feat(jail): operator read-only and writable bind allowlists - #188
Open
drewstone wants to merge 1 commit into
Open
feat(jail): operator read-only and writable bind allowlists#188drewstone wants to merge 1 commit into
drewstone wants to merge 1 commit into
Conversation
BRIDGE_JAIL_RO_PATHS and BRIDGE_JAIL_RW_PATHS add operator binds to every jailed worker. An fs-jail hides the operator home by design, which also hides a harness whose install or state lives there: a Python venv (hermes), an isolated node prefix (prime-agent), an agent's own config dir. The lab's bridge env already named BRIDGE_JAIL_RO_PATHS; no code read it. Both lists are parsed at boot. A relative path, /, /home, or the home itself refuses the bridge. A bind at or above a request's working directory refuses that request. Read-only extras are inert unless the floor is fs-jail (boot warning). Writable extras are bound before read-only ones so an operator can keep an agent's state writable and carve its code back to read-only.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
BRIDGE_JAIL_RO_PATHS/BRIDGE_JAIL_RW_PATHS: operator allowlists of extra binds for every jailed worker (comma- or colon-separated absolute paths). Read-only extras apply under fs-jail; writable extras under both jail modes.Why
An fs-jail hides the operator home by design. That also hides a harness whose install or state lives there: a Python venv (
hermes, plus its uv-managed interpreter under~/.local/share/uv), an isolated node prefix (prime-agent), an agent's own config dir. The discovery-lab bridge env already setBRIDGE_JAIL_RO_PATHSfor opencode; no code read it. This makes the name real.Safety
/,/home, or the operator home itself refuses the bridge.RW=$HOME/.hermes+RO=$HOME/.hermes/hermes-agentkeeps an agent's state writable and its code read-only. The old order would have made the code writable.Verification
tsc --noEmitexit 0;vitest run tests/jail.test.ts tests/jail-path-allowlists.test.ts60/60; pre-pushtrace-contract-tests44/44.BRIDGE_JAIL_RW_PATHS=$HOME/.hermesandBRIDGE_JAIL_RO_PATHS=$HOME/.hermes/hermes-agent,$HOME/.local/share/uv,$HOME/bin,$HOME/.cache/cli-bridge/prime-agent,$HOME/.local/bin. Before:bwrap: execvp .../hermes: No such file or directory, same for prime-agent. After:hermes acpcompletes a jailed session end to end (HTTP 200) and prime-agent 0.7.0 (built from the pinned commit) is found and runs. Their remaining failures (hermes does not seeHERMES_HOMEinside the jail; prime's daemon backstop throws) are backend env-passthrough questions, tracked separately.