env shell: make the agent-in-box actually work by default#128
Merged
Conversation
The default `h5i env shell` could not run coding agents: claude/codex live under $HOME (not granted), the supervised socket gate denied the anonymous AF_UNIX socketpair every modern runtime creates at startup (codex panicked in tokio's signal setup), setsid detached the session from its controlling tty (no job control, broken TUIs), TERM wasn't passed, and the wall-clock timer SIGKILLed interactive sessions after 30min. - supervised gate: socketpair(AF_UNIX) is always allowed (anonymous pair = intra-box IPC, no authority); socket(AF_UNIX) stays deny-by-default - interactive sessions keep the caller's terminal session (no setsid) and have no wall-clock kill — operator-bounded, same rule both tiers - default env_pass gains TERM/COLORTERM; /dev/null + /dev/zero are write-granted sinks - new built-in 'agent' profile (no env.toml needed): ro ~/.local, ~/.nvm, rc files, git identity; rw ~/.claude(.json), ~/.codex, ~/.cache, ~/.npm, /tmp, /dev/tty; net.egress pinned to the agent APIs (supervised/container only — refuses tiers that can't enforce it); USER/SHELL; 8G/512 procs - env shell banner shows the profile + hints at --profile agent Verified on a supervised host: claude -p completed a real API round-trip inside the box; codex reads its auth; example.com blocked; ~/.ssh denied.
Instead of hinting at --profile agent from inside a box that can't run an agent, an unspecified --profile now auto-picks: the built-in 'agent' profile when its policy is actually enforceable on this host (net.egress needs the supervised/container tier — also checked against an explicitly pinned weaker --isolation), else the fail-closed 'default' with a printed note. Same pattern as the isolation auto-pick: explicit = fail-closed, unspecified = best runnable. So the out-of-the-box flow is now just: h5i env create tmp && h5i env shell tmp # claude/codex run, egress pinned Also: agent profile additionally grants ro ~/.cargo/env + ~/.cargo/bin (PATH shims only, NOT ~/.cargo with credentials.toml) so .bashrc sourcing works; CreateOpts.profile is Option<String> (None = auto) across CLI/MCP. (Audit note: the flagged 'exec()' is sandbox::verify_exec, h5i's own confinement self-test — not code execution.) Verified: bare create → agent+supervised on this host, claude --version runs in the box; --isolation process falls back to default with the note; 989 tests + clippy clean.
Koukyosyumei
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.