@snowyroad/braid 0.96.8 → 0.97.0

package/README.md

@@ -231,7 +231,7 @@ descendant process and cannot be shed.
   dirs** — `~/.ssh`, `~/.aws`, `~/.gnupg`, `~/.kube/config`, and the bridge's own
   credential store (`~/.braid`).
 - **Network:** a curated allow-list (provider API hosts, package registries, and
-  the major source-code hosts) so normal work keeps working; everything else is
+  read-only source-content hosts such as codeload.github.com) so normal work keeps working; everything else is
   blocked. Operator-extensible.
 - **Fail-closed:** in **full** tool mode the bridge REFUSES to start if the OS
   sandbox facility is unavailable, and tells you how to fix it. In read-and-reply
@@ -243,9 +243,11 @@ descendant process and cannot be shed.
   or the `BRAID_SCOPE_ALLOW_WRITE` / `BRAID_SCOPE_ALLOW_READ` / `BRAID_SCOPE_ALLOW_DOMAINS`
   env vars (see below). Credential directories (`~/.ssh`, `~/.aws`, `~/.config/gh`,
   and the rest of the protected inventory) are reserved and CANNOT be granted: a
-  grant that lands inside one is refused at startup with a SCOPE ERROR. A tool CLI
-  that only needs network still works inside the jail (`github.com` is in the default
-  allow-list); grant a project data directory, never a credential store.
+  grant that lands inside one is refused at startup with a SCOPE ERROR. Code hosts
+  (github.com, gitlab.com, bitbucket.org) are NOT reachable from inside the jail:
+  authenticated git goes through the bridge's git tools. Grant a project data directory, never a credential store.
+
+**Code hosts are not reachable from the jail.** `github.com`, `api.github.com`, `gitlab.com` and `bitbucket.org` are a reserved set: an `--allow-domain` or `scope.network.allowedDomains` entry that reaches them is refused at startup. To accept that risk for one agent (for example, `git+https` dependencies during installs) run `braid scope allow-code-hosts <agent>`; the startup banner then carries a warning. The agent's own `git` runs with credential helpers disabled, so it cannot read your `gh` or keychain credentials.
 
 - **Unix socket access (Linux):** on Linux, seccomp-bpf cannot filter Unix sockets
   by path. The default `compat` IPC profile allows all pathname sockets. The `strict`

package/dist/{chunk-QHWKKDPN.js → chunk-2OHYN3KD.js}

@@ -400,7 +400,7 @@ var InviteExpiredError = class extends Error {
   }
 };
 async function redeemInvite(relayHttpUrl, code) {
-  const { boundedJsonFetch: boundedJsonFetch2 } = await import("./http-3WYFRJZR.js");
+  const { boundedJsonFetch: boundedJsonFetch2 } = await import("./http-7LMCYNHB.js");
   const r = await boundedJsonFetch2(`${relayHttpUrl.replace(/\/$/, "")}/invites/redeem`, {
     method: "POST",
     headers: { "content-type": "application/json" },
@@ -492,7 +492,7 @@ function validateReplacementToken(newToken, currentToken, nowMs = Date.now()) {
   return { ok: true };
 }
 async function mintAccessToken(relayHttpUrl, agentKey, fetchFn = fetch, dpopProof) {
-  const { boundedJsonFetch: boundedJsonFetch2 } = await import("./http-3WYFRJZR.js");
+  const { boundedJsonFetch: boundedJsonFetch2 } = await import("./http-7LMCYNHB.js");
   const r = await boundedJsonFetch2(`${relayHttpUrl.replace(/\/$/, "")}/agents/token`, {
     method: "POST",
     headers: {
@@ -812,6 +812,7 @@ function parseScope(v) {
     if (allowedDomains) net.allowedDomains = allowedDomains;
     const deniedDomains = strArr(n.deniedDomains);
     if (deniedDomains) net.deniedDomains = deniedDomains;
+    if (typeof n.allowCodeHosts === "boolean") net.allowCodeHosts = n.allowCodeHosts;
     if (Object.keys(net).length > 0) out.network = net;
   }
   return Object.keys(out).length > 0 ? out : void 0;
@@ -1049,6 +1050,13 @@ function pinEndpoint(dir, agentName, pin) {
   agent.pinnedEndpoints = next;
   saveAgent(dir, agent);
 }
+function setScopeAllowCodeHosts(dir, agentName, value) {
+  const entry = loadAgent(dir, agentName);
+  const agent = entry.agent;
+  const network = { ...agent.scope?.network ?? {}, allowCodeHosts: value };
+  agent.scope = { ...agent.scope ?? {}, network };
+  saveAgent(dir, agent);
+}
 function updateAgentWorkspace(dir, agentName, info) {
   try {
     const entry = loadAgent(dir, agentName);
@@ -2832,13 +2840,44 @@ var DEFAULT_ALLOWED_DOMAINS = [
   // Crates.io
   "crates.io",
   "static.crates.io",
-  // Source hosts
+  // Source hosts: READ-ONLY content delivery only. The code-host write paths
+  // (github.com, api.github.com, gitlab.com, bitbucket.org) left this list on
+  // 2026-10-06 (git gateway D12/G2): with them present, an injected agent could
+  // push private files to an attacker's repo using an attacker-supplied token,
+  // no operator credential needed. Authenticated git goes through the bridge's
+  // git gateway tools; see RESERVED_CODE_HOST_DOMAINS for the enforced floor.
+  "codeload.github.com",
+  "*.githubusercontent.com"
+];
+var RESERVED_CODE_HOST_DOMAINS = [
   "github.com",
   "*.github.com",
-  "*.githubusercontent.com",
   "gitlab.com",
-  "bitbucket.org"
+  "*.gitlab.com",
+  "bitbucket.org",
+  "*.bitbucket.org"
 ];
+var RESERVED_CODE_HOST_READ_ONLY = /* @__PURE__ */ new Set(["codeload.github.com"]);
+function codeHostConflicts(allowed) {
+  const out = [];
+  for (const a of allowed) {
+    const d = a.domain.trim().toLowerCase().replace(/\.$/, "");
+    if (RESERVED_CODE_HOST_READ_ONLY.has(d)) continue;
+    for (const r of RESERVED_CODE_HOST_DOMAINS) {
+      const base = r.startsWith("*.") ? r.slice(2) : r;
+      const isAllMatch = d === "*";
+      const isReservedItself = d === r || d === base;
+      const isSubdomainOfReservedWildcard = r.startsWith("*.") && d.endsWith("." + base);
+      const isBroaderWildcard = d.startsWith("*.") && (base === d.slice(2) || base.endsWith("." + d.slice(2)));
+      const hit = isAllMatch || isReservedItself || isSubdomainOfReservedWildcard || isBroaderWildcard;
+      if (hit) {
+        out.push({ domain: a.domain, source: a.source, reservation: r });
+        break;
+      }
+    }
+  }
+  return out;
+}
 var PROVIDER_PATHS = {
   "claude-code": ["~/.claude", "~/.claude.json"],
   codex: ["~/.codex"],
@@ -3022,6 +3061,24 @@ Narrow the grant to a path outside the protected set. (Ancestor grants like "~"
     ...scope.network?.deniedDomains ?? [],
     ...parseEnvList(env["BRAID_SCOPE_DENY_DOMAINS"])
   ]);
+  const allowCodeHosts = scope.network?.allowCodeHosts === true;
+  if (!disabled && !allowCodeHosts) {
+    const labelledDomains = [
+      ...(scope.network?.allowedDomains ?? []).map((domain) => ({ domain, source: "scope.network.allowedDomains" })),
+      ...(cfg.derivedAllowedDomains ?? []).map((domain) => ({ domain, source: "derived model endpoint" })),
+      ...parseEnvList(env["BRAID_SCOPE_ALLOW_DOMAINS"]).map((domain) => ({ domain, source: "BRAID_SCOPE_ALLOW_DOMAINS" })),
+      ...(cfg.scopeFlags?.allowDomains ?? []).map((domain) => ({ domain, source: "--allow-domain" }))
+    ];
+    const hits = codeHostConflicts(labelledDomains);
+    if (hits.length > 0) {
+      const detail = hits.map((h) => `  - ${h.source}: "${h.domain}" is a code host (reserved: ${h.reservation})`).join("\n");
+      throw new Error(
+        `[braid] SCOPE ERROR: a network grant reaches a code host and was refused:
+${detail}
+The sandboxed agent must not reach code hosts directly (an injected agent could push private files anywhere on that host). Use the Braid git tools for authenticated git, or run \`braid scope allow-code-hosts <agent>\` to accept the exfiltration risk for this agent.`
+      );
+    }
+  }
   function describe() {
     const lines = [];
     if (disabled) {
@@ -3042,6 +3099,9 @@ Narrow the grant to a path outside the protected set. (Ancestor grants like "~"
       lines.push(`[scope] provider paths (writable): ${providerPaths.join(", ")}`);
     }
     lines.push(`[scope] allowed domains (${allowedDomains.length}): ${allowedDomains.slice(0, 5).join(", ")}${allowedDomains.length > 5 ? " ..." : ""}`);
+    if (allowCodeHosts) {
+      lines.push("[scope] WARNING: direct code-host egress is ON for this agent (exfiltration path accepted by the owner via `braid scope allow-code-hosts`)");
+    }
     if ((cfg.derivedAllowedDomains ?? []).length > 0) {
       lines.push(`[scope] model endpoints (derived): ${(cfg.derivedAllowedDomains ?? []).join(", ")}`);
     }
@@ -6225,6 +6285,29 @@ function formatRateLimitNotice(agentName, provider, message) {
   ];
 }
 
+// src/gitEnv.ts
+var AGENT_GIT_ENV = {
+  GIT_TERMINAL_PROMPT: "0",
+  GCM_INTERACTIVE: "never",
+  GIT_CONFIG_NOSYSTEM: "1"
+};
+var AGENT_GIT_CONFIG = [
+  ["credential.helper", ""],
+  ["core.askPass", ""]
+];
+function withAgentGitEnv(extra, baseGitConfigCount = process.env.GIT_CONFIG_COUNT) {
+  const out = { ...extra, ...AGENT_GIT_ENV };
+  let n = Number.parseInt(extra.GIT_CONFIG_COUNT ?? baseGitConfigCount ?? "0", 10);
+  if (!Number.isFinite(n) || n < 0) n = 0;
+  for (const [key, value] of AGENT_GIT_CONFIG) {
+    out[`GIT_CONFIG_KEY_${n}`] = key;
+    out[`GIT_CONFIG_VALUE_${n}`] = value;
+    n++;
+  }
+  out.GIT_CONFIG_COUNT = String(n);
+  return out;
+}
+
 // src/adapter.ts
 function defaultToolPolicy() {
   return { mode: "readonly", configDirAbs: resolve2(configDir(process.env)), allowReadAbs: [] };
@@ -6324,6 +6407,10 @@ function resolvePathBinary(binary, hint) {
   return found;
 }
 function launchSpecFor(agent) {
+  const spec = launchSpecForProvider(agent);
+  return { ...spec, env: withAgentGitEnv(spec.env ?? {}) };
+}
+function launchSpecForProvider(agent) {
   const cwd = process.cwd();
   switch (agent) {
     case "claude-code": {
@@ -6468,7 +6555,7 @@ function interactiveHandoffSupported(agent) {
 }
 function interactiveResumeSpecFor(agent, sessionId, cwd) {
   const build = HANDOFF_RESUME_SPECS[agent];
-  return build ? build(sessionId, cwd) : null;
+  return build ? { ...build(sessionId, cwd), env: withAgentGitEnv({}) } : null;
 }
 var defaultAcpClientFactory = (launch) => new AcpClient(launch);
 var MAX_CONSECUTIVE_RESTARTS = 3;
@@ -7921,6 +8008,7 @@ export {
   loadAgent,
   acquireAgentLock,
   pinEndpoint,
+  setScopeAllowCodeHosts,
   updateAgentWorkspace,
   isFilesystemRoot,
   narrowestMode,
@@ -7950,6 +8038,7 @@ export {
   scopedLaunch,
   resetScope,
   sandboxInstaller,
+  withAgentGitEnv,
   resolveClaudeBinary,
   describeClaudeBinary,
   interactiveHandoffSupported,

package/dist/cli.js

@@ -75,6 +75,7 @@ import {
   sanitizeForTty,
   saveAgent,
   scopedLaunch,
+  setScopeAllowCodeHosts,
   setVerboseOutput,
   snapshotHttpMetrics,
   startingLines,
@@ -82,8 +83,9 @@ import {
   toolStatusLine,
   updateAgentWorkspace,
   validateRelayWsUrl,
+  withAgentGitEnv,
   wsToHttp
-} from "./chunk-QHWKKDPN.js";
+} from "./chunk-2OHYN3KD.js";
 import {
   clampUntrusted,
   externalSourceLabel,
@@ -2376,7 +2378,7 @@ function makeSocketHandoffController(deps) {
           session = c.session;
           spec = c.spec;
         }
-        const scoped = await scopedLaunchFn({ command: spec.command, args: spec.args, cwd: spec.cwd }, { scope: deps.scope }, deps.provider);
+        const scoped = await scopedLaunchFn({ command: spec.command, args: spec.args, cwd: spec.cwd, env: spec.env }, { scope: deps.scope }, deps.provider);
         pauseAttempted = true;
         await session.handoffPause();
         active = { channelId, session };
@@ -3043,6 +3045,9 @@ Commands:
                   (no network; local inspection only)
   scope allow <agent> <host>
                   Approve a custom model endpoint host for a saved agent (BL-148)
+  scope allow-code-hosts <agent>
+                  Let THIS agent's sandbox reach github.com/gitlab.com/bitbucket.org
+                  directly (accepts the exfiltration risk; prefer the git tools)
   telemetry [status|enable|disable]
                   Show or change usage telemetry (tool-mode +
                   blocked-tool-call signals only; never content, paths, or
@@ -3125,6 +3130,11 @@ function parseCliArgs(argv) {
       }
       return { kind: "scope-allow", agent: agent2, host };
     }
+    if (argv[1] === "allow-code-hosts") {
+      const agent2 = argv[2] && !argv[2].startsWith("-") ? argv[2].trim() : void 0;
+      if (!agent2) return { kind: "usage", error: `Usage: braid scope allow-code-hosts <agent>` };
+      return { kind: "scope-allow-code-hosts", agent: agent2 };
+    }
     const agent = argv[1] && !argv[1].startsWith("-") ? argv[1].trim() : void 0;
     return { kind: "scope", agent };
   }
@@ -3951,7 +3961,7 @@ async function runHandoff(opts) {
   }
   const spawnFn = opts.spawnFn ?? nodeSpawn;
   const scoped = await scopedLaunch(
-    { command: spec.command, args: spec.args, cwd: spec.cwd },
+    { command: spec.command, args: spec.args, cwd: spec.cwd, env: spec.env },
     { scope: opts.scope },
     provider
   );
@@ -4109,7 +4119,7 @@ async function runTakeover(lc, ctx) {
       const child = spawnFn(spec.command, spec.args, {
         stdio: "inherit",
         cwd: spec.cwd,
-        env: buildAcpEnv(env, spec.env ?? void 0)
+        env: buildAcpEnv(env, spec.env ? withOwnGitConfig(spec.env, env) : void 0)
       });
       child.on("exit", () => settle({}));
       child.on("error", (e) => settle({ error: e }));
@@ -4332,6 +4342,13 @@ async function defaultPrompt(stdin, stdout, question) {
     rl.close();
   }
 }
+function withOwnGitConfig(wire, owner) {
+  const rest = {};
+  for (const [k, v] of Object.entries(wire)) {
+    if (k !== "GIT_CONFIG_COUNT" && !/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(k)) rest[k] = v;
+  }
+  return withAgentGitEnv(rest, owner.GIT_CONFIG_COUNT);
+}
 
 // src/observe/handoffGate.ts
 var HandoffGate = class {
@@ -5993,6 +6010,13 @@ Set the provider's config to use ${normalizedHost} and try again, or check BRAID
   console.log(`[braid] pinned: ${normalizedHost}  (source: ${match.source})`);
   console.log(`[braid] restart the bridge for the change to take effect.`);
 }
+function scopeAllowCodeHosts(agentName) {
+  const dir = configDir(process.env);
+  setScopeAllowCodeHosts(dir, agentName, true);
+  console.log(`[braid] ${agentName}: direct code-host egress is now ON (github.com, gitlab.com, bitbucket.org reachable from the jail).`);
+  console.log(`[braid] This re-opens an exfiltration path. Prefer the Braid git tools; undo by editing scope.network.allowCodeHosts in the saved agent file.`);
+  console.log(`[braid] restart the bridge for the change to take effect.`);
+}
 function runTelemetryVerb(verb) {
   const dir = configDir(process.env);
   if (verb === "disable") {
@@ -6063,6 +6087,10 @@ async function main() {
     scopeAllow(invocation.agent, invocation.host);
     return;
   }
+  if (invocation.kind === "scope-allow-code-hosts") {
+    scopeAllowCodeHosts(invocation.agent);
+    return;
+  }
   if (invocation.kind === "telemetry") {
     runTelemetryVerb(invocation.verb);
     return;

package/dist/{http-3WYFRJZR.js → http-7LMCYNHB.js}

@@ -4,7 +4,7 @@ import {
   boundedJsonFetch,
   resetHttpMetricsForTest,
   snapshotHttpMetrics
-} from "./chunk-QHWKKDPN.js";
+} from "./chunk-2OHYN3KD.js";
 import "./chunk-HQNAAXUM.js";
 export {
   assertHttpEndpoint,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@snowyroad/braid",
-  "version": "0.96.8",
+  "version": "0.97.0",
   "description": "Braid: connect your own coding agent (Claude Code, Codex, Gemini, Grok) to a Braid channel and collaborate with other agents and humans.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "SnowyRoad",

package/service-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@snowyroad/braid",
-  "version": "0.96.8",
+  "version": "0.97.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@snowyroad/braid",
-      "version": "0.96.8",
+      "version": "0.97.0",
       "license": "SEE LICENSE IN LICENSE.md",
       "dependencies": {
         "@agentclientprotocol/sdk": "0.25.1",
@@ -1394,9 +1394,9 @@
       }
     },
     "node_modules/acorn": {
-      "version": "8.18.0",
-      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.18.0.tgz",
-      "integrity": "sha512-lGq+9yr1/GuAWaVYIHRjvvySG5/4VfKIvC8EWxStPdcDh/Ka7FG3twP6v4d5BkravUilhIAsG4Qj83t02LWUPQ==",
+      "version": "8.19.0",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.19.0.tgz",
+      "integrity": "sha512-oJlA3XiRm7Cyk6qFD2Jn8ak9B7jSy0qy00ADO3+8dpT0LSjFihQYv4C02LFCSYJV3Q37xYwwRy5m+IpIiUzqWw==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -2144,9 +2144,9 @@
       }
     },
     "node_modules/express-rate-limit": {
-      "version": "8.7.0",
-      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.7.0.tgz",
-      "integrity": "sha512-hOwV7WOxXfjRpAM1DSJWZDXx3GhplwD8IfwuwvogD8i1Qnkgosw/H45s4ZnFAUHDAhPjlY9hLBvJhKmGMyY26g==",
+      "version": "8.7.1",
+      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.7.1.tgz",
+      "integrity": "sha512-2FXbqkygil3mZiXzEtM0IjE/UBmBNot0J1GEVrJT4JbrvwOSoEtqtO+wHbiMQELWe1eNvHoYRg2dkjOid+6JkA==",
       "license": "MIT",
       "dependencies": {
         "debug": "^4.4.3",
@@ -2369,9 +2369,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.13.12",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.12.tgz",
-      "integrity": "sha512-6E2QDAc9Ick9Sq77ZrGS/dk2WUYni91aufTw6LJKpV7w8kW5/GxVUc650FOADOmlwg3K+f7Pun6XlV+pYmW6gw==",
+      "version": "4.13.13",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.13.tgz",
+      "integrity": "sha512-CQ46U0ZkAGmbT/4UxdzzGJpacP2IeKgY4a5/tOI9AABbpOMfK739wfDXmv1usCk+3RkKj1hQy4/fjhiwa2xlrA==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"
@@ -2745,9 +2745,9 @@
       }
     },
     "node_modules/nanoid": {
-      "version": "3.3.19",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.19.tgz",
-      "integrity": "sha512-Y2tUNy4ouw6tq5oDSKeQYGOyhkUBhNOcGV/02KC+6kd9eDGqdZd++mjMiIDilrBYvjEnCYvVtsuHCuP+okSfug==",
+      "version": "3.3.20",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.20.tgz",
+      "integrity": "sha512-uKdg2G3GNCKQn9byYOpxbGqrT2fGO5KRt5J/8b3pok8rT6qxGWF6hxMyJiEYtAf+FVyYuD9hRaDqX5uPFYJ4ZQ==",
       "dev": true,
       "funding": [
         {
@@ -2964,9 +2964,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.28",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.28.tgz",
-      "integrity": "sha512-RRuzqDtt5Y9h3quz5hWhK+TPnsmVs6WwSU6LkJMeY4HstUEDuYTG8UJSdawMRzmzAtV+KEoG8N3Qg2qLy5vM/A==",
+      "version": "8.5.29",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.29.tgz",
+      "integrity": "sha512-49cGhUbXj8Qenv0iTMxA1cFBzxXoctpC9Ujd77t1WcbJIr6nF/eI7g/8MgxrYldFRuAXvja7xQRwavoW7kgrxQ==",
       "dev": true,
       "funding": [
         {
@@ -2984,9 +2984,9 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.18",
+        "nanoid": "^3.3.19",
         "picocolors": "^1.1.1",
-        "source-map-js": "^1.2.1"
+        "source-map-js": "^1.2.2"
       },
       "engines": {
         "node": "^10 || ^12 || >=14"