@ravefox/space 0.0.0-stage → 0.2.0

package/src/lib/sandbox/turn-dir.js

@@ -0,0 +1,56 @@
+/**
+ * The folder an adapter keeps one turn's credential in sits under the temp
+ * root. The sandbox denies that root by leaving it out of every grant, so a
+ * workspace that holds it undoes the denial: the workspace grant covers it,
+ * and code in the jail can read the credential and replace the turn's files
+ * (F219; measured on a real `codex sandbox`, where a workspace of $TMPDIR read
+ * the credential and a project folder could not).
+ *
+ * Checked before the folder exists, against the root, so a refused turn writes
+ * nothing. OpenCode has its own check, which also walks links and git worktrees.
+ */
+import { realpath } from 'fs/promises';
+import { tmpdir } from 'os';
+import {
+  basename, dirname, join, resolve, sep,
+} from 'path';
+
+export const contains = (outer, inner) => inner === outer
+  || inner.startsWith(outer.endsWith(sep) ? outer : outer + sep);
+
+// The real path of a path that may not exist yet: its nearest existing
+// ancestor resolved, with the rest appended. realpath(3) also returns the
+// disk's own spelling, which matters on a volume that folds case.
+export const realpathOfNearest = async (path) => {
+  const rest = [];
+  let current = resolve(path);
+  for (;;) {
+    try {
+      return join(await realpath(current), ...rest);
+    } catch (err) {
+      // Only a missing path walks up. Anything else (EACCES, ELOOP) would leave
+      // the containment check comparing a path nobody resolved: fail closed.
+      if (err?.code !== 'ENOENT' && err?.code !== 'ENOTDIR') throw err;
+      const parent = dirname(current);
+      if (parent === current) return join(current, ...rest);
+      rest.unshift(basename(current));
+      current = parent;
+    }
+  }
+};
+
+/** Throws when `workspace` holds the temp root; returns its real path otherwise. */
+export const refuseWorkspaceHoldingTurnDirs = async ({
+  workspace, seat, tempRoot = tmpdir(),
+}) => {
+  const [realWorkspace, realRoot] = await Promise.all([
+    realpathOfNearest(workspace || process.cwd()),
+    realpathOfNearest(tempRoot),
+  ]);
+  if (contains(realWorkspace, realRoot)) {
+    throw new Error(`${seat} cannot run in ${workspace || process.cwd()}: it contains the temp folder (${tempRoot}) `
+      + 'where each turn keeps the agent\'s credential, which the sandbox would then expose. '
+      + 'Run it in a project folder, or set TMPDIR outside it.');
+  }
+  return realWorkspace;
+};

package/src/lib/sandbox/windows-unsandboxed.js

@@ -0,0 +1,183 @@
+/**
+ * D245: the user's own opt-in to run an agent without a sandbox on native
+ * Windows.
+ *
+ * Commonly confines a public seat with Seatbelt on macOS and bubblewrap on
+ * Linux (mode.js). Windows has neither, so without this a public Claude Code,
+ * OpenCode or Qwen seat is refused on Windows (host-check.js). The opt-in
+ * keeps that refusal as the default and lets the person at the keyboard choose
+ * otherwise, for this machine only:
+ *
+ * - `commonly agent run <name> --unsandboxed` for one foreground run, or
+ * - `commonly daemon install --unsandboxed`, which writes the marker below; the
+ *   seats that daemon spawns read it. Installing again without the flag, or
+ *   uninstalling, removes it.
+ *
+ * Only a LOCAL action sets it. Nothing the server sends (a seat's declared
+ * environment, an adopted-seat row, a pod's settings) can create the marker or
+ * stand in for the flag: `hostUnconfinedForRun` takes the decision as an
+ * argument, and the adapter reads it from its spawn context, never from the
+ * environment.
+ *
+ * Only the OS jail is skipped. The seat keeps its trust, and with it the
+ * public tool policy (--setting-sources '', --strict-mcp-config, dontAsk,
+ * Read(./**), the denied tools), the sanitized environment and the TASK-294
+ * per-turn placement: on a host with no OS isolation that policy IS the
+ * sandbox. An earlier form of this rewrote the environment to `mode: 'none'`,
+ * which dropped the trust and the policy with it (review of #3388). The
+ * decision now travels as `hostUnconfined` on the adapter's spawn context,
+ * set only by `agent run`, so the environment, stored or derived, never
+ * carries it and nothing the server sends can set it.
+ *
+ * Claude Code keeps its public policy without the jail. OpenCode and Qwen stay
+ * refused on Windows. Codex has no policy beneath its permission profile, which
+ * its unelevated Windows sandbox cannot enforce, so an unconfined Codex is a
+ * full shell. It therefore gets a narrower opt-in (codexUnconfinedForRun): only
+ * a seat whose every pod is confirmed private, re-read before every turn
+ * (unconfinedTurnPlacement), and a public one always refuses (host-check.js).
+ * No seat on native Windows gets the grant broker (grant-broker-guard.js), and
+ * the server refuses grant use for every seat on a machine whose daemon reports
+ * the opt-in.
+ */
+
+import { existsSync, readFileSync, rmSync } from 'fs';
+import { homedir } from 'os';
+import { join } from 'path';
+
+import { writeServiceFile } from '../daemon-service.js';
+import { effectiveSandboxTrust } from '../environment.js';
+import { allPodsConfirmedPrivate } from '../workspace-trust.js';
+import { UNSANDBOXED_FLAG } from './host-check.js';
+
+export { UNSANDBOXED_FLAG };
+
+export const unsandboxedMarkerPath = (home = homedir()) => join(home, '.commonly', 'daemon', 'unsandboxed.json');
+
+/**
+ * The flag answers a gap in the sandbox: native Windows has none, and a private
+ * Codex agent on Linux has none where bubblewrap can't start (F387, F444). So
+ * on Linux it is accepted only for `agent run` of a Codex agent: pass `adapterName` once it is known,
+ * or `deferred` before the record is read (the run checks again after). The
+ * daemon's marker stays Windows-only.
+ */
+export const unsandboxedFlagRefusal = (platform = process.platform, { adapterName = null, deferred = false } = {}) => {
+  if (platform === 'win32') return null;
+  if (platform === 'linux' && (adapterName === 'codex' || (deferred && adapterName === null))) return null;
+  return `${UNSANDBOXED_FLAG} is only for native Windows, which has no sandbox for agents yet, and for`
+    + ` \`agent run\` of a private Codex agent on Linux. On this machine this agent runs in a sandbox.`;
+};
+
+export const loadUnsandboxedOptIn = ({
+  platform = process.platform, home = homedir(), exists = existsSync, read = readFileSync,
+} = {}) => {
+  if (platform !== 'win32') return false;
+  const file = unsandboxedMarkerPath(home);
+  if (!exists(file)) return false;
+  try {
+    const value = JSON.parse(read(file, 'utf8'));
+    return value?.unsandboxed === true && value?.platform === 'win32';
+  } catch {
+    return false;
+  }
+};
+
+export const saveUnsandboxedOptIn = ({ home = homedir(), writeFile = writeServiceFile, now = () => new Date() } = {}) => {
+  writeFile(unsandboxedMarkerPath(home), `${JSON.stringify({ unsandboxed: true, platform: 'win32', optedInAt: now().toISOString() })}\n`);
+};
+
+export const clearUnsandboxedOptIn = ({ home = homedir(), exists = existsSync, remove = rmSync } = {}) => {
+  const file = unsandboxedMarkerPath(home);
+  if (!exists(file)) return false;
+  remove(file);
+  return true;
+};
+
+/**
+ * Did the user opt in for THIS run? The typed flag, or, for a seat the daemon
+ * spawned, the marker that `daemon install --unsandboxed` wrote. A foreground
+ * run never reads the marker, so installing the daemon unsandboxed does not
+ * quietly change what a hand-started `agent run` does.
+ */
+export const runOptedInUnsandboxed = ({ flag, env = process.env, load = loadUnsandboxedOptIn } = {}) => (
+  flag === true || (env.COMMONLY_MANAGED_RUNNER === '1' && load() === true)
+);
+
+/** The adapters that can run their trust's tool policy without the OS jail. */
+export const POLICY_ONLY_ADAPTERS = new Set(['claude']);
+
+/**
+ * Does this run skip the OS jail? Only on win32, only by the user's own
+ * opt-in, only for an adapter that keeps its policy without the jail, and only
+ * for a seat whose trust brings that policy (public or workspace). A seat with
+ * no confined trust is the owner's own and is never jailed anywhere, so the
+ * opt-in changes nothing for it, and the notice must not promise it a policy.
+ */
+export const hostUnconfinedForRun = ({
+  optedIn, adapterName, environment, platform = process.platform,
+}) => {
+  // The effective trust, as host-check.js and the claude adapter read it: a
+  // legacy `internal` record means `public`, so it gets the same opt-in.
+  const trust = effectiveSandboxTrust(environment?.sandbox?.trust);
+  return platform === 'win32' && optedIn === true && POLICY_ONLY_ADAPTERS.has(adapterName)
+    && (trust === 'public' || trust === 'workspace');
+};
+
+/**
+ * Does this Codex run go unconfined? Only on win32, or on Linux (F387, F444),
+ * only by the user's own opt-in, and only when every pod the seat answers in is confirmed private:
+ * `installations` is the server's read of them, and an empty or failed read is
+ * a no. Workspace trust stays with Codex's own refusal. The caller removes the
+ * sandbox block for this run only, so the saved record keeps its public trust
+ * and a later run without the flag refuses as before.
+ */
+export const codexUnconfinedForRun = ({
+  optedIn, adapterName, environment, installations, platform = process.platform,
+}) => (platform === 'win32' || platform === 'linux') && optedIn === true && adapterName === 'codex'
+  && effectiveSandboxTrust(environment?.sandbox?.trust) !== 'workspace'
+  && allPodsConfirmedPrivate(installations);
+
+/**
+ * What the daemon's check-in says about this host. The server refuses grant
+ * use for every seat on a machine that reports either Windows value.
+ */
+export const hostSandboxReport = ({ platform = process.platform, load = () => loadUnsandboxedOptIn({ platform }) } = {}) => {
+  if (platform !== 'win32') return 'default';
+  return load() === true ? 'unsandboxed-opted-in' : 'native-windows';
+};
+
+/** One plain line for the run log and `daemon status`. */
+export const UNSANDBOXED_NOTICE = 'unsandboxed (opted in): Windows has no sandbox, so nothing at the OS level confines this agent. It keeps Space\'s restricted tool settings, gets no shell even with --allow write, and gets no connector grants.';
+
+/** Codex has no restricted tool settings to keep, so its line says what it costs instead. */
+export const CODEX_UNSANDBOXED_NOTICE = 'unsandboxed (opted in): Windows has no sandbox Codex can use here, so nothing confines this agent. It runs with your own access to files and commands, and anyone in its pods, people invited later included, can direct it. It gets no connector grants, and a turn is refused if a pod stops being invite-only.';
+
+export const CODEX_LINUX_UNSANDBOXED_NOTICE = 'unsandboxed (opted in): you ran this Codex agent without its sandbox, so nothing confines this agent. It runs with your own access to files and commands, and anyone in its pods, people invited later included, can direct it. It gets no connector grants, and a turn is refused if a pod stops being invite-only.';
+
+export const codexUnsandboxedNotice = (platform = process.platform) => (platform === 'linux'
+  ? CODEX_LINUX_UNSANDBOXED_NOTICE
+  : CODEX_UNSANDBOXED_NOTICE);
+
+// A 404 here is a server from before this route, which reads like a missing agent.
+export const hostReportFailureMessage = (err) => {
+  const hint = err?.status === 404
+    ? '. This server is older than this CLI: update the server, or run the agent in a sandbox.'
+    : '';
+  return `could not tell the server this agent has no sandbox, so it did not start: ${err?.message}${hint}`;
+};
+
+export default {
+  CODEX_LINUX_UNSANDBOXED_NOTICE,
+  CODEX_UNSANDBOXED_NOTICE,
+  codexUnsandboxedNotice,
+  UNSANDBOXED_FLAG,
+  UNSANDBOXED_NOTICE,
+  codexUnconfinedForRun,
+  clearUnsandboxedOptIn,
+  loadUnsandboxedOptIn,
+  runOptedInUnsandboxed,
+  saveUnsandboxedOptIn,
+  unsandboxedFlagRefusal,
+  unsandboxedMarkerPath,
+  hostUnconfinedForRun,
+  hostSandboxReport,
+};

package/src/lib/sandbox/workspace-git-config.js

@@ -0,0 +1,243 @@
+/**
+ * Refuses a public Codex seat's workspace when its repository is set up to run
+ * programs.
+ *
+ * Codex runs git itself (status and diff of the workspace) outside the seat's
+ * permission profile, so whatever the repository's own git setup tells git to
+ * run, runs as the operator. `git clone` never copies a remote's config or
+ * hooks, so a repository the operator cloned carries none of this. A folder
+ * that was copied, unpacked or handed over can, and nothing about the folder
+ * says which it was.
+ *
+ * So before a turn, git itself is asked which repository it would open from the
+ * workspace and what config that repository gives it. Asking git rather than
+ * walking for `.git` matters: git also accepts a bare layout, skips a `.git` it
+ * can't use, and follows `.git` files and symlinks. The questions asked
+ * (`rev-parse`, `config --list`, `ls-files`) parse and print, and run with
+ * fsmonitor and hooks forced off on the command line, so the check can't be
+ * turned against the host. The same is done for every submodule recorded in
+ * the index that is checked out, since `git status` recurses into them.
+ *
+ * The turn is refused when any of these repositories sets a key that names a
+ * program or another config file, or holds a hook. The names are reported,
+ * never the values. When git's answer can't be read, the turn is refused too.
+ *
+ * Hook managers (husky's `core.hooksPath`, lefthook, pre-commit, git-lfs's
+ * hooks) are refused like any other: a later commit would run them as the
+ * operator. A seat that needs one of those repositories needs that setup
+ * removed from its copy.
+ */
+import { spawnSync } from 'child_process';
+import { existsSync, readdirSync } from 'fs';
+import { isAbsolute, join, resolve } from 'path';
+
+// Keys whose value names a program git may run, or another file whose keys it
+// would then read. Matched on the key as git prints it: section and key lower
+// case, subsection as written. Bare-boolean keys are in BOOLEAN_KEYS below.
+const PROGRAM_KEYS = [
+  /^filter\..+\.(clean|smudge|process)$/i,
+  /^core\.(sshcommand|pager|editor|askpass|hookspath|gitproxy|alternaterefscommand|worktree)$/i,
+  /^diff\.external$/i,
+  /^diff\..+\.(command|textconv)$/i,
+  /^merge\..+\.driver$/i,
+  /^(mergetool|difftool)\..+\.(cmd|path)$/i,
+  /^pager\./i,
+  /^gpg\.(program|.+\.program)$/i,
+  /^gpg\.ssh\.defaultkeycommand$/i,
+  /^credential\.(helper|.+\.helper)$/i,
+  /^sequence\.editor$/i,
+  /^interactive\.difffilter$/i,
+  /^include\.path$/i,
+  /^includeif\..+\.path$/i,
+  /^hook\./i,
+  /^gc\.recentobjectshook$/i,
+  /^remote\..+\.(uploadpack|receivepack|proxy|vcs)$/i,
+  /^uploadpack\.packobjectshook$/i,
+  /^protocol\.allow$/i,
+  /^protocol\..+\.allow$/i,
+  /^sendemail\.(.+\.)?(smtpserver|tocmd|cccmd|sendmailcmd|headercmd)$/i,
+  /^imap\.tunnel$/i,
+  /^guitool\..+\.cmd$/i,
+  /^instaweb\.httpd$/i,
+  /^(web|help)\.browser$/i,
+  /^(browser|man)\..+\.(cmd|path)$/i,
+  /^trailer\..+\.(command|cmd)$/i,
+  /^lfs\.extension\..+\.(clean|smudge)$/i,
+  /^lfs\.customtransfer\..+\.path$/i,
+];
+// core.fsmonitor is a program unless it is a boolean (true starts git's own
+// daemon, which runs nothing from the repository).
+const BOOLEAN_KEYS = [/^core\.fsmonitor$/i];
+const BOOLEAN_VALUES = new Set(['', 'true', 'false', 'yes', 'no', 'on', 'off', '1', '0']);
+// Keys that run a program only when their value says so.
+const BANG_VALUE_KEYS = [/^alias\./i, /^submodule\..+\.update$/i];
+const EXT_URL = /^ext::/i;
+
+export const codeRunningKey = (key, value = '') => {
+  if (PROGRAM_KEYS.some((pattern) => pattern.test(key))) return true;
+  if (BOOLEAN_KEYS.some((pattern) => pattern.test(key))) return !BOOLEAN_VALUES.has(String(value).trim().toLowerCase());
+  if (BANG_VALUE_KEYS.some((pattern) => pattern.test(key))) return String(value).trim().startsWith('!');
+  if (/^(remote|submodule)\..+\.(url|pushurl)$/i.test(key)) return EXT_URL.test(String(value).trim());
+  if (/^url\..+\.(insteadof|pushinsteadof)$/i.test(key)) return EXT_URL.test(key.slice(4));
+  return false;
+};
+
+// What git reads from the environment to pick a repository and its index.
+// Passed through, so the check opens the repository Codex's git would.
+const DISCOVERY_ENV = [
+  'GIT_DIR', 'GIT_WORK_TREE', 'GIT_COMMON_DIR', 'GIT_INDEX_FILE', 'GIT_CEILING_DIRECTORIES', 'GIT_DISCOVERY_ACROSS_FILESYSTEM',
+];
+// The ones git clears before it runs inside a submodule (its local_repo_env):
+// they name the top repository, so a submodule is opened from its own folder.
+const TOP_REPOSITORY_ENV = ['GIT_DIR', 'GIT_WORK_TREE', 'GIT_COMMON_DIR', 'GIT_INDEX_FILE'];
+const submoduleEnv = (env) => Object.fromEntries(Object.entries(env).filter(([name]) => !TOP_REPOSITORY_ENV.includes(name)));
+// On the command line, ahead of anything the repository says: nothing these
+// commands do may start fsmonitor or a hook.
+const SAFE_FLAGS = ['-c', 'core.fsmonitor=false', '-c', 'core.hooksPath=/dev/null', '-c', 'core.untrackedCache=false'];
+const MAX_DEPTH = 8;
+
+const gitEnv = (baseEnv) => {
+  const env = { PATH: baseEnv.PATH || process.env.PATH, GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null' };
+  for (const name of DISCOVERY_ENV) if (baseEnv[name] !== undefined) env[name] = baseEnv[name];
+  return env;
+};
+
+const runGit = (run, cwd, env, args, { flags = SAFE_FLAGS } = {}) => run('git', [...flags, ...args], {
+  cwd, env, encoding: 'utf8', timeout: 10_000, maxBuffer: 16 * 1024 * 1024,
+});
+
+// The repository git opens from `dir`, as git reports it: null when `dir` is in
+// none, or `{ unreadable }` when git could not say.
+const describeRepository = (dir, { run, env }) => {
+  const result = runGit(run, dir, env, ['rev-parse', '--path-format=absolute', '--absolute-git-dir', '--git-common-dir', '--git-path', 'hooks']);
+  if (result?.status !== 0) {
+    // No git on the host means Codex can't run git either.
+    if (result?.error?.code === 'ENOENT') return null;
+    // Only git's "nothing here or above" answer means no repository. A `.git`
+    // file pointing nowhere also says "not a git repository", with the path.
+    if (/not a git repository \(or any/i.test(String(result?.stderr || ''))) return null;
+    return { unreadable: `git could not read the repository (${String(result?.stderr || result?.error?.message || 'no answer').trim().split('\n')[0]})` };
+  }
+  const [gitDir, commonDir, hooksDirRaw] = String(result.stdout).trim().split('\n');
+  if (!gitDir || !commonDir || !hooksDirRaw) return { unreadable: 'git gave no repository path' };
+  // --git-path answers with core.hooksPath forced to /dev/null above, so the
+  // repository's own hooks folder is read without it.
+  const hooksDir = hooksDirRaw === '/dev/null' ? join(commonDir, 'hooks') : hooksDirRaw;
+  return { gitDir, commonDir, hooksDir: isAbsolute(hooksDir) ? hooksDir : resolve(dir, hooksDir) };
+};
+
+// Every config entry git applies in this repository, with the system and
+// global files off: the repository's own config, its worktree config, and
+// whatever they include.
+const repositoryConfig = (dir, { run, env }) => {
+  const result = runGit(run, dir, env, ['config', '--list', '--includes', '-z', '--show-origin']);
+  if (result?.status !== 0) return null;
+  // With --show-origin and -z each entry is "origin\0key\nvalue\0".
+  const parts = String(result.stdout || '').split('\0');
+  const entries = [];
+  for (let i = 0; i + 1 < parts.length; i += 2) {
+    const origin = parts[i];
+    const entry = parts[i + 1];
+    // The safe flags this check passes come back as "command line:" entries.
+    if (!entry || origin.startsWith('command line:')) continue;
+    const at = entry.indexOf('\n');
+    entries.push({
+      origin: origin.replace(/^file:/, ''),
+      key: at < 0 ? entry : entry.slice(0, at),
+      value: at < 0 ? '' : entry.slice(at + 1),
+    });
+  }
+  return entries;
+};
+
+// Hook names in `dir`, or null when it exists but can't be listed.
+const hooksIn = (dir) => {
+  if (!existsSync(dir)) return [];
+  try {
+    return readdirSync(dir).filter((name) => !name.endsWith('.sample'));
+  } catch {
+    return null;
+  }
+};
+
+// Checked-out submodules recorded in the index, as paths below `top`.
+const submodulesOf = (top, { run, env }) => {
+  const result = runGit(run, top, env, ['ls-files', '--stage', '-z']);
+  if (result?.status !== 0) return null;
+  return String(result.stdout || '').split('\0').filter((line) => line.startsWith('160000 '))
+    .map((line) => line.slice(line.indexOf('\t') + 1))
+    .map((path) => join(top, path))
+    .filter((path) => existsSync(join(path, '.git')));
+};
+
+const topLevelOf = (dir, { run, env }) => {
+  const result = runGit(run, dir, env, ['rev-parse', '--show-toplevel']);
+  return result?.status === 0 ? String(result.stdout).trim() || null : null;
+};
+
+const inspect = (dir, context, findings, seen, depth) => {
+  const repo = describeRepository(dir, context);
+  if (!repo) return;
+  if (repo.unreadable) {
+    findings.push({ file: dir, key: repo.unreadable });
+    return;
+  }
+  if (seen.has(repo.gitDir)) return;
+  seen.add(repo.gitDir);
+  if (depth > MAX_DEPTH) {
+    findings.push({ file: dir, key: `submodules nested deeper than ${MAX_DEPTH}` });
+    return;
+  }
+  const entries = repositoryConfig(dir, context);
+  if (!entries) {
+    findings.push({ file: join(repo.commonDir, 'config'), key: 'unreadable config' });
+  } else {
+    for (const { origin, key, value } of entries) {
+      if (codeRunningKey(key, value)) findings.push({ file: origin, key });
+    }
+  }
+  for (const hooksDir of new Set([repo.hooksDir, join(repo.gitDir, 'hooks'), join(repo.commonDir, 'hooks')])) {
+    const hooks = hooksIn(hooksDir);
+    if (!hooks) findings.push({ file: hooksDir, key: 'unreadable hooks folder' });
+    else for (const hook of hooks) findings.push({ file: join(hooksDir, hook), hook });
+  }
+  const top = topLevelOf(dir, context);
+  if (!top) return; // a bare repository has no work tree, so no submodules are checked out
+  const submodules = submodulesOf(top, context);
+  if (!submodules) {
+    findings.push({ file: top, key: 'unreadable index' });
+    return;
+  }
+  const subContext = { ...context, env: submoduleEnv(context.env) };
+  for (const sub of submodules) inspect(sub, subContext, findings, seen, depth + 1);
+};
+
+/**
+ * What would make git run a program in the workspace's repository or its
+ * checked-out submodules: each a `{ file, key }` (never the value), or a
+ * `{ file, hook }`. Empty when the workspace is in no repository, or nothing
+ * is set. `env` is the environment Codex will get; only the variables git uses
+ * to pick a repository are taken from it.
+ */
+export const codeRunningGitSetup = (workspace, { run = spawnSync, env = process.env } = {}) => {
+  const findings = [];
+  inspect(resolve(workspace), { run, env: gitEnv(env) }, findings, new Set(), 0);
+  return findings;
+};
+
+export const refuseCodeRunningGitSetup = (workspace, { seat = 'this agent', run, env } = {}) => {
+  const findings = codeRunningGitSetup(workspace, { run, env });
+  if (!findings.length) return;
+  const named = findings.slice(0, 8).map((f) => (f.hook ? `hook ${f.hook} (${f.file})` : `${f.key} (${f.file})`)).join('; ');
+  const more = findings.length > 8 ? ` and ${findings.length - 8} more` : '';
+  const error = new Error(
+    `${seat} won't work in ${workspace}: its git repository is set to run programs, or git couldn't `
+    + `say (${named}${more}). Codex runs git outside the sandbox, so these would run as you. Remove that setup from the `
+    + 'agent\'s copy (unset the keys, delete the hooks), or give it a fresh `git clone` that no hook '
+    + 'manager has been installed into.',
+  );
+  error.code = 'workspace_git_runs_programs';
+  throw error;
+};
+
+export default { codeRunningGitSetup, codeRunningKey, refuseCodeRunningGitSetup };

package/src/lib/sandbox/workspace-pin.js

@@ -0,0 +1,158 @@
+/**
+ * The realpath a workspace-trust seat's folder had when the seat first ran
+ * there (F200).
+ *
+ * A public seat's writable folder is pinned to its own name (seatbelt.js
+ * pinnedRealpath, F197). A workspace seat's folder is the operator's choice
+ * and may be a link on purpose, so it cannot be pinned that way. But a seat
+ * with write access can remove its project folder and leave a link in its
+ * place, and the next turn's grant (a Seatbelt subpath on the resolved path,
+ * or a bwrap bind of it) would follow that link.
+ *
+ * So the folder's realpath is recorded the first time the seat runs there,
+ * and a later turn whose folder resolves anywhere else is refused before
+ * anything is spawned. A link the operator had in place before that first
+ * turn is part of what was recorded and keeps working. The record lives in a
+ * folder beside the seat's state folder, which no turn is granted: Seatbelt
+ * denies writes to it by name, and bwrap never binds it. A workspace that
+ * contains it is refused.
+ *
+ * Each folder has its own record file, created once and never rewritten: a
+ * staged copy is hard-linked to the final name, which fails if the name is
+ * taken. So two turns recording at once cannot lose each other's record, and
+ * two that disagree about one folder cannot both pass.
+ *
+ * Recording happens on the first turn, not at attach: attach does not know
+ * the seat's state folder, and no turn of the seat runs between attach and its
+ * first turn. A seat that already ran before this check existed is recorded on
+ * its first turn after the update.
+ */
+import {
+  link, lstat, mkdir, readFile, realpath, rm, writeFile,
+} from 'fs/promises';
+import { createHash, randomUUID } from 'crypto';
+import {
+  basename, dirname, isAbsolute, join, relative, resolve, sep,
+} from 'path';
+
+export const workspacePinDir = (statePath) => join(dirname(statePath), 'workspace-pins');
+export const workspacePinFile = (statePath, cwd) => {
+  const folder = createHash('sha256').update(resolve(cwd)).digest('hex').slice(0, 16);
+  return join(workspacePinDir(statePath), `${basename(statePath)}-${folder}.json`);
+};
+
+const isInsideOrEqual = (child, parent) => {
+  const rel = relative(parent, child);
+  return rel === '' || (rel.split(sep)[0] !== '..' && !isAbsolute(rel));
+};
+
+const readRecord = async (file) => {
+  let stat;
+  try {
+    stat = await lstat(file);
+  } catch (err) {
+    if (err?.code === 'ENOENT') return null;
+    throw err;
+  }
+  const unreadable = (why) => new Error(
+    `refusing a workspace turn: this agent's workspace record ${file} ${why}. `
+    + 'First confirm the agent\'s folder resolves where you expect (for example with `realpath`), '
+    + 'then remove the record; the next turn records the folder as it resolves then.',
+  );
+  if (!stat.isFile()) throw unreadable('is not a regular file');
+  try {
+    const parsed = JSON.parse(await readFile(file, 'utf8'));
+    if (typeof parsed?.realpath !== 'string' || !parsed.realpath) throw new Error('bad shape');
+    return parsed;
+  } catch {
+    throw unreadable('cannot be read');
+  }
+};
+
+// True when this call created the record, false when another had already. The
+// final name appears only complete, because it is a link to a finished copy.
+const createRecord = async (file, record, { _writeFile = writeFile } = {}) => {
+  await mkdir(dirname(file), { recursive: true, mode: 0o700 });
+  const staged = join(dirname(file), `.${basename(file)}.${randomUUID()}.tmp`);
+  try {
+    await _writeFile(staged, `${JSON.stringify(record, null, 2)}\n`, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+    await link(staged, file);
+    return true;
+  } catch (err) {
+    if (err?.code === 'EEXIST') return false;
+    throw err;
+  } finally {
+    await rm(staged, { force: true });
+  }
+};
+
+const changed = ({ given, current, recorded, file }) => new Error(
+  `refusing a workspace turn: ${given} now resolves to ${current}, but it resolved to `
+  + `${recorded} when this agent first ran there. A turn can replace its folder with a `
+  + 'link, which would let the next turn write wherever the link points. If you moved the '
+  + `project on purpose, remove ${file} (the next turn records the new location), or attach `
+  + 'the agent to the project\'s new folder.',
+);
+
+/**
+ * Compare the folder's realpath with the one recorded for it, recording it
+ * when there is none, and return the realpath to grant. A folder that does not
+ * resolve is refused, recorded or not: the run loop makes the folder before
+ * each turn, so there is nothing here to grant.
+ *
+ * `_realpath` and `_writeFile` are test seams.
+ */
+export const holdWorkspaceRealpath = async ({
+  cwd, statePath, log = (line) => console.warn(line), _realpath = realpath, _writeFile = writeFile,
+}) => {
+  const given = resolve(cwd);
+  const file = workspacePinFile(statePath, given);
+  let current;
+  try {
+    current = await _realpath(given);
+  } catch {
+    // Missing, or a link to nowhere.
+    const entry = await readRecord(file);
+    if (entry) throw changed({ given, current: 'nothing', recorded: entry.realpath, file });
+    throw new Error(
+      `refusing a workspace turn: ${given} does not resolve to a folder. `
+      + 'Create the folder or point the agent at one, and run the turn again.',
+    );
+  }
+  const pinDir = workspacePinDir(statePath);
+  let realPinDir = pinDir;
+  try {
+    realPinDir = await realpath(pinDir);
+  } catch {
+    try {
+      realPinDir = join(await realpath(dirname(pinDir)), basename(pinDir));
+    } catch {
+      // Neither exists yet; compared as given.
+    }
+  }
+  if (isInsideOrEqual(realPinDir, current)) {
+    throw new Error(
+      `refusing a workspace turn: ${given} contains this agent's own record of its folder (${pinDir}), `
+      + 'which the agent must not be able to write. Point the agent at a project folder instead.',
+    );
+  }
+  const held = async (entry) => {
+    if (entry?.realpath !== current) {
+      throw changed({ given, current, recorded: entry?.realpath ?? 'nothing', file });
+    }
+    return current;
+  };
+  const existing = await readRecord(file);
+  if (existing) return held(existing);
+  const created = await createRecord(file, {
+    workspace: given, realpath: current, recordedAt: new Date().toISOString(),
+  }, { _writeFile });
+  // Another turn recorded it first: this turn answers to that record.
+  if (!created) return held(await readRecord(file));
+  // Once per folder: a seat that ran before this check is recorded as its
+  // folder resolves now, which the operator should confirm.
+  log(`[claude] workspace: recorded ${given} → ${current}`);
+  return current;
+};
+
+export default { holdWorkspaceRealpath, workspacePinDir, workspacePinFile };