Antigravity のサンドボックスでマルチエージェントを動かしても、隔離は思ったほど効いていない — 被害範囲を封じ込める運用メモ

<!-- AGENTS.md -->
## Code Generation Agent
- Sandbox: moderate
- Allowed paths: src/**, lib/**, types/**
- Denied paths: .env*, secrets/**, *.key
- Network: registry.npmjs.org
- Timeout: 180s
 
## Deploy Agent
- Sandbox: strict
- Allowed paths: .github/workflows/** (readonly), wrangler.toml (readonly)
- Denied paths: **/* (default deny)
- Network: api.cloudflare.com
- Timeout: 60s

// ❌ サンドボックス内で壊れる
const configPath = "/home/user/project/config.json";
 
// ✅ 実行時のカレントから解決する
const configPath = path.resolve(process.cwd(), "config.json");

// .antigravity/settings.json — 共有は一方向に固定する
{
  "agent.sandbox.sharedVolumes": [
    {
      "name": "codegen-output",
      "path": ".antigravity/exchange/codegen/",
      "permissions": {
        "code-gen-agent": "readwrite",
        "test-agent": "readonly"
      }
    },
    {
      "name": "test-report",
      "path": ".antigravity/exchange/report/",
      "permissions": {
        "test-agent": "readwrite",
        "deploy-agent": "readonly"
      }
    }
  ]
}

// egress-guard.ts — 完全一致の許可リスト + 試行の全記録
interface EgressAttempt {
  at: string;
  agentId: string;
  host: string;
  allowed: boolean;
}
 
class EgressGuard {
  private readonly allow: Set<string>;
  private readonly attempts: EgressAttempt[] = [];
 
  constructor(allowedHosts: string[]) {
    // サブドメインを含めず、完全一致のみを許可する
    this.allow = new Set(allowedHosts.map((h) => h.toLowerCase()));
  }
 
  check(agentId: string, url: string): boolean {
    const host = new URL(url).hostname.toLowerCase();
    const allowed = this.allow.has(host);
    this.attempts.push({
      at: new Date().toISOString(),
      agentId,
      host,
      allowed,
    });
    if (!allowed) {
      console.warn(`[egress] blocked ${agentId} -> ${host}`);
    }
    return allowed;
  }
 
  // ポリシー見直しの一次資料になる: 誰が、どこへ、通そうとしたか
  blockedHosts(): Record<string, number> {
    return this.attempts
      .filter((a) => !a.allowed)
      .reduce<Record<string, number>>((acc, a) => {
        acc[a.host] = (acc[a.host] ?? 0) + 1;
        return acc;
      }, {});
  }
}

// .antigravity/settings.json — 承認の頻度設計
{
  "agent.sandbox.autoApprove": [
    { "action": "write", "path": "src/**" },
    { "action": "write", "path": "tests/**" },
    { "action": "network", "host": "registry.npmjs.org" }
  ],
  "agent.sandbox.alwaysPrompt": [
    { "action": "write", "path": ".env*" },
    { "action": "write", "path": "**/*.pem" },
    { "action": "write", "path": ".git/**" },
    { "action": "network", "host": "*" }
  ]
}

// agent-policy.ts — 既定拒否で、必要分だけ開ける
interface AgentPolicy {
  agentId: string;
  read: string[];          // glob。ここにないものは読めない
  write: string[];         // glob。ここにないものは書けない
  egress: string[];        // 完全一致ホスト。空なら通信なし
  limits: {
    maxProcesses: number;
    maxMemoryMB: number;
    timeoutSeconds: number;
    maxFileSizeKB: number; // 1ファイルの上限。暴走生成でディスクを溢れさせない
  };
}
 
const codeGen: AgentPolicy = {
  agentId: "code-gen-agent",
  read: ["src/**", "lib/**", "types/**", "package.json", "tsconfig.json"],
  write: ["src/**", "lib/**", ".antigravity/exchange/codegen/**"],
  egress: ["registry.npmjs.org"],
  limits: { maxProcesses: 5, maxMemoryMB: 1024, timeoutSeconds: 180, maxFileSizeKB: 500 },
};
 
const deploy: AgentPolicy = {
  agentId: "deploy-agent",
  read: ["dist/**", ".antigravity/exchange/report/**"],
  write: [".antigravity/exchange/deploy-log/**"], // 本番資産には触らせない
  egress: ["api.cloudflare.com"],
  limits: { maxProcesses: 2, maxMemoryMB: 512, timeoutSeconds: 120, maxFileSizeKB: 100 },
};

// timeout-guard.ts — 上限で殺す前に、まず保存する
class TimeoutGuard {
  private readonly startedAt = Date.now();
  private readonly hardLimitMs: number;
  private readonly warnAtMs: number;
 
  constructor(
    seconds: number,
    private readonly saveCheckpoint: () => Promise<void>,
    warnRatio = 0.8,
  ) {
    this.hardLimitMs = seconds * 1000;
    this.warnAtMs = this.hardLimitMs * warnRatio;
  }
 
  async tick(agentId: string): Promise<void> {
    const elapsed = Date.now() - this.startedAt;
 
    if (elapsed >= this.hardLimitMs) {
      await this.saveCheckpoint(); // 捨てるのは実行であって、成果ではない
      throw new Error(`[timeout] ${agentId} exceeded ${this.hardLimitMs / 1000}s`);
    }
 
    if (elapsed >= this.warnAtMs) {
      const left = Math.round((this.hardLimitMs - elapsed) / 1000);
      console.warn(`[timeout] ${agentId}: ${left}s remaining`);
    }
  }
}

// containment.test.ts — 隔離の境界をわざと踏んで、止まることを確認する
import { describe, it, expect } from "vitest";
import { runInSandbox } from "./sandbox-runner";
import { codeGen } from "./agent-policy";
 
describe("code-gen-agent の封じ込め", () => {
  it("スコープ外への書き込みは拒否される", async () => {
    const r = await runInSandbox(codeGen, {
      action: "write",
      path: ".env.production",
      data: "LEAKED=1",
    });
    expect(r.allowed).toBe(false);
    expect(r.reason).toMatch(/not in write scope/);
  });
 
  it("許可していないホストへの通信は拒否される", async () => {
    const r = await runInSandbox(codeGen, {
      action: "network",
      url: "https://evil.example.com/exfil",
    });
    expect(r.allowed).toBe(false);
  });
 
  it("許可スコープ内の書き込みは通る（過剰ブロックでないこと）", async () => {
    const r = await runInSandbox(codeGen, {
      action: "write",
      path: "src/feature.ts",
      data: "export const ok = true;",
    });
    expect(r.allowed).toBe(true);
  });
});

// audit.ts — 試行・結果・理由を構造化して残す
interface AuditEntry {
  at: string;
  agentId: string;
  action: "read" | "write" | "network" | "process";
  target: string;
  outcome: "allowed" | "blocked";
  reason?: string;
}
 
class AuditLog {
  private entries: AuditEntry[] = [];
 
  record(e: Omit<AuditEntry, "at">): void {
    this.entries.push({ at: new Date().toISOString(), ...e });
  }
 
  // 事故調査の起点: ブロックされた書き込み・通信を時系列で
  blockedTimeline(agentId?: string): AuditEntry[] {
    return this.entries
      .filter((e) => e.outcome === "blocked")
      .filter((e) => !agentId || e.agentId === agentId)
      .sort((a, b) => a.at.localeCompare(b.at));
  }
}