@kendoo.agentdesk/agentdesk 0.18.6 → 0.19.0

package/CHANGELOG.md

@@ -8,6 +8,11 @@ All user-facing changes to AgentDesk. Each entry is tagged:
 
 Internal refactors, infrastructure changes, and architectural notes are not listed here.
 
+## [0.19.0] — 2026-04-18
+
+### Changed
+- `[CLI]` Session scoping rewritten: `HOME` is no longer redirected to a scratch directory. Instead, only the identity-sensitive surface is scoped via tool-specific env vars — `GH_CONFIG_DIR` for the gh CLI, `GIT_CONFIG_GLOBAL` + `GIT_AUTHOR_*` / `GIT_COMMITTER_*` for git, and per-project tracker tokens. Claude Code and other tools now find their own state (auth, cache, etc.) at the real `$HOME` where they expect it. The previous approach was too aggressive: it broke Claude Code's lookup of `~/.claude.json` and caused immediate session crashes. Kernel-level protection of sensitive paths (`~/.ssh`, `~/.aws`, `~/.config/gh`, etc.) is unchanged — the sandbox still denies reads/writes there.
+
 ## [0.18.6] — 2026-04-18
 
 ### Fixed

package/cli/session-sandbox.mjs

@@ -1,81 +1,53 @@
-// Per-session scratch HOME for identity isolation.
+// Per-session scoped identity.
 //
-// When a session runs, we point HOME / GH_CONFIG_DIR / XDG_CONFIG_HOME at a
-// private scratch directory containing only this project's git + gh config.
-// This means `gh`, `git`, `ssh` inside the session see only the identity we
-// put there — the user's global accounts, other projects' tokens, or keys
-// in the real $HOME aren't discovered by default lookups.
+// Goal: isolate the project's git/gh/tracker identity from the user's
+// global state, without breaking other tools that rely on finding their
+// own state in the real $HOME.
 //
-// This is Tier 1 (scoped-env). It prevents accidental cross-project use.
-// Tier 2 (sandbox-exec / bwrap) layers a kernel-enforced boundary on top.
+// Strategy: DO NOT redirect HOME (earlier versions did, and that broke
+// Claude Code's own ~/.claude.json lookup). Instead, set tool-specific
+// env vars that each tool's documentation says will override their
+// per-user config:
+//   - gh:    GH_CONFIG_DIR → scratch/.config/gh
+//   - git:   GIT_CONFIG_GLOBAL → scratch/.gitconfig
+//            GIT_AUTHOR_NAME / GIT_AUTHOR_EMAIL
+//            GIT_COMMITTER_NAME / GIT_COMMITTER_EMAIL
+//   - credentials: GITHUB_TOKEN, GH_TOKEN, LINEAR_API_KEY, JIRA_*
+//
+// The kernel sandbox (session-isolation.mjs) still applies a deny-list
+// to sensitive paths (~/.ssh, ~/.aws, ~/.config/gh, etc.) so a confused
+// agent can't read other projects' tokens even though HOME is the real
+// one.
 
-import { mkdirSync, writeFileSync, chmodSync, rmSync, existsSync, symlinkSync } from "fs";
+import { mkdirSync, writeFileSync, rmSync, existsSync } from "fs";
 import { join } from "path";
-import { tmpdir, homedir } from "os";
+import { tmpdir } from "os";
 import { randomUUID } from "crypto";
 
-// Tools whose own state must follow the user into a scratch HOME. Without
-// these symlinks the tool looks for its auth/config at <scratch>/... and
-// fails because we redirected HOME.
-//   ~/.claude.json       — Claude Code's auth/config file
-//   ~/.claude            — Claude Code's state dir (backups, caches)
-//   ~/.npm               — npm cache (agents run npm during sessions)
-//   ~/.cache             — generic XDG cache
-//   ~/.local             — generic XDG state
-// Works for both files and directories — symlinkSync handles both.
-const HOME_PASSTHROUGH = [
-  ".claude.json",
-  ".claude",
-  ".npm",
-  ".cache",
-  ".local",
-];
-
-// Build a session scratch HOME. Returns { home, env, cleanup }.
-//   projectId        — identifier used to make the dir path readable
-//   sessionId        — unique per session; guarantees parallel sessions don't collide
-//   creds            — { LINEAR_API_KEY?, JIRA_EMAIL?, JIRA_API_TOKEN?, GITHUB_TOKEN? }
-//   commitIdentity   — { name, email } for git user.* (falls back to sensible defaults)
-//
-// The caller spawns the Claude child with:
-//   { ...process.env, ...env }
-// …and MUST call cleanup() when the session ends (success, crash, signal).
 export function createScratchHome({ projectId, sessionId, creds = {}, commitIdentity = {} }) {
   const base = join(tmpdir(), "agentdesk-sessions", `${safe(projectId)}-${sessionId || randomUUID().slice(0, 8)}`);
-  mkdirSync(base, { recursive: true, mode: 0o700 });
-  mkdirSync(join(base, ".config"), { recursive: true, mode: 0o700 });
-  mkdirSync(join(base, ".config", "gh"), { recursive: true, mode: 0o700 });
-
-  // Symlink the user's real state dirs for tools that need their own auth/cache
-  // (Claude Code itself, npm, etc). Without this the tools look for their
-  // auth at <scratch>/... and fail because we redirected HOME.
-  const realHome = homedir();
-  for (const dir of HOME_PASSTHROUGH) {
-    const src = join(realHome, dir);
-    const dst = join(base, dir);
-    if (!existsSync(src)) continue;
-    try { symlinkSync(src, dst); } catch {}
-  }
+  const ghConfigDir = join(base, "gh");
+  mkdirSync(ghConfigDir, { recursive: true, mode: 0o700 });
 
-  // --- gh: scoped hosts.yml with only this project's GitHub token ---
+  // --- gh: a scoped hosts.yml overrides the user's ~/.config/gh/ when we
+  //     point GH_CONFIG_DIR at this dir. Only this project's token lives
+  //     here. Falls back to empty (no stored auth) if no token configured.
   if (creds.GITHUB_TOKEN) {
-    const hostsPath = join(base, ".config", "gh", "hosts.yml");
-    const hostsYaml =
-      `github.com:\n` +
-      `    oauth_token: ${creds.GITHUB_TOKEN}\n` +
-      `    git_protocol: https\n`;
-    writeFileSync(hostsPath, hostsYaml, { mode: 0o600 });
+    writeFileSync(
+      join(ghConfigDir, "hosts.yml"),
+      `github.com:\n    oauth_token: ${creds.GITHUB_TOKEN}\n    git_protocol: https\n`,
+      { mode: 0o600 }
+    );
   }
 
-  // --- git: scoped gitconfig with commit identity and a credential helper
-  //     that echoes this token for github.com HTTPS pushes. This bypasses
-  //     macOS Keychain, SSH keys, and the global git-credential-manager. ---
+  // --- git: a scoped gitconfig overrides the user's ~/.gitconfig when we
+  //     point GIT_CONFIG_GLOBAL at this file. The credential helper
+  //     script echoes the project's GITHUB_TOKEN for HTTPS pushes so
+  //     git push authenticates as this project's identity — not the
+  //     user's global SSH key or credential manager.
   const helperPath = join(base, "gh-credential-helper.sh");
   const helperScript = [
     `#!/usr/bin/env bash`,
-    `# Per-session credential helper. Echoes the scoped GitHub token to git`,
-    `# so HTTPS pushes authenticate as this session's identity, regardless of`,
-    `# the user's global git-credential state.`,
     `if [ "$1" = "get" ]; then`,
     `  while IFS= read -r line; do [ -z "$line" ] && break; done`,
     `  echo "username=x-access-token"`,
@@ -85,6 +57,7 @@ export function createScratchHome({ projectId, sessionId, creds = {}, commitIden
   ].join("\n");
   writeFileSync(helperPath, helperScript, { mode: 0o700 });
 
+  const gitconfigPath = join(base, "gitconfig");
   const gitconfig = [
     `[user]`,
     `\tname = ${gitQuote(commitIdentity.name || "AgentDesk")}`,
@@ -92,34 +65,39 @@ export function createScratchHome({ projectId, sessionId, creds = {}, commitIden
     ``,
     `[credential "https://github.com"]`,
     `\thelper = ${gitQuote(helperPath)}`,
-    ``,
-    // Stop the global credential helper (osxkeychain, gcm, libsecret) from
-    // being consulted. Our helper above is the only one.
     `[credential]`,
     `\thelper = `,
     `\thelper = ${gitQuote(helperPath)}`,
     ``,
   ].join("\n");
-  writeFileSync(join(base, ".gitconfig"), gitconfig, { mode: 0o600 });
+  writeFileSync(gitconfigPath, gitconfig, { mode: 0o600 });
 
-  // --- Scoped env for the child process ---
+  // --- Scoped env for the child. HOME stays the user's real HOME — Claude
+  //     Code and other tools find their own state. Only the identity-
+  //     sensitive surface is redirected.
   const env = {
-    HOME: base,
-    XDG_CONFIG_HOME: join(base, ".config"),
-    GH_CONFIG_DIR: join(base, ".config", "gh"),
-
-    // Explicit GITHUB_TOKEN overrides gh's stored auth (which we've
-    // already replaced with our hosts.yml, but belt + suspenders).
+    // gh: uses GH_CONFIG_DIR for its own config. Writing hosts.yml there
+    // with our token means `gh auth` operations hit this project's account.
+    GH_CONFIG_DIR: ghConfigDir,
+    // git: GIT_CONFIG_GLOBAL overrides ~/.gitconfig for this process tree
+    // (git 2.32+). Our gitconfig sets user.name/email and a credential
+    // helper that only knows this project's token.
+    GIT_CONFIG_GLOBAL: gitconfigPath,
+    // Belt-and-braces commit identity — overrides even if git ignores
+    // GIT_CONFIG_GLOBAL for any reason.
+    GIT_AUTHOR_NAME: commitIdentity.name || "AgentDesk",
+    GIT_AUTHOR_EMAIL: commitIdentity.email || "agentdesk@local",
+    GIT_COMMITTER_NAME: commitIdentity.name || "AgentDesk",
+    GIT_COMMITTER_EMAIL: commitIdentity.email || "agentdesk@local",
+    // Explicit GITHUB_TOKEN/GH_TOKEN overrides gh's stored auth (which
+    // we've already replaced anyway, but belt + suspenders).
     GITHUB_TOKEN: creds.GITHUB_TOKEN || "",
     GH_TOKEN: creds.GITHUB_TOKEN || "",
-
-    // Linear / Jira — only this project's credentials travel into the session.
+    // Tracker-specific env — only this project's credentials reach the agent.
     LINEAR_API_KEY: creds.LINEAR_API_KEY || "",
     JIRA_EMAIL: creds.JIRA_EMAIL || "",
     JIRA_API_TOKEN: creds.JIRA_API_TOKEN || "",
   };
-
-  // Drop empty-string entries so child processes don't see ambiguous empty vars.
   for (const k of Object.keys(env)) if (env[k] === "") delete env[k];
 
   let cleaned = false;
@@ -128,11 +106,6 @@ export function createScratchHome({ projectId, sessionId, creds = {}, commitIden
     cleaned = true;
     try { if (existsSync(base)) rmSync(base, { recursive: true, force: true }); } catch {}
   }
-
-  // Best-effort cleanup if the parent process exits without an explicit call.
-  // Don't hijack SIGINT/SIGTERM — the daemon has its own signal handling and
-  // each session registering a process.exit() handler would kill the daemon
-  // as soon as one session saw a signal. /tmp is cleaned by the OS anyway.
   process.once("exit", cleanup);
 
   return { home: base, env, cleanup };
@@ -143,7 +116,6 @@ function safe(s) {
 }
 
 function gitQuote(s) {
-  // git config values: wrap in quotes if they contain whitespace or shell-sensitive chars.
   if (/[\s"\\#;]/.test(s)) return `"${s.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
   return s;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kendoo.agentdesk/agentdesk",
-  "version": "0.18.6",
+  "version": "0.19.0",
   "description": "AI team orchestrator for Claude Code — run collaborative agent sessions from your terminal",
   "type": "module",
   "bin": {