1 line
8.0 KiB
JSON
1 line
8.0 KiB
JSON
{"repo": "canyonroad/agentsh-blaxel", "files": {"config.yaml": {"f99dc588bbc6c3063c1794425940db9ee789ec7d": {"t": 1785674471.6392806, "n": 7643, "h": "8ae73511cd9c0575", "c": "# agentsh Server Configuration for Blaxel Sandbox\n# Optimized for containerized AI agent environments (v0.20.2)\n\n# Security settings from agentsh detect\nsecurity:\n mode: \"full\" # seccomp + eBPF + FUSE (v0.16.8 fix: EPERM instead of KILL)\n strict: true\n\ncapabilities:\n allow: []\n\nserver:\n http:\n addr: \"127.0.0.1:18080\"\n read_timeout: \"30s\"\n write_timeout: \"5m\"\n grpc:\n enabled: false\n\nauth:\n type: \"none\"\n\nlogging:\n level: \"info\"\n format: \"text\"\n output: \"stderr\"\n\nsessions:\n base_dir: \"/var/lib/agentsh/sessions\"\n max_sessions: 100\n default_timeout: \"1h\"\n default_idle_timeout: \"15m\"\n cleanup_interval: \"5m\"\n\naudit:\n enabled: true\n storage:\n sqlite_path: \"/var/lib/agentsh/events.db\"\n\nsandbox:\n # env_inject: Environment variables injected into all commands\n # These bypass env policy filtering (operator-trusted)\n # Primary use: BASH_ENV to disable bash builtins that bypass seccomp\n #\n # agentsh 0.20.2 (PR #380, fixes #374): env_inject is now applied on the\n # wrap-init/kernel-install (unixwrap) shim path, so these reach executed\n # commands again. (On 0.20.1 the unixwrap path ignored env_inject, which we\n # had worked around with an entrypoint export — no longer needed.)\n env_inject:\n BASH_ENV: \"/usr/lib/agentsh/bash_startup.sh\"\n OTEL_SERVICE_NAME: \"agentsh-blaxel\"\n OTEL_TRACES_EXPORTER: \"otlp\"\n\n # Enforce env_policy (allow/deny from default.yaml) on commands run through\n # the wrap/unixwrap shim path (agentsh 0.20.2, PR #387 / #379). Opt-in;\n # default off. Without it the wrap path leaks sandbox-api's full environment\n # (BL_*, NODE_VERSION, …) into commands. With it, only the env_policy allow\n # list passes (AGENTSH_*, BASH_ENV, OTEL_*, HOME, PATH, … are preserved) and\n # the deny list (AWS_*, *_TOKEN, LD_*, …) is stripped — defense-in-depth.\n # env_inject values above are operator-trusted and bypass this filtering.\n wrap_env_policy:\n enabled: true\n\n # FUSE filesystem interception (requires FUSE support)\n # Deferred: mount on first exec, not at startup. Survives container\n # freeze/thaw (Blaxel standby) — if re-mount fails, degrades gracefully.\n fuse:\n enabled: true\n mount_base_dir: \"/var/lib/agentsh/sessions\"\n audit:\n enabled: true\n mode: \"monitor\"\n\n # Network interception\n network:\n enabled: true\n intercept_mode: \"all\"\n proxy_listen_addr: \"127.0.0.1:0\"\n\n # cgroups resource enforcement\n # Note: Requires cgroup v2 and write access to cgroup filesystem\n cgroups:\n enabled: false # Keep disabled - read-only cgroup fs in containers\n\n # Unix sockets wrapper settings (seccomp enforcement)\n # REQUIRED for command blocking to work - wraps commands with agentsh-unixwrap\n unix_sockets:\n enabled: true\n\n # Seccomp syscall filtering\n # Enables command_rules enforcement at syscall level\n seccomp:\n enabled: true\n mode: \"enforce\"\n # Opaque sh -c handling (agentsh 0.20.2, PR #386 / fixes #378).\n # Blaxel's sandbox-api always runs `/bin/sh -c \"<command>\"`. \"enforce\" runs\n # scripts the shim cannot statically resolve (pipes, redirects, $-expansion,\n # &&, ;, globs) through the wrapped shell WITH per-exec interception, so the\n # inner commands are still policy-checked. (0.20.1 had no knob and\n # fail-closed every such script as shellc-opaque-script.)\n # Values: deny (block) | enforce (run under per-exec policy) | allow (run, no enforcement).\n # enforce is the 0.20.2 default; pinned here to document intent.\n shellc:\n opaque: enforce\n syscalls:\n default_action: \"allow\"\n on_block: \"errno\"\n execve:\n enabled: true\n # Debian .deb installs agentsh under /usr/bin, while tarball/musl\n # installs use /usr/local/bin. Bypass both internal tool locations so\n # seccomp execve interception never traps agentsh's own control path.\n internal_bypass:\n - \"/usr/bin/agentsh\"\n - \"/usr/bin/agentsh-unixwrap\"\n - \"/usr/local/bin/agentsh\"\n - \"/usr/local/bin/agentsh-unixwrap\"\n # File I/O interception via seccomp-notify\n file_monitor:\n # FUSE is the primary file policy layer in this Blaxel integration.\n # Keep the seccomp file monitor off; on Alpine/musl under Blaxel\n # v0.20.2 it can leave the agentsh server unresponsive mid-suite.\n enabled: false\n enforce_without_fuse: false\n intercept_metadata: false\n\n # Resource limits enforced at sandbox level\n limits:\n max_memory_mb: 2048\n max_cpu_percent: 50\n max_processes: 100\n\n# =============================================================================\n# POLICIES\n# =============================================================================\n\npolicies:\n dir: \"/etc/agentsh/policies\"\n default: \"default\"\n allowed:\n - \"default\"\n\n# =============================================================================\n# APPROVALS\n# =============================================================================\n\napprovals:\n enabled: false # Disable approvals for sandbox (no TTY available)\n mode: \"local_tty\"\n timeout: \"1s\"\n\n# =============================================================================\n# HEALTH & METRICS\n# =============================================================================\n\nhealth:\n path: \"/health\"\n readiness_path: \"/ready\"\n\nmetrics:\n enabled: true\n path: \"/metrics\"\n\n# =============================================================================\n# LLM PROXY - Intercept LLM API requests for auditing and DLP\n# =============================================================================\n\nproxy:\n mode: \"embedded\"\n port: 0\n\n providers:\n anthropic: \"https://api.anthropic.com\"\n openai: \"https://api.openai.com\"\n\n# =============================================================================\n# DLP (Data Loss Prevention) - Redact sensitive data from outputs\n# =============================================================================\n\ndlp:\n mode: \"redact\"\n\n patterns:\n email: true\n phone: true\n credit_card: true\n ssn: true\n api_keys: true\n\n custom_patterns:\n - name: openai_key\n display: \"[OPENAI_KEY]\"\n regex: \"sk-[a-zA-Z0-9]{48,}\"\n action: redact\n\n - name: anthropic_key\n display: \"[ANTHROPIC_KEY]\"\n regex: \"sk-ant-[a-zA-Z0-9-]{95,}\"\n action: redact\n\n - name: aws_access_key\n display: \"[AWS_KEY]\"\n regex: \"AKIA[0-9A-Z]{16}\"\n action: redact\n\n - name: github_pat\n display: \"[GITHUB_TOKEN]\"\n regex: \"ghp_[a-zA-Z0-9]{36}\"\n action: redact\n\n - name: github_oauth\n display: \"[GITHUB_OAUTH]\"\n regex: \"gho_[a-zA-Z0-9]{36}\"\n action: redact\n\n - name: jwt_token\n display: \"[JWT]\"\n regex: \"eyJ[a-zA-Z0-9_-]*\\\\.eyJ[a-zA-Z0-9_-]*\\\\.[a-zA-Z0-9_-]*\"\n action: redact\n\n - name: private_key\n display: \"[PRIVATE_KEY]\"\n regex: \"-----BEGIN [A-Z]+ PRIVATE KEY-----\"\n action: block\n\n - name: slack_token\n display: \"[SLACK_TOKEN]\"\n regex: \"xox[baprs]-[0-9]{10,13}-[0-9]{10,13}-[a-zA-Z0-9]{24}\"\n action: redact\n\n - name: database_url\n display: \"[DATABASE_URL]\"\n regex: \"(postgres|mysql|mongodb|redis)://[^\\\\s]+\"\n action: redact\n\n - name: bearer_token\n display: \"[BEARER_TOKEN]\"\n regex: \"Bearer\\\\s+[a-zA-Z0-9_-]{20,}\"\n action: redact\n\n redact_files:\n - \"**/.env\"\n - \"**/.env.*\"\n - \"**/credentials*\"\n - \"**/*secret*\"\n - \"**/*.pem\"\n - \"**/*.key\"\n\n# =============================================================================\n# DEVELOPMENT SETTINGS\n# =============================================================================\n\ndevelopment:\n disable_auth: true\n"}}}} |