pi-microsandbox 0.1.1 → 0.3.0

package/extensions/pi-msb/config.ts

@@ -1,6 +1,6 @@
 import { promises as fs } from "node:fs";
 import { homedir as osHomedir } from "node:os";
-import { dirname, isAbsolute, join, normalize, relative, resolve, sep } from "node:path";
+import { basename, dirname, isAbsolute, join, normalize, relative, resolve, sep } from "node:path";
 import type {
   Config,
   ConfigLayerInput,
@@ -19,6 +19,39 @@ const CONTROL_KEYS = new Set(["removeSecrets", "removeMounts", "removeRouteTools
 const SECRET_FIELDS = new Set(["env", "value", "allowHosts"]);
 const MOUNT_FIELDS = new Set(["type", "hostPath", "guestPath", "readonly", "options"]);
 const FORBIDDEN_CONFIG_KEYS = new Set(["__proto__", "prototype", "constructor"]);
+const REMOVED_WORKSPACE_KEYS = new Set(["mode", "cloneBranch", "cloneDepth", "shallowArchive", "volumeQuotaMiB"]);
+const REMOVED_WORKSPACE_MESSAGE = "was removed; pi-microsandbox now bind-mounts the discovered workspace root read/write";
+const PROTECTED_GUEST_ENV = new Set([
+  "BASH_ENV",
+  "CDPATH",
+  "DOCKER_CERT_PATH",
+  "DOCKER_CONFIG",
+  "DOCKER_CONTEXT",
+  "DOCKER_HOST",
+  "DOCKER_TLS",
+  "DOCKER_TLS_VERIFY",
+  "ENV",
+  "GLOBIGNORE",
+  "LD_LIBRARY_PATH",
+  "LD_PRELOAD",
+  "PATH",
+  "SHELLOPTS",
+]);
+const PROTECTED_GUEST_PATHS = [
+  "/bin",
+  "/dev",
+  "/etc/ld.so.cache",
+  "/etc/ld.so.preload",
+  "/lib",
+  "/lib64",
+  "/proc",
+  "/sbin",
+  "/sys",
+  "/usr",
+  "/run",
+  "/var/run",
+  "/var/lib/docker",
+] as const;
 
 function deepFreeze<T>(value: T): DeepReadonly<T> {
   if (value !== null && typeof value === "object" && !Object.isFrozen(value)) {
@@ -30,23 +63,19 @@ function deepFreeze<T>(value: T): DeepReadonly<T> {
 
 /** Defaults from PLAN §11.2. Values containing credentials are deliberately absent. */
 export const DEFAULT_CONFIG = deepFreeze<Config>({
-  image: "ghcr.io/hcohe/pi-microsandbox:1.0.0@sha256:00ea1e0911189815614e8a8eee36d1fd64f0f1edb39492e0bda9f273c834e59f",
+  image: "ghcr.io/hcohe/pi-microsandbox:1.1.0@sha256:ab4e99d4232f827b3f295ff3210437e01446dbb672ef0d0c78358566170ac86c",
   pullPolicy: "if-missing",
   bootstrapTools: "auto",
-  cpus: 1,
-  memoryMiB: 512,
+  cpus: 4,
+  memoryMiB: 8_192,
   idleTimeoutSec: 600,
   stopTimeoutMs: 10_000,
   detached: true,
   replace: false,
   replaceTimeoutMs: 10_000,
   sandboxName: null,
-  mode: "direct",
-  cloneBranch: "current",
-  cloneDepth: "unlimited",
-  shallowArchive: false,
-  volumeQuotaMiB: 2_048,
   network: { mode: "default", allowHosts: [], allowDns: true, publishPorts: [] },
+  docker: { mode: "auto", startupTimeoutMs: 15_000 },
   secrets: [],
   mounts: [],
   blockThirdParty: true,
@@ -76,6 +105,7 @@ export interface ResolveConfigInput {
   readFile?: (path: string) => Promise<string | null>;
   exists?: (path: string) => Promise<boolean>;
   realpath?: (path: string) => Promise<string>;
+  stat?: (path: string) => Promise<{ isSocket(): boolean }>;
 }
 
 export class ConfigError extends Error {
@@ -145,6 +175,16 @@ function camel(key: string): string {
 function snake(key: string): string {
   return key.replace(/MiB/g, "mib").replace(/[A-Z]/g, (c) => `_${c.toLowerCase()}`);
 }
+function removedWorkspaceIssues(value: Record<string, unknown>): string[] {
+  return Object.keys(value)
+    .map(camel)
+    .filter((key) => REMOVED_WORKSPACE_KEYS.has(key))
+    .map((key) => `${snake(key)} ${REMOVED_WORKSPACE_MESSAGE}`);
+}
+function assertNoRemovedWorkspaceKeys(value: Record<string, unknown>): void {
+  const issues = removedWorkspaceIssues(value);
+  if (issues.length) throw new ConfigError(issues);
+}
 function pathKey(parts: string[]): string { return parts.join("."); }
 function isPlainObject(value: unknown): value is Record<string, unknown> {
   if (!value || typeof value !== "object" || Array.isArray(value)) return false;
@@ -196,6 +236,64 @@ function findEquals(text: string): number {
   }
   return -1;
 }
+function decodeBasicTomlKey(text: string): string {
+  let result = "";
+  for (let index = 1; index < text.length - 1; index++) {
+    const character = text[index]!;
+    if (character !== "\\") {
+      result += character;
+      continue;
+    }
+    const escape = text[++index];
+    if (escape === undefined) throw new Error("invalid quoted TOML key");
+    const simple: Record<string, string> = { b: "\b", t: "\t", n: "\n", f: "\f", r: "\r", "\"": "\"", "\\": "\\" };
+    if (Object.hasOwn(simple, escape)) {
+      result += simple[escape];
+      continue;
+    }
+    if (escape !== "u" && escape !== "U") throw new Error("invalid quoted TOML key");
+    const length = escape === "u" ? 4 : 8;
+    const hex = text.slice(index + 1, index + 1 + length);
+    if (!new RegExp(`^[0-9a-fA-F]{${length}}$`).test(hex)) throw new Error("invalid quoted TOML key");
+    const codePoint = Number.parseInt(hex, 16);
+    if (codePoint > 0x10ffff || (codePoint >= 0xd800 && codePoint <= 0xdfff)) throw new Error("invalid quoted TOML key");
+    result += String.fromCodePoint(codePoint);
+    index += length;
+  }
+  return result;
+}
+function parseTomlKeySegment(text: string): string {
+  const key = text.trim();
+  if (key.startsWith("\"") && key.endsWith("\"")) return decodeBasicTomlKey(key);
+  if (key.startsWith("'") && key.endsWith("'") && !key.slice(1, -1).includes("'")) return key.slice(1, -1);
+  if (/^[A-Za-z0-9_-]+$/.test(key)) return key;
+  throw new Error("invalid TOML key");
+}
+function parseTomlKey(text: string): string[] {
+  const parts: string[] = [];
+  let start = 0;
+  let quote = "";
+  for (let index = 0; index < text.length; index++) {
+    const character = text[index]!;
+    if (quote === "\"") {
+      if (character === "\\") index++;
+      else if (character === quote) quote = "";
+      continue;
+    }
+    if (quote === "'") {
+      if (character === quote) quote = "";
+      continue;
+    }
+    if (character === "\"" || character === "'") quote = character;
+    else if (character === ".") {
+      parts.push(parseTomlKeySegment(text.slice(start, index)));
+      start = index + 1;
+    }
+  }
+  if (quote) throw new Error("invalid TOML key");
+  parts.push(parseTomlKeySegment(text.slice(start)));
+  return parts;
+}
 function parseTomlValue(text: string): unknown {
   const value = text.trim();
   if (value.startsWith("[") && value.endsWith("]")) return splitTopLevel(value.slice(1, -1)).map(parseTomlValue);
@@ -204,9 +302,8 @@ function parseTomlValue(text: string): unknown {
     for (const part of splitTopLevel(value.slice(1, -1))) {
       const at = findEquals(part);
       if (at < 0) throw new Error("invalid inline table");
-      const key = part.slice(0, at).trim();
-      assertSafeConfigKey(key, [key]);
-      object[key] = parseTomlValue(part.slice(at + 1));
+      const keys = parseTomlKey(part.slice(0, at));
+      assign(object, keys, parseTomlValue(part.slice(at + 1)));
     }
     return object;
   }
@@ -237,7 +334,7 @@ function readToml(text: string): Record<string, unknown> {
     const line = stripTomlComment(raw);
     if (!line) continue;
     if (line.startsWith("[[") && line.endsWith("]]")) {
-      const keys = line.slice(2, -2).trim().split(".").map((x) => x.trim());
+      const keys = parseTomlKey(line.slice(2, -2).trim());
       assertSafeConfigPath(keys);
       let parent: Record<string, unknown> = root;
       for (const key of keys.slice(0, -1)) {
@@ -255,14 +352,14 @@ function readToml(text: string): Record<string, unknown> {
       continue;
     }
     if (line.startsWith("[") && line.endsWith("]")) {
-      section = line.slice(1, -1).trim().split(".").map((x) => x.trim());
+      section = parseTomlKey(line.slice(1, -1).trim());
       assertSafeConfigPath(section);
       arraySection = null;
       continue;
     }
     const at = findEquals(line);
     if (at < 0) throw new Error("invalid assignment");
-    const key = line.slice(0, at).trim();
+    const keys = parseTomlKey(line.slice(0, at));
     const value = parseTomlValue(line.slice(at + 1));
     if (arraySection) {
       let parent: Record<string, unknown> = root;
@@ -271,9 +368,8 @@ function readToml(text: string): Record<string, unknown> {
         if (!Array.isArray(list) || !isPlainObject(list[list.length - 1])) throw new Error("invalid array table");
         parent = list[list.length - 1] as Record<string, unknown>;
       }
-      assertSafeConfigKey(key, [...arraySection, key]);
-      parent[key] = value;
-    } else assign(root, [...section, ...key.split(".").map((x) => x.trim())], value);
+      assign(parent, keys, value);
+    } else assign(root, [...section, ...keys], value);
   }
   return root;
 }
@@ -299,9 +395,10 @@ function knownPath(path: string): boolean {
     return parts.length === 1 && CONTROL_KEYS.has(parts[0]) && !nestedNetworkRemoval;
   }
   if (parts[0] === "network") return parts.length === 1 || (parts.length === 2 && ["mode", "allowHosts", "allowDns", "publishPorts", "removeAllowHosts", "removePublishPorts"].includes(parts[1]));
+  if (parts[0] === "docker") return parts.length === 1 || (parts.length === 2 && ["mode", "startupTimeoutMs"].includes(parts[1]));
   if (parts[0] === "secrets") return parts.length === 1 || (parts.length === 2 && SECRET_FIELDS.has(parts[1]));
   if (parts[0] === "mounts") return parts.length === 1 || (parts.length === 2 && MOUNT_FIELDS.has(parts[1]));
-  return ["image", "pullPolicy", "bootstrapTools", "cpus", "memoryMiB", "idleTimeoutSec", "stopTimeoutMs", "detached", "replace", "replaceTimeoutMs", "sandboxName", "mode", "cloneBranch", "cloneDepth", "shallowArchive", "volumeQuotaMiB", "blockThirdParty", "routeTools", "passThroughTools", "allowHostExecution", "allowSkillReads", "fallbackMode", "exposeSessionEnvironment", "hostEnv", "autoStart", "pruneOnStart", "showFooter", "lockDir", "hostRoAllowlist"].includes(parts[0]);
+  return ["image", "pullPolicy", "bootstrapTools", "cpus", "memoryMiB", "idleTimeoutSec", "stopTimeoutMs", "detached", "replace", "replaceTimeoutMs", "sandboxName", "blockThirdParty", "routeTools", "passThroughTools", "allowHostExecution", "allowSkillReads", "fallbackMode", "exposeSessionEnvironment", "hostEnv", "autoStart", "pruneOnStart", "showFooter", "lockDir", "hostRoAllowlist"].includes(parts[0]);
 }
 function collectUnknown(value: unknown, base: string[], warnings: string[]): void {
   if (!isPlainObject(value)) return;
@@ -334,7 +431,9 @@ function withMountDefaults(value: LayerValue): LayerValue {
 }
 function normalizeLayer(name: ConfigLayerName, raw: Record<string, unknown>, source?: string): ParsedConfigLayer {
   assertSafeConfigValue(raw);
-  const value = withMountDefaults(normalizeValue(raw) as LayerValue);
+  const normalized = normalizeValue(raw) as Record<string, unknown>;
+  assertNoRemovedWorkspaceKeys(normalized);
+  const value = withMountDefaults(normalized as LayerValue);
   const warnings: string[] = [];
   collectUnknown(value, [], warnings);
   if (name === "project" && Array.isArray(value.secrets)) {
@@ -349,7 +448,10 @@ function normalizeLayer(name: ConfigLayerName, raw: Record<string, unknown>, sou
 
 export function parseTomlConfig(text: string, source: string): ParsedConfigLayer {
   try { return normalizeLayer(source === "cli" ? "cli" : source === "env" ? "env" : source === "project" ? "project" : "global", readToml(text), source); }
-  catch { throw new ConfigError([`invalid TOML in ${source}`]); }
+  catch (error) {
+    if (error instanceof ConfigError) throw error;
+    throw new ConfigError([`invalid TOML in ${source}`]);
+  }
 }
 
 function envScalar(text: string, key: string): unknown {
@@ -454,6 +556,7 @@ export function mergeConfigLayers(layers: readonly ConfigLayerInput[]): MergeRes
   const warnings: string[] = [];
   for (const layer of layers) {
     assertSafeConfigValue(layer.value);
+    assertNoRemovedWorkspaceKeys(layer.value as Record<string, unknown>);
     warnings.push(...layer.warnings.map(warning));
     const source = withMountDefaults(clone(layer.value) as LayerValue);
     applyRemovals(result, source, layer.name, provenance);
@@ -483,6 +586,7 @@ function validatePort(port: unknown): boolean {
 }
 
 export function validateConfig(raw: DeepPartial<Config>): Config {
+  assertNoRemovedWorkspaceKeys(raw as Record<string, unknown>);
   const config = mergeWithDefaults(raw);
   const issues: string[] = [];
   const n = (value: unknown) => typeof value === "number" && Number.isFinite(value);
@@ -493,15 +597,14 @@ export function validateConfig(raw: DeepPartial<Config>): Config {
   if (!n(config.idleTimeoutSec) || config.idleTimeoutSec < 0) issues.push(issueForPath("idleTimeoutSec", "must be non-negative"));
   if (!n(config.stopTimeoutMs) || config.stopTimeoutMs < 1) issues.push(issueForPath("stopTimeoutMs", "must be positive"));
   if (!n(config.replaceTimeoutMs) || config.replaceTimeoutMs < 1) issues.push(issueForPath("replaceTimeoutMs", "must be positive"));
-  if (!n(config.volumeQuotaMiB) || config.volumeQuotaMiB < 1) issues.push(issueForPath("volumeQuotaMiB", "must be positive"));
-  if (!["auto", "git", "direct", "none"].includes(config.mode)) issues.push(issueForPath("mode", "unknown storage mode"));
+  const docker = isPlainObject(config.docker) ? config.docker : null;
+  if (!docker || !["auto", "require", "disabled"].includes(docker.mode as string)) issues.push(issueForPath("docker.mode", "must be auto, require, or disabled"));
+  if (!docker || !n(docker.startupTimeoutMs) || !Number.isInteger(docker.startupTimeoutMs) || (docker.startupTimeoutMs as number) < 1 || (docker.startupTimeoutMs as number) > 300_000) issues.push(issueForPath("docker.startupTimeoutMs", "must be an integer between 1 and 300000"));
   if (!["auto", true, false].includes(config.bootstrapTools)) issues.push(issueForPath("bootstrapTools", "must be auto, true, or false"));
   if (!["block", "host"].includes(config.fallbackMode)) issues.push(issueForPath("fallbackMode", "must be block or host"));
-  const booleanFields = ["detached", "replace", "shallowArchive", "blockThirdParty", "allowHostExecution", "allowSkillReads", "exposeSessionEnvironment", "autoStart", "pruneOnStart", "showFooter"] as const;
+  const booleanFields = ["detached", "replace", "blockThirdParty", "allowHostExecution", "allowSkillReads", "exposeSessionEnvironment", "autoStart", "pruneOnStart", "showFooter"] as const;
   for (const field of booleanFields) if (typeof config[field] !== "boolean") issues.push(issueForPath(field, "must be boolean"));
   if (config.sandboxName !== null && typeof config.sandboxName !== "string") issues.push(issueForPath("sandboxName", "must be a string or null"));
-  if (typeof config.cloneBranch !== "string" || !config.cloneBranch) issues.push(issueForPath("cloneBranch", "must be a non-empty string"));
-  if (config.cloneDepth !== "unlimited" && (!n(config.cloneDepth) || !Number.isInteger(config.cloneDepth) || config.cloneDepth < 1)) issues.push(issueForPath("cloneDepth", "must be a positive integer or unlimited"));
   const stringArray = (field: string, value: unknown) => {
     if (!Array.isArray(value)) { issues.push(issueForPath(field, "must be an array")); return false; }
     for (const item of value) if (typeof item !== "string" || !item) issues.push(issueForPath(field, "must contain non-empty strings"));
@@ -509,7 +612,7 @@ export function validateConfig(raw: DeepPartial<Config>): Config {
   };
   if (stringArray("routeTools", config.routeTools)) for (const tool of config.routeTools) if (!ROUTED_TOOLS.includes(tool)) issues.push(issueForPath("routeTools", `unknown routed tool ${tool}`));
   stringArray("passThroughTools", config.passThroughTools);
-  stringArray("hostEnv", config.hostEnv);
+  if (stringArray("hostEnv", config.hostEnv)) for (const name of config.hostEnv) if (PROTECTED_GUEST_ENV.has(name)) issues.push(issueForPath("hostEnv", `must not forward protected process environment variable ${name}`));
   stringArray("hostRoAllowlist", config.hostRoAllowlist);
   const network = isPlainObject(config.network) ? config.network : null;
   if (!network || !["default", "open", "allowlist", "deny"].includes(network.mode as string)) issues.push(issueForPath("network.mode", "unknown network mode"));
@@ -521,6 +624,7 @@ export function validateConfig(raw: DeepPartial<Config>): Config {
   if (!Array.isArray(config.secrets)) issues.push(issueForPath("secrets", "must be an array"));
   for (const [index, secret] of (Array.isArray(config.secrets) ? config.secrets : []).entries()) {
     if (!secret || typeof secret.env !== "string" || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(secret.env)) issues.push(issueForPath(`secrets[${index}]`, "env must be a valid host environment name"));
+    else if (PROTECTED_GUEST_ENV.has(secret.env)) issues.push(issueForPath(`secrets[${index}].env`, `must not set protected process environment variable ${secret.env}`));
     if (typeof secret?.value !== "string") issues.push(issueForPath(`secrets[${index}].value`, "must be a string"));
     if (!Array.isArray(secret?.allowHosts) || !secret.allowHosts.length || secret.allowHosts.some((host: unknown) => typeof host !== "string" || !host)) issues.push(issueForPath(`secrets[${index}]`, "allowHosts must be a non-empty string array"));
   }
@@ -542,6 +646,7 @@ export function validateConfig(raw: DeepPartial<Config>): Config {
     if (typeof guest === "string" && isAbsolute(guest)) {
       const canonical = String(canonicalGuestPath(guest));
       if (isInside(canonical, "/tmp") || isInside("/tmp", canonical)) issues.push(issueForPath(`mounts[${index}].guestPath`, "must not shadow reserved /tmp paths"));
+      if (PROTECTED_GUEST_PATHS.some((reserved) => isInside(canonical, reserved) || isInside(reserved, canonical))) issues.push(issueForPath(`mounts[${index}].guestPath`, "must not shadow protected guest system or Docker runtime paths"));
     }
   }
   if (issues.length) throw new ConfigError(issues);
@@ -580,7 +685,10 @@ function configDir(env: NodeJS.ProcessEnv, input: ResolveConfigInput): string {
 }
 function layerFromText(name: ConfigLayerName, text: string, source: string): ParsedConfigLayer {
   try { return normalizeLayer(name, readToml(text), source); }
-  catch { throw new ConfigError([`invalid TOML in ${source}`]); }
+  catch (error) {
+    if (error instanceof ConfigError) throw error;
+    throw new ConfigError([`invalid TOML in ${source}`]);
+  }
 }
 
 export async function resolveConfig(input: ResolveConfigInput): Promise<ResolvedConfig> {
@@ -599,28 +707,40 @@ export async function resolveConfig(input: ResolveConfigInput): Promise<Resolved
   const canonicalPath = async (path: string, failClosed = false): Promise<string> => {
     try { return await realpath(path); }
     catch {
-      if (failClosed) throw new ConfigError(["trusted project path could not be canonicalized"]);
+      if (failClosed) throw new ConfigError(["mount or trusted project path could not be canonicalized"]);
       return resolve(path);
     }
   };
   const project = await projectFile(input.cwd, input.repoRoot, input.configDirName, exists);
-  if (project && !input.projectTrusted) warnings.push("project config ignored because this project is not trusted");
-  if (project && input.projectTrusted) {
-    const text = await readFile(project);
-    if (text !== null) {
-      const parsed = layerFromText("project", text, project);
-      const projectValue = withMountDefaults(clone(parsed.value) as LayerValue);
-      if (Array.isArray(projectValue.mounts)) {
-        projectValue.mounts = await Promise.all(projectValue.mounts.map(async (mount: any) => {
-          if (mount && (mount.type === "dir" || mount.type === "file") && typeof mount.hostPath === "string" && isAbsolute(mount.hostPath)) {
-            return { ...mount, hostPath: await canonicalPath(mount.hostPath, true) };
-          }
-          return mount;
-        })) as any;
+  const projectText = project ? await readFile(project) : null;
+  if (project && !input.projectTrusted) {
+    warnings.push("project config ignored because this project is not trusted");
+    if (projectText !== null) {
+      // Ignored project configuration cannot influence policy, but a removed
+      // workspace selector must still stop startup before direct host writes.
+      try {
+        const normalized = normalizeValue(readToml(projectText)) as Record<string, unknown>;
+        assertNoRemovedWorkspaceKeys(normalized);
+      } catch (error) {
+        if (error instanceof ConfigError && error.issues.some((issue) => issue.includes(REMOVED_WORKSPACE_MESSAGE))) throw error;
+        // Preserve the existing trust rule for every other malformed/unsafe key:
+        // untrusted project configuration is not interpreted.
       }
-      layers.push({ ...parsed, value: projectValue });
     }
   }
+  if (project && input.projectTrusted && projectText !== null) {
+    const parsed = layerFromText("project", projectText, project);
+    const projectValue = withMountDefaults(clone(parsed.value) as LayerValue);
+    if (Array.isArray(projectValue.mounts)) {
+      projectValue.mounts = await Promise.all(projectValue.mounts.map(async (mount: any) => {
+        if (mount && (mount.type === "dir" || mount.type === "file") && typeof mount.hostPath === "string" && isAbsolute(mount.hostPath)) {
+          return { ...mount, hostPath: await canonicalPath(mount.hostPath, true) };
+        }
+        return mount;
+      })) as any;
+    }
+    layers.push({ ...parsed, value: projectValue });
+  }
   layers.push(parseEnvConfig(env));
   if (input.cliOverridesToml !== undefined) layers.push(parseTomlConfig(input.cliOverridesToml, "cli"));
   const merged = mergeConfigLayers(layers);
@@ -629,6 +749,12 @@ export async function resolveConfig(input: ResolveConfigInput): Promise<Resolved
   config = normalizeLegacy(config, warnings);
   // Legacy mounts participate in the same overlap/type checks as native mounts.
   config = validateConfig(config);
+  config = {
+    ...config,
+    mounts: await Promise.all(config.mounts.map(async (mount) => mount.type === "named" || mount.type === "tmpfs"
+      ? mount
+      : { ...mount, hostPath: await canonicalPath(mount.hostPath!, true) })),
+  };
 
   const projectGuestPath = String(canonicalGuestPath(resolve(input.repoRoot ?? input.cwd)));
   const projectShadowIssues = config.mounts.flatMap((mount, index) => {
@@ -649,6 +775,20 @@ export async function resolveConfig(input: ResolveConfigInput): Promise<Resolved
     .filter((mount) => mount && mount.readonly === false)
     .map((mount) => String(canonicalGuestPath(mount.guestPath ?? "")));
   const policyIssues: string[] = [];
+  const mountStat = input.stat ?? fs.stat;
+  const knownHostDockerSockets = ["/var/run/docker.sock", "/run/docker.sock"];
+  if (input.homedir ?? env.HOME) knownHostDockerSockets.push(join(String(input.homedir ?? env.HOME), ".docker", "run", "docker.sock"));
+  if (env.XDG_RUNTIME_DIR) knownHostDockerSockets.push(join(env.XDG_RUNTIME_DIR, "docker.sock"));
+  for (const [index, mount] of config.mounts.entries()) {
+    if (mount.type === "named" || mount.type === "tmpfs" || typeof mount.hostPath !== "string") continue;
+    const host = resolve(mount.hostPath);
+    let unsafe = basename(host) === "docker.sock" || knownHostDockerSockets.some((socket) => isInside(socket, host));
+    if (!unsafe) {
+      try { unsafe = (await mountStat(host)).isSocket(); }
+      catch { policyIssues.push(issueForPath(`mounts[${index}].hostPath`, "could not be safely inspected")); continue; }
+    }
+    if (unsafe) policyIssues.push(issueForPath(`mounts[${index}].hostPath`, "must not mount a host socket or Docker socket path"));
+  }
   const projectSecretFiles = new Map<string, { reference: string; canonical: string }>();
   if (Array.isArray(projectMounts)) for (const mount of projectMounts as any[]) {
     if (!mount || typeof mount.hostPath !== "string" || mount.type === "named" || mount.type === "tmpfs") continue;
@@ -708,7 +848,11 @@ function setAt(base: any, parts: string[], value: unknown): any {
 export function applyOverride(base: DeepPartial<Config>, dottedSnakeKey: string, value: unknown): DeepPartial<Config> {
   const rawParts = dottedSnakeKey.split(".").filter(Boolean);
   assertSafeConfigPath(rawParts);
-  return setAt(base, rawParts.map(camel), value) as DeepPartial<Config>;
+  const parts = rawParts.map(camel);
+  if (REMOVED_WORKSPACE_KEYS.has(parts[0] ?? "")) {
+    throw new ConfigError([`${dottedSnakeKey} ${REMOVED_WORKSPACE_MESSAGE}`]);
+  }
+  return setAt(base, parts, value) as DeepPartial<Config>;
 }
 export function removeOverride(base: DeepPartial<Config>, dottedSnakeKey: string): DeepPartial<Config> {
   assertSafeConfigValue(base);
@@ -717,6 +861,9 @@ export function removeOverride(base: DeepPartial<Config>, dottedSnakeKey: string
   assertSafeConfigPath(rawParts);
   const parts = rawParts.map(camel);
   assertSafeConfigPath(parts);
+  if (REMOVED_WORKSPACE_KEYS.has(parts[0] ?? "")) {
+    throw new ConfigError([`${dottedSnakeKey} ${REMOVED_WORKSPACE_MESSAGE}`]);
+  }
   let current = out;
   for (const part of parts.slice(0, -1)) { if (!isPlainObject(current[part])) return out; current = current[part]; }
   delete current[parts[parts.length - 1]];