Found by a pre-release audit of the local network surfaces (Claude
workflow wf_d93a93bb-48d: three auditors plus adversarial verification
of every finding; a Gemini 4 Argon read-only review through agy found
nothing exploitable by default). Founder, 2026-10-18: pause account work
and hold the paid product until security review is stronger; this keeps
the local release to the same bar. Two unrefuted High findings and one
Medium are fixed here; the rest are listed in 0.10.2's Known limits.
1. Sandbox escape through the Runtime daemon socket (High).
Sandboxed commands (test scripts, postinstall hooks) could read the
owner receipt and connect to the daemon socket that `codewhale serve`,
the desktop app, the VS Code extension or ACP holds. The socket checks
only the peer uid, and an attached Control peer reaches the full
dispatcher, including app/config/set (sandbox_mode, approval_policy,
providers.*.base_url) and prompt/run. On Linux, bubblewrap's
--unshare-all does not stop a path-based AF_UNIX connect. On macOS,
Seatbelt with network on allows it.
- read_guard.rs: the daemon's default run directories, as this process
resolves them (CODEWHALE_HOME/run, $XDG_RUNTIME_DIR/codewhale,
~/Library/Application Support/codewhale, ~/.codewhale/run; an invalid
CODEWHALE_HOME falls back to the other layouts), join the default
sandbox deny-list. bubblewrap
masks an existing denied directory with an empty tmpfs, so the
socket and receipt are not there inside the sandbox.
- seatbelt.rs: a file-read deny does not stop connect(2). Checked with
sandbox-exec: with (allow network-outbound), the read deny alone
still connected, and adding (deny network-outbound (remote
unix-socket (subpath …))) refused it. With network on, every denied
path now gets that rule.
Live check (macOS, debug TUI, mock provider, CODEWHALE_SANDBOX_NETWORK_ACCESS=1,
a listener at <CODEWHALE_HOME>/run/t.sock; release-0102-refreeze-20261018/):
before "SOCKET-CONNECTED b'hi'", after "PermissionError: [Errno 1]".
Linux bubblewrap was not run end to end here; it relies on the existing
mask path proven for #7007.
2. `codewhale web` proof leak (High).
GET / wrote the live request proof into a meta tag for any request
carrying the session cookie and Sec-Fetch-Site: same-origin|none. The
cookie is host-scoped, not port-scoped, so a listener on another
127.0.0.1 port can receive it, and a non-browser client can claim any
Sec-Fetch-Site. Cookie plus proof opens every /v1 route (threads with
auto_approve, approvals, terminal input, config).
- web.rs: the page is static; the proof is never put in HTML.
index.html drops the meta tag; app.mjs drops pageProof and keeps the
proof in sessionStorage, so a reload still works. The existing
source assertion that app.mjs never uses localStorage stays.
- Behaviour change: a new tab opened by typing the address is not
signed in. docs/WEB.md and docs/RUNTIME_API.md say so and say what
to do.
Live check (curl against `codewhale web`, harness HOME, bootstrap
redeemed, then GET / with the cookie and Sec-Fetch-Site: none):
before "PROOF RE-ISSUED", after "no proof in page". Headless Chrome
over CDP on the fixed build: bootstrap ready with the proof in
sessionStorage and nothing in localStorage, reload ready, and a typed
new tab shows "not authenticated".
3. Web approval card spoofing (Medium).
When the model had written anything, the card showed only
`intent_summary` (the model's own text) and never the input. It now
shows the deterministic `summary`; then `description`, the runtime's
reason for asking (sandbox escalation, auto-review hold, repo law,
Computer Use consent), when it differs; then every argument in a <pre>:
the command first, then all other fields as JSON (sandbox_permissions,
justification, stdin, cwd, task_id ...), not truncated; and the model's
text last, labelled "The model says:". Headless Chrome with the mock
provider:
- phase3: summary "Run `echo later-01`", request "echo later-01"
- phase10 (bash with sandbox_permissions=danger-full-access): reason
"Sandbox escalation to 'danger-full-access' for this exact call: needs
the whole disk", request shows the command and the escalation fields
Tests changed for the new behaviour:
- web.rs runtime_surface_review_web_page_recovers_proof_for_reload_and_second_tab
becomes ..._web_page_never_carries_the_request_proof.
- runtime_api/tests.rs: the reload loop asserts the proof is absent.
- runtime_web_client.test.mjs: the independent-tab test becomes "web
session uses only its fragment or this tab's stored proof".
Checks:
- cargo test -p codewhale-tui --lib -- runtime_api:: runtime_surface
sandbox:: read_guard seatbelt bwrap provider_lake: 603 passed; 0 failed
- cargo test -p codewhale-commands: 28 passed; 0 failed
- node --test crates/tui/tests/runtime_web_client.test.mjs: 43/43; vitest
runtime_web app.test.mjs: 29/29
- after the review fixes: cargo test -p codewhale-tui --lib -- sandbox::
read_guard seatbelt bwrap runtime_surface runtime_api::web: 114 passed;
0 failed; clippy (tui, CI flags) clean; web tests 43/43 and 29/29
- cargo clippy -p codewhale-tui -p codewhale-commands --all-targets
--all-features --locked with CI's flags: clean; cargo fmt --check: clean
- npm test: 101/101, 19/19, 413 passed + 7 skipped of 420, 7/7, vitest
772/772; web prebuild + check-facts + check:docs OK; sync-changelog
--check up to date
Pre-push review (Claude workflow wf_626dd2b1-3e0, three lenses; Gemini 4
Argon via agy on the diff) found no bypass of the default setup and
these, all addressed before push:
- The card hid the runtime's `description` (a regression for sandbox
escalations) and dropped every input field but `command`. Fixed as in 3.
- An invalid (relative) CODEWHALE_HOME made runtime_daemon_socket_dirs
return nothing. Fixed with the fallback above.
- docs/zh_hans/RUNTIME_API.md still described the meta-tag recovery, and
zh_hans/WEB.md lacked the new-tab note. Both updated.
- The changelog overstated coverage. It now says the default deny-list
must stay on, and the gaps are listed under Known limits.
Unverified and not acted on: a claimed window after a TUI workspace switch
before the respawned engine installs the deny-list (recorded in the
release packet).
Known limits, listed in 0.10.2: no Host/Origin check under --insecure and
--insecure-no-auth; the bootstrap nonce passes through the browser
launcher's argv; the opt-in control socket has no peer-uid check; OAuth
loopback callbacks can be ended by a malformed request; the daemon-socket
deny covers only default locations as this process sees them, not a
directory created after a long-running command started, and not a macOS
workspace at or above the daemon directory (the directory can be moved).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01NBKbhx19BRbZtvWK8rVKjz
The OS browser opener can spawn successfully without opening a tab, and a hard opener failure currently shuts down an otherwise healthy local Runtime. In both cases the one-time bootstrap URL is unavailable to the person running Codewhale.
Print the loopback-only single-use URL, extend its bounded lifetime from two to ten minutes, and keep the server alive when automatic opening fails. Update the local web and Runtime API contracts to describe the terminal capability and recovery path.
Verified: rustfmt --check on the touched Rust modules; dependency-free web suite 21/21. Agent-assisted work; nothing published.
* docs(web): align the public surface with Blue Stage
Carry the TUI's semantic Blue Stage palette into the website, keep Signal Gold on the whale and human-attention accents, and enforce the cross-surface token contract in tests. Route existing Install and Providers topics to their first-party pages and document the loopback-only browser client's real bootstrap and authentication boundaries.
Signed-off-by: Hunter B <[email protected]>
* docs: keep translated READMEs in public-surface parity
Mirror the browser-client command and guide link across all six translated READMEs, with the source stamp updated to the exact English README. This restores the repository translation gate without translating or reordering executable commands.
Signed-off-by: Hunter B <[email protected]>
---------
Signed-off-by: Hunter B <[email protected]>
