fix(computer-server): close Android VM escape vectors in command routing - #1193
Closed
ddupont808 wants to merge 11 commits into
Closed
fix(computer-server): close Android VM escape vectors in command routing#1193ddupont808 wants to merge 11 commits into
ddupont808 wants to merge 11 commits into
Conversation
Rewrote both custom agent doc pages to accurately reflect the codebase: - Correct perform_task signature (includes tracer param) - Show @register_agent decorator pattern - Add --with flag for dev without rebuilding Docker image - Complete action types and AgentResult reference Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…ocker runtimes - New cua-sandbox package: declarative Image API, layered disk caching, multi-runtime support - QEMU WSL2 runtime: runs QEMU inside WSL2 with KVM hardware acceleration on Windows - Hyper-V runtime: builds Windows images from ISO with native Hyper-V Gen2 VMs - Shared Windows unattended install (builder/windows_unattend.py): Autounattend.xml, ISO creation - OCI registry push/pull for QEMU disk images - Computer-server setup script installs cua-computer-server only (no PyTorch/agent) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Cloud sandboxes are now the default path — sandbox() connects to the CUA platform API, provisions VMs, and delegates control via HTTPTransport. Ephemeral inference: image= creates+destroys, name= connects only. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…ple sandboxes Adds AndroidEmulatorRuntime with headless toggle, ADB/VNC/SSH/QMP transports, cloud transport timeout increase (10min), and example sandbox scripts. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
… VM creation Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…and hardware keys Adds sb.mobile.* methods (tap, swipe, scroll, pinch, home, back, etc.) backed by ADB shell commands, and an ephemeral Android example. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…se VM escape vectors - android.py: remove host-bypass heuristic in run_command that allowed any command containing "uv", "python", or "/home/androidusr" to execute on the container host instead of inside the emulator; all commands now route through adb shell unconditionally - main.py: PTY endpoint now enforces adb shell on Android regardless of any caller-supplied command parameter, closing the bypass where an explicit command could get a host PTY - linux/macos/windows run_command: route through adb shell when IS_CUA_ANDROID is set Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
📦 Publishable packages changed
Add |
Contributor
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (79)
📝 WalkthroughWalkthroughThis pull request introduces a new Changes
Sequence DiagramsequenceDiagram
participant User
participant Sandbox
participant Runtime
participant Transport
participant Image as Image/Registry
participant Guest as Guest (VM/Container)
User->>Sandbox: sandbox(image=..., local=True)
Sandbox->>Image: resolve image kind (if needed)
Sandbox->>Sandbox: auto-select runtime<br/>(Docker/QEMU/etc.)
Sandbox->>Runtime: Runtime.start(image, name)
Runtime->>Guest: Launch VM/container<br/>(via Docker/QEMU/etc.)
Guest-->>Runtime: RuntimeInfo<br/>(host, api_port, vnc_port)
Sandbox->>Transport: Select transport type<br/>(HTTP/VNC/SSH/etc.)
Transport->>Transport: connect()
Transport-->>Sandbox: Connected
Sandbox-->>User: Sandbox instance<br/>(with interfaces)
User->>Sandbox: screenshot()/click()/type()
Sandbox->>Transport: send(action, params)
Transport->>Guest: HTTP POST /cmd<br/>or VNC/SSH/ADB command
Guest-->>Transport: Response (image/result/status)
Transport-->>Sandbox: Parsed result
Sandbox-->>User: Return value
User->>Sandbox: close()
Sandbox->>Transport: disconnect()
Sandbox->>Runtime: stop()
Runtime->>Guest: Terminate VM/container
Estimated code review effort🎯 4 (Complex) | ⏱️ ~75 minutes Possibly related PRs
Poem
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
|
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
android.pyrun_commandhad a host-bypass via substring matching on"uv","python","/home/androidusr"— trivially bypassable by any authenticated caller. Removed; all commands now route throughadb shellunconditionally./ptyendpoint enforcedadb shellonly when nocommandparam was supplied. Explicitcommandparam bypassed this and gave a host PTY. Nowadb shellis enforced unconditionally on Android.linux/macos/windowsrun_commandnow route throughadb shellwhenIS_CUA_ANDROIDis set as defense-in-depth.Test plan
run_commandon Android routes all commands throughadb shellwith no host execution pathadb shell, even when acommandbody param is passedSummary by CodeRabbit
New Features
cua-sandboxPython SDK for controlling sandboxed VMs and containers across multiple platforms (Docker, QEMU, Hyper-V, Lume, Android emulator, Tart) with a unified async API.Documentation
Tests