Add devbox image Dockerfiles and build scripts, split from homelab-komodo

devbox/base-config/kilo/acp-bridge-auth.py

@@ -0,0 +1,49 @@
+#!/usr/bin/env python3
+# Gate for acp-bridge-listen.sh's socat listeners: reads exactly one line
+# (unbuffered — a normal buffered readline could silently swallow bytes
+# belonging to the real protocol stream that follows, which would be lost on
+# exec) from the connection and compares it to PEER_BRIDGE_TOKEN. Only on a
+# match does it exec into the real target, inheriting the same socket fds so
+# everything after the token line passes through untouched.
+#
+# Without this, acp-bridge-listen.sh's ACP port would be a fully
+# auto-approving agent shell (bash, edit, write) reachable, unauthenticated,
+# by anything on the same docker network — not just the specific peer
+# workspace it's meant for.
+import os
+import sys
+
+
+def read_line_unbuffered():
+    buf = b""
+    fd = sys.stdin.fileno()
+    while True:
+        b = os.read(fd, 1)
+        if not b or b == b"\n":
+            break
+        buf += b
+    return buf.decode(errors="replace")
+
+
+def main():
+    if len(sys.argv) < 2:
+        print("usage: acp-bridge-auth.py <command> [args...]", file=sys.stderr)
+        print("       acp-bridge-auth.py --print-env <VAR_NAME>", file=sys.stderr)
+        sys.exit(1)
+
+    expected = os.environ.get("PEER_BRIDGE_TOKEN", "")
+    got = read_line_unbuffered()
+    if not expected or got != expected:
+        sys.exit(1)
+
+    # --print-env avoids threading a shell one-liner through socat's own EXEC
+    # argument quoting just to echo an already-inherited env var.
+    if sys.argv[1] == "--print-env":
+        print(os.environ.get(sys.argv[2], ""))
+        sys.exit(0)
+
+    os.execvp(sys.argv[1], sys.argv[1:])
+
+
+if __name__ == "__main__":
+    main()