@kendoo.agentdesk/agentdesk 0.18.3 → 0.18.4

package/CHANGELOG.md

@@ -8,6 +8,11 @@ All user-facing changes to AgentDesk. Each entry is tagged:
 
 Internal refactors, infrastructure changes, and architectural notes are not listed here.
 
+## [0.18.4] — 2026-04-18
+
+### Fixed
+- `[CLI]` Sandbox was too strict: the "deny all writes except project+scratch+tmp" rule blocked Claude and other tools from writing to their own state directories (`~/.claude`, `~/.npm`, etc.), causing sessions to crash in under 3 seconds with a misleading "hit rate/context limit" handoff. The sandbox now allows reads and writes by default and denies a specific list of sensitive paths (`~/.ssh`, `~/.aws`, `~/.gcloud`, `~/.config/gh`, `~/.docker`, `~/.kube`, `~/.agentdesk`, `~/.gitconfig`, `~/.netrc`, `~/.npmrc`, `~/.pypirc`, shell rc files). Identity-isolation goal preserved; compatibility restored.
+
 ## [0.18.3] — 2026-04-18
 
 ### Fixed

package/cli/session-isolation.mjs

@@ -83,10 +83,10 @@ export function wrapIsolatedSpawn({ cmd, args, cwd, scratchHome, sessionId }) {
 
 function macosProfile({ cwd, scratchHome }) {
   const home = homedir();
-  // Known-sensitive user paths where credentials typically live. Reads denied
-  // even though general reads are allowed, so a confused agent can't slurp
-  // up other projects' tokens or the user's SSH keys.
-  const denyReadPaths = [
+  // Known-sensitive paths: reads AND writes denied, even though general
+  // access is allowed, so a confused agent can't slurp up other projects'
+  // tokens or clobber the user's SSH keys / shell config.
+  const denyPathsSubpath = [
     join(home, ".ssh"),
     join(home, ".aws"),
     join(home, ".gcloud"),
@@ -96,36 +96,27 @@ function macosProfile({ cwd, scratchHome }) {
     join(home, ".agentdesk"),
     join(home, ".config", "agentdesk"),
   ];
-  const denyReadLiterals = [
+  const denyPathsLiteral = [
     join(home, ".netrc"),
     join(home, ".gitconfig"),            // real gitconfig (scratch has its own)
     join(home, ".npmrc"),
     join(home, ".pypirc"),
-  ];
-
-  // Writes allowed only here. Everywhere else: read-only by default.
-  const writeSubpaths = [
-    cwd,
-    scratchHome,
-    "/tmp",
-    "/private/tmp",
-    "/private/var/folders",              // macOS TMPDIR lives here
+    join(home, ".zshrc"),
+    join(home, ".zprofile"),
+    join(home, ".bashrc"),
+    join(home, ".bash_profile"),
+    join(home, ".profile"),
   ];
 
   const sb = [
     `(version 1)`,
     `(allow default)`,
     ``,
-    `; Deny reads to known credential locations`,
-    ...denyReadPaths.map(p => `(deny file-read* (subpath ${sbString(p)}))`),
-    ...denyReadLiterals.map(p => `(deny file-read* (literal ${sbString(p)}))`),
-    ``,
-    `; Writes: deny everywhere, then allow the project dir + scratch + tmp`,
-    `(deny file-write*)`,
-    ...writeSubpaths.map(p => `(allow file-write* (subpath ${sbString(p)}))`),
-    ``,
-    `; Allow writes to devices so stdio, /dev/null, tty, ptys all work`,
-    `(allow file-write* (subpath "/dev"))`,
+    `; Deny access (read + write) to known credential and shell-config paths.`,
+    `; Agents can't read other projects' tokens, can't overwrite SSH keys or`,
+    `; rewrite the user's shell rc files.`,
+    ...denyPathsSubpath.map(p => `(deny file-read* file-write* (subpath ${sbString(p)}))`),
+    ...denyPathsLiteral.map(p => `(deny file-read* file-write* (literal ${sbString(p)}))`),
     ``,
   ].join("\n");
 
@@ -139,22 +130,42 @@ function sbString(s) {
 // --- Linux bwrap args --------------------------------------------------------
 
 function bwrapArgs({ cwd, scratchHome }) {
-  // Everything read-only by default via ro-bind of /. Writable exceptions:
-  // the project dir, the scratch HOME, and a private /tmp. /home/<user> is
-  // replaced with a tmpfs so the agent can't browse the real home dir.
+  // Bind the whole filesystem normally so tools that need to write state
+  // (claude, npm, pip, yarn, etc.) keep working. Then cover the sensitive
+  // credential/config paths with tmpfs mounts so the agent can't read or
+  // write them — other projects' .env, SSH keys, shell rc files, etc.
   const home = homedir();
-  return [
-    "--ro-bind", "/", "/",
+  const denyPaths = [
+    join(home, ".ssh"),
+    join(home, ".aws"),
+    join(home, ".gcloud"),
+    join(home, ".config", "gh"),
+    join(home, ".docker"),
+    join(home, ".kube"),
+    join(home, ".agentdesk"),
+    join(home, ".config", "agentdesk"),
+    join(home, ".netrc"),
+    join(home, ".gitconfig"),
+    join(home, ".npmrc"),
+    join(home, ".pypirc"),
+    join(home, ".zshrc"),
+    join(home, ".zprofile"),
+    join(home, ".bashrc"),
+    join(home, ".bash_profile"),
+    join(home, ".profile"),
+  ];
+  const args = [
+    "--bind", "/", "/",
     "--dev-bind", "/dev", "/dev",
     "--proc", "/proc",
-    "--tmpfs", "/tmp",
-    "--tmpfs", home,                     // blank user home
-    "--bind", cwd, cwd,                  // project dir writable
-    "--bind", scratchHome, scratchHome,  // scratch writable (HOME env var points here)
     "--die-with-parent",
     "--unshare-ipc",
     "--unshare-uts",
     "--unshare-pid",
     // Network is NOT unshared — agents need network for tracker APIs and git.
   ];
+  for (const p of denyPaths) args.push("--tmpfs", p);
+  // scratch HOME + project dir stay writable (already bound via --bind / /
+  // above — tmpfs blanks only the specific deny paths, not the rest).
+  return args;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kendoo.agentdesk/agentdesk",
-  "version": "0.18.3",
+  "version": "0.18.4",
   "description": "AI team orchestrator for Claude Code — run collaborative agent sessions from your terminal",
   "type": "module",
   "bin": {