      - 'file:read'
    
    # 自动拒绝的权限
    autoDeny:
      - 'network:inbound'
      - 'memory:unlimited'