@gethmy/harness 1.3.0 → 1.5.0

package/src/sdk-agent-runner.ts

@@ -36,6 +36,7 @@ import {
   type McpServerConfig,
   type Options,
   query,
+  type SandboxSettings,
   type SDKMessage,
   type SettingSource,
   type SpawnedProcess,
@@ -143,6 +144,18 @@ export interface SdkRunnerConfig {
    * Only the sizing preflight sets this. Every other spawn keeps CLI parity.
    */
   gateEveryToolCall?: boolean;
+  /**
+   * OS-level isolation for COMMAND EXECUTION — Seatbelt on macOS, bubblewrap on
+   * Linux (#988). Built by `implementRunContainment` (`run-containment.ts`),
+   * which is where the reasoning for each field lives.
+   *
+   * This is the only containment knob that leaves `Bash` usable. `canUseTool` +
+   * `confineToRepo` gate the agent's own TOOL calls, so they can confine a
+   * spawn that only reads and edits; they say nothing about what a command that
+   * spawn runs may then reach. An implement run has to run commands, so it
+   * needs the bound one layer down.
+   */
+  sandbox?: SandboxSettings;
   /**
    * Hands the spawned process-group leader to the worker so its existing
    * pause/resume/cancel paths can keep operating on `this.process`.
@@ -322,6 +335,12 @@ export class SdkAgentRunner implements AgentRunner {
         : {}),
       ...(this.cfg.mcpServers ? { mcpServers: this.cfg.mcpServers } : {}),
       ...(this.cfg.strictMcpConfig ? { strictMcpConfig: true } : {}),
+      // Execution sandbox (#988). Omitted entirely when unset, so every spawn
+      // that has not opted in keeps its current behaviour — the same shape as
+      // `canUseTool` above. When it IS set, `failIfUnavailable` inside it means
+      // an unsupported host fails the run rather than quietly running it
+      // uncontained, so there is no silent third state.
+      ...(this.cfg.sandbox ? { sandbox: this.cfg.sandbox } : {}),
       stderr: (data) => {
         this.capturedStderr += data;
       },

package/src/verification.ts

@@ -11,6 +11,11 @@ import {
   testCommand,
 } from "./project-type.js";
 import { findDeletedTestFiles } from "./revert-guard.js";
+import {
+  containedEnv,
+  GIT_NO_HOOKS,
+  implementRunContainmentCliArgs,
+} from "./run-containment.js";
 
 const TAG = "verification";
 
@@ -148,6 +153,38 @@ export async function runVerification(
   return result;
 }
 
+/**
+ * ## The verification steps run the RUN'S OWN scripts, and that is a known hole
+ *
+ * `runBuild`, `runTests`, `runFormatFix`, `runLint` and `runDeepReview`'s dev
+ * server all resolve their command through `spawnRunArgs` — `bun run <script>`
+ * out of the worktree's own `package.json` — and execute it **in the daemon
+ * process**. (`review-worker.ts` spawns the sixth, its own `dev` server, for the
+ * same reason and with the same exposure.)
+ * The worktree is in `sandbox.filesystem.allowWrite` by design, so a contained
+ * implement run can rewrite `"build"` to anything it likes and the daemon will
+ * then run it, outside the sandbox, with full network. No failure is needed to
+ * trigger this; verification runs on every successful run.
+ *
+ * `env: containedEnv()` (#988) is a real reduction and NOT a fix: it removes
+ * the secret-shaped variables, so `HARMONY_API_KEY`, `GITHUB_PERSONAL_ACCESS_TOKEN`
+ * and their neighbours are gone from the child. What remains is a command of
+ * the run's choosing, executing as the operator, able to read `~/.ssh` and
+ * reach the network.
+ *
+ * Closing it properly means running the repo's own build and test somewhere the
+ * operator's credentials are not — which is the problem `repair-sandbox.ts`
+ * solved for the CI repair with a container, and it is a piece of work of its
+ * own rather than a line in this one. Until then this is listed in
+ * `run-containment.ts`'s "what this does not cover" and in `docs/agent-daemon.md`,
+ * because a residual nobody wrote down is indistinguishable from one nobody saw.
+ *
+ * That is not a figure of speech here. The first version of both lists named
+ * the four verification steps only, and the two `dev` servers — which are the
+ * same `spawnRunArgs` shape — then shipped with the daemon's full environment,
+ * unlisted and unnoticed through every gate. `spawn-run-containment.test.ts`
+ * now asserts the property over call sites rather than over a written list.
+ */
 export function runBuild(worktreePath: string, timeout: number): string[] {
   const command = buildCommand(worktreePath);
   if (!command) {
@@ -163,6 +200,7 @@ export function runBuild(worktreePath: string, timeout: number): string[] {
       timeout,
       stdio: "pipe",
       maxBuffer: MAX_OUTPUT_BUFFER,
+      env: containedEnv(),
     });
     return [];
   } catch (err: unknown) {
@@ -190,6 +228,7 @@ export function runTests(worktreePath: string, timeout: number): string[] {
       timeout,
       stdio: "pipe",
       maxBuffer: MAX_OUTPUT_BUFFER,
+      env: containedEnv(),
     });
     return [];
   } catch (err: unknown) {
@@ -229,6 +268,7 @@ export function runFormatFix(
       timeout,
       stdio: "pipe",
       maxBuffer: MAX_OUTPUT_BUFFER,
+      env: containedEnv(),
     });
     log.info(
       TAG,
@@ -259,6 +299,7 @@ export function runLint(worktreePath: string, timeout: number): string[] {
       timeout,
       stdio: "pipe",
       maxBuffer: MAX_OUTPUT_BUFFER,
+      env: containedEnv(),
     });
     return [];
   } catch (err: unknown) {
@@ -290,6 +331,19 @@ export async function runDeepReview(
     devServer = spawn(cmd, args, {
       cwd: worktreePath,
       stdio: ["ignore", "pipe", "pipe"],
+      // Contained (#988), and it was the one spawn in this file that was not.
+      // `spawnRunArgs("dev", …)` resolves the worktree's OWN `dev` script,
+      // which the contained implement run may rewrite, so this is the same
+      // attacker-choosable command as `runBuild`/`runTests` — except it ran
+      // with the daemon's full environment, `HARMONY_API_KEY` and
+      // `GITHUB_PERSONAL_ACCESS_TOKEN` included, while `changelog.ts` told
+      // users the verification commands run "without your credentials".
+      //
+      // A reduction, not a fix: the command still executes outside the sandbox
+      // with network. That is why the dev server is now NAMED in the residual
+      // list in `run-containment.ts` and in `docs/agent-daemon.md`, instead of
+      // being left implied by a list of four other scripts.
+      env: containedEnv(),
     });
 
     // Wait for dev server to be ready, then confirm it answers HTTP.
@@ -311,7 +365,7 @@ export async function runDeepReview(
       // "(unable to retrieve diff)" — reviewing the change with no change (#701).
       diff = execFileSync(
         "git",
-        ["diff", `origin/${config.worktree.baseBranch}..HEAD`],
+        [...GIT_NO_HOOKS, "diff", `origin/${config.worktree.baseBranch}..HEAD`],
         {
           cwd: worktreePath,
           encoding: "utf-8",
@@ -336,7 +390,6 @@ export async function runDeepReview(
       "```",
     ].join("\n");
 
-    const leanSources = config.claude.leanSettingSources;
     const output = execFileSync(
       "claude",
       [
@@ -345,8 +398,16 @@ export async function runDeepReview(
         "sonnet",
         "--max-turns",
         "10",
-        // Lean spawn — skip project CLAUDE.md/@-imports (#348).
-        ...(leanSources ? ["--setting-sources", leanSources] : []),
+        // Contained (#988). This spawn reads a diff the implement run wrote, in
+        // that run's own worktree, so it is downstream of untrusted text by
+        // construction — and it used to run with no sandbox and no credential
+        // deny at all. It has no `--allowedTools` of its own, which bounds it
+        // less than it looks: the default set still reads files.
+        ...implementRunContainmentCliArgs({
+          worktree: worktreePath,
+          // Reads a diff and reports findings; it writes nothing.
+          readOnly: true,
+        }),
         "--",
         reviewPrompt,
       ],
@@ -356,6 +417,7 @@ export async function runDeepReview(
         timeout: config.verification.timeout,
         stdio: "pipe",
         maxBuffer: MAX_OUTPUT_BUFFER,
+        env: containedEnv(),
       },
     );
 
@@ -396,7 +458,6 @@ export function attemptAutoFix(
     "```",
   ].join("\n");
 
-  const leanSources = config.claude.leanSettingSources;
   const args = [
     "--print",
     "--model",
@@ -405,8 +466,23 @@ export function attemptAutoFix(
     "50",
     "--allowedTools",
     "Bash,Read,Write,Edit,Glob,Grep",
-    // Lean spawn — concrete build/lint errors, no project docs needed (#348).
-    ...(leanSources ? ["--setting-sources", leanSources] : []),
+    // Contained exactly like the implement run (#988). This spawn used to pass
+    // `--setting-sources local,user` and nothing else: no sandbox, no
+    // credential denies, no env strip — measured reading
+    // `~/.harmony-mcp/config.json` (the Harmony API key), reaching the open
+    // internet and writing to `$HOME`.
+    //
+    // It is not an edge path. `maxFixAttempts` defaults to 1, so a failing
+    // build reaches here on an ordinary run — and whether the build fails is
+    // under the CONTAINED run's control, which made this the cheap way out of
+    // the containment: break the build, get an uncontained spawn in the same
+    // worktree, on the same branch.
+    //
+    // `leanSettingSources` is deliberately no longer read here. It exists to
+    // drop the project docs an auto-fix does not need (#348), and the
+    // containment's `settingSources` already excludes `user`; honouring both
+    // would let the operator's config widen a boundary.
+    ...implementRunContainmentCliArgs({ worktree: worktreePath }),
     "--",
     fixPrompt,
   ];
@@ -419,6 +495,7 @@ export function attemptAutoFix(
     timeout: config.verification.timeout,
     stdio: "pipe",
     maxBuffer: MAX_OUTPUT_BUFFER,
+    env: containedEnv(),
   });
 }