@gethmy/harness 1.4.0 → 1.5.0

package/src/sdk-agent-runner.ts

@@ -36,6 +36,7 @@ import {
   type McpServerConfig,
   type Options,
   query,
+  type SandboxSettings,
   type SDKMessage,
   type SettingSource,
   type SpawnedProcess,
@@ -143,6 +144,18 @@ export interface SdkRunnerConfig {
    * Only the sizing preflight sets this. Every other spawn keeps CLI parity.
    */
   gateEveryToolCall?: boolean;
+  /**
+   * OS-level isolation for COMMAND EXECUTION — Seatbelt on macOS, bubblewrap on
+   * Linux (#988). Built by `implementRunContainment` (`run-containment.ts`),
+   * which is where the reasoning for each field lives.
+   *
+   * This is the only containment knob that leaves `Bash` usable. `canUseTool` +
+   * `confineToRepo` gate the agent's own TOOL calls, so they can confine a
+   * spawn that only reads and edits; they say nothing about what a command that
+   * spawn runs may then reach. An implement run has to run commands, so it
+   * needs the bound one layer down.
+   */
+  sandbox?: SandboxSettings;
   /**
    * Hands the spawned process-group leader to the worker so its existing
    * pause/resume/cancel paths can keep operating on `this.process`.
@@ -322,6 +335,12 @@ export class SdkAgentRunner implements AgentRunner {
         : {}),
       ...(this.cfg.mcpServers ? { mcpServers: this.cfg.mcpServers } : {}),
       ...(this.cfg.strictMcpConfig ? { strictMcpConfig: true } : {}),
+      // Execution sandbox (#988). Omitted entirely when unset, so every spawn
+      // that has not opted in keeps its current behaviour — the same shape as
+      // `canUseTool` above. When it IS set, `failIfUnavailable` inside it means
+      // an unsupported host fails the run rather than quietly running it
+      // uncontained, so there is no silent third state.
+      ...(this.cfg.sandbox ? { sandbox: this.cfg.sandbox } : {}),
       stderr: (data) => {
         this.capturedStderr += data;
       },

package/src/verification.ts

@@ -11,6 +11,11 @@ import {
   testCommand,
 } from "./project-type.js";
 import { findDeletedTestFiles } from "./revert-guard.js";
+import {
+  containedEnv,
+  GIT_NO_HOOKS,
+  implementRunContainmentCliArgs,
+} from "./run-containment.js";
 
 const TAG = "verification";
 
@@ -148,6 +153,38 @@ export async function runVerification(
   return result;
 }
 
+/**
+ * ## The verification steps run the RUN'S OWN scripts, and that is a known hole
+ *
+ * `runBuild`, `runTests`, `runFormatFix`, `runLint` and `runDeepReview`'s dev
+ * server all resolve their command through `spawnRunArgs` — `bun run <script>`
+ * out of the worktree's own `package.json` — and execute it **in the daemon
+ * process**. (`review-worker.ts` spawns the sixth, its own `dev` server, for the
+ * same reason and with the same exposure.)
+ * The worktree is in `sandbox.filesystem.allowWrite` by design, so a contained
+ * implement run can rewrite `"build"` to anything it likes and the daemon will
+ * then run it, outside the sandbox, with full network. No failure is needed to
+ * trigger this; verification runs on every successful run.
+ *
+ * `env: containedEnv()` (#988) is a real reduction and NOT a fix: it removes
+ * the secret-shaped variables, so `HARMONY_API_KEY`, `GITHUB_PERSONAL_ACCESS_TOKEN`
+ * and their neighbours are gone from the child. What remains is a command of
+ * the run's choosing, executing as the operator, able to read `~/.ssh` and
+ * reach the network.
+ *
+ * Closing it properly means running the repo's own build and test somewhere the
+ * operator's credentials are not — which is the problem `repair-sandbox.ts`
+ * solved for the CI repair with a container, and it is a piece of work of its
+ * own rather than a line in this one. Until then this is listed in
+ * `run-containment.ts`'s "what this does not cover" and in `docs/agent-daemon.md`,
+ * because a residual nobody wrote down is indistinguishable from one nobody saw.
+ *
+ * That is not a figure of speech here. The first version of both lists named
+ * the four verification steps only, and the two `dev` servers — which are the
+ * same `spawnRunArgs` shape — then shipped with the daemon's full environment,
+ * unlisted and unnoticed through every gate. `spawn-run-containment.test.ts`
+ * now asserts the property over call sites rather than over a written list.
+ */
 export function runBuild(worktreePath: string, timeout: number): string[] {
   const command = buildCommand(worktreePath);
   if (!command) {
@@ -163,6 +200,7 @@ export function runBuild(worktreePath: string, timeout: number): string[] {
       timeout,
       stdio: "pipe",
       maxBuffer: MAX_OUTPUT_BUFFER,
+      env: containedEnv(),
     });
     return [];
   } catch (err: unknown) {
@@ -190,6 +228,7 @@ export function runTests(worktreePath: string, timeout: number): string[] {
       timeout,
       stdio: "pipe",
       maxBuffer: MAX_OUTPUT_BUFFER,
+      env: containedEnv(),
     });
     return [];
   } catch (err: unknown) {
@@ -229,6 +268,7 @@ export function runFormatFix(
       timeout,
       stdio: "pipe",
       maxBuffer: MAX_OUTPUT_BUFFER,
+      env: containedEnv(),
     });
     log.info(
       TAG,
@@ -259,6 +299,7 @@ export function runLint(worktreePath: string, timeout: number): string[] {
       timeout,
       stdio: "pipe",
       maxBuffer: MAX_OUTPUT_BUFFER,
+      env: containedEnv(),
     });
     return [];
   } catch (err: unknown) {
@@ -290,6 +331,19 @@ export async function runDeepReview(
     devServer = spawn(cmd, args, {
       cwd: worktreePath,
       stdio: ["ignore", "pipe", "pipe"],
+      // Contained (#988), and it was the one spawn in this file that was not.
+      // `spawnRunArgs("dev", …)` resolves the worktree's OWN `dev` script,
+      // which the contained implement run may rewrite, so this is the same
+      // attacker-choosable command as `runBuild`/`runTests` — except it ran
+      // with the daemon's full environment, `HARMONY_API_KEY` and
+      // `GITHUB_PERSONAL_ACCESS_TOKEN` included, while `changelog.ts` told
+      // users the verification commands run "without your credentials".
+      //
+      // A reduction, not a fix: the command still executes outside the sandbox
+      // with network. That is why the dev server is now NAMED in the residual
+      // list in `run-containment.ts` and in `docs/agent-daemon.md`, instead of
+      // being left implied by a list of four other scripts.
+      env: containedEnv(),
     });
 
     // Wait for dev server to be ready, then confirm it answers HTTP.
@@ -311,7 +365,7 @@ export async function runDeepReview(
       // "(unable to retrieve diff)" — reviewing the change with no change (#701).
       diff = execFileSync(
         "git",
-        ["diff", `origin/${config.worktree.baseBranch}..HEAD`],
+        [...GIT_NO_HOOKS, "diff", `origin/${config.worktree.baseBranch}..HEAD`],
         {
           cwd: worktreePath,
           encoding: "utf-8",
@@ -336,7 +390,6 @@ export async function runDeepReview(
       "```",
     ].join("\n");
 
-    const leanSources = config.claude.leanSettingSources;
     const output = execFileSync(
       "claude",
       [
@@ -345,8 +398,16 @@ export async function runDeepReview(
         "sonnet",
         "--max-turns",
         "10",
-        // Lean spawn — skip project CLAUDE.md/@-imports (#348).
-        ...(leanSources ? ["--setting-sources", leanSources] : []),
+        // Contained (#988). This spawn reads a diff the implement run wrote, in
+        // that run's own worktree, so it is downstream of untrusted text by
+        // construction — and it used to run with no sandbox and no credential
+        // deny at all. It has no `--allowedTools` of its own, which bounds it
+        // less than it looks: the default set still reads files.
+        ...implementRunContainmentCliArgs({
+          worktree: worktreePath,
+          // Reads a diff and reports findings; it writes nothing.
+          readOnly: true,
+        }),
         "--",
         reviewPrompt,
       ],
@@ -356,6 +417,7 @@ export async function runDeepReview(
         timeout: config.verification.timeout,
         stdio: "pipe",
         maxBuffer: MAX_OUTPUT_BUFFER,
+        env: containedEnv(),
       },
     );
 
@@ -396,7 +458,6 @@ export function attemptAutoFix(
     "```",
   ].join("\n");
 
-  const leanSources = config.claude.leanSettingSources;
   const args = [
     "--print",
     "--model",
@@ -405,8 +466,23 @@ export function attemptAutoFix(
     "50",
     "--allowedTools",
     "Bash,Read,Write,Edit,Glob,Grep",
-    // Lean spawn — concrete build/lint errors, no project docs needed (#348).
-    ...(leanSources ? ["--setting-sources", leanSources] : []),
+    // Contained exactly like the implement run (#988). This spawn used to pass
+    // `--setting-sources local,user` and nothing else: no sandbox, no
+    // credential denies, no env strip — measured reading
+    // `~/.harmony-mcp/config.json` (the Harmony API key), reaching the open
+    // internet and writing to `$HOME`.
+    //
+    // It is not an edge path. `maxFixAttempts` defaults to 1, so a failing
+    // build reaches here on an ordinary run — and whether the build fails is
+    // under the CONTAINED run's control, which made this the cheap way out of
+    // the containment: break the build, get an uncontained spawn in the same
+    // worktree, on the same branch.
+    //
+    // `leanSettingSources` is deliberately no longer read here. It exists to
+    // drop the project docs an auto-fix does not need (#348), and the
+    // containment's `settingSources` already excludes `user`; honouring both
+    // would let the operator's config widen a boundary.
+    ...implementRunContainmentCliArgs({ worktree: worktreePath }),
     "--",
     fixPrompt,
   ];
@@ -419,6 +495,7 @@ export function attemptAutoFix(
     timeout: config.verification.timeout,
     stdio: "pipe",
     maxBuffer: MAX_OUTPUT_BUFFER,
+    env: containedEnv(),
   });
 }
 

package/src/worktree.ts

@@ -3,6 +3,7 @@ import { existsSync, readdirSync, rmSync } from "node:fs";
 import { resolve } from "node:path";
 import { log } from "./log.js";
 import { installCommand } from "./pm.js";
+import { containedEnv, GIT_NO_HOOKS } from "./run-containment.js";
 
 const TAG = "worktree";
 
@@ -47,7 +48,7 @@ export function fetchBaseBranch(
   baseBranch: string,
   attempts = 3,
   fetchImpl: (root: string, branch: string) => void = (root, branch) =>
-    execFileSync("git", ["fetch", "origin", branch], {
+    execFileSync("git", [...GIT_NO_HOOKS, "fetch", "origin", branch], {
       cwd: root,
       stdio: "pipe",
     }),
@@ -241,13 +242,20 @@ export function fetchExistingBranch(
   lsRemoteImpl: (root: string, branch: string) => void = (root, branch) =>
     execFileSync(
       "git",
-      ["ls-remote", "--exit-code", "origin", `refs/heads/${branch}`],
+      [
+        ...GIT_NO_HOOKS,
+        "ls-remote",
+        "--exit-code",
+        "origin",
+        `refs/heads/${branch}`,
+      ],
       { cwd: root, stdio: "pipe" },
     ),
   fetchImpl: (root: string, branch: string) => void = (root, branch) =>
     execFileSync(
       "git",
       [
+        ...GIT_NO_HOOKS,
         "fetch",
         "origin",
         `+refs/heads/${branch}:refs/remotes/origin/${branch}`,
@@ -336,7 +344,7 @@ export interface CreateWorktreeOptions {
  */
 export function readWorktreeHead(worktreePath: string): string | null {
   try {
-    return execFileSync("git", ["rev-parse", "HEAD"], {
+    return execFileSync("git", [...GIT_NO_HOOKS, "rev-parse", "HEAD"], {
       cwd: worktreePath,
       encoding: "utf-8",
     }).trim();
@@ -351,9 +359,13 @@ export function createWorktree(
   branchName: string,
   opts: CreateWorktreeOptions = {},
 ): string {
-  const repoRoot = execFileSync("git", ["rev-parse", "--show-toplevel"], {
-    encoding: "utf-8",
-  }).trim();
+  const repoRoot = execFileSync(
+    "git",
+    [...GIT_NO_HOOKS, "rev-parse", "--show-toplevel"],
+    {
+      encoding: "utf-8",
+    },
+  ).trim();
 
   const worktreeDir = resolve(repoRoot, basePath, branchName);
 
@@ -368,10 +380,14 @@ export function createWorktree(
   // `--expire=now` overrides `gc.worktreePruneExpire` (default 3 months) so
   // freshly-orphaned entries are removed immediately.
   try {
-    execFileSync("git", ["worktree", "prune", "--expire=now"], {
-      cwd: repoRoot,
-      stdio: "pipe",
-    });
+    execFileSync(
+      "git",
+      [...GIT_NO_HOOKS, "worktree", "prune", "--expire=now"],
+      {
+        cwd: repoRoot,
+        stdio: "pipe",
+      },
+    );
   } catch {
     // non-fatal
   }
@@ -405,7 +421,15 @@ export function createWorktree(
   try {
     execFileSync(
       "git",
-      ["worktree", "add", "-B", branchName, worktreeDir, startRef],
+      [
+        ...GIT_NO_HOOKS,
+        "worktree",
+        "add",
+        "-B",
+        branchName,
+        worktreeDir,
+        startRef,
+      ],
       { cwd: repoRoot, stdio: "pipe" },
     );
   } catch (err) {
@@ -422,24 +446,32 @@ export function createWorktree(
     removeWorktreeHoldingBranch(repoRoot, branchName, worktreeDir);
     // Remove any registered worktree at this path (phantom or otherwise).
     try {
-      execFileSync("git", ["worktree", "remove", worktreeDir, "--force"], {
-        cwd: repoRoot,
-        stdio: "pipe",
-      });
+      execFileSync(
+        "git",
+        [...GIT_NO_HOOKS, "worktree", "remove", worktreeDir, "--force"],
+        {
+          cwd: repoRoot,
+          stdio: "pipe",
+        },
+      );
     } catch {
       // best-effort
     }
     // Force-prune any stale worktree admin entries referencing this branch.
     try {
-      execFileSync("git", ["worktree", "prune", "--expire=now"], {
-        cwd: repoRoot,
-        stdio: "pipe",
-      });
+      execFileSync(
+        "git",
+        [...GIT_NO_HOOKS, "worktree", "prune", "--expire=now"],
+        {
+          cwd: repoRoot,
+          stdio: "pipe",
+        },
+      );
     } catch {
       // best-effort
     }
     try {
-      execFileSync("git", ["branch", "-D", branchName], {
+      execFileSync("git", [...GIT_NO_HOOKS, "branch", "-D", branchName], {
         cwd: repoRoot,
         stdio: "pipe",
       });
@@ -448,18 +480,40 @@ export function createWorktree(
     }
     execFileSync(
       "git",
-      ["worktree", "add", "-B", branchName, worktreeDir, startRef],
+      [
+        ...GIT_NO_HOOKS,
+        "worktree",
+        "add",
+        "-B",
+        branchName,
+        worktreeDir,
+        startRef,
+      ],
       { cwd: repoRoot, stdio: "pipe" },
     );
   }
 
-  // Install dependencies in the worktree
+  // Install dependencies in the worktree.
+  //
+  // `ignoreScripts: true` and `containedEnv()` (#988). This runs in the DAEMON
+  // process with no sandbox, and on a retry, resume or steering re-spawn the
+  // worktree is cut from the run's OWN branch tip — so the `package.json` being
+  // installed is one a previous contained run committed. With lifecycle scripts
+  // enabled that is a `postinstall` executing as the operator with the full
+  // environment, which is the same reason `ci-patch.ts` passes `ignoreScripts`
+  // on the repair checkout.
+  //
+  // The cost is real and accepted: a repo whose install genuinely needs a
+  // `postinstall` gets an incomplete `node_modules` here. The catch below
+  // already treats a failed install as survivable, and the verification step
+  // reports what actually breaks.
   log.info(TAG, "Installing dependencies in worktree...");
   try {
-    execSync(installCommand(), {
+    execSync(installCommand(true), {
       cwd: worktreeDir,
       stdio: "pipe",
       timeout: 60_000,
+      env: containedEnv(),
     });
   } catch {
     log.warn(TAG, "Install failed (may be fine if deps are hoisted)");
@@ -494,9 +548,13 @@ export function cleanupWorktree(
   worktreePath: string,
   branchName?: string,
 ): void {
-  const repoRoot = execFileSync("git", ["rev-parse", "--show-toplevel"], {
-    encoding: "utf-8",
-  }).trim();
+  const repoRoot = execFileSync(
+    "git",
+    [...GIT_NO_HOOKS, "rev-parse", "--show-toplevel"],
+    {
+      encoding: "utf-8",
+    },
+  ).trim();
 
   if (existsSync(worktreePath)) {
     // Never escalate on a container: `git worktree remove` would fail on it
@@ -510,10 +568,14 @@ export function cleanupWorktree(
       );
     }
     try {
-      execFileSync("git", ["worktree", "remove", worktreePath, "--force"], {
-        cwd: repoRoot,
-        stdio: "pipe",
-      });
+      execFileSync(
+        "git",
+        [...GIT_NO_HOOKS, "worktree", "remove", worktreePath, "--force"],
+        {
+          cwd: repoRoot,
+          stdio: "pipe",
+        },
+      );
       log.info(TAG, `Removed worktree: ${worktreePath}`);
     } catch (err) {
       log.warn(
@@ -526,10 +588,14 @@ export function cleanupWorktree(
       }
       // Prune stale worktree entries
       try {
-        execFileSync("git", ["worktree", "prune", "--expire=now"], {
-          cwd: repoRoot,
-          stdio: "pipe",
-        });
+        execFileSync(
+          "git",
+          [...GIT_NO_HOOKS, "worktree", "prune", "--expire=now"],
+          {
+            cwd: repoRoot,
+            stdio: "pipe",
+          },
+        );
       } catch {
         // best-effort
       }
@@ -541,10 +607,14 @@ export function cleanupWorktree(
     // "Failed to remove worktree cleanly" warning. Quietly prune any stale
     // registration instead; the branch delete below still runs.
     try {
-      execFileSync("git", ["worktree", "prune", "--expire=now"], {
-        cwd: repoRoot,
-        stdio: "pipe",
-      });
+      execFileSync(
+        "git",
+        [...GIT_NO_HOOKS, "worktree", "prune", "--expire=now"],
+        {
+          cwd: repoRoot,
+          stdio: "pipe",
+        },
+      );
     } catch {
       // best-effort
     }
@@ -553,7 +623,7 @@ export function cleanupWorktree(
   // Delete the branch so it doesn't block future runs
   if (branchName) {
     try {
-      execFileSync("git", ["branch", "-D", branchName], {
+      execFileSync("git", [...GIT_NO_HOOKS, "branch", "-D", branchName], {
         cwd: repoRoot,
         stdio: "pipe",
       });
@@ -590,11 +660,15 @@ export function removeWorktreeHoldingBranch(
 ): string | null {
   let listing: string;
   try {
-    listing = execFileSync("git", ["worktree", "list", "--porcelain"], {
-      cwd: repoRoot,
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "pipe"],
-    });
+    listing = execFileSync(
+      "git",
+      [...GIT_NO_HOOKS, "worktree", "list", "--porcelain"],
+      {
+        cwd: repoRoot,
+        encoding: "utf-8",
+        stdio: ["ignore", "pipe", "pipe"],
+      },
+    );
   } catch {
     return null;
   }
@@ -622,10 +696,14 @@ export function removeWorktreeHoldingBranch(
   if (exceptDir && resolve(holderPath) === resolve(exceptDir)) return null;
 
   try {
-    execFileSync("git", ["worktree", "remove", holderPath, "--force"], {
-      cwd: repoRoot,
-      stdio: "pipe",
-    });
+    execFileSync(
+      "git",
+      [...GIT_NO_HOOKS, "worktree", "remove", holderPath, "--force"],
+      {
+        cwd: repoRoot,
+        stdio: "pipe",
+      },
+    );
     log.warn(
       TAG,
       `Evicted worktree ${holderPath} holding branch ${branchName} so it can be reused (#732)`,
@@ -642,10 +720,14 @@ export function removeWorktreeHoldingBranch(
   // Clear the now-orphaned admin entry so `git branch -D` / `worktree add` see a
   // free branch.
   try {
-    execFileSync("git", ["worktree", "prune", "--expire=now"], {
-      cwd: repoRoot,
-      stdio: "pipe",
-    });
+    execFileSync(
+      "git",
+      [...GIT_NO_HOOKS, "worktree", "prune", "--expire=now"],
+      {
+        cwd: repoRoot,
+        stdio: "pipe",
+      },
+    );
   } catch {
     // best-effort
   }
@@ -654,9 +736,13 @@ export function removeWorktreeHoldingBranch(
 
 /** Resolve the main repo root, independent of any worktree cwd. */
 function resolveRepoRoot(): string {
-  return execFileSync("git", ["rev-parse", "--show-toplevel"], {
-    encoding: "utf-8",
-  }).trim();
+  return execFileSync(
+    "git",
+    [...GIT_NO_HOOKS, "rev-parse", "--show-toplevel"],
+    {
+      encoding: "utf-8",
+    },
+  ).trim();
 }
 
 /**
@@ -669,7 +755,13 @@ function localBranchExists(branchName: string, repoRoot: string): boolean {
   try {
     execFileSync(
       "git",
-      ["show-ref", "--verify", "--quiet", `refs/heads/${branchName}`],
+      [
+        ...GIT_NO_HOOKS,
+        "show-ref",
+        "--verify",
+        "--quiet",
+        `refs/heads/${branchName}`,
+      ],
       { cwd: repoRoot, stdio: "ignore" },
     );
     return true;
@@ -708,7 +800,7 @@ export function branchAheadOfItsRemote(
   try {
     const out = execFileSync(
       "git",
-      ["rev-list", branchName, "--not", "--remotes=origin"],
+      [...GIT_NO_HOOKS, "rev-list", branchName, "--not", "--remotes=origin"],
       // stdio pipes stderr (rather than inheriting it) so any git diagnostic is
       // captured with the throw, never leaked to the daemon's own stderr.
       { cwd: repoRoot, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] },