@fungi.computer/truffle 0.2.2 → 0.3.1

package/dist/private-local-service.js

@@ -13,9 +13,12 @@ export { AgentArchiveRefused } from "@fungi.computer/shiitake/agent-control";
 import { newWebSocketRpcSession } from "@fungi.computer/capnweb";
 import { runPrivateLocalAuthRemote, } from "./private-local-auth-rpc.js";
 import { spawn } from "node:child_process";
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { setTimeout as delay } from "node:timers/promises";
 import { readInstalledLocalClientBuildId } from "./private-local-client-version.js";
+import { nativePackageStartupError } from "./private-local-native-install-error.js";
 export { readInstalledLocalClientBuildId } from "./private-local-client-version.js";
 export { privateLocalServiceVersion } from "./private-local-service-discovery.js";
 import { createShiitakeClient, parseSessionSnapshot, } from "@fungi.computer/shiitake/client";
@@ -220,6 +223,7 @@ export function createPrivateLocalServiceManager(options = {}) {
         request.signal?.throwIfAborted();
         const directory = await serviceDirectory(selectedDirectory);
         const release = await acquireServiceLock(directory, "startup");
+        let nativeRefusalDirectory;
         try {
             const registration = await readServiceRegistration(directory);
             const existing = registration === undefined
@@ -239,6 +243,8 @@ export function createPrivateLocalServiceManager(options = {}) {
                 : [];
             const serviceEntry = bundledCli ??
                 fileURLToPath(new URL("./private-local-service-process.js", import.meta.url));
+            nativeRefusalDirectory = await mkdtemp(join(directory, ".native-startup-refusal-"));
+            const nativeRefusal = join(nativeRefusalDirectory, "native-package");
             const child = spawn(options.executable ?? process.execPath, [
                 ...bunFlags,
                 serviceEntry,
@@ -249,7 +255,11 @@ export function createPrivateLocalServiceManager(options = {}) {
                 stdio: "ignore",
                 // Service startup retains its existing inherited inputs. This is
                 // not a Computer exec child: only its selected host HOME is pinned.
-                env: { ...process.env, HOME: root.home },
+                env: {
+                    ...process.env,
+                    HOME: root.home,
+                    FUNGI_NATIVE_STARTUP_REFUSAL: nativeRefusal,
+                },
             });
             let failure;
             let exited = false;
@@ -272,8 +282,18 @@ export function createPrivateLocalServiceManager(options = {}) {
                         throw new Error(`The started Local service reports version ${ready.version}, not this client's ${expectedVersion}`);
                     return accept(ready);
                 }
-                if (hasExited())
+                if (hasExited()) {
+                    const refusal = await readFile(nativeRefusal, "utf8").catch((cause) => {
+                        if (cause instanceof Error &&
+                            "code" in cause &&
+                            cause.code === "ENOENT")
+                            return undefined;
+                        throw cause;
+                    });
+                    if (refusal === "native-package")
+                        throw nativePackageStartupError();
                     throw new Error("Local service exited before its handshake");
+                }
                 await delay(100, undefined, { signal: request.signal });
             }
             child.kill("SIGTERM");
@@ -284,7 +304,14 @@ export function createPrivateLocalServiceManager(options = {}) {
                 : `Local service did not become ready; child ${String(child.pid)} is still running`);
         }
         finally {
-            await release();
+            // The token is per spawn and cannot survive a failed or successful start.
+            try {
+                if (nativeRefusalDirectory !== undefined)
+                    await rm(nativeRefusalDirectory, { recursive: true, force: true });
+            }
+            finally {
+                await release();
+            }
         }
     }
     /** POST one selection to `service`; every refusal is a typed failure. */

package/dist/private-local-session-discovery.d.ts

@@ -32,7 +32,8 @@ export declare function readPrivateLocalAgentProfile(path: string): {
     name: string | undefined;
     createdBy: string | null;
     archived: boolean;
-    requireSandbox: boolean;
+    mode: "read-only" | "workspace" | "full-access";
+    writableFolders: string[];
     folder: string;
     model: {
         readonly providerId: string;

package/dist/private-local-session-discovery.js

@@ -3,6 +3,7 @@ import { basename, dirname, join, resolve } from "node:path";
 import * as Effect from "effect/Effect";
 import { parseModelPreferenceJson } from "@fungi.computer/shiitake/model-preference";
 import { z } from "zod";
+import { localPermissionModeSchema } from "./private-local-permission-mode.js";
 import { readAgentDefaultModelJson } from "./private-local-agent-default-model.js";
 import { localAgentFolderSchema, resolveAgentFolder, } from "./private-local-sandbox-policy.js";
 import { logEvent } from "./log-event.js";
@@ -105,7 +106,8 @@ const storedProfileSchema = z.strictObject({
     name: z.string().nullable(),
     createdBy: z.string().nullable(),
     archived: z.union([z.literal(0), z.literal(1)]),
-    requireSandbox: z.union([z.literal(0), z.literal(1)]),
+    mode: localPermissionModeSchema,
+    writableFolders: z.array(z.string()),
     folder: localAgentFolderSchema,
     model: z.string(),
 });
@@ -129,16 +131,25 @@ export function readPrivateLocalAgentProfile(path) {
         const columns = database
             .prepare("PRAGMA table_info(private_local_identity)")
             .all();
-        if (!["name", "created_by", "archived", "require_sandbox", "folder"].every((required) => columns.some((column) => column.name === required)))
+        if (![
+            "name",
+            "created_by",
+            "archived",
+            "mode",
+            "writable_folders",
+            "folder",
+        ].every((required) => columns.some((column) => column.name === required)))
             throw new LocalStoreSchemaError(path);
         const identity = database
-            .prepare("SELECT name, created_by, archived, require_sandbox, folder FROM private_local_identity WHERE singleton = 1")
+            .prepare("SELECT name, created_by, archived, mode, writable_folders, folder FROM private_local_identity WHERE singleton = 1")
             .get();
+        const writableFolders = storedProfileSchema.shape.writableFolders.parse(JSON.parse(z.string().parse(identity?.writable_folders)));
         const stored = storedProfileSchema.parse({
             name: identity?.name,
             createdBy: identity?.created_by,
             archived: identity?.archived,
-            requireSandbox: identity?.require_sandbox,
+            mode: identity?.mode,
+            writableFolders,
             folder: identity?.folder,
             model: readAgentDefaultModelJson(database),
         });
@@ -146,7 +157,8 @@ export function readPrivateLocalAgentProfile(path) {
             name: stored.name ?? undefined,
             createdBy: stored.createdBy,
             archived: stored.archived === 1,
-            requireSandbox: stored.requireSandbox === 1,
+            mode: stored.mode,
+            writableFolders: stored.writableFolders,
             folder: stored.folder,
             model: parseModelPreferenceJson(stored.model),
         };
@@ -267,7 +279,7 @@ export function projectPrivateLocalSessionDiscovery(discovered, connect) {
             databasePath,
             sessionId,
             fungiMcp: resumeRequest?.fungiMcp,
-            requireSandbox: resumeRequest?.requireSandbox,
+            mode: resumeRequest?.mode,
         }, resumeRequest),
     }));
     return Object.freeze({

package/dist/private-mcp-form-contract.d.ts

@@ -77,7 +77,7 @@ export declare const mcpFormApprovalContract: {
             scope: "session";
             input: Schema.Struct<{
                 readonly id: Schema.String;
-                readonly decision: Schema.Literals<readonly ["approve", "deny"]>;
+                readonly decision: Schema.Literals<readonly ["approve", "deny", "always-allow"]>;
                 readonly expectedRevision: Schema.Int;
             }>;
             output: Schema.Union<readonly [Schema.Struct<{
@@ -179,6 +179,15 @@ export declare const mcpFormApprovalContract: {
                     readonly canAnswer: Schema.Boolean;
                     readonly canSetAutoApprove: Schema.Boolean;
                 }>;
+                readonly review: Schema.optionalKey<Schema.Struct<{
+                    readonly command: Schema.String;
+                    readonly cwd: Schema.String;
+                    readonly justification: Schema.String;
+                    readonly prefix: Schema.optionalKey<Schema.$Array<Schema.String>>;
+                    readonly warning: Schema.optionalKey<Schema.String>;
+                    readonly alwaysAllowCoverage: Schema.optionalKey<Schema.String>;
+                    readonly alwaysAllowUnavailableReason: Schema.optionalKey<Schema.String>;
+                }>>;
             }>>;
         }>;
     };

package/dist/private-mcp-form-contract.js

@@ -32,6 +32,15 @@ const answerResult = Schema.Union([
 const McpFormPendingSchema = Schema.Struct({
     id: Schema.String,
     approval: ApprovalViewSchema,
+    review: Schema.optionalKey(Schema.Struct({
+        command: Schema.String,
+        cwd: Schema.String,
+        justification: Schema.String,
+        prefix: Schema.optionalKey(Schema.Array(Schema.String)),
+        warning: Schema.optionalKey(Schema.String),
+        alwaysAllowCoverage: Schema.optionalKey(Schema.String),
+        alwaysAllowUnavailableReason: Schema.optionalKey(Schema.String),
+    })),
 });
 /** The existing Session extension slot carries only display-safe form data. */
 export const mcpFormApprovalContract = {
@@ -41,7 +50,7 @@ export const mcpFormApprovalContract = {
             scope: "session",
             input: Schema.Struct({
                 id: Schema.String,
-                decision: ApprovalAnswerInputSchema.fields.decision,
+                decision: Schema.Literals(["approve", "deny", "always-allow"]),
                 expectedRevision: ApprovalAnswerInputSchema.fields.expectedRevision,
             }),
             output: answerResult,

package/dist/private-mcp-form-session.d.ts

@@ -1,6 +1,23 @@
-import type { Approvals, PendingApproval } from "@fungi.computer/approvals";
+import type { Approvals, ApprovalView, PendingApproval } from "@fungi.computer/approvals";
 import type { ShiitakeSession } from "@fungi.computer/shiitake";
 import { type LocalUiAttachment } from "./private-local-ui-attachment.js";
+export type LocalApprovalReview = {
+    command: string;
+    cwd: string;
+    justification: string;
+    prefix?: readonly string[];
+    warning?: string;
+    alwaysAllowCoverage?: string;
+    alwaysAllowUnavailableReason?: string;
+};
+type Pending = {
+    sessionId: string;
+    approval: ApprovalView;
+    approvals: Approvals;
+    answering: boolean;
+    review: LocalApprovalReview | undefined;
+    alwaysAllow: ((selected: "prefix" | false) => void) | undefined;
+};
 /** Host-owned references to canonical approvals; no suspended tool or second ledger. */
 export declare function createMcpFormSession(): {
     extension: import("@fungi.computer/shiitake/extensions").DefinedExtensionV0<{
@@ -8,7 +25,7 @@ export declare function createMcpFormSession(): {
             scope: "session";
             input: import("effect/Schema").Struct<{
                 readonly id: import("effect/Schema").String;
-                readonly decision: import("effect/Schema").Literals<readonly ["approve", "deny"]>;
+                readonly decision: import("effect/Schema").Literals<readonly ["approve", "deny", "always-allow"]>;
                 readonly expectedRevision: import("effect/Schema").Int;
             }>;
             output: import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
@@ -108,6 +125,15 @@ export declare function createMcpFormSession(): {
                 readonly canAnswer: boolean;
                 readonly canSetAutoApprove: boolean;
             };
+            readonly review?: {
+                readonly command: string;
+                readonly cwd: string;
+                readonly justification: string;
+                readonly prefix?: readonly string[];
+                readonly warning?: string;
+                readonly alwaysAllowCoverage?: string;
+                readonly alwaysAllowUnavailableReason?: string;
+            };
         }[];
     }, {
         readonly pending: readonly {
@@ -153,9 +179,18 @@ export declare function createMcpFormSession(): {
                 readonly canAnswer: boolean;
                 readonly canSetAutoApprove: boolean;
             };
+            readonly review?: {
+                readonly command: string;
+                readonly cwd: string;
+                readonly justification: string;
+                readonly prefix?: readonly string[];
+                readonly warning?: string;
+                readonly alwaysAllowCoverage?: string;
+                readonly alwaysAllowUnavailableReason?: string;
+            };
         }[];
     }>;
-    presentApproval: (sessionId: string, submitted: PendingApproval, approvals: Approvals) => Promise<{
+    presentApproval: (sessionId: string, submitted: PendingApproval, approvals: Approvals, review?: Pending["review"], alwaysAllow?: (selected: "prefix" | false) => void) => Promise<{
         readonly kind: "refused";
         readonly reason: "not-pending";
         readonly id?: never;
@@ -170,3 +205,4 @@ export declare function createMcpFormSession(): {
     }>;
     bindSession: (sessionId: string, session: ShiitakeSession, attachment: LocalUiAttachment | undefined) => ShiitakeSession;
 };
+export {};

package/dist/private-mcp-form-session.js

@@ -46,13 +46,22 @@ export function createMcpFormSession() {
                                 return { kind: "refused", reason: "not-attached" };
                             // Session commit and live UI recheck precede the canonical
                             // decision. Its bound host, never MCP accept, owns apply.
-                            return await entry.approvals.answer({
+                            if (input.decision === "always-allow" &&
+                                entry.alwaysAllow === undefined)
+                                return { kind: "refused", reason: "not-pending" };
+                            if (input.decision === "always-allow")
+                                entry.alwaysAllow?.("prefix");
+                            const result = await entry.approvals.answer({
                                 recordId: entry.approval.record.recordId,
-                                decision: input.decision,
+                                decision: input.decision === "always-allow"
+                                    ? "approve"
+                                    : input.decision,
                                 expectedRevision: input.expectedRevision,
                             });
+                            return result;
                         }
                         finally {
+                            entry.alwaysAllow?.(false);
                             entry.answering = false;
                             const view = await entry.approvals.get({
                                 recordId: entry.approval.record.recordId,
@@ -80,7 +89,12 @@ export function createMcpFormSession() {
             read: (_context, sessionId) => ({
                 pending: [...pending.entries()]
                     .filter(([, entry]) => entry.sessionId === sessionId)
-                    .map(([id, entry]) => ({ id, approval: entry.approval })),
+                    .map(([id, entry]) => {
+                    const item = { id, approval: entry.approval };
+                    return entry.review === undefined
+                        ? item
+                        : { ...item, review: entry.review };
+                }),
             }),
         },
     });
@@ -88,7 +102,7 @@ export function createMcpFormSession() {
      * Native host port, never a model or UI command. The caller supplies the
      * actual submit result and a member-bound capability, not form JSON.
      */
-    async function presentApproval(sessionId, submitted, approvals) {
+    async function presentApproval(sessionId, submitted, approvals, review, alwaysAllow) {
         const approval = await approvals.get({ recordId: submitted.recordId });
         if (approval?.record.state !== "pending" ||
             approval.record.requester.sessionId !== sessionId)
@@ -99,13 +113,22 @@ export function createMcpFormSession() {
             const [id, entry] = existing;
             entry.approval = approval;
             entry.approvals = approvals;
+            entry.review = review;
+            entry.alwaysAllow = alwaysAllow;
             await publish?.(sessionId);
             return { kind: "presented", id };
         }
         if (pending.size >= maximumPendingForms)
             return { kind: "refused", reason: "capacity" };
         const id = correlationKey();
-        pending.set(id, { sessionId, approval, approvals, answering: false });
+        pending.set(id, {
+            sessionId,
+            approval,
+            approvals,
+            answering: false,
+            review,
+            alwaysAllow,
+        });
         await publish?.(sessionId);
         return { kind: "presented", id };
     }

package/dist/private-oyster-mcp-auth.d.ts

@@ -3,7 +3,7 @@ import { UnauthorizedError, type AuthProvider } from "@modelcontextprotocol/clie
 export declare class OysterMcpKeyRejectedError extends UnauthorizedError {
     constructor();
 }
-/** Read bounded UTF-8 stdin, then place the key in Local's existing private store. */
+/** Read bounded UTF-8 stdin, then place the key in OS custody when available. */
 export declare function saveOysterMcpKey(endpoint: URL, input: AsyncIterable<Uint8Array>, options?: {
     credentialPath?: string;
 }): Promise<void>;

package/dist/private-oyster-mcp-auth.js

@@ -1,4 +1,9 @@
 import { UnauthorizedError, } from "@modelcontextprotocol/client";
+import { once } from "node:events";
+import { access } from "node:fs/promises";
+import { join } from "node:path";
+import { Message, sessionBus } from "@jellybrick/dbus-next";
+import { AsyncEntry } from "@napi-rs/keyring";
 import { z } from "zod";
 import { createPrivateCredentialStore, maximumCredentialStringLength, } from "./private-file-credential-store.js";
 import { parseFungiMcpEndpoint } from "./private-fungi-mcp-endpoint.js";
@@ -20,10 +25,120 @@ const oysterKey = z
     .min(5)
     .max(maximumCredentialStringLength)
     .regex(/^oyk_[A-Za-z0-9_-]+$/);
-/** Read bounded UTF-8 stdin, then place the key in Local's existing private store. */
+const keychainService = "fungi-oyster-mcp";
+const warnedFallbackPaths = new Set();
+function fileStore(path) {
+    return createPrivateCredentialStore(path);
+}
+function fallbackWarning(path) {
+    if (warnedFallbackPaths.has(path))
+        return;
+    warnedFallbackPaths.add(path);
+    process.stderr.write(`fungi: OS keychain unavailable (Linux Secret Service); Oyster key stored/read in 0600 file ${JSON.stringify(path)}.\n`);
+}
+/**
+ * The keyring binding reports both absent and broken services as GenericFailure.
+ * Ask the D-Bus owner for typed names, including activatable services, rather
+ * than interpreting its human-readable error text or downgrading every error.
+ */
+async function secretServiceAbsent() {
+    const missingBus = z.object({ code: z.enum(["ENOENT", "ECONNREFUSED"]) });
+    let bus;
+    try {
+        bus = sessionBus();
+        const connectedBus = bus;
+        async function names(member) {
+            const reply = await Promise.race([
+                connectedBus.call(new Message({
+                    destination: "org.freedesktop.DBus",
+                    path: "/org/freedesktop/DBus",
+                    interface: "org.freedesktop.DBus",
+                    member,
+                })),
+                once(connectedBus, "error", { signal: AbortSignal.timeout(3_000) }),
+            ]);
+            if (Array.isArray(reply)) {
+                const error = reply[0];
+                if (error instanceof Error)
+                    throw error;
+                throw new Error("Cannot connect to the Secret Service session bus");
+            }
+            if (reply === null)
+                throw new Error("Cannot inspect the Secret Service session bus");
+            return z.array(z.string()).parse(reply.body[0]);
+        }
+        const [active, activatable] = await Promise.all([
+            names("ListNames"),
+            names("ListActivatableNames"),
+        ]);
+        return (!active.includes("org.freedesktop.secrets") &&
+            !activatable.includes("org.freedesktop.secrets"));
+    }
+    catch (cause) {
+        if (missingBus.safeParse(cause).success)
+            return true;
+        // dbus-next emits a plain Error when it cannot discover any bus address.
+        // Without an explicit address, an XDG bus socket or an X11 display, no
+        // session bus can be reached; other errors from a reachable bus stay fatal.
+        if (!process.env.DBUS_SESSION_BUS_ADDRESS && !process.env.DISPLAY) {
+            const runtime = process.env.XDG_RUNTIME_DIR;
+            if (!runtime)
+                return true;
+            try {
+                await access(join(runtime, "bus"));
+            }
+            catch (missingSocket) {
+                if (missingBus.safeParse(missingSocket).success)
+                    return true;
+                throw missingSocket;
+            }
+        }
+        throw cause;
+    }
+    finally {
+        bus?.disconnect();
+    }
+}
+async function keychain(id) {
+    try {
+        // Do not accept the library's default, nonpersistent Linux keyutils fallback.
+        return new AsyncEntry(keychainService, id, {
+            linux: { store: "secret-service" },
+        });
+    }
+    catch (cause) {
+        if (process.platform === "linux" && (await secretServiceAbsent()))
+            return undefined;
+        throw cause;
+    }
+}
+async function movePlaintextKey(id, path, entry) {
+    const store = fileStore(path);
+    const legacy = await store.read(id);
+    const saved = await entry.getPassword();
+    if (legacy === undefined)
+        return saved;
+    if (legacy.type !== "api_key" || legacy.key === undefined)
+        throw new Error("The saved Oyster MCP credential is invalid");
+    const key = oysterKey.parse(legacy.key);
+    if (saved !== null && saved !== key)
+        throw new Error("The Oyster MCP keychain and plaintext file disagree; refusing to discard either key");
+    if (saved === null)
+        await entry.setPassword(key);
+    if ((await entry.getPassword()) !== key)
+        throw new Error("The Oyster MCP keychain did not retain the migrated key");
+    await store.remove(id, async (current) => {
+        if (current.type !== "api_key" || current.key !== key)
+            throw new Error("The plaintext Oyster MCP key changed during migration");
+        if ((await entry.getPassword()) !== key)
+            throw new Error("The Oyster MCP keychain changed during migration");
+    });
+    return key;
+}
+/** Read bounded UTF-8 stdin, then place the key in OS custody when available. */
 export async function saveOysterMcpKey(endpoint, input, options = {}) {
     const id = credentialId(endpoint);
-    const store = createPrivateCredentialStore(options.credentialPath ?? capturePrivateLocalConfigRoot().credentialPath);
+    const path = options.credentialPath ?? capturePrivateLocalConfigRoot().credentialPath;
     const decoder = new TextDecoder("utf-8", { fatal: true });
     let bytes = 0;
     let text = "";
@@ -37,18 +152,35 @@ export async function saveOysterMcpKey(endpoint, input, options = {}) {
     const parsed = oysterKey.safeParse(text);
     if (!parsed.success)
         throw new Error("Expected one Oyster oyk_ key on stdin");
-    await store.modify(id, () => Promise.resolve({ type: "api_key", key: parsed.data }));
+    const entry = await keychain(id);
+    if (entry === undefined) {
+        await fileStore(path).modify(id, () => Promise.resolve({ type: "api_key", key: parsed.data }));
+        fallbackWarning(path);
+        return;
+    }
+    await movePlaintextKey(id, path, entry);
+    await entry.setPassword(parsed.data);
+    if ((await entry.getPassword()) !== parsed.data)
+        throw new Error("The Oyster MCP keychain did not retain the saved key");
 }
 /** Static bearer auth reads only the selected origin's credential, without discovery. */
 export function oysterMcpKeyAuth(endpoint, options = {}) {
     const id = credentialId(endpoint);
-    const store = createPrivateCredentialStore(options.credentialPath ?? capturePrivateLocalConfigRoot().credentialPath);
+    const path = options.credentialPath ?? capturePrivateLocalConfigRoot().credentialPath;
     return {
         async token() {
-            const credential = await store.read(id);
-            if (credential?.type !== "api_key" || credential.key === undefined)
+            const entry = await keychain(id);
+            if (entry === undefined) {
+                const credential = await fileStore(path).read(id);
+                fallbackWarning(path);
+                if (credential?.type !== "api_key" || credential.key === undefined)
+                    throw new OysterMcpKeyRejectedError();
+                return oysterKey.parse(credential.key);
+            }
+            const key = await movePlaintextKey(id, path, entry);
+            if (key === null)
                 throw new OysterMcpKeyRejectedError();
-            return credential.key;
+            return oysterKey.parse(key);
         },
         onUnauthorized() {
             return Promise.reject(new OysterMcpKeyRejectedError());

package/dist/private-provider-rejection.js

@@ -20,5 +20,5 @@ export function modelFailureMessage(provider, failure) {
     }
     if (failure.rejection?.code === "provider_rejected")
         return `${provider} rejected the model request (${failure.rejection.code}, HTTP ${String(failure.rejection.status)}). Check /login or choose another model with /model.`;
-    return `${provider} rejected the model request. Check /login or choose another model with /model.`;
+    return `${provider} model request failed without a provider rejection. Retry the request.`;
 }

package/dist/seatbelt/safe-base.sbpl

@@ -3,8 +3,8 @@
 ; rust-v0.162.1 (7a078f6bb4).
 ; Changed by Botanical: no network fragments, PTY/device write grants, shared
 ; memory or power-management grants. Reads and parameterized folder/temp writes
-; are composed by private-local-seatbelt.ts. Protect .fungi and Git hooks/config,
-; not all of .git. Denials carry fungi-safe for diagnostic correlation.
+; are composed by private-local-seatbelt.ts. Protect .fungi and the whole
+; existing .git administration. Denials carry fungi-safe for diagnostic correlation.
 ;
 ; inspired by Chrome's sandbox policy:
 ; https://source.chromium.org/chromium/chromium/src/+/main:sandbox/policy/mac/common.sb;l=273-319;drc=7b3962fe2e5fc9e2ee58000dc8fbf3429d84d3bd

package/native/bin/bwrap-build-source/Dockerfile

@@ -37,6 +37,8 @@ RUN test "$(getconf GNU_LIBC_VERSION)" = "glibc 2.35" \
     && cc -O2 -Wall -Wextra -Werror /source/vendor/seccomp-unix-block.c -lseccomp -o /compiled/seccomp-generator \
     && /compiled/seccomp-generator /out/fungi-seccomp.bpf \
       $(if [ "$TARGET" = linux-arm64 ]; then printf aarch64; else printf x86_64; fi) unix \
+    && /compiled/seccomp-generator /out/fungi-seccomp-workspace.bpf \
+      $(if [ "$TARGET" = linux-arm64 ]; then printf aarch64; else printf x86_64; fi) workspace \
     && chmod 0755 /out/fungi-bwrap \
     && patchelf --print-needed /out/fungi-bwrap > /needed \
     && while read -r lib; do \

package/native/bin/bwrap-build-source/README.md

@@ -73,17 +73,17 @@ directory. Only controlled TCP/Unix listeners are created, and they close in
 mutated.
 
 The prepared probe checks confined writes, outside-write refusal, `.fungi` and
-Git config/hooks protection, a real allowed Git add/commit, private `/run` and
+Git administration write refusal (including add/commit), private `/run` and
 external XDG runtime directory, absent session locators, and refusal to reach
 the controlled host TCP/Unix listeners. Namespace denial must fail the proof,
 not trigger bare execution or a skipped success.
 
 This is a **direct backend proof fixture**, not foreground/background lifecycle
-or Files acceptance. Linked-worktree Git protection, immovable Git directories,
-shell/direct command owners, process-group cleanup, hidden-run detachment,
-installed-package resolution and all affected gates still require qualification.
-The argv/digest unit tests do not establish any of these kernel properties. Even
-a passing backend probe alone does not authorize changing readiness.
+or Files acceptance. Linked-worktree Git protection, shell/direct command
+owners, process-group cleanup, hidden-run detachment, installed-package
+resolution and all affected gates still require qualification. The argv/digest
+unit tests do not establish any of these kernel properties. Even a passing
+backend probe alone does not authorize changing readiness.
 
 ## Exact remaining gap
 

package/native/bin/bwrap-build-source/pin.mjs

@@ -9,13 +9,13 @@ export const bwrapPin = Object.freeze({
     "0e85c8702248b8dd64144f594147553650cdd0e4c951690345faace79c217c4d",
 });
 
-/** Unmodified maintained libseccomp generator; never locally assembled BPF. */
+/** Retained libseccomp generator with a Workspace rule-set selector. */
 export const seccompPin = Object.freeze({
   repository: "https://github.com/anthropic-experimental/sandbox-runtime",
   revision: "38d1aee29c72035f1dba1337ac89b03a2f655d26",
   source: "vendor/seccomp-src/seccomp-unix-block.c",
   sourceSha256:
-    "9dcde4aedc076fb44efc5cc8d843c7ba898f2a056b71931812d55ef99f1ed6b1",
+    "1599d24097d5e0bac5a22c6d38de98cae990eb18ee28d6be5faccf6db80dcf24",
   licenseSha256:
     "1210bc93eb85dd786c33192d5bcb7153a93922fa99fbc1512af6a7199cb41080",
 });

package/native/bin/bwrap-build-source/record.mjs

@@ -19,6 +19,13 @@ await writeFile(
   resolve(output, "fungi-seccomp.bpf.sha256"),
   `${seccompSha256}\n`,
 );
+const workspaceSeccompSha256 = createHash("sha256")
+  .update(await readFile(resolve(output, "fungi-seccomp-workspace.bpf")))
+  .digest("hex");
+await writeFile(
+  resolve(output, "fungi-seccomp-workspace.bpf.sha256"),
+  `${workspaceSeccompSha256}\n`,
+);
 await copyFile(
   "/source/vendor/LICENSE.sandbox-runtime",
   resolve(output, "LICENSE.sandbox-runtime"),
@@ -47,7 +54,11 @@ await writeFile(
       platform,
       upstream: bwrapPin,
       sha256,
-      seccomp: { generator: seccompPin, sha256: seccompSha256 },
+      seccomp: {
+        generator: seccompPin,
+        readOnlySha256: seccompSha256,
+        workspaceSha256: workspaceSeccompSha256,
+      },
       packages: [
         {
           name: "sandbox-runtime-seccomp-generator",