CodeWhale BotandClaude Opus 5.5
0d347f5566
Found by a pre-release audit of the local network surfaces (Claude
workflow wf_d93a93bb-48d: three auditors plus adversarial verification
of every finding; a Gemini 4 Argon read-only review through agy found
nothing exploitable by default). Founder, 2026-10-18: pause account work
and hold the paid product until security review is stronger; this keeps
the local release to the same bar. Two unrefuted High findings and one
Medium are fixed here; the rest are listed in 0.10.2's Known limits.
1. Sandbox escape through the Runtime daemon socket (High).
Sandboxed commands (test scripts, postinstall hooks) could read the
owner receipt and connect to the daemon socket that `codewhale serve`,
the desktop app, the VS Code extension or ACP holds. The socket checks
only the peer uid, and an attached Control peer reaches the full
dispatcher, including app/config/set (sandbox_mode, approval_policy,
providers.*.base_url) and prompt/run. On Linux, bubblewrap's
--unshare-all does not stop a path-based AF_UNIX connect. On macOS,
Seatbelt with network on allows it.
- read_guard.rs: the daemon's default run directories, as this process
resolves them (CODEWHALE_HOME/run, $XDG_RUNTIME_DIR/codewhale,
~/Library/Application Support/codewhale, ~/.codewhale/run; an invalid
CODEWHALE_HOME falls back to the other layouts), join the default
sandbox deny-list. bubblewrap
masks an existing denied directory with an empty tmpfs, so the
socket and receipt are not there inside the sandbox.
- seatbelt.rs: a file-read deny does not stop connect(2). Checked with
sandbox-exec: with (allow network-outbound), the read deny alone
still connected, and adding (deny network-outbound (remote
unix-socket (subpath …))) refused it. With network on, every denied
path now gets that rule.
Live check (macOS, debug TUI, mock provider, CODEWHALE_SANDBOX_NETWORK_ACCESS=1,
a listener at <CODEWHALE_HOME>/run/t.sock; release-0102-refreeze-20261018/):
before "SOCKET-CONNECTED b'hi'", after "PermissionError: [Errno 1]".
Linux bubblewrap was not run end to end here; it relies on the existing
mask path proven for #7007.
2. `codewhale web` proof leak (High).
GET / wrote the live request proof into a meta tag for any request
carrying the session cookie and Sec-Fetch-Site: same-origin|none. The
cookie is host-scoped, not port-scoped, so a listener on another
127.0.0.1 port can receive it, and a non-browser client can claim any
Sec-Fetch-Site. Cookie plus proof opens every /v1 route (threads with
auto_approve, approvals, terminal input, config).
- web.rs: the page is static; the proof is never put in HTML.
index.html drops the meta tag; app.mjs drops pageProof and keeps the
proof in sessionStorage, so a reload still works. The existing
source assertion that app.mjs never uses localStorage stays.
- Behaviour change: a new tab opened by typing the address is not
signed in. docs/WEB.md and docs/RUNTIME_API.md say so and say what
to do.
Live check (curl against `codewhale web`, harness HOME, bootstrap
redeemed, then GET / with the cookie and Sec-Fetch-Site: none):
before "PROOF RE-ISSUED", after "no proof in page". Headless Chrome
over CDP on the fixed build: bootstrap ready with the proof in
sessionStorage and nothing in localStorage, reload ready, and a typed
new tab shows "not authenticated".
3. Web approval card spoofing (Medium).
When the model had written anything, the card showed only
`intent_summary` (the model's own text) and never the input. It now
shows the deterministic `summary`; then `description`, the runtime's
reason for asking (sandbox escalation, auto-review hold, repo law,
Computer Use consent), when it differs; then every argument in a <pre>:
the command first, then all other fields as JSON (sandbox_permissions,
justification, stdin, cwd, task_id ...), not truncated; and the model's
text last, labelled "The model says:". Headless Chrome with the mock
provider:
- phase3: summary "Run `echo later-01`", request "echo later-01"
- phase10 (bash with sandbox_permissions=danger-full-access): reason
"Sandbox escalation to 'danger-full-access' for this exact call: needs
the whole disk", request shows the command and the escalation fields
Tests changed for the new behaviour:
- web.rs runtime_surface_review_web_page_recovers_proof_for_reload_and_second_tab
becomes ..._web_page_never_carries_the_request_proof.
- runtime_api/tests.rs: the reload loop asserts the proof is absent.
- runtime_web_client.test.mjs: the independent-tab test becomes "web
session uses only its fragment or this tab's stored proof".
Checks:
- cargo test -p codewhale-tui --lib -- runtime_api:: runtime_surface
sandbox:: read_guard seatbelt bwrap provider_lake: 603 passed; 0 failed
- cargo test -p codewhale-commands: 28 passed; 0 failed
- node --test crates/tui/tests/runtime_web_client.test.mjs: 43/43; vitest
runtime_web app.test.mjs: 29/29
- after the review fixes: cargo test -p codewhale-tui --lib -- sandbox::
read_guard seatbelt bwrap runtime_surface runtime_api::web: 114 passed;
0 failed; clippy (tui, CI flags) clean; web tests 43/43 and 29/29
- cargo clippy -p codewhale-tui -p codewhale-commands --all-targets
--all-features --locked with CI's flags: clean; cargo fmt --check: clean
- npm test: 101/101, 19/19, 413 passed + 7 skipped of 420, 7/7, vitest
772/772; web prebuild + check-facts + check:docs OK; sync-changelog
--check up to date
Pre-push review (Claude workflow wf_626dd2b1-3e0, three lenses; Gemini 4
Argon via agy on the diff) found no bypass of the default setup and
these, all addressed before push:
- The card hid the runtime's `description` (a regression for sandbox
escalations) and dropped every input field but `command`. Fixed as in 3.
- An invalid (relative) CODEWHALE_HOME made runtime_daemon_socket_dirs
return nothing. Fixed with the fallback above.
- docs/zh_hans/RUNTIME_API.md still described the meta-tag recovery, and
zh_hans/WEB.md lacked the new-tab note. Both updated.
- The changelog overstated coverage. It now says the default deny-list
must stay on, and the gaps are listed under Known limits.
Unverified and not acted on: a claimed window after a TUI workspace switch
before the respawned engine installs the deny-list (recorded in the
release packet).
Known limits, listed in 0.10.2: no Host/Origin check under --insecure and
--insecure-no-auth; the bootstrap nonce passes through the browser
launcher's argv; the opt-in control socket has no peer-uid check; OAuth
loopback callbacks can be ended by a malformed request; the daemon-socket
deny covers only default locations as this process sees them, not a
directory created after a long-running command started, and not a macOS
workspace at or above the daemon directory (the directory can be moved).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01NBKbhx19BRbZtvWK8rVKjz
3.8 KiB
Local browser client
阅读简体中文版：zh_hans/WEB.md。
codewhale web opens Codewhale's embedded browser client over the canonical
Runtime API. It is a local surface: the server always binds to
127.0.0.1, cannot be rebound to a LAN address, and cannot run with Runtime
authentication disabled.
Start it
From the workspace Codewhale should operate in, run:
codewhale web
The default address is http://127.0.0.1:7878. To avoid a local port
collision, choose another loopback port:
codewhale web --port 8788
Codewhale starts the Runtime API, serves the dependency-free client embedded
in the installed binary, prints a single-use launch URL, and asks the operating
system to open that URL in the default browser. If the browser does not open,
use the printed URL within ten minutes. Stop the process with Ctrl+C; the
browser session ends with it.
What the browser can do
The embedded client provides a responsive thread and search rail, Runtime-owned session facts, transcript and tool receipts, and a composer. It can create, select, rename, and archive threads; start or steer turns; interrupt work; resolve approvals; and answer Runtime user-input requests.
The browser is another view of the same local Runtime. It does not create a second cloud account, copy provider credentials into browser storage, or weaken the configured approval and sandbox policies.
Authentication boundary
The browser-launch URL contains a random, short-lived, one-time bootstrap
capability. It never contains the Runtime bearer token. A loopback request
exchanges the capability for an HttpOnly, SameSite=Strict, process-local
session cookie and immediately invalidates the capability.
Reused, expired, malformed, and non-loopback bootstrap attempts fail closed. The Runtime token is not placed in rendered HTML, browser storage, URL queries or fragments, or browser-launch arguments. The one-time bootstrap value is printed in the local terminal and briefly passes through the operating system's browser launcher. It is single-use and expires after ten minutes, but a hostile process already running as the same OS user remains inside the local trust boundary.
Cookie-authenticated state-changing requests must also present the exact local web origin. Cross-origin browser requests are rejected. Existing explicit bearer and Runtime-token-header clients retain their normal Runtime API behavior.
Local means local
codewhale web accepts only --port; there is no --host or insecure-auth
option on this command. Do not treat it as a public website or expose its port
directly through router forwarding, a public reverse proxy, or a tunnel.
The separate codewhale app-server --mobile and --http modes have different
deployment and authentication contracts. Read RUNTIME_API.md
before operating either one, especially before selecting a non-loopback bind.
Troubleshooting
- If port
7878is occupied, pass an unused--portvalue. - If the browser does not open, copy the printed single-use bootstrap URL into
a browser on the same machine within ten minutes. Start
codewhale webagain if that URL has already been used or expired. - If the page loads but a provider is unavailable, inspect
codewhale doctorand/provider; the web command does not configure or move provider credentials. - If a session expired, stop and restart
codewhale webto mint a new process-local session. Reusing an old bootstrap URL is expected to fail. - A new tab opened by typing the address is not signed in: the session's
request proof stays in the tab that opened it. Use that tab, duplicate it,
or restart
codewhale web.
For integration endpoints, headers, events, and the complete web-session contract, see RUNTIME_API.md.