chad-code 1.11.0__tar.gz → 1.12.0__tar.gz

{chad_code-1.11.0 → chad_code-1.12.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: chad-code
-Version: 1.11.0
+Version: 1.12.0
 Summary: Local MLX-backed, Claude-Code-style coding agent (Apple Silicon, Ornith 35B/9B)
 License-Expression: MIT
 Project-URL: Repository, https://github.com/nathansutton/chad

{chad_code-1.11.0 → chad_code-1.12.0}/pyproject.toml

@@ -4,7 +4,7 @@
 # import name, and command name are independent. `uvx chad-code` runs the alias
 # script added under [project.scripts].
 name = "chad-code"
-version = "1.11.0"
+version = "1.12.0"
 description = "Local MLX-backed, Claude-Code-style coding agent (Apple Silicon, Ornith 35B/9B)"
 readme = "README.md"
 license = "MIT"

{chad_code-1.11.0 → chad_code-1.12.0}/src/chad/__init__.py

@@ -4,7 +4,7 @@ A flat collection of cooperating modules behind one console script (``chad``):
 the inference engine, the tool layer, the agent loop, and the terminal UI.
 """
 
-__version__ = "1.11.0"
+__version__ = "1.12.0"
 
 # chad sets no MLX_* runtime vars. MLX_METAL_FAST_SYNCH, MLX_MAX_OPS_PER_BUFFER
 # and MLX_MAX_MB_PER_BUFFER were each measured end-to-end on the 35B and every

{chad_code-1.11.0 → chad_code-1.12.0}/src/chad/agent.py

@@ -14,7 +14,18 @@ import re
 import sys
 import time
 
-from . import ambient, atif, compaction, config, guardrails, levers, session, syntaxgate
+from . import (
+    ambient,
+    atif,
+    checkpoint,
+    compaction,
+    config,
+    guardrails,
+    levers,
+    seatbelt,
+    session,
+    syntaxgate,
+)
 from .base_engine import BackendError, BaseEngine
 from .diag import args_preview, log, redact, result_preview
 from .prompt import build_subagent_prompt, build_system_prompt, classify_intent
@@ -1971,12 +1982,27 @@ class Agent:
                 else:
                     _t0 = time.perf_counter()
                     self.tool_dispatches += 1
+                    # A snapshot happens AFTER approval, immediately before the tool
+                    # runs — a denied edit must not leave a checkpoint claiming it ran.
+                    if (name in AUTO_EDIT_TOOLS
+                            and levers.enabled("edit_checkpoint")):
+                        _ref = checkpoint.snapshot(
+                            os.getcwd(), f"before {name} {args.get('path', '')}".strip())
+                        if _ref:
+                            levers.fired("edit_checkpoint", step=step, ref=_ref)
+                    # Seatbelt context is scoped to exactly this dispatch: `active`
+                    # reflects the mode of the agent actually executing, so a
+                    # sub-agent's yolo loop is confined inside a normal-mode parent
+                    # turn, and the context can't leak to the `!cmd` passthrough.
+                    seatbelt.set_context(self.mode == "yolo", os.getcwd())
                     try:
                         result = fn(args, self._should_stop)
                         if plan_write and result.startswith("[wrote"):
                             self.last_plan_path = os.path.abspath(args["path"])
                     except Exception as e:  # noqa: BLE001 - surface tool errors to model
                         result = f"[tool error: {type(e).__name__}: {e}]"
+                    finally:
+                        seatbelt.set_context(False, None)
                     _tool_s = time.perf_counter() - _t0
                     # Backstop: bound the prefill from any tool, AND from the step as a
                     # whole — several calls in one step stack into one prefill, so later

chad_code-1.12.0/src/chad/checkpoint.py

@@ -0,0 +1,150 @@
+"""Shadow-git checkpoints for file edits (lever: edit_checkpoint).
+
+Auto-approved edits are justified as "a diff you can read and revert" — this
+module supplies the revert. Before each file-mutating tool lands, the workspace
+is committed to a *shadow* git repository under ~/.chad/checkpoints/<hash>. The
+user's own .git is never opened, never written, never required to exist: the
+shadow repo has its own GIT_DIR and treats the workspace purely as a work tree.
+/undo and /restore in the TUI check files back out of it.
+
+Failure policy: never raise. An edit must not die because the checkpoint
+machinery hiccuped — snapshot() returns None on any failure and the tool call
+proceeds unprotected (logged, and visible in `chad levers` firing counts as the
+absence of a fire).
+
+Restore policy (deliberately conservative): `git restore --source=<ref>` puts
+every snapshotted file back to its snapshotted content. Files *created after*
+the snapshot are left in place — deleting files is exactly the blast radius this
+lever exists to contain, so the restore path never does it.
+"""
+
+import hashlib
+import logging
+import os
+import subprocess
+from typing import Optional
+
+log = logging.getLogger("chad")
+
+_GIT_TIMEOUT_S = 120  # first snapshot of a big tree is seconds; never hang a turn
+
+# Junk that snapshots must not swallow when the workspace has no .gitignore of its
+# own (a non-git project): written to the shadow repo's info/exclude, which
+# composes with any workspace .gitignore rather than replacing it.
+_DEFAULT_EXCLUDES = (".venv/\nvenv/\nnode_modules/\n__pycache__/\n*.pyc\n"
+                     ".mypy_cache/\n.ruff_cache/\n.pytest_cache/\n.DS_Store\n")
+
+
+def _history_root() -> str:
+    # CHAD_CHECKPOINT_DIR: test/e2e override so suites never write real home state.
+    # NOT ~/.chad/history — that name is taken by the TUI's prompt-history FILE.
+    env = os.environ.get("CHAD_CHECKPOINT_DIR")
+    if env:
+        return env
+    return os.path.join(os.path.expanduser("~"), ".chad", "checkpoints")
+
+
+def shadow_dir(workspace: str) -> str:
+    ws = os.path.realpath(workspace)
+    tag = hashlib.sha1(ws.encode()).hexdigest()[:16]
+    return os.path.join(_history_root(), tag, "shadow.git")
+
+
+def _git(workspace: str, *args: str) -> subprocess.CompletedProcess:
+    """Run git against the shadow repo with the workspace as work tree. Identity
+    and signing come from -c flags so the user's global config is never consulted
+    for authorship and never mutated."""
+    cmd = ["git", "--git-dir", shadow_dir(workspace), "--work-tree",
+           os.path.realpath(workspace),
+           "-c", "user.email=chad@localhost", "-c", "user.name=chad",
+           "-c", "commit.gpgsign=false", "-c", "core.hooksPath=/dev/null",
+           *args]
+    return subprocess.run(cmd, capture_output=True, text=True,
+                          timeout=_GIT_TIMEOUT_S, check=False)
+
+
+def _ensure_shadow(workspace: str) -> bool:
+    sd = shadow_dir(workspace)
+    if os.path.isdir(sd):
+        return True
+    try:
+        os.makedirs(os.path.dirname(sd), exist_ok=True)
+        r = subprocess.run(["git", "init", "-q", "--bare", sd],
+                           capture_output=True, text=True,
+                           timeout=_GIT_TIMEOUT_S, check=False)
+        if r.returncode != 0:
+            log.warning("CHECKPOINT shadow init failed: %s", r.stderr.strip())
+            return False
+        info = os.path.join(sd, "info")
+        os.makedirs(info, exist_ok=True)
+        with open(os.path.join(info, "exclude"), "w", encoding="utf-8") as fh:
+            fh.write(_DEFAULT_EXCLUDES)
+        return True
+    except (OSError, subprocess.SubprocessError) as e:
+        log.warning("CHECKPOINT shadow init failed: %s", e)
+        return False
+
+
+def snapshot(workspace: str, label: str) -> Optional[str]:
+    """Commit the workspace state to the shadow repo; return the short hash, or
+    None if no checkpoint exists after the attempt. An unchanged tree is not a
+    failure — the previous snapshot already covers it, so its hash is returned."""
+    try:
+        if not _ensure_shadow(workspace):
+            return None
+        add = _git(workspace, "add", "-A")
+        if add.returncode != 0:
+            log.warning("CHECKPOINT add failed: %s", add.stderr.strip())
+            return None
+        commit = _git(workspace, "commit", "-q", "-m", label)
+        head = _git(workspace, "rev-parse", "--short", "HEAD")
+        if head.returncode != 0:
+            # Nothing staged AND no prior snapshot — an empty workspace's first
+            # checkpoint. Record the empty state anyway so the timeline exists.
+            commit = _git(workspace, "commit", "-q", "--allow-empty", "-m", label)
+            head = _git(workspace, "rev-parse", "--short", "HEAD")
+            if head.returncode != 0:
+                log.warning("CHECKPOINT commit failed: %s", commit.stderr.strip())
+                return None
+        return head.stdout.strip()
+    except (OSError, subprocess.SubprocessError) as e:
+        log.warning("CHECKPOINT snapshot failed: %s", e)
+        return None
+
+
+def snapshots(workspace: str, limit: int = 10) -> list:
+    """Newest-first [(short_hash, iso_time, label)] — empty on any failure."""
+    try:
+        r = _git(workspace, "log", f"-{limit}", "--format=%h%x09%cI%x09%s")
+        if r.returncode != 0:
+            return []
+        rows = []
+        for line in r.stdout.splitlines():
+            parts = line.split("\t", 2)
+            if len(parts) == 3:
+                rows.append((parts[0], parts[1], parts[2]))
+        return rows
+    except (OSError, subprocess.SubprocessError):
+        return []
+
+
+def restore(workspace: str, ref: str = "HEAD") -> str:
+    """Check snapshotted files back out at `ref`. Returns a human-readable
+    one-liner (also used verbatim by the TUI)."""
+    try:
+        ok = _git(workspace, "rev-parse", "--verify", "--quiet", f"{ref}^{{commit}}")
+        if ok.returncode != 0:
+            have = snapshots(workspace, limit=1)
+            return (f"no checkpoint named {ref!r}" if have else
+                    "no checkpoints exist for this workspace yet — snapshots are "
+                    "taken before file edits when the edit_checkpoint lever is on")
+        changed = _git(workspace, "diff", "--name-only", ref)
+        n = len([ln for ln in changed.stdout.splitlines() if ln.strip()])
+        r = _git(workspace, "restore", "--worktree", f"--source={ref}", "--", ".")
+        if r.returncode != 0:
+            return f"restore failed: {r.stderr.strip() or 'unknown git error'}"
+        label = _git(workspace, "log", "-1", "--format=%s", ref).stdout.strip()
+        return (f"restored {n} file(s) to checkpoint {ref} ({label}). Files created "
+                f"since that snapshot were left in place.")
+    except (OSError, subprocess.SubprocessError) as e:
+        return f"restore failed: {e}"

{chad_code-1.11.0 → chad_code-1.12.0}/src/chad/levers.py

@@ -514,6 +514,50 @@ LEVERS: dict[str, Lever] = {
         "only a server already warmed by find_refs/hover/disambiguation is "
         "consulted; absent one, silence.",
         "ctxengine"),
+
+    # --- group "safety": blast-radius containment for unattended mutation. ---------
+    "yolo_seatbelt": Lever(
+        "In yolo mode on macOS, each bash command's shell child runs under a "
+        "Seatbelt profile (sandbox-exec) that denies file writes outside the "
+        "workspace, temp dirs, tool caches, and ~/.chad — reads, network, and exec "
+        "stay open, and ~/.chad/checkpoints (the undo history) is carved back out "
+        "so a sandboxed command cannot delete it. The model process is never "
+        "sandboxed, only the spawned shell. The startup probe proves the profile "
+        "ENFORCES (an allowed write must land, a denied write must not) before any "
+        "confinement is claimed; either failure runs unconfined with a loud log. "
+        "Fires when a denial is detected in command output: each fire is a write "
+        "the command-pattern denylist did not catch.",
+        "safety"),
+    "edit_checkpoint": Lever(
+        "Before a file-mutating tool lands, commit a workspace snapshot to a "
+        "shadow git repo under ~/.chad/checkpoints (the project's own .git is "
+        "never touched or required); /undo and /restore in the TUI revert from "
+        "it. Fires once per snapshot taken and once per restore performed.",
+        "safety"),
+    "seatbelt_protect_git": Lever(
+        "Opt-in tier on top of yolo_seatbelt: the workspace's git metadata "
+        "(.git, and a worktree's external gitdir + common dir) is write-DENIED "
+        "inside the otherwise-writable workspace, so an unreviewed command "
+        "cannot destroy project history (`rm -rf .git`) — and with "
+        "edit_checkpoint on, the undo snapshots stay tamper-proof from inside "
+        "the sandbox too. The cost is real: every .git-writing git command "
+        "(commit, add, checkout) EPERMs — sized at <=2.65% of 91,910 real "
+        "session commands, concentrated in 14% of sessions — which is why this "
+        "is its own lever, not part of the base profile. Inert unless "
+        "yolo_seatbelt is also enabled; a denial it causes surfaces through "
+        "yolo_seatbelt's own firing (the profile cannot say which rule bit).",
+        "safety", fires=PASSIVE),
+    "bash_env_guard": Lever(
+        "Spawned bash children get a FILTERED copy of the environment: variable "
+        "names shaped like credentials (…_TOKEN, …_SECRET, …_PASSWORD, "
+        "…_API_KEY, …_ACCESS_KEY(_ID), …_PRIVATE_KEY, …_CREDENTIALS) are "
+        "dropped, closing the gap where a filesystem sandbox still hands every "
+        "command the operator's cloud keys. Name-pattern only — values are "
+        "never read or logged. OFF (the default) inherits the parent env "
+        "untouched, today's behavior; commands that legitimately need a "
+        "credential need the lever off. Fires per spawn that actually dropped "
+        "something, with the count.",
+        "safety"),
 }
 
 

chad_code-1.12.0/src/chad/seatbelt.py

@@ -0,0 +1,255 @@
+"""macOS Seatbelt confinement for yolo-mode bash commands (lever: yolo_seatbelt).
+
+The destructive-command denylist in guardrails.py is pattern-matching, not a
+boundary — it says so itself. This module is the boundary: in yolo mode (the one
+mode where a shell command runs with no human in the loop), the spawned shell is
+wrapped in `sandbox-exec` with a profile that denies file writes everywhere except
+the workspace, temp dirs, caches, and chad's own state dir. Reads and network stay
+open; the failure mode this closes is "an unreviewed command wrote outside the
+project".
+
+Only the *spawned shell child* is ever sandboxed. The chad process itself must
+never enter the sandbox: the model runs in-process on Metal, and GPU access from
+inside a Seatbelt profile is not something to gamble a session on. tool_bash asks
+`wrap_argv()` for an argv at spawn time; everything else here is profile plumbing.
+
+The active/workspace context is set by the agent immediately before each tool
+dispatch and cleared after, so nested agents (a sub-agent's yolo loop inside a
+normal-mode parent turn) and the `!cmd` passthrough each get exactly the
+confinement of the agent/mode that is actually executing.
+"""
+
+import logging
+import os
+import re
+import shlex
+import subprocess
+import sys
+import tempfile
+from typing import Optional
+
+from . import levers
+
+log = logging.getLogger("chad")
+
+SANDBOX_EXEC = "/usr/bin/sandbox-exec"
+
+# One-shot enforcement probe. Seatbelt profiles don't nest: when chad itself runs
+# inside a sandbox (CI, a harness container, another agent's shell tool),
+# sandbox-exec fails to apply and would turn EVERY yolo bash call into an error.
+# Probe once per process; on failure run unconfined (logged) rather than broken.
+_probe_result: Optional[bool] = None
+
+# The marker a denied write leaves in command output (EPERM strerror). Used by
+# tool_bash to detect that the profile bit and to append an explanation the model
+# can act on instead of a bare permission error.
+DENIAL_MARKER = "Operation not permitted"
+DENIAL_NOTE = ("\n[seatbelt: a write outside the workspace was denied — yolo mode "
+               "confines file writes to the project directory, temp dirs, and "
+               "caches. Work inside the project, or ask the user to run this "
+               "command themselves.]")
+
+_ctx: dict = {"active": False, "workspace": None}
+
+# profile path per workspace realpath — the profile embeds absolute paths, so it is
+# only reusable for the same workspace.
+_profiles: dict = {}
+
+
+def set_context(active: bool, workspace: Optional[str]) -> None:
+    """Called by the agent around each tool dispatch. `active` is 'the executing
+    agent is in yolo mode'; whether wrapping actually happens still depends on the
+    lever and platform (see wrap_argv)."""
+    _ctx["active"] = active
+    _ctx["workspace"] = workspace
+
+
+def available() -> bool:
+    return sys.platform == "darwin" and os.path.exists(SANDBOX_EXEC)
+
+
+def probe() -> bool:
+    """Does a sandbox applied from this process actually ENFORCE? Cached per process.
+
+    Running `sandbox-exec` successfully proves nothing about confinement: a profile
+    that fails open (OS version drift, a malformed rule) would leave every yolo
+    command reported as confined while writing anywhere it likes — a boundary that
+    lies is worse than no boundary. So the probe exercises both directions of a
+    real deny/allow profile against a throwaway directory pair: the allowed write
+    must land AND the denied write must not. A denied write that lands fails the
+    probe loudly; either failure means yolo bash runs unconfined (and says so)
+    rather than confined-in-name-only."""
+    global _probe_result
+    if _probe_result is not None:
+        return _probe_result
+    if not available():
+        _probe_result = False
+        return False
+    _probe_result = False
+    leaked = False
+    try:
+        with tempfile.TemporaryDirectory(prefix="chad-sb-probe-") as tmp:
+            # Seatbelt matches the KERNEL's view of a path: $TMPDIR is a symlink
+            # (/var/folders -> /private/var/folders), and an allow rule written
+            # against the symlinked spelling silently denies everything under it.
+            root = os.path.realpath(tmp)
+            allowed = os.path.join(root, "allowed")
+            denied = os.path.join(root, "denied")
+            os.mkdir(allowed)
+            os.mkdir(denied)
+            prof = ("(version 1)(allow default)(deny file-write*)"
+                    f'(allow file-write* (subpath "{_scheme_str(allowed)}"))')
+            cmd = (f"printf ok > {shlex.quote(os.path.join(allowed, 'w'))}; "
+                   f"printf no > {shlex.quote(os.path.join(denied, 'w'))}")
+            subprocess.run([SANDBOX_EXEC, "-p", prof, "/bin/sh", "-c", cmd],
+                           capture_output=True, timeout=10, check=False)
+            leaked = os.path.isfile(os.path.join(denied, "w"))
+            _probe_result = (not leaked
+                             and os.path.isfile(os.path.join(allowed, "w")))
+    except (OSError, subprocess.SubprocessError):
+        _probe_result = False
+    if leaked:
+        log.error("SEATBELT profile FAILED to enforce (a write that must be denied "
+                  "landed) — refusing a confinement that would only be claimed; "
+                  "yolo bash runs unconfined")
+    elif not _probe_result:
+        log.warning("SEATBELT unavailable here (nested sandbox or missing "
+                    "support) — yolo bash runs unconfined")
+    return _probe_result
+
+
+def _scheme_str(path: str) -> str:
+    """Escape a path for embedding in a Scheme string literal. Paths are embedded
+    directly (no -D params): quotes and backslashes in a path must not be able to
+    terminate the string and smuggle profile syntax."""
+    return path.replace("\\", "\\\\").replace('"', '\\"')
+
+
+def _worktree_gitdirs(workspace: str) -> list:
+    """If the workspace is a `git worktree`, its `.git` is a FILE pointing at an
+    external gitdir — and every git command writes there (index, locks) and to the
+    shared common dir (objects, refs). Without these two carve-outs the sandbox
+    kills all git activity in a worktree checkout."""
+    dirs = []
+    dotgit = os.path.join(workspace, ".git")
+    if not os.path.isfile(dotgit):
+        return dirs
+    try:
+        with open(dotgit, encoding="utf-8", errors="replace") as fh:
+            m = re.match(r"gitdir:\s*(.+)", fh.read().strip())
+        if not m:
+            return dirs
+        gitdir = os.path.normpath(os.path.join(workspace, m.group(1).strip()))
+        if os.path.isdir(gitdir):
+            dirs.append(gitdir)
+            common = os.path.join(gitdir, "commondir")
+            if os.path.isfile(common):
+                with open(common, encoding="utf-8", errors="replace") as fh:
+                    rel = fh.read().strip()
+                commondir = os.path.normpath(os.path.join(gitdir, rel))
+                if os.path.isdir(commondir):
+                    dirs.append(commondir)
+    except OSError:
+        return dirs
+    return dirs
+
+
+def profile_text(workspace: str) -> str:
+    """Deny-writes-outside-allowlist profile. `(allow default)` keeps reads,
+    network, exec, signals open — v1 confines exactly one thing: where files can
+    be written. The allowlist is every place real commands legitimately write:
+    the workspace, POSIX and macOS temp roots, tool caches (uv/pip live under
+    ~/Library/Caches on macOS, not ~/.cache), and chad's state dir.
+
+    Two carve-backs ride AFTER the allow block (the last matching Seatbelt rule
+    wins), because a writable root is not uniformly expendable:
+
+    * `~/.chad/checkpoints` — the shadow-repo undo history. It sits under the
+      allowed `~/.chad` subpath, so without its own deny a sandboxed command
+      could delete the very snapshots a user would reach for after a bad turn.
+      Only chad's own (never-sandboxed) process legitimately writes there, so
+      this deny is unconditional and costs real commands nothing.
+    * the workspace's git metadata (`.git`, and for a worktree checkout its
+      external gitdir + shared common dir) — gated by the `seatbelt_protect_git`
+      lever, its own opt-in tier rather than part of the base profile: it makes
+      project history un-destroyable from inside the sandbox (`rm -rf .git`
+      EPERMs), but any git command that writes — commit, add, checkout — fails
+      with it. Sized statically against 91,910 real session commands: at most
+      2.65% would EPERM (an upper bound — a clone/init into a subdirectory makes
+      a NESTED .git, which stays writable), concentrated in 14% of sessions.
+      With the tier off, worktree gitdirs stay on the ALLOW list, since every
+      git command writes through them."""
+    home = os.path.expanduser("~")
+    ws = os.path.realpath(workspace)
+    protect_git = levers.enabled("seatbelt_protect_git")
+    gitdirs = _worktree_gitdirs(ws)
+    write_paths = [ws]
+    if workspace != ws:
+        write_paths.append(workspace)
+    if not protect_git:
+        write_paths += gitdirs
+    write_paths += [
+        "/tmp", "/private/tmp", "/var/tmp", "/private/var/tmp",
+        "/private/var/folders",              # $TMPDIR lives here on macOS
+        os.path.join(home, ".chad"),
+        os.path.join(home, ".cache"),
+        os.path.join(home, "Library", "Caches"),
+        os.path.join(home, ".local", "share", "uv"),
+        os.path.join(home, ".npm"),
+    ]
+    lines = ["(version 1)", "(allow default)", "(deny file-write*)",
+             "(allow file-write*"]
+    for p in write_paths:
+        lines.append(f'    (subpath "{_scheme_str(p)}")')
+    lines.append(f'    (literal "{_scheme_str(os.path.join(home, ".gitconfig"))}")')
+    for dev in ("/dev/null", "/dev/stdout", "/dev/stderr", "/dev/fd"):
+        lines.append(f'    (literal "{dev}")')
+    lines.append('    (regex #"^/dev/tty")')
+    lines.append(")")
+    deny_paths = [os.path.join(home, ".chad", "checkpoints")]
+    if protect_git:
+        deny_paths.append(os.path.join(ws, ".git"))
+        if workspace != ws:
+            deny_paths.append(os.path.join(workspace, ".git"))
+        deny_paths += gitdirs
+    lines.append("(deny file-write*")
+    for p in deny_paths:
+        lines.append(f'    (subpath "{_scheme_str(p)}")')
+    lines.append(")")
+    return "\n".join(lines) + "\n"
+
+
+def _profile_path(workspace: str) -> str:
+    # Keyed on the git-protection tier as well as the workspace: the profile body
+    # differs, and lever state can change between calls within one process.
+    ws = os.path.realpath(workspace)
+    key = (ws, levers.enabled("seatbelt_protect_git"))
+    path = _profiles.get(key)
+    if path and os.path.exists(path):
+        return path
+    fd, path = tempfile.mkstemp(prefix="chad-seatbelt-", suffix=".sb")
+    with os.fdopen(fd, "w", encoding="utf-8") as fh:
+        fh.write(profile_text(ws))
+    _profiles[key] = path
+    log.info("SEATBELT profile for %s -> %s", ws, path)
+    return path
+
+
+def wrap_argv(command: str) -> Optional[list]:
+    """The argv to spawn `command` sandboxed, or None to run it unconfined.
+    None whenever the lever is off, the executing agent is not in yolo mode, or
+    the platform can't do Seatbelt — tool_bash falls through to its normal
+    shell=True spawn, byte-identical behavior to before this module existed."""
+    if not levers.enabled("yolo_seatbelt"):
+        return None
+    if not _ctx["active"] or not probe():
+        return None
+    workspace = _ctx["workspace"] or os.getcwd()
+    try:
+        profile = _profile_path(workspace)
+    except OSError as e:
+        # No profile means no confinement; in yolo that is the unsafe direction,
+        # but killing every bash call is worse — log loudly and run unconfined.
+        log.warning("SEATBELT profile write failed (%s) — running unconfined", e)
+        return None
+    return [SANDBOX_EXEC, "-f", profile, "/bin/sh", "-c", command]

{chad_code-1.11.0 → chad_code-1.12.0}/src/chad/tools.py

@@ -21,7 +21,7 @@ import threading
 import time
 from typing import Any
 
-from . import config, levers, lsp, repomap, symbols, syntaxgate
+from . import config, levers, lsp, repomap, seatbelt, symbols, syntaxgate
 from .ignore import IGNORE_DIRS, slash_wrapped
 
 # Directories never worth walking: huge, generated, or VCS internals. The canonical set
@@ -276,13 +276,39 @@ def _bash_backgrounded(d: "_BgDrainer", timeout: int) -> str | None:
     return head + "\n" + _bash_headtail(partial) if partial else head
 
 
+# Environment variable names shaped like credentials, dropped from spawned shell
+# children when the bash_env_guard lever is on. Name-pattern only: values are never
+# inspected (a value test would itself be a secret-handling liability), and the
+# pattern is anchored at the end so AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, and
+# DB_PASSWORD match while PATH, TOKENIZERS_PARALLELISM, and friends pass through.
+_ENV_SECRET_RE = re.compile(
+    r"(?i)(TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIALS?|API_?KEY|"
+    r"ACCESS_KEY(_ID)?|SECRET_KEY|PRIVATE_KEY)$")
+
+
+def _bash_env() -> dict | None:
+    """The environment for a spawned bash child: None (inherit the parent env
+    untouched — the default contract) unless the guard lever is on, in which case a
+    copy with credential-shaped names removed. A command that legitimately needs a
+    credential sees a clear absence, not a corrupted value."""
+    if not levers.enabled("bash_env_guard"):
+        return None
+    env = {k: v for k, v in os.environ.items() if not _ENV_SECRET_RE.search(k)}
+    dropped = len(os.environ) - len(env)
+    if dropped:
+        levers.fired("bash_env_guard", dropped=dropped)
+    return env
+
+
 def _bash_auto_background(command: str, timeout: int, should_stop) -> str:
     """tool_bash's timeout path when auto-background is armed. Mirrors the foreground
     loop exactly, except that a timeout hands the command off instead of killing it."""
+    argv = seatbelt.wrap_argv(command)
     try:
-        p = subprocess.Popen(command, shell=True, stdout=subprocess.PIPE,
+        p = subprocess.Popen(argv if argv is not None else command,
+                             shell=argv is None, stdout=subprocess.PIPE,
                              stderr=subprocess.STDOUT, text=True, errors="replace",
-                             start_new_session=True)
+                             start_new_session=True, env=_bash_env())
     except OSError as e:
         return f"[failed to launch: {e}]"
     d = _BgDrainer(p)
@@ -308,20 +334,23 @@ def _bash_auto_background(command: str, timeout: int, should_stop) -> str:
         p.poll()
     if p.returncode not in (0, None):
         out = f"[exit {p.returncode}]\n{out}"
+    out = _seatbelt_note(argv, out)
     return _bash_headtail(out) if out else "[no output]"
 
 
 def tool_bash(command: str, timeout: int = 120, should_stop=None) -> str:
     if levers.enabled("bash_auto_background"):
         return _bash_auto_background(command, timeout, should_stop)
+    argv = seatbelt.wrap_argv(command)
     try:
         # errors="replace": text mode decodes strictly by default, so binary bytes in the
         # output (hexdump, `cat` on an archive) killed the reader thread mid-communicate —
         # the command's whole output AND its exit code vanished into a "[no output]" that
         # read as a quiet success (and could spoof the verify gate).
-        p = subprocess.Popen(command, shell=True, stdout=subprocess.PIPE,
+        p = subprocess.Popen(argv if argv is not None else command,
+                             shell=argv is None, stdout=subprocess.PIPE,
                              stderr=subprocess.STDOUT, text=True, errors="replace",
-                             start_new_session=True)
+                             start_new_session=True, env=_bash_env())
     except OSError as e:
         return f"[failed to launch: {e}]"
     # Drain output on a helper thread (so large output can't deadlock the pipe)
@@ -344,9 +373,21 @@ def tool_bash(command: str, timeout: int = 120, should_stop=None) -> str:
         p.poll()  # reconcile: a reader-thread death skips communicate()'s internal wait
     if p.returncode not in (0, None):
         out = f"[exit {p.returncode}]\n{out}"
+    out = _seatbelt_note(argv, out)
     return _bash_headtail(out) if out else "[no output]"
 
 
+def _seatbelt_note(argv, out: str) -> str:
+    """When a sandboxed command's output shows a write denial, say what happened
+    and what to do — a bare 'Operation not permitted' reads as a broken tool, and
+    a model that can't see the boundary will retry into it. Each detected denial
+    is exactly the event the lever exists to produce, so it fires here."""
+    if argv is None or seatbelt.DENIAL_MARKER not in out:
+        return out
+    levers.fired("yolo_seatbelt", denial=True)
+    return out + seatbelt.DENIAL_NOTE
+
+
 def _bash_killed(reason: str, partial: str | None) -> str:
     """Result for a bash command chad killed (timeout or interrupt). The output the
     process wrote before it died is already drained into `partial` by the join above —