refactor: move sandbox js code to its own module (#225)
This commit is contained in:
Brandon Keiji
GitHub
parent
fb23321514
commit
cb8a7f01ae
|
|
@ -4,11 +4,7 @@
|
|||
* SPDX-License-Identifier: Apache-2.0
|
||||
*/
|
||||
|
||||
import os from 'os';
|
||||
import path from 'path';
|
||||
import fs from 'fs';
|
||||
import React from 'react';
|
||||
import { quote } from 'shell-quote';
|
||||
import { render } from 'ink';
|
||||
import { App } from './ui/App.js';
|
||||
import { loadCliConfig } from './config/config.js';
|
||||
|
|
@ -17,237 +13,11 @@ import { GeminiClient } from '@gemini-code/server';
|
|||
import { readPackageUp } from 'read-package-up';
|
||||
import { fileURLToPath } from 'node:url';
|
||||
import { dirname } from 'node:path';
|
||||
import { execSync, spawnSync, spawn } from 'child_process';
|
||||
import { sandbox_command, start_sandbox } from './utils/sandbox.js';
|
||||
|
||||
const __filename = fileURLToPath(import.meta.url);
|
||||
const __dirname = dirname(__filename);
|
||||
|
||||
// node.js equivalent of scripts/sandbox_command.sh
|
||||
function sandbox_command(): string {
|
||||
const sandbox = process.env.GEMINI_CODE_SANDBOX?.toLowerCase().trim() ?? '';
|
||||
if (['1', 'true'].includes(sandbox)) {
|
||||
// look for docker or podman, in that order
|
||||
if (execSync('command -v docker || true').toString().trim()) {
|
||||
return 'docker'; // Set sandbox to 'docker' if found
|
||||
} else if (execSync('command -v podman || true').toString().trim()) {
|
||||
return 'podman'; // Set sandbox to 'podman' if found
|
||||
} else {
|
||||
console.error(
|
||||
'ERROR: failed to determine command for sandbox; ' +
|
||||
'install docker or podman or specify command in GEMINI_CODE_SANDBOX',
|
||||
);
|
||||
process.exit(1);
|
||||
}
|
||||
} else if (sandbox) {
|
||||
// confirm that specfied command exists
|
||||
if (execSync(`command -v ${sandbox} || true`).toString().trim()) {
|
||||
return sandbox;
|
||||
} else {
|
||||
console.error(
|
||||
`ERROR: missing sandbox command '${sandbox}' (from GEMINI_CODE_SANDBOX)`,
|
||||
);
|
||||
process.exit(1);
|
||||
}
|
||||
} else {
|
||||
return ''; // no sandbox
|
||||
}
|
||||
}
|
||||
|
||||
// node.js equivalent of scripts/start_sandbox.sh
|
||||
async function start_sandbox(sandbox: string) {
|
||||
// determine full path for gemini-code to distinguish linked vs installed setting
|
||||
const gcPath = execSync(`realpath $(which gemini-code)`).toString().trim();
|
||||
|
||||
// if project is gemini-code, then switch to -dev image & run CLI from ${workdir}/packages/cli
|
||||
let image = 'gemini-code-sandbox';
|
||||
const project = path.basename(process.cwd());
|
||||
const workdir = process.cwd();
|
||||
let cliPath = '/usr/local/share/npm-global/lib/node_modules/@gemini-code/cli';
|
||||
if (project === 'gemini-code') {
|
||||
image += '-dev';
|
||||
cliPath = `${workdir}/packages/cli`;
|
||||
}
|
||||
|
||||
// if BUILD_SANDBOX is set, then call scripts/build_sandbox.sh under gemini-code repo
|
||||
// note this can only be done with binary linked from gemini-code repo
|
||||
if (process.env.BUILD_SANDBOX) {
|
||||
if (!gcPath.includes('gemini-code/packages/')) {
|
||||
console.error(
|
||||
'ERROR: cannot BUILD_SANDBOX using installed gemini-code binary; ' +
|
||||
'run `npm link ./packages/cli` under gemini-code repo to switch to linked binary.',
|
||||
);
|
||||
process.exit(1);
|
||||
} else {
|
||||
console.log('building sandbox ...');
|
||||
const gcRoot = gcPath.split('/packages/')[0];
|
||||
spawnSync(`cd ${gcRoot} && scripts/build_sandbox.sh`, {
|
||||
stdio: 'inherit',
|
||||
shell: true,
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
// stop if image is missing
|
||||
if (!execSync(`${sandbox} images -q ${image}`).toString().trim()) {
|
||||
const remedy = gcPath.includes('gemini-code/packages/')
|
||||
? 'Try `scripts/build_sandbox.sh` under gemini-code repo.'
|
||||
: 'Please notify gemini-code-dev@google.com.';
|
||||
console.error(`ERROR: ${image} is missing. ${remedy}`);
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
// use interactive tty mode and auto-remove container on exit
|
||||
// run init binary inside container to forward signals & reap zombies
|
||||
const args = ['run', '-it', '--rm', '--init', '--workdir', workdir];
|
||||
|
||||
// mount current directory as ${workdir} inside container
|
||||
args.push('--volume', `${process.cwd()}:${workdir}`);
|
||||
|
||||
// mount os.tmpdir() as /tmp inside container
|
||||
args.push('--volume', `${os.tmpdir()}:/tmp`);
|
||||
|
||||
// mount paths listed in SANDBOX_MOUNTS
|
||||
if (process.env.SANDBOX_MOUNTS) {
|
||||
for (let mount of process.env.SANDBOX_MOUNTS.split(',')) {
|
||||
if (mount.trim()) {
|
||||
// parse mount as from:to:opts
|
||||
let [from, to, opts] = mount.trim().split(':');
|
||||
to = to || from; // default to mount at same path inside container
|
||||
opts = opts || 'ro'; // default to read-only
|
||||
mount = `${from}:${to}:${opts}`;
|
||||
// check that from path is absolute
|
||||
if (!path.isAbsolute(from)) {
|
||||
console.error(
|
||||
`ERROR: path '${from}' listed in SANDBOX_MOUNTS must be absolute`,
|
||||
);
|
||||
process.exit(1);
|
||||
}
|
||||
// check that from path exists on host
|
||||
if (!fs.existsSync(from)) {
|
||||
console.error(
|
||||
`ERROR: missing mount path '${from}' listed in SANDBOX_MOUNTS`,
|
||||
);
|
||||
process.exit(1);
|
||||
}
|
||||
console.log(`SANDBOX_MOUNTS: ${from} -> ${to} (${opts})`);
|
||||
args.push('--volume', mount);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// name container after image, plus numeric suffix to avoid conflicts
|
||||
let index = 0;
|
||||
while (
|
||||
execSync(
|
||||
`${sandbox} ps -a --format "{{.Names}}" | grep "${image}-${index}" || true`,
|
||||
)
|
||||
.toString()
|
||||
.trim()
|
||||
) {
|
||||
index++;
|
||||
}
|
||||
args.push('--name', `${image}-${index}`, '--hostname', `${image}-${index}`);
|
||||
|
||||
// copy GEMINI_API_KEY
|
||||
if (process.env.GEMINI_API_KEY) {
|
||||
args.push('--env', `GEMINI_API_KEY=${process.env.GEMINI_API_KEY}`);
|
||||
}
|
||||
|
||||
// copy GEMINI_CODE_MODEL
|
||||
if (process.env.GEMINI_CODE_MODEL) {
|
||||
args.push('--env', `GEMINI_CODE_MODEL=${process.env.GEMINI_CODE_MODEL}`);
|
||||
}
|
||||
|
||||
// copy TERMINAL_TOOL to optionally enable shell tool
|
||||
if (process.env.TERMINAL_TOOL) {
|
||||
args.push('--env', `TERMINAL_TOOL=${process.env.TERMINAL_TOOL}`);
|
||||
}
|
||||
|
||||
// copy TERM and COLORTERM to try to maintain terminal setup
|
||||
if (process.env.TERM) {
|
||||
args.push('--env', `TERM=${process.env.TERM}`);
|
||||
}
|
||||
if (process.env.COLORTERM) {
|
||||
args.push('--env', `COLORTERM=${process.env.COLORTERM}`);
|
||||
}
|
||||
|
||||
// copy additional environment variables from SANDBOX_ENV
|
||||
if (process.env.SANDBOX_ENV) {
|
||||
for (let env of process.env.SANDBOX_ENV.split(',')) {
|
||||
if ((env = env.trim())) {
|
||||
if (env.includes('=')) {
|
||||
console.log(`SANDBOX_ENV: ${env}`);
|
||||
args.push('--env', env);
|
||||
} else {
|
||||
console.error(
|
||||
'ERROR: SANDBOX_ENV must be a comma-separated list of key=value pairs',
|
||||
);
|
||||
process.exit(1);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// set SANDBOX as container name
|
||||
args.push('--env', `SANDBOX=${image}-${index}`);
|
||||
|
||||
// for podman only, use empty --authfile to skip unnecessary auth refresh overhead
|
||||
if (sandbox === 'podman') {
|
||||
const emptyAuthFilePath = path.join(os.tmpdir(), 'empty_auth.json');
|
||||
fs.writeFileSync(emptyAuthFilePath, '{}', 'utf-8');
|
||||
args.push('--authfile', emptyAuthFilePath);
|
||||
}
|
||||
|
||||
// enable debugging via node --inspect-brk if DEBUG is set
|
||||
const nodeArgs = [];
|
||||
const debugPort = process.env.DEBUG_PORT || '9229';
|
||||
if (process.env.DEBUG) {
|
||||
args.push('--publish', `${debugPort}:${debugPort}`);
|
||||
nodeArgs.push(`--inspect-brk=0.0.0.0:${debugPort}`);
|
||||
}
|
||||
|
||||
// open additional ports if SANDBOX_PORTS is set
|
||||
// also set up redirects (via socat) so servers can listen on localhost instead of 0.0.0.0
|
||||
let bashCmd = '';
|
||||
if (process.env.SANDBOX_PORTS) {
|
||||
for (let port of process.env.SANDBOX_PORTS.split(',')) {
|
||||
if ((port = port.trim())) {
|
||||
console.log(`SANDBOX_PORTS: ${port}`);
|
||||
args.push('--publish', `${port}:${port}`);
|
||||
bashCmd += `socat TCP4-LISTEN:${port},bind=$(hostname -i),fork,reuseaddr TCP4:127.0.0.1:${port} 2> /dev/null & `;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// specify --user as "$(id -u):$(id -g)" if SANDBOX_SET_UID_GID is 1|true
|
||||
// only necessary if user mapping is not handled by sandboxing setup on host
|
||||
// (e.g. rootful docker on linux w/o userns-remap configured)
|
||||
if (['1', 'true'].includes(process.env.SANDBOX_SET_UID_GID ?? '')) {
|
||||
const uid = execSync('id -u').toString().trim();
|
||||
const gid = execSync('id -g').toString().trim();
|
||||
args.push('--user', `${uid}:${gid}`);
|
||||
}
|
||||
|
||||
// append remaining args (image, bash -c "node node_args... cli path cli_args...")
|
||||
// node_args and cli_args need to be quoted before being inserted into bash_cmd
|
||||
const quotedNodeArgs = nodeArgs.map((arg) => quote([arg]));
|
||||
const quotedCliArgs = process.argv.slice(2).map((arg) => quote([arg]));
|
||||
bashCmd += `node ${quotedNodeArgs.join(' ')} ${quote([cliPath])} ${quotedCliArgs.join(' ')}`;
|
||||
args.push(image, 'bash', '-c', bashCmd);
|
||||
|
||||
// spawn child and let it inherit stdio
|
||||
const child = spawn(sandbox, args, {
|
||||
stdio: 'inherit',
|
||||
detached: true,
|
||||
});
|
||||
|
||||
// uncomment this line (and comment the await on following line) to let parent exit
|
||||
// child.unref();
|
||||
await new Promise((resolve) => {
|
||||
child.on('close', resolve);
|
||||
});
|
||||
}
|
||||
|
||||
async function main() {
|
||||
const config = loadCliConfig();
|
||||
let input = config.getQuestion();
|
||||
|
|
|
|||
|
|
@ -0,0 +1,237 @@
|
|||
/**
|
||||
* @license
|
||||
* Copyright 2025 Google LLC
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*/
|
||||
|
||||
import { execSync, spawnSync, spawn } from 'node:child_process';
|
||||
import os from 'node:os';
|
||||
import path from 'node:path';
|
||||
import fs from 'node:fs';
|
||||
import { quote } from 'shell-quote';
|
||||
|
||||
// node.js equivalent of scripts/sandbox_command.sh
|
||||
export function sandbox_command(): string {
|
||||
const sandbox = process.env.GEMINI_CODE_SANDBOX?.toLowerCase().trim() ?? '';
|
||||
if (['1', 'true'].includes(sandbox)) {
|
||||
// look for docker or podman, in that order
|
||||
if (execSync('command -v docker || true').toString().trim()) {
|
||||
return 'docker'; // Set sandbox to 'docker' if found
|
||||
} else if (execSync('command -v podman || true').toString().trim()) {
|
||||
return 'podman'; // Set sandbox to 'podman' if found
|
||||
} else {
|
||||
console.error(
|
||||
'ERROR: failed to determine command for sandbox; ' +
|
||||
'install docker or podman or specify command in GEMINI_CODE_SANDBOX',
|
||||
);
|
||||
process.exit(1);
|
||||
}
|
||||
} else if (sandbox) {
|
||||
// confirm that specfied command exists
|
||||
if (execSync(`command -v ${sandbox} || true`).toString().trim()) {
|
||||
return sandbox;
|
||||
} else {
|
||||
console.error(
|
||||
`ERROR: missing sandbox command '${sandbox}' (from GEMINI_CODE_SANDBOX)`,
|
||||
);
|
||||
process.exit(1);
|
||||
}
|
||||
} else {
|
||||
return ''; // no sandbox
|
||||
}
|
||||
}
|
||||
|
||||
// node.js equivalent of scripts/start_sandbox.sh
|
||||
export async function start_sandbox(sandbox: string) {
|
||||
// determine full path for gemini-code to distinguish linked vs installed setting
|
||||
const gcPath = execSync(`realpath $(which gemini-code)`).toString().trim();
|
||||
|
||||
// if project is gemini-code, then switch to -dev image & run CLI from ${workdir}/packages/cli
|
||||
let image = 'gemini-code-sandbox';
|
||||
const project = path.basename(process.cwd());
|
||||
const workdir = process.cwd();
|
||||
let cliPath = '/usr/local/share/npm-global/lib/node_modules/@gemini-code/cli';
|
||||
if (project === 'gemini-code') {
|
||||
image += '-dev';
|
||||
cliPath = `${workdir}/packages/cli`;
|
||||
}
|
||||
|
||||
// if BUILD_SANDBOX is set, then call scripts/build_sandbox.sh under gemini-code repo
|
||||
// note this can only be done with binary linked from gemini-code repo
|
||||
if (process.env.BUILD_SANDBOX) {
|
||||
if (!gcPath.includes('gemini-code/packages/')) {
|
||||
console.error(
|
||||
'ERROR: cannot BUILD_SANDBOX using installed gemini-code binary; ' +
|
||||
'run `npm link ./packages/cli` under gemini-code repo to switch to linked binary.',
|
||||
);
|
||||
process.exit(1);
|
||||
} else {
|
||||
console.log('building sandbox ...');
|
||||
const gcRoot = gcPath.split('/packages/')[0];
|
||||
spawnSync(`cd ${gcRoot} && scripts/build_sandbox.sh`, {
|
||||
stdio: 'inherit',
|
||||
shell: true,
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
// stop if image is missing
|
||||
if (!execSync(`${sandbox} images -q ${image}`).toString().trim()) {
|
||||
const remedy = gcPath.includes('gemini-code/packages/')
|
||||
? 'Try `scripts/build_sandbox.sh` under gemini-code repo.'
|
||||
: 'Please notify gemini-code-dev@google.com.';
|
||||
console.error(`ERROR: ${image} is missing. ${remedy}`);
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
// use interactive tty mode and auto-remove container on exit
|
||||
// run init binary inside container to forward signals & reap zombies
|
||||
const args = ['run', '-it', '--rm', '--init', '--workdir', workdir];
|
||||
|
||||
// mount current directory as ${workdir} inside container
|
||||
args.push('--volume', `${process.cwd()}:${workdir}`);
|
||||
|
||||
// mount os.tmpdir() as /tmp inside container
|
||||
args.push('--volume', `${os.tmpdir()}:/tmp`);
|
||||
|
||||
// mount paths listed in SANDBOX_MOUNTS
|
||||
if (process.env.SANDBOX_MOUNTS) {
|
||||
for (let mount of process.env.SANDBOX_MOUNTS.split(',')) {
|
||||
if (mount.trim()) {
|
||||
// parse mount as from:to:opts
|
||||
let [from, to, opts] = mount.trim().split(':');
|
||||
to = to || from; // default to mount at same path inside container
|
||||
opts = opts || 'ro'; // default to read-only
|
||||
mount = `${from}:${to}:${opts}`;
|
||||
// check that from path is absolute
|
||||
if (!path.isAbsolute(from)) {
|
||||
console.error(
|
||||
`ERROR: path '${from}' listed in SANDBOX_MOUNTS must be absolute`,
|
||||
);
|
||||
process.exit(1);
|
||||
}
|
||||
// check that from path exists on host
|
||||
if (!fs.existsSync(from)) {
|
||||
console.error(
|
||||
`ERROR: missing mount path '${from}' listed in SANDBOX_MOUNTS`,
|
||||
);
|
||||
process.exit(1);
|
||||
}
|
||||
console.log(`SANDBOX_MOUNTS: ${from} -> ${to} (${opts})`);
|
||||
args.push('--volume', mount);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// name container after image, plus numeric suffix to avoid conflicts
|
||||
let index = 0;
|
||||
while (
|
||||
execSync(
|
||||
`${sandbox} ps -a --format "{{.Names}}" | grep "${image}-${index}" || true`,
|
||||
)
|
||||
.toString()
|
||||
.trim()
|
||||
) {
|
||||
index++;
|
||||
}
|
||||
args.push('--name', `${image}-${index}`, '--hostname', `${image}-${index}`);
|
||||
|
||||
// copy GEMINI_API_KEY
|
||||
if (process.env.GEMINI_API_KEY) {
|
||||
args.push('--env', `GEMINI_API_KEY=${process.env.GEMINI_API_KEY}`);
|
||||
}
|
||||
|
||||
// copy GEMINI_CODE_MODEL
|
||||
if (process.env.GEMINI_CODE_MODEL) {
|
||||
args.push('--env', `GEMINI_CODE_MODEL=${process.env.GEMINI_CODE_MODEL}`);
|
||||
}
|
||||
|
||||
// copy TERMINAL_TOOL to optionally enable shell tool
|
||||
if (process.env.TERMINAL_TOOL) {
|
||||
args.push('--env', `TERMINAL_TOOL=${process.env.TERMINAL_TOOL}`);
|
||||
}
|
||||
|
||||
// copy TERM and COLORTERM to try to maintain terminal setup
|
||||
if (process.env.TERM) {
|
||||
args.push('--env', `TERM=${process.env.TERM}`);
|
||||
}
|
||||
if (process.env.COLORTERM) {
|
||||
args.push('--env', `COLORTERM=${process.env.COLORTERM}`);
|
||||
}
|
||||
|
||||
// copy additional environment variables from SANDBOX_ENV
|
||||
if (process.env.SANDBOX_ENV) {
|
||||
for (let env of process.env.SANDBOX_ENV.split(',')) {
|
||||
if ((env = env.trim())) {
|
||||
if (env.includes('=')) {
|
||||
console.log(`SANDBOX_ENV: ${env}`);
|
||||
args.push('--env', env);
|
||||
} else {
|
||||
console.error(
|
||||
'ERROR: SANDBOX_ENV must be a comma-separated list of key=value pairs',
|
||||
);
|
||||
process.exit(1);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// set SANDBOX as container name
|
||||
args.push('--env', `SANDBOX=${image}-${index}`);
|
||||
|
||||
// for podman only, use empty --authfile to skip unnecessary auth refresh overhead
|
||||
if (sandbox === 'podman') {
|
||||
const emptyAuthFilePath = path.join(os.tmpdir(), 'empty_auth.json');
|
||||
fs.writeFileSync(emptyAuthFilePath, '{}', 'utf-8');
|
||||
args.push('--authfile', emptyAuthFilePath);
|
||||
}
|
||||
|
||||
// enable debugging via node --inspect-brk if DEBUG is set
|
||||
const nodeArgs = [];
|
||||
const debugPort = process.env.DEBUG_PORT || '9229';
|
||||
if (process.env.DEBUG) {
|
||||
args.push('--publish', `${debugPort}:${debugPort}`);
|
||||
nodeArgs.push(`--inspect-brk=0.0.0.0:${debugPort}`);
|
||||
}
|
||||
|
||||
// open additional ports if SANDBOX_PORTS is set
|
||||
// also set up redirects (via socat) so servers can listen on localhost instead of 0.0.0.0
|
||||
let bashCmd = '';
|
||||
if (process.env.SANDBOX_PORTS) {
|
||||
for (let port of process.env.SANDBOX_PORTS.split(',')) {
|
||||
if ((port = port.trim())) {
|
||||
console.log(`SANDBOX_PORTS: ${port}`);
|
||||
args.push('--publish', `${port}:${port}`);
|
||||
bashCmd += `socat TCP4-LISTEN:${port},bind=$(hostname -i),fork,reuseaddr TCP4:127.0.0.1:${port} 2> /dev/null & `;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// specify --user as "$(id -u):$(id -g)" if SANDBOX_SET_UID_GID is 1|true
|
||||
// only necessary if user mapping is not handled by sandboxing setup on host
|
||||
// (e.g. rootful docker on linux w/o userns-remap configured)
|
||||
if (['1', 'true'].includes(process.env.SANDBOX_SET_UID_GID ?? '')) {
|
||||
const uid = execSync('id -u').toString().trim();
|
||||
const gid = execSync('id -g').toString().trim();
|
||||
args.push('--user', `${uid}:${gid}`);
|
||||
}
|
||||
|
||||
// append remaining args (image, bash -c "node node_args... cli path cli_args...")
|
||||
// node_args and cli_args need to be quoted before being inserted into bash_cmd
|
||||
const quotedNodeArgs = nodeArgs.map((arg) => quote([arg]));
|
||||
const quotedCliArgs = process.argv.slice(2).map((arg) => quote([arg]));
|
||||
bashCmd += `node ${quotedNodeArgs.join(' ')} ${quote([cliPath])} ${quotedCliArgs.join(' ')}`;
|
||||
args.push(image, 'bash', '-c', bashCmd);
|
||||
|
||||
// spawn child and let it inherit stdio
|
||||
const child = spawn(sandbox, args, {
|
||||
stdio: 'inherit',
|
||||
detached: true,
|
||||
});
|
||||
|
||||
// uncomment this line (and comment the await on following line) to let parent exit
|
||||
// child.unref();
|
||||
await new Promise((resolve) => {
|
||||
child.on('close', resolve);
|
||||
});
|
||||
}
|
||||
Loading…
Reference in New Issue