14 Commits

Include renames

Author	SHA1	Message	Date
6 people	55fa05f0ab	fix(sandbox): deny reads of Zero credential stores (#681) ... * fix(sandbox): deny reads of zero credential stores * fix(sandbox): address PR review comments - Deny reads of mcp-oauth-tokens.json.secret in the default Zero config candidates: file-backed oauth stores keep their encryption secret in a sibling .secret file, so the default MCP token store needs the same protection as the override paths (CodeRabbit). - Clarify that explicit credential-file overrides are still filtered by on-disk existence like every other candidate (Copilot). - Align the zeroUserConfigDir doc comment with config.UserConfigDir: macOS honors XDG_CONFIG_HOME before falling back to ~/.config (Copilot). Co-Authored-By: Claude Fable 5 <[email protected]> * fix(sandbox): deny the whole Zero config dir, not itemized filenames Address code review on PR #681: - Deny credentialDenyReadPaths' Zero-config candidate as the containing directory instead of an itemized filename list. The token/credential/ config stores each publish through a randomly-named .tmp-<pid>-<nanos> sibling before their atomic rename, and the legacy MCP token store leaves a mcp-oauth-tokens.json.migrated backup after importing it — none of those names were covered by the old itemized list, so a sandboxed command could read them under the read-all posture. - Stop dropping default candidates that don't exist yet at profile-build time. A store created later in a long-lived sandboxed session (e.g. a concurrent ) previously got no deny rule at all; every backend already treats a deny rule over a not-yet-existing path as a harmless no-op that still takes effect once the path appears. - Resolve ZERO_OAUTH_TOKENS_PATH / ZERO_MCP_OAUTH_TOKENS_PATH overrides the same way the token stores resolve them (relative-to-cwd, no ~ expansion) instead of through normalizeProfilePath, which tilde-expands and so could derive a deny path different from where the store actually writes. Adds regression coverage for the directory-wide deny (including the migrated backup and synthetic temp-file siblings), for building the profile before the store directory exists, and for the tilde-override resolution mismatch. Co-Authored-By: Claude Sonnet 5 <[email protected]> * fix(sandbox): address macOS deny-path test and config parity Recompute the expected Zero config deny path after MkdirAll and resolve the temp base with EvalSymlinks so macOS /var -> /private/var does not flake TestPermissionProfileDeniesZeroCredentialFiles. Add a parity test that sandbox.zeroUserConfigDir stays aligned with config.UserConfigDir. Co-authored-by: PierrunoYT <[email protected]> * fix(sandbox): harden credential deny paths * test(cli): normalize credential deny baseline * fix(sandbox): close credential path gaps * test(sandbox): normalize command credential path * fix(sandbox): handle absent credential paths safely * fix(sandbox): protect MCP OAuth siblings * fix(sandbox): protect OAuth lock siblings * docs(sandbox): clarify Linux future-path limits * test(sandbox): probe credential store reads in the Linux smoke test The smoke test wired HOME/XDG_CONFIG_HOME at credential directories but never attempted a read through the sandbox, so it could not catch a real-bwrap regression for the paths this change protects. Write a secret into ~/.aws and $XDG_CONFIG_HOME/zero and add both to the deny-read table. * fix(sandbox): keep the credential deny usable, current, and unguessable Four problems with the credential deny baseline, all in the same mechanism. The whole-directory deny over $XDG_CONFIG_HOME/zero also hid the supported user plugin, specialist, and command roots, whose commands and scripts are executed through this sandbox, so an installed user plugin could no longer start. Narrowing the deny to itemized files was not an option: the stores publish through temporary names and a concurrent login can add a store that did not exist when the profile was built, and only a directory rule covers both. The directory deny therefore stays, and the non-secret subtrees are carved back out through a new DenyReadCarveouts field: seatbelt re-allows them after the deny (SBPL is last-match-wins) plus ancestor metadata so path resolution can reach them, and bubblewrap masks the directory with --perms 111 instead of 000 -- unlistable but traversable -- and re-binds the carveout read-only before the tmpfs is remounted read-only. A relative ZERO_OAUTH_TOKENS_PATH, ZERO_MCP_OAUTH_TOKENS_PATH, or XDG_CONFIG_HOME was resolved against the command directory only, while oauth.ResolveStorePath and mcp.ResolveTokenStorePath call filepath.Abs, i.e. resolve against the Zero process working directory. A command run from a subdirectory therefore had the wrong path denied and the real store stayed readable under the read-all posture. Relative candidates now resolve against both directories, since the process that resolves the value is not necessarily the one that writes the store. The regression test runs the command from a different directory than the process, which the previous tests did not. bubblewrap cannot mount over a path that is absent when the namespace is assembled, so a store created mid-session stayed readable through the live read-only host-root bind for the rest of a long-lived sandbox session. The directories Zero owns -- its config directory and the per-store publication directories -- are now reported as EnsureDenyReadDirs and created (0700) before the namespace is assembled, so their mask always exists. Third-party stores such as ~/.aws are still skipped when absent: Zero must not create them, and that limitation stays documented on the field. The fixed <store>.tmp publication sibling made the plaintext token, and via the same path its encryption key, observable to a same-user sandboxed process with write access to an override parent: it could wait for the known name and rename the opened inode into an allowed path. Both stores now publish through a per-store <store>.publish directory with a randomly-named file inside. The directory name is derived from the store path, so the profile can deny it up front, while the random name inside is what cannot be waited for or renamed away. A test keeps the duplicated suffix in step with oauth.PublicationDirSuffix. Also adds the seatbelt render coverage that was missing: dropping DenyReadIfExists from denyReadRules made every credential store readable again on macOS without failing a single test. * fix(sandbox): close credential deny review gaps Preserve process credential roots alongside command overrides while limiting host precreation and read carveouts to trusted process-derived paths. Canonicalize future credential roots through existing path aliases, reject symlink carveouts, and collapse automatic masks already covered by user or automatic directory denies. Normalize the policy golden and add regression coverage across profile, Seatbelt, and bubblewrap rendering. Amp-Thread-ID: https://ampcode.com/threads/T-019fa019-2f41-7398-8692-75327064c6f0 Co-authored-by: Pierre Bruno <[email protected]> * fix(sandbox): normalize credential carveout paths Amp-Thread-ID: https://ampcode.com/threads/T-019fa019-2f41-7398-8692-75327064c6f0 Co-authored-by: Pierre Bruno <[email protected]> * fix(sandbox): canonicalize backend credential masks Amp-Thread-ID: https://ampcode.com/threads/T-019fa019-2f41-7398-8692-75327064c6f0 Co-authored-by: Pierre Bruno <[email protected]> * test(sandbox): normalize backend mask expectations Amp-Thread-ID: https://ampcode.com/threads/T-019fa019-2f41-7398-8692-75327064c6f0 Co-authored-by: Pierre Bruno <[email protected]> * fix(sandbox): fail closed for replaceable token stores Amp-Thread-ID: https://ampcode.com/threads/T-019fa7a0-1223-701d-9529-48ba5d7cf8c8 Co-authored-by: Pierre Bruno <[email protected]> * fix(sandbox): allow keyring token path overrides Amp-Thread-ID: https://ampcode.com/threads/T-019fbdfa-8469-731e-87c0-b26b7641cf59 Co-authored-by: Pierre Bruno <[email protected]> * fix(sandbox): harden command credential roots Amp-Thread-ID: https://ampcode.com/threads/T-019fbec7-c723-74d9-a323-026040b94436 Co-authored-by: Pierre Bruno <[email protected]> * fix(sandbox): close credential deny review gaps Reapply credential denies after Seatbelt extension carveouts and model the legacy MCP token path as a migration input rather than an atomic writer. Retain Bubblewrap fail-closed markers for OAuth outputs exposed through readable carveouts, and add regressions for both platform policies. Amp-Thread-ID: https://ampcode.com/threads/T-019fbf55-f6b0-71fc-b384-652ba32b9645 Co-authored-by: Pierre Bruno <[email protected]> --------- Co-authored-by: Claude Fable 5 <[email protected]> Co-authored-by: Cursor Agent <[email protected]> Co-authored-by: PierrunoYT <[email protected]> Co-authored-by: Amp <[email protected]>	2026-08-10 07:33:29 +08:00
Vasanth T	990e3c439b	fix(sandbox): self-dispatch the Windows sandbox helpers so they work in dev (#280) ... Zero already had a complete Windows sandbox (restricted token + workspace ACLs + WFP network filters), but it was unreachable in dev and plain go build: the backend was only selected when the standalone helper exes were found adjacent to the binary or on PATH (release layout only), so every bash command hard-failed with 'Windows sandbox command runner is not available'. Add self-dispatch: the running zero binary acts as its own helper via two hidden subcommands, with three-tier discovery (adjacent exe, PATH, then self-dispatch via os.Executable) mirroring the Linux fallback. Also surface the elevation requirement for 'zero sandbox setup' (WFP/ACL need Administrator) instead of a raw ACCESS_DENIED. Tests cover the three discovery tiers, dispatch routing, and the unavailable edge.	2026-06-21 14:01:49 +05:30
Anandan	ac6addaa83	Align sandbox permission blocks and backend states (#253) ... * Prompt for shell network permissions Route network-risk shell calls through the existing permission prompt instead of hard-denying them at sandbox preflight. Approved network prompts apply the current turn/session request-permissions overlay so the effective sandbox policy is widened only after user approval. Move network command detection into the shell AST analyzer for package installers, gh/git network subcommands, and python http.server so quoted process patterns such as pkill -f "python3 -m http.server 8000" are not misclassified as network activity. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox -run 'TestAnalyzeCommand|TestClassifyDoesNotFlagQuotedHttpServerPattern|TestEvaluateExemptsNetworkToolsFromDenyByDefault|TestEngineClassifiesNetworkAndDestructiveShellCommands|TestGrantRequestPermissionsNetworkOverlaysPolicyForTurn' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/agent -run 'TestRunPersistentCommandPrefixStillPromptsForNetwork|TestRunApprovedNetworkBashPromptAppliesTurnNetworkGrant' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/tools -run 'TestBash|TestRegistryRunsBashThroughSandboxEngine' Tested: GOCACHE=/tmp/zero-go-cache go test ./... * Auto-allow native-sandboxed shell commands Remove the old hidden bash auto-allow environment/config path. Ordinary shell commands now use the active native sandbox as the permission boundary by default, while network, destructive, and workspace policy checks still run first. Policy-only and disabled sandbox backends continue to require approval for shell commands, so unsandboxed execution is not silently allowed. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox -run 'TestSandboxedBash|TestShellSandboxActive|TestEvaluateExemptsNetworkToolsFromDenyByDefault|TestGrantRequestPermissionsNetworkOverlaysPolicyForTurn|TestAnalyzeCommand|TestClassifyDoesNotFlagQuotedHttpServerPattern' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/tools -run 'TestBashAuto|TestBashStillPromptsWithoutActiveSandbox|TestRegistryRunsBashThroughSandboxEngine' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/cli -run 'TestApplyConfiguredSandboxPolicy|TestApplyConfiguredAutonomyCeiling' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/agent -run 'TestRunPersistentCommandPrefixStillPromptsForNetwork|TestRunApprovedNetworkBashPromptAppliesTurnNetworkGrant' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/daemon -run 'TestScrubWorkerEnvRemovesReentrancyMarkers' Tested: GOCACHE=/tmp/zero-go-cache go test ./... * Prompt for destructive shell approval Remove the separate DenyDestructiveShell policy layer from active sandbox decisions. Destructive shell classification now produces an approval prompt in ask/auto flows instead of a sandbox hard-deny, while no-approval paths remain blocked. Drop the removed destructive-shell policy field from sandbox policy output, backend capabilities, snapshots, and Windows golden data. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/agent -run 'TestRunPromptsForDestructiveShellInsteadOfSandboxDeny|TestRunPersistentCommandPrefixStillPromptsForNetwork|TestRunApprovedNetworkBashPromptAppliesTurnNetworkGrant' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox -run 'TestEngineClassifiesNetworkAndDestructiveShellCommands|TestBackendCapabilitiesReflectDisabledPolicy' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/cli -run 'TestRunSandboxPolicy|TestEffectiveSandboxPolicy' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/zerocommands -run 'TestSandboxPolicySnapshotFromPolicyFillsEffectiveMode' Tested: GOCACHE=/tmp/zero-go-cache go test ./... * Remove web-tool network policy switch Remove the old EnforceToolNetwork policy option and the NetworkHostAllowed per-tool gate so sandbox network policy only controls sandboxed shell egress. Keep web_search and web_fetch on their own tool permission and URL safety paths, with tests proving deny/scoped shell network policy no longer blocks in-process web tools. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox -run 'TestEvaluateExemptsNetworkToolsFromShellNetworkPolicy|TestEngineAllowsNetworkSideEffectWhenShellPolicyBlocksNetwork|TestGrantRequestPermissionsNetworkOverlaysPolicyForTurn|TestScopedNetworkGateInEvaluate' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/tools -run 'TestWebSearchRunWithSandbox|TestWebFetchRunWithSandbox|TestRegistryRoutesWebFetchThroughSandboxPath' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/agent -run 'TestRunPersistentCommandPrefixStillPromptsForNetwork|TestRunApprovedNetworkBashPromptAppliesTurnNetworkGrant' Tested: GOCACHE=/tmp/zero-go-cache go test ./... Tested: git diff --check * Prompt for outside-workspace file access Convert recoverable outside-workspace file path violations into permission prompts instead of hard-denying in ask/auto modes. Approved prompts now grant the requested filesystem scope through the existing request_permissions overlay for the current turn or session, so the follow-up sandbox evaluation and scoped file tools use the same policy path. Keep unsafe mode, apply_patch escapes, symlink traversal, and non-recoverable path cases hard-denied. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox -run 'TestEngineAutoAllowsWorkspaceFileMutationTools|TestEngineDeniesOutOfWorkspacePaths|TestGrantRequestPermissionsReadDoesNotGrantWrite|TestGrantRequestPermissionsSessionPersists' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/agent -run 'TestRunPromptsAndAllowsOutsideWorkspaceWrite|TestRunSessionAllowsLaterOutsideWorkspaceWrite|TestRunAppliesSandboxEvenInUnsafeMode' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/tools -run 'TestRegistryAppliesSandboxBeforeToolExecution|TestRegistrySandboxGatesPathAliasKeys|TestRegistryAllowsPromptToolWithPersistentSandboxGrant' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/cli -run 'TestRunSandboxCheckJSONDeniesOutOfWorkspaceWrite' Tested: GOCACHE=/tmp/zero-go-cache go test ./... Tested: git diff --check * Fix Windows network prompt test fixture Use a Windows curl.cmd shim and cmd.exe PATH syntax for TestRunApprovedNetworkBashPromptAppliesTurnNetworkGrant while keeping the POSIX fake curl fixture for Linux and macOS. This keeps the test focused on network prompt approval and turn network grants instead of relying on a POSIX shell script being executable on Windows. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/agent -run 'TestRunApprovedNetworkBashPromptAppliesTurnNetworkGrant|TestRunPersistentCommandPrefixStillPromptsForNetwork' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox -run 'TestClassifyASTCatchesNetworkProgramsRegexMisses|TestClassifyFlagsPipedInstallerVariants' Tested: GOCACHE=/tmp/zero-go-cache go test ./... Tested: git diff --check * Remove sandbox autonomy ceilings Sandbox permission decisions now match grants by tool and scope only, without MaxAutonomy or request autonomy checks. Persistent/session grants, permission approvals, workspace-write auto-allow, and native-sandbox shell auto-allow no longer route through an autonomy ceiling. Remove the sandbox.maxAutonomy config and CLI surfaces, including grant --auto, policy output, sandbox check autonomy input, and sandbox grant snapshots. MCP permission autonomy is intentionally unchanged because it is a separate MCP permission model. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox ./internal/agent ./internal/tools ./internal/zerocommands ./internal/config ./internal/cli ./internal/tui Tested: GOCACHE=/tmp/zero-go-cache go test ./... * Fail closed without native sandbox Remove AllowPolicyOnlyRunner from sandbox policy and snapshots. A restricted/managed command plan now errors when native sandbox support is unavailable instead of running through a policy-only direct runner. Policy-only backend data remains as diagnostics for capability/reporting paths, but it no longer authorizes command execution when a platform sandbox is required. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox ./internal/zerocommands ./internal/cli ./internal/tui Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/agent ./internal/tools Tested: GOCACHE=/tmp/zero-go-cache go test ./... * Remove scoped shell network policy Drop the domain-scoped shell network mode and the local scoped-egress proxy path from the active sandbox model. Shell network policy now serializes and evaluates only deny or allow. Request-permissions network grants widen to allow without domain lists, and platform profiles consume the binary mode directly. The Linux helper no longer accepts proxy-route flags, Windows network hashes only the binary mode, and web tool tests assert they remain separate from shell network policy. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox ./internal/tools ./internal/notify Tested: GOCACHE=/tmp/zero-go-cache go test ./... * Align permission grant ordering and prompt text Move persistent and session grant matching ahead of recoverable sandbox prompts while keeping explicit denies and non-recoverable path violations fail-closed. Clean TUI permission transcript/card text so normal prompts show action, reason, scope, and readable block details instead of raw permission/risk/violation key-value metadata. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox ./internal/tui ./internal/agent ./internal/tools Tested: GOCACHE=/tmp/zero-go-cache go test ./... * Remove policy-only sandbox terminology Replace the unavailable native-backend diagnostic path with explicit unavailable support/backend states, and stop presenting missing native isolation as a policy-only fallback. Rename structured sandbox denial metadata from violation to block across permission events, stream-json, snapshots, TUI rendering, and sandbox-check output so user-facing flow matches blocked action language. Update README, work split docs, smoke test selectors, and Windows sandbox policy golden output for the new backend/support names and block payloads. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox ./internal/agent ./internal/tools ./internal/tui ./internal/cli ./internal/doctor ./internal/zerocommands ./internal/streamjson Tested: GOCACHE=/tmp/zero-go-cache go test ./... Tested: scripts/sandbox-smoke.sh Tested: git diff --check * Fix sandbox review follow-ups Fail closed for unknown network modes, keep network prompts ahead of bash allow grants, preserve v1 grant-file reads, and classify unparseable commands with obvious network programs as network-risk. Bump stream-json schema to v2 and document the block metadata field after the violation-to-block rename. Tests: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox ./internal/streamjson ./internal/specialist ./internal/cli -run 'TestExec.*Stream|TestStreamJSON|TestExecProtocol|TestExecReadsStreamJSONImages|TestExecAcceptsImageOnlyStreamJSONMessage|TestExecInputFormatStreamJSON' Tests: GOCACHE=/tmp/zero-go-cache go test ./... Tests: scripts/sandbox-smoke.sh Tests: git diff --check	2026-06-19 19:50:12 +05:30
Anandan	673fce11bd	Persist command prefix approvals (#252) ... Add file-backed command prefix grants to the sandbox store and load them through the engine so approved prefixes skip future prompts while still running through sandbox policy checks. Tighten reusable prefix validation for runner-style launchers and script paths, and classify find -delete as destructive. Surface persistent prefix choices in the TUI and include approved prefixes in the run prompt context and sandbox grants list. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/agent ./internal/sandbox ./internal/tui ./internal/cli Tested: GOCACHE=/tmp/zero-go-cache go test ./... Tested: git diff --check	2026-06-18 21:56:24 +05:30
Anandan	4cb1f10952	Add sandbox architecture baseline (#240) ... * Add sandbox architecture baseline Record target backend names, enforcement metadata, legacy sandbox entrypoints, and policy JSON baseline coverage for the sandbox rewrite. Add a focused sandbox smoke script with cross-platform compile checks and an opt-in real backend smoke path. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox -run 'TestTargetBackendForPlatformBaseline|TestLegacySandboxEntrypointsAreExplicitAndExist|TestBackendPlanCarriesPhase0ManagerFields|TestCommandPlanCarriesSandboxMetadata|TestPolicyOnlyDisabledFailClosedForTargetPlatforms|TestSelectBackendChoosesPlatformAdapterWithFallback|TestBackendBuildPlanDocumentsBestEffortIsolation|TestBackendCapabilitiesReflectDisabledPolicy' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/cli -run 'TestRunSandboxPolicyInspectTextAndJSON|TestRunSandboxPolicyJSONGoldenIncludesManagerBaselineFields|TestRunSandboxPolicyEffectiveTextAndJSON' Tested: scripts/sandbox-smoke.sh Tested: git diff --cached --check * Introduce sandbox manager and permission profile Add a normalized permission profile and sandbox manager execution request that owns target backend selection, enforcement metadata, and fail-closed validation. Route command planning and sandbox policy output through the manager boundary while keeping legacy adapters explicit as temporary integration points. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox -run 'TestPermissionProfileFromPolicyBuildsWorkspaceWriteProfile|TestPermissionProfileFromDisabledPolicyDoesNotRequirePlatformSandbox|TestSandboxManagerBuildsExecutionRequestFromProfile|TestSandboxManagerFailsClosedWhenNativeRequiredAndPolicyOnlyDisabled|TestTargetBackendForPlatformBaseline|TestBackendPlanCarriesPhase0ManagerFields|TestCommandPlanCarriesSandboxMetadata|TestPolicyOnlyDisabledFailClosedForTargetPlatforms' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/cli -run 'TestRunSandboxPolicyInspectTextAndJSON|TestRunSandboxPolicyJSONGoldenIncludesManagerBaselineFields|TestRunSandboxPolicyEffectiveTextAndJSON' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/tools -run 'TestRegistryRunsBashThroughSandboxEngine|TestBashToolReportsDisabledPolicyOnlyRunner|TestBashToolBuildsWrappedSandboxExecCommand' Tested: scripts/sandbox-smoke.sh Tested: git diff --cached --check * Move sandbox backend selection into manager Make SandboxManager own platform backend selection and keep SelectBackend as a compatibility shim for existing CLI and TUI wiring. Add tests proving manager-owned selection and the compatibility wrapper agree. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox -run 'TestSandboxManagerSelectsPlatformBackend|TestSelectBackendDelegatesToSandboxManagerSelection|TestSelectBackendChoosesPlatformAdapterWithFallback|TestLegacySandboxEntrypointsAreExplicitAndExist|TestSandboxManagerBuildsExecutionRequestFromProfile|TestSandboxManagerFailsClosedWhenNativeRequiredAndPolicyOnlyDisabled' Tested: scripts/sandbox-smoke.sh Tested: git diff --cached --check * Route command planning through sandbox manager Make SandboxManager build command plans from sandbox execution requests, with backend-specific wrapping isolated behind a temporary adapter. Move Engine.BuildCommandPlan to a single manager boundary and mark buildLegacyCommandPlan as the explicit delete target for later backend work. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox -run 'TestSandboxManagerBuildsCommandPlanThroughTemporaryAdapter|TestSandboxManagerBuildsDegradedPolicyOnlyCommandPlan|TestBuildCommandPlanWrapsBubblewrap|TestBuildCommandPlanWrapsSandboxExec|TestBuildCommandPlanUsesPolicyOnlyFallback|TestBuildCommandPlanCanRejectPolicyOnlyFallback|TestLegacySandboxEntrypointsAreExplicitAndExist|TestSandboxManagerBuildsExecutionRequestFromProfile|TestSandboxManagerFailsClosedWhenNativeRequiredAndPolicyOnlyDisabled' Tested: scripts/sandbox-smoke.sh Tested: git diff --cached --check * Add Linux sandbox helper command boundary Introduce the zero-linux-sandbox command surface and typed permission-profile argv builder used by the upcoming Linux helper rewrite. Keep the helper fail-closed until enforcement is wired, and add parser tests plus smoke compilation for the new helper package. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox -run 'TestBuildLinuxSandboxCommandArgsSerializesPermissionProfile|TestParseLinuxSandboxHelperArgs|TestRunLinuxSandboxHelperFailsClosedUntilEnforcementIsWired' Tested: scripts/sandbox-smoke.sh Tested: git diff --cached --check * Fix sandbox policy golden path aliases Normalize both original and symlink-resolved temp paths before comparing sandbox policy JSON goldens, so macOS /private/var aliases do not fail the smoke job. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/cli -run 'TestRunSandboxPolicyJSONGoldenIncludesManagerBaselineFields|TestRunSandboxPolicyInspectTextAndJSON|TestRunSandboxPolicyEffectiveTextAndJSON' Tested: scripts/sandbox-smoke.sh Tested: git diff --cached --check * Fix Windows sandbox smoke test assumptions Normalize JSON-escaped Windows paths in the sandbox policy golden test and mark the fake bubblewrap backend as Linux in the command metadata test. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/cli -run 'TestRunSandboxPolicyJSONGoldenIncludesManagerBaselineFields|TestRunSandboxPolicyInspectTextAndJSON|TestRunSandboxPolicyEffectiveTextAndJSON' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox -run 'TestCommandPlanCarriesSandboxMetadata|TestBackendPlanCarriesPhase0ManagerFields|TestPolicyOnlyDisabledFailClosedForTargetPlatforms' Tested: scripts/sandbox-smoke.sh Tested: git diff --cached --check * Stabilize sandbox policy golden test Compare the Windows sandbox policy golden as decoded JSON after path tokenization so platform-specific byte formatting does not fail smoke tests while preserving the same field-level regression coverage. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/cli -run TestRunSandboxPolicyJSONGoldenIncludesManagerBaselineFields Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/cli -run 'TestRunSandboxPolicyJSONGoldenIncludesManagerBaselineFields|TestRunSandboxPolicyInspectTextAndJSON|TestRunSandboxPolicyEffectiveTextAndJSON' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox Tested: scripts/sandbox-smoke.sh Tested: git diff --check * Route Linux sandboxing through helper Move Linux command planning to invoke zero-linux-sandbox with the permission profile, command cwd, and command argv instead of exposing bubblewrap construction from the runner boundary. The helper now builds the bubblewrap argv, binds its own executable for the inner stage, applies the seccomp/no-new-privs step before exec, and preserves the original command cwd path. Package Linux releases with zero-linux-sandbox next to zero so release builds use the helper directly, while local development can fall back to go run for the helper. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/cli ./internal/tools ./cmd/zero-linux-sandbox Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/release ./cmd/zero-release Tested: scripts/sandbox-smoke.sh Tested: git diff --check * Normalize Linux helper cwd test paths Compare native paths in the helper cwd regression test so Windows smoke does not fail on path separator formatting while preserving the same helper behavior assertion. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox -run TestLinuxHelperPlanPreservesRealExtraRootCwd Tested: scripts/sandbox-smoke.sh Tested: git diff --check * Add Linux Landlock helper enforcement Implement the zero-linux-sandbox Landlock helper path with fail-closed profile validation, Landlock filesystem rules, and seccomp network-deny enforcement for the fallback backend. Broaden the Linux real smoke coverage to cover helper write allow/deny, deny-read, temp writes, metadata protection, network deny, and direct Landlock fallback behavior. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox Tested: scripts/sandbox-smoke.sh Tested: GOCACHE=/tmp/zero-go-cache go test ./cmd/zero-linux-sandbox ./internal/cli ./internal/tools ./internal/release ./cmd/zero-release Tested: git diff --check * Route Seatbelt profiles through permission profiles Build macOS sandbox-exec profiles from the shared PermissionProfile so read roots, write roots, temp access, deny-read, deny-write, and protected metadata are expressed by the platform profile instead of legacy write-root-only inputs. Keep the existing sandbox-exec adapter path as a compatibility wrapper while adding target macos-seatbelt capability handling. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox Tested: scripts/sandbox-smoke.sh Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/cli ./internal/tools Tested: git diff --check * Stabilize Seatbelt write carveouts Emit protected metadata and read-only write-root carveouts as explicit Seatbelt deny rules after the broad write allow. This preserves deny precedence while avoiding fragile allow-rule predicates in real sandbox-exec runs. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox Tested: scripts/sandbox-smoke.sh Tested: git diff --check * Expand macOS Seatbelt runtime allowances Restore the platform startup allowances needed by sandbox-exec-wrapped commands under restricted filesystem profiles: executable mapping, system metadata reads, pty/device access, preferences, IPC, and standard library/runtime roots. This keeps project writes constrained to the PermissionProfile roots while preventing macOS shells from aborting before user commands run. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox Tested: scripts/sandbox-smoke.sh Tested: git diff --check * Normalize Seatbelt deny expectations in tests Build Seatbelt deny-rule expectations from normalized profile paths so the metadata ordering test matches production behavior on Windows and Unix hosts. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox Tested: scripts/sandbox-smoke.sh Tested: GOOS=windows GOARCH=amd64 GOCACHE=/tmp/zero-go-cache go test -c ./internal/sandbox -o /tmp/zero-sandbox.test.exe Tested: git diff --check * Add Windows sandbox runner command planning Select the windows-restricted-token backend only when the Windows sandbox command runner is discoverable, and keep the missing-runner path as an explicit policy-only downgrade. Add the Windows runner argument contract for command cwd, workspace roots, permission profile JSON, child environment JSON, restricted-token level, and payload command parsing. Update sandbox policy output and tests to describe the missing Windows runner instead of an unimplemented adapter. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/cli Tested: GOOS=windows GOARCH=amd64 GOCACHE=/tmp/zero-go-cache go test -c ./internal/sandbox -o /tmp/zero-sandbox.test.exe Tested: scripts/sandbox-smoke.sh Tested: GOCACHE=/tmp/zero-go-cache go test ./... Tested: git diff --check * Add Windows sandbox command runner Add the zero-windows-command-runner executable and wire windows-restricted-token plans to pass sandbox home, command cwd, workspace roots, permission profile JSON, child env JSON, sandbox level, and command argv. Persist Windows capability SIDs under the resolved sandbox home, select read-only or writable-root capability SIDs from the permission profile, and create a restricted token before launching the payload with CreateProcessAsUserW. Package the Windows runner next to zero.exe and extend sandbox smoke coverage to cross-build it. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox ./internal/release ./cmd/zero-windows-command-runner ./cmd/zero-release Tested: GOOS=windows GOARCH=amd64 GOCACHE=/tmp/zero-go-cache go build -o /tmp/zero-windows-command-runner.exe ./cmd/zero-windows-command-runner Tested: scripts/sandbox-smoke.sh Tested: GOCACHE=/tmp/zero-go-cache go test ./... Tested: git diff --check * Plan Windows sandbox ACL operations Derive a deterministic Windows ACL operation list from the restricted permission profile, including writable root allows, protected metadata deny-write entries, explicit deny-write paths, and deny-read materialization targets. The plan maps workspace and extra writable roots onto the persisted capability SIDs so the elevated setup helper can apply the same contract without reinterpreting the profile. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox Tested: GOOS=windows GOARCH=amd64 GOCACHE=/tmp/zero-go-cache go test -c ./internal/sandbox -o /tmp/zero-sandbox.test.exe Tested: GOOS=windows GOARCH=amd64 GOCACHE=/tmp/zero-go-cache go build -o /tmp/zero-windows-command-runner.exe ./cmd/zero-windows-command-runner Tested: GOCACHE=/tmp/zero-go-cache go test ./... Tested: scripts/sandbox-smoke.sh Tested: git diff --check * Add Windows sandbox setup boundary Add the zero-windows-sandbox-setup command, setup argument parsing, deterministic ACL plan hashing, and a setup marker contract that can detect profile changes requiring refresh. Make Windows native backend discovery require both the command runner and setup helper, package the setup helper with Windows releases, and include it in sandbox smoke builds. The setup command remains fail-closed until the Windows ACL applier is wired, so it cannot create a setup-complete marker without applying enforcement. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox ./internal/release ./cmd/zero-windows-sandbox-setup Tested: GOOS=windows GOARCH=amd64 GOCACHE=/tmp/zero-go-cache go test -c ./internal/sandbox -o /tmp/zero-sandbox.test.exe Tested: GOOS=windows GOARCH=amd64 GOCACHE=/tmp/zero-go-cache go build -o /tmp/zero-windows-command-runner.exe ./cmd/zero-windows-command-runner Tested: GOOS=windows GOARCH=amd64 GOCACHE=/tmp/zero-go-cache go build -o /tmp/zero-windows-sandbox-setup.exe ./cmd/zero-windows-sandbox-setup Tested: GOCACHE=/tmp/zero-go-cache go test ./... Tested: scripts/sandbox-smoke.sh Tested: git diff --check * Apply Windows sandbox ACL setup Implement the Windows ACL setup path with grouped native DACL updates, deny-read materialization, existing DACL snapshots, and rollback for partial application failures. Write the setup marker only after ACL setup succeeds, roll back applied ACLs if marker persistence fails, and make the Windows command runner validate the setup marker before creating the restricted token. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox ./cmd/zero-windows-sandbox-setup ./cmd/zero-windows-command-runner Tested: GOOS=windows GOARCH=amd64 GOCACHE=/tmp/zero-go-cache go test -c ./internal/sandbox -o /tmp/zero-sandbox.test.exe Tested: GOOS=windows GOARCH=amd64 GOCACHE=/tmp/zero-go-cache go build -o /tmp/zero-windows-command-runner.exe ./cmd/zero-windows-command-runner Tested: GOOS=windows GOARCH=amd64 GOCACHE=/tmp/zero-go-cache go build -o /tmp/zero-windows-sandbox-setup.exe ./cmd/zero-windows-sandbox-setup Tested: GOCACHE=/tmp/zero-go-cache go test ./... Tested: scripts/sandbox-smoke.sh Tested: git diff --check * Fail closed for Windows network policies Add Windows network policy validation that allows only explicit network-allow until native Windows network enforcement is implemented. Make the Windows command runner reject deny, scoped, and unset network modes before launching a restricted-token process so default network-deny cannot silently run open. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox ./cmd/zero-windows-command-runner Tested: GOOS=windows GOARCH=amd64 GOCACHE=/tmp/zero-go-cache go test -c ./internal/sandbox -o /tmp/zero-sandbox.test.exe Tested: GOOS=windows GOARCH=amd64 GOCACHE=/tmp/zero-go-cache go build -o /tmp/zero-windows-command-runner.exe ./cmd/zero-windows-command-runner Tested: GOCACHE=/tmp/zero-go-cache go test ./... Tested: scripts/sandbox-smoke.sh Tested: git diff --check * Track Windows network setup state Add a canonical Windows network-policy hash and persist it in the Windows sandbox setup marker so setup refresh can detect network mode, domain, and proxy-requirement changes. Bump the setup marker schema and add tests for domain-order normalization plus network-change marker invalidation. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox Tested: GOOS=windows GOARCH=amd64 GOCACHE=/tmp/zero-go-cache go test -c ./internal/sandbox -o /tmp/zero-sandbox.test.exe Tested: GOOS=windows GOARCH=amd64 GOCACHE=/tmp/zero-go-cache go build -o /tmp/zero-windows-command-runner.exe ./cmd/zero-windows-command-runner Tested: GOOS=windows GOARCH=amd64 GOCACHE=/tmp/zero-go-cache go build -o /tmp/zero-windows-sandbox-setup.exe ./cmd/zero-windows-sandbox-setup Tested: GOCACHE=/tmp/zero-go-cache go test ./... Tested: scripts/sandbox-smoke.sh Tested: git diff --check * Add sandbox setup CLI command Add zero sandbox setup to resolve the active sandbox policy, derive the Windows setup helper next to the command runner, and invoke it with the shared Windows setup argument contract. Return text or JSON setup results, no-op cleanly for non-Windows native backends, and add tests using an injected helper runner. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/cli ./internal/sandbox Tested: GOOS=windows GOARCH=amd64 GOCACHE=/tmp/zero-go-cache go test -c ./internal/cli -o /tmp/zero-cli.test.exe Tested: GOOS=windows GOARCH=amd64 GOCACHE=/tmp/zero-go-cache go test -c ./internal/sandbox -o /tmp/zero-sandbox.test.exe Tested: GOOS=windows GOARCH=amd64 GOCACHE=/tmp/zero-go-cache go build -o /tmp/zero-windows-sandbox-setup.exe ./cmd/zero-windows-sandbox-setup Tested: GOCACHE=/tmp/zero-go-cache go test ./... Tested: scripts/sandbox-smoke.sh Tested: git diff --check * Stabilize Windows ACL canonical path test * Add TUI sandbox setup command * Gate TUI sandbox setup command * Clarify sandbox doctor setup status * Add Windows WFP network setup Adds a Windows network enforcement plan with stable WFP provider, sublayer, and filter specs for deny-mode sandbox identities. The setup helper now installs or removes those filters transactionally before writing the setup marker, and the marker tracks the network enforcement plan so stale filters require refresh. Scoped Windows network mode remains fail-closed until the proxy exception path is implemented, so it cannot silently become open network. Diagnostics now report native Windows network enforcement when the restricted-token backend is active. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox -run 'TestValidateWindowsNetworkPolicyAllowsNativeModes|TestValidateWindowsNetworkPolicyFailsClosedForScoped|TestBuildWindowsNetworkPlanForDenyUsesCapabilityIdentity|TestBuildWindowsNetworkPlanFailsClosedForScoped|TestWindowsNetworkPlanHashIsStableAcrossEntryOrder|TestWindowsSandboxSetupMarkerRefreshesWhenNetworkChanges|TestSelectBackendChoosesPlatformAdapterWithFallback' Tested: GOCACHE=/tmp/zero-go-cache GOOS=windows GOARCH=amd64 go build -o /tmp/zero-windows-sandbox-setup.exe ./cmd/zero-windows-sandbox-setup Tested: GOCACHE=/tmp/zero-go-cache GOOS=windows GOARCH=amd64 go build -o /tmp/zero-windows-command-runner.exe ./cmd/zero-windows-command-runner Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox ./internal/cli ./internal/doctor Tested: GOCACHE=/tmp/zero-go-cache go test ./... Tested: GOCACHE=/tmp/zero-go-cache scripts/sandbox-smoke.sh Tested: git diff --check * Add Windows sandbox network smoke Adds a gated Windows real sandbox smoke test that runs the compiled setup helper and command runner, verifies sandboxed writes still work, and proves network=deny blocks a loopback TCP connection from a restricted-token command. The sandbox smoke script now runs this test on Windows using the helper binaries it builds in its temporary directory. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox -run 'TestValidateWindowsNetworkPolicyAllowsNativeModes|TestBuildWindowsNetworkPlanForDenyUsesCapabilityIdentity' Tested: GOCACHE=/tmp/zero-go-cache GOOS=windows GOARCH=amd64 go test -c -o /tmp/zero-windows-sandbox.test ./internal/sandbox Tested: GOCACHE=/tmp/zero-go-cache GOOS=windows GOARCH=amd64 go build -o /tmp/zero-windows-sandbox-setup.exe ./cmd/zero-windows-sandbox-setup Tested: GOCACHE=/tmp/zero-go-cache GOOS=windows GOARCH=amd64 go build -o /tmp/zero-windows-command-runner.exe ./cmd/zero-windows-command-runner Tested: GOCACHE=/tmp/zero-go-cache scripts/sandbox-smoke.sh Tested: GOCACHE=/tmp/zero-go-cache go test ./... Tested: git diff --check * Remove legacy sandbox runner paths Drop the old direct bubblewrap adapter, the standalone zero-seccomp wrapper, legacy adapter metadata, and the Phase 0 legacy inventory now that command planning goes through the sandbox manager backends. Switch platform selection and tests to target backend names: linux-bwrap, macos-seatbelt, windows-restricted-token, and explicit policy-only degradation. Keep policy as the shared permission/profile and diagnostics surface, but stop exposing legacy adapter fields in CLI policy output and tool metadata. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox ./internal/cli ./internal/tools ./internal/zerocommands ./internal/doctor Tested: GOCACHE=/tmp/zero-go-cache scripts/sandbox-smoke.sh Tested: GOCACHE=/tmp/zero-go-cache go test ./... Tested: git diff --check * Address sandbox baseline review blockers Restore sandbox.blockUnixSockets as a resolved config and policy field, route it into the Linux helper as --block-unix-sockets, and keep zero-seccomp as a Linux compatibility wrapper packaged with release artifacts. Add the missing legacy-entrypoint test referenced by the smoke script, extend helper/release/config tests, and make CLI startup tests hermetic by stubbing MCP registration where they assert quiet output. Document the compatibility path, release helper scope, and the already-resolved #237 prompt-file overlap in the PR body. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox ./internal/cli ./internal/config ./internal/release ./cmd/zero-seccomp -run 'TestLegacySandboxEntrypointsAreExplicitAndExist|TestSandboxManagerBuildsCommandPlanThroughLinuxHelper|TestBuildLinuxSandboxCommandArgsSerializesPermissionProfile|TestParseLinuxSandboxHelperArgs|TestBuildLinuxSandboxBwrapArgsWrapsInnerSeccompStage|TestApplyConfiguredSandboxPolicyDiagnosticsFlags|TestResolveSandboxBlockUnixSocketsFromFile|TestCopyPackageFilesStagesLinuxSandboxHelper' Tested: GOCACHE=/tmp/zero-go-cache go test ./... Tested: GOCACHE=/tmp/zero-go-cache scripts/sandbox-smoke.sh Tested: git diff --cached --check Tested: local leak scan found no matches	2026-06-18 12:03:10 +05:30
KRATOS	29fc29a41d	feat: add providers detect and sandbox check (wire audit-found unwired features) + coverage (#238) ... * feat(providers): add `zero providers detect` for local-runtime onboarding Wire the previously-unwired provideronboarding detect/advice surface into the CLI. `zero providers detect` probes for running local OpenAI-compatible runtimes (Ollama, LM Studio) on their default ports and prints a no-key adopt command for each, followed by the next-step actions (use / check / set key) for every configured provider. Supports --json. This connects DetectLocalRuntimes, LocalRuntimeCandidates, DetectedLocalRuntime.SetupAction, ProviderActions, MissingCredentialAction, SetupCommand, and ProviderState.Actions — a fully built, tested feature that had no caller. Adds an injectable detectLocalRuntimes appDep for hermetic tests. * feat(sandbox): add `zero sandbox check` to evaluate a decision as JSON Wire the previously-unwired zerocommands sandbox-snapshot contract into the CLI. `zero sandbox check <tool>` evaluates what the sandbox engine would decide for a hypothetical tool action against the resolved policy, and emits the active plan (policy + backend + restrictions), the decision (allow/prompt/deny with risk and any violation), and any persistent grant matching the tool. Supports --json; grant reasons are redacted. This connects SandboxPlanSnapshotFromPlan, SandboxPolicySnapshotFromPolicy, SandboxBackendSnapshotFromBackend, SandboxDecisionSnapshotFromDecision, SandboxRiskSnapshotFromRisk, SandboxViolationSnapshotFromViolation, and SandboxGrantMatchSnapshotFromLookup — a fully built, tested JSON contract that had no production consumer. The existing `sandbox policy` output is unchanged. * test(providermodelcatalog): cover model predicates and remote fetch layer Add targeted tests for the audit-identified coverage gaps: the pure logic (LooksLikeCodingModelID, modelMatchesProvider, defaultedOpenGatewayURL, modelSortLabel/sortModels) and the HTTP fetch layer (fetchJSON, FetchModelsDev, FetchOpenGateway, FetchRemote routing) via httptest. Package coverage 48.9% -> 79.5%. cmd/zero (main shim) and browser.OpenURL (exec wrapper) are intentionally left to CI smoke — their only logic seams (openCommand) are already covered. * fix(sandbox): address CodeRabbit review on `sandbox check` - Pass the configured write-root scope (NewScope with AdditionalWriteRoots) into the check engine, so its decision matches real enforcement and a stale extra-root config surfaces here too instead of a workspace-only fallback. - Validate --side-effect and --autonomy against their advertised value sets and return a usage error on a typo, rather than letting the engine normalize it. - Reword the unmatched-grant line to "no grant matched this action" — Lookup only checks this tool/scope/autonomy, not whether any grant exists for the tool. - Add tests: invalid-flag rejection and a matched-grant reason-redaction regression. * test(sandbox): make the out-of-workspace check test path OS-portable Smoke (windows-latest) failed: "/etc/passwd" is not absolute on Windows, so the check joined it into the workspace and returned "prompt" instead of "deny". Build the out-of-workspace path under a separate temp dir so it is absolute and outside the workspace on every OS.	2026-06-18 10:20:24 +05:30
KRATOS	474f494b93	Deep-audit remediation + sandbox hardening (batches 1–35) (#189) ... * audit batch 1: redact nested secrets fully; count image tokens in compaction estimate - secrets.Redact: replace longest matches first so a containing PRIVATE KEY block is redacted before a nested shorter match corrupts its exact string (audit medium internal/secrets/scanner.go:81) + regression test. - agent compaction estimateTokens: add a flat per-image token cost so an image-heavy context trends toward compaction instead of reading as ~0 (audit medium internal/agent/compaction.go:58) + test. - ledger: re-verify against current main; mark scanner.go:35 and redaction.go:362 already-fixed-on-main, record this batch's fixes. * audit batch 2: worktrees defaultRunGit separates stdout/stderr Capture git stdout and stderr into separate buffers instead of CombinedOutput, so parsed rev-parse output is not polluted by git warnings and CommandResult.Stderr carries the real error text (audit medium internal/worktrees/worktrees.go:247) + test. * audit: re-verify all 87 pending findings against current main Independent agent per file re-checked each open/partial finding against the actual current code (the 06-11 ledger was verified on a since-diverged branch), with an adversarial second pass on every already_fixed verdict. Authoritative result: 78 genuinely pending (66 still_open + 12 partial); 9 rows were already fixed on main and are reclassified. Full table in 2026-06-13-reverification.md. * audit batch 3 (agent): cancellation identity, always-allow w/o sandbox, compaction usage, dedup - loop.go: check ctx.Err() before collected.Error so a cancelled run returns context.Canceled (errors.Is holds) instead of a plain stringified error. - loop.go: 'Always allow' with no sandbox engine now allows THIS call instead of denying it (persistence is skipped when there's nowhere to persist). - loop.go: remove a duplicate schema["items"] assignment in propertyToRuntimeMap. - compaction.go: forward OnUsage (token accounting) through the summarizer while still omitting OnText, so compaction's token cost is counted in usage/budgets. - tests for all three behavioral fixes (each fails pre-fix). * audit batch 4 (cli): list-tools -o json, interrupted -o json terminal, surface session-record failures - exec --list-tools -o json now emits a JSON tool listing instead of falling through to the human-readable text (audit medium exec.go:182) + test. - interrupted run with -o json now emits a terminal error+done on stdout instead of only printing to stderr, so a JSON consumer sees a clean end (medium exec.go:500) + test. - execSessionRecorder: surface a latched session-append failure to stderr once at run end (deferred) instead of silently dropping it (medium exec_sessions.go:114/115) + test. - left app.go trailing-arg ignore as-is: documented-intentional, TUI has no argv prompt. * audit batch 5 (zerogit): status -z porcelain (renames + non-ASCII paths); document env-drop on plain Runner - parseStatus: switch `git status` to `--porcelain -z` and parse the NUL-delimited form (audit medium zerogit.go:212). Previously the default --short output was split on newlines, so a rename `R old -> new` was kept as one bogus path and a non-ASCII/whitespace filename arrived C-quoted+escaped (e.g. `"caf\303\251.txt"`). The -z form never quotes paths and emits a rename/copy as `XY <dest>\0<src>`, so we now record the destination verbatim and consume the source field. + TestParseStatusZHandlesRenamesAndSpecialPaths. - resolveRunners: document that the plain-Runner EnvRunner adapter intentionally drops env (audit low zerogit.go:417). The branch is reached only when a caller supplies a custom Runner without a RunGitEnv — in practice fake-Runner tests. Production leaves both nil and gets defaultRunGit/defaultRunGitEnv, which honor GIT_INDEX_FILE, so snapshot-diff isolation holds. Routing env calls to real git instead would break the fake-Runner test pattern and fix nothing in production. - update Inspect/Commit mock tests to the -z status format and the new command. * audit batch 6 (config): reject negative maxTurns; drop dead contract-gap helpers - FileConfig.UnmarshalJSON now rejects a negative maxTurns instead of letting the `MaxTurns > 0` merge gates silently drop it and fall back to the default, hiding the misconfiguration (audit medium resolver.go:136). 0 is left as the "unset" sentinel (omitempty) and still falls back to the default; the CLI --max-turns flag continues to reject 0 too since there it is distinguishable from absent. + TestResolveRejectsNegativeMaxTurns / ...ZeroFallsBackToDefault. - remove dead config/contracts.go (ContractGap, DefaultContractGaps, FindContractGapsByMilestone, ContractOwnerRuntime) and its test — referenced only by that test, never by production (audit low contracts.go:12). - NOT changed: ResolveMCP intentionally does not run the provider command (TestResolveMCPDoesNotRunProviderCommand guards this), so the "ZERO_PROVIDER_COMMAND MCP servers dropped" row is by-design, not a defect. * audit batch 7 (mcp): bound captured MCP server stderr connectStdio attached a plain bytes.Buffer as cmd.Stderr that is only ever read on initialize failure, yet it kept growing for the entire process lifetime as a long-lived server logged to stderr (audit medium client.go:98). Replace it with a concurrency-safe boundedBuffer capped at 64 KiB that keeps the head (enough for init-error diagnostics) and discards the rest, reporting full write lengths so os/exec never sees a short write. + TestBoundedBufferCapsRetainedBytes. Left as-is (not defects worth the risk in the MCP client): - client.go writer.write under client.mu: already designed to release the lock before the unbounded response wait; the residual concern is a server that stops draining stdin, an involved async rewrite for a theoretical deadlock. - readLoop not answering server-initiated requests (ping): responding safely needs re-locking around the shared writer; no configured server relies on it. * audit batch 8 (tools/providers): read_file truncation marker; drop dead provider branch - read_file: when a max_lines cut occurs, append an explicit "[truncated: N more line(s)... set start_line=X to continue]" marker to the output. Previously only the Result.Truncated flag was set, which is invisible in the rendered text, so the model could not distinguish a cut read from a complete one (audit low read_file.go:89). + TestReadFileToolMarksTruncation. - providers/factory: simplify `if !explicitProvider || isImplicitOpenAI(...)` to `if !explicitProvider` and delete the now-unused isImplicitOpenAI. The clause was dead: explicitProvider==true implies ProviderKind or Provider is set, but isImplicitOpenAI required both empty, so it could never contribute a case (audit low factory.go:118). Behavior-preserving; providers tests still green. * audit batch 9 (sessions): Tree builds from a single List() snapshot (no N+1 disk scans) Store.Tree recursed via ListChildren per node, and each ListChildren ran a full store.List() that re-read every metadata.json from disk — O(nodes * total-sessions) reads for one tree (audit medium lineage.go:140). Snapshot all sessions once, index children by parent in memory, and recurse over that. Child ordering is factored into sortChildSessions so ListChildren and Tree stay identical; path-scoped cycle detection (delete(seen,...)) is preserved. Existing tree/lineage tests still pass. Left as-is: store.go timestamp() second precision (RFC3339) — switching to RFC3339Nano would break lexical UpdatedAt ordering against existing second-precision records ("...00.5Z" sorts before "...00Z"), so it is not a safe one-line change. * audit batch 10 (specialist): serialize accounting dedup-then-append recordSpecialistStop and appendSpecialistUsageRollup checked for an existing event (specialistEventExists → ReadEvents) and then appended under SEPARATE store locks, so two concurrent finishers — a foreground onExit racing a TaskOutput poll, or a background reaper — could both pass the dedup check and write duplicate stop/usage events (audit medium accounting.go:72). Guard each check-then-append pair with a package-level accountingMu (Executor is used by value, so a struct field would not be shared). + TestRecordSpecialistStopDedupesUnderConcurrency (passes under -race). * audit batch 11 (zeroruntime/gemini): O(1) text accumulation; gemini cached-token counts - zeroruntime CollectStreamWithOptions accumulated assistant text with `collected.Text += event.Content`, reallocating the whole string on every chunk (O(n^2) over a long streamed response). Accumulate in a strings.Builder on the collector and materialize it once in flush, the single finalization point hit before every return (audit low helpers.go:104). Existing collect tests still pass. - gemini decoded usageMetadata without cachedContentTokenCount, so a cached-prompt response reported zero cached input tokens while the other providers report them (audit medium gemini/types.go:88). Decode the field and thread it through streamState into NormalizeUsage as CachedInputTokens. + extended TestStreamCompletionEmitsTextUsageAndReasoningTokens. * audit batch 12 (specialist): parse child stream without a line-length cap; drop dead helper - ParseStream used a bufio.Scanner capped at 1 MiB, so one large stream-json line from a child (a big tool result or final answer) hit bufio.ErrTooLong and aborted the entire specialist run (audit medium streamer.go:43). Switch to a bufio.Reader with ReadString, which has no per-line limit; the child is our own trusted subprocess, so its output length is the legitimate bound. Line numbering and blank-line/EOF handling are preserved. + TestParseStreamHandlesLineLargerThan1MiB. - remove dead formatTaskOutput (output_tool.go:244): zero callers and zero tests; it only forwarded to formatTaskOutputSummary, which is the one actually used. * audit batch 13 (background/specialist): kill background tasks as a process group Background children were launched in the parent's process group and terminated by signalling only the single PID, so any process the task forked was orphaned and outlived a cancel; the signal also risked hitting a recycled PID after the child was reaped (audit medium process_posix.go:38/50). - ConfigureChildProcessGroup (Setpgid on POSIX, no-op on Windows where taskkill /T already tree-kills) is applied at launch so the child leads its own group. - terminateProcess now SIGTERM/SIGKILLs the negative PID (the whole group), with a pid>1 guard so a bogus 0/1 can never expand to "our own group" or "everything", and treats ESRCH as already-gone. Liveness polls the group. Targeting a group (rarely recycled vs. a bare PID) also shrinks the reaped-then-recycled window. - specialist launchBackgroundProcess opts every child into its own group; on a SetPID failure it now kills the child + group, marks the task errored, and records the stop (deduped) instead of leaking an untracked orphan. - tests launch as group leaders; new TestTerminateProcessKillsForkedChildren proves a forked grandchild dies with the group. * audit batch 14 (sandbox): quote-aware shell segment splitting splitShellSegments used a quote-unaware strings.Replacer, so a shell operator inside quotes was treated as a separator: `git commit -m "use top | less"` split into a `less` segment and `echo "a; vim b"` into a `vim` segment, both falsely flagged as interactive (audit medium safe_command.go:138). Replace it with a quote-aware scanner that mirrors the shell: single quotes make everything literal; double quotes keep $(...)/`...` substitution active but treat |, ;, && as literal; unquoted text splits on the same operator set as before (;, |, ||, &&) plus substitution boundaries. Real unquoted operators still split, so an interactive program behind a separator — or inside a live `"$(...)"` substitution — is still caught (no new false negatives, the security-relevant direction). + TestDetectInteractiveQuoteAwareSeparators covering both directions. * audit batch 15 (cron): collapse DST fall-back repeated hour to one fire On a fall-back day the clock repeats an hour (e.g. 01:30 EDT then 01:30 EST), so Next("30 1 * * *", <01:30 EDT>) returned the same-day 01:30 EST — firing a daily job twice (audit medium schedule.go:171, which previously guarded only the spring-forward gap). Next now skips a match whose local wall-clock minute equals `after`'s but whose absolute time is later (the repeated-hour duplicate) and keeps searching. Normal forward search always advances the wall-clock, so this only triggers on the fall-back repeat; when the scheduler passes the last fire time as `after`, the repeated hour collapses to a single fire. + TestNextDSTFallBackDoesNotRepeatHour (spring-forward termination test still passes). Note: Next is stateless, so it dedupes relative to `after`; a caller that passes an arbitrary mid-hour "now" instead of the last fire time is out of scope here. * audit batch 16 (mcp): skip SSE notifications before the response; larger SSE buffer - decodeSSERPCMessage returned the first non-empty `message` event unconditionally, so a server-initiated notification/request arriving before the response made the caller see an id mismatch and fail (audit medium network_client.go:621). It now skips any message carrying a method (notifications/requests have one; a response does not) and returns the first real response; the caller's rpcIDMatches still validates the id. + TestDecodeSSERPCMessageSkipsNotifications. - raise the per-event SSE scanner cap from 1 MiB to a bounded 8 MiB so a large but legitimate MCP message no longer hits bufio.ErrTooLong and fails the request (audit medium network_client.go:637); still bounded against an unbounded server. Out of scope (kept): full reconnect of a persistent SSE stream after a fatal read error — a larger change than this remediation. * audit batch 17 (sessions): fsync session metadata before the atomic rename writeMetadata wrote the temp file with os.WriteFile (no sync) and renamed it into place, so a crash right after the rename could expose a metadata file whose bytes were never flushed — a torn or empty file that corrupts the whole session (audit medium store.go:632). Write+fsync the temp via a new writeFileSync helper before renaming, closing that window. + TestWriteFileSyncRoundTrips. Deliberately scoped: - Event-log appends (appendEventLocked) are NOT fsynced per append: that would add a disk flush to every event (every tool call), and a hard-crash loss of the log's unsynced tail is acceptable, whereas torn METADATA is not. Metadata is the integrity-critical part and is what this syncs. - Directory fsync is omitted for cross-platform simplicity (it errors on Windows); the file fsync already prevents the torn-contents failure, the serious case. Left for follow-up (in this bucket but not safe/clear wins here): - hooks append sequence still re-reads the file per append; the in-memory cache is cross-process-unsafe and the safe last-line read is fiddly for a low-volume log. - Fork event re-append/de-dup is nuanced usage-accounting and needs its own change. * audit batch 18 (agent): count tool-defs in compaction estimate; don't deny an always-allow on persist failure - maybeCompact's estimate omitted the tool definitions, which ride on every request, so the real input could exceed the model limit while the message-only estimate stayed under threshold and compaction never fired (audit medium compaction.go:58). partitionTools is now computed before maybeCompact (it does not depend on the messages) and the exposed tools' estimated tokens are added to both the threshold check and the post-compaction shrink check. + estimateToolDefTokens and TestEstimateToolDefTokensCountsDefinitions. - PermissionDecisionAlwaysAllow denied the call when persistPermissionGrant failed, overriding what the user explicitly allowed (audit medium loop.go:468). Persisting is now best-effort: a failure (or no sandbox engine) just means the grant is not remembered and the user is re-prompted next time, not denied now. This also drops the dead requestEvent.GrantMatched/Grant writes (audit low loop.go:473) — the emitted event derives them from the sandbox decision via buildPermissionEvent. Left intentional (documented, not defects): the reactive-retry path omits OnText to avoid duplicating mid-stream text (loop.go:183); OnContext/MeasureContext is a complete, tested context-breakdown scaffold awaiting a consumer (types.go:183). * audit batch 19 (usage): price escalated usage from the event's own model exec persists payload["model"] on --allow-escalation runs (the model can change mid-run), but BuildReport priced every event from the session's Metadata.ModelID and never read the payload, so usage from an escalated model was mis-priced at the base model (audit medium report.go:17). usageEventPayload now carries Model and BuildReport prefers it, falling back to the session model when absent (older events stay byte-identical and behave as before). + TestBuildReportPricesFromEventModelWhenPresent. * audit batch 20 (sessions): don't copy usage events into a fork (no double-count) Fork re-appended every parent event, including provider_usage, into the child, so a usage report aggregating the parent and the fork double-counted the parent's usage (audit medium store.go:387). Skip EventUsage when copying — it already counted against the parent and is not part of the conversation history a fork replays — and record the actual copied count in the fork marker. + TestStoreForkSkipsUsageEvents. * audit batch 21 (cli/skills): warn on duplicate skill names instead of silently dropping skills.Load deduplicates same-named skills (first directory wins) and records the dropped collisions via skills.Duplicates, but nothing surfaced them, so a shadowed skill just vanished with no signal — and Duplicates had no production caller (audit low skills.go:91). `skills list` now reports each collision to stderr (keeping stdout/--json clean), using Duplicates. + TestRunSkillsListWarnsOnDuplicateNames. Note: skills.Get is kept — it is a by-name accessor used throughout the package's tests, not dead code. * audit batch 22 (cli/cron): capture the run error from stream-json stdout Cron jobs run exec with --output-format stream-json, so a failure is reported as an `error` event on STDOUT, but the run record's Error was set only from stderr — so a failed job often recorded an empty/uninformative error while the real message sat unread in outBuf (audit low cron_run.go:150). On a non-zero exit, scan the stdout stream-json for the error event's message and prefer it, falling back to stderr. + extractStreamJSONError and TestExtractStreamJSONError. * audit batch 23 (sandbox): richer macOS seatbelt profile (signal + mach-lookup) The generated sandbox-exec profile was default-deny with only process/sysctl/file allowances, so two real gaps remained on macOS (sandbox quality report H1): - A sandboxed script could not signal the children it spawned — `kill` returned "Operation not permitted" under seatbelt, breaking common `cmd & ... kill`, test-runner, and timeout patterns. Add `(allow signal (target self) (target pgrp))`, which stays scoped to the command's own process group. - XPC to system daemons was denied, so keychain (securityd/trustd), user/group lookup (opendirectoryd), preferences (cfprefsd), network config (SystemConfiguration), launch services, and the pasteboard all failed. Add a curated `(allow mach-lookup ...)` allowlist (`sandboxMachServices`). Neither touches the file-write or network rules, so the workspace boundary is unchanged — verified on a real macOS host: `security`/`scutil`/`pbpaste`/self-kill now succeed while writes to $HOME and /etc are still denied. iokit-open was tried and dropped as unnecessary. + unit assertions (TestSandboxExecProfileGrantsSignalAndMachLookup) and extended the darwin integration test with a self-kill case and an outside-workspace deny check. * audit batch 24 (sandbox/tools): remove dead OnSandboxDecision hook RunOptions.OnSandboxDecision had no setter anywhere, yet registry.RunWithOptions spawned a goroutine (with panic recovery) for it on every sandboxed tool call — pure per-call overhead for an unreachable callback (sandbox report M1). The sandbox decision is already surfaced to observers via the permission event (buildPermissionEvent reads the decision), so this hook is redundant; delete the field and its call site. * audit batch 25 (sandbox/cli): exact-path grants — create and revoke by path The engine already matched ScopeFile grants and DeriveScope already produced them from path/file tool args, but the CLI could neither create one explicitly nor revoke a single one (sandbox report L3 / prompt 7). Add: - GrantStore.RevokePath(tool, path): revokes only the grant whose scope matches the given file/dir, leaving tool-wide and other-path grants intact (path canonicalized to absolute like stored scopes). + TestGrantStoreRevokePathRemovesOnlyMatchingScope. - `zero sandbox grants allow <tool> --path <p>`: persists an exact-file (ScopeFile) grant, path resolved to absolute so it matches lookups and revokes. - `zero sandbox grants revoke <tool> --path <p>`: revokes just that grant (default still revokes all grants for the tool). + TestRunSandboxGrantsCreateAndRevokeByPath. The TUI permission-card "Allow always (exact path)" option is intentionally left for the TUI feature branches (it overlaps #187/#188); the engine + CLI now cover the full create/match/revoke round-trip for file-scoped grants. * audit batch 26 (sandbox): Engine.Precheck — report violations before execution Add Engine.Precheck(ctx, request) []Violation, which reports the sandbox violations that would block a tool request before it runs (sandbox report / prompt 6). It reuses Evaluate so policy is not duplicated: an allowed or merely-prompted request yields no violations; a denied request yields its violation (via the shared violationsFromDecision helper, with a ViolationPolicyDenied fallback for a deny that carries no structured violation). A nil engine yields nothing. + TestEnginePrecheckReportsViolationsBeforeExecution. Wiring Precheck into the batch-confirmation prompt is intentionally left to the TUI branch: it touches prompt rendering, and short-circuiting the agent loop's deny path would skip the before/after-tool hooks that currently fire around a policy-denied call. The engine API is in place for that consumer. * audit batch 27 (sandbox): scoped-egress domain prompt with timeout + caching The scoped-egress proxy failed closed on any host outside the allowlist. Add an opt-in DomainPrompt callback (prompt 8): an UNKNOWN host (neither allowed nor explicitly denied) is authorized at request time via the callback instead of being refused outright. An explicitly denied host is still refused without prompting; the callback is bounded by PromptTimeout (default 60s, timeout/error => deny); decisions are cached for the proxy's lifetime so a host is prompted at most once. With no callback set the strict fail-closed behavior is unchanged. Wired through both the CONNECT and HTTP handlers via authorizeTarget. + TestEgressProxyAuthorizeDomainPrompt / ...TimeoutDenies / ...NilPromptFailsClosed. The user-facing prompt that supplies the callback is left to the permission UI (TUI) branch; the egress mechanism (callback + timeout + cache) is in place and tested. * audit batch 28 (sandbox): AST-based shell analysis (AnalyzeCommand) Add AnalyzeCommand(script) AnalysisResult, a static shell analyzer built on the mvdan.cc/sh/v3 parser (prompt 12). Walking the parsed command tree makes it a more precise second opinion than the regex detector: a program name only counts when it is an actual command, so `echo "vim ..."`, `printf 'open with vim'`, and `git commit -m "rm -rf /"` are clean, while real commands are flagged — interactive (editors/pagers + REPLs, with the same -e/script suppression as nonInteractiveREPLFlags), destructive (rm -rf/-fr, dd, mkfs, shred, ...), and network (curl/wget/ssh/nc/...). An unparseable script yields TooComplex so callers can treat it as higher-risk. + TestAnalyzeCommand (16 cases) / ...EmptyIsClean. Dependency: mvdan.cc/sh/v3 pinned to v3.11.0 — compatible with the existing go 1.24 directive (the latest v3.13.1 would have bumped the module to go 1.25). It is kept as a standalone analyzer for callers to consult; feeding it into Engine.Evaluate is deliberately not done here, since that would change allow/deny classification. * audit batch 29 (sandbox): unify proxy-env generation (ProxyEnv) Export ProxyEnv as the single source of truth for proxy-env injection (prompt 9 req 1), replacing the unexported scopedProxyEnv used by the sandboxed-shell path. + TestProxyEnv. Investigation that bounds the rest of prompt 9 (documented in the ProxyEnv doc): - web_fetch already honors HTTP_PROXY/HTTPS_PROXY — its transport clones http.DefaultTransport, whose Proxy is http.ProxyFromEnvironment. - MCP children already inherit the parent env (mergeProcessEnv appends os.Environ), so they pick up any proxy vars the agent has. So the only missing link to scope FetchUrl/MCP is a SESSION-level egress proxy whose address reaches the agent process. That is deliberately NOT wired here: doing it safely requires allowlisting the active LLM provider's own domain first, or the agent's provider calls would route through the scoped proxy and be denied — a correctness pitfall that also can't be verified end-to-end on this host. Flagged rather than shipped blind. * audit batch 30 (sandbox): Linux seccomp Unix-socket block — UNVERIFIED, needs Linux CI Adds a pure-Go (no cgo, no vendored binary) seccomp BPF filter that denies socket(AF_UNIX) with EPERM on x86-64/arm64, closing the Unix-socket gap bubblewrap's filesystem/network isolation leaves open (prompt 11): - internal/sandbox/seccomp.go: the classic-BPF program as a platform-neutral []sockFilter, built and UNIT-TESTED (structure + every jump offset in range — the classic way a hand-written BPF filter goes silently wrong). - seccomp_linux.go: ApplyUnixSocketBlock installs it via prctl(NO_NEW_PRIVS) + prctl(SET_SECCOMP, MODE_FILTER). seccomp_other.go is a no-op everywhere else. - cmd/zero-seccomp: a tiny linux-only exec wrapper that applies the filter then execs the real command (the standard way to install seccomp in a child with os/exec); degrades gracefully (warns + runs) if the kernel lacks seccomp. ⚠️ HONEST CAVEAT: I developed this on macOS and CANNOT run the actual AF_UNIX block here. darwin build, `GOOS=linux` cross-compile, vet, and the structure test all pass, but the unit test verifies the program's SHAPE, not that the kernel actually blocks AF_UNIX — that MUST be verified on Linux CI (create a Unix socket under the wrapper and assert EPERM). Safe to ship as-is: it is linux-only, no-op on every other platform, and not wired into the bwrap command yet (opt-in prefixing the sandboxed command with zero-seccomp is the remaining integration), so it cannot regress any current path. * audit batch 31 (sandbox): macOS denial log monitor (opt-in, default off) Re-adds the macOS seatbelt-denial monitor as an opt-in feature (prompt 10). When Policy.MonitorDenials is set, the sandbox-exec profile tags its default-deny with a marker and bash tails `log stream` for that tag during the command, appending any captured denials as a <sandbox_violations> block to the command's stderr so the model can see what was blocked. - DenialMonitor (darwin) tails/parses tagged denials with a capped, deduped ring buffer and noise filtering; no-op stub on other platforms. parseSandboxDenyLine is unit-tested. + profile-tag test + appendSandboxViolations test. - Default OFF: with MonitorTag empty, StartDenialMonitor is a no-op and the command path is byte-for-byte unchanged, so there is no regression or per-command overhead unless enabled. CAVEAT: on at least one macOS host (verified live) seatbelt denials are NOT delivered to the `log stream`-queryable unified log, so the monitor captures nothing there. It is the standard mechanism and works on macOS versions that do log denials; shipping it default-off means it never affects whether a command runs. * audit batch 32 (sandbox): wire seccomp Unix-socket block into bubblewrap (opt-in) Completes prompt 11: the zero-seccomp helper (which installs the AF_UNIX seccomp filter) is now actually invoked by the sandbox instead of only existing as a standalone binary. - bubblewrapCommandPlan, when Policy.BlockUnixSockets is set, ro-binds the discovered zero-seccomp helper into the sandbox at its host path and prefixes the command with it so the filter is installed before the real argv runs. - findSeccompHelper discovers the helper next to the running executable first, then on PATH; it returns "" when absent, so the sandbox degrades gracefully (runs without the extra filter — bubblewrap's fs/net isolation still applies) rather than failing the command. Exposed as a package var so the wiring is unit-tested on any OS. - Reachable from config: SandboxConfig.BlockUnixSockets and .MonitorDenials now map onto the policy in applyConfiguredSandboxPolicy (opt-in only — config can turn a hardening flag on, never off). Both default OFF. - Tests: helper-prefix present when enabled / absent by default; config flags apply independently and stay off when omitted. Default OFF and Linux-only effect; the runtime seccomp enforcement still needs a Linux host/CI to exercise end-to-end (the wiring and BPF program are unit-tested). * audit batch 33 (sandbox): enforce scoped/deny network policy in web_fetch & web_search Completes prompt 9: the built-in network tools now honor the SAME allow/deny/scoped policy the sandboxed shell egress proxy enforces, instead of bypassing it. Before this, web_fetch/web_search would reach any public host even when the policy was NetworkDeny or NetworkScoped — the egress proxy only constrained shell commands. - New shared gate Engine.NetworkHostAllowed(host) reuses the egress domain matcher (domainAllowed/normalizeDomains/effectiveNetwork) as the single source of truth: allow → all hosts; deny → none; scoped → only AllowedDomains minus DeniedDomains (empty allowlist collapses to deny). Disabled policy / nil engine impose nothing. - web_fetch is now sandbox-aware: the host is checked before the request AND on every redirect, so a denied/unlisted host fails closed before any dial. Plumbed via a networkPolicyGate so the no-sandbox path is byte-for-byte unchanged. - web_search is sandbox-aware: the configured backend's endpoint host is checked before the query leaves the machine; blocked under deny, and under scoped unless the backend host is allowlisted. - The registry already routes sandbox-aware tools through RunWithSandbox when an engine is present, so this activates automatically wherever the sandbox is wired. - Tests: engine gate matrix (deny/allow/scoped/denylist/empty/disabled/nil + host:port); web_fetch & web_search block denied/unlisted hosts without dialing and allow listed ones; endpoint-host parsing. * audit batch 34 (sandbox): prove network-policy wiring end-to-end + document opt-in flags Verification follow-up to batches 31-33; no behaviour change. - Adds a registry-level test that exercises the FULL chain for the scoped-network enforcement: registry.RunWithOptions -> engine.Evaluate (passes a scoped, egress-capable sandbox-exec backend) -> routes web_fetch through RunWithSandbox -> per-host allowlist blocks an unlisted host before any dial. This proves the Tool-interface value actually satisfies sandboxAwareTool at the registry boundary, not just in a direct method call. - Documents the two opt-in hardening flags (sandbox.blockUnixSockets, sandbox.monitorDenials) and the scoped web_fetch/web_search behaviour in the README so the config keys are discoverable. Both remain off by default. Confirmed wiring: agent loop forwards options.Sandbox to the registry; the registry routes sandbox-aware tools (web_fetch, web_search) through RunWithSandbox when an engine is present; MonitorTag is set only on the macOS sandbox-exec plan; the seccomp helper prefix is added only on the bubblewrap plan when BlockUnixSockets is set; both config flags map onto the policy via applyConfiguredSandboxPolicy. * audit batch 35 (sessions): fix Windows CI failure in TestWriteFileSyncRoundTrips The exact-permission assertion (perm == 0o600) added in batch 17 fails on windows-latest because Windows does not honor Unix permission bits: Go reports 0o666 for a writable file regardless of the mode passed to OpenFile. This was the sole cause of the failing Smoke (windows-latest) CI job; macOS and Ubuntu passed. Guard the perm check with runtime.GOOS != "windows" so it still verifies the mode on the platforms that enforce it, while the round-trip (write + read-back) is still asserted on every platform. * audit batch 36: address CodeRabbit review (5 findings) - background/process_posix: after SIGKILL, poll until the process group is actually gone (SIGKILL is async) and return an error if it survives past a second deadline, instead of returning nil while descendants still race. - sandbox/safe_command: only treat ')' as a substitution boundary when it closes an active $(...). A literal ')' (e.g. echo "a) less") no longer splits into a fake `less` segment and is no longer misflagged as interactive. Depth-tracked so nested $(...) still isolate their inner command. Direct splitShellSegments test (fails pre-fix: yields ["echo \"a", "less\""]). - cron/schedule: the DST fall-back collapse now only applies when `after` sits exactly on the minute boundary (its "last fire time" form). With sub-minute precision (e.g. 01:30:30 EDT) the first 01:30 fire already passed, so the repeated 01:30 EST is the legitimate next fire and is returned — restoring strictly-after semantics. New test fails pre-fix (skipped to next day). - config/types: maxTurns error message now reads "must be >= 0" to match the check (0 is accepted; only < 0 is rejected). Negative-maxTurns test asserts the message. - docs/audit: header date/branch metadata now matches the body (2026-06-13, fix/audit-batch) instead of the stale 2026-06-11/fix/audit-critical-high snapshot. Verified: gofmt clean; go vet clean; host + linux + windows builds; affected suites green. Each behavioural fix ships with a test confirmed to fail without the change. * audit batch 37: address CodeRabbit re-review (12 findings) Findings on the audit code from batches 21-36; each behavioural fix ships with a regression test (several confirmed to fail without the change). sandbox/analyzer (AnalyzeCommand): - Unwrap launcher prefixes (sudo/env/nice/bash -c/...) and recurse into `sh -c` payloads so `sudo rm -rf`, `env curl …`, `bash -c 'vim x'` classify on the real command, not the launcher. Mirrors DetectInteractiveCommand. - Honor rm's `--` end-of-options marker so `rm -- -rf` (delete a file named -rf) is not flagged destructive. sandbox/engine: NetworkHostAllowed now shares one backend-aware effective-mode helper with Evaluate, so scoped collapses to deny when the backend can't enforce scoped egress — the per-tool gate can no longer permit traffic the engine-level decision would fail closed. sandbox/egress: cache domain-prompt decisions by host:port, not host, so one "allow" can't authorize other ports on the same host. sandbox/safe_command: the segment splitter is now escape-aware (\| , \" ) so an escaped operator/quote can't manufacture a fake interactive segment. sandbox/log_monitor (darwin): Wait() the `log stream` child after draining stdout so the cancelled process isn't leaked as a zombie. tools/web_search: confine the search backend to same-host redirects (with a limit) so a redirect chain can't egress to a host the scoped/deny policy never authorized. cli/sandbox: an explicit empty --path (`--path=` / `--path ""`) now fails closed instead of silently widening an allow to tool-wide or a revoke to all-grants. cli/skills: warn on stderr when duplicate-skill detection fails instead of swallowing the error. specialist/exec: don't mask a failed orphan-kill — join the TerminateProcess error with the SetPID error so a surviving process is visible. background/process_posix: resolve the PGID and only group-signal when pid leads its own group; otherwise signal the individual PID. Avoids both a false-success on a non-leader ESRCH and the hazard of signalling an unrelated (possibly our own) group. Verified: gofmt + go vet clean; host + linux + windows builds; full go test ./... green. * audit batch 38: address CodeRabbit re-review round 2 (3 findings) Follow-ups to batch 37, each with a regression test: - safe_command (splitter): a ')' is now only a substitution boundary when it closes an active, UNQUOTED $(...). A quote-state stack saved at each '$(' lets a substitution run in a fresh quoting context and restores the outer quoting on its matching ')'. Fixes `echo $(printf "a) less")` splitting into a fake `less` segment, while still isolating the inner command of `echo "$(vim x)"`. - egress: deduplicate in-flight domain prompts per host:port. Concurrent requests for the same unknown target now wait on the first prompt and reuse its cached decision instead of each firing a prompt (a prompt storm) and racing to write the final decision. Race-tested with 25 concurrent authorizers → one prompt. - analyzer + safe_command: wrapper option-value consumption is now wrapper-specific (wrapperValueOptionsByProg) instead of a global option set. A valueless flag like `sudo -n` no longer swallows the real payload, so `sudo -n rm -rf` / `sudo -n curl …` are correctly classified destructive/network; `sudo -u root vim` still consumes its value. Shared by the AST analyzer and the regex detector so they can't diverge. Verified: gofmt + go vet clean; host + linux + windows builds; go test ./... and -race on sandbox/background all green. * audit batch 39: address CodeRabbit re-review round 3 (12 findings) All verified against current code; each behavioural fix has a regression test. Security / correctness: - tools/web_search: redirect policy now also refuses a scheme change, blocking a same-host https→http downgrade that would send the query + bearer token over plaintext. - sandbox/safe_command: a ')' is only a substitution boundary when it closes an active UNQUOTED $(...), and backticks now get the same quote-state save/restore as $( — so `echo "`a | less`"` and `echo "$(true | less)"` no longer hide the inner pager from interactive detection. - sandbox/analyzer + safe_command: wrapper option-value consumption stays wrapper-specific, and unwrapping no longer aborts on a dynamic ($x) wrapper arg once a wrapper is active, so `env "$opts" curl` / `sudo "$x" rm -rf` are still classified. - sandbox/egress: in-flight prompts deduped per host:port (carried from batch 38); the prompt callback is now cancellable (context cancelled on timeout) so a stuck prompt can abort instead of leaking; signature threaded through. - sandbox/runner: per-plan unique denial tag (pid+counter) so concurrent monitored sandbox-exec runs can't ingest each other's denials; helper selection now requires an executable regular file so a non-exec sibling degrades gracefully. - mcp/network_client: aggregate SSE event-size cap (not just per-line) so a server can't grow memory with many unterminated data: lines. - specialist/accounting: a previously-recorded stop/usage with an empty runId is a catch-all and now suppresses a later runId-bearing duplicate. - sessions/lineage: Tree fetches the root via Get() first so a corrupt root surfaces its real error instead of degrading to "not found". Docs/tests: - background/terminate: docstring now states the leader-only group-kill (PID-only fallback for non-leaders); test child-liveness probe uses ESRCH specifically. - cli/sandbox: grant usage strings include --path. Verified: gofmt + go vet clean; host + linux + windows builds; go test ./... and -race on sandbox/background all green. * audit batch 40: address CodeRabbit re-review round 4 (8 fixed, 1 skipped) Verified each against current code. Fixed: - sessions/lineage: PANIC FIX — store.Get returns (nil, nil) for a missing session, so the batch-39 root prefetch could nil-deref. Guard root == nil and return a not-found error. Regression test added (was a panic). - agent/compaction: the reactive recover() now records lowWaterMark in the SAME combined (messages + tool-defs) token domain maybeCompact uses, so the proactive shrink-guard compares like with like. recover() takes tools; callers pass request.Tools. - mcp/network_client: SSE aggregate counter no longer counts a joining newline for the first data line (only when prior content exists), avoiding premature rejects. - sessions/store: fsync the parent directory after the metadata rename so the rename is durable across a crash (no-op on Windows, which can't fsync a dir). - sandbox/egress: parse the target port with strconv.Atoi instead of net.LookupPort (no context-unaware resolver use). - sandbox/runner: escape the per-plan denial tag through sandboxProfileString when embedding it in the seatbelt profile. - sandbox/seccomp_linux: guard against an empty filter program before taking &kernelFilters[0] (defensive; the program is fixed non-empty today). - cli/cron_run_test: assert last-error-wins with two error events. - background/terminate, cli/sandbox usage, process_posix_test ESRCH (carried). Skipped (with reason): - zerogit worktree-rename (Y='R') test: git porcelain v1 -z only emits the rename-source field when the INDEX column is R/C; the worktree column never carries 'R' with a source field in v1, so the fixture would test output git doesn't produce, and making parseStatus consume on code[1]=='R' would risk mis-consuming the following entry for a plain ` R` status. Left as-is. Verified: gofmt + go vet clean; host + linux + windows builds; go test ./... and -race on sandbox/background all green. * audit batch 41: address CodeRabbit re-review round 5 (4 findings) All verified against current code; code fixes have regression tests. - agent/compaction: summarizeWithFallback's reduce pass no longer swallows ALL errors. A context-limit error still falls back to the joined partial summaries (documented "extreme" case), but a non-context failure (auth/network/provider) now surfaces unchanged, per the function's contract. Two tests (propagate vs. joined-fallback); the propagate test fails without the fix. - sandbox/safe_command + analyzer: wrapper value-consuming options now include the long spellings (sudo --user root, env --unset NAME, timeout --signal …), so a long flag's value is no longer mis-read as the program (interactive/destructive/ network detection bypass). A `--flag=value` token carries its own value and never consumes the next token. Tests for space and = forms in both the AST analyzer and the regex detector. - docs/audit: the status-ledger summary table's open/partial cells (64/14) were the lone outlier — the ledger's own narrative and 2026-06-13-reverification.md both state 66/12. Corrected to 66/12 (66+12+97 = 175); derivation: body 69 open + 18 partial minus the 9 already-fixed-on-main (3 open + 6 partial) = 66/12 = 78 pending, fixed 88+9 = 97. Added a comment documenting the summary-vs-body relationship. The reverification doc already states 66/12, so both now agree. Verified: gofmt + go vet clean; host + linux + windows builds; full go test ./... green. * audit batch 42: address CodeRabbit re-review round 6 (1 fixed, 1 kept w/ proof) CodeRabbit re-surfaced two "duplicate" refinements; CI was already green (its 6th pass was a COMMENT with no new findings). - cli/sandbox_test (TestRunSandboxGrantsRejectsEmptyPath): now seeds a tool-wide grant and asserts grant-store immutability after EACH rejected empty-`--path` call (reflect.DeepEqual before/after), so a mutation in one call can't be masked by a later one — and a buggy "revoke all" is actually observable (it's a no-op on an empty store). Stronger than the suggested patch. - zerogit.parseStatus: KEPT consuming the rename source on the index column only (code[0]), with an explanatory comment. Verified empirically that git porcelain v1 -z reports a rename/copy (and emits the extra source field) only in the index column: `git mv` → "R new\0old\0"; a worktree-only rename → " D old\0?? new\0" (delete + untracked, never "R" in code[1]). Consuming on code[1]=='R'/'C' would match no real git output and would only risk mis-consuming the next entry on malformed input, so the suggestion is declined as incorrect for v1. Verified: gofmt + go vet clean; host + linux + windows builds; affected suites green.	2026-06-13 21:32:48 +05:30
KRATOSandClaude Fable 5	e381d8eab1	Additional write roots: --add-dir flag, global config key, /add-dir TUI command (#162) ... * docs: spec for additional write roots (--add-dir / /add-dir) Co-Authored-By: Claude Fable 5 <[email protected]> * docs: implementation plan for additional write roots Co-Authored-By: Claude Fable 5 <[email protected]> * sandbox: add Scope type for multi-root write access Co-Authored-By: Claude Fable 5 <[email protected]> * docs: write roots honored from global config only, union merge semantics Co-Authored-By: Claude Fable 5 <[email protected]> * sandbox: fix multi-root violation reporting and pin prefix-alias behavior - validate: prefer ViolationSymlinkTraversal over ViolationOutsideWorkspace when all roots deny; return original requestedPath in violation; append --add-dir hint only on outside_workspace results; extend doc comment to state that a symlink resolving inside any root is allowed. - normalizePrefixForRoot: dedupe insideRoot check via pathWithinRoot (Fix 3); widen EvalSymlinks comment to cover jump-over case; add POSIX-only note. - WorkspaceRoot: add doc comment noting immutability/lock safety (Fix 4). - Tests: pin multi-root traversal-preferred behavior, deterministic alias test (TestValidateResolvesAliasedPathPrefixes), Add symlink normalization test, and tilde-expansion error path test. Co-Authored-By: Claude Fable 5 <[email protected]> * sandbox: make engine path validation and risk scope-aware Thread *Scope through EngineOptions/Engine so Evaluate and Classify use multi-root scope validation instead of single-root validateWorkspacePaths, letting extra write roots (--add-dir / /add-dir) be honoured by the policy gate and risk classifier. Remove now-dead validateWorkspacePaths helper. Co-Authored-By: Claude Fable 5 <[email protected]> * sandbox: pin override-root scope isolation, tidy Evaluate scope handling Co-Authored-By: Claude Fable 5 <[email protected]> * sandbox: widen seatbelt/bubblewrap profiles and command cwd to scope roots Co-Authored-By: Claude Fable 5 <[email protected]> * sandbox: pin extra-root chdir behavior and document bind invariants Co-Authored-By: Claude Fable 5 <[email protected]> * tools: resolve paths against the shared write scope Add PathScope interface and scoped resolver helpers to workspace.go, then thread a scope field through all 8 file tools (read_file, list_directory, glob, grep, write_file, edit_file, apply_patch, bash). Each existing constructor delegates to a new NewScoped* variant; nil scope is byte-identical to the original behavior. Registry gains CoreReadOnlyToolsScoped, CoreWriteToolsScoped, CoreShellToolsScoped, and CoreToolsScoped. Co-Authored-By: Claude Fable 5 <[email protected]> * tools: restore fail-closed write-target symlink checks, share prefix normalization * tools: report absolute paths for extra-root changes, pin scoped traversal denial - resolveScopedPath and resolveScopedTargetPath now return the absolute path as the second value when the matched root is an extra (non-workspace) root, eliminating ambiguity in ChangedFiles, cwd meta, and display summaries downstream - Add TestScopedWriteRefusesSameRootSymlinkTraversal to pin that same-root symlink traversal within an extra root is denied (pre-existing behavior) - Add TestScopedWriteReportsAbsolutePathForExtraRoot to enforce the new absolute-path contract for ChangedFiles on extra-root writes - Extend doc comments on PathScope, ChangedFiles, changedFilesFromPatch, and both scoped resolvers to capture the workspace-vs-absolute invariant Co-Authored-By: Claude Fable 5 <[email protected]> * config: add sandbox.additionalWriteRoots (global config only, union merge) * cli: add repeatable --add-dir flag wiring scope into registry and engine Co-Authored-By: Claude Fable 5 <[email protected]> * cli: forward --add-dir across dispatch paths, pin scope wiring with tests Co-Authored-By: Claude Fable 5 <[email protected]> * cli: pin --add-dir dispatch forwarding end-to-end, close guard gaps Review fixes for the --add-dir dispatch commit: - Add TestRunAddDirDispatchForwardsGrantIntoExecScope: drives runWithDeps through both the "exec" and "-p" dispatch shapes with a provider that calls write_file inside the extra root, asserting the grant reaches the exec sandbox scope (and a negative control without --add-dir is denied fail-closed). Mutation-verified: dropping addDirFlagArgs forwarding from either case fails the test. - Remove help/version from the --add-dir allowlist so any non-TUI/ non-exec leading --add-dir hard-errors, matching the stated requirement; extend the rejection test with those cases. - Fail loud when --add-dir is hidden behind a stray non-flag arg on the --skip-permissions-unsafe path instead of silently dropping the grant. - Reject flag-like values in the inline --add-dir= spelling to match the space form (a directory named -foo stays reachable as ./-foo). - Move TestExecScopeReRegistrationSwapsCoreToolsByName out of the parse test file into the new exec_scope_test.go alongside the e2e test. Co-Authored-By: Claude Fable 5 <[email protected]> * tui: add /add-dir command for session write-root grants Co-Authored-By: Claude Fable 5 <[email protected]> * sandbox: surface write roots in zero sandbox status and plan snapshots Co-Authored-By: Claude Fable 5 <[email protected]> * cli: surface write-roots error in --effective --json, normalize fallback root Review fixes for the Task8 observability range: - runSandboxPolicyEffective JSON payload gains writeRootsError (omitempty) so --json consumers see the same fail-soft signal as the text write_roots_error line instead of a misleading workspace-only writeRoots list. - The fail-soft fallback now derives its write roots from a workspace-only Scope (which cannot fail) so the error path renders the same symlink-resolved root as the success path. - TestRunSandboxPolicyEffectiveWriteRootsFailSoft gains a --json leg asserting writeRootsError names the stale root with a workspace-only fallback; the configured-roots test asserts the key is absent for valid roots. - SandboxPlanSnapshot doc comment reworded to match the converter: no current builder populates WriteRoots. Co-Authored-By: Claude Fable 5 <[email protected]> * sandbox: seatbelt integration test for extra write roots Co-Authored-By: Claude Fable 5 <[email protected]> * docs: document --add-dir and /add-dir write-root grants Co-Authored-By: Claude Fable 5 <[email protected]> * sandbox: pass volume-qualified paths through prefix normalization verbatim NormalizePrefixForRoot's POSIX component walk mangled Windows drive paths (C:\Users -> C:Users), which downstream single-root checks treated as relative and joined under the workspace — failing the policy gate OPEN on Windows. Volume-qualified paths now bypass the walk entirely (the macOS /var alias problem it solves has no Windows equivalent) and windows-gated tests pin both the verbatim pass-through and the engine denial. Co-Authored-By: Claude Fable 5 <[email protected]> * sandbox: make prefix normalization volume-aware for Windows alias resolution The previous commit disabled NormalizePrefixForRoot on Windows, which broke it the other direction: a workspace created under an 8.3 short path (C:\Users\RUNNER~1\...) resolves via EvalSymlinks to its long form (runneradmin), so raw short-form requests escaped the long-form root and legitimate extra-root writes were denied. This is the same alias problem as macOS /var -> /private/var, which the helper already solves. Start the component walk from the volume root (C:\ or //host/share/) instead of "/" so it resolves the prefix on Windows too; POSIX VolumeName is empty so the walk reduces to the original "/"-rooted behavior byte-for-byte. Windows test now pins allow-inside-root + deny-outside both directions. Co-Authored-By: Claude Fable 5 <[email protected]> * sandbox: address PR review findings for additional write roots Resolve the CHANGES_REQUESTED review on PR #162: - engine: derive workspaceRoot from scope.Roots()[0] when NewEngine is given a Scope without an explicit WorkspaceRoot, so Evaluate's EnforceWorkspace/classification guards no longer silently skip (+ regression test). - tools/workspace: scopedRoots now fails closed (returns an error) when a non-nil PathScope exposes empty Roots(), instead of returning success with an empty path; threaded through the scoped resolve/recheck helpers and resolveGrepRoot. - tools/glob: emit absolute matches when cwd resolves into an extra root so results can't be fed back and resolve to a same-named workspace file (+ regression test). - tools/bash,grep,apply_patch: schema descriptions mention granted extra roots (relative -> workspace, absolute -> granted root). - docs/plan: fix markdownlint heading increment, malformed rule+heading, and bare code fence. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> * tools/grep, tui: address PR review for additional write roots - grep now emits absolute, symlink-resolved paths for matches in a granted extra (non-workspace) root, mirroring the glob fix. A bare workspace-relative name like "report.go" otherwise resolves back under the workspace when fed to read_file/edit_file and hits the wrong file when the name exists in both roots. Covers content and files_with_matches output. - tui: only reset chatScrollOffset for a real submission, not an empty Enter (a no-op), so the viewport is no longer yanked to the bottom when nothing was submitted. Real submissions still snap back. - glob: schema description now mentions granted extra roots, matching the bash/grep/apply_patch wording so the --add-dir/-add-dir flow is discoverable. Regression tests: TestScopedGrepReturnsAbsoluteMatchesForExtraRoot, TestEmptySubmitKeepsChatScrollOffset. * docs: add /add-dir to the TUI commands quick-reference table The command was documented further down but missing from the scannable commands table, so users browsing the table wouldn't discover the additional-write-roots flow. --------- Co-authored-by: Claude Fable 5 <[email protected]>	2026-06-11 15:17:20 +05:30
3 people	6fb0231df8	TUI scrollback re-architecture, Lime chat surface, and deep-audit fixes (#158) ... * docs(design): add Lime TUI prototype and rebuild spec * tui: remove the zeroline skin system One design remains in the tree ahead of the Lime rebuild: the zeroline package, its TUI view/skin plumbing (Options.Skin/ThemeVariant/ThemeDark, model skin branches, theme picker), and the zeroline CLI subcommand are gone. /theme keeps its shell-only message. * tui: replace the cyan palette with the Lime token table theme.go is rebuilt around the Lime design tokens (docs/design/ zero_tui_lime.html): near-black panels, one lime accent, solid tint stand-ins for the prototype's rgba overlays. Existing render sites map onto the new role styles (ink/line/userPrompt/toolName/toolArg) without layout changes; no hex exists outside theme.go. * tui: build the Lime chat-surface components Title bar with brand badge + context window, empty state replacing the deleted splash (block-art 0, tagline, 1-3 starter suggestions), stream blocks (user prompt gutter, muted interim with cursor, final-answer accent rail, done line, bordered notes), tool cards with diff/read/ bash/grep bodies and MiniDot run spinner, borderless composer with run-state hints, and the grouped status line. Final answers are marked at append time; resolved tool calls collapse into their result cards. * tui: fix Stage 2 review findings Adversarial review of the chat-surface commit confirmed 15 issues, all fixed here: - wrapPlainText sliced wide runes by rune count: CJK/emoji prose could panic the TUI or emit lines ~2x the measure; split at width instead - a cancelled run's streamingText leaked into the next turn's interim block; cancelRun now clears it - orphaned tool-call cards (cancelled/errored turns) re-animated with the spinner on any later run; the glyph is now scoped to the call's own runID - starter-suggestion digit capture was active while the chips were off screen (/clear mid-run); the guard now mirrors the render condition - prompt submits while a deferred Ctrl+C quit is draining could start a run the quit would orphan; submission is blocked while exiting - the running placeholder advertised ctrl+c (which quits) as the interrupt key; it now says esc - read-card parser expected 'N: text' but read_file emits 'N | text', so the gutter and L-range never rendered on real output - toolCard borders were one column short of the body rows - diff tint bands now span the full row; NEW FILE renders green on addBg; preamble/no-newline lines are unnumbered meta and no longer shift hunk numbering - card bodies and system notes paint the panel surface; the head gains the separate faintest arg column (grep target + pattern) - title-bar overflow now truncates the minimal candidate instead of rendering the deleted design's 'ZERO … READY' line - untracked the stray snake-game.html (left on disk, ignored) * tui: restyle the interactive surfaces for Lime Permission prompts render as the amber permission card (PERMISSION badge, risk readout, key chips); resolved prompts collapse to one line (allowed once/always/denied · tool) and unprompted allows fold into the tool card's [auto] tag. Ask-user and spec-review prompts share the card language with line borders. Autocomplete and picker overlays move onto the panel/selection tints with the accent ❯ marker; model-picker rows gain the provider dot and ctx · KEY_ENV metadata from the registry and provider catalog. /resume renders its list as stacked session cards (id + age, title, meta). Key handling is untouched everywhere. * tui: adaptive width tiers, doc updates, final polish Width tiers re-evaluate from the live width: ≥100 renders the full spec; 80–99 drops the tool-arg column, header ctx, and the status 'interactive' group; 58–79 drops the diff/read gutters, bares the badge, and keeps provider+tokens+mode; <58 renders a single-segment header, rail-less cards, and a mode-only status line. Table-driven tests cover {58,70,80,100,120} plus a frame-wide invariant that no emitted line exceeds the terminal at any tier. Card bodies expand tabs so width math holds. Dead splash-chip machinery (startupCommandNames, startupOrder) is gone; README's TUI section now describes Lime. * tui: fix final-review findings across Stages 3-4 A second adversarial review confirmed 14 issues, all addressed: - permission collapse and tool-card pairing are now run-scoped (rcKey): providers with repeating synthetic ToolCallIDs (Gemini gemini_tool_N) could attribute a decision or result to a different run's call - rehydrated always-grants no longer mislabel as 'allowed once' (GrantMatched fallback) - the width invariant now actually holds everywhere: empty-state tagline/hint, ask-user rows, permission detail blobs, pending image chips, and the sessions trailing hint are wrapped or fitted; the invariant test renders the empty state and all of those rows at widths 24-120 - every card (permission, ask-user, spec-review, sessions, notes) drops side borders on tiny terminals, not just tool cards - /resume card fields are sanitized against separator bytes from user-controlled titles - the picker's selected row paints its gap so the selBg band is solid - dead splash helpers (normalizedStartupWidth, countLines, nonEmpty, unreachable rowWelcome branch) and stale /theme comments are gone - README no longer claims transcript scrolling keys or Tab-accept behavior that never existed; chatWidth documents its 24-col floor Tag tui-lime-s4 moves to this commit. * audit: deep-audit report, TUI scrollback re-architecture, and cross-module fixes TUI: settled-row flush frontier prints history to native terminal scrollback (tea.Println, ordered + ack-serialized); View() renders only the live tail. Full diffs (400-line flush cap) and OSC 8 file:// links land in history; streamed interim text, cancellation markers, ask_user exchanges, and composer input history are preserved; run-scoped dedup keys fix Gemini's repeating tool-call ids; /exit, Ctrl+C-after-Esc, and cross-session late flushes no longer orphan or contaminate checkpoints. Cross-module: zero search panic + offset mapping, usage report robustness, 529 retry, SSE keep-alive watchdog, registry corrections, update --check on dev builds, MCP ping + mcp list --json secret redaction, sandbox.network config knob, doctor apiKey presence, atomic config writes, C1-safe notifications, rune-safe truncation everywhere, gofmt + vet CI gates, dead glamour dependency dropped. Full audit report: docs/audit/2026-06-10-deep-audit.md (175 findings). Co-Authored-By: Claude Fable 5 <[email protected]> * tui: hide malformed ask_user tool errors * fix tui malformed tool retries * fix max-turn finalization * upgrade tui agent guardrails * fix coderabbit guardrail findings --------- Co-authored-by: Claude Fable 5 <[email protected]> Co-authored-by: Vasanthdev2004 <[email protected]>	2026-06-10 17:18:30 +05:30
3 people	9c2e14272b	CLI: doctor config validation, autonomy ceiling, changes --base, usage report (#142) ... * config: add ValidateFile for structured config diagnostics * doctor: add offsetToLineCol helper for JSON error positions * doctor: validate config files in config.validation check * cli: thread config paths into doctor and degrade on bad JSON * doctor: inline read, single-parse config validation + utf8 col test - Remove the osReadFile wrapper; call os.ReadFile directly at its one call site - Add config.ValidateBytes([]byte) so each config file is read and JSON-parsed once in configValidationCheck instead of twice (once for position, once via ValidateFile); ValidateFile now reads then delegates to its own unmarshal for the path-prefixed error message, keeping its public signature unchanged - Fix the misleading skip comment in configValidationCheck: configFilesCheck only checks path-string presence; the skip is a defensive guard for the unreachable case where DefaultResolveOptions passed a non-empty path that still fails to read - Add utf8 multibyte case to TestOffsetToLineCol documenting byte-column semantics (column counts bytes, not runes) * sandbox: add Policy.MaxAutonomy ceiling defaulting to high * sandbox: normalize both operands in autonomyAllowed to fail closed * sandbox: clamp grant-allow and unsafe escalation to policy autonomy ceiling * sandbox: add RequiredAutonomyForBatch helper with fail-closed mapping * config: add sandbox.maxAutonomy field to file and resolved config * config: merge sandbox.maxAutonomy across layers, env, and overrides * cli: thread configured autonomy ceiling into sandbox engine construction * cli: surface max_autonomy in sandbox policy formatters * zerocommands: carry max autonomy in sandbox policy snapshot * sandbox: default empty policy ceiling to high + reason const Evaluate now treats an empty Policy.MaxAutonomy (from a directly-constructed Policy that bypasses DefaultPolicy) as High instead of letting it normalize to Low, which would silently clamp every Medium/High decision to Prompt. The ceiling is a no-op unless explicitly configured. Also extracts the "above policy ceiling" clamp reason into a package const referenced at both engine clamp sites and the related tests, and adds a non-vacuous engine test proving the empty-ceiling trap is closed. * zerogit: add base-ref three-dot diff to changes inspect * zerogit: cover base-ref backward-compat and real-git diff * zerogit: propagate base ref through change snapshot * cli: parse changes --base ref and reject on commit * cli: thread base ref into changes inspect output and help * changes: redact base in cli summary + guard --base= + rename test - redactChangeSummary now redacts the Base field alongside Root/Branch/Commit/etc. - --base= equals-form rejects leading-dash values via flagValueLooksLikeOption, closing the option-smuggling gap - TestParseNameStatusRenameAndCopy asserts rename/copy three-field lines use the new/destination path with correct status, and confirms two-field modify is unaffected * Add ParseDiffStat helper for git diff --stat summaries * Add usage report aggregation over persisted session usage events * Add zero usage report command over persisted session usage * Wire usage command into CLI dispatch and help * usage: validate --since format, fix redaction comments, add tests Fix 1 (BLOCKING): parseUsageArgs now validates --since with time.Parse against YYYY-MM-DD; returns exitUsage + "invalid --since %q: expected YYYY-MM-DD" for bare strings like "foo", unpadded "2026-6-1", or wrong-separator "06/01/2026". Valid dates are stored unchanged for the existing lexical comparison. Fix 2: Replace false "pre-redaction stat" claims in diffstat.go and usage.go with accurate comments: the --stat summary line carries no secret-bearing tokens so parsing the already-redacted DiffStat is safe. Fix 3: Add three tests to usage_test.go — - TestRunUsageDaysFilter: stubs deps.now, seeds events on two dates, asserts --days 3 includes the recent date and excludes the old one. - TestRunUsageInvalidSince: table-driven; verifies "foo", "2026-6-1", "06/01/2026" each return exitUsage + validation message, while "2026-06-01" returns exitSuccess. - TestRunUsageEmptyStore: zero usage events → exitSuccess, output contains header and "total" row, no panic. * doctor: surface type-mismatch offsets and drop colliding flat line/col keys Probe config validation against config.FileConfig instead of a bare any so a structurally-valid document with a wrong field type (e.g. maxTurns as a string) surfaces a *json.UnmarshalTypeError carrying the offset, instead of losing line/col. Remove the flat top-level details["line"]/["col"] keys that were overwritten by the last malformed file when several were present; keep only the unambiguous per-path map entry. Tighten the existing malformed test to assert concrete per-path line/col and add a type-mismatch test that exercises the previously-dead UnmarshalTypeError branch. * sandbox: fail closed on invalid configured autonomy ceiling An invalid non-empty sandbox.maxAutonomy (e.g. "moderate") previously survived Resolve (only trimmed, never validated), failed to normalize at the sandbox bridge, and left the policy unchanged at the default High ceiling. A typo therefore silently disabled the admin's intended ceiling: fail-open on a security boundary. Validate at resolve time (fail loud): Resolve now rejects a non-empty maxAutonomy that does not normalize, returning a clear error. As defense in depth, applyConfiguredAutonomyCeiling now clamps an unrecognised non-empty value to the most restrictive ceiling (low) instead of returning the policy unchanged, so a bad value can never widen the ceiling even via direct use. Empty/unset stays valid and keeps the default High ceiling. Add resolver tests for invalid-fails / valid-resolves and bridge tests for the fail-closed clamp and valid mappings. * sandbox: fail closed on malformed autonomy and surface policy resolve errors Treat a genuinely-invalid request autonomy as the highest tier in the engine so it exceeds a Medium/Low ceiling and clamps to Prompt instead of being sanitized to Low and auto-allowing on the grant/unsafe path. Surface resolveConfig failures in the policy command instead of silently falling back to the permissive DefaultPolicy, which would misreport trust posture. * usage: bucket and filter by UTC calendar day, reject empty --session Normalize RFC3339 timestamps to their UTC calendar date before day bucketing (report) and before the --since/--days cutoff comparison (CLI) so offset timestamps land on the correct UTC day and the bucket and cutoff agree; malformed timestamps fall back to the leading-10 slice. Reject empty --session/--session-id values with a value-required error matching the --since validation style. * doctor: fail on unreadable config files and stop fabricating positions Surface a present-but-unreadable config path (permissions, is-a-directory) as a failing per-path validation detail instead of silently skipping it; a genuinely-missing path stays a skip. Return ok=false for a JSON parse error that carries no offset so it routes through the no-position ValidateBytes path rather than fabricating a (1,1) line/col. Assert empty stderr on the JSON doctor failure path. * config: make sandbox maxAutonomy resolver tests hermetic Pass an explicit empty Env to the maxAutonomy Resolve tests so host environment variables cannot leak in through the nil-Env os.Getenv fallback. * sandbox: preserve raw autonomy for ceiling check so invalid clamps under default ceiling Defaulting invalid request.Autonomy to High only clamped under a Medium/Low ceiling; under the default High ceiling autonomyAllowed(High, High) returned true and still auto-allowed (fail-open). Keep the raw requested value for the ceiling check so autonomyAllowed's unknown-tier guard fails it closed under ANY ceiling. Adds default-High-ceiling regression tests for the unsafe and grant-allow paths. --------- Co-authored-by: KRATOS <[email protected]> Co-authored-by: Vasanthdev2004 <[email protected]>	2026-06-08 17:15:57 +05:30
KRATOSandKRATOS	07d8ffc524	CLI wiring: skills/zeroline commands, --mode presets, exec checkpoints, sandbox --effective, sessions rewind (#128) ... * CLI wiring: skills/zeroline commands, --mode presets, exec checkpoints, sandbox --effective, sessions rewind Final module of the runtime-core split. Wires the new runtime features into the cli, PRESERVING main's merged specialist cli (the source branch predates specialist and drops it; this keeps it via a 3-way merge from the common base, adding the reskin features as ours/theirs-only changes). - skills command (internal/cli/skills.go) listing internal/skills; zeroline-skin TUI launcher (internal/cli/zeroline.go) via runInteractiveTUIWithSkin. - exec: --mode presets (smart/deep/fast/large/precise) via applyExecMode; model-registry alias resolution + deprecation/effort notices; ContextWindow sizing (modelContextWindow); before-mutation checkpoint recording in OnToolCall; enhanced tool-result output (ChangedFiles/Redacted/Display); permission-mode validation fix. - sandbox policy --effective (resolved guards); sessions rewind (executes the rewind plan); interactive TUI defaults to Ask mode (advertises write/edit/bash + gates via prompts). - internal/streamjson: EventCheckpoint/EventRestore + CheckpointInfo for structured checkpoint output. Specialist cli preserved (specialist.go + flags + runtime + tests all intact). build/vet/-race/full-suite + GOOS=windows build green; no new deps. * Address #128 review: make sessions rewind reachable + honor --exclude-target, mode/notice/redaction fixes - sessions: add "rewind" to the parser whitelist (isSessionsCommand) — it was wired in dispatch + help but parseSessionsArgs rejected it as 'unknown sessions command', so it was unreachable. Regression test TestRunSessionsRewindIsReachableAndHonorsExcludeTarget. - sessions rewind: honor --exclude-target — ApplyRewind keeps THROUGH a sequence, so when KeepTarget is false apply through TargetSequence-1, matching rewind-plan (previously rewind always applied TO the target, disagreeing with the plan). The test asserts --exclude-target keeps fewer events than the default. - sessions rewind: redact the session id in the success + not-found messages (consistent with every other human-readable path). - exec_parse: reject empty inline --mode= via requiredInlineFlagValue (was a silent no-op running defaults). - exec: notice writes (model-deprecation + reasoning-effort advisories) now treat write failures as exitCrash, consistent with the rest of the command. build/vet/-race/full-suite + GOOS=windows build green. --------- Co-authored-by: KRATOS <[email protected]>	2026-06-07 23:42:10 +05:30
Anandan	90b3cf1093	Add sandbox backend capability reporting (#94)	2026-06-06 15:04:20 +05:30
Anandan	1974a19e84	Report sandbox platform capabilities (#81)	2026-06-06 10:59:21 +05:30
KRATOS	29aec1b190	feat: add M6 sandbox backend (#77) ... * feat: add sandbox policy backend * feat: enforce sandbox decisions in tool runtime * feat: add sandbox policy and grants CLI * fix: honor sandbox grants in registry	2026-06-05 19:25:49 +05:30