1use std::env;
2use std::io;
3use std::process::{Command, Stdio};
4use std::time::Duration;
5
6use serde::{Deserialize, Serialize};
7use tokio::process::Command as TokioCommand;
8use tokio::runtime::Builder;
9use tokio::time::timeout;
10
11use crate::remote::inherited_upstream_proxy_env;
12use crate::sandbox::{
13 build_sandbox_command, resolve_sandbox_status_for_request, FilesystemIsolationMode,
14 SandboxConfig, SandboxStatus,
15};
16use crate::ConfigLoader;
17
18#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
19pub struct BashCommandInput {
20 pub command: String,
21 pub timeout: Option<u64>,
22 pub description: Option<String>,
23 #[serde(rename = "run_in_background")]
24 pub run_in_background: Option<bool>,
25 #[serde(rename = "dangerouslyDisableSandbox")]
26 pub dangerously_disable_sandbox: Option<bool>,
27 #[serde(rename = "namespaceRestrictions")]
28 pub namespace_restrictions: Option<bool>,
29 #[serde(rename = "isolateNetwork")]
30 pub isolate_network: Option<bool>,
31 #[serde(rename = "filesystemMode")]
32 pub filesystem_mode: Option<FilesystemIsolationMode>,
33 #[serde(rename = "allowedMounts")]
34 pub allowed_mounts: Option<Vec<String>>,
35}
36
37#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
38pub struct BashCommandOutput {
39 pub stdout: String,
40 pub stderr: String,
41 #[serde(rename = "rawOutputPath")]
42 pub raw_output_path: Option<String>,
43 pub interrupted: bool,
44 #[serde(rename = "isImage")]
45 pub is_image: Option<bool>,
46 #[serde(rename = "backgroundTaskId")]
47 pub background_task_id: Option<String>,
48 #[serde(rename = "backgroundedByUser")]
49 pub backgrounded_by_user: Option<bool>,
50 #[serde(rename = "assistantAutoBackgrounded")]
51 pub assistant_auto_backgrounded: Option<bool>,
52 #[serde(rename = "dangerouslyDisableSandbox")]
53 pub dangerously_disable_sandbox: Option<bool>,
54 #[serde(rename = "returnCodeInterpretation")]
55 pub return_code_interpretation: Option<String>,
56 #[serde(rename = "noOutputExpected")]
57 pub no_output_expected: Option<bool>,
58 #[serde(rename = "structuredContent")]
59 pub structured_content: Option<Vec<serde_json::Value>>,
60 #[serde(rename = "persistedOutputPath")]
61 pub persisted_output_path: Option<String>,
62 #[serde(rename = "persistedOutputSize")]
63 pub persisted_output_size: Option<u64>,
64 #[serde(rename = "sandboxStatus")]
65 pub sandbox_status: Option<SandboxStatus>,
66}
67
68pub fn execute_bash(input: BashCommandInput) -> io::Result<BashCommandOutput> {
69 let cwd = env::current_dir()?;
70 let sandbox_status = sandbox_status_for_input(&input, &cwd);
71
72 if input.run_in_background.unwrap_or(false) {
73 let mut child = prepare_command(&input.command, &cwd, &sandbox_status, false);
74 let mut child = child
75 .stdin(Stdio::null())
76 .stdout(Stdio::null())
77 .stderr(Stdio::null())
78 .spawn()?;
79
80 let pid = child.id();
81 std::thread::spawn(move || {
82 let _ = child.wait();
83 });
84
85 return Ok(BashCommandOutput {
86 stdout: String::new(),
87 stderr: String::new(),
88 raw_output_path: None,
89 interrupted: false,
90 is_image: None,
91 background_task_id: Some(pid.to_string()),
92 backgrounded_by_user: Some(false),
93 assistant_auto_backgrounded: Some(false),
94 dangerously_disable_sandbox: input.dangerously_disable_sandbox,
95 return_code_interpretation: None,
96 no_output_expected: Some(true),
97 structured_content: None,
98 persisted_output_path: None,
99 persisted_output_size: None,
100 sandbox_status: Some(sandbox_status),
101 });
102 }
103
104 let runtime = Builder::new_current_thread().enable_all().build()?;
105 runtime.block_on(execute_bash_async(input, sandbox_status, cwd))
106}
107
108async fn execute_bash_async(
109 input: BashCommandInput,
110 sandbox_status: SandboxStatus,
111 cwd: std::path::PathBuf,
112) -> io::Result<BashCommandOutput> {
113 let mut command = prepare_tokio_command(&input.command, &cwd, &sandbox_status, true);
114
115 let output_result = if let Some(timeout_ms) = input.timeout {
116 let child = command
117 .stdout(std::process::Stdio::piped())
118 .stderr(std::process::Stdio::piped())
119 .kill_on_drop(true)
120 .spawn()?;
121 match timeout(Duration::from_millis(timeout_ms), child.wait_with_output()).await {
122 Ok(result) => (result?, false),
123 Err(_) => {
124 return Ok(BashCommandOutput {
125 stdout: String::new(),
126 stderr: format!("Command exceeded timeout of {timeout_ms} ms"),
127 raw_output_path: None,
128 interrupted: true,
129 is_image: None,
130 background_task_id: None,
131 backgrounded_by_user: None,
132 assistant_auto_backgrounded: None,
133 dangerously_disable_sandbox: input.dangerously_disable_sandbox,
134 return_code_interpretation: Some(String::from("timeout")),
135 no_output_expected: Some(true),
136 structured_content: None,
137 persisted_output_path: None,
138 persisted_output_size: None,
139 sandbox_status: Some(sandbox_status),
140 });
141 }
142 }
143 } else {
144 (command.output().await?, false)
145 };
146
147 let (output, interrupted) = output_result;
148 let stdout = String::from_utf8_lossy(&output.stdout).into_owned();
149 let stderr = String::from_utf8_lossy(&output.stderr).into_owned();
150 let no_output_expected = Some(stdout.trim().is_empty() && stderr.trim().is_empty());
151 let return_code_interpretation = output.status.code().and_then(|code| {
152 if code == 0 {
153 None
154 } else {
155 Some(format!("exit_code:{code}"))
156 }
157 });
158
159 Ok(BashCommandOutput {
160 stdout,
161 stderr,
162 raw_output_path: None,
163 interrupted,
164 is_image: None,
165 background_task_id: None,
166 backgrounded_by_user: None,
167 assistant_auto_backgrounded: None,
168 dangerously_disable_sandbox: input.dangerously_disable_sandbox,
169 return_code_interpretation,
170 no_output_expected,
171 structured_content: None,
172 persisted_output_path: None,
173 persisted_output_size: None,
174 sandbox_status: Some(sandbox_status),
175 })
176}
177
178fn sandbox_status_for_input(input: &BashCommandInput, cwd: &std::path::Path) -> SandboxStatus {
179 let config = ConfigLoader::default_for(cwd).load().map_or_else(
180 |_| SandboxConfig::default(),
181 |runtime_config| runtime_config.sandbox().clone(),
182 );
183 let request = config.resolve_request(
184 input.dangerously_disable_sandbox.map(|disabled| !disabled),
185 input.namespace_restrictions,
186 input.isolate_network,
187 input.filesystem_mode,
188 input.allowed_mounts.clone(),
189 );
190 resolve_sandbox_status_for_request(&request, cwd)
191}
192
193fn prepare_command(
194 command: &str,
195 cwd: &std::path::Path,
196 sandbox_status: &SandboxStatus,
197 create_dirs: bool,
198) -> Command {
199 if create_dirs {
200 prepare_sandbox_dirs(cwd);
201 }
202
203 if let Some(launcher) = build_sandbox_command(command, cwd, sandbox_status) {
204 let mut prepared = Command::new(launcher.program);
205 prepared.args(launcher.args);
206 prepared.current_dir(cwd);
207 prepared.envs(launcher.env);
208 apply_proxy_env(&mut prepared);
209 return prepared;
210 }
211
212 #[cfg(windows)]
213 {
214 let mut prepared = Command::new("cmd");
215 prepared.arg("/C").arg(command).current_dir(cwd);
216 if sandbox_status.filesystem_active {
217 prepared.env("USERPROFILE", cwd.join(".sandbox-home"));
218 prepared.env("TEMP", cwd.join(".sandbox-tmp"));
219 prepared.env("TMP", cwd.join(".sandbox-tmp"));
220 }
221 apply_proxy_env(&mut prepared);
222 prepared
223 }
224 #[cfg(not(windows))]
225 {
226 let mut prepared = Command::new("sh");
227 prepared.arg("-lc").arg(command).current_dir(cwd);
228 if sandbox_status.filesystem_active {
229 prepared.env("HOME", cwd.join(".sandbox-home"));
230 prepared.env("TMPDIR", cwd.join(".sandbox-tmp"));
231 }
232 apply_proxy_env(&mut prepared);
233 prepared
234 }
235}
236
237fn prepare_tokio_command(
238 command: &str,
239 cwd: &std::path::Path,
240 sandbox_status: &SandboxStatus,
241 create_dirs: bool,
242) -> TokioCommand {
243 if create_dirs {
244 prepare_sandbox_dirs(cwd);
245 }
246
247 if let Some(launcher) = build_sandbox_command(command, cwd, sandbox_status) {
248 let mut prepared = TokioCommand::new(launcher.program);
249 prepared.args(launcher.args);
250 prepared.current_dir(cwd);
251 prepared.envs(launcher.env);
252 apply_tokio_proxy_env(&mut prepared);
253 return prepared;
254 }
255
256 #[cfg(windows)]
257 {
258 let mut prepared = TokioCommand::new("cmd");
259 prepared.arg("/C").arg(command).current_dir(cwd);
260 if sandbox_status.filesystem_active {
261 prepared.env("USERPROFILE", cwd.join(".sandbox-home"));
262 prepared.env("TEMP", cwd.join(".sandbox-tmp"));
263 prepared.env("TMP", cwd.join(".sandbox-tmp"));
264 }
265 apply_tokio_proxy_env(&mut prepared);
266 prepared
267 }
268 #[cfg(not(windows))]
269 {
270 let mut prepared = TokioCommand::new("sh");
271 prepared.arg("-lc").arg(command).current_dir(cwd);
272 if sandbox_status.filesystem_active {
273 prepared.env("HOME", cwd.join(".sandbox-home"));
274 prepared.env("TMPDIR", cwd.join(".sandbox-tmp"));
275 }
276 apply_tokio_proxy_env(&mut prepared);
277 prepared
278 }
279}
280
281fn apply_proxy_env(cmd: &mut Command) {
282 let env_map = env::vars().collect();
283 let proxy_env = inherited_upstream_proxy_env(&env_map);
284 cmd.envs(proxy_env);
285}
286
287fn apply_tokio_proxy_env(cmd: &mut TokioCommand) {
288 let env_map = env::vars().collect();
289 let proxy_env = inherited_upstream_proxy_env(&env_map);
290 cmd.envs(proxy_env);
291}
292
293fn prepare_sandbox_dirs(cwd: &std::path::Path) {
294 let _ = std::fs::create_dir_all(cwd.join(".sandbox-home"));
295 let _ = std::fs::create_dir_all(cwd.join(".sandbox-tmp"));
296}
297
298#[cfg(test)]
299#[cfg(unix)]
300mod tests {
301 use super::{execute_bash, BashCommandInput};
302 use crate::sandbox::FilesystemIsolationMode;
303
304 #[test]
305 fn executes_simple_command() {
306 let output = execute_bash(BashCommandInput {
307 command: String::from("printf 'hello'"),
308 timeout: Some(1_000),
309 description: None,
310 run_in_background: Some(false),
311 dangerously_disable_sandbox: Some(false),
312 namespace_restrictions: Some(false),
313 isolate_network: Some(false),
314 filesystem_mode: Some(FilesystemIsolationMode::WorkspaceOnly),
315 allowed_mounts: None,
316 })
317 .expect("bash command should execute");
318
319 assert_eq!(output.stdout, "hello");
320 assert!(!output.interrupted);
321 assert!(output.sandbox_status.is_some());
322 }
323
324 #[test]
325 fn disables_sandbox_when_requested() {
326 let output = execute_bash(BashCommandInput {
327 command: String::from("printf 'hello'"),
328 timeout: Some(1_000),
329 description: None,
330 run_in_background: Some(false),
331 dangerously_disable_sandbox: Some(true),
332 namespace_restrictions: None,
333 isolate_network: None,
334 filesystem_mode: None,
335 allowed_mounts: None,
336 })
337 .expect("bash command should execute");
338
339 assert!(!output.sandbox_status.expect("sandbox status").enabled);
340 }
341}