@kendoo.agentdesk/agentdesk 0.22.1 → 0.23.0

package/README.md

@@ -272,7 +272,9 @@ Once running, a "Run Team" button appears on [agentdesk.live](https://agentdesk.
 ### Security
 
 - **Per-session identity isolation** — every session runs with `HOME` / `GH_CONFIG_DIR` / `XDG_CONFIG_HOME` pointed at a private scratch dir containing only this project's tracker credentials and commit identity. `gh`, `git`, and `ssh` inside the session cannot see your global accounts, other projects' tokens, or keys elsewhere on disk.
-- **Kernel-enforced sandbox when available** — on macOS (`sandbox-exec`) and Linux (`bwrap` / bubblewrap), sessions run with writes restricted to the project dir + scratch home + `/tmp`, and reads denied on known credential locations (`~/.ssh`, `~/.aws`, `~/.config/gh`, `~/.gitconfig`, `~/.netrc`, etc.). If the tool isn't available, sessions fall back to scoped-env isolation with a one-line notice. Opt out for debugging with `AGENTDESK_NO_SANDBOX=1`.
+- **Kernel-enforced sandbox when available** — on macOS (`sandbox-exec`) and Linux (`bwrap` / bubblewrap), sessions run with a strict allowlist policy: full read/write on the project cwd, the per-session scratch HOME, `/tmp`, and common tool caches (`~/.nvm`, `~/.npm`, `~/.cache`, `~/.pyenv`, `~/.rbenv`, `~/.rvm`, `~/.cargo`, `~/.rustup`, `~/.gem`, `~/.local`). Read-only on system paths (`/usr`, `/etc`, `/System`, etc.). **Everything else under your real `$HOME` is unreadable from inside the session** — `~/Documents`, browser cookie stores, other projects' `.env` files, SSH keys, cloud-provider creds. Network stays open so agents can reach the Anthropic API, tracker APIs, package registries, and remote git. If `sandbox-exec` / `bwrap` isn't installed, sessions fall back to scoped-env isolation with a one-line notice.
+  - Opt out for debugging: `AGENTDESK_NO_SANDBOX=1` (no kernel sandbox at all).
+  - If the strict allowlist breaks a tool you need, fall back to the pre-allowlist denylist policy with `AGENTDESK_SANDBOX_LEGACY=1` and please file an issue so we can extend the allowlist.
 - **Credentials prerequisite** — scoped sessions push code over HTTPS using a per-project GitHub token. `agentdesk init` saves it to the project's `.env` as `GITHUB_TOKEN`; if you skip that step, the session refuses to start with an actionable message. SSH-only remotes (`git@github.com:...`) are also rejected — the sandbox intentionally isolates `~/.ssh`. Switch the origin to `https://github.com/<owner>/<repo>.git` or run without scoped isolation.
 - **Outbound only** — no ports opened on your machine
 - **Project allowlist** — only runs on projects registered via `agentdesk init`

package/cli/session-isolation.mjs

@@ -5,12 +5,21 @@
 //   - macOS: `sandbox-exec` (TrustedBSD sandbox, same primitive App Sandbox uses)
 //   - Linux: `bwrap` (bubblewrap — mount namespaces, same primitive Docker uses)
 //
-// Failure mode: if the tool isn't present or the profile can't be written,
-// we emit a one-line notice and spawn the child as normal. The scoped HOME
-// from Phase E still applies — isolation just degrades from "kernel boundary"
-// to "scoped env."
+// AD-30: the policy is an ALLOWLIST — deny by default, then re-expose only what
+// legitimate tools need (project cwd, scratchHome, system binaries/libraries,
+// tool caches like ~/.nvm and ~/.npm). The previous denylist of ~12 known
+// credential paths left every other ~/Documents, browser cookie store, and
+// other-project .env readable to a prompt-injected agent.
 //
-// Escape hatch: AGENTDESK_NO_SANDBOX=1 skips this layer entirely.
+// Escape hatches:
+//   - AGENTDESK_NO_SANDBOX=1     — skip kernel isolation entirely (scoped HOME still applies)
+//   - AGENTDESK_SANDBOX_LEGACY=1 — revert to the pre-AD-30 denylist (use only if strict
+//                                 policy breaks a tool you need; report so we can extend)
+//
+// Failure mode: if sandbox-exec / bwrap isn't installed or the profile can't
+// be written, we emit a one-line notice and spawn the child as normal. The
+// scoped HOME from session-sandbox.mjs still applies — isolation degrades to
+// "scoped env" rather than "kernel boundary."
 
 import { execSync } from "child_process";
 import { existsSync, writeFileSync } from "fs";
@@ -49,6 +58,10 @@ export function probeIsolation() {
   return cachedProbe;
 }
 
+function legacyMode() {
+  return process.env.AGENTDESK_SANDBOX_LEGACY === "1";
+}
+
 // Build the spawn arguments for an isolated claude invocation. Takes the
 // original command/args/options and returns the wrapped form, plus a flag
 // indicating which isolation mode is active.
@@ -58,39 +71,129 @@ export function wrapIsolatedSpawn({ cmd, args, cwd, scratchHome, sessionId }) {
     return { cmd, args, isolation: { kind: "none", reason: probe.reason } };
   }
 
+  const policyKind = legacyMode() ? "legacy" : "strict";
+
   if (probe.kind === "sandbox-exec") {
     const profilePath = join(scratchHome, "sandbox.sb");
-    writeFileSync(profilePath, macosProfile({ cwd, scratchHome }), { mode: 0o600 });
+    const profile = policyKind === "legacy"
+      ? macosProfileLegacy({ cwd, scratchHome })
+      : macosProfileStrict({ cwd, scratchHome });
+    writeFileSync(profilePath, profile, { mode: 0o600 });
     return {
       cmd: "sandbox-exec",
       args: ["-f", profilePath, cmd, ...args],
-      isolation: { kind: "sandbox-exec" },
+      isolation: { kind: "sandbox-exec", policy: policyKind },
     };
   }
 
   if (probe.kind === "bwrap") {
+    const bwrap = policyKind === "legacy"
+      ? bwrapArgsLegacy({ cwd, scratchHome })
+      : bwrapArgsStrict({ cwd, scratchHome });
     return {
       cmd: "bwrap",
-      args: [...bwrapArgs({ cwd, scratchHome }), cmd, ...args],
-      isolation: { kind: "bwrap" },
+      args: [...bwrap, cmd, ...args],
+      isolation: { kind: "bwrap", policy: policyKind },
     };
   }
 
   return { cmd, args, isolation: { kind: "none", reason: "unknown probe kind" } };
 }
 
-// --- macOS sandbox-exec profile ---------------------------------------------
+// --- macOS profiles ----------------------------------------------------------
+
+function sbString(s) {
+  return `"${String(s).replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+
+// AD-30 strict allowlist. Start with deny-default, then re-expose only the
+// paths and capabilities legitimate tools need. Anything under $HOME that
+// isn't explicitly allowed is unreadable — that includes ~/Documents,
+// browser cookie stores, other projects' .env files, etc.
+function macosProfileStrict({ cwd, scratchHome }) {
+  const home = homedir();
+
+  // Tool installations and caches users typically need read access to. If a
+  // path doesn't exist we still list it — sandbox-exec ignores missing paths.
+  const userToolPaths = [
+    join(home, ".nvm"),
+    join(home, ".npm"),
+    join(home, ".cache"),
+    join(home, ".pyenv"),
+    join(home, ".rbenv"),
+    join(home, ".rvm"),
+    join(home, ".cargo"),
+    join(home, ".rustup"),
+    join(home, ".gem"),
+    join(home, ".local"),
+    join(home, "Library", "Caches"),
+  ];
+
+  return [
+    `(version 1)`,
+    `(deny default)`,
+    ``,
+    `; Process, IPC, signals, and basic mach lookups so child tools can exec.`,
+    `(allow process-exec)`,
+    `(allow process-fork)`,
+    `(allow signal)`,
+    `(allow mach-lookup)`,
+    `(allow sysctl-read)`,
+    `(allow iokit-open)`,
+    `(allow system-socket)`,
+    ``,
+    `; Network — agents need to reach the Anthropic API, tracker APIs, package`,
+    `; registries, and remote git over HTTPS/SSH.`,
+    `(allow network*)`,
+    ``,
+    `; Project cwd + scratch HOME — full read/write.`,
+    `(allow file-read* file-write* (subpath ${sbString(cwd)}))`,
+    `(allow file-read* file-write* (subpath ${sbString(scratchHome)}))`,
+    ``,
+    `; System binaries and libraries — read-only.`,
+    `(allow file-read* (subpath "/usr"))`,
+    `(allow file-read* (subpath "/bin"))`,
+    `(allow file-read* (subpath "/sbin"))`,
+    `(allow file-read* (subpath "/System"))`,
+    `(allow file-read* (subpath "/Library"))`,
+    `(allow file-read* (subpath "/Applications"))`,
+    `(allow file-read* (subpath "/opt"))`,
+    `(allow file-read* (subpath "/private/etc"))`,
+    `(allow file-read* (subpath "/private/var/db/timezone"))`,
+    ``,
+    `; Standard devices.`,
+    `(allow file-read* file-write* (literal "/dev/null"))`,
+    `(allow file-read* (literal "/dev/random"))`,
+    `(allow file-read* (literal "/dev/urandom"))`,
+    `(allow file-read* file-write* (literal "/dev/tty"))`,
+    `(allow file-read* file-write* (literal "/dev/stdin"))`,
+    `(allow file-read* file-write* (literal "/dev/stdout"))`,
+    `(allow file-read* file-write* (literal "/dev/stderr"))`,
+    ``,
+    `; Temp space — child tools and package managers stage here.`,
+    `(allow file-read* file-write* (subpath "/tmp"))`,
+    `(allow file-read* file-write* (subpath "/private/tmp"))`,
+    `(allow file-read* file-write* (subpath "/private/var/folders"))`,
+    ``,
+    `; Tool installations and caches the user already has in $HOME — read+write`,
+    `; because package managers and version managers update their own caches.`,
+    `; NOTE: only these specific subpaths are exposed; the rest of $HOME stays`,
+    `; denied, so ~/Documents, ~/.ssh, ~/.aws, browser cookies, etc. are NOT`,
+    `; readable from inside the sandbox.`,
+    ...userToolPaths.map(p => `(allow file-read* file-write* (subpath ${sbString(p)}))`),
+    ``,
+  ].join("\n");
+}
 
-function macosProfile({ cwd, scratchHome }) {
+// Pre-AD-30 denylist — kept as opt-in fallback via AGENTDESK_SANDBOX_LEGACY=1
+// in case the strict policy breaks a tool we haven't accounted for.
+function macosProfileLegacy({ cwd, scratchHome }) {
   const home = homedir();
-  // Known-sensitive paths: reads AND writes denied, even though general
-  // access is allowed, so a confused agent can't slurp up other projects'
-  // tokens or clobber the user's SSH keys / shell config.
   const denyPathsSubpath = [
     join(home, ".ssh"),
     join(home, ".aws"),
     join(home, ".gcloud"),
-    join(home, ".config", "gh"),         // real gh config (scratch is under $TMPDIR)
+    join(home, ".config", "gh"),
     join(home, ".docker"),
     join(home, ".kube"),
     join(home, ".agentdesk"),
@@ -98,7 +201,7 @@ function macosProfile({ cwd, scratchHome }) {
   ];
   const denyPathsLiteral = [
     join(home, ".netrc"),
-    join(home, ".gitconfig"),            // real gitconfig (scratch has its own)
+    join(home, ".gitconfig"),
     join(home, ".npmrc"),
     join(home, ".pypirc"),
     join(home, ".zshrc"),
@@ -108,32 +211,73 @@ function macosProfile({ cwd, scratchHome }) {
     join(home, ".profile"),
   ];
 
-  const sb = [
+  return [
     `(version 1)`,
     `(allow default)`,
     ``,
-    `; Deny access (read + write) to known credential and shell-config paths.`,
-    `; Agents can't read other projects' tokens, can't overwrite SSH keys or`,
-    `; rewrite the user's shell rc files.`,
+    `; LEGACY denylist (pre-AD-30). Set AGENTDESK_SANDBOX_LEGACY=1 to use.`,
     ...denyPathsSubpath.map(p => `(deny file-read* file-write* (subpath ${sbString(p)}))`),
     ...denyPathsLiteral.map(p => `(deny file-read* file-write* (literal ${sbString(p)}))`),
     ``,
   ].join("\n");
-
-  return sb;
-}
-
-function sbString(s) {
-  return `"${String(s).replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
 }
 
 // --- Linux bwrap args --------------------------------------------------------
 
-function bwrapArgs({ cwd, scratchHome }) {
-  // Bind the whole filesystem normally so tools that need to write state
-  // (claude, npm, pip, yarn, etc.) keep working. Then cover the sensitive
-  // credential/config paths with tmpfs mounts so the agent can't read or
-  // write them — other projects' .env, SSH keys, shell rc files, etc.
+// AD-30 strict allowlist via bwrap. Read-only binds for system paths, --tmpfs
+// over $HOME so nothing on the user's home directory is visible by default,
+// then re-expose specific tool dirs that exist as read-only binds.
+function bwrapArgsStrict({ cwd, scratchHome }) {
+  const home = homedir();
+  const args = [
+    "--die-with-parent",
+    "--unshare-ipc",
+    "--unshare-uts",
+    "--unshare-pid",
+    "--proc", "/proc",
+    "--dev", "/dev",
+    // System: read-only.
+    "--ro-bind", "/usr", "/usr",
+    "--ro-bind", "/etc", "/etc",
+    "--ro-bind-try", "/lib", "/lib",
+    "--ro-bind-try", "/lib64", "/lib64",
+    "--ro-bind-try", "/lib32", "/lib32",
+    "--ro-bind-try", "/bin", "/bin",
+    "--ro-bind-try", "/sbin", "/sbin",
+    "--ro-bind-try", "/opt", "/opt",
+    // tmp: writable.
+    "--bind", "/tmp", "/tmp",
+    // Blank the real home; re-expose specific tool dirs below.
+    "--tmpfs", home,
+    // Project cwd + scratch HOME: writable.
+    "--bind", cwd, cwd,
+    "--bind", scratchHome, scratchHome,
+    // Network is intentionally NOT unshared — agents need tracker APIs and git.
+  ];
+
+  // Tool dirs the user typically has in $HOME — re-expose only if present.
+  // `--ro-bind-try` is a no-op if the source path doesn't exist.
+  const userToolPaths = [
+    join(home, ".nvm"),
+    join(home, ".npm"),
+    join(home, ".cache"),
+    join(home, ".pyenv"),
+    join(home, ".rbenv"),
+    join(home, ".rvm"),
+    join(home, ".cargo"),
+    join(home, ".rustup"),
+    join(home, ".gem"),
+    join(home, ".local"),
+  ];
+  for (const p of userToolPaths) {
+    args.push("--ro-bind-try", p, p);
+  }
+
+  return args;
+}
+
+// Pre-AD-30 denylist via bwrap (--bind / / + tmpfs over deny paths).
+function bwrapArgsLegacy({ cwd, scratchHome }) {
   const home = homedir();
   const denyPaths = [
     join(home, ".ssh"),
@@ -162,10 +306,7 @@ function bwrapArgs({ cwd, scratchHome }) {
     "--unshare-ipc",
     "--unshare-uts",
     "--unshare-pid",
-    // Network is NOT unshared — agents need network for tracker APIs and git.
   ];
   for (const p of denyPaths) args.push("--tmpfs", p);
-  // scratch HOME + project dir stay writable (already bound via --bind / /
-  // above — tmpfs blanks only the specific deny paths, not the rest).
   return args;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kendoo.agentdesk/agentdesk",
-  "version": "0.22.1",
+  "version": "0.23.0",
   "description": "AI team orchestrator for Claude Code — run collaborative agent sessions from your terminal",
   "type": "module",
   "bin": {