@kendoo.agentdesk/agentdesk 0.22.0 → 0.23.0

package/CHANGELOG.md

@@ -13,6 +13,9 @@ Internal refactors, infrastructure changes, and architectural notes are not list
 ### Added
 - `[UI]` Private-session sharing flow. When someone visits a session URL they don't own, they now see a friendly "Shh… this one's private" page with a one-click "Request access" button instead of a blank error. The session owner sees pending requests in a new header inbox and can grant viewer access for just that session or the whole project. Viewer-granted sessions show up in the teammate's sidebar tagged as a viewer.
 
+### Changed
+- `[Both]` Security improvements and hardening. No action required.
+
 ## [0.22.0] — 2026-05-23
 
 ### Changed

package/README.md

@@ -272,7 +272,9 @@ Once running, a "Run Team" button appears on [agentdesk.live](https://agentdesk.
 ### Security
 
 - **Per-session identity isolation** — every session runs with `HOME` / `GH_CONFIG_DIR` / `XDG_CONFIG_HOME` pointed at a private scratch dir containing only this project's tracker credentials and commit identity. `gh`, `git`, and `ssh` inside the session cannot see your global accounts, other projects' tokens, or keys elsewhere on disk.
-- **Kernel-enforced sandbox when available** — on macOS (`sandbox-exec`) and Linux (`bwrap` / bubblewrap), sessions run with writes restricted to the project dir + scratch home + `/tmp`, and reads denied on known credential locations (`~/.ssh`, `~/.aws`, `~/.config/gh`, `~/.gitconfig`, `~/.netrc`, etc.). If the tool isn't available, sessions fall back to scoped-env isolation with a one-line notice. Opt out for debugging with `AGENTDESK_NO_SANDBOX=1`.
+- **Kernel-enforced sandbox when available** — on macOS (`sandbox-exec`) and Linux (`bwrap` / bubblewrap), sessions run with a strict allowlist policy: full read/write on the project cwd, the per-session scratch HOME, `/tmp`, and common tool caches (`~/.nvm`, `~/.npm`, `~/.cache`, `~/.pyenv`, `~/.rbenv`, `~/.rvm`, `~/.cargo`, `~/.rustup`, `~/.gem`, `~/.local`). Read-only on system paths (`/usr`, `/etc`, `/System`, etc.). **Everything else under your real `$HOME` is unreadable from inside the session** — `~/Documents`, browser cookie stores, other projects' `.env` files, SSH keys, cloud-provider creds. Network stays open so agents can reach the Anthropic API, tracker APIs, package registries, and remote git. If `sandbox-exec` / `bwrap` isn't installed, sessions fall back to scoped-env isolation with a one-line notice.
+  - Opt out for debugging: `AGENTDESK_NO_SANDBOX=1` (no kernel sandbox at all).
+  - If the strict allowlist breaks a tool you need, fall back to the pre-allowlist denylist policy with `AGENTDESK_SANDBOX_LEGACY=1` and please file an issue so we can extend the allowlist.
 - **Credentials prerequisite** — scoped sessions push code over HTTPS using a per-project GitHub token. `agentdesk init` saves it to the project's `.env` as `GITHUB_TOKEN`; if you skip that step, the session refuses to start with an actionable message. SSH-only remotes (`git@github.com:...`) are also rejected — the sandbox intentionally isolates `~/.ssh`. Switch the origin to `https://github.com/<owner>/<repo>.git` or run without scoped isolation.
 - **Outbound only** — no ports opened on your machine
 - **Project allowlist** — only runs on projects registered via `agentdesk init`

package/cli/session-isolation.mjs

@@ -5,12 +5,21 @@
 //   - macOS: `sandbox-exec` (TrustedBSD sandbox, same primitive App Sandbox uses)
 //   - Linux: `bwrap` (bubblewrap — mount namespaces, same primitive Docker uses)
 //
-// Failure mode: if the tool isn't present or the profile can't be written,
-// we emit a one-line notice and spawn the child as normal. The scoped HOME
-// from Phase E still applies — isolation just degrades from "kernel boundary"
-// to "scoped env."
+// AD-30: the policy is an ALLOWLIST — deny by default, then re-expose only what
+// legitimate tools need (project cwd, scratchHome, system binaries/libraries,
+// tool caches like ~/.nvm and ~/.npm). The previous denylist of ~12 known
+// credential paths left every other ~/Documents, browser cookie store, and
+// other-project .env readable to a prompt-injected agent.
 //
-// Escape hatch: AGENTDESK_NO_SANDBOX=1 skips this layer entirely.
+// Escape hatches:
+//   - AGENTDESK_NO_SANDBOX=1     — skip kernel isolation entirely (scoped HOME still applies)
+//   - AGENTDESK_SANDBOX_LEGACY=1 — revert to the pre-AD-30 denylist (use only if strict
+//                                 policy breaks a tool you need; report so we can extend)
+//
+// Failure mode: if sandbox-exec / bwrap isn't installed or the profile can't
+// be written, we emit a one-line notice and spawn the child as normal. The
+// scoped HOME from session-sandbox.mjs still applies — isolation degrades to
+// "scoped env" rather than "kernel boundary."
 
 import { execSync } from "child_process";
 import { existsSync, writeFileSync } from "fs";
@@ -49,6 +58,10 @@ export function probeIsolation() {
   return cachedProbe;
 }
 
+function legacyMode() {
+  return process.env.AGENTDESK_SANDBOX_LEGACY === "1";
+}
+
 // Build the spawn arguments for an isolated claude invocation. Takes the
 // original command/args/options and returns the wrapped form, plus a flag
 // indicating which isolation mode is active.
@@ -58,39 +71,129 @@ export function wrapIsolatedSpawn({ cmd, args, cwd, scratchHome, sessionId }) {
     return { cmd, args, isolation: { kind: "none", reason: probe.reason } };
   }
 
+  const policyKind = legacyMode() ? "legacy" : "strict";
+
   if (probe.kind === "sandbox-exec") {
     const profilePath = join(scratchHome, "sandbox.sb");
-    writeFileSync(profilePath, macosProfile({ cwd, scratchHome }), { mode: 0o600 });
+    const profile = policyKind === "legacy"
+      ? macosProfileLegacy({ cwd, scratchHome })
+      : macosProfileStrict({ cwd, scratchHome });
+    writeFileSync(profilePath, profile, { mode: 0o600 });
     return {
       cmd: "sandbox-exec",
       args: ["-f", profilePath, cmd, ...args],
-      isolation: { kind: "sandbox-exec" },
+      isolation: { kind: "sandbox-exec", policy: policyKind },
     };
   }
 
   if (probe.kind === "bwrap") {
+    const bwrap = policyKind === "legacy"
+      ? bwrapArgsLegacy({ cwd, scratchHome })
+      : bwrapArgsStrict({ cwd, scratchHome });
     return {
       cmd: "bwrap",
-      args: [...bwrapArgs({ cwd, scratchHome }), cmd, ...args],
-      isolation: { kind: "bwrap" },
+      args: [...bwrap, cmd, ...args],
+      isolation: { kind: "bwrap", policy: policyKind },
     };
   }
 
   return { cmd, args, isolation: { kind: "none", reason: "unknown probe kind" } };
 }
 
-// --- macOS sandbox-exec profile ---------------------------------------------
+// --- macOS profiles ----------------------------------------------------------
+
+function sbString(s) {
+  return `"${String(s).replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+
+// AD-30 strict allowlist. Start with deny-default, then re-expose only the
+// paths and capabilities legitimate tools need. Anything under $HOME that
+// isn't explicitly allowed is unreadable — that includes ~/Documents,
+// browser cookie stores, other projects' .env files, etc.
+function macosProfileStrict({ cwd, scratchHome }) {
+  const home = homedir();
+
+  // Tool installations and caches users typically need read access to. If a
+  // path doesn't exist we still list it — sandbox-exec ignores missing paths.
+  const userToolPaths = [
+    join(home, ".nvm"),
+    join(home, ".npm"),
+    join(home, ".cache"),
+    join(home, ".pyenv"),
+    join(home, ".rbenv"),
+    join(home, ".rvm"),
+    join(home, ".cargo"),
+    join(home, ".rustup"),
+    join(home, ".gem"),
+    join(home, ".local"),
+    join(home, "Library", "Caches"),
+  ];
+
+  return [
+    `(version 1)`,
+    `(deny default)`,
+    ``,
+    `; Process, IPC, signals, and basic mach lookups so child tools can exec.`,
+    `(allow process-exec)`,
+    `(allow process-fork)`,
+    `(allow signal)`,
+    `(allow mach-lookup)`,
+    `(allow sysctl-read)`,
+    `(allow iokit-open)`,
+    `(allow system-socket)`,
+    ``,
+    `; Network — agents need to reach the Anthropic API, tracker APIs, package`,
+    `; registries, and remote git over HTTPS/SSH.`,
+    `(allow network*)`,
+    ``,
+    `; Project cwd + scratch HOME — full read/write.`,
+    `(allow file-read* file-write* (subpath ${sbString(cwd)}))`,
+    `(allow file-read* file-write* (subpath ${sbString(scratchHome)}))`,
+    ``,
+    `; System binaries and libraries — read-only.`,
+    `(allow file-read* (subpath "/usr"))`,
+    `(allow file-read* (subpath "/bin"))`,
+    `(allow file-read* (subpath "/sbin"))`,
+    `(allow file-read* (subpath "/System"))`,
+    `(allow file-read* (subpath "/Library"))`,
+    `(allow file-read* (subpath "/Applications"))`,
+    `(allow file-read* (subpath "/opt"))`,
+    `(allow file-read* (subpath "/private/etc"))`,
+    `(allow file-read* (subpath "/private/var/db/timezone"))`,
+    ``,
+    `; Standard devices.`,
+    `(allow file-read* file-write* (literal "/dev/null"))`,
+    `(allow file-read* (literal "/dev/random"))`,
+    `(allow file-read* (literal "/dev/urandom"))`,
+    `(allow file-read* file-write* (literal "/dev/tty"))`,
+    `(allow file-read* file-write* (literal "/dev/stdin"))`,
+    `(allow file-read* file-write* (literal "/dev/stdout"))`,
+    `(allow file-read* file-write* (literal "/dev/stderr"))`,
+    ``,
+    `; Temp space — child tools and package managers stage here.`,
+    `(allow file-read* file-write* (subpath "/tmp"))`,
+    `(allow file-read* file-write* (subpath "/private/tmp"))`,
+    `(allow file-read* file-write* (subpath "/private/var/folders"))`,
+    ``,
+    `; Tool installations and caches the user already has in $HOME — read+write`,
+    `; because package managers and version managers update their own caches.`,
+    `; NOTE: only these specific subpaths are exposed; the rest of $HOME stays`,
+    `; denied, so ~/Documents, ~/.ssh, ~/.aws, browser cookies, etc. are NOT`,
+    `; readable from inside the sandbox.`,
+    ...userToolPaths.map(p => `(allow file-read* file-write* (subpath ${sbString(p)}))`),
+    ``,
+  ].join("\n");
+}
 
-function macosProfile({ cwd, scratchHome }) {
+// Pre-AD-30 denylist — kept as opt-in fallback via AGENTDESK_SANDBOX_LEGACY=1
+// in case the strict policy breaks a tool we haven't accounted for.
+function macosProfileLegacy({ cwd, scratchHome }) {
   const home = homedir();
-  // Known-sensitive paths: reads AND writes denied, even though general
-  // access is allowed, so a confused agent can't slurp up other projects'
-  // tokens or clobber the user's SSH keys / shell config.
   const denyPathsSubpath = [
     join(home, ".ssh"),
     join(home, ".aws"),
     join(home, ".gcloud"),
-    join(home, ".config", "gh"),         // real gh config (scratch is under $TMPDIR)
+    join(home, ".config", "gh"),
     join(home, ".docker"),
     join(home, ".kube"),
     join(home, ".agentdesk"),
@@ -98,7 +201,7 @@ function macosProfile({ cwd, scratchHome }) {
   ];
   const denyPathsLiteral = [
     join(home, ".netrc"),
-    join(home, ".gitconfig"),            // real gitconfig (scratch has its own)
+    join(home, ".gitconfig"),
     join(home, ".npmrc"),
     join(home, ".pypirc"),
     join(home, ".zshrc"),
@@ -108,32 +211,73 @@ function macosProfile({ cwd, scratchHome }) {
     join(home, ".profile"),
   ];
 
-  const sb = [
+  return [
     `(version 1)`,
     `(allow default)`,
     ``,
-    `; Deny access (read + write) to known credential and shell-config paths.`,
-    `; Agents can't read other projects' tokens, can't overwrite SSH keys or`,
-    `; rewrite the user's shell rc files.`,
+    `; LEGACY denylist (pre-AD-30). Set AGENTDESK_SANDBOX_LEGACY=1 to use.`,
     ...denyPathsSubpath.map(p => `(deny file-read* file-write* (subpath ${sbString(p)}))`),
     ...denyPathsLiteral.map(p => `(deny file-read* file-write* (literal ${sbString(p)}))`),
     ``,
   ].join("\n");
-
-  return sb;
-}
-
-function sbString(s) {
-  return `"${String(s).replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
 }
 
 // --- Linux bwrap args --------------------------------------------------------
 
-function bwrapArgs({ cwd, scratchHome }) {
-  // Bind the whole filesystem normally so tools that need to write state
-  // (claude, npm, pip, yarn, etc.) keep working. Then cover the sensitive
-  // credential/config paths with tmpfs mounts so the agent can't read or
-  // write them — other projects' .env, SSH keys, shell rc files, etc.
+// AD-30 strict allowlist via bwrap. Read-only binds for system paths, --tmpfs
+// over $HOME so nothing on the user's home directory is visible by default,
+// then re-expose specific tool dirs that exist as read-only binds.
+function bwrapArgsStrict({ cwd, scratchHome }) {
+  const home = homedir();
+  const args = [
+    "--die-with-parent",
+    "--unshare-ipc",
+    "--unshare-uts",
+    "--unshare-pid",
+    "--proc", "/proc",
+    "--dev", "/dev",
+    // System: read-only.
+    "--ro-bind", "/usr", "/usr",
+    "--ro-bind", "/etc", "/etc",
+    "--ro-bind-try", "/lib", "/lib",
+    "--ro-bind-try", "/lib64", "/lib64",
+    "--ro-bind-try", "/lib32", "/lib32",
+    "--ro-bind-try", "/bin", "/bin",
+    "--ro-bind-try", "/sbin", "/sbin",
+    "--ro-bind-try", "/opt", "/opt",
+    // tmp: writable.
+    "--bind", "/tmp", "/tmp",
+    // Blank the real home; re-expose specific tool dirs below.
+    "--tmpfs", home,
+    // Project cwd + scratch HOME: writable.
+    "--bind", cwd, cwd,
+    "--bind", scratchHome, scratchHome,
+    // Network is intentionally NOT unshared — agents need tracker APIs and git.
+  ];
+
+  // Tool dirs the user typically has in $HOME — re-expose only if present.
+  // `--ro-bind-try` is a no-op if the source path doesn't exist.
+  const userToolPaths = [
+    join(home, ".nvm"),
+    join(home, ".npm"),
+    join(home, ".cache"),
+    join(home, ".pyenv"),
+    join(home, ".rbenv"),
+    join(home, ".rvm"),
+    join(home, ".cargo"),
+    join(home, ".rustup"),
+    join(home, ".gem"),
+    join(home, ".local"),
+  ];
+  for (const p of userToolPaths) {
+    args.push("--ro-bind-try", p, p);
+  }
+
+  return args;
+}
+
+// Pre-AD-30 denylist via bwrap (--bind / / + tmpfs over deny paths).
+function bwrapArgsLegacy({ cwd, scratchHome }) {
   const home = homedir();
   const denyPaths = [
     join(home, ".ssh"),
@@ -162,10 +306,7 @@ function bwrapArgs({ cwd, scratchHome }) {
     "--unshare-ipc",
     "--unshare-uts",
     "--unshare-pid",
-    // Network is NOT unshared — agents need network for tracker APIs and git.
   ];
   for (const p of denyPaths) args.push("--tmpfs", p);
-  // scratch HOME + project dir stay writable (already bound via --bind / /
-  // above — tmpfs blanks only the specific deny paths, not the rest).
   return args;
 }

package/cli/tracker-check.mjs

@@ -1,7 +1,12 @@
 // Verify tracker API permissions before starting a session
 // Checks: read tasks, create tasks, update tasks
 
-import { execSync } from "child_process";
+import { execFileSync } from "child_process";
+
+// AD-29: any external string (repo name, ref, etc.) must be regex-validated
+// before it goes into a child process. Even with execFile, an upstream caller
+// passing "../../etc" or similar can trip path semantics in the called tool.
+const GITHUB_REPO_RE = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
 
 const LINEAR_API = "https://api.linear.app/graphql";
 
@@ -187,18 +192,25 @@ async function checkGitHub({ repo }, creds) {
   const env = { ...process.env };
   if (creds?.GITHUB_TOKEN) env.GH_TOKEN = creds.GITHUB_TOKEN;
 
-  // Check if gh CLI is available
+  // AD-29: refuse anything that isn't a clean owner/repo before going near a
+  // subprocess. `repo` comes from server-pushed project settings, which an
+  // attacker could control via a chained takeover.
+  if (!GITHUB_REPO_RE.test(repo)) {
+    return { ok: false, errors: [`Invalid GitHub repo format: ${JSON.stringify(repo)} (expected "owner/name")`] };
+  }
+
+  // Check if gh CLI is available. execFileSync (no shell) — argv is static.
   try {
-    execSync("gh --version", { stdio: "pipe" });
+    execFileSync("gh", ["--version"], { stdio: "pipe" });
   } catch {
     return { ok: false, errors: ["GitHub CLI (gh) is not installed — install it from https://cli.github.com"] };
   }
 
   // Check auth status and grab the authenticated login
   try {
-    execSync("gh auth status", { stdio: "pipe", env });
+    execFileSync("gh", ["auth", "status"], { stdio: "pipe", env });
     try {
-      const who = execSync(`gh api user --jq '{login: .login, name: .name}'`, { stdio: "pipe", encoding: "utf-8", env }).trim();
+      const who = execFileSync("gh", ["api", "user", "--jq", "{login: .login, name: .name}"], { stdio: "pipe", encoding: "utf-8", env }).trim();
       const j = JSON.parse(who);
       identity = { name: j.name || j.login, login: j.login };
     } catch {}
@@ -206,9 +218,9 @@ async function checkGitHub({ repo }, creds) {
     return { ok: false, errors: ["GitHub CLI is not authenticated — run 'gh auth login', or paste a GITHUB_TOKEN"] };
   }
 
-  // Check repo access and permissions
+  // Check repo access and permissions — argv form, no shell, repo already validated.
   try {
-    const result = execSync(`gh api repos/${repo} --jq ".permissions"`, { stdio: "pipe", encoding: "utf-8", env });
+    const result = execFileSync("gh", ["api", `repos/${repo}`, "--jq", ".permissions"], { stdio: "pipe", encoding: "utf-8", env });
     const perms = JSON.parse(result.trim());
 
     if (!perms.pull) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kendoo.agentdesk/agentdesk",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "description": "AI team orchestrator for Claude Code — run collaborative agent sessions from your terminal",
   "type": "module",
   "bin": {
@@ -22,7 +22,7 @@
     "server": "node server/index.mjs",
     "build": "vite build",
     "preview": "vite preview",
-    "test": "node --test tests/server.test.mjs tests/agents.test.mjs tests/homepage.test.mjs tests/sessionUtils.test.mjs tests/tracker-url.test.mjs tests/session-preflight.test.mjs tests/access.test.mjs",
+    "test": "node --test tests/server.test.mjs tests/agents.test.mjs tests/homepage.test.mjs tests/sessionUtils.test.mjs tests/tracker-url.test.mjs tests/session-preflight.test.mjs tests/access.test.mjs tests/project-ownership.test.mjs tests/random-hex.test.mjs",
     "lint:changelog": "node scripts/lint-changelog.mjs",
     "prepublishOnly": "node scripts/lint-changelog.mjs"
   },