Repository navigation
Add per-tool safe profiles and an isolation policy - #82
Merged
Merged
Conversation
safe gains SAFE_SOCKET_DIRS for per-invocation unix-socket grants (safehouse has no flag for them); safehouse's own SAFEHOUSE_ADD_DIRS* and SAFEHOUSE_ENV_PASS cover dirs and env. safe-tmux is the tool-neutral way to drive a shell under safe from tmux. ADR 0063 records the per-invocation knobs. ADR 0064 proposes the isolation policy (deny/isolate/narrow/share) and records shared mise and bundler access as an accepted, documented gap. Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
bin/safe picks a tool profile from SAFE_TOOL or the command's basename
and applies config/agent-safehouse/tools/<tool>.{sb,sh}: extra grants,
env passthrough, unix-socket dirs, and an optional isolated XDG cache
and state root (mise's cache and state stay pinned to the real dirs so
trust survives the redirect).
prime-agent gets state, daemon and worker sockets, and isolated cache
and state. pi takes the plannotator grant out of common.sb.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Pinning MISE_STATE_DIR to the real dir let a sandboxed `mise trust` write into the trust state that guards planted mise configs. With SAFE_XDG_ISOLATE the tool's state is now its own copy, seeded one way (cp -n) from the real trusted-configs and tracked-configs, so existing repos stay trusted and the tool can't trust anything in yours. mise's cache is ~/Library/Caches/mise on macOS (not XDG), so the old cache pin pointed at an empty dir and is gone. Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
safenow picks a tool profile from the command name (orSAFE_TOOL) and appliesconfig/agent-safehouse/tools/<tool>.{sb,sh}: extra grants, env passthrough, and optionally an isolated XDG cache and state root under~/.local/share/safe/<tool>. First two profiles areprime-agentandpi(the plannotator grant moves out ofcommon.sb).SAFE_SOCKET_DIRSgives a command bind/accept/connect on unix sockets in the listed dirs. Safehouse has no flag for that, and its ownSAFEHOUSE_ADD_DIRS,SAFEHOUSE_ADD_DIRS_ROandSAFEHOUSE_ENV_PASSalready cover dirs and env, so that's the only gap I filled.bin/safe-tmuxdrives a shell undersafefrom a detached tmux session, for poking at things without an interactive terminal.XDG isolation only redirects cache and state. mise's trust state is seeded one way from the real one, so existing repos stay trusted but a
mise trustrun by the tool never touches yours.Test plan
I could only test against a stubbed
safehouse(it can't nest inside Claude's sandbox), so this needs a real run from a normal terminal:safe prime-agent statusandsafe pistart, and a profiled tool can write its private root.mise trustandmise installstill work from insidesafe prime-agent.SAFE_SOCKET_DIRSdir, andsafe zsh(no profile) behaves as before.~/.config/agent-safehouselinks into themainworktree, so the profiles only take effect after this merges.Follow-up work
Audit of what the existing grants expose is in progress. First pass found some broad ones (cloud SSO token cache, MCP OAuth credentials, cached executables), and those get their own PRs.
🤖 Generated with Claude Code