maf 0.1.0 → 0.2.0

data/lib/maf/shared/processes.rb

@@ -3,6 +3,7 @@
 # maf shared library - code that the maf CLI and the scripts in .maf/bin share.
 # The installer copies this folder to .maf/lib/maf/shared/. maf update replaces it.
 # Use the Ruby stdlib only: a script loads this file without a gem bundle.
+require "time"
 
 module Maf
   module Shared
@@ -20,6 +21,25 @@ module Maf
         true
       end
 
+      def self.same?(pid, started)
+        !started.to_s.empty? && alive?(pid) && started_at(pid) == started.to_s
+      end
+
+      LEGACY_LIVE_WINDOW = 3600
+
+      def self.live?(entry)
+        return false unless alive?(entry["pid"])
+
+        recorded = entry["started"].to_s
+        recorded.empty? ? recent?(entry["seen_at"]) : recorded == started_at(entry["pid"])
+      end
+
+      def self.recent?(seen_at)
+        Time.now - Time.parse(seen_at.to_s) < LEGACY_LIVE_WINDOW
+      rescue ArgumentError
+        false
+      end
+
       # The start time as ps prints it, or "" when ps fails.
       def self.started_at(pid)
         IO.popen(PS_ENV, ["ps", "-o", "lstart=", "-p", pid.to_s], err: File::NULL, &:read).to_s.strip

data/lib/maf/shared/sandbox/bwrap.rb

@@ -0,0 +1,128 @@
+# frozen_string_literal: true
+
+# maf shared library - code that the maf CLI and the scripts in .maf/bin share.
+# The installer copies this folder to .maf/lib/maf/shared/. maf update replaces it.
+# Use the Ruby stdlib only: a script loads this file without a gem bundle.
+require "fileutils"
+
+module Maf
+  module Shared
+    module Sandbox
+      # Bwrap runs a command in a Linux bubblewrap sandbox.
+      module Bwrap
+        COMMAND = "bwrap"
+        MARKER = "MAF_BWRAP"
+        BASE = ["--ro-bind", "/", "/", "--dev-bind", "/dev", "/dev", "--tmpfs", "/dev/shm", "--proc", "/proc",
+                "--tmpfs", "/tmp", "--setenv", MARKER, "1"].freeze
+        MASKED_DIRS = %w[/run/user /run/dbus].freeze
+        MASKED_SOCKETS = %w[/run/docker.sock /run/podman/podman.sock /run/containerd/containerd.sock].freeze
+        HOOK = "# Project hook for coord worktree. See assets/worktree-env.example.rb in the maf gem.\n"
+
+        def self.wrap(cmd, paths)
+          return cmd if inside?
+
+          [binary, *BASE, *masks, *home, *binds(paths), *protects(paths), "--die-with-parent", "--", *cmd]
+        end
+
+        def self.available? = !binary.nil?
+
+        def self.binary
+          dirs = ENV.fetch("PATH", "").split(File::PATH_SEPARATOR).reject { |dir| agent_dir?(File.expand_path(dir)) }
+          dirs.map { |dir| File.join(dir, COMMAND) }.find { |file| File.executable?(file) }
+        end
+
+        def self.agent_dir?(dir)
+          writes = Array(Sandbox.policy["write"]).map { |path| File.expand_path(path, Project.root) }
+          tops = [Project.root, "/tmp", "/var/tmp", ENV.fetch("TMPDIR", nil), *writes].compact.map { _1.chomp("/") }
+          tops.any? { |top| dir == top || dir.start_with?("#{top}/") }
+        end
+
+        def self.require!
+          inside? || (available? && overlay?) || abort("maf: sandbox mode bwrap needs bubblewrap 0.10 or later.")
+        end
+
+        def self.inside?(mountinfo = "/proc/self/mountinfo")
+          ENV[MARKER] == "1" && File.foreach(mountinfo).any? { |line| home_overlay?(line) }
+        rescue SystemCallError
+          false
+        end
+
+        # mountinfo writes a space in a path as \040.
+        def self.home_overlay?(line) = line.include?(" #{mount_path(Dir.home)} ") && line.include?(" - overlay ")
+        def self.mount_path(path) = path.gsub(" ", "\\\\040")
+
+        def self.masks
+          runtime = ENV.fetch("XDG_RUNTIME_DIR", "")
+          MASKED_DIRS.select { |dir| File.directory?(dir) }.flat_map { |dir| ["--tmpfs", dir] } +
+            (runtime.start_with?("/run/user/") ? ["--dir", runtime] : []) +
+            MASKED_SOCKETS.select { |path| File.exist?(path) }.flat_map { |path| ["--ro-bind", "/dev/null", path] }
+        end
+
+        def self.home = ["--overlay-src", Dir.home, "--tmp-overlay", Dir.home]
+        def self.overlay? = IO.popen([binary, "--help"], err: %i[child out], &:read).include?("--tmp-overlay")
+
+        def self.binds(paths)
+          FileUtils.mkdir_p(paths.harness_dirs)
+          paths.prefixes.each { |file| File.exist?(file) || File.write(file, "{}\n") }
+          writable(paths).select { |path| File.exist?(path) }.flat_map { |path| ["--bind", path, path] }
+        end
+
+        def self.writable(paths)
+          ((paths.dirs - ["/tmp"]) + paths.harness_dirs + paths.prefixes).reject { |path| masked?(path) }
+        end
+
+        def self.masked?(path)
+          (MASKED_DIRS + MASKED_SOCKETS).any? do |mask|
+            path == mask || path.start_with?("#{mask}/") || mask.start_with?("#{path.chomp("/")}/")
+          end
+        end
+
+        # A mount point cannot be renamed, so each parent folder is bound onto itself.
+        # Then each protected path is bound read-only.
+        def self.protects(paths)
+          create_protected(paths)
+          parents = bound_parents(paths).select { |dir| File.directory?(dir) }.flat_map { |dir| ["--bind", dir, dir] }
+          parents + paths.protected.select { |path| File.exist?(path) }.flat_map { |path| ["--ro-bind", path, path] }
+        end
+
+        def self.bound_parents(paths)
+          tops = writable(paths)
+          paths.parents.select { |dir| tops.any? { |top| dir == top || dir.start_with?("#{top.chomp("/")}/") } }
+        end
+
+        # A bind needs an existing path. Else the agent could create a protected
+        # path, so the folders, the worktree hook, and the harness config are created first.
+        def self.create_protected(paths)
+          paths.protected_dirs.each { |dir| make(dir) }
+          create_hook(paths.coord_file("worktree-env.rb"))
+          paths.placeholders.each { |path| placeholder(path) }
+        end
+
+        def self.create_hook(hook)
+          File.exist?(File.dirname(hook)) && !File.exist?(hook) && File.write(hook, HOOK)
+        end
+
+        def self.placeholder(path)
+          return if File.exist?(path) || File.symlink?(path) || !File.directory?(File.dirname(path))
+
+          name = File.basename(path)
+          File.extname(name).empty? && !name.start_with?(".") ? make(path) : write(path, empty_text(name))
+        end
+
+        def self.write(path, text)
+          File.write(path, text)
+        rescue SystemCallError
+          nil
+        end
+
+        def self.empty_text(name) = name.end_with?(".json", ".jsonc") ? "{}\n" : ""
+
+        def self.make(dir)
+          FileUtils.mkdir_p(dir)
+        rescue SystemCallError
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/maf/shared/sandbox/harness_files.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+# maf shared library - code that the maf CLI and the scripts in .maf/bin share.
+# The installer copies this folder to .maf/lib/maf/shared/. maf update replaces it.
+# Use the Ruby stdlib only: a script loads this file without a gem bundle.
+
+module Maf
+  module Shared
+    module Sandbox
+      # HarnessFiles holds the state paths and the protected paths in the folders of the harnesses.
+      class HarnessFiles
+        def initialize(harnesses, real)
+          @harnesses = harnesses
+          @real = real
+        end
+
+        def dirs = @dirs ||= @real.call(@harnesses.flat_map(&:sandbox_dirs))
+        def prefixes = @real.call(@harnesses.flat_map(&:sandbox_prefixes))
+        def placeholders = @harnesses.flat_map(&:sandbox_placeholders)
+        def config = @harnesses.flat_map(&:sandbox_protected).select { |path| File.file?(path) }
+
+        def state
+          @state ||= @harnesses.flat_map(&:sandbox_state).map do |pattern|
+            pattern = File.expand_path(pattern)
+            File.join(@real.call([File.dirname(pattern)]).first, File.basename(pattern))
+          end
+        end
+
+        def state?(path)
+          dir = dirs.find { |folder| path.start_with?("#{folder}/") } or return false
+          top = File.join(dir, path.delete_prefix("#{dir}/").split("/").first)
+          state.any? { |pattern| File.fnmatch?(pattern, top, File::FNM_DOTMATCH | File::FNM_PATHNAME) }
+        end
+
+        def locked
+          @locked ||= (dirs.flat_map { |dir| children(dir) }.reject { |path| state?(path) } +
+                       @harnesses.flat_map(&:sandbox_protected)).uniq
+        end
+
+        private
+
+        def children(dir)
+          Dir.children(dir).map { |name| File.join(dir, name) }
+        rescue SystemCallError
+          []
+        end
+      end
+    end
+  end
+end

data/lib/maf/shared/sandbox/links.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+# maf shared library - code that the maf CLI and the scripts in .maf/bin share.
+# The installer copies this folder to .maf/lib/maf/shared/. maf update replaces it.
+# Use the Ruby stdlib only: a script loads this file without a gem bundle.
+require "fileutils"
+
+module Maf
+  module Shared
+    module Sandbox
+      # Links puts back a protected symlink that the agent changed in a bwrap run.
+      module Links
+        def self.record(paths) = paths.select { |path| File.symlink?(path) }.to_h { |path| [path, File.readlink(path)] }
+
+        def self.restore(links) = links.each { |link, target| restore_link(link, target) }
+
+        def self.restore_link(link, target)
+          return if File.symlink?(link) && File.readlink(link) == target
+
+          warn "maf: sandbox: the agent changed the protected link #{link}. maf put it back."
+          FileUtils.rm_rf(link) && File.symlink(target, link)
+        rescue SystemCallError => e
+          warn "maf: sandbox: cannot put back the link #{link}: #{e.message}"
+        end
+      end
+    end
+  end
+end

data/lib/maf/shared/sandbox/paths.rb

@@ -0,0 +1,124 @@
+# frozen_string_literal: true
+
+# maf shared library - code that the maf CLI and the scripts in .maf/bin share.
+# The installer copies this folder to .maf/lib/maf/shared/. maf update replaces it.
+# Use the Ruby stdlib only: a script loads this file without a gem bundle.
+require_relative "../project"
+require_relative "references"
+require_relative "harness_files"
+
+module Maf
+  module Shared
+    module Sandbox
+      # Paths holds the real paths of a sandbox.
+      class Paths
+        COMMON = ["/tmp", "/var/tmp"].freeze
+        PROTECTED = [".maf/sandbox.json", ".maf/bin", ".maf/lib", ".maf/env.sh", ".maf/coordination/harness-hooks",
+                     ".maf/claude", ".maf/mcp", ".git/hooks", ".git/config", ".git/commondir",
+                     ".git/config.worktree"].freeze
+        COORD_PROTECTED = %w[message-hooks taskrc worktree-env.rb taskdata/hooks].freeze
+        COORD_DIRS = %w[message-hooks taskdata/hooks].freeze
+        PROTECTED_DIRS = [".maf/bin", ".maf/lib", ".maf/claude", ".maf/mcp", ".git/hooks"].freeze
+        WORKTREE_PROTECTED = [".maf/bin", ".maf/lib", ".maf/env.sh", ".maf/coordination/harness-hooks"].freeze
+        FLOW_CONFIG = %w[.maf/claude/settings.json .maf/mcp/*.json].freeze
+
+        attr_reader :root
+
+        def initialize(harnesses, root, coord_dir, extra)
+          @harness = HarnessFiles.new(harnesses, ->(paths) { real(paths) })
+          @root = root
+          @coord_dir = coord_dir || File.join(root, ".maf", "coordination")
+          @extra = extra.map { |path| File.expand_path(path, root) }
+        end
+
+        def dirs = @dirs ||= real([@root, @coord_dir, *@extra, ENV.fetch("TMPDIR", nil), *COMMON])
+        def harness_dirs = @harness.dirs
+        def state = @harness.state
+        def harness_files = @harness.locked
+        def placeholders = @harness.placeholders
+        def prefixes = @harness.prefixes
+
+        def references
+          keep = ->(path) { writable?(path) }
+          References.of(@harness.config + project_config + flow_config, @root, keep) +
+            worktrees.flat_map { |dir| References.of(config_in(dir), dir, keep) }
+        end
+
+        def existing = dirs.select { |dir| File.exist?(dir) }
+        def sockets = real([@root, @coord_dir])
+
+        def protected
+          @protected ||= begin
+            paths = [*PROTECTED.map { |path| File.join(@root, path) }, *project_config, *coord_files, *worktree_links,
+                     *worktree_files, *submodule_files, *harness_files, *references]
+            (real(paths) + links(paths)).uniq
+          end
+        end
+
+        def project_config = config_in(@root)
+        def config_in(dir) = Harness.all.flat_map(&:sandbox_project).uniq.map { |path| File.join(dir, path) }
+        def flow_config = FLOW_CONFIG.flat_map { |glob| Dir.glob(File.join(@root, glob)) }
+
+        def protected_dirs
+          real([*PROTECTED_DIRS.map { |path| File.join(@root, path) }, *COORD_DIRS.map { |name| coord_file(name) }])
+        end
+
+        def coord_files = COORD_PROTECTED.map { |name| coord_file(name) }
+        def coord_file(name) = File.join(@coord_dir, name)
+
+        def worktree_links
+          Dir.glob(File.join(@root, Project::WORKTREES_DIR, "*", ".git")) +
+            Dir.glob(File.join(@root, ".git", "worktrees", "*", "{commondir,gitdir,config.worktree}"))
+        end
+
+        def worktree_files
+          worktrees.flat_map do |dir|
+            [*WORKTREE_PROTECTED.map { |path| File.join(dir, path) }, *config_in(dir)]
+          end
+        end
+
+        GIT_FILES = %w[config hooks].freeze
+
+        def submodule_files
+          dirs = Dir.glob(File.join(@root, ".git", "modules", "**", "HEAD")).map { |head| File.dirname(head) }
+          dirs = dirs.select { |dir| File.file?(File.join(dir, "config")) }
+          dirs.flat_map { |dir| GIT_FILES.map { |name| File.join(dir, name) } }
+        end
+
+        def worktrees = Dir.glob(File.join(@root, Project::WORKTREES_DIR, "*"))
+
+        def parents
+          protected.flat_map { |path| parents_of(path) }.uniq.sort_by(&:size)
+        end
+
+        private
+
+        def parents_of(path)
+          top = (dirs + harness_dirs).select { |dir| path.start_with?("#{dir}/") }.max_by(&:size)
+          top ? ancestors(path).take_while { |dir| dir.size >= top.size } : []
+        end
+
+        def writable?(path)
+          real_path = real([path]).first
+          dirs.any? { |dir| real_path.start_with?("#{dir}/") }
+        end
+
+        def ancestors(path) = (dir = File.dirname(path)) == path ? [] : [dir, *ancestors(dir)]
+        def real(paths) = paths.compact.reject(&:empty?).map { |path| resolve(File.expand_path(path)) }.uniq
+
+        def resolve(path)
+          File.realpath(path)
+        rescue SystemCallError
+          File.exist?(File.dirname(path)) ? in_real_dir(path) : path
+        end
+
+        def links(paths)
+          symlinks = paths.map { |path| File.expand_path(path) }.select { |path| File.symlink?(path) }
+          symlinks.map { |link| in_real_dir(link) }
+        end
+
+        def in_real_dir(path) = File.join(File.realpath(File.dirname(path)), File.basename(path))
+      end
+    end
+  end
+end

data/lib/maf/shared/sandbox/references.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+# maf shared library - code that the maf CLI and the scripts in .maf/bin share.
+# The installer copies this folder to .maf/lib/maf/shared/. maf update replaces it.
+# Use the Ruby stdlib only: a script loads this file without a gem bundle.
+require "json"
+
+module Maf
+  module Shared
+    module Sandbox
+      # References finds the files that a config file of a harness names.
+      module References
+        # A path in a command or a setting: ~/x, $HOME/x, ${HOME}/x, or /x.
+        PATH = %r{(?:~|\$\{?HOME\}?)?/[^\s"'`;|&()<>,\\]+}
+        # A relative path with a folder (scripts/hook.sh). A hook runs in the project folder.
+        RELATIVE = /(?<![\w.\/~}$-])[\w.-]+(?:\/[\w.-]+)+/
+        # An import in a Markdown file: @path, at the start of a line or after a space.
+        # A period or a comma after the path ends the sentence.
+        IMPORT = /(?:^|\s)@([^\s]+?)[.,;:!?)]*(?=\s|$)/
+        # Claude Code sets this variable to the project folder for a hook. It becomes ".", so RELATIVE finds the path.
+        PROJECT_DIR = /\$\{?CLAUDE_PROJECT_DIR\}?/
+        DEPTH = 5
+        MAX_SIZE = 1_000_000
+
+        def self.of(files, root, keep) = walk(files, root, DEPTH).select(&keep)
+
+        def self.walk(files, root, depth)
+          found = files.flat_map { |file| named_in(file, root) }.uniq - files
+          depth.zero? || found.empty? ? found : (found + walk(found, root, depth - 1)).uniq
+        end
+
+        def self.named_in(file, root)
+          text = read(file)
+          paths = file.end_with?(".md") ? imports(text, file) : commands(text, file, root)
+          paths.select { |path| File.file?(path) }
+        rescue SystemCallError, ArgumentError
+          []
+        end
+
+        def self.imports(text, file) = text.scan(IMPORT).flatten.map { |path| expand(path, file) }
+
+        def self.commands(text, file, root)
+          text = text.gsub(PROJECT_DIR, ".")
+          text.scan(PATH).map { |path| expand(path, file) } +
+            text.scan(RELATIVE).map { |path| File.expand_path(path, root) }
+        end
+
+        def self.read(file)
+          text = File.file?(file) && File.size(file) < MAX_SIZE ? File.read(file) : ""
+          file.end_with?(".json") ? without_permissions(text) : text
+        end
+
+        def self.without_permissions(text)
+          data = JSON.parse(text)
+          data.is_a?(Hash) ? JSON.generate(data.except("permissions")) : text
+        rescue JSON::ParserError
+          text
+        end
+
+        def self.expand(path, file) = File.expand_path(path.sub(/\A\$\{?HOME\}?/, "~"), File.dirname(file))
+      end
+    end
+  end
+end

data/lib/maf/shared/sandbox/seatbelt.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+# maf shared library - code that the maf CLI and the scripts in .maf/bin share.
+# The installer copies this folder to .maf/lib/maf/shared/. maf update replaces it.
+# Use the Ruby stdlib only: a script loads this file without a gem bundle.
+require "digest"
+
+module Maf
+  module Shared
+    module Sandbox
+      # Seatbelt runs a command in a macOS sandbox-exec profile.
+      module Seatbelt
+        COMMAND = "/usr/bin/sandbox-exec"
+        DEVICES = '(literal "/dev/null") (literal "/dev/zero") (literal "/dev/dtracehelper") ' \
+                  '(regex #"^/dev/tty") (regex #"^/dev/fd/") (regex #"^/dev/ptmx")'
+        DNS = '(path-literal "/private/var/run/mDNSResponder")'
+        TMP_PREFIX = "maf-sandbox-"
+        SERVICES = "(deny mach-lookup (global-name-regex #\"^com\\.apple\\.(coreservices|lsd)\\.\"))\n" \
+                   "(deny appleevent-send)\n"
+
+        def self.wrap(cmd, paths)
+          tmp = private_tmp(paths.root)
+          [COMMAND, "-p", profile(paths, tmp), "env", "TMPDIR=#{tmp}/", "XDG_CACHE_HOME=#{tmp}/cache", *cmd]
+        end
+
+        def self.available? = File.executable?(COMMAND)
+        def self.require! = available? || abort("maf: sandbox mode seatbelt needs #{COMMAND} (macOS only).")
+
+        def self.private_tmp(root) = own_dir(project_tmp(root))
+
+        def self.project_tmp(root)
+          File.join(File.realpath("/tmp"), "#{TMP_PREFIX}#{Process.uid}-#{Digest::SHA256.hexdigest(root)[0, 12]}")
+        end
+
+        def self.own_dir(dir)
+          make(dir)
+          stat = File.lstat(dir)
+          return dir if stat.directory? && stat.uid == Process.uid && stat.mode.nobits?(0o077)
+
+          abort "maf: #{dir} belongs to another user or is open to others. Remove it."
+        end
+
+        def self.make(dir)
+          Dir.mkdir(dir, 0o700)
+        rescue Errno::EEXIST
+          nil
+        end
+
+        def self.profile(paths, tmp)
+          "(version 1)\n(allow default)\n(deny file-write*)\n#{writes(paths)}#{protects(paths)}" \
+            "#{sockets([*paths.sockets, tmp])}#{SERVICES}"
+        end
+
+        def self.writes(paths)
+          rules = paths.dirs.map { |dir| "(subpath #{quote(dir)})" } +
+                  paths.prefixes.map { |prefix| "(prefix #{quote(prefix)})" } +
+                  paths.state.filter_map { |pattern| regex(pattern) }
+          "(allow file-write* #{DEVICES}\n  #{rules.join("\n  ")})\n"
+        end
+
+        def self.regex(pattern)
+          return if pattern.include?('"')
+
+          "(regex #\"^#{escape(pattern).gsub("*", "[^/]*")}(/|$)\")"
+        end
+
+        def self.escape(pattern) = pattern.gsub(/[.^$|()\[\]{}+?\\]/) { |char| "\\#{char}" }
+
+        # A later rule wins, so these denials come after the allowed folders.
+        def self.protects(paths)
+          rules = paths.protected.map { |path| "(subpath #{quote(path)})" } +
+                  paths.parents.map { |dir| "(literal #{quote(dir)})" }
+          "(deny file-write*\n  #{rules.join("\n  ")})\n"
+        end
+
+        def self.sockets(dirs)
+          allowed = [DNS, *dirs.map { |dir| "(subpath #{quote(dir)})" }]
+          rules = allowed.map { |path| "(allow network-outbound (remote unix-socket #{path}))\n" }
+          "(deny network-outbound (remote unix-socket))\n#{rules.join}"
+        end
+
+        def self.quote(path) = "\"#{path.gsub(/["\\]/) { |char| "\\#{char}" }}\""
+      end
+    end
+  end
+end

data/lib/maf/shared/sandbox.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+# maf shared library - code that the maf CLI and the scripts in .maf/bin share.
+# The installer copies this folder to .maf/lib/maf/shared/. maf update replaces it.
+# Use the Ruby stdlib only: a script loads this file without a gem bundle.
+require "json"
+require_relative "project"
+require_relative "harness"
+require_relative "sandbox/paths"
+require_relative "sandbox/seatbelt"
+require_relative "sandbox/bwrap"
+require_relative "sandbox/links"
+
+module Maf
+  module Shared
+    # Sandbox runs an agent command in the OS sandbox of the mode in .maf/sandbox.json.
+    module Sandbox
+      BACKENDS = { "seatbelt" => Seatbelt, "bwrap" => Bwrap }.freeze
+      MODES = ["off", "auto", *BACKENDS.keys].freeze
+      POLICY = File.join(".maf", "sandbox.json")
+
+      def self.policy
+        path = File.join(Project.root, POLICY)
+        return {} unless File.exist?(path)
+
+        JSON.parse(File.read(path)).tap { |data| data.is_a?(Hash) || abort("maf: #{POLICY} must hold a JSON object.") }
+      rescue SystemCallError, JSON::ParserError => e
+        abort "maf: cannot read #{POLICY}: #{e.message.lines.first.strip}. Fix the file, or delete it."
+      end
+
+      def self.mode(policy = self.policy)
+        mode = ENV.fetch("MAF_SANDBOX", nil).to_s
+        mode = policy["mode"] || "off" if mode.empty?
+        abort "maf: unknown sandbox mode '#{mode}' (use #{MODES.join(", ")})" unless MODES.include?(mode)
+        (mode == "auto" ? native : mode).tap { |name| BACKENDS[name]&.require! }
+      end
+
+      def self.native = RUBY_PLATFORM.include?("darwin") ? "seatbelt" : "bwrap"
+
+      def self.wrap(cmd, harness, coord_dir: ENV.fetch("COORD_DIR", nil))
+        policy = self.policy
+        mode = mode(policy)
+        mode == "off" ? cmd : BACKENDS[mode].wrap(harness.sandboxed(cmd), paths(harness, policy, coord_dir))
+      end
+
+      def self.keeping_links(harness, coord_dir: ENV.fetch("COORD_DIR", nil))
+        links = protected_links(harness, coord_dir)
+        yield
+      ensure
+        Links.restore(links || {})
+      end
+
+      def self.protected_links(harness, coord_dir)
+        policy = self.policy
+        mode(policy) == "bwrap" && !Bwrap.inside? ? Links.record(paths(harness, policy, coord_dir).protected) : {}
+      end
+
+      def self.describe(harness, coord_dir: ENV.fetch("COORD_DIR", nil))
+        policy = self.policy
+        mode = mode(policy)
+        mode == "off" ? "off" : "#{mode}, #{writes(paths(harness, policy, coord_dir))}"
+      end
+
+      def self.writes(paths)
+        state = paths.harness_dirs.select { |dir| File.exist?(dir) }
+        "writes to #{paths.existing.join(", ")}#{", and the state files in #{state.join(", ")}" if state.any?}"
+      end
+
+      def self.paths(harness, policy, coord_dir)
+        protect_policy
+        Paths.new([harness, *project_harnesses].uniq, Project.root, coord_dir, Array(policy["write"]))
+      end
+
+      def self.project_harnesses = Project.manifest.fetch("agents", []).filter_map { |a| Harness[a["harness"]] }
+
+      def self.protect_policy
+        path = File.join(Project.root, POLICY)
+        File.write(path, "{}\n") unless File.exist?(path)
+      rescue SystemCallError
+        nil
+      end
+    end
+  end
+end

data/lib/maf/team_command.rb

@@ -32,15 +32,15 @@ module Maf
 
     def line(id, entry)
       mode = entry["dispatch"] ? "dispatch" : "interactive"
-      [id.ljust(28), entry["role"].to_s.ljust(20), entry["harness"], entry["model"] || "-", mode, state(entry)]
+      [id.ljust(28), entry["role"].to_s.ljust(20), entry["harness"], entry["model"] || "-", mode, state(id, entry)]
         .join("  ")
     end
 
-    def state(entry)
+    def state(id, entry)
       pid = entry["pid"]
       return "-" unless pid
 
-      Shared::Processes.alive?(pid) ? "running (pid #{pid})" : "stopped"
+      Workers.at(@root).running?(id) ? "running (pid #{pid})" : "stopped"
     end
 
     # The budget keys replace the old budget. Keep every other manifest key,

data/lib/maf/uninstall/manifest.rb

@@ -2,25 +2,27 @@
 
 module Maf
   module Uninstall
-    # .maf/config.json lists the generated agents. Hermes skills live outside
-    # the project, so only the manifest tells which ones belong to it.
+    # .maf/config.json lists the generated agents. Some harnesses keep role
+    # files outside the project, so only the manifest tells which ones belong to it.
     class Manifest
       def initialize(project)
         @project = project
         @path = File.join(project, ".maf/config.json")
       end
 
-      def steps = File.exist?(@path) ? [Owned.remove(@path)] : []
+      def steps = [@path, policy].select { |path| File.exist?(path) }.map { |path| Owned.remove(path) }
+      def policy = File.join(@project, Maf::Shared::Sandbox::POLICY)
 
-      def hermes_skills
-        roles = data.fetch("agents", []).select { |a| a["harness"] == "hermes" }.map { |a| a["role"] }
-        roles.map { |role| File.join(hermes_dir, "#{File.basename(@project)}-#{role}", "SKILL.md") }
+      # The role files of the harnesses that keep them outside .maf/agents/.
+      def outside_role_files
+        data.fetch("agents", []).filter_map do |agent|
+          harness = Maf::Shared::Harness[agent["harness"]]
+          harness.role_destination(@project, agent["role"], data) if harness && !harness.role_path(agent["role"])
+        end
       end
 
       private
 
-      def hermes_dir = data.fetch("hermes_dir", Flow::DEFAULT_HERMES_DIR)
-
       def data
         @data ||= File.exist?(@path) ? (JSON.parse(File.read(@path)) rescue {}) : {}
       end