cdx-manager 0.24.5 → 0.24.7

package/README.md

@@ -4,7 +4,7 @@
 
 <br clear="left"/>
 
-[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.24.5-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
+[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.24.7-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
 
 **The right AI coding account, when you need it.** CDX Manager keeps your Codex and Claude accounts in separate profiles, shows which ones have quota, and helps you pick the next usable session from your terminal.
 

package/VERSION

@@ -1 +1 @@
-0.24.5
+0.24.7

package/changelogs/CHANGELOGS_0_24_6.md

@@ -0,0 +1,16 @@
+# CDX Manager 0.24.6
+
+Release date: 2026-10-29
+
+This patch gives isolated online workspace runs their own egress-only network. (#63)
+
+## Workspace runs
+
+- Use a dedicated pasta network namespace for online `--isolate-workspace` runs, including provider transport, with port relays and host gateway mapping disabled. (#63)
+- Apply nftables output filtering to reject loopback, private, link-local, and tailnet destination ranges, and use public DNS resolvers. (#63)
+- Fail closed when pasta (passt), nftables, or Python 3 is unavailable, without falling back to the host network. (#63)
+
+## Maintenance
+
+- Record tray companion checksums for v0.24.5. (`78ba34dd71a19ac392feda771737705a72c765e5`)
+- Record release archive checksums for v0.24.5. (`f835adb7acc495133438c6e719fa452843109d58`)

package/changelogs/CHANGELOGS_0_24_7.md

@@ -0,0 +1,15 @@
+# CDX Manager 0.24.7
+
+Release date: 2026-10-29
+
+This patch fixes command execution in isolated Codex workspace runs. (#65)
+
+## Workspace runs
+
+- Drop Codex's nested sandbox when `--isolate-workspace` is enabled, avoiding the user namespace mapping failure that prevented commands from running. The outer workspace sandbox remains the isolation boundary. (#65)
+- Remove Codex's sandbox mode and network overrides inside the isolated workspace and pass `--dangerously-bypass-approvals-and-sandbox`; the outer sandbox controls network access and keeps review runs read-only through its workspace mount. (#65)
+
+## Maintenance
+
+- Record tray companion checksums for v0.24.6. (`87aba5d2cffdfb1a96e386abcdabe54df9ee4808`)
+- Record release archive checksums for v0.24.6. (`6b92094143ea28bf0cc096aef88d1015565aba18`)

package/checksums/release-archives.json

@@ -628,6 +628,28 @@
         "x86_64-pc-windows-msvc": "1fd621d4ba7175c868c4e598850c5f5ccd914c91aaef3d79024376082e8fe81d",
         "x86_64-unknown-linux-musl": "f4c3a6e7c2af75cd8214609971fe2cbef6f34e818796d70b661d9a9f7e9327af"
       }
+    },
+    "v0.24.5": {
+      "github_tarball_sha256": "0e34b1c67f3357d1551a2cce1187efb84cfb737163e91b3ae4e448f9bd2fee08",
+      "github_zip_sha256": "0f1242f234392f003fe6ed61206d4b931d72887f875cd0a60b20199a2f5745a6",
+      "tray_assets": {
+        "aarch64-apple-darwin": "6847d3f6b66137157896ec901b47a3b48913f78390b3fff50d1d59c85151e748",
+        "aarch64-unknown-linux-musl": "6f167515cdc0914b1d04ceee0ea60e28de57d2321d4073912409a6d9266c6185",
+        "x86_64-apple-darwin": "16a9bfc33fe03b771bdb7ffd417ce222785062f342c1c599bdda2a3fc7200841",
+        "x86_64-pc-windows-msvc": "74124b2e40a58a58b55724ef453c4b543a83eefab9a5f92685b239c5d97e7f67",
+        "x86_64-unknown-linux-musl": "089e552a4dfae4080a2e76cedb6fe72fc8013a9cd08cf3c8b333f916198da57c"
+      }
+    },
+    "v0.24.6": {
+      "github_tarball_sha256": "4b61861ae26fc7904e751571b65d0783c16dcf35d3b485379434469e27511fb4",
+      "github_zip_sha256": "6c5cfa2139eb53a20a8eca8624437a06b18392b0df7774d9c7c64a74b8066f59",
+      "tray_assets": {
+        "aarch64-apple-darwin": "7200f658e3413b2614a7ffa5d03e1dac173fc1a653dc659d92f2bef40f2bf5d4",
+        "aarch64-unknown-linux-musl": "b892a9a3bf009e5069dc798ab910b20e77ac9d03b9b575a80cb19af1dc13533a",
+        "x86_64-apple-darwin": "d1e1b619feab8eae1e2a25e17942d8d690fc1e6184f294599a15858a1f0c146e",
+        "x86_64-pc-windows-msvc": "0d125d8e0f7d9880a2ed9e0a794964f3d69ef3353b90a1d594b17f9392a0a0af",
+        "x86_64-unknown-linux-musl": "d6c369ace10a6d373366cd12e4e6cd7f2fd278fbce2fd9a13c5bf51047847441"
+      }
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cdx-manager",
-  "version": "0.24.5",
+  "version": "0.24.7",
   "description": "Terminal session manager for Codex and Claude accounts.",
   "license": "MIT",
   "author": "Alexandre Agostini",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cdx-manager"
-version = "0.24.5"
+version = "0.24.7"
 description = "Terminal session manager for Codex and Claude accounts."
 readme = "README.md"
 requires-python = ">=3.9"

package/src/provider_runtime.py

@@ -1212,7 +1212,10 @@ def _run_headless_provider_command(session, cwd=None, env_override=None, initial
     )
     launch = session.get("launch") or {}
     if launch.get("network_access"):
-        if session.get("provider") == PROVIDER_CODEX:
+        if session.get("provider") == PROVIDER_CODEX and launch.get("isolate_workspace"):
+            # The outer sandbox owns the network; Codex's own sandbox is dropped below.
+            pass
+        elif session.get("provider") == PROVIDER_CODEX:
             # Keep the workspace sandbox; append overrides before the prompt separator.
             index = spec["args"].index("--") if "--" in spec["args"] else len(spec["args"])
             spec["args"][index:index] = ["-c", 'sandbox_workspace_write.network_access=true', '-c', 'sandbox_workspace_write.writable_roots=["/cache", "/home/agent"]']
@@ -1226,6 +1229,17 @@ def _run_headless_provider_command(session, cwd=None, env_override=None, initial
             # The outer OS sandbox is the permission boundary for unattended Bash.
             index = spec["args"].index("--") if "--" in spec["args"] else len(spec["args"])
             spec["args"][index:index] = ["--permission-mode", "bypassPermissions"]
+        elif session.get("provider") == PROVIDER_CODEX:
+            # Codex's bubblewrap sandbox cannot nest inside ours (no uid map), so the
+            # outer box is the boundary: drop `-s <mode>` and bypass the inner one.
+            # A review run stays read-only through the outer mount.
+            args = spec["args"]
+            while "-s" in args:
+                index = args.index("-s")
+                del args[index:index + 2]
+            if "--dangerously-bypass-approvals-and-sandbox" not in args:
+                index = args.index("--") if "--" in args else len(args)
+                args[index:index] = ["--dangerously-bypass-approvals-and-sandbox"]
         try:
             argv, child_env = sandbox_command(
                 [spec["command"], *spec["args"]], Path(cwd),

package/src/workspace_sandbox.py

@@ -11,6 +11,41 @@ from pathlib import Path
 
 CACHE = Path.home() / ".cdx" / "shared-cache"
 
+# Installed before any untrusted command, in the namespace owned by pasta.
+NETWORK_RULES = """table inet mission_egress {
+    chain output {
+        type filter hook output priority 0; policy accept;
+        oif "lo" accept
+        ip daddr { 0.0.0.0/8, 10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8,
+                   169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16 } reject
+        ip6 daddr { ::1, fc00::/7, fe80::/10 } reject
+    }
+}
+"""
+PUBLIC_RESOLV_CONF = "nameserver 1.1.1.1\nnameserver 9.9.9.9\n"
+
+# Keep the trusted setup outside the agent's filesystem/PID/user namespaces.
+NETWORK_SETUP = """
+import pathlib
+import subprocess
+import sys
+import tempfile
+try:
+    subprocess.run([sys.argv[1], "-f", "-"], input=RULES, text=True,
+                   check=True, timeout=15)
+    with tempfile.TemporaryDirectory(prefix="mission-dns-") as directory:
+        resolver = pathlib.Path(directory) / "resolv.conf"
+        resolver.write_text(RESOLVER)
+        args = sys.argv[2:]
+        index = args.index("--")
+        args[index:index] = ["--ro-bind", str(resolver), "/etc/resolv.conf"]
+        status = subprocess.call(args)
+except (OSError, subprocess.SubprocessError) as error:
+    print("Isolated mission network setup failed: " + str(error), file=sys.stderr)
+    sys.exit(1)
+sys.exit(status)
+"""
+
 
 def clean_env(source: dict) -> dict:
     allowed = ("PATH", "LANG", "LC_ALL", "TERM", "TZ")
@@ -36,10 +71,20 @@ def sandbox_command(command: list[str], tree: Path, *, network: bool, writable:
         raise RuntimeError("Workspace must be a directory")
     tree = tree.resolve()
     CACHE.mkdir(parents=True, exist_ok=True)
-    args = [bwrap, "--die-with-parent", "--new-session", "--unshare-all", "--cap-drop", "ALL"]
-    # The provider needs transport even when its own tool sandbox denies network.
-    if network or provider:
-        args += ["--share-net"]
+    # Provider transport uses the same restricted egress, even for read-only tools.
+    online = bool(network or provider)
+    if online:
+        pasta = shutil.which("pasta", path=source.get("PATH"))
+        nft = shutil.which("nft", path=os.defpath + ":/usr/sbin:/sbin")
+        python = shutil.which("python3", path=source.get("PATH"))
+        if not pasta or not nft or not python:
+            raise RuntimeError("Isolated mission networking requires pasta (passt), nftables and python3; no shared-network fallback")
+    args = [bwrap, "--die-with-parent", "--new-session"]
+    # pasta already created the network namespace. A new child user namespace and
+    # dropped capabilities prevent the agent from changing its ancestor's nft rules.
+    args += (["--unshare-user", "--unshare-ipc", "--unshare-pid", "--unshare-uts", "--unshare-cgroup"]
+             if online else ["--unshare-all"])
+    args += ["--cap-drop", "ALL"]
     args += ["--proc", "/proc", "--dev", "/dev", "--tmpfs", "/tmp", "--dir", "/home/agent"]
     # An allowlist avoids overlooking another secret file or a credential symlink.
     paths = [Path(p) for p in ("/usr", "/bin", "/sbin", "/lib", "/lib64")]
@@ -51,7 +96,7 @@ def sandbox_command(command: list[str], tree: Path, *, network: bool, writable:
             args += ["--ro-bind", str(path), str(path)]
     for path in ("/etc/ssl", "/etc/resolv.conf", "/etc/hosts", "/etc/nsswitch.conf", "/etc/ld.so.cache",
                  "/etc/fonts", "/etc/passwd", "/etc/group", "/etc/alternatives"):
-        if Path(path).exists():
+        if Path(path).exists() and not (online and path == "/etc/resolv.conf"):
             args += ["--ro-bind", path, path]
     # Fail closed for a provider installed outside the explicitly permitted toolchains.
     resolved = Path(binary).resolve()
@@ -91,4 +136,10 @@ def sandbox_command(command: list[str], tree: Path, *, network: bool, writable:
     elif provider:
         raise RuntimeError("Unsupported isolated provider: " + provider)
     args += ["--chdir", str(tree), "--", binary, *command[1:]]
+    if online:
+        setup = "RULES = " + repr(NETWORK_RULES) + "\nRESOLVER = " + repr(PUBLIC_RESOLV_CONF) + "\n" + NETWORK_SETUP
+        # Disable both directions explicitly: automatic host-loopback splicing
+        # bypasses output filtering unless -T/-U are also disabled.
+        args = [pasta, "--config-net", "--no-map-gw", "-t", "none", "-u", "none",
+                "-T", "none", "-U", "none", "-q", "--", python, "-I", "-c", setup, nft, *args]
     return args, env