cdx-manager 0.24.4 → 0.24.6

package/README.md

@@ -4,7 +4,7 @@
 
 <br clear="left"/>
 
-[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.24.4-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
+[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.24.6-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
 
 **The right AI coding account, when you need it.** CDX Manager keeps your Codex and Claude accounts in separate profiles, shows which ones have quota, and helps you pick the next usable session from your terminal.
 

package/VERSION

@@ -1 +1 @@
-0.24.4
+0.24.6

package/changelogs/CHANGELOGS_0_24_5.md

@@ -0,0 +1,16 @@
+# CDX Manager 0.24.5
+
+Release date: 2026-10-29
+
+This patch adds isolated workspace runs with opt-in network access. (#61)
+
+## Workspace runs
+
+- Add `cdx run --isolate-workspace` for Linux workspace confinement through bubblewrap, exposing the checkout, permitted toolchains, shared caches, and provider authentication while keeping the operator's home and host processes outside the boundary. (#61)
+- Add `--network-access` to enable Codex's workspace-write network setting while retaining its workspace sandbox. (#61)
+- Preserve both options across detached runs and failover, and advertise `workspace_isolation` and `workspace_network` capabilities in `cdx schema`. (#61)
+
+## Maintenance
+
+- Record tray companion checksums for v0.24.4. (`7465b2e8244e90032d1ab8b7ad7af6a26ffe805c`)
+- Record release archive checksums for v0.24.4. (`a0afa21ccc816769fb0aac5883912efd90bf1028`)

package/changelogs/CHANGELOGS_0_24_6.md

@@ -0,0 +1,16 @@
+# CDX Manager 0.24.6
+
+Release date: 2026-10-29
+
+This patch gives isolated online workspace runs their own egress-only network. (#63)
+
+## Workspace runs
+
+- Use a dedicated pasta network namespace for online `--isolate-workspace` runs, including provider transport, with port relays and host gateway mapping disabled. (#63)
+- Apply nftables output filtering to reject loopback, private, link-local, and tailnet destination ranges, and use public DNS resolvers. (#63)
+- Fail closed when pasta (passt), nftables, or Python 3 is unavailable, without falling back to the host network. (#63)
+
+## Maintenance
+
+- Record tray companion checksums for v0.24.5. (`78ba34dd71a19ac392feda771737705a72c765e5`)
+- Record release archive checksums for v0.24.5. (`f835adb7acc495133438c6e719fa452843109d58`)

package/checksums/release-archives.json

@@ -617,6 +617,28 @@
         "x86_64-pc-windows-msvc": "6da838217c01251b809bac1e188217dcfbb00c2102b901cfda43cf2fc0696aa2",
         "x86_64-unknown-linux-musl": "c6651dd909d486c2b0bb209e0d813ab044dc7b5ffb1a07078c8ec7a69126e028"
       }
+    },
+    "v0.24.4": {
+      "github_tarball_sha256": "279d60a1073f56ac1ccc361248c14668e9e018d81dd56e4eb177cb3f4bac4cf6",
+      "github_zip_sha256": "05dd935dc0e8e686a1dce96c0543b91757995a5f49ae2aed1155ddf97916e55d",
+      "tray_assets": {
+        "aarch64-apple-darwin": "9fdcddf98e9723f2af2007f0c0a183644b2200e599c33d354c097e2510a3901b",
+        "aarch64-unknown-linux-musl": "eef61a80c0d1107de9dfb980fb5914d85ec3b0a5d640ff559bf8e7faa4e857bd",
+        "x86_64-apple-darwin": "3296ee96b17442d8a2d8eaee6ceeba90dc498c74168973a6932793fa509afc66",
+        "x86_64-pc-windows-msvc": "1fd621d4ba7175c868c4e598850c5f5ccd914c91aaef3d79024376082e8fe81d",
+        "x86_64-unknown-linux-musl": "f4c3a6e7c2af75cd8214609971fe2cbef6f34e818796d70b661d9a9f7e9327af"
+      }
+    },
+    "v0.24.5": {
+      "github_tarball_sha256": "0e34b1c67f3357d1551a2cce1187efb84cfb737163e91b3ae4e448f9bd2fee08",
+      "github_zip_sha256": "0f1242f234392f003fe6ed61206d4b931d72887f875cd0a60b20199a2f5745a6",
+      "tray_assets": {
+        "aarch64-apple-darwin": "6847d3f6b66137157896ec901b47a3b48913f78390b3fff50d1d59c85151e748",
+        "aarch64-unknown-linux-musl": "6f167515cdc0914b1d04ceee0ea60e28de57d2321d4073912409a6d9266c6185",
+        "x86_64-apple-darwin": "16a9bfc33fe03b771bdb7ffd417ce222785062f342c1c599bdda2a3fc7200841",
+        "x86_64-pc-windows-msvc": "74124b2e40a58a58b55724ef453c4b543a83eefab9a5f92685b239c5d97e7f67",
+        "x86_64-unknown-linux-musl": "089e552a4dfae4080a2e76cedb6fe72fc8013a9cd08cf3c8b333f916198da57c"
+      }
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cdx-manager",
-  "version": "0.24.4",
+  "version": "0.24.6",
   "description": "Terminal session manager for Codex and Claude accounts.",
   "license": "MIT",
   "author": "Alexandre Agostini",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cdx-manager"
-version = "0.24.4"
+version = "0.24.6"
 description = "Terminal session manager for Codex and Claude accounts."
 readme = "README.md"
 requires-python = ">=3.9"

package/src/cli_args.py

@@ -47,7 +47,7 @@ CAN_RESUME_USAGE = "Usage: cdx can-resume <name> [--conversation <id>] [--json]"
 SESSIONS_USAGE = "Usage: cdx sessions [--all] --json"
 SELECT_USAGE = "Usage: cdx select --provider PROVIDER [--min-reasoning-effort minimal|low|medium|high|xhigh] [--min-power minimal|low|medium|high|xhigh] [--require-ready] [--refresh] --json"
 NEXT_USAGE = "Usage: cdx next [--json] [--refresh]"
-RUN_USAGE = "Usage: cdx run [session] (--cwd|--dir) PATH (--prompt-file PATH|--prompt TEXT|--prompt-file -) [--provider PROVIDER] [--model MODEL] [--kind assistant|code-review|retro] [--reasoning-effort minimal|low|medium|high|xhigh] [--power minimal|low|medium|high|xhigh] [--permission review|default|auto|full|workspace-write|read-only|danger-full-access] [--timeout-seconds N] [--label TEXT] [--max-parallel N] [--detach] [--failover] [--refresh] --json"
+RUN_USAGE = "Usage: cdx run [session] (--cwd|--dir) PATH (--prompt-file PATH|--prompt TEXT|--prompt-file -) [--provider PROVIDER] [--model MODEL] [--kind assistant|code-review|retro] [--reasoning-effort minimal|low|medium|high|xhigh] [--power minimal|low|medium|high|xhigh] [--permission review|default|auto|full|workspace-write|read-only|danger-full-access] [--network-access] [--isolate-workspace] [--timeout-seconds N] [--label TEXT] [--max-parallel N] [--detach] [--failover] [--refresh] --json"
 RUN_JSON_REQUIRED = "cdx run: --json is required."
 RUN_TARGET_REQUIRED = "cdx run: specify a session name or --provider PROVIDER."
 RUN_SESSION_PROVIDER_CONFLICT = "cdx run: cannot specify both a session name and --provider."
@@ -475,6 +475,7 @@ def cdx_schema():
     # No `schema_version` here: the JSON envelope already carries it, and two
     # keys of that name in one payload would be one too many.
     return {
+        "capabilities": {"workspace_isolation": 1, "workspace_network": 1},
         "enums": {
             "permission": {
                 "accepted": list(RUN_PERMISSION_VALUES),
@@ -665,6 +666,8 @@ def _parse_run_args(args):
         "--permission": {"key": "permission", "type": "str", "default": None, "transform": _normalize_run_permission},
         "--timeout-seconds": {"key": "timeout_seconds", "type": "str", "default": None, "transform": _parse_run_timeout_seconds},
         "--detach": {"key": "detach", "type": "bool", "default": False},
+        "--network-access": {"key": "network_access", "type": "bool", "default": False},
+        "--isolate-workspace": {"key": "isolate_workspace", "type": "bool", "default": False},
         "--failover": {"key": "failover", "type": "bool", "default": False},
         "--refresh": {"key": "refresh", "type": "bool", "default": False},
         "--label": {"key": "label", "type": "str", "default": None},
@@ -716,6 +719,8 @@ def _parse_run_args(args):
         "permission": parsed["permission"],
         "timeout_seconds": parsed["timeout_seconds"],
         "detach": parsed["detach"],
+        "network_access": parsed["network_access"],
+        "isolate_workspace": parsed["isolate_workspace"],
         "failover": parsed["failover"],
         "label": parsed["label"],
         "max_parallel": parsed["max_parallel"],

package/src/commands/runs.py

@@ -206,8 +206,9 @@ def _detached_child_argv(parsed, prompt_path, session_name, cwd):
         argv += ["--timeout-seconds", str(parsed["timeout_seconds"])]
     # The child is the supervisor: it watches the run like any blocking one, so
     # it applies the failover rule and records each move in the registry.
-    if parsed.get("failover"):
-        argv.append("--failover")
+    for key in ("network_access", "isolate_workspace", "failover"):
+        if parsed.get(key):
+            argv.append("--" + key.replace("_", "-"))
     argv.append("--json")
     return argv
 
@@ -572,7 +573,7 @@ def handle_run(rest, ctx):
             raise CdxError(f"Invalid cwd: {parsed['cwd']}", code="invalid_cwd")
         prompt = read_run_prompt(parsed, stdin=ctx.get("prompt_stdin"))
         _consume_detached_prompt_file(parsed, detached_run_id)
-        launch_updates = {}
+        launch_updates = {key: parsed.get(key, False) for key in ("network_access", "isolate_workspace")}
         if parsed.get("model"):
             launch_updates["model"] = parsed["model"]
         if parsed.get("permission"):
@@ -643,7 +644,7 @@ def handle_run(rest, ctx):
             launch = None
             # A provider's own background agent has no cdx process watching it,
             # so nothing could fail it over; --failover keeps the in-house child.
-            if not parsed.get("failover") and supports_native_background(
+            if not parsed.get("isolate_workspace") and not parsed.get("network_access") and not parsed.get("failover") and supports_native_background(
                 run_session.get("provider"),
                 env=ctx.get("env"),
                 spawn_sync=ctx.get("spawn_text"),

package/src/provider_runtime.py

@@ -1210,6 +1210,33 @@ def _run_headless_provider_command(session, cwd=None, env_override=None, initial
         env_override=env_override,
         initial_prompt=initial_prompt,
     )
+    launch = session.get("launch") or {}
+    if launch.get("network_access"):
+        if session.get("provider") == PROVIDER_CODEX:
+            # Keep the workspace sandbox; append overrides before the prompt separator.
+            index = spec["args"].index("--") if "--" in spec["args"] else len(spec["args"])
+            spec["args"][index:index] = ["-c", 'sandbox_workspace_write.network_access=true', '-c', 'sandbox_workspace_write.writable_roots=["/cache", "/home/agent"]']
+        elif session.get("provider") != PROVIDER_CLAUDE:
+            raise CdxError("Network override is unsupported for this provider")
+    if launch.get("isolate_workspace"):
+        from pathlib import Path
+
+        from .workspace_sandbox import sandbox_command
+        if session.get("provider") == PROVIDER_CLAUDE:
+            # The outer OS sandbox is the permission boundary for unattended Bash.
+            index = spec["args"].index("--") if "--" in spec["args"] else len(spec["args"])
+            spec["args"][index:index] = ["--permission-mode", "bypassPermissions"]
+        try:
+            argv, child_env = sandbox_command(
+                [spec["command"], *spec["args"]], Path(cwd),
+                network=launch.get("network_access", False),
+                writable=launch.get("permission") != "review",
+                source=spec["options"]["env"], auth_home=_get_auth_home(session),
+                provider=session.get("provider"))
+        except (OSError, RuntimeError) as error:
+            raise CdxError(str(error)) from error
+        spec.update(command=argv[0], args=argv[1:])
+        spec["options"]["env"] = child_env
     paths = _headless_artifact_paths(session, run_id=run_id)
     start_time = datetime.now(timezone.utc)
     command = spec["command"]

package/src/run_command.py

@@ -133,7 +133,7 @@ def run_warnings(parsed, session, selection_row=None):
         })
     provider = session.get("provider") if session else parsed.get("provider")
     permission = run_effective_permission(parsed, session)
-    if headless_permission_disables_network(provider, permission):
+    if not parsed.get("network_access") and headless_permission_disables_network(provider, permission):
         described = repr(permission) if permission else "its default (none set)"
         warnings.append({
             "code": "network_disabled_by_permission",

package/src/workspace_sandbox.py

@@ -0,0 +1,145 @@
+"""Linux workspace confinement shared with the cdx-manager integration patch.
+
+Expose tools, caches and one checkout, never the operator's home or host processes.
+Provider authentication is the only credential deliberately passed to the provider.
+"""
+from __future__ import annotations
+
+import os
+import shutil
+from pathlib import Path
+
+CACHE = Path.home() / ".cdx" / "shared-cache"
+
+# Installed before any untrusted command, in the namespace owned by pasta.
+NETWORK_RULES = """table inet mission_egress {
+    chain output {
+        type filter hook output priority 0; policy accept;
+        oif "lo" accept
+        ip daddr { 0.0.0.0/8, 10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8,
+                   169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16 } reject
+        ip6 daddr { ::1, fc00::/7, fe80::/10 } reject
+    }
+}
+"""
+PUBLIC_RESOLV_CONF = "nameserver 1.1.1.1\nnameserver 9.9.9.9\n"
+
+# Keep the trusted setup outside the agent's filesystem/PID/user namespaces.
+NETWORK_SETUP = """
+import pathlib
+import subprocess
+import sys
+import tempfile
+try:
+    subprocess.run([sys.argv[1], "-f", "-"], input=RULES, text=True,
+                   check=True, timeout=15)
+    with tempfile.TemporaryDirectory(prefix="mission-dns-") as directory:
+        resolver = pathlib.Path(directory) / "resolv.conf"
+        resolver.write_text(RESOLVER)
+        args = sys.argv[2:]
+        index = args.index("--")
+        args[index:index] = ["--ro-bind", str(resolver), "/etc/resolv.conf"]
+        status = subprocess.call(args)
+except (OSError, subprocess.SubprocessError) as error:
+    print("Isolated mission network setup failed: " + str(error), file=sys.stderr)
+    sys.exit(1)
+sys.exit(status)
+"""
+
+
+def clean_env(source: dict) -> dict:
+    allowed = ("PATH", "LANG", "LC_ALL", "TERM", "TZ")
+    env = {key: source[key] for key in allowed if key in source}
+    env.update(HOME="/home/agent", XDG_CONFIG_HOME="/home/agent/.config",
+               XDG_CACHE_HOME="/cache", GIT_CONFIG_NOSYSTEM="1",
+               GIT_CONFIG_GLOBAL="/dev/null", GIT_TERMINAL_PROMPT="0", GIT_OPTIONAL_LOCKS="0",
+               GIT_CONFIG_COUNT="1", GIT_CONFIG_KEY_0="credential.helper", GIT_CONFIG_VALUE_0="",
+               GH_CONFIG_DIR="/home/agent/.config/gh", NPM_CONFIG_CACHE="/cache/npm",
+               PIP_CACHE_DIR="/cache/pip", UV_CACHE_DIR="/cache/uv",
+               PLAYWRIGHT_BROWSERS_PATH="/cache/playwright", CI="1")
+    return env
+
+
+def sandbox_command(command: list[str], tree: Path, *, network: bool, writable: bool = True,
+                    source: dict | None = None, auth_home: str = "", provider: str = "") -> tuple[list[str], dict]:
+    source = os.environ if source is None else source
+    binary = shutil.which(command[0], path=source.get("PATH"))
+    bwrap = shutil.which("bwrap", path=source.get("PATH"))
+    if not binary or not bwrap:
+        raise RuntimeError("Workspace isolation requires bubblewrap and " + command[0])
+    if tree.is_symlink() or not tree.is_dir():
+        raise RuntimeError("Workspace must be a directory")
+    tree = tree.resolve()
+    CACHE.mkdir(parents=True, exist_ok=True)
+    # Provider transport uses the same restricted egress, even for read-only tools.
+    online = bool(network or provider)
+    if online:
+        pasta = shutil.which("pasta", path=source.get("PATH"))
+        nft = shutil.which("nft", path=os.defpath + ":/usr/sbin:/sbin")
+        python = shutil.which("python3", path=source.get("PATH"))
+        if not pasta or not nft or not python:
+            raise RuntimeError("Isolated mission networking requires pasta (passt), nftables and python3; no shared-network fallback")
+    args = [bwrap, "--die-with-parent", "--new-session"]
+    # pasta already created the network namespace. A new child user namespace and
+    # dropped capabilities prevent the agent from changing its ancestor's nft rules.
+    args += (["--unshare-user", "--unshare-ipc", "--unshare-pid", "--unshare-uts", "--unshare-cgroup"]
+             if online else ["--unshare-all"])
+    args += ["--cap-drop", "ALL"]
+    args += ["--proc", "/proc", "--dev", "/dev", "--tmpfs", "/tmp", "--dir", "/home/agent"]
+    # An allowlist avoids overlooking another secret file or a credential symlink.
+    paths = [Path(p) for p in ("/usr", "/bin", "/sbin", "/lib", "/lib64")]
+    home = Path.home()
+    paths += [home / ".nvm", home / ".local/bin", home / ".local/share/claude",
+              home / ".local/share/uv"]
+    for path in paths:
+        if path.exists():
+            args += ["--ro-bind", str(path), str(path)]
+    for path in ("/etc/ssl", "/etc/resolv.conf", "/etc/hosts", "/etc/nsswitch.conf", "/etc/ld.so.cache",
+                 "/etc/fonts", "/etc/passwd", "/etc/group", "/etc/alternatives"):
+        if Path(path).exists() and not (online and path == "/etc/resolv.conf"):
+            args += ["--ro-bind", path, path]
+    # Fail closed for a provider installed outside the explicitly permitted toolchains.
+    resolved = Path(binary).resolve()
+    if not any(resolved.is_relative_to(p.resolve()) for p in paths if p.exists()):
+        raise RuntimeError("Executable is outside the permitted toolchains: " + str(resolved))
+    args += ["--bind", str(CACHE), "/cache", "--bind" if writable else "--ro-bind", str(tree), str(tree)]
+    marker = tree / ".git"
+    if marker.is_file():
+        text = marker.read_text().strip()
+        if marker.is_symlink() or not text.startswith("gitdir: "):
+            raise RuntimeError("Invalid worktree Git marker")
+        gitdir = (tree / text.removeprefix("gitdir: ")).resolve()
+        common = (gitdir / (gitdir / "commondir").read_text().strip()).resolve()
+        # A writable marker must never turn into an arbitrary host-directory mount.
+        if (common.name != ".git" or gitdir.parent != common / "worktrees"
+                or common.is_relative_to(tree) or common.is_relative_to(CACHE.resolve())
+                or Path((gitdir / "gitdir").read_text().strip()).resolve() != marker):
+            raise RuntimeError("Invalid external worktree Git directory")
+        args += ["--ro-bind", str(marker), str(marker), "--ro-bind", str(common), str(common),
+                 "--tmpfs", str(common / "worktrees"), "--ro-bind", str(gitdir), str(gitdir),
+                 "--ro-bind", "/dev/null", str(common / "config"),
+                 "--tmpfs", str(common / "hooks")]
+        if (gitdir / "config.worktree").exists():
+            args += ["--ro-bind", "/dev/null", str(gitdir / "config.worktree")]
+    elif marker.exists():
+        raise RuntimeError("Expected an isolated git worktree")
+    env = clean_env(source)
+    if provider == "codex":
+        env["CODEX_HOME"] = "/home/agent/.codex"
+        args += ["--ro-bind", str(Path(auth_home) / "auth.json"), "/home/agent/.codex/auth.json"]
+    elif provider == "claude":
+        token = source.get("CLAUDE_CODE_OAUTH_TOKEN")
+        if not token:
+            raise RuntimeError("Isolated Claude runs require a cdx OAuth setup token")
+        env.update(CLAUDE_CODE_OAUTH_TOKEN=token, CLAUDE_CODE_SUBPROCESS_ENV_SCRUB="1",
+                   CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC="1")
+    elif provider:
+        raise RuntimeError("Unsupported isolated provider: " + provider)
+    args += ["--chdir", str(tree), "--", binary, *command[1:]]
+    if online:
+        setup = "RULES = " + repr(NETWORK_RULES) + "\nRESOLVER = " + repr(PUBLIC_RESOLV_CONF) + "\n" + NETWORK_SETUP
+        # Disable both directions explicitly: automatic host-loopback splicing
+        # bypasses output filtering unless -T/-U are also disabled.
+        args = [pasta, "--config-net", "--no-map-gw", "-t", "none", "-u", "none",
+                "-T", "none", "-U", "none", "-q", "--", python, "-I", "-c", setup, nft, *args]
+    return args, env