fix(security): bundle real sandbox runtime in open CLI (Gitlawb#1641)

* fix(security): bundle real sandbox runtime in open CLI

* test(sandbox): cover fail-closed runtime diagnostics

* fix(sandbox): report doctor inspection failures

Author: chioarub

scripts/build.ts

@@ -225,7 +225,6 @@ export async function handleBgFlag() { throw new Error("Background sessions are
           'color-diff-napi',
           '@anthropic-ai/mcpb',
           '@ant/claude-for-chrome-mcp',
-          '@anthropic-ai/sandbox-runtime',
           'asciichart',
           'plist',
           'cacache',

scripts/missing-module-stub.test.ts

@@ -45,3 +45,16 @@ test('WebFetch binds the real ssrfGuardedLookup in the CLI bundle', () => {
   // ...and ssrfGuard must not have been replaced by a missing-module stub.
   expect(bundle).not.toMatch(/missing-module-stub:.*ssrfGuard/)
 })
+
+test('CLI bundle includes the real sandbox runtime instead of the native stub', () => {
+  if (!existsSync(DIST)) {
+    throw new Error(
+      'dist/cli.mjs not found — run `bun run build` before this test',
+    )
+  }
+
+  const bundle = readFileSync(DIST, 'utf-8')
+
+  expect(bundle).not.toContain('native-stub:@anthropic-ai/sandbox-runtime')
+  expect(bundle).toContain('bubblewrap (bwrap) not installed')
+})

scripts/system-check.test.ts

@@ -1,8 +1,10 @@
 import { describe, expect, test } from 'bun:test'
 
 import {
+  buildSandboxRuntimeCheck,
   checkNodeVersion,
   formatReachabilityFailureDetail,
+  isCliSandboxRuntimeStubbed,
   readNodeExecutableVersion,
 } from './system-check.ts'
 
@@ -119,3 +121,131 @@ describe('checkNodeVersion', () => {
     })
   })
 })
+
+describe('sandbox runtime diagnostics', () => {
+  test('fails when sandbox runtime inspection throws an Error', () => {
+    const result = buildSandboxRuntimeCheck({
+      inspectionError: new Error('EACCES: permission denied, open dist/cli.mjs'),
+    })
+
+    expect(result).toEqual({
+      ok: false,
+      label: 'Sandbox runtime',
+      detail:
+        'Unable to inspect CLI sandbox runtime: EACCES: permission denied, open dist/cli.mjs',
+    })
+  })
+
+  test('fails when sandbox runtime inspection throws a non-Error value', () => {
+    const result = buildSandboxRuntimeCheck({
+      inspectionError: 'bundle read failed',
+    })
+
+    expect(result).toEqual({
+      ok: false,
+      label: 'Sandbox runtime',
+      detail: 'Unable to inspect CLI sandbox runtime: bundle read failed',
+    })
+  })
+
+  test('detects sandbox-runtime native stubs in the CLI bundle', () => {
+    expect(
+      isCliSandboxRuntimeStubbed(
+        '// native-stub:@anthropic-ai/sandbox-runtime\nconst noop = () => null',
+      ),
+    ).toBe(true)
+    expect(isCliSandboxRuntimeStubbed('bubblewrap (bwrap) not installed')).toBe(
+      false,
+    )
+  })
+
+  test('fails when the CLI bundle contains a sandbox runtime stub', () => {
+    const result = buildSandboxRuntimeCheck({
+      cliRuntimeStubbed: true,
+      sandboxEnabled: true,
+      failIfUnavailable: true,
+      sandboxingEnabled: false,
+      unavailableReason: 'sandbox.enabled is set but the runtime is stubbed',
+    })
+
+    expect(result.ok).toBe(false)
+    expect(result.label).toBe('Sandbox runtime')
+    expect(result.detail).toContain('CLI bundle: stubbed')
+    expect(result.detail).toContain('effective behavior: fail-closed')
+    expect(result.detail).toContain(
+      'reason: sandbox.enabled is set but the runtime is stubbed',
+    )
+  })
+
+  test('reports warning-only behavior when sandbox is enabled but unavailable', () => {
+    const result = buildSandboxRuntimeCheck({
+      cliRuntimeStubbed: false,
+      sandboxEnabled: true,
+      failIfUnavailable: false,
+      sandboxingEnabled: false,
+      unavailableReason: 'bubblewrap (bwrap) not installed',
+    })
+
+    expect(result.ok).toBe(true)
+    expect(result.detail).toContain('CLI bundle: real runtime')
+    expect(result.detail).toContain('effective behavior: warning-only')
+    expect(result.detail).toContain('reason: bubblewrap (bwrap) not installed')
+  })
+
+  test('flags fail-closed behavior when sandbox is required but unavailable', () => {
+    const result = buildSandboxRuntimeCheck({
+      cliRuntimeStubbed: false,
+      sandboxEnabled: true,
+      failIfUnavailable: true,
+      sandboxingEnabled: false,
+      unavailableReason: 'bubblewrap (bwrap) not installed',
+    })
+
+    expect(result.ok).toBe(false)
+    expect(result.detail).toContain('CLI bundle: real runtime')
+    expect(result.detail).toContain('effective behavior: fail-closed')
+    expect(result.detail).toContain('reason: bubblewrap (bwrap) not installed')
+  })
+
+  test('reports enforcing behavior when sandboxing is active', () => {
+    const result = buildSandboxRuntimeCheck({
+      cliRuntimeStubbed: false,
+      sandboxEnabled: true,
+      failIfUnavailable: true,
+      sandboxingEnabled: true,
+    })
+
+    expect(result.ok).toBe(true)
+    expect(result.detail).toBe(
+      'CLI bundle: real runtime; sandbox.enabled: true; failIfUnavailable: true; effective behavior: enforcing',
+    )
+  })
+
+  test('reports disabled behavior without failing when sandbox is not enabled', () => {
+    const result = buildSandboxRuntimeCheck({
+      cliRuntimeStubbed: false,
+      sandboxEnabled: false,
+      failIfUnavailable: false,
+      sandboxingEnabled: false,
+    })
+
+    expect(result.ok).toBe(true)
+    expect(result.detail).toBe(
+      'CLI bundle: real runtime; sandbox.enabled: false; failIfUnavailable: false; effective behavior: disabled',
+    )
+  })
+
+  test('reports disabled behavior without failing when sandbox is off and the CLI runtime is stubbed', () => {
+    const result = buildSandboxRuntimeCheck({
+      cliRuntimeStubbed: true,
+      sandboxEnabled: false,
+      failIfUnavailable: false,
+      sandboxingEnabled: false,
+    })
+
+    expect(result.ok).toBe(true)
+    expect(result.detail).toBe(
+      'CLI bundle: stubbed; sandbox.enabled: false; failIfUnavailable: false; effective behavior: disabled',
+    )
+  })
+})

scripts/system-check.ts

@@ -1,5 +1,5 @@
 // @ts-nocheck
-import { existsSync, mkdirSync, writeFileSync } from 'node:fs'
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
 import { dirname, join, resolve } from 'node:path'
 import { spawnSync } from 'node:child_process'
 import {
@@ -17,6 +17,7 @@ import {
   MIN_NODE_ENGINE_RANGE,
   checkSupportedNodeVersion,
 } from '../src/utils/nodeRuntime.js'
+import { SandboxManager } from '../src/utils/sandbox/sandbox-adapter.js'
 
 type CheckResult = {
   ok: boolean
@@ -173,6 +174,92 @@ function checkBuildArtifacts(): CheckResult {
   return pass('Build artifacts', distCli)
 }
 
+export function isCliSandboxRuntimeStubbed(bundleText: string): boolean {
+  return bundleText.includes('native-stub:@anthropic-ai/sandbox-runtime')
+}
+
+type SandboxRuntimeCheckInput =
+  | {
+      inspectionError: unknown
+    }
+  | {
+      cliRuntimeStubbed: boolean
+      sandboxEnabled: boolean
+      failIfUnavailable: boolean
+      sandboxingEnabled: boolean
+      unavailableReason?: string
+    }
+
+function formatUnknownError(error: unknown): string {
+  return error instanceof Error ? error.message : String(error)
+}
+
+export function buildSandboxRuntimeCheck(
+  input: SandboxRuntimeCheckInput,
+): CheckResult {
+  if ('inspectionError' in input) {
+    return fail(
+      'Sandbox runtime',
+      `Unable to inspect CLI sandbox runtime: ${formatUnknownError(input.inspectionError)}`,
+    )
+  }
+
+  const effectiveBehavior = input.sandboxingEnabled
+    ? 'enforcing'
+    : input.sandboxEnabled
+      ? input.failIfUnavailable
+        ? 'fail-closed'
+        : 'warning-only'
+      : 'disabled'
+
+  const detailParts = [
+    `CLI bundle: ${input.cliRuntimeStubbed ? 'stubbed' : 'real runtime'}`,
+    `sandbox.enabled: ${input.sandboxEnabled}`,
+    `failIfUnavailable: ${input.failIfUnavailable}`,
+    `effective behavior: ${effectiveBehavior}`,
+  ]
+  const reason =
+    input.unavailableReason ??
+    (input.cliRuntimeStubbed && input.sandboxEnabled
+      ? 'CLI bundle contains a no-op sandbox runtime stub'
+      : undefined)
+  if (reason) {
+    detailParts.push(`reason: ${reason}`)
+  }
+
+  const ok = !(
+    input.sandboxEnabled &&
+    input.failIfUnavailable &&
+    Boolean(reason)
+  )
+  return ok
+    ? pass('Sandbox runtime', detailParts.join('; '))
+    : fail('Sandbox runtime', detailParts.join('; '))
+}
+
+function checkSandboxRuntime(): CheckResult {
+  const distCli = resolve(process.cwd(), 'dist', 'cli.mjs')
+  if (!existsSync(distCli)) {
+    return fail(
+      'Sandbox runtime',
+      `CLI bundle missing at ${distCli}. Run: bun run build`,
+    )
+  }
+
+  try {
+    const bundle = readFileSync(distCli, 'utf8')
+    return buildSandboxRuntimeCheck({
+      cliRuntimeStubbed: isCliSandboxRuntimeStubbed(bundle),
+      sandboxEnabled: SandboxManager.isSandboxEnabledInSettings(),
+      failIfUnavailable: SandboxManager.isSandboxRequired(),
+      sandboxingEnabled: SandboxManager.isSandboxingEnabled(),
+      unavailableReason: SandboxManager.getSandboxUnavailableReason(),
+    })
+  } catch (error) {
+    return buildSandboxRuntimeCheck({ inspectionError: error })
+  }
+}
+
 function isLocalBaseUrl(baseUrl: string): boolean {
   return isProviderLocalUrl(baseUrl)
 }
@@ -717,6 +804,7 @@ async function main(): Promise<void> {
   results.push(checkNodeVersion())
   results.push(checkBunRuntime())
   results.push(checkBuildArtifacts())
+  results.push(checkSandboxRuntime())
   results.push(...checkOpenAIEnv())
   results.push(await checkBaseUrlReachability())
   results.push(await checkProviderGenerationReadiness())