@fungi.computer/truffle 0.2.1 → 0.3.0

package/dist/private-local-session-discovery.js

@@ -3,6 +3,7 @@ import { basename, dirname, join, resolve } from "node:path";
 import * as Effect from "effect/Effect";
 import { parseModelPreferenceJson } from "@fungi.computer/shiitake/model-preference";
 import { z } from "zod";
+import { localPermissionModeSchema } from "./private-local-permission-mode.js";
 import { readAgentDefaultModelJson } from "./private-local-agent-default-model.js";
 import { localAgentFolderSchema, resolveAgentFolder, } from "./private-local-sandbox-policy.js";
 import { logEvent } from "./log-event.js";
@@ -105,7 +106,8 @@ const storedProfileSchema = z.strictObject({
     name: z.string().nullable(),
     createdBy: z.string().nullable(),
     archived: z.union([z.literal(0), z.literal(1)]),
-    requireSandbox: z.union([z.literal(0), z.literal(1)]),
+    mode: localPermissionModeSchema,
+    writableFolders: z.array(z.string()),
     folder: localAgentFolderSchema,
     model: z.string(),
 });
@@ -129,16 +131,25 @@ export function readPrivateLocalAgentProfile(path) {
         const columns = database
             .prepare("PRAGMA table_info(private_local_identity)")
             .all();
-        if (!["name", "created_by", "archived", "require_sandbox", "folder"].every((required) => columns.some((column) => column.name === required)))
+        if (![
+            "name",
+            "created_by",
+            "archived",
+            "mode",
+            "writable_folders",
+            "folder",
+        ].every((required) => columns.some((column) => column.name === required)))
             throw new LocalStoreSchemaError(path);
         const identity = database
-            .prepare("SELECT name, created_by, archived, require_sandbox, folder FROM private_local_identity WHERE singleton = 1")
+            .prepare("SELECT name, created_by, archived, mode, writable_folders, folder FROM private_local_identity WHERE singleton = 1")
             .get();
+        const writableFolders = storedProfileSchema.shape.writableFolders.parse(JSON.parse(z.string().parse(identity?.writable_folders)));
         const stored = storedProfileSchema.parse({
             name: identity?.name,
             createdBy: identity?.created_by,
             archived: identity?.archived,
-            requireSandbox: identity?.require_sandbox,
+            mode: identity?.mode,
+            writableFolders,
             folder: identity?.folder,
             model: readAgentDefaultModelJson(database),
         });
@@ -146,7 +157,8 @@ export function readPrivateLocalAgentProfile(path) {
             name: stored.name ?? undefined,
             createdBy: stored.createdBy,
             archived: stored.archived === 1,
-            requireSandbox: stored.requireSandbox === 1,
+            mode: stored.mode,
+            writableFolders: stored.writableFolders,
             folder: stored.folder,
             model: parseModelPreferenceJson(stored.model),
         };
@@ -267,7 +279,7 @@ export function projectPrivateLocalSessionDiscovery(discovered, connect) {
             databasePath,
             sessionId,
             fungiMcp: resumeRequest?.fungiMcp,
-            requireSandbox: resumeRequest?.requireSandbox,
+            mode: resumeRequest?.mode,
         }, resumeRequest),
     }));
     return Object.freeze({

package/dist/private-mcp-form-contract.d.ts

@@ -77,7 +77,7 @@ export declare const mcpFormApprovalContract: {
             scope: "session";
             input: Schema.Struct<{
                 readonly id: Schema.String;
-                readonly decision: Schema.Literals<readonly ["approve", "deny"]>;
+                readonly decision: Schema.Literals<readonly ["approve", "deny", "always-allow"]>;
                 readonly expectedRevision: Schema.Int;
             }>;
             output: Schema.Union<readonly [Schema.Struct<{
@@ -179,6 +179,13 @@ export declare const mcpFormApprovalContract: {
                     readonly canAnswer: Schema.Boolean;
                     readonly canSetAutoApprove: Schema.Boolean;
                 }>;
+                readonly review: Schema.optionalKey<Schema.Struct<{
+                    readonly command: Schema.String;
+                    readonly cwd: Schema.String;
+                    readonly justification: Schema.String;
+                    readonly prefix: Schema.optionalKey<Schema.$Array<Schema.String>>;
+                    readonly warning: Schema.optionalKey<Schema.String>;
+                }>>;
             }>>;
         }>;
     };

package/dist/private-mcp-form-contract.js

@@ -32,6 +32,13 @@ const answerResult = Schema.Union([
 const McpFormPendingSchema = Schema.Struct({
     id: Schema.String,
     approval: ApprovalViewSchema,
+    review: Schema.optionalKey(Schema.Struct({
+        command: Schema.String,
+        cwd: Schema.String,
+        justification: Schema.String,
+        prefix: Schema.optionalKey(Schema.Array(Schema.String)),
+        warning: Schema.optionalKey(Schema.String),
+    })),
 });
 /** The existing Session extension slot carries only display-safe form data. */
 export const mcpFormApprovalContract = {
@@ -41,7 +48,7 @@ export const mcpFormApprovalContract = {
             scope: "session",
             input: Schema.Struct({
                 id: Schema.String,
-                decision: ApprovalAnswerInputSchema.fields.decision,
+                decision: Schema.Literals(["approve", "deny", "always-allow"]),
                 expectedRevision: ApprovalAnswerInputSchema.fields.expectedRevision,
             }),
             output: answerResult,

package/dist/private-mcp-form-session.d.ts

@@ -1,6 +1,21 @@
-import type { Approvals, PendingApproval } from "@fungi.computer/approvals";
+import type { Approvals, ApprovalView, PendingApproval } from "@fungi.computer/approvals";
 import type { ShiitakeSession } from "@fungi.computer/shiitake";
 import { type LocalUiAttachment } from "./private-local-ui-attachment.js";
+export type LocalApprovalReview = {
+    command: string;
+    cwd: string;
+    justification: string;
+    prefix?: readonly string[];
+    warning?: string;
+};
+type Pending = {
+    sessionId: string;
+    approval: ApprovalView;
+    approvals: Approvals;
+    answering: boolean;
+    review: LocalApprovalReview | undefined;
+    alwaysAllow: ((selected: "prefix" | false) => void) | undefined;
+};
 /** Host-owned references to canonical approvals; no suspended tool or second ledger. */
 export declare function createMcpFormSession(): {
     extension: import("@fungi.computer/shiitake/extensions").DefinedExtensionV0<{
@@ -8,7 +23,7 @@ export declare function createMcpFormSession(): {
             scope: "session";
             input: import("effect/Schema").Struct<{
                 readonly id: import("effect/Schema").String;
-                readonly decision: import("effect/Schema").Literals<readonly ["approve", "deny"]>;
+                readonly decision: import("effect/Schema").Literals<readonly ["approve", "deny", "always-allow"]>;
                 readonly expectedRevision: import("effect/Schema").Int;
             }>;
             output: import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
@@ -108,6 +123,13 @@ export declare function createMcpFormSession(): {
                 readonly canAnswer: boolean;
                 readonly canSetAutoApprove: boolean;
             };
+            readonly review?: {
+                readonly command: string;
+                readonly cwd: string;
+                readonly justification: string;
+                readonly prefix?: readonly string[];
+                readonly warning?: string;
+            };
         }[];
     }, {
         readonly pending: readonly {
@@ -153,9 +175,16 @@ export declare function createMcpFormSession(): {
                 readonly canAnswer: boolean;
                 readonly canSetAutoApprove: boolean;
             };
+            readonly review?: {
+                readonly command: string;
+                readonly cwd: string;
+                readonly justification: string;
+                readonly prefix?: readonly string[];
+                readonly warning?: string;
+            };
         }[];
     }>;
-    presentApproval: (sessionId: string, submitted: PendingApproval, approvals: Approvals) => Promise<{
+    presentApproval: (sessionId: string, submitted: PendingApproval, approvals: Approvals, review?: Pending["review"], alwaysAllow?: (selected: "prefix" | false) => void) => Promise<{
         readonly kind: "refused";
         readonly reason: "not-pending";
         readonly id?: never;
@@ -170,3 +199,4 @@ export declare function createMcpFormSession(): {
     }>;
     bindSession: (sessionId: string, session: ShiitakeSession, attachment: LocalUiAttachment | undefined) => ShiitakeSession;
 };
+export {};

package/dist/private-mcp-form-session.js

@@ -46,13 +46,22 @@ export function createMcpFormSession() {
                                 return { kind: "refused", reason: "not-attached" };
                             // Session commit and live UI recheck precede the canonical
                             // decision. Its bound host, never MCP accept, owns apply.
-                            return await entry.approvals.answer({
+                            if (input.decision === "always-allow" &&
+                                entry.alwaysAllow === undefined)
+                                return { kind: "refused", reason: "not-pending" };
+                            if (input.decision === "always-allow")
+                                entry.alwaysAllow?.("prefix");
+                            const result = await entry.approvals.answer({
                                 recordId: entry.approval.record.recordId,
-                                decision: input.decision,
+                                decision: input.decision === "always-allow"
+                                    ? "approve"
+                                    : input.decision,
                                 expectedRevision: input.expectedRevision,
                             });
+                            return result;
                         }
                         finally {
+                            entry.alwaysAllow?.(false);
                             entry.answering = false;
                             const view = await entry.approvals.get({
                                 recordId: entry.approval.record.recordId,
@@ -80,7 +89,12 @@ export function createMcpFormSession() {
             read: (_context, sessionId) => ({
                 pending: [...pending.entries()]
                     .filter(([, entry]) => entry.sessionId === sessionId)
-                    .map(([id, entry]) => ({ id, approval: entry.approval })),
+                    .map(([id, entry]) => {
+                    const item = { id, approval: entry.approval };
+                    return entry.review === undefined
+                        ? item
+                        : { ...item, review: entry.review };
+                }),
             }),
         },
     });
@@ -88,7 +102,7 @@ export function createMcpFormSession() {
      * Native host port, never a model or UI command. The caller supplies the
      * actual submit result and a member-bound capability, not form JSON.
      */
-    async function presentApproval(sessionId, submitted, approvals) {
+    async function presentApproval(sessionId, submitted, approvals, review, alwaysAllow) {
         const approval = await approvals.get({ recordId: submitted.recordId });
         if (approval?.record.state !== "pending" ||
             approval.record.requester.sessionId !== sessionId)
@@ -99,13 +113,22 @@ export function createMcpFormSession() {
             const [id, entry] = existing;
             entry.approval = approval;
             entry.approvals = approvals;
+            entry.review = review;
+            entry.alwaysAllow = alwaysAllow;
             await publish?.(sessionId);
             return { kind: "presented", id };
         }
         if (pending.size >= maximumPendingForms)
             return { kind: "refused", reason: "capacity" };
         const id = correlationKey();
-        pending.set(id, { sessionId, approval, approvals, answering: false });
+        pending.set(id, {
+            sessionId,
+            approval,
+            approvals,
+            answering: false,
+            review,
+            alwaysAllow,
+        });
         await publish?.(sessionId);
         return { kind: "presented", id };
     }

package/dist/private-oyster-mcp-auth.d.ts

@@ -3,7 +3,7 @@ import { UnauthorizedError, type AuthProvider } from "@modelcontextprotocol/clie
 export declare class OysterMcpKeyRejectedError extends UnauthorizedError {
     constructor();
 }
-/** Read bounded UTF-8 stdin, then place the key in Local's existing private store. */
+/** Read bounded UTF-8 stdin, then place the key in OS custody when available. */
 export declare function saveOysterMcpKey(endpoint: URL, input: AsyncIterable<Uint8Array>, options?: {
     credentialPath?: string;
 }): Promise<void>;

package/dist/private-oyster-mcp-auth.js

@@ -1,4 +1,9 @@
 import { UnauthorizedError, } from "@modelcontextprotocol/client";
+import { once } from "node:events";
+import { access } from "node:fs/promises";
+import { join } from "node:path";
+import { Message, sessionBus } from "@jellybrick/dbus-next";
+import { AsyncEntry } from "@napi-rs/keyring";
 import { z } from "zod";
 import { createPrivateCredentialStore, maximumCredentialStringLength, } from "./private-file-credential-store.js";
 import { parseFungiMcpEndpoint } from "./private-fungi-mcp-endpoint.js";
@@ -20,10 +25,120 @@ const oysterKey = z
     .min(5)
     .max(maximumCredentialStringLength)
     .regex(/^oyk_[A-Za-z0-9_-]+$/);
-/** Read bounded UTF-8 stdin, then place the key in Local's existing private store. */
+const keychainService = "fungi-oyster-mcp";
+const warnedFallbackPaths = new Set();
+function fileStore(path) {
+    return createPrivateCredentialStore(path);
+}
+function fallbackWarning(path) {
+    if (warnedFallbackPaths.has(path))
+        return;
+    warnedFallbackPaths.add(path);
+    process.stderr.write(`fungi: OS keychain unavailable (Linux Secret Service); Oyster key stored/read in 0600 file ${JSON.stringify(path)}.\n`);
+}
+/**
+ * The keyring binding reports both absent and broken services as GenericFailure.
+ * Ask the D-Bus owner for typed names, including activatable services, rather
+ * than interpreting its human-readable error text or downgrading every error.
+ */
+async function secretServiceAbsent() {
+    const missingBus = z.object({ code: z.enum(["ENOENT", "ECONNREFUSED"]) });
+    let bus;
+    try {
+        bus = sessionBus();
+        const connectedBus = bus;
+        async function names(member) {
+            const reply = await Promise.race([
+                connectedBus.call(new Message({
+                    destination: "org.freedesktop.DBus",
+                    path: "/org/freedesktop/DBus",
+                    interface: "org.freedesktop.DBus",
+                    member,
+                })),
+                once(connectedBus, "error", { signal: AbortSignal.timeout(3_000) }),
+            ]);
+            if (Array.isArray(reply)) {
+                const error = reply[0];
+                if (error instanceof Error)
+                    throw error;
+                throw new Error("Cannot connect to the Secret Service session bus");
+            }
+            if (reply === null)
+                throw new Error("Cannot inspect the Secret Service session bus");
+            return z.array(z.string()).parse(reply.body[0]);
+        }
+        const [active, activatable] = await Promise.all([
+            names("ListNames"),
+            names("ListActivatableNames"),
+        ]);
+        return (!active.includes("org.freedesktop.secrets") &&
+            !activatable.includes("org.freedesktop.secrets"));
+    }
+    catch (cause) {
+        if (missingBus.safeParse(cause).success)
+            return true;
+        // dbus-next emits a plain Error when it cannot discover any bus address.
+        // Without an explicit address, an XDG bus socket or an X11 display, no
+        // session bus can be reached; other errors from a reachable bus stay fatal.
+        if (!process.env.DBUS_SESSION_BUS_ADDRESS && !process.env.DISPLAY) {
+            const runtime = process.env.XDG_RUNTIME_DIR;
+            if (!runtime)
+                return true;
+            try {
+                await access(join(runtime, "bus"));
+            }
+            catch (missingSocket) {
+                if (missingBus.safeParse(missingSocket).success)
+                    return true;
+                throw missingSocket;
+            }
+        }
+        throw cause;
+    }
+    finally {
+        bus?.disconnect();
+    }
+}
+async function keychain(id) {
+    try {
+        // Do not accept the library's default, nonpersistent Linux keyutils fallback.
+        return new AsyncEntry(keychainService, id, {
+            linux: { store: "secret-service" },
+        });
+    }
+    catch (cause) {
+        if (process.platform === "linux" && (await secretServiceAbsent()))
+            return undefined;
+        throw cause;
+    }
+}
+async function movePlaintextKey(id, path, entry) {
+    const store = fileStore(path);
+    const legacy = await store.read(id);
+    const saved = await entry.getPassword();
+    if (legacy === undefined)
+        return saved;
+    if (legacy.type !== "api_key" || legacy.key === undefined)
+        throw new Error("The saved Oyster MCP credential is invalid");
+    const key = oysterKey.parse(legacy.key);
+    if (saved !== null && saved !== key)
+        throw new Error("The Oyster MCP keychain and plaintext file disagree; refusing to discard either key");
+    if (saved === null)
+        await entry.setPassword(key);
+    if ((await entry.getPassword()) !== key)
+        throw new Error("The Oyster MCP keychain did not retain the migrated key");
+    await store.remove(id, async (current) => {
+        if (current.type !== "api_key" || current.key !== key)
+            throw new Error("The plaintext Oyster MCP key changed during migration");
+        if ((await entry.getPassword()) !== key)
+            throw new Error("The Oyster MCP keychain changed during migration");
+    });
+    return key;
+}
+/** Read bounded UTF-8 stdin, then place the key in OS custody when available. */
 export async function saveOysterMcpKey(endpoint, input, options = {}) {
     const id = credentialId(endpoint);
-    const store = createPrivateCredentialStore(options.credentialPath ?? capturePrivateLocalConfigRoot().credentialPath);
+    const path = options.credentialPath ?? capturePrivateLocalConfigRoot().credentialPath;
     const decoder = new TextDecoder("utf-8", { fatal: true });
     let bytes = 0;
     let text = "";
@@ -37,18 +152,35 @@ export async function saveOysterMcpKey(endpoint, input, options = {}) {
     const parsed = oysterKey.safeParse(text);
     if (!parsed.success)
         throw new Error("Expected one Oyster oyk_ key on stdin");
-    await store.modify(id, () => Promise.resolve({ type: "api_key", key: parsed.data }));
+    const entry = await keychain(id);
+    if (entry === undefined) {
+        await fileStore(path).modify(id, () => Promise.resolve({ type: "api_key", key: parsed.data }));
+        fallbackWarning(path);
+        return;
+    }
+    await movePlaintextKey(id, path, entry);
+    await entry.setPassword(parsed.data);
+    if ((await entry.getPassword()) !== parsed.data)
+        throw new Error("The Oyster MCP keychain did not retain the saved key");
 }
 /** Static bearer auth reads only the selected origin's credential, without discovery. */
 export function oysterMcpKeyAuth(endpoint, options = {}) {
     const id = credentialId(endpoint);
-    const store = createPrivateCredentialStore(options.credentialPath ?? capturePrivateLocalConfigRoot().credentialPath);
+    const path = options.credentialPath ?? capturePrivateLocalConfigRoot().credentialPath;
     return {
         async token() {
-            const credential = await store.read(id);
-            if (credential?.type !== "api_key" || credential.key === undefined)
+            const entry = await keychain(id);
+            if (entry === undefined) {
+                const credential = await fileStore(path).read(id);
+                fallbackWarning(path);
+                if (credential?.type !== "api_key" || credential.key === undefined)
+                    throw new OysterMcpKeyRejectedError();
+                return oysterKey.parse(credential.key);
+            }
+            const key = await movePlaintextKey(id, path, entry);
+            if (key === null)
                 throw new OysterMcpKeyRejectedError();
-            return credential.key;
+            return oysterKey.parse(key);
         },
         onUnauthorized() {
             return Promise.reject(new OysterMcpKeyRejectedError());

package/dist/private-provider-rejection.js

@@ -20,5 +20,5 @@ export function modelFailureMessage(provider, failure) {
     }
     if (failure.rejection?.code === "provider_rejected")
         return `${provider} rejected the model request (${failure.rejection.code}, HTTP ${String(failure.rejection.status)}). Check /login or choose another model with /model.`;
-    return `${provider} rejected the model request. Check /login or choose another model with /model.`;
+    return `${provider} model request failed without a provider rejection. Retry the request.`;
 }

package/dist/seatbelt/safe-base.sbpl

@@ -3,8 +3,8 @@
 ; rust-v0.162.1 (7a078f6bb4).
 ; Changed by Botanical: no network fragments, PTY/device write grants, shared
 ; memory or power-management grants. Reads and parameterized folder/temp writes
-; are composed by private-local-seatbelt.ts. Protect .fungi and Git hooks/config,
-; not all of .git. Denials carry fungi-safe for diagnostic correlation.
+; are composed by private-local-seatbelt.ts. Protect .fungi and the whole
+; existing .git administration. Denials carry fungi-safe for diagnostic correlation.
 ;
 ; inspired by Chrome's sandbox policy:
 ; https://source.chromium.org/chromium/chromium/src/+/main:sandbox/policy/mac/common.sb;l=273-319;drc=7b3962fe2e5fc9e2ee58000dc8fbf3429d84d3bd

package/native/bin/bwrap-build-source/Dockerfile

@@ -12,7 +12,7 @@ RUN if [ "$TARGET" = linux-arm64 ]; then \
     fi && apt-get update && apt-get install -y --no-install-recommends \
       build-essential ca-certificates curl xz-utils python3-pip ninja-build \
       pkg-config patchelf libcap-dev libseccomp-dev \
-      $(if [ "$TARGET" = linux-arm64 ]; then printf 'gcc-aarch64-linux-gnu binutils-aarch64-linux-gnu libcap-dev:arm64'; fi) \
+      $(if [ "$TARGET" = linux-arm64 ]; then printf 'gcc-aarch64-linux-gnu binutils-aarch64-linux-gnu libc6-dev-arm64-cross libcap-dev:arm64'; fi) \
     && rm -rf /var/lib/apt/lists/*
 # prefer_static is a maintained Meson option newer than Jammy's Meson.
 RUN pip3 install --no-cache-dir meson==1.10.2
@@ -37,6 +37,8 @@ RUN test "$(getconf GNU_LIBC_VERSION)" = "glibc 2.35" \
     && cc -O2 -Wall -Wextra -Werror /source/vendor/seccomp-unix-block.c -lseccomp -o /compiled/seccomp-generator \
     && /compiled/seccomp-generator /out/fungi-seccomp.bpf \
       $(if [ "$TARGET" = linux-arm64 ]; then printf aarch64; else printf x86_64; fi) unix \
+    && /compiled/seccomp-generator /out/fungi-seccomp-workspace.bpf \
+      $(if [ "$TARGET" = linux-arm64 ]; then printf aarch64; else printf x86_64; fi) workspace \
     && chmod 0755 /out/fungi-bwrap \
     && patchelf --print-needed /out/fungi-bwrap > /needed \
     && while read -r lib; do \

package/native/bin/bwrap-build-source/README.md

@@ -73,17 +73,17 @@ directory. Only controlled TCP/Unix listeners are created, and they close in
 mutated.
 
 The prepared probe checks confined writes, outside-write refusal, `.fungi` and
-Git config/hooks protection, a real allowed Git add/commit, private `/run` and
+Git administration write refusal (including add/commit), private `/run` and
 external XDG runtime directory, absent session locators, and refusal to reach
 the controlled host TCP/Unix listeners. Namespace denial must fail the proof,
 not trigger bare execution or a skipped success.
 
 This is a **direct backend proof fixture**, not foreground/background lifecycle
-or Files acceptance. Linked-worktree Git protection, immovable Git directories,
-shell/direct command owners, process-group cleanup, hidden-run detachment,
-installed-package resolution and all affected gates still require qualification.
-The argv/digest unit tests do not establish any of these kernel properties. Even
-a passing backend probe alone does not authorize changing readiness.
+or Files acceptance. Linked-worktree Git protection, shell/direct command
+owners, process-group cleanup, hidden-run detachment, installed-package
+resolution and all affected gates still require qualification. The argv/digest
+unit tests do not establish any of these kernel properties. Even a passing
+backend probe alone does not authorize changing readiness.
 
 ## Exact remaining gap
 

package/native/bin/bwrap-build-source/pin.mjs

@@ -9,13 +9,13 @@ export const bwrapPin = Object.freeze({
     "0e85c8702248b8dd64144f594147553650cdd0e4c951690345faace79c217c4d",
 });
 
-/** Unmodified maintained libseccomp generator; never locally assembled BPF. */
+/** Retained libseccomp generator with a Workspace rule-set selector. */
 export const seccompPin = Object.freeze({
   repository: "https://github.com/anthropic-experimental/sandbox-runtime",
   revision: "38d1aee29c72035f1dba1337ac89b03a2f655d26",
   source: "vendor/seccomp-src/seccomp-unix-block.c",
   sourceSha256:
-    "9dcde4aedc076fb44efc5cc8d843c7ba898f2a056b71931812d55ef99f1ed6b1",
+    "1599d24097d5e0bac5a22c6d38de98cae990eb18ee28d6be5faccf6db80dcf24",
   licenseSha256:
     "1210bc93eb85dd786c33192d5bcb7153a93922fa99fbc1512af6a7199cb41080",
 });

package/native/bin/bwrap-build-source/record.mjs

@@ -19,6 +19,13 @@ await writeFile(
   resolve(output, "fungi-seccomp.bpf.sha256"),
   `${seccompSha256}\n`,
 );
+const workspaceSeccompSha256 = createHash("sha256")
+  .update(await readFile(resolve(output, "fungi-seccomp-workspace.bpf")))
+  .digest("hex");
+await writeFile(
+  resolve(output, "fungi-seccomp-workspace.bpf.sha256"),
+  `${workspaceSeccompSha256}\n`,
+);
 await copyFile(
   "/source/vendor/LICENSE.sandbox-runtime",
   resolve(output, "LICENSE.sandbox-runtime"),
@@ -47,7 +54,11 @@ await writeFile(
       platform,
       upstream: bwrapPin,
       sha256,
-      seccomp: { generator: seccompPin, sha256: seccompSha256 },
+      seccomp: {
+        generator: seccompPin,
+        readOnlySha256: seccompSha256,
+        workspaceSha256: workspaceSeccompSha256,
+      },
       packages: [
         {
           name: "sandbox-runtime-seccomp-generator",

package/native/bin/bwrap-build-source/vendor/seccomp-unix-block.c

@@ -157,7 +157,8 @@ int main(int argc, char *argv[]) {
     const char *output_file = argv[1];
     const char *arch_name = (argc >= 3) ? argv[2] : NULL;
     const char *rule_set = (argc == 4) ? argv[3] : "unix";
-    if (strcmp(rule_set, "unix") != 0 && strcmp(rule_set, "namespaces") != 0) {
+    if (strcmp(rule_set, "unix") != 0 && strcmp(rule_set, "workspace") != 0 &&
+        strcmp(rule_set, "namespaces") != 0) {
         fprintf(stderr, "Error: Unknown rule set '%s'\n", rule_set);
         return 1;
     }
@@ -209,12 +210,14 @@ int main(int argc, char *argv[]) {
      * int, so the kernel ignores the upper 32 bits of the register. A plain
      * SCMP_CMP_EQ would compare all 64 bits and miss calls where the upper bits
      * are set. */
-    rc = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(socket), 1,
-                          SCMP_A0(SCMP_CMP_MASKED_EQ, 0xffffffff, AF_UNIX));
-    if (rc < 0) {
-        fprintf(stderr, "Error: Failed to add seccomp rule: %s\n", strerror(-rc));
-        seccomp_release(ctx);
-        return 1;
+    if (strcmp(rule_set, "unix") == 0) {
+        rc = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(socket), 1,
+                              SCMP_A0(SCMP_CMP_MASKED_EQ, 0xffffffff, AF_UNIX));
+        if (rc < 0) {
+            fprintf(stderr, "Error: Failed to add seccomp rule: %s\n", strerror(-rc));
+            seccomp_release(ctx);
+            return 1;
+        }
     }
 
     /* Add rule to block socket(AF_VSOCK, ...) */

package/native/bin/bwrap-build.json

@@ -13,10 +13,11 @@
       "repository": "https://github.com/anthropic-experimental/sandbox-runtime",
       "revision": "38d1aee29c72035f1dba1337ac89b03a2f655d26",
       "source": "vendor/seccomp-src/seccomp-unix-block.c",
-      "sourceSha256": "9dcde4aedc076fb44efc5cc8d843c7ba898f2a056b71931812d55ef99f1ed6b1",
+      "sourceSha256": "1599d24097d5e0bac5a22c6d38de98cae990eb18ee28d6be5faccf6db80dcf24",
       "licenseSha256": "1210bc93eb85dd786c33192d5bcb7153a93922fa99fbc1512af6a7199cb41080"
     },
-    "sha256": "38112f9cf994bed2ed962fae63e803c41874732ab032088b2c1ea3d713e51c11"
+    "readOnlySha256": "38112f9cf994bed2ed962fae63e803c41874732ab032088b2c1ea3d713e51c11",
+    "workspaceSha256": "e46f1045f85fcf14f91fae8654bba6a0c87f57e3b92f60bfc16008dbf7dc87c8"
   },
   "packages": [
     {

package/native/bin/fungi-seccomp-workspace.bpf.sha256

@@ -0,0 +1 @@
+e46f1045f85fcf14f91fae8654bba6a0c87f57e3b92f60bfc16008dbf7dc87c8