@kendoo.agentdesk/agentdesk 0.16.3 → 0.17.1

package/CHANGELOG.md

@@ -8,6 +8,16 @@ All user-facing changes to AgentDesk. Each entry is tagged:
 
 Internal refactors, infrastructure changes, and architectural notes are not listed here.
 
+## [0.17.1] — 2026-04-18
+
+### Added
+- `[CLI]` Sessions now run inside a kernel-enforced sandbox when one is available — `sandbox-exec` on macOS, `bwrap` (bubblewrap) on Linux. Writes outside the project directory and the session's scratch home are blocked at the kernel level; reads from known credential locations (`~/.ssh`, `~/.aws`, `~/.config/gh`, `~/.gitconfig`, `~/.netrc`, etc.) are denied so a confused agent cannot slurp up other projects' tokens. If the tool isn't installed (Linux without `bubblewrap` / unsupported platform), sessions fall back to the Tier 1 scoped-env isolation and a one-line notice explains why. Set `AGENTDESK_NO_SANDBOX=1` to opt out for debugging.
+
+## [0.17.0] — 2026-04-18
+
+### Added
+- `[CLI]` Each session now runs with a scoped identity. Before spawning, agentdesk builds a private scratch home containing only this project's tracker credentials, git commit identity, and a scoped GitHub credential helper. `gh`, `git`, and `ssh` inside the session see only what we put there — your global accounts, other projects' tokens, and keys outside the scratch dir aren't discovered by default lookups. Prevents accidental cross-project identity use on shared machines.
+
 ## [0.16.3] — 2026-04-18
 
 ### Changed

package/cli/daemon.mjs

@@ -385,6 +385,7 @@ export async function runDaemon() {
         tracker, config,
         project: detected, team, teamSections,
         sessionUrl,
+        sessionId,
         cwd: project.path,
         apiKey,
         serverUrl: agentdeskServer,

package/cli/orchestrator.mjs

@@ -7,6 +7,8 @@ import { join, dirname } from "path";
 import { fileURLToPath } from "url";
 import { buildPrompt, buildSoloPrompt, buildPhasedPrompt } from "./prompt.mjs";
 import { createStreamParser } from "./stream-parser.mjs";
+import { createScratchHome } from "./session-sandbox.mjs";
+import { wrapIsolatedSpawn, probeIsolation } from "./session-isolation.mjs";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const CLI_VERSION = JSON.parse(readFileSync(join(__dirname, "../package.json"), "utf-8")).version;
@@ -72,10 +74,23 @@ function modelLabelForPhase(phase, phaseModels) {
 export async function runOrchestrator({
   taskId, taskLink, description, createTask, tracker, config,
   project, team, teamSections, sessionUrl, cwd,
-  onEvent, apiKey, serverUrl, soloAgent, childStrategy,
+  onEvent, apiKey, serverUrl, soloAgent, childStrategy, sessionId,
 }) {
   const trackerCreds = await fetchTrackerCredentials(project?.name, apiKey, serverUrl);
-  const env = { ...process.env, ...loadDotEnv(cwd), ...trackerCreds };
+
+  // Build a per-session scratch HOME that isolates THIS project's identity
+  // from the user's global git/gh/ssh state and from other projects'
+  // credentials. Cleanup runs at session end regardless of outcome.
+  const sandbox = createScratchHome({
+    projectId: project?.name,
+    sessionId,
+    creds: trackerCreds,
+    commitIdentity: {
+      name: config?.identityBadge || "AgentDesk",
+      email: trackerCreds.JIRA_EMAIL || `agentdesk@local`,
+    },
+  });
+  const env = { ...process.env, ...loadDotEnv(cwd), ...sandbox.env };
   const startTime = Date.now();
   let totalInputTokens = 0;
   let totalOutputTokens = 0;
@@ -109,9 +124,21 @@ export async function runOrchestrator({
   emit({ type: "phase:change", phase: initialPhase, model: representativeModel });
 
   const modelArgs = modelArgsForPhase("EXECUTION", config?.phaseModels);
+  const wrapped = wrapIsolatedSpawn({
+    cmd: "claude",
+    args: ["-p", fullPrompt, ...modelArgs, "--allowedTools", "Bash,Read,Edit,Write,Glob,Grep", "--verbose", "--output-format", "stream-json"],
+    cwd,
+    scratchHome: sandbox.home,
+    sessionId,
+  });
+  if (wrapped.isolation.kind !== "none") {
+    console.error(`[agentdesk] session isolation: ${wrapped.isolation.kind}`);
+  } else if (wrapped.isolation.reason) {
+    console.error(`[agentdesk] hard isolation unavailable (${wrapped.isolation.reason}) — scoped-env only`);
+  }
   const child = spawn(
-    "claude",
-    ["-p", fullPrompt, ...modelArgs, "--allowedTools", "Bash,Read,Edit,Write,Glob,Grep", "--verbose", "--output-format", "stream-json"],
+    wrapped.cmd,
+    wrapped.args,
     { stdio: ["pipe", "pipe", "inherit"], shell: false, env, cwd }
   );
   child.stdin.end();
@@ -200,15 +227,24 @@ export async function runOrchestrator({
     emit({ type: "session:end", duration, steps: totalSteps, inputTokens: totalInputTokens, outputTokens: totalOutputTokens });
   }
 
+  sandbox.cleanup();
+
   return { duration, steps: totalSteps, inputTokens: totalInputTokens, outputTokens: totalOutputTokens, handoff: isHandoff };
 }
 
 // --- Phased orchestrator: runs 3 sequential Claude processes ---
 
-async function runSinglePhase({ prompt, cwd, env, teamNames, emit, modelArgs = [] }) {
+async function runSinglePhase({ prompt, cwd, env, teamNames, emit, modelArgs = [], scratchHome, sessionId }) {
+  const wrapped = wrapIsolatedSpawn({
+    cmd: "claude",
+    args: ["-p", prompt, ...modelArgs, "--allowedTools", "Bash,Read,Edit,Write,Glob,Grep", "--verbose", "--output-format", "stream-json"],
+    cwd,
+    scratchHome,
+    sessionId,
+  });
   const child = spawn(
-    "claude",
-    ["-p", prompt, ...modelArgs, "--allowedTools", "Bash,Read,Edit,Write,Glob,Grep", "--verbose", "--output-format", "stream-json"],
+    wrapped.cmd,
+    wrapped.args,
     { stdio: ["pipe", "pipe", "inherit"], shell: false, env, cwd }
   );
   child.stdin.end();
@@ -245,13 +281,30 @@ async function runSinglePhase({ prompt, cwd, env, teamNames, emit, modelArgs = [
 export async function runPhasedOrchestrator({
   taskId, taskLink, description, createTask, tracker, config,
   project, team, teamSections, sessionUrl, cwd,
-  onEvent, apiKey, serverUrl, onChild,
+  onEvent, apiKey, serverUrl, onChild, sessionId,
 }) {
   const trackerCreds = await fetchTrackerCredentials(project?.name, apiKey, serverUrl);
-  const env = { ...process.env, ...loadDotEnv(cwd), ...trackerCreds };
+
+  const sandbox = createScratchHome({
+    projectId: project?.name,
+    sessionId,
+    creds: trackerCreds,
+    commitIdentity: {
+      name: config?.identityBadge || "AgentDesk",
+      email: trackerCreds.JIRA_EMAIL || `agentdesk@local`,
+    },
+  });
+  const env = { ...process.env, ...loadDotEnv(cwd), ...sandbox.env };
   const startTime = Date.now();
   const teamNames = teamSections.names;
 
+  const probe = probeIsolation();
+  if (probe.kind !== "none") {
+    console.error(`[agentdesk] session isolation: ${probe.kind}`);
+  } else {
+    console.error(`[agentdesk] hard isolation unavailable (${probe.reason}) — scoped-env only`);
+  }
+
   function timestamp() {
     const d = new Date();
     return [d.getHours(), d.getMinutes(), d.getSeconds()].map(n => String(n).padStart(2, "0")).join(":");
@@ -304,7 +357,7 @@ export async function runPhasedOrchestrator({
     });
 
     const modelArgs = modelArgsForPhase(phase, config?.phaseModels);
-    const result = await runSinglePhase({ prompt, cwd, env, teamNames, emit, modelArgs });
+    const result = await runSinglePhase({ prompt, cwd, env, teamNames, emit, modelArgs, scratchHome: sandbox.home, sessionId });
 
     if (onChild) onChild(result.child);
 
@@ -366,5 +419,7 @@ export async function runPhasedOrchestrator({
     emit({ type: "session:end", duration, steps: totalSteps, inputTokens: totalInputTokens, outputTokens: totalOutputTokens });
   }
 
+  sandbox.cleanup();
+
   return { duration, steps: totalSteps, inputTokens: totalInputTokens, outputTokens: totalOutputTokens, handoff };
 }

package/cli/session-isolation.mjs

@@ -0,0 +1,160 @@
+// Tier 2 kernel-enforced isolation.
+//
+// On top of the scoped HOME from session-sandbox.mjs, wrap the Claude child
+// process in a kernel sandbox when one is available:
+//   - macOS: `sandbox-exec` (TrustedBSD sandbox, same primitive App Sandbox uses)
+//   - Linux: `bwrap` (bubblewrap — mount namespaces, same primitive Docker uses)
+//
+// Failure mode: if the tool isn't present or the profile can't be written,
+// we emit a one-line notice and spawn the child as normal. The scoped HOME
+// from Phase E still applies — isolation just degrades from "kernel boundary"
+// to "scoped env."
+//
+// Escape hatch: AGENTDESK_NO_SANDBOX=1 skips this layer entirely.
+
+import { execSync } from "child_process";
+import { existsSync, writeFileSync } from "fs";
+import { join } from "path";
+import { platform, homedir } from "os";
+
+// Detect which kernel-isolation tool is usable. Cached after first probe.
+let cachedProbe = null;
+export function probeIsolation() {
+  if (cachedProbe) return cachedProbe;
+  if (process.env.AGENTDESK_NO_SANDBOX === "1") {
+    cachedProbe = { kind: "none", reason: "AGENTDESK_NO_SANDBOX=1 set" };
+    return cachedProbe;
+  }
+  if (platform() === "darwin") {
+    try {
+      execSync("command -v sandbox-exec", { stdio: "pipe" });
+      cachedProbe = { kind: "sandbox-exec" };
+      return cachedProbe;
+    } catch {
+      cachedProbe = { kind: "none", reason: "sandbox-exec not found" };
+      return cachedProbe;
+    }
+  }
+  if (platform() === "linux") {
+    try {
+      execSync("command -v bwrap", { stdio: "pipe" });
+      cachedProbe = { kind: "bwrap" };
+      return cachedProbe;
+    } catch {
+      cachedProbe = { kind: "none", reason: "bubblewrap not installed — apt install bubblewrap / brew install bubblewrap" };
+      return cachedProbe;
+    }
+  }
+  cachedProbe = { kind: "none", reason: `no isolation tool for platform ${platform()}` };
+  return cachedProbe;
+}
+
+// Build the spawn arguments for an isolated claude invocation. Takes the
+// original command/args/options and returns the wrapped form, plus a flag
+// indicating which isolation mode is active.
+export function wrapIsolatedSpawn({ cmd, args, cwd, scratchHome, sessionId }) {
+  const probe = probeIsolation();
+  if (probe.kind === "none") {
+    return { cmd, args, isolation: { kind: "none", reason: probe.reason } };
+  }
+
+  if (probe.kind === "sandbox-exec") {
+    const profilePath = join(scratchHome, "sandbox.sb");
+    writeFileSync(profilePath, macosProfile({ cwd, scratchHome }), { mode: 0o600 });
+    return {
+      cmd: "sandbox-exec",
+      args: ["-f", profilePath, cmd, ...args],
+      isolation: { kind: "sandbox-exec" },
+    };
+  }
+
+  if (probe.kind === "bwrap") {
+    return {
+      cmd: "bwrap",
+      args: [...bwrapArgs({ cwd, scratchHome }), cmd, ...args],
+      isolation: { kind: "bwrap" },
+    };
+  }
+
+  return { cmd, args, isolation: { kind: "none", reason: "unknown probe kind" } };
+}
+
+// --- macOS sandbox-exec profile ---------------------------------------------
+
+function macosProfile({ cwd, scratchHome }) {
+  const home = homedir();
+  // Known-sensitive user paths where credentials typically live. Reads denied
+  // even though general reads are allowed, so a confused agent can't slurp
+  // up other projects' tokens or the user's SSH keys.
+  const denyReadPaths = [
+    join(home, ".ssh"),
+    join(home, ".aws"),
+    join(home, ".gcloud"),
+    join(home, ".config", "gh"),         // real gh config (scratch is under $TMPDIR)
+    join(home, ".docker"),
+    join(home, ".kube"),
+    join(home, ".agentdesk"),
+    join(home, ".config", "agentdesk"),
+  ];
+  const denyReadLiterals = [
+    join(home, ".netrc"),
+    join(home, ".gitconfig"),            // real gitconfig (scratch has its own)
+    join(home, ".npmrc"),
+    join(home, ".pypirc"),
+  ];
+
+  // Writes allowed only here. Everywhere else: read-only by default.
+  const writeSubpaths = [
+    cwd,
+    scratchHome,
+    "/tmp",
+    "/private/tmp",
+    "/private/var/folders",              // macOS TMPDIR lives here
+  ];
+
+  const sb = [
+    `(version 1)`,
+    `(allow default)`,
+    ``,
+    `; Deny reads to known credential locations`,
+    ...denyReadPaths.map(p => `(deny file-read* (subpath ${sbString(p)}))`),
+    ...denyReadLiterals.map(p => `(deny file-read* (literal ${sbString(p)}))`),
+    ``,
+    `; Writes: deny everywhere, then allow the project dir + scratch + tmp`,
+    `(deny file-write*)`,
+    ...writeSubpaths.map(p => `(allow file-write* (subpath ${sbString(p)}))`),
+    ``,
+    `; Allow writes to devices so stdio, /dev/null, tty, ptys all work`,
+    `(allow file-write* (subpath "/dev"))`,
+    ``,
+  ].join("\n");
+
+  return sb;
+}
+
+function sbString(s) {
+  return `"${String(s).replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+
+// --- Linux bwrap args --------------------------------------------------------
+
+function bwrapArgs({ cwd, scratchHome }) {
+  // Everything read-only by default via ro-bind of /. Writable exceptions:
+  // the project dir, the scratch HOME, and a private /tmp. /home/<user> is
+  // replaced with a tmpfs so the agent can't browse the real home dir.
+  const home = homedir();
+  return [
+    "--ro-bind", "/", "/",
+    "--dev-bind", "/dev", "/dev",
+    "--proc", "/proc",
+    "--tmpfs", "/tmp",
+    "--tmpfs", home,                     // blank user home
+    "--bind", cwd, cwd,                  // project dir writable
+    "--bind", scratchHome, scratchHome,  // scratch writable (HOME env var points here)
+    "--die-with-parent",
+    "--unshare-ipc",
+    "--unshare-uts",
+    "--unshare-pid",
+    // Network is NOT unshared — agents need network for tracker APIs and git.
+  ];
+}

package/cli/session-sandbox.mjs

@@ -0,0 +1,121 @@
+// Per-session scratch HOME for identity isolation.
+//
+// When a session runs, we point HOME / GH_CONFIG_DIR / XDG_CONFIG_HOME at a
+// private scratch directory containing only this project's git + gh config.
+// This means `gh`, `git`, `ssh` inside the session see only the identity we
+// put there — the user's global accounts, other projects' tokens, or keys
+// in the real $HOME aren't discovered by default lookups.
+//
+// This is Tier 1 (scoped-env). It prevents accidental cross-project use.
+// Tier 2 (sandbox-exec / bwrap) layers a kernel-enforced boundary on top.
+
+import { mkdirSync, writeFileSync, chmodSync, rmSync, existsSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { randomUUID } from "crypto";
+
+// Build a session scratch HOME. Returns { home, env, cleanup }.
+//   projectId        — identifier used to make the dir path readable
+//   sessionId        — unique per session; guarantees parallel sessions don't collide
+//   creds            — { LINEAR_API_KEY?, JIRA_EMAIL?, JIRA_API_TOKEN?, GITHUB_TOKEN? }
+//   commitIdentity   — { name, email } for git user.* (falls back to sensible defaults)
+//
+// The caller spawns the Claude child with:
+//   { ...process.env, ...env }
+// …and MUST call cleanup() when the session ends (success, crash, signal).
+export function createScratchHome({ projectId, sessionId, creds = {}, commitIdentity = {} }) {
+  const base = join(tmpdir(), "agentdesk-sessions", `${safe(projectId)}-${sessionId || randomUUID().slice(0, 8)}`);
+  mkdirSync(base, { recursive: true, mode: 0o700 });
+  mkdirSync(join(base, ".config"), { recursive: true, mode: 0o700 });
+  mkdirSync(join(base, ".config", "gh"), { recursive: true, mode: 0o700 });
+
+  // --- gh: scoped hosts.yml with only this project's GitHub token ---
+  if (creds.GITHUB_TOKEN) {
+    const hostsPath = join(base, ".config", "gh", "hosts.yml");
+    const hostsYaml =
+      `github.com:\n` +
+      `    oauth_token: ${creds.GITHUB_TOKEN}\n` +
+      `    git_protocol: https\n`;
+    writeFileSync(hostsPath, hostsYaml, { mode: 0o600 });
+  }
+
+  // --- git: scoped gitconfig with commit identity and a credential helper
+  //     that echoes this token for github.com HTTPS pushes. This bypasses
+  //     macOS Keychain, SSH keys, and the global git-credential-manager. ---
+  const helperPath = join(base, "gh-credential-helper.sh");
+  const helperScript = [
+    `#!/usr/bin/env bash`,
+    `# Per-session credential helper. Echoes the scoped GitHub token to git`,
+    `# so HTTPS pushes authenticate as this session's identity, regardless of`,
+    `# the user's global git-credential state.`,
+    `if [ "$1" = "get" ]; then`,
+    `  while IFS= read -r line; do [ -z "$line" ] && break; done`,
+    `  echo "username=x-access-token"`,
+    `  echo "password=${creds.GITHUB_TOKEN || ""}"`,
+    `fi`,
+    ``,
+  ].join("\n");
+  writeFileSync(helperPath, helperScript, { mode: 0o700 });
+
+  const gitconfig = [
+    `[user]`,
+    `\tname = ${gitQuote(commitIdentity.name || "AgentDesk")}`,
+    `\temail = ${gitQuote(commitIdentity.email || "agentdesk@local")}`,
+    ``,
+    `[credential "https://github.com"]`,
+    `\thelper = ${gitQuote(helperPath)}`,
+    ``,
+    // Stop the global credential helper (osxkeychain, gcm, libsecret) from
+    // being consulted. Our helper above is the only one.
+    `[credential]`,
+    `\thelper = `,
+    `\thelper = ${gitQuote(helperPath)}`,
+    ``,
+  ].join("\n");
+  writeFileSync(join(base, ".gitconfig"), gitconfig, { mode: 0o600 });
+
+  // --- Scoped env for the child process ---
+  const env = {
+    HOME: base,
+    XDG_CONFIG_HOME: join(base, ".config"),
+    GH_CONFIG_DIR: join(base, ".config", "gh"),
+
+    // Explicit GITHUB_TOKEN overrides gh's stored auth (which we've
+    // already replaced with our hosts.yml, but belt + suspenders).
+    GITHUB_TOKEN: creds.GITHUB_TOKEN || "",
+    GH_TOKEN: creds.GITHUB_TOKEN || "",
+
+    // Linear / Jira — only this project's credentials travel into the session.
+    LINEAR_API_KEY: creds.LINEAR_API_KEY || "",
+    JIRA_EMAIL: creds.JIRA_EMAIL || "",
+    JIRA_API_TOKEN: creds.JIRA_API_TOKEN || "",
+  };
+
+  // Drop empty-string entries so child processes don't see ambiguous empty vars.
+  for (const k of Object.keys(env)) if (env[k] === "") delete env[k];
+
+  let cleaned = false;
+  function cleanup() {
+    if (cleaned) return;
+    cleaned = true;
+    try { if (existsSync(base)) rmSync(base, { recursive: true, force: true }); } catch {}
+  }
+
+  // Best-effort cleanup if the parent process exits without an explicit call.
+  // Don't hijack SIGINT/SIGTERM — the daemon has its own signal handling and
+  // each session registering a process.exit() handler would kill the daemon
+  // as soon as one session saw a signal. /tmp is cleaned by the OS anyway.
+  process.once("exit", cleanup);
+
+  return { home: base, env, cleanup };
+}
+
+function safe(s) {
+  return String(s || "unknown").replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 40);
+}
+
+function gitQuote(s) {
+  // git config values: wrap in quotes if they contain whitespace or shell-sensitive chars.
+  if (/[\s"\\#;]/.test(s)) return `"${s.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+  return s;
+}

package/cli/team.mjs

@@ -210,6 +210,7 @@ export async function runTeam(taskId, opts = {}) {
   const result = await orchestrate({
     taskId, taskLink, description, createTask, tracker, config,
     project, team, teamSections, sessionUrl, cwd,
+    sessionId,
     onEvent: vizSend,
     apiKey,
     serverUrl: agentdeskServer,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kendoo.agentdesk/agentdesk",
-  "version": "0.16.3",
+  "version": "0.17.1",
   "description": "AI team orchestrator for Claude Code — run collaborative agent sessions from your terminal",
   "type": "module",
   "bin": {