@agenshield/sandbox 0.2.0 → 0.3.0

package/guarded-shell.d.ts

@@ -25,10 +25,10 @@ export declare const GUARDED_SHELL_CONTENT = "#!/bin/zsh\n# guarded-shell: launc
  * ZDOTDIR .zshenv — runs after /etc/zshenv (which calls path_helper on macOS).
  * Overrides PATH to only include $HOME/bin.
  */
-export declare const ZDOT_ZSHENV_CONTENT = "# AgenShield restricted .zshenv\n# Runs AFTER /etc/zshenv \u2014 overrides path_helper's full system PATH.\n\n# ALWAYS set HOME based on actual user, never inherit\nexport HOME=\"/Users/$(id -un)\"\nexport PATH=\"$HOME/bin\"\nexport SHELL=\"/usr/local/bin/guarded-shell\"\n\n# Clear any leftover env tricks\nunset DYLD_LIBRARY_PATH DYLD_FALLBACK_LIBRARY_PATH DYLD_INSERT_LIBRARIES\nunset PYTHONPATH NODE_PATH RUBYLIB PERL5LIB\nunset SSH_ASKPASS LD_PRELOAD\n";
+export declare const ZDOT_ZSHENV_CONTENT = "# AgenShield restricted .zshenv\n# Runs AFTER /etc/zshenv \u2014 overrides path_helper's full system PATH.\n\n# ALWAYS set HOME based on actual user, never inherit\nexport HOME=\"/Users/$(id -un)\"\nexport HISTFILE=\"$HOME/.zsh_history\"\n\n# Suppress locale to prevent /etc/zshrc from calling locale command\nexport LC_ALL=C LANG=C\n\nexport PATH=\"$HOME/bin\"\nexport SHELL=\"/usr/local/bin/guarded-shell\"\n\n# Clear any leftover env tricks\nunset DYLD_LIBRARY_PATH DYLD_FALLBACK_LIBRARY_PATH DYLD_INSERT_LIBRARIES\nunset PYTHONPATH NODE_PATH RUBYLIB PERL5LIB\nunset SSH_ASKPASS LD_PRELOAD\n";
 /**
  * ZDOTDIR .zshrc — interactive shell restrictions.
  * Applies RESTRICTED mode, locks variables, disables builtins, installs hooks.
  */
-export declare const ZDOT_ZSHRC_CONTENT = "# AgenShield restricted .zshrc\n# Applied to every interactive shell for the agent user.\n\nemulate -LR zsh\n\n# ---- Shell options ----\n# Note: NOT using setopt RESTRICTED as it disables cd entirely.\n# Instead we use preexec hooks and builtin disable for enforcement.\nsetopt NO_CASE_GLOB\nsetopt NO_BEEP\n\n# ---- Lock critical variables (readonly) ----\ntypeset -r PATH HOME SHELL\n\n# ---- Enforcement helpers ----\ndeny() {\n  print -r -- \"Denied by policy\"\n  return 126\n}\n\nis_allowed_cmd() {\n  local cmd=\"$1\"\n\n  # Allow shell builtins we explicitly permit\n  case \"\\$cmd\" in\n    cd|pwd|echo|printf|test|true|false|exit|return|break|continue|shift|set|unset|export|typeset|local|declare|readonly|let|read|print|pushd|popd|dirs|jobs|fg|bg|kill|wait|times|ulimit|umask|history|fc|type|whence|which|where|rehash)\n      return 0\n      ;;\n  esac\n\n  # Deny path execution outright\n  [[ \"$cmd\" == */* ]] && return 1\n\n  # Resolve command path\n  local resolved\n  resolved=\"\\$(whence -p -- \"\\$cmd\" 2>/dev/null)\" || return 1\n\n  # Must live under HOME/bin exactly\n  [[ \"\\$resolved\" == \"$HOME/bin/\"* ]] && return 0\n  return 1\n}\n\n# ---- Block dangerous builtins ----\ndisable -r builtin command exec eval hash nohup setopt source unfunction functions alias unalias 2>/dev/null || true\n\n# ---- Intercept every interactive command before execution ----\npreexec() {\n  local line=\"$1\"\n  local cmd=\"${line%%[[:space:]]*}\"\n\n  # Empty / whitespace lines\n  [[ -z \"\\$cmd\" ]] && return 0\n\n  # Deny anything with slash in the command token (direct path execution)\n  [[ \"\\$cmd\" == */* ]] && { print -r -- \"Denied: direct path execution\"; kill -KILL $$; }\n\n  # Deny anything not allowed\n  if ! is_allowed_cmd \"\\$cmd\"; then\n    print -r -- \"Denied: \\$cmd (not in \\$HOME/bin)\"\n    kill -KILL $$\n  fi\n}\n\n# ---- Also intercept non-interactive \\`zsh -c\\` cases ----\nTRAPDEBUG() {\n  local line=\"${ZSH_DEBUG_CMD:-$1}\"\n  local cmd=\"${line%%[[:space:]]*}\"\n  [[ -z \"\\$cmd\" ]] && return 0\n\n  [[ \"\\$cmd\" == */* ]] && { print -r -- \"Denied: direct path execution\"; return 126; }\n  is_allowed_cmd \"\\$cmd\" || { print -r -- \"Denied: \\$cmd\"; return 126; }\n  return 0\n}\n\n# ---- Ensure accessible working directory ----\ncd \"$HOME\" 2>/dev/null || cd /\n";
+export declare const ZDOT_ZSHRC_CONTENT = "# AgenShield restricted .zshrc\n# Applied to every interactive shell for the agent user.\n\nemulate -LR zsh\n\n# ---- Shell options ----\n# Note: NOT using setopt RESTRICTED as it disables cd entirely.\n# Instead we use preexec hooks and builtin disable for enforcement.\nsetopt NO_CASE_GLOB\nsetopt NO_BEEP\n\n# ---- Lock critical variables (readonly) ----\ntypeset -r PATH HOME SHELL\n\n# ---- Enforcement helpers ----\ndeny() {\n  print -r -- \"Denied by policy\"\n  return 126\n}\n\nis_allowed_cmd() {\n  local cmd=\"$1\"\n\n  # Allow shell builtins we explicitly permit\n  case \"$cmd\" in\n    cd|pwd|echo|printf|test|true|false|exit|return|break|continue|shift|set|unset|export|typeset|local|declare|readonly|let|read|print|pushd|popd|dirs|jobs|fg|bg|kill|wait|times|ulimit|umask|history|fc|type|whence|which|where|rehash)\n      return 0\n      ;;\n  esac\n\n  # Deny path execution outright\n  [[ \"$cmd\" == */* ]] && return 1\n\n  # Resolve command path\n  local resolved\n  resolved=\"$(whence -p -- \"$cmd\" 2>/dev/null)\" || return 1\n\n  # Must live under HOME/bin exactly\n  [[ \"$resolved\" == \"$HOME/bin/\"* ]] && return 0\n  return 1\n}\n\n# ---- Block dangerous builtins ----\ndisable -r builtin command exec eval hash nohup setopt source unfunction functions alias unalias 2>/dev/null || true\n\n# ---- Intercept every interactive command before execution ----\npreexec() {\n  local line=\"$1\"\n  local cmd=\"${line%%[[:space:]]*}\"\n\n  # Empty / whitespace lines\n  [[ -z \"$cmd\" ]] && return 0\n\n  # Deny anything with slash in the command token (direct path execution)\n  [[ \"$cmd\" == */* ]] && { print -r -- \"Denied: direct path execution\"; kill -KILL $$; }\n\n  # Deny anything not allowed\n  if ! is_allowed_cmd \"$cmd\"; then\n    print -r -- \"Denied: $cmd (not in $HOME/bin)\"\n    kill -KILL $$\n  fi\n}\n\n# ---- Also intercept non-interactive \\`zsh -c\\` cases ----\nTRAPDEBUG() {\n  local line=\"${ZSH_DEBUG_CMD:-$1}\"\n  local cmd=\"${line%%[[:space:]]*}\"\n  [[ -z \"$cmd\" ]] && return 0\n\n  [[ \"$cmd\" == */* ]] && { print -r -- \"Denied: direct path execution\"; return 126; }\n  is_allowed_cmd \"$cmd\" || { print -r -- \"Denied: $cmd\"; return 126; }\n  return 0\n}\n\n# ---- Ensure accessible working directory ----\ncd \"$HOME\" 2>/dev/null || cd /\n";
 //# sourceMappingURL=guarded-shell.d.ts.map

package/guarded-shell.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guarded-shell.d.ts","sourceRoot":"","sources":["../src/guarded-shell.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,kBAAkB,iCAAiC,CAAC;AACjE,eAAO,MAAM,QAAQ,yBAAyB,CAAC;AAE/C;;;GAGG;AACH,eAAO,MAAM,qBAAqB,mjBAgBjC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,8cAY/B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,gyEA4E9B,CAAC"}
+{"version":3,"file":"guarded-shell.d.ts","sourceRoot":"","sources":["../src/guarded-shell.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,kBAAkB,iCAAiC,CAAC;AACjE,eAAO,MAAM,QAAQ,yBAAyB,CAAC;AAE/C;;;GAGG;AACH,eAAO,MAAM,qBAAqB,mjBAgBjC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,ulBAiB/B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,swEA4E9B,CAAC"}

package/index.js

@@ -45,6 +45,11 @@ exec /bin/zsh
 
 # ALWAYS set HOME based on actual user, never inherit
 export HOME="/Users/$(id -un)"
+export HISTFILE="$HOME/.zsh_history"
+
+# Suppress locale to prevent /etc/zshrc from calling locale command
+export LC_ALL=C LANG=C
+
 export PATH="$HOME/bin"
 export SHELL="/usr/local/bin/guarded-shell"
 
@@ -77,7 +82,7 @@ is_allowed_cmd() {
   local cmd="$1"
 
   # Allow shell builtins we explicitly permit
-  case "\\$cmd" in
+  case "$cmd" in
     cd|pwd|echo|printf|test|true|false|exit|return|break|continue|shift|set|unset|export|typeset|local|declare|readonly|let|read|print|pushd|popd|dirs|jobs|fg|bg|kill|wait|times|ulimit|umask|history|fc|type|whence|which|where|rehash)
       return 0
       ;;
@@ -88,10 +93,10 @@ is_allowed_cmd() {
 
   # Resolve command path
   local resolved
-  resolved="\\$(whence -p -- "\\$cmd" 2>/dev/null)" || return 1
+  resolved="$(whence -p -- "$cmd" 2>/dev/null)" || return 1
 
   # Must live under HOME/bin exactly
-  [[ "\\$resolved" == "$HOME/bin/"* ]] && return 0
+  [[ "$resolved" == "$HOME/bin/"* ]] && return 0
   return 1
 }
 
@@ -104,14 +109,14 @@ preexec() {
   local cmd="\${line%%[[:space:]]*}"
 
   # Empty / whitespace lines
-  [[ -z "\\$cmd" ]] && return 0
+  [[ -z "$cmd" ]] && return 0
 
   # Deny anything with slash in the command token (direct path execution)
-  [[ "\\$cmd" == */* ]] && { print -r -- "Denied: direct path execution"; kill -KILL $$; }
+  [[ "$cmd" == */* ]] && { print -r -- "Denied: direct path execution"; kill -KILL $$; }
 
   # Deny anything not allowed
-  if ! is_allowed_cmd "\\$cmd"; then
-    print -r -- "Denied: \\$cmd (not in \\$HOME/bin)"
+  if ! is_allowed_cmd "$cmd"; then
+    print -r -- "Denied: $cmd (not in $HOME/bin)"
     kill -KILL $$
   fi
 }
@@ -120,10 +125,10 @@ preexec() {
 TRAPDEBUG() {
   local line="\${ZSH_DEBUG_CMD:-$1}"
   local cmd="\${line%%[[:space:]]*}"
-  [[ -z "\\$cmd" ]] && return 0
+  [[ -z "$cmd" ]] && return 0
 
-  [[ "\\$cmd" == */* ]] && { print -r -- "Denied: direct path execution"; return 126; }
-  is_allowed_cmd "\\$cmd" || { print -r -- "Denied: \\$cmd"; return 126; }
+  [[ "$cmd" == */* ]] && { print -r -- "Denied: direct path execution"; return 126; }
+  is_allowed_cmd "$cmd" || { print -r -- "Denied: $cmd"; return 126; }
   return 0
 }
 
@@ -1265,22 +1270,25 @@ function createDirectoryStructure(config) {
         group: socketGroupName
       },
       [`${agentHome}/bin`]: {
-        mode: 493,
-        // only owner can write
+        mode: 1533,
+        // setgid + group-writable
         owner: brokerUsername,
         // broker owns bin, can create skill wrappers
         group: socketGroupName
         // agent can read+exec via group
       },
       [`${agentHome}/.openclaw`]: {
-        mode: 493,
-        owner: "root",
+        mode: 1533,
+        // setgid + group-writable for broker
+        owner: brokerUsername,
+        // broker needs write access
         group: socketGroupName
       },
       [`${agentHome}/.openclaw/skills`]: {
         mode: 1533,
         // setgid bit, group-writable for broker to create subdirectories
-        owner: "root",
+        owner: brokerUsername,
+        // broker needs write access
         group: socketGroupName
       },
       [`${agentHome}/workspace`]: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenshield/sandbox",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "type": "module",
   "description": "User isolation and sandboxing utilities for AgenShield",
   "main": "./index.js",