@sema-agent/core/dist/core/oracle-isolation.js

Stateless, task-oriented AI agent core

import { isRemoteExecutionEnv, isIsolated } from "./remote-env.js";
import { canonicalizeTarget, pathFamilyOf } from "../tools/fs/safety.js";
import { thrownText } from "./thrown-value.js";
function probeCommand(canonOraclePath) {
    const q = `'${canonOraclePath.replace(/'/g, `'\\''`)}'`;
    return `touch -- ${q}/.oracle-isolation-probe 2>/dev/null`;
}
export async function assertOracleIsolation(workerEnv, grader, opts) {
    const isolationClass = isIsolated(grader.env)
        ? "out_of_process"
        : "in_process_probe_only";
    if (grader.env === workerEnv) {
        return { protected: false, isolationClass, reason: "grader.env is the SAME object as workerEnv (no isolation)" };
    }
    if (isRemoteExecutionEnv(grader.env) && isRemoteExecutionEnv(workerEnv)) {
        let graderId;
        let workerId;
        try {
            graderId = grader.env.workspaceHandle().sandboxId;
            workerId = workerEnv.workspaceHandle().sandboxId;
        }
        catch (e) {
            return { protected: false, isolationClass, reason: `workspaceHandle() threw during identity check: ${thrownText(e)}` };
        }
        if (graderId === workerId) {
            return { protected: false, isolationClass, reason: `grader and worker share sandboxId "${graderId}" (no isolation)` };
        }
    }
    for (const oraclePath of grader.immutableOraclePaths) {
        if (opts?.signal?.aborted) {
            return { protected: false, isolationClass, reason: "isolation probe aborted before completing" };
        }
        let writable;
        try {
            const canon = await canonicalizeTarget(workerEnv, oraclePath, opts?.signal, pathFamilyOf({ root: oraclePath }));
            if (!canon.ok) {
                return { protected: false, isolationClass, reason: `cannot canonicalize oracle path "${oraclePath}": ${canon.message}` };
            }
            const res = await workerEnv.exec(probeCommand(canon.key), { abortSignal: opts?.signal });
            writable = res.ok && res.value.exitCode === 0;
        }
        catch (e) {
            return { protected: false, isolationClass, reason: `isolation probe threw for "${oraclePath}": ${thrownText(e)}` };
        }
        if (writable) {
            return { protected: false, isolationClass, reason: `oracle path "${oraclePath}" is WRITABLE from the worker env (probe wrote it)` };
        }
    }
    return { protected: true, isolationClass };
}