@aron98/load-lock 1.2.0 → 1.2.1

package/README.md

@@ -59,7 +59,8 @@ agent A (OpenCode)        agent B (Codex)         agent C (Claude Code)
 ```sh
 npm install -g @aron98/load-lock
 load-lock install --harness opencode     # or claude-code | codex | gemini-cli |
-                                         # copilot-cli | cline | roo-code | goose | generic
+                                         # copilot-cli | cline | roo-code | goose |
+                                         # omac (sandbox grants) | generic
 load-lock doctor
 ```
 
@@ -88,7 +89,7 @@ WSL2) share the host's budget instead of getting their own: bridge the
 daemon's Unix socket into the sandbox, set `LOAD_LOCK_NO_SPAWN=1` so the
 client never spawns a useless sandbox-local daemon, and optionally tag
 holds with `LOAD_LOCK_LABEL_PREFIX` (e.g. `bwrap:issue-42 build`).
-Ready-to-run per-sandbox recipes — live-verified for bubblewrap,
+Ready-to-run per-sandbox recipes — live-verified for bubblewrap and omac,
 contract-inspected for the rest, plus the cross-PID-namespace lease
 lifecycle — live in docs/OPERATIONS.md → "Sandboxes".
 

package/dist/cli/install.js

@@ -43,11 +43,22 @@
  *                   .cursor/rules/load-lock.mdc. Contract-tested against
  *                   the documented hooks JSON; not live-verified.
  *  - generic      : prints an MCP stdio config snippet (any MCP-capable harness).
+ *  - omac         : merges load-lock grants into omac's user-global sandbox
+ *                   profile (~/.config/omac/sandbox-profiles/default.json):
+ *                   filesystem.allow_unix_dir += the state dir (host-daemon
+ *                   socket bridge), filesystem.read += the installed package
+ *                   tree when load-lock lives outside any granted workdir
+ *                   (global bun/npm installs; gotcha verified live), and
+ *                   environment.allow_vars += "LOAD_LOCK_*". omac parses
+ *                   profiles strictly (unknown fields are errors) and never
+ *                   rewrites a profile it has created, so the installer only
+ *                   writes known fields and touches nothing else.
  */
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { POLICY_BRIEF } from "../policy/text.js";
+import { resolveStateDir } from "../shared/transport.js";
 const HOME = os.homedir();
 const PKG_NAME = "@aron98/load-lock";
 export function pkgRoot(binDir) {
@@ -948,6 +959,206 @@ function uninstallCursor(opts) {
     pruneEmptyDirs(cursorDir, cursorDir);
     return actions;
 }
+// --------------------------------------------------------------------- omac
+// omac (verified against 0.11.0) sandboxes agents with bubblewrap +
+// Landlock on Linux and strips the harness environment, allowing through
+// only what the user-global sandbox profile lists. Known profile fields
+// (strict parsing — unknown fields are hard errors): top-level `workdir`,
+// `network`, `filesystem`, `environment`; `workdir.access`,
+// `network.allow_domain`/`deny_domain`/`allow_tcp_connect`,
+// `filesystem.allow`/`read`/`write`/`allow_unix_dir`/`deny`,
+// `environment.allow_vars` — all lists of strings. omac never rewrites a
+// profile it has created, so the profile file is the whole extension
+// point and we only ever write known fields.
+const OMAC_LL_ENV_ENTRY = "LOAD_LOCK_*"; // allow_vars trailing-* prefix (verified: accepted by 0.11.0)
+/** omac's user-global sandbox profile (no project equivalent exists). */
+function omacProfileFile() {
+    return path.join(configHome(), "omac", "sandbox-profiles", "default.json");
+}
+/** Read + shape-check the profile; undefined when the file does not exist. */
+function omacReadProfile(file) {
+    if (!fs.existsSync(file))
+        return undefined;
+    let parsed;
+    try {
+        parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+    }
+    catch (e) {
+        throw new Error(`${file} is not valid JSON (${e instanceof Error ? e.message : String(e)}). omac parses ` +
+            `profiles strictly; load-lock refuses to overwrite it — fix or remove the file, then re-run install`);
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        throw new Error(`${file} is not a JSON object; refusing to overwrite`);
+    }
+    return parsed;
+}
+/** The profile sub-object `key`, created when absent; refuses non-objects. */
+function omacSection(profile, key) {
+    const v = profile[key];
+    if (v === undefined) {
+        const section = {};
+        profile[key] = section;
+        return section;
+    }
+    if (typeof v !== "object" || v === null || Array.isArray(v)) {
+        throw new Error(`omac profile: "${key}" is not an object; refusing to overwrite`);
+    }
+    return v;
+}
+/**
+ * Merge string entries into section[key] (created only when something is
+ * added, so we never write empty arrays). Returns the entries actually
+ * added; refuses non-string-array values instead of mangling them.
+ */
+function omacMergeList(section, key, entries) {
+    const v = section[key];
+    let list;
+    if (v === undefined)
+        list = [];
+    else if (Array.isArray(v) && v.every((x) => typeof x === "string"))
+        list = [...v];
+    else
+        throw new Error(`omac profile: "${key}" is not an array of strings; refusing to overwrite`);
+    const added = entries.filter((e) => !list.includes(e));
+    if (added.length)
+        section[key] = [...list, ...added];
+    return added;
+}
+/**
+ * The installed package tree a sandboxed CLI must be able to *read*.
+ * Live-verified gotcha: a global bun/npm install grants the bin dir, but
+ * the launcher resolves the dist tree under `.../node_modules/@aron98/
+ * load-lock` — without a read grant the CLI dies with ERR_MODULE_NOT_FOUND
+ * before ever reaching the socket. Returns the realpath of the package
+ * root, or null when load-lock lives in a repo checkout / worktree (the
+ * nearest `.git`): there the agent's omac workdir grant already covers
+ * it, and a read grant would be noise.
+ */
+function omacReadGrant(P) {
+    let root = P.root;
+    try {
+        root = fs.realpathSync(root);
+    }
+    catch {
+        /* keep the unresolved path — omac grants are not existence-filtered */
+    }
+    for (let dir = root;;) {
+        if (fs.existsSync(path.join(dir, ".git")))
+            return null; // repo checkout / git worktree
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return root;
+}
+/**
+ * Remove our entries (match-own-entries style: exact current state dir,
+ * the "LOAD_LOCK_*" prefix entry, and read entries pointing at the
+ * current package root or at a global `node_modules/@aron98/load-lock`
+ * tree — the shape the installer writes). Keys whose lists we emptied are
+ * dropped; sections that become empty are dropped; the file is removed
+ * (and dirs pruned) when nothing user-owned remains.
+ */
+function uninstallOmac() {
+    const actions = [];
+    const file = omacProfileFile();
+    const profile = omacReadProfile(file);
+    if (!profile)
+        return actions; // nothing installed; uninstall never creates anything
+    const stateDir = resolveStateDir(process.platform, process.env);
+    const readTree = omacReadGrant(pkgPaths());
+    const globalPkgSuffix = path.join("node_modules", PKG_NAME);
+    let changed = false;
+    const drop = (sectionKey, key, isOurs) => {
+        const section = profile[sectionKey];
+        if (!section || typeof section !== "object" || Array.isArray(section))
+            return;
+        const list = section[key];
+        if (!Array.isArray(list) || !list.every((x) => typeof x === "string"))
+            return;
+        const kept = list.filter((e) => !isOurs(e));
+        if (kept.length === list.length)
+            return;
+        changed = true;
+        if (kept.length)
+            section[key] = kept;
+        else
+            delete section[key];
+    };
+    drop("filesystem", "allow_unix_dir", (e) => e === stateDir);
+    drop("filesystem", "read", (e) => (readTree !== null && e === readTree) || e.endsWith(globalPkgSuffix));
+    drop("environment", "allow_vars", (e) => e === OMAC_LL_ENV_ENTRY);
+    // prune sections our removals emptied (never anything the user still has)
+    for (const key of ["filesystem", "environment"]) {
+        const section = profile[key];
+        if (section && typeof section === "object" && !Array.isArray(section) && Object.keys(section).length === 0) {
+            delete profile[key];
+        }
+    }
+    if (!changed) {
+        actions.push(`no load-lock grants found in ${file}`);
+        return actions;
+    }
+    if (Object.keys(profile).length === 0) {
+        fs.rmSync(file);
+        actions.push(`removed ${file} (nothing else was in it)`);
+        pruneEmptyDirs(path.dirname(file), path.join(configHome(), "omac"));
+    }
+    else {
+        writeJson(file, profile);
+        actions.push(`removed load-lock grants from ${file}`);
+    }
+    return actions;
+}
+function installOmac(opts, P) {
+    const actions = [];
+    const file = omacProfileFile();
+    const existed = fs.existsSync(file);
+    const profile = omacReadProfile(file) ?? {};
+    const stateDir = resolveStateDir(process.platform, process.env);
+    const grants = [];
+    const fsSection = omacSection(profile, "filesystem");
+    grants.push(...omacMergeList(fsSection, "allow_unix_dir", [stateDir]));
+    const readTree = omacReadGrant(P);
+    if (readTree)
+        grants.push(...omacMergeList(fsSection, "read", [readTree]));
+    const envSection = omacSection(profile, "environment");
+    grants.push(...omacMergeList(envSection, "allow_vars", [OMAC_LL_ENV_ENTRY]));
+    // merge-only: never rewrite the file when nothing changed (idempotent
+    // re-install leaves the user's bytes untouched)
+    if (grants.length || !existed)
+        writeJson(file, profile);
+    if (!existed)
+        actions.push(`created ${file} (omac's user-global sandbox profile)`);
+    else if (grants.length)
+        actions.push(`grants merged into ${file}`);
+    else
+        actions.push(`all grants already present in ${file} — nothing to do`);
+    for (const g of grants) {
+        if (g === OMAC_LL_ENV_ENTRY) {
+            actions.push(`environment.allow_vars += "${OMAC_LL_ENV_ENTRY}" (prefix pattern; passes all four LOAD_LOCK_* vars through the sandbox env filter)`);
+        }
+        else if (g === stateDir) {
+            actions.push(`filesystem.allow_unix_dir += ${stateDir} (AF_UNIX connect to the host daemon socket + read/write on the state dir)`);
+        }
+        else {
+            actions.push(`filesystem.read += ${g} (installed package tree — the bin-dir grant alone is not enough; without this the CLI dies with ERR_MODULE_NOT_FOUND before reaching the socket)`);
+        }
+    }
+    if (!readTree) {
+        actions.push(`skipped filesystem.read: load-lock lives in a repo checkout (${P.root}) — the omac workdir grant already covers it`);
+    }
+    actions.push("set the values in your harness env (the grants only allow the names through): " +
+        "LOAD_LOCK_NO_SPAWN=1 (client-only; the daemon must run on the host, e.g. load-lock service start), " +
+        "LOAD_LOCK_LABEL_PREFIX=omac (dashboard shows holders as omac:<label>); " +
+        "LOAD_LOCK_SOCKET only if the default <state dir>/daemon.sock is not what the sandbox sees");
+    actions.push("label prefixes need load-lock >= 1.2.0 on BOTH ends: a daemon started before v1.2.0 " +
+        "silently strips the unknown labelPrefix field — upgrade and restart the daemon (load-lock service stop && load-lock service start)");
+    actions.push("verified live against omac 0.11.0 (bubblewrap + Landlock): sandboxed client -> host daemon " +
+        "round-trip, prefixed labels, LOAD_LOCK_NO_SPAWN error contract");
+    return actions;
+}
 // -------------------------------------------------------------------- public
 export async function installCommand(opts) {
     const P = pkgPaths(opts.binDir);
@@ -956,7 +1167,7 @@ export async function installCommand(opts) {
     }
     const harness = opts.harness;
     if (!harness)
-        throw new Error("install: --harness <opencode|claude-code|codex|cursor|gemini-cli|copilot-cli|cline|roo-code|goose|generic> is required");
+        throw new Error("install: --harness <opencode|claude-code|codex|cursor|gemini-cli|copilot-cli|cline|roo-code|goose|omac|generic> is required");
     let actions;
     switch (harness) {
         case "opencode":
@@ -992,6 +1203,9 @@ export async function installCommand(opts) {
         case "goose":
             actions = installGoose(opts, P);
             break;
+        case "omac":
+            actions = installOmac(opts, P);
+            break;
         case "generic":
         case "all":
         default:
@@ -1044,6 +1258,9 @@ export async function uninstallCommand(opts) {
         case "goose":
             actions = uninstallGoose();
             break;
+        case "omac":
+            actions = uninstallOmac();
+            break;
         default:
             throw new Error(`uninstall: unknown harness "${opts.harness}"`);
     }

package/dist/test/install.test.js

@@ -5,7 +5,7 @@
  */
 import { test } from "node:test";
 import assert from "node:assert/strict";
-import { mkdtempSync, rmSync, mkdirSync, readFileSync, writeFileSync, existsSync } from "node:fs";
+import { mkdtempSync, rmSync, mkdirSync, readFileSync, writeFileSync, existsSync, cpSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -656,3 +656,183 @@ test("cursor: uninstall with nothing installed is a harmless no-op", async () =>
     assert.ok(!existsSync(join(proj, ".cursor")), "no files created by uninstall");
     rmSync(home, { recursive: true, force: true });
 });
+// --------------------------------------------------------------------- omac
+// The omac profile the installer must merge into without damaging it:
+// entries in every known section plus an unknown field (a newer omac
+// would accept it; we must preserve it untouched).
+function omacUserProfile(home) {
+    return JSON.stringify({
+        workdir: { access: "readwrite" },
+        network: { allow_domain: ["example.com"], allow_tcp_connect: [22] },
+        filesystem: {
+            allow: ["/data"],
+            read: ["/docs"],
+            write: ["/out"],
+            allow_unix_dir: ["/tmp/other-socks"],
+            deny: [".env"],
+        },
+        environment: { allow_vars: ["ANTHROPIC_API_KEY", "MY_*"] },
+        someFutureField: { nested: true },
+    }, null, 2) + "\n";
+}
+function omacProfilePath(home) {
+    return join(home, ".config", "omac", "sandbox-profiles", "default.json");
+}
+test("omac: install/uninstall round-trip on a populated profile; re-install is byte-identical", async () => {
+    const home = tempHome();
+    const xdg = join(home, ".config");
+    const profileFile = omacProfilePath(home);
+    mkdirSync(dirname(profileFile), { recursive: true });
+    const before = omacUserProfile(home);
+    writeFileSync(profileFile, before);
+    const stateDir = join(home, "ll-state");
+    const env = { XDG_CONFIG_HOME: xdg, LOAD_LOCK_STATE_DIR: stateDir, XDG_STATE_HOME: join(home, ".local", "state") };
+    // -- install
+    let r = await runCli(home, ["install", "--harness", "omac"], env);
+    assert.equal(r.code, 0, `install failed: ${r.stderr}`);
+    // honesty: live-verified claim, the env prefix entry, and the state-dir grant
+    assert.match(r.stdout, /live-verified.*omac 0\.11\.0|verified live against omac 0\.11\.0/i, "installer output must state the verification status");
+    assert.match(r.stdout, /LOAD_LOCK_\*/, "installer output must mention the LOAD_LOCK_* allow_vars entry");
+    assert.match(r.stdout, /allow_unix_dir \+=/, "installer output must mention the state-dir grant");
+    assert.match(r.stdout, /skipped filesystem\.read.*repo checkout/, "installer output must honestly note the skipped read grant (CLI runs from a repo checkout)");
+    const p = JSON.parse(readFileSync(profileFile, "utf8"));
+    // user entries preserved everywhere
+    assert.deepEqual(p.workdir, { access: "readwrite" }, "user workdir section preserved");
+    assert.deepEqual(p.network, { allow_domain: ["example.com"], allow_tcp_connect: [22] }, "user network section preserved");
+    assert.deepEqual(p.filesystem.allow, ["/data"], "user filesystem.allow preserved");
+    assert.deepEqual(p.filesystem.write, ["/out"], "user filesystem.write preserved");
+    assert.deepEqual(p.filesystem.deny, [".env"], "user filesystem.deny preserved");
+    assert.deepEqual(p.filesystem.read, ["/docs"], "read untouched — repo checkout needs no package-tree grant");
+    assert.deepEqual(p.someFutureField, { nested: true }, "unknown (newer-omac) field preserved");
+    // our grants, exactly once, alongside the user's
+    assert.deepEqual(p.filesystem.allow_unix_dir, ["/tmp/other-socks", stateDir], "state dir appended to allow_unix_dir");
+    assert.deepEqual(p.environment.allow_vars, ["ANTHROPIC_API_KEY", "MY_*", "LOAD_LOCK_*"], "LOAD_LOCK_* appended to allow_vars");
+    assert.equal(p.filesystem.allow_unix_dir.filter((e) => e === stateDir).length, 1, "state dir granted exactly once");
+    // -- idempotent re-install: the file is not rewritten at all
+    const afterInstall = readFileSync(profileFile, "utf8");
+    r = await runCli(home, ["install", "--harness", "omac"], env);
+    assert.equal(r.code, 0, `re-install failed: ${r.stderr}`);
+    assert.equal(readFileSync(profileFile, "utf8"), afterInstall, "re-install must be byte-identical");
+    assert.match(r.stdout, /already present.*nothing to do/, "re-install must say nothing was needed");
+    // -- uninstall removes exactly our entries
+    r = await runCli(home, ["uninstall", "--harness", "omac"], env);
+    assert.equal(r.code, 0, `uninstall failed: ${r.stderr}`);
+    const u = JSON.parse(readFileSync(profileFile, "utf8"));
+    assert.deepEqual(u.filesystem.allow_unix_dir, ["/tmp/other-socks"], "our state dir removed, user entry kept");
+    assert.ok(!u.filesystem.read.includes(stateDir), "no stray read grant");
+    assert.deepEqual(u.filesystem.read, ["/docs"], "user read entry kept");
+    assert.deepEqual(u.environment.allow_vars, ["ANTHROPIC_API_KEY", "MY_*"], "our env entry removed, user entries kept");
+    assert.deepEqual(u.workdir, { access: "readwrite" }, "user sections untouched by uninstall");
+    assert.deepEqual(u.someFutureField, { nested: true }, "unknown field untouched by uninstall");
+    rmSync(home, { recursive: true, force: true });
+});
+test("omac: install on a missing profile creates a minimal valid one (XDG_STATE_HOME honored); uninstall cleans it", async () => {
+    const home = tempHome();
+    const xdg = join(home, ".config");
+    const profileFile = omacProfilePath(home);
+    const xdgState = join(home, ".local", "state");
+    // LOAD_LOCK_STATE_DIR: "" clears any inherited override so XDG_STATE_HOME is honored
+    const env = { XDG_CONFIG_HOME: xdg, LOAD_LOCK_STATE_DIR: "", XDG_STATE_HOME: xdgState };
+    let r = await runCli(home, ["install", "--harness", "omac"], env);
+    assert.equal(r.code, 0, `install failed: ${r.stderr}`);
+    assert.ok(existsSync(profileFile), "profile created");
+    const p = JSON.parse(readFileSync(profileFile, "utf8"));
+    // minimal valid profile: only known fields, no empty arrays, no read grant (repo checkout)
+    assert.deepEqual(p, {
+        environment: { allow_vars: ["LOAD_LOCK_*"] },
+        filesystem: { allow_unix_dir: [join(xdgState, "load-lock")] },
+    }, "created profile holds exactly our grants");
+    // XDG_STATE_HOME honored: default state dir, not ~/.local/state off the real HOME
+    assert.ok(p.filesystem.allow_unix_dir[0].startsWith(xdgState), "state dir derived from XDG_STATE_HOME");
+    // idempotent re-install: byte-identical
+    const bytes = readFileSync(profileFile, "utf8");
+    r = await runCli(home, ["install", "--harness", "omac"], env);
+    assert.equal(r.code, 0, `re-install failed: ${r.stderr}`);
+    assert.equal(readFileSync(profileFile, "utf8"), bytes, "re-install is byte-identical");
+    // uninstall removes the file (nothing user-owned was ever in it) and prunes dirs
+    r = await runCli(home, ["uninstall", "--harness", "omac"], env);
+    assert.equal(r.code, 0, `uninstall failed: ${r.stderr}`);
+    assert.ok(!existsSync(profileFile), "our file removed");
+    assert.ok(!existsSync(join(xdg, "omac")), "empty omac config tree pruned");
+    rmSync(home, { recursive: true, force: true });
+});
+test("omac: a global-style install (package outside any repo) adds the package-tree read grant; uninstall removes it by shape", async () => {
+    const home = tempHome();
+    const xdg = join(home, ".config");
+    const stateDir = join(home, "ll-state");
+    const env = { XDG_CONFIG_HOME: xdg, LOAD_LOCK_STATE_DIR: stateDir, XDG_STATE_HOME: join(home, ".local", "state") };
+    // simulate a global install: package tree under node_modules, outside any .git
+    const pkgMock = join(home, "bun-mock", "install", "global", "node_modules", "@aron98", "load-lock");
+    mkdirSync(dirname(pkgMock), { recursive: true });
+    cpSync(join(HERE, ".."), join(pkgMock, "dist"), { recursive: true }); // dist/ from the worktree build
+    const mockCli = join(pkgMock, "dist", "cli", "main.js");
+    const profileFile = omacProfilePath(home);
+    const runMock = (args) => new Promise((resolveP, reject) => {
+        const child = spawn(process.execPath, [mockCli, ...args], { env: { ...process.env, HOME: home, ...env } });
+        let stdout = "";
+        let stderr = "";
+        child.stdout.on("data", (b) => (stdout += b));
+        child.stderr.on("data", (b) => (stderr += b));
+        child.stdin.end();
+        child.once("exit", (code) => resolveP({ code, stdout, stderr }));
+        child.once("error", reject);
+    });
+    let r = await runMock(["install", "--harness", "omac"]);
+    assert.equal(r.code, 0, `install failed: ${r.stderr}`);
+    assert.match(r.stdout, /filesystem\.read \+=/, "installer output must mention the package-tree read grant");
+    const p = JSON.parse(readFileSync(profileFile, "utf8"));
+    const pkgReal = resolve(pkgMock);
+    assert.deepEqual(p.filesystem.read, [pkgReal], "read grant is the realpath of the package root");
+    assert.ok(p.filesystem.allow_unix_dir.includes(stateDir), "state dir granted too");
+    // idempotent re-install from the global copy: byte-identical
+    const bytes = readFileSync(profileFile, "utf8");
+    r = await runMock(["install", "--harness", "omac"]);
+    assert.equal(r.code, 0, `re-install failed: ${r.stderr}`);
+    assert.equal(readFileSync(profileFile, "utf8"), bytes, "re-install is byte-identical");
+    // uninstall from the WORKTREE CLI (a different location, readTree is null
+    // there): the read entry still matches by its node_modules/@aron98/load-lock shape
+    r = await runCli(home, ["uninstall", "--harness", "omac"], env);
+    assert.equal(r.code, 0, `uninstall failed: ${r.stderr}`);
+    assert.ok(!existsSync(profileFile), "profile held only our grants — removed");
+    rmSync(home, { recursive: true, force: true });
+});
+test("omac: uninstall with nothing installed is a harmless no-op", async () => {
+    const home = tempHome();
+    const r = await runCli(home, ["uninstall", "--harness", "omac"], { XDG_CONFIG_HOME: join(home, ".config"), LOAD_LOCK_STATE_DIR: join(home, "ll-state") });
+    assert.equal(r.code, 0, `uninstall failed: ${r.stderr}`);
+    assert.ok(!existsSync(join(home, ".config", "omac")), "no files created by uninstall");
+    rmSync(home, { recursive: true, force: true });
+});
+test("omac: install refuses to touch a broken or misshapen profile", async () => {
+    const home = tempHome();
+    const xdg = join(home, ".config");
+    const profileFile = omacProfilePath(home);
+    mkdirSync(dirname(profileFile), { recursive: true });
+    const env = { XDG_CONFIG_HOME: xdg, LOAD_LOCK_STATE_DIR: join(home, "ll-state") };
+    // (a) invalid JSON
+    const broken = "{ not json";
+    writeFileSync(profileFile, broken);
+    let r = await runCli(home, ["install", "--harness", "omac"], env);
+    assert.notEqual(r.code, 0, "install must refuse invalid JSON");
+    assert.match(r.stderr + r.stdout, /not valid JSON|refus/i, "error must explain the refusal");
+    assert.equal(readFileSync(profileFile, "utf8"), broken, "file untouched on refusal");
+    // (b) allow_vars present but not an array of strings
+    const misshapen = JSON.stringify({ environment: { allow_vars: "PATH" } }, null, 2) + "\n";
+    writeFileSync(profileFile, misshapen);
+    r = await runCli(home, ["install", "--harness", "omac"], env);
+    assert.notEqual(r.code, 0, "install must refuse a non-array allow_vars");
+    assert.match(r.stderr + r.stdout, /allow_vars.*not an array/i, "error must name the offending field");
+    assert.equal(readFileSync(profileFile, "utf8"), misshapen, "file untouched on refusal");
+    // uninstall also refuses (never "fixes" the file by overwriting it) on invalid JSON
+    writeFileSync(profileFile, broken);
+    r = await runCli(home, ["uninstall", "--harness", "omac"], env);
+    assert.notEqual(r.code, 0, "uninstall must refuse invalid JSON too");
+    assert.equal(readFileSync(profileFile, "utf8"), broken, "file untouched on refusal");
+    // on a merely misshapen value (valid JSON, allow_vars not an array) uninstall
+    // is a graceful no-op: it never wrote that value, so it leaves it alone
+    writeFileSync(profileFile, misshapen);
+    r = await runCli(home, ["uninstall", "--harness", "omac"], env);
+    assert.equal(r.code, 0, `uninstall failed: ${r.stderr}`);
+    assert.equal(readFileSync(profileFile, "utf8"), misshapen, "file untouched by uninstall");
+    rmSync(home, { recursive: true, force: true });
+});

package/docs/COMPATIBILITY.md

@@ -43,6 +43,7 @@ Status labels mean exactly this:
 | **Cline** | Yes (`cline_mcp_settings.json`, merge-only installer) | `~/.cline/rules/load-lock.md` (dedicated rule file) | Rules always loaded | No hooks — `wait_for_turn` bounded sleep is the primary idle mechanism | No | Via MCP `run_with_permit` only | **Implemented (fallback tier, config-tested)** |
 | **Roo Code** | Yes (project `.roo/mcp.json` + existing global `mcp_settings.json`, merge-only installer) | `~/.roo/rules/load-lock.md` (dedicated rule file) | Rules always loaded | No hooks — `wait_for_turn` bounded sleep is the primary idle mechanism | No | Via MCP `run_with_permit` only | **Implemented (fallback tier, config-tested)** |
 | **Goose** | Yes (`~/.config/goose/config.yaml` `extensions` block, merge-only installer) | `.goosehints` (global, marked section) | Hints always loaded | No hooks — `wait_for_turn` bounded sleep is the primary idle mechanism | No | Via MCP `run_with_permit` only | **Implemented (fallback tier, config-tested)** |
+| **omac** (agent sandbox; verified with 0.11.0) | N/A — omac is a sandbox runtime, not a harness: the agent inside it uses whichever harness adapter applies (OpenCode, Claude Code, …) | via the inner harness | via the inner harness | via the inner harness | via the inner harness | Full for the sandbox grants: `load-lock uninstall --harness omac` removes exactly the entries install added (match-own-entries, empty sections pruned) | **Sandbox-profile grants installed + live-verified** (`install --harness omac`: `filesystem.allow_unix_dir` += state dir, `filesystem.read` += package tree when needed, `environment.allow_vars` += `LOAD_LOCK_*`) |
 | **Aider** | **No MCP support** | CONVENTIONS.md / `.aider.conf.yml` | Read each run | N/A | N/A | CLI-only: same-shell `load-lock acquire ... && cmd; load-lock release ...` (manual) | Proposed (manual CLI tier) |
 
 ## How each integration tier works
@@ -236,6 +237,40 @@ push channel, so a woken agent relies on tool results (which carry
 pending offers) rather than harness messages. We do not pretend these
 harnesses got push notifications.
 
+### omac — sandbox-profile grants (live-verified, issue #32)
+
+omac runs agent harnesses inside a sandbox (bubblewrap + Landlock on
+Linux, seatbelt on macOS) and strips the harness environment, allowing
+through only what the user-global profile lists — so a load-lock client
+inside omac cannot reach the host daemon without explicit grants.
+`load-lock install --harness omac` merges three grants into
+`~/.config/omac/sandbox-profiles/default.json` (merge-only, idempotent,
+reversible by uninstall; omac parses profiles strictly so the installer
+writes only known fields and never rewrites the user's bytes when
+nothing changed):
+
+- `filesystem.allow_unix_dir` += the load-lock state dir (AF_UNIX connect
+  to the host daemon socket + read/write on the state dir);
+- `filesystem.read` += the installed package tree — **only when load-lock
+  lives outside an already-granted workdir** (a repo checkout needs
+  nothing: the sandbox workdir grant covers it; a global bun/npm install
+  does need it, see OPERATIONS.md gotcha #1);
+- `environment.allow_vars` += `"LOAD_LOCK_*"` — one trailing-`*` prefix
+  entry that passes all four client vars (`LOAD_LOCK_SOCKET`,
+  `LOAD_LOCK_STATE_DIR`, `LOAD_LOCK_NO_SPAWN`, `LOAD_LOCK_LABEL_PREFIX`)
+  through omac's env filter.
+
+Verified live against omac 0.11.0 (see OPERATIONS.md for the exact
+procedure and the two gotchas): profile accepted by omac's strict parser,
+sandboxed CLI → host daemon round-trip, prefixed holder labels
+(`omac:<label>`), client-only (`LOAD_LOCK_NO_SPAWN=1`) error contract, and
+the global-install read grant proven necessary and sufficient
+(ERR_MODULE_NOT_FOUND without it, working round-trip with it).
+Install/uninstall round-trips are contract-tested in
+`src/test/install.test.ts` (temp HOME: populated profile preserved,
+idempotent re-install byte-identical, missing-profile creation, global
+read grant, refusal on broken profiles).
+
 ### Tier 4 — Aider (manual CLI)
 
 No MCP/hooks; nothing to install. Agents (or humans) use the CLI directly in
@@ -256,6 +291,7 @@ UI** — where no UI surface exists, we say so rather than claim parity.
 | **Codex CLI** | None in-app — same reason. `load_lock_status` MCP tool; `SessionStart`/`SubagentStart` machine summary. | `load-lock dashboard` (alias `top`) |
 | **Gemini CLI** | None in-app (no hooks, no UI plugin surface). `load_lock_status` MCP tool at tool boundaries. | `load-lock dashboard` (alias `top`) |
 | **Copilot CLI, Cursor, Cline, Roo Code, Goose** | None in-app. MCP `status` tool where the MCP server is configured. | `load-lock dashboard` (alias `top`) |
+| **omac** | None added by the omac installer — it only edits the sandbox profile; the inner harness keeps whatever surface its own adapter provides. | `load-lock dashboard` (alias `top`) |
 | **Aider** | None (no MCP either). | `load-lock dashboard` (alias `top`) |
 
 All dashboard surfaces are **read-only viewers that never acquire a
@@ -272,6 +308,7 @@ reconnect, view-model shaping, frame rendering) is covered by
 | Claude Code | hooks get `session_id`; MCP tools take explicit `agent_id` | policy instructs agents to pass it |
 | Codex | hooks get `session_id`; MCP tools take explicit `agent_id` | same |
 | Cursor | hooks get `conversation_id` (no `cwd` — `workspace_roots[0]` identifies the request); MCP tools take explicit `agent_id` | same |
+| omac (sandbox) | inner harness identity + `LOAD_LOCK_LABEL_PREFIX=omac` | dashboard shows holders as `omac:<label>` |
 | Tier 3 | explicit `agent_id` argument | falls back to per-server-process id |
 
 ## Platform matrix
@@ -289,19 +326,25 @@ reconnect, view-model shaping, frame rendering) is covered by
   asyncRewake wakeup paths, subagents, background-job cleanup); Codex CLI
   (Docker, interactive TUI: policy injection, MCP round-trip, FIFO queueing
   behind a CLI holder, Stop-hook decision-block wakeup; exec-mode MCP
-  injection blocked upstream — see Tier 2 notes).
+  injection blocked upstream — see Tier 2 notes); omac 0.11.0 (sandbox
+  grants installer: profile accepted by omac's strict parser, sandboxed
+  client → host daemon round-trip, `omac:`-prefixed labels,
+  `LOAD_LOCK_NO_SPAWN=1` error contract, global-install read grant proven
+  necessary and sufficient — see the omac section above and OPERATIONS.md).
 - Contract-tested: Cursor (hooks-v1 stop-hook adapter + installer, tested
   against the officially documented hooks JSON contract; no Cursor install
   on the verification machine — see the Cursor section under Tier 2).
 - Config-tested: Gemini CLI, Copilot CLI, Cline, Roo Code, Goose (installer
   round-trips, temp HOME; real harnesses not installed on the verification
   machine).
-- Core daemon/protocol/CLI: 68 automated tests + scripted 3-worktree demo
+- Core daemon/protocol/CLI + adapters: 125 automated tests + scripted 3-worktree demo
   (three independent agent processes, real git worktrees, one pool), including
   9 dashboard tests (view-model shaping, event-cursor resume across a daemon
-  restart, reconnect, and a `load-lock dashboard --once` render smoke test) and
+  restart, reconnect, and a `load-lock dashboard --once` render smoke test),
   9 bounded-wait tests (multi-process `wait_for_turn`: FIFO wake with
   auto-claim, timeout/pause/cancel/restart/abort paths, `maxTurnWaitMs` cap,
-  MCP snake_case round trip).
+  MCP snake_case round trip) and 5 omac installer contract tests
+  (populated-profile preservation, idempotent re-install, missing-profile
+  creation, global-install read grant, broken-profile refusal).
 - Proposed (researched capabilities, generic adapter only):
   Aider.

package/docs/OPERATIONS.md

@@ -607,56 +607,122 @@ Caveats observed (verified):
   inside the sandbox and split the budget. The tests in
   `src/test/sandbox.test.ts` pin the loud failure instead.
 
-### omac — contract-inspected
-
-**omac is not installed on the verification machine**, so nothing in this
-subsection was executed here; it is assembled from omac's documented
-behavior (the facts below are from omac's docs, not invented) and the
-bubblewrap recipe above, which omac wraps on Linux. Treat it as a
-ready-to-run procedure with expected outcomes, and record what you find.
-
-omac sandboxes agents with bubblewrap on Linux (seatbelt on macOS, WSL2
-elsewhere) and **strips the harness environment** before starting the
-agent, allowing through only variables listed in the sandbox profile's
-`environment.allow_vars` — `~/.config/omac/sandbox-profiles/default.json`
-by default. That file is the whole recipe:
-
-1. Make sure the load-lock state dir is visible inside omac's bubblewrap
-   sandbox (the `LOAD_LOCK_SOCKET` path must resolve inside it). How
-   omac's sandbox mounts map to bwrap `--bind`s is an omac sandbox-config
-   question — omac's own facade socket under `~/.local/state/omac/run/`
-   is the project's precedent for a sandbox process connecting to a
-   host-owned socket through its profile.
-2. Add the load-lock variables to the profile's `environment.allow_vars`:
-
-   ```json
-   {
-     "environment": {
-       "allow_vars": [
-         "LOAD_LOCK_SOCKET",
-         "LOAD_LOCK_STATE_DIR",
-         "LOAD_LOCK_NO_SPAWN",
-         "LOAD_LOCK_LABEL_PREFIX"
-       ]
-     }
-   }
-   ```
+### omac — live-verified
+
+Verified 2026-10-20 against **omac 0.11.0** (extracted package binary, no
+root needed) on Linux, driving the load-lock CLI from the v1.2.0 worktree
+build end-to-end from inside `omac sandbox run`. omac wraps bubblewrap +
+Landlock on Linux (seatbelt on macOS with the same env-stripping) and
+**strips the harness environment**, allowing through only variables
+listed in the user-global sandbox profile —
+`~/.config/omac/sandbox-profiles/default.json`. The profile is the whole
+recipe, and `load-lock install --harness omac` writes it for you
+(merge-only; idempotent; `load-lock uninstall --harness omac` removes
+exactly the entries it added):
+
+```json
+{
+  "filesystem": {
+    "allow_unix_dir": ["<load-lock state dir>"],
+    "read": ["<installed package tree>"]
+  },
+  "environment": { "allow_vars": ["LOAD_LOCK_*"] }
+}
+```
+
+- `filesystem.allow_unix_dir` += the state dir: AF_UNIX connect to the
+  host daemon socket plus read/write on the state dir — this is the
+  sandbox→host bridge (omac has no separate "bind" step; the grant is the
+  bridge).
+- `environment.allow_vars` += `"LOAD_LOCK_*"` — one trailing-`*` prefix
+  entry (verified: omac 0.11.0 accepts prefix patterns) covering all four
+  client vars (`LOAD_LOCK_SOCKET`, `LOAD_LOCK_STATE_DIR`,
+  `LOAD_LOCK_NO_SPAWN`, `LOAD_LOCK_LABEL_PREFIX`).
+- `filesystem.read` += the installed package tree — **only when
+  load-lock lives outside an already-granted workdir** (see gotcha 1).
+
+The exact procedure that was verified (run it with a throwaway `HOME`
+unless you want the grants in your real profile):
+
+```sh
+# 0. scratch dirs + a current daemon built from the v1.2.0+ tree.
+#    GOTCHA 2: the machine's real daemon was still v1.1.0 — a daemon
+#    started before v1.2.0 silently strips the unknown labelPrefix field
+#    (zod), so prefixed labels disappear without any error. Upgrade and
+#    restart: load-lock service stop && load-lock service start. This
+#    verification deliberately
+#    used its own daemon on a temp state dir.
+LOAD_LOCK_STATE_DIR=/tmp/ll-32-test node dist/cli/main.js service start
+
+# 1. install the grants (merge-only; prints exactly what it merged)
+HOME=/tmp/ll-32-home LOAD_LOCK_STATE_DIR=/tmp/ll-32-test \
+  node dist/cli/main.js install --harness omac
+
+# 2. omac's strict parser accepts the profile (unknown fields are errors)
+HOME=/tmp/ll-32-home omac sandbox run -- true    # exit 0, no ERROR lines
+
+# 3. sandboxed client -> host daemon round-trip.
+#    NOTE: standalone `omac sandbox run` starts at cwd "/" and grants NO
+#    workdir by default — `--workdir-access read` binds the invocation
+#    dir read-only, modeling what a real omac agent session gets for its
+#    project workdir (which is why a repo checkout needs no read grant).
+#    The env values are set inside the sandboxed command with `env`
+#    (`-- env VAR=... node ...`); with the LOAD_LOCK_* allow_vars entry
+#    in place they could equally be inherited from the outer shell.
+HOME=/tmp/ll-32-home omac sandbox run --workdir-access read -- \
+  env LOAD_LOCK_SOCKET=/tmp/ll-32-test/daemon.sock LOAD_LOCK_NO_SPAWN=1 \
+      LOAD_LOCK_LABEL_PREFIX=omac \
+  node dist/cli/main.js acquire --op-key issue-32-live \
+    --reason "issue-32 live verification build" --label "issue-32 build" --json
+# -> permit prm_…; host status shows:
+#    held: omac:issue-32 build — issue-32 live verification build [claimed, awaiting start]
+
+# 4. host-side release (or any later step from inside the sandbox):
+node dist/cli/main.js release --permit prm_…   # -> releasedNow: true
+```
 
-   Set the values themselves in your harness env (or the profile's env
-   mechanism): `LOAD_LOCK_SOCKET` to the host daemon socket as seen inside
-   the sandbox, `LOAD_LOCK_NO_SPAWN=1`, and — recommended —
-   `LOAD_LOCK_LABEL_PREFIX=omac` so the dashboard shows holders as
-   `omac:<label>`.
-3. Watch out: **omac never rewrites a profile it has created**, so if your
-   `default.json` already exists, edit it by hand (adding the entries
-   above); and **unknown profile fields are errors**, so don't invent
-   other keys — `allow_vars` entries are plain variable names.
-
-Expected outcome (unverified here): with those four variables allowed and
-the state dir mounted, an agent inside omac behaves exactly like the
-verified bubblewrap case above — host daemon answers, labels carry the
-`omac:` prefix, and long holds need `mark_started` + heartbeats (lease
-mode) because of the PID namespace.
+Also verified live:
+
+- **`LOAD_LOCK_NO_SPAWN=1` error contract**: with the client pointed at a
+  missing socket inside the sandbox, the CLI exits **70** with the loud
+  "not reachable and auto-spawn is disabled … bridge its socket into this
+  sandbox" error instead of silently spawning a sandbox-local daemon.
+- **Lease-mode lifecycle across the PID namespace** (same as the
+  bubblewrap case): `acquire` → `mark-started` (held, lease 900s) →
+  `release` (`releasedNow: true`), all issued from inside the sandbox;
+  long holds need lease mode because the host daemon pid is invisible to
+  the sandbox.
+- **Install/uninstall round-trips against the real omac**: a populated
+  user profile (workdir/network/environment entries) survives install
+  byte-faithfully with our grants appended, omac's strict parser accepts
+  the merged file, and uninstall leaves the user entries intact; a
+  from-scratch profile is removed entirely on uninstall (with the omac
+  config tree pruned) and omac keeps running on its defaults.
+
+The two gotchas that shaped the installer:
+
+1. **A global install needs a read grant for the package tree, not just
+   the bin dir.** omac's builtin grants cover `~/.bun/bin`, but the
+   launcher resolves the dist tree under
+   `~/.bun/install/global/node_modules/@aron98/load-lock/dist/…` —
+   ungranted, the CLI dies with `Cannot find module …` (exit 1) before
+   ever reaching the socket. Proven live both ways: the sandboxed CLI
+   from a global-style tree failed with exactly that error before the
+   grant, and completed the full acquire→mark-started→release round-trip
+   after `filesystem.read` covered the tree. A repo checkout needs no
+   read grant (the agent session's workdir already covers it) and the
+   installer says so honestly in its output.
+2. **Label prefixes need a current daemon on the host.** A daemon
+   started before v1.2.0 strips the unknown `labelPrefix` field silently
+   (zod); the dashboard shows the bare label with no error anywhere.
+   `load-lock service stop && load-lock service start` after upgrading.
+
+What was NOT verified: omac's macOS seatbelt path (same profile schema,
+per omac's docs, but the verification machine is Linux) and omac's agent
+orchestration commands (`omac start`/`continue`/…) driving a real agent —
+the round-trip was verified with the documented `omac sandbox run`
+primitive those commands build on. The installer's contract tests cover
+the merge/uninstall edge cases (`src/test/install.test.ts`).
 
 ### Docker — contract-inspected
 
@@ -730,8 +796,10 @@ path-literal strict, or re-generate the profile. Expected outcome
 `LOAD_LOCK_LABEL_PREFIX=…`) passed through to the agent, a seatbelt-sandboxed
 client talks to the host daemon exactly as in the verified bubblewrap
 case. omac's macOS sandboxing uses seatbelt under the hood with the same
-`environment.allow_vars` env-stripping as on Linux, so the omac recipe
-above (profile `allow_vars` + bridged socket path) applies unchanged.
+`environment.allow_vars` env-stripping as on Linux, so the omac installer
+(`load-lock install --harness omac`, live-verified on Linux against omac
+0.11.0 — see above) applies unchanged; only the socket path and the
+seatbelt file rules differ.
 
 ### WSL2 — honest state
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aron98/load-lock",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "Machine-wide counting semaphore coordinating resource-intensive work across parallel coding agents (OpenCode, Codex CLI, Claude Code, ...)",
   "type": "module",
   "license": "MIT",