Skip to content

emrg: bash tool sandbox — file-level isolation for task sessions - #886

Merged
argszero merged 2 commits into
masterfrom
feature/bash-sandbox
Aug 20, 2026
Merged

emrg: bash tool sandbox — file-level isolation for task sessions#886
argszero merged 2 commits into
masterfrom
feature/bash-sandbox

Conversation

@argszero

@argszeroargszero commented Aug 20, 2026•
edited
Loading

Copy link
Copy Markdown
Owner

Implement file-level isolation for the bash tool, per host design-finalized rant 2026-08-20T15:46:50 (learned from DeepSeek Harness's sandbox modes).

Design (EMRG-minimal, per host spec)

Three per-task sandbox tiers, default = danger-full-access (current behavior, zero breakage):

  • danger-full-access — no checks (unchanged)
  • read-only — blocks destructive writes: rm -r/-rf/-R, rmdir, mv, cp -r, and shell redirects (> / >> / 2> / &>) to any non-/dev/null target
  • workspace-write — blocks writes to protected daemon files (~/.emrg/config.toml, emrgd.token, tasks.yml, projects.yml, rants.jsonl), to ~/.emrg itself, and to absolute paths outside the workspace root (OS temp dir allowed — mirrors dsh's workspace + backend-promised temp area)

Enforcement is honestly reported: checked modes report partial (static heuristic scan — no bwrap/Seatbelt/ACL, per host's explicit no-heavy-dependency decision); danger-full-access reports full. Blocked commands return a ⛔ [sandbox:...] ... not executed ToolResult; successful sandboxed runs tag output with [sandbox:<mode> enforcement=partial] ok.

Wiring

  • TaskRequest.sandbox field (protocol) → daemon tool loop injects it into bash tool args (the agent cannot choose its own sandbox — config decides)
  • Scheduler resolves tier per task: explicit sandbox: field in tasks.yml wins; builtin defaults — emrg-task → workspace-write, *-opensource-task → read-only, custom tasks → full access; upgrade sessions run workspace-write
  • task_create / task_update accept and validate the sandbox field; hot-reload diff signature includes it
  • +23 tests (pytest 958 → 981, Agent.md count synced); full suite green (980 passed + 1 skipped), import + CLI OK

Acceptance (from the rant)

  1. ✅ Task-configurable sandbox (3 tiers, default full-access = compatible)
  2. ✅ read-only: obvious destructive writes blocked with explanation
  3. ✅ workspace-write: in-workspace writes fine, protected/outside-workspace blocked
  4. ✅ enforcement honestly reported (full/partial)
  5. ✅ evolution/opensource/upgrade tasks get the suggested default tiers
  6. ✅ unconfigured tasks = danger-full-access = current behavior
  7. ✅ full test suite passes (pytest + import + CLI)

EMRG Evolution
emrg: bash tool sandbox — file-level isolation for task sessions (ran…
98410de
…t 2026-08-20T15:46:50)
Per-task sandbox tier (read-only / workspace-write / danger-full-access,
default = danger-full-access = current behavior) injected into the bash
tool's static command scan:
- read-only: blocks destructive writes (rm -r / rmdir / mv / cp -r and
shell redirects to non-/dev/null targets)
- workspace-write: blocks writes to protected daemon files
(config.toml / emrgd.token / tasks.yml / projects.yml / rants.jsonl),
to ~/.emrg itself, and to absolute paths outside the workspace (OS temp
dir allowed, mirroring dsh's workspace + temp area)
- enforcement honestly reports partial (static heuristic, no OS-level
boundary — no bwrap/Seatbelt/ACL)
Wiring: TaskRequest.sandbox (protocol) → daemon tool loop injects it into
bash args → scheduler resolves tier per task (explicit tasks.yml sandbox
field wins; emrg-task → workspace-write, *-opensource-task → read-only,
custom tasks → full access). Upgrade sessions run workspace-write.
task_create/task_update accept and validate sandbox; hot-reload diffing
includes it. +23 tests (pytest 958 → 981, Agent.md synced).
@argszeroargszero changed the title emrg: add DeepSeek Harness to vs-the-competition comparison tableemrg: bash tool sandbox — file-level isolation for task sessionsAug 20, 2026
EMRG Evolution
emrg: sandbox — treat drive-less rooted paths as absolute (Windows CI…
4423069
… fix)
ntpath.isabs('/etc/hosts') returns False (rooted-relative, no drive), so
the workspace-write check treated out-of-workspace absolute targets as
in-workspace relative ones on Windows. _is_absolute_path now also
classifies '/...' and '\...' as absolute (review #886 test-windows ❌).
argszero
argszero commented Aug 20, 2026
View reviewed changes

@argszeroargszero left a comment

Copy link
Copy Markdown
OwnerAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ LGTM — cycle (full suite 980 passed + 1 skipped locally; test + test-windows CI green after the Windows drive-less-root fix)

argszero
argszero commented Aug 20, 2026
View reviewed changes

@argszeroargszero left a comment

Copy link
Copy Markdown
OwnerAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ LGTM — cycle 2 (independent re-review: sandbox tiers, static check, honest partial/full enforcement, task wiring all match the design; CI test + test-windows green)

argszero
argszero commented Aug 20, 2026
View reviewed changes

@argszeroargszero left a comment

Copy link
Copy Markdown
OwnerAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ LGTM — cycle 3 (head unchanged since cycle 2, CLEAN/MERGEABLE, CI green) — merging

@argszero
argszero merged commit 49a02f1 into masterAug 20, 2026
2 checks passed
@argszeroargszero mentioned this pull request Aug 20, 2026
Merged
argszero added a commit that referenced this pull request Aug 20, 2026
@argszeroEMRG Evolution
emrg: bump version to v0.2.59 (release:#886#887#888#889#890) (#893)
1245362
Co-authored-by: EMRG Evolution <emrg@argszero.dev>
@argszero
argszero deleted the feature/bash-sandbox branch August 23, 2026 02:26
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@argszero
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
emrg: bash tool sandbox — file-level isolation for task sessions by argszero · Pull Request #886 · argszero/emrg · GitHub
Skip to content
emrg: bash tool sandbox — file-level isolation for task sessions - #886
Merged
argszero merged 2 commits into
masterfrom 
feature/bash-sandbox
Aug 20, 2026
Merged
emrg: bash tool sandbox — file-level isolation for task sessions#886
argszero merged 2 commits into
masterfrom 
feature/bash-sandbox
Conversation
@argszero
@argszeroargszero
commented
Aug 20, 2026•

edited

Loading

Copy link


Copy Markdown

Owner
Implement file-level isolation for the bash tool, per host design-finalized rant 2026-08-20T15:46:50 (learned from DeepSeek Harness's sandbox modes).
Design (EMRG-minimal, per host spec)
Three per-task sandbox tiers, default = danger-full-access (current behavior, zero breakage):
  • danger-full-access — no checks (unchanged)
  • read-only — blocks destructive writes: rm -r/-rf/-R, rmdir, mv, cp -r, and shell redirects (> / >> / 2> / &>) to any non-/dev/null target
  • workspace-write — blocks writes to protected daemon files (~/.emrg/config.toml, emrgd.token, tasks.yml, projects.yml, rants.jsonl), to ~/.emrg itself, and to absolute paths outside the workspace root (OS temp dir allowed — mirrors dsh's workspace + backend-promised temp area)
Enforcement is honestly reported: checked modes report partial (static heuristic scan — no bwrap/Seatbelt/ACL, per host's explicit no-heavy-dependency decision); danger-full-access reports full. Blocked commands return a ⛔ [sandbox:...] ... not executed ToolResult; successful sandboxed runs tag output with [sandbox:<mode> enforcement=partial] ok.
Wiring
  • TaskRequest.sandbox field (protocol) → daemon tool loop injects it into bash tool args (the agent cannot choose its own sandbox — config decides)
  • Scheduler resolves tier per task: explicit sandbox: field in tasks.yml wins; builtin defaults — emrg-task → workspace-write, *-opensource-task → read-only, custom tasks → full access; upgrade sessions run workspace-write
  • task_create / task_update accept and validate the sandbox field; hot-reload diff signature includes it
  • +23 tests (pytest 958 → 981, Agent.md count synced); full suite green (980 passed + 1 skipped), import + CLI OK
Acceptance (from the rant)
  1. ✅ Task-configurable sandbox (3 tiers, default full-access = compatible)
  2. ✅ read-only: obvious destructive writes blocked with explanation
  3. ✅ workspace-write: in-workspace writes fine, protected/outside-workspace blocked
  4. ✅ enforcement honestly reported (full/partial)
  5. ✅ evolution/opensource/upgrade tasks get the suggested default tiers
  6. ✅ unconfigured tasks = danger-full-access = current behavior
  7. ✅ full test suite passes (pytest + import + CLI)
EMRG Evolution
emrg: bash tool sandbox — file-level isolation for task sessions (ran…
98410de
…t 2026-08-20T15:46:50)
Per-task sandbox tier (read-only / workspace-write / danger-full-access,
default = danger-full-access = current behavior) injected into the bash
tool's static command scan:
- read-only: blocks destructive writes (rm -r / rmdir / mv / cp -r and
shell redirects to non-/dev/null targets)
- workspace-write: blocks writes to protected daemon files
(config.toml / emrgd.token / tasks.yml / projects.yml / rants.jsonl),
to ~/.emrg itself, and to absolute paths outside the workspace (OS temp
dir allowed, mirroring dsh's workspace + temp area)
- enforcement honestly reports partial (static heuristic, no OS-level
boundary — no bwrap/Seatbelt/ACL)
Wiring: TaskRequest.sandbox (protocol) → daemon tool loop injects it into
bash args → scheduler resolves tier per task (explicit tasks.yml sandbox
field wins; emrg-task → workspace-write, *-opensource-task → read-only,
custom tasks → full access). Upgrade sessions run workspace-write.
task_create/task_update accept and validate sandbox; hot-reload diffing
includes it. +23 tests (pytest 958 → 981, Agent.md synced).
@argszeroargszero
changed the title
emrg: add DeepSeek Harness to vs-the-competition comparison tableemrg: bash tool sandbox — file-level isolation for task sessionsAug 20, 2026
EMRG Evolution
emrg: sandbox — treat drive-less rooted paths as absolute (Windows CI…
4423069
… fix)
ntpath.isabs('/etc/hosts') returns False (rooted-relative, no drive), so
the workspace-write check treated out-of-workspace absolute targets as
in-workspace relative ones on Windows. _is_absolute_path now also
classifies '/...' and '\...' as absolute (review #886 test-windows ❌).
argszero
argszero
commented
Aug 20, 2026
View reviewed changes
@argszeroargszero
left a comment


Copy link


Copy Markdown

OwnerAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ LGTM — cycle (full suite 980 passed + 1 skipped locally; test + test-windows CI green after the Windows drive-less-root fix)
argszero
argszero
commented
Aug 20, 2026
View reviewed changes
@argszeroargszero
left a comment


Copy link


Copy Markdown

OwnerAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ LGTM — cycle 2 (independent re-review: sandbox tiers, static check, honest partial/full enforcement, task wiring all match the design; CI test + test-windows green)
argszero
argszero
commented
Aug 20, 2026
View reviewed changes
@argszeroargszero
left a comment


Copy link


Copy Markdown

OwnerAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ LGTM — cycle 3 (head unchanged since cycle 2, CLEAN/MERGEABLE, CI green) — merging
@argszero
argszero
merged commit 49a02f1
into
masterAug 20, 2026

2 checks passed

@argszeroargszero
mentioned this pull request
Aug 20, 2026
 Merged

argszero added a commit
that referenced
this pull request
Aug 20, 2026
@argszeroEMRG Evolution
emrg: bump version to v0.2.59 (release:#886#887#888#889#890) (#893)
1245362
Co-authored-by: EMRG Evolution <emrg@argszero.dev>
@argszero
argszero
deleted the

feature/bash-sandbox

branch
August 23, 2026 02:26
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@argszero

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
emrg: bash tool sandbox — file-level isolation for task sessions by argszero · Pull Request #886 · argszero/emrg · GitHub
Skip to content
emrg: bash tool sandbox — file-level isolation for task sessions - #886
Merged
argszero merged 2 commits into
masterfrom 
feature/bash-sandbox
Aug 20, 2026
Merged
emrg: bash tool sandbox — file-level isolation for task sessions#886
argszero merged 2 commits into
masterfrom 
feature/bash-sandbox
Conversation
@argszero
@argszeroargszero
commented
Aug 20, 2026•

edited

Loading

Copy link


Copy Markdown

Owner
Implement file-level isolation for the bash tool, per host design-finalized rant 2026-08-20T15:46:50 (learned from DeepSeek Harness's sandbox modes).
Design (EMRG-minimal, per host spec)
Three per-task sandbox tiers, default = danger-full-access (current behavior, zero breakage):
  • danger-full-access — no checks (unchanged)
  • read-only — blocks destructive writes: rm -r/-rf/-R, rmdir, mv, cp -r, and shell redirects (> / >> / 2> / &>) to any non-/dev/null target
  • workspace-write — blocks writes to protected daemon files (~/.emrg/config.toml, emrgd.token, tasks.yml, projects.yml, rants.jsonl), to ~/.emrg itself, and to absolute paths outside the workspace root (OS temp dir allowed — mirrors dsh's workspace + backend-promised temp area)
Enforcement is honestly reported: checked modes report partial (static heuristic scan — no bwrap/Seatbelt/ACL, per host's explicit no-heavy-dependency decision); danger-full-access reports full. Blocked commands return a ⛔ [sandbox:...] ... not executed ToolResult; successful sandboxed runs tag output with [sandbox:<mode> enforcement=partial] ok.
Wiring
  • TaskRequest.sandbox field (protocol) → daemon tool loop injects it into bash tool args (the agent cannot choose its own sandbox — config decides)
  • Scheduler resolves tier per task: explicit sandbox: field in tasks.yml wins; builtin defaults — emrg-task → workspace-write, *-opensource-task → read-only, custom tasks → full access; upgrade sessions run workspace-write
  • task_create / task_update accept and validate the sandbox field; hot-reload diff signature includes it
  • +23 tests (pytest 958 → 981, Agent.md count synced); full suite green (980 passed + 1 skipped), import + CLI OK
Acceptance (from the rant)
  1. ✅ Task-configurable sandbox (3 tiers, default full-access = compatible)
  2. ✅ read-only: obvious destructive writes blocked with explanation
  3. ✅ workspace-write: in-workspace writes fine, protected/outside-workspace blocked
  4. ✅ enforcement honestly reported (full/partial)
  5. ✅ evolution/opensource/upgrade tasks get the suggested default tiers
  6. ✅ unconfigured tasks = danger-full-access = current behavior
  7. ✅ full test suite passes (pytest + import + CLI)
EMRG Evolution
emrg: bash tool sandbox — file-level isolation for task sessions (ran…
98410de
…t 2026-08-20T15:46:50)
Per-task sandbox tier (read-only / workspace-write / danger-full-access,
default = danger-full-access = current behavior) injected into the bash
tool's static command scan:
- read-only: blocks destructive writes (rm -r / rmdir / mv / cp -r and
shell redirects to non-/dev/null targets)
- workspace-write: blocks writes to protected daemon files
(config.toml / emrgd.token / tasks.yml / projects.yml / rants.jsonl),
to ~/.emrg itself, and to absolute paths outside the workspace (OS temp
dir allowed, mirroring dsh's workspace + temp area)
- enforcement honestly reports partial (static heuristic, no OS-level
boundary — no bwrap/Seatbelt/ACL)
Wiring: TaskRequest.sandbox (protocol) → daemon tool loop injects it into
bash args → scheduler resolves tier per task (explicit tasks.yml sandbox
field wins; emrg-task → workspace-write, *-opensource-task → read-only,
custom tasks → full access). Upgrade sessions run workspace-write.
task_create/task_update accept and validate sandbox; hot-reload diffing
includes it. +23 tests (pytest 958 → 981, Agent.md synced).
@argszeroargszero
changed the title
emrg: add DeepSeek Harness to vs-the-competition comparison tableemrg: bash tool sandbox — file-level isolation for task sessionsAug 20, 2026
EMRG Evolution
emrg: sandbox — treat drive-less rooted paths as absolute (Windows CI…
4423069
… fix)
ntpath.isabs('/etc/hosts') returns False (rooted-relative, no drive), so
the workspace-write check treated out-of-workspace absolute targets as
in-workspace relative ones on Windows. _is_absolute_path now also
classifies '/...' and '\...' as absolute (review #886 test-windows ❌).
argszero
argszero
commented
Aug 20, 2026
View reviewed changes
@argszeroargszero
left a comment


Copy link


Copy Markdown

OwnerAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ LGTM — cycle (full suite 980 passed + 1 skipped locally; test + test-windows CI green after the Windows drive-less-root fix)
argszero
argszero
commented
Aug 20, 2026
View reviewed changes
@argszeroargszero
left a comment


Copy link


Copy Markdown

OwnerAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ LGTM — cycle 2 (independent re-review: sandbox tiers, static check, honest partial/full enforcement, task wiring all match the design; CI test + test-windows green)
argszero
argszero
commented
Aug 20, 2026
View reviewed changes
@argszeroargszero
left a comment


Copy link


Copy Markdown

OwnerAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ LGTM — cycle 3 (head unchanged since cycle 2, CLEAN/MERGEABLE, CI green) — merging
@argszero
argszero
merged commit 49a02f1
into
masterAug 20, 2026

2 checks passed

@argszeroargszero
mentioned this pull request
Aug 20, 2026
 Merged

argszero added a commit
that referenced
this pull request
Aug 20, 2026
@argszeroEMRG Evolution
emrg: bump version to v0.2.59 (release:#886#887#888#889#890) (#893)
1245362
Co-authored-by: EMRG Evolution <emrg@argszero.dev>
@argszero
argszero
deleted the

feature/bash-sandbox

branch
August 23, 2026 02:26
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@argszero

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
emrg: bash tool sandbox — file-level isolation for task sessions by argszero · Pull Request #886 · argszero/emrg · GitHub
Skip to content
emrg: bash tool sandbox — file-level isolation for task sessions - #886
Merged
argszero merged 2 commits into
masterfrom 
feature/bash-sandbox
Aug 20, 2026
Merged
emrg: bash tool sandbox — file-level isolation for task sessions#886
argszero merged 2 commits into
masterfrom 
feature/bash-sandbox
Conversation
@argszero
@argszeroargszero
commented
Aug 20, 2026•

edited

Loading

Copy link


Copy Markdown

Owner
Implement file-level isolation for the bash tool, per host design-finalized rant 2026-08-20T15:46:50 (learned from DeepSeek Harness's sandbox modes).
Design (EMRG-minimal, per host spec)
Three per-task sandbox tiers, default = danger-full-access (current behavior, zero breakage):
  • danger-full-access — no checks (unchanged)
  • read-only — blocks destructive writes: rm -r/-rf/-R, rmdir, mv, cp -r, and shell redirects (> / >> / 2> / &>) to any non-/dev/null target
  • workspace-write — blocks writes to protected daemon files (~/.emrg/config.toml, emrgd.token, tasks.yml, projects.yml, rants.jsonl), to ~/.emrg itself, and to absolute paths outside the workspace root (OS temp dir allowed — mirrors dsh's workspace + backend-promised temp area)
Enforcement is honestly reported: checked modes report partial (static heuristic scan — no bwrap/Seatbelt/ACL, per host's explicit no-heavy-dependency decision); danger-full-access reports full. Blocked commands return a ⛔ [sandbox:...] ... not executed ToolResult; successful sandboxed runs tag output with [sandbox:<mode> enforcement=partial] ok.
Wiring
  • TaskRequest.sandbox field (protocol) → daemon tool loop injects it into bash tool args (the agent cannot choose its own sandbox — config decides)
  • Scheduler resolves tier per task: explicit sandbox: field in tasks.yml wins; builtin defaults — emrg-task → workspace-write, *-opensource-task → read-only, custom tasks → full access; upgrade sessions run workspace-write
  • task_create / task_update accept and validate the sandbox field; hot-reload diff signature includes it
  • +23 tests (pytest 958 → 981, Agent.md count synced); full suite green (980 passed + 1 skipped), import + CLI OK
Acceptance (from the rant)
  1. ✅ Task-configurable sandbox (3 tiers, default full-access = compatible)
  2. ✅ read-only: obvious destructive writes blocked with explanation
  3. ✅ workspace-write: in-workspace writes fine, protected/outside-workspace blocked
  4. ✅ enforcement honestly reported (full/partial)
  5. ✅ evolution/opensource/upgrade tasks get the suggested default tiers
  6. ✅ unconfigured tasks = danger-full-access = current behavior
  7. ✅ full test suite passes (pytest + import + CLI)
EMRG Evolution
emrg: bash tool sandbox — file-level isolation for task sessions (ran…
98410de
…t 2026-08-20T15:46:50)
Per-task sandbox tier (read-only / workspace-write / danger-full-access,
default = danger-full-access = current behavior) injected into the bash
tool's static command scan:
- read-only: blocks destructive writes (rm -r / rmdir / mv / cp -r and
shell redirects to non-/dev/null targets)
- workspace-write: blocks writes to protected daemon files
(config.toml / emrgd.token / tasks.yml / projects.yml / rants.jsonl),
to ~/.emrg itself, and to absolute paths outside the workspace (OS temp
dir allowed, mirroring dsh's workspace + temp area)
- enforcement honestly reports partial (static heuristic, no OS-level
boundary — no bwrap/Seatbelt/ACL)
Wiring: TaskRequest.sandbox (protocol) → daemon tool loop injects it into
bash args → scheduler resolves tier per task (explicit tasks.yml sandbox
field wins; emrg-task → workspace-write, *-opensource-task → read-only,
custom tasks → full access). Upgrade sessions run workspace-write.
task_create/task_update accept and validate sandbox; hot-reload diffing
includes it. +23 tests (pytest 958 → 981, Agent.md synced).
@argszeroargszero
changed the title
emrg: add DeepSeek Harness to vs-the-competition comparison tableemrg: bash tool sandbox — file-level isolation for task sessionsAug 20, 2026
EMRG Evolution
emrg: sandbox — treat drive-less rooted paths as absolute (Windows CI…
4423069
… fix)
ntpath.isabs('/etc/hosts') returns False (rooted-relative, no drive), so
the workspace-write check treated out-of-workspace absolute targets as
in-workspace relative ones on Windows. _is_absolute_path now also
classifies '/...' and '\...' as absolute (review #886 test-windows ❌).
argszero
argszero
commented
Aug 20, 2026
View reviewed changes
@argszeroargszero
left a comment


Copy link


Copy Markdown

OwnerAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ LGTM — cycle (full suite 980 passed + 1 skipped locally; test + test-windows CI green after the Windows drive-less-root fix)
argszero
argszero
commented
Aug 20, 2026
View reviewed changes
@argszeroargszero
left a comment


Copy link


Copy Markdown

OwnerAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ LGTM — cycle 2 (independent re-review: sandbox tiers, static check, honest partial/full enforcement, task wiring all match the design; CI test + test-windows green)
argszero
argszero
commented
Aug 20, 2026
View reviewed changes
@argszeroargszero
left a comment


Copy link


Copy Markdown

OwnerAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ LGTM — cycle 3 (head unchanged since cycle 2, CLEAN/MERGEABLE, CI green) — merging
@argszero
argszero
merged commit 49a02f1
into
masterAug 20, 2026

2 checks passed

@argszeroargszero
mentioned this pull request
Aug 20, 2026
 Merged

argszero added a commit
that referenced
this pull request
Aug 20, 2026
@argszeroEMRG Evolution
emrg: bump version to v0.2.59 (release:#886#887#888#889#890) (#893)
1245362
Co-authored-by: EMRG Evolution <emrg@argszero.dev>
@argszero
argszero
deleted the

feature/bash-sandbox

branch
August 23, 2026 02:26
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@argszero

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
emrg: bash tool sandbox — file-level isolation for task sessions by argszero · Pull Request #886 · argszero/emrg · GitHub
Skip to content
emrg: bash tool sandbox — file-level isolation for task sessions - #886
Merged
argszero merged 2 commits into
masterfrom 
feature/bash-sandbox
Aug 20, 2026
Merged
emrg: bash tool sandbox — file-level isolation for task sessions#886
argszero merged 2 commits into
masterfrom 
feature/bash-sandbox
Conversation
@argszero
@argszeroargszero
commented
Aug 20, 2026•

edited

Loading

Copy link


Copy Markdown

Owner
Implement file-level isolation for the bash tool, per host design-finalized rant 2026-08-20T15:46:50 (learned from DeepSeek Harness's sandbox modes).
Design (EMRG-minimal, per host spec)
Three per-task sandbox tiers, default = danger-full-access (current behavior, zero breakage):
  • danger-full-access — no checks (unchanged)
  • read-only — blocks destructive writes: rm -r/-rf/-R, rmdir, mv, cp -r, and shell redirects (> / >> / 2> / &>) to any non-/dev/null target
  • workspace-write — blocks writes to protected daemon files (~/.emrg/config.toml, emrgd.token, tasks.yml, projects.yml, rants.jsonl), to ~/.emrg itself, and to absolute paths outside the workspace root (OS temp dir allowed — mirrors dsh's workspace + backend-promised temp area)
Enforcement is honestly reported: checked modes report partial (static heuristic scan — no bwrap/Seatbelt/ACL, per host's explicit no-heavy-dependency decision); danger-full-access reports full. Blocked commands return a ⛔ [sandbox:...] ... not executed ToolResult; successful sandboxed runs tag output with [sandbox:<mode> enforcement=partial] ok.
Wiring
  • TaskRequest.sandbox field (protocol) → daemon tool loop injects it into bash tool args (the agent cannot choose its own sandbox — config decides)
  • Scheduler resolves tier per task: explicit sandbox: field in tasks.yml wins; builtin defaults — emrg-task → workspace-write, *-opensource-task → read-only, custom tasks → full access; upgrade sessions run workspace-write
  • task_create / task_update accept and validate the sandbox field; hot-reload diff signature includes it
  • +23 tests (pytest 958 → 981, Agent.md count synced); full suite green (980 passed + 1 skipped), import + CLI OK
Acceptance (from the rant)
  1. ✅ Task-configurable sandbox (3 tiers, default full-access = compatible)
  2. ✅ read-only: obvious destructive writes blocked with explanation
  3. ✅ workspace-write: in-workspace writes fine, protected/outside-workspace blocked
  4. ✅ enforcement honestly reported (full/partial)
  5. ✅ evolution/opensource/upgrade tasks get the suggested default tiers
  6. ✅ unconfigured tasks = danger-full-access = current behavior
  7. ✅ full test suite passes (pytest + import + CLI)
EMRG Evolution
emrg: bash tool sandbox — file-level isolation for task sessions (ran…
98410de
…t 2026-08-20T15:46:50)
Per-task sandbox tier (read-only / workspace-write / danger-full-access,
default = danger-full-access = current behavior) injected into the bash
tool's static command scan:
- read-only: blocks destructive writes (rm -r / rmdir / mv / cp -r and
shell redirects to non-/dev/null targets)
- workspace-write: blocks writes to protected daemon files
(config.toml / emrgd.token / tasks.yml / projects.yml / rants.jsonl),
to ~/.emrg itself, and to absolute paths outside the workspace (OS temp
dir allowed, mirroring dsh's workspace + temp area)
- enforcement honestly reports partial (static heuristic, no OS-level
boundary — no bwrap/Seatbelt/ACL)
Wiring: TaskRequest.sandbox (protocol) → daemon tool loop injects it into
bash args → scheduler resolves tier per task (explicit tasks.yml sandbox
field wins; emrg-task → workspace-write, *-opensource-task → read-only,
custom tasks → full access). Upgrade sessions run workspace-write.
task_create/task_update accept and validate sandbox; hot-reload diffing
includes it. +23 tests (pytest 958 → 981, Agent.md synced).
@argszeroargszero
changed the title
emrg: add DeepSeek Harness to vs-the-competition comparison tableemrg: bash tool sandbox — file-level isolation for task sessionsAug 20, 2026
EMRG Evolution
emrg: sandbox — treat drive-less rooted paths as absolute (Windows CI…
4423069
… fix)
ntpath.isabs('/etc/hosts') returns False (rooted-relative, no drive), so
the workspace-write check treated out-of-workspace absolute targets as
in-workspace relative ones on Windows. _is_absolute_path now also
classifies '/...' and '\...' as absolute (review #886 test-windows ❌).
argszero
argszero
commented
Aug 20, 2026
View reviewed changes
@argszeroargszero
left a comment


Copy link


Copy Markdown

OwnerAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ LGTM — cycle (full suite 980 passed + 1 skipped locally; test + test-windows CI green after the Windows drive-less-root fix)
argszero
argszero
commented
Aug 20, 2026
View reviewed changes
@argszeroargszero
left a comment


Copy link


Copy Markdown

OwnerAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ LGTM — cycle 2 (independent re-review: sandbox tiers, static check, honest partial/full enforcement, task wiring all match the design; CI test + test-windows green)
argszero
argszero
commented
Aug 20, 2026
View reviewed changes
@argszeroargszero
left a comment


Copy link


Copy Markdown

OwnerAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ LGTM — cycle 3 (head unchanged since cycle 2, CLEAN/MERGEABLE, CI green) — merging
@argszero
argszero
merged commit 49a02f1
into
masterAug 20, 2026

2 checks passed

@argszeroargszero
mentioned this pull request
Aug 20, 2026
 Merged

argszero added a commit
that referenced
this pull request
Aug 20, 2026
@argszeroEMRG Evolution
emrg: bump version to v0.2.59 (release:#886#887#888#889#890) (#893)
1245362
Co-authored-by: EMRG Evolution <emrg@argszero.dev>
@argszero
argszero
deleted the

feature/bash-sandbox

branch
August 23, 2026 02:26
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@argszero

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
emrg: bash tool sandbox — file-level isolation for task sessions by argszero · Pull Request #886 · argszero/emrg · GitHub
Skip to content
emrg: bash tool sandbox — file-level isolation for task sessions - #886
Merged
argszero merged 2 commits into
masterfrom 
feature/bash-sandbox
Aug 20, 2026
Merged
emrg: bash tool sandbox — file-level isolation for task sessions#886
argszero merged 2 commits into
masterfrom 
feature/bash-sandbox
Conversation
@argszero
@argszeroargszero
commented
Aug 20, 2026•

edited

Loading

Copy link


Copy Markdown

Owner
Implement file-level isolation for the bash tool, per host design-finalized rant 2026-08-20T15:46:50 (learned from DeepSeek Harness's sandbox modes).
Design (EMRG-minimal, per host spec)
Three per-task sandbox tiers, default = danger-full-access (current behavior, zero breakage):
  • danger-full-access — no checks (unchanged)
  • read-only — blocks destructive writes: rm -r/-rf/-R, rmdir, mv, cp -r, and shell redirects (> / >> / 2> / &>) to any non-/dev/null target
  • workspace-write — blocks writes to protected daemon files (~/.emrg/config.toml, emrgd.token, tasks.yml, projects.yml, rants.jsonl), to ~/.emrg itself, and to absolute paths outside the workspace root (OS temp dir allowed — mirrors dsh's workspace + backend-promised temp area)
Enforcement is honestly reported: checked modes report partial (static heuristic scan — no bwrap/Seatbelt/ACL, per host's explicit no-heavy-dependency decision); danger-full-access reports full. Blocked commands return a ⛔ [sandbox:...] ... not executed ToolResult; successful sandboxed runs tag output with [sandbox:<mode> enforcement=partial] ok.
Wiring
  • TaskRequest.sandbox field (protocol) → daemon tool loop injects it into bash tool args (the agent cannot choose its own sandbox — config decides)
  • Scheduler resolves tier per task: explicit sandbox: field in tasks.yml wins; builtin defaults — emrg-task → workspace-write, *-opensource-task → read-only, custom tasks → full access; upgrade sessions run workspace-write
  • task_create / task_update accept and validate the sandbox field; hot-reload diff signature includes it
  • +23 tests (pytest 958 → 981, Agent.md count synced); full suite green (980 passed + 1 skipped), import + CLI OK
Acceptance (from the rant)
  1. ✅ Task-configurable sandbox (3 tiers, default full-access = compatible)
  2. ✅ read-only: obvious destructive writes blocked with explanation
  3. ✅ workspace-write: in-workspace writes fine, protected/outside-workspace blocked
  4. ✅ enforcement honestly reported (full/partial)
  5. ✅ evolution/opensource/upgrade tasks get the suggested default tiers
  6. ✅ unconfigured tasks = danger-full-access = current behavior
  7. ✅ full test suite passes (pytest + import + CLI)
EMRG Evolution
emrg: bash tool sandbox — file-level isolation for task sessions (ran…
98410de
…t 2026-08-20T15:46:50)
Per-task sandbox tier (read-only / workspace-write / danger-full-access,
default = danger-full-access = current behavior) injected into the bash
tool's static command scan:
- read-only: blocks destructive writes (rm -r / rmdir / mv / cp -r and
shell redirects to non-/dev/null targets)
- workspace-write: blocks writes to protected daemon files
(config.toml / emrgd.token / tasks.yml / projects.yml / rants.jsonl),
to ~/.emrg itself, and to absolute paths outside the workspace (OS temp
dir allowed, mirroring dsh's workspace + temp area)
- enforcement honestly reports partial (static heuristic, no OS-level
boundary — no bwrap/Seatbelt/ACL)
Wiring: TaskRequest.sandbox (protocol) → daemon tool loop injects it into
bash args → scheduler resolves tier per task (explicit tasks.yml sandbox
field wins; emrg-task → workspace-write, *-opensource-task → read-only,
custom tasks → full access). Upgrade sessions run workspace-write.
task_create/task_update accept and validate sandbox; hot-reload diffing
includes it. +23 tests (pytest 958 → 981, Agent.md synced).
@argszeroargszero
changed the title
emrg: add DeepSeek Harness to vs-the-competition comparison tableemrg: bash tool sandbox — file-level isolation for task sessionsAug 20, 2026
EMRG Evolution
emrg: sandbox — treat drive-less rooted paths as absolute (Windows CI…
4423069
… fix)
ntpath.isabs('/etc/hosts') returns False (rooted-relative, no drive), so
the workspace-write check treated out-of-workspace absolute targets as
in-workspace relative ones on Windows. _is_absolute_path now also
classifies '/...' and '\...' as absolute (review #886 test-windows ❌).
argszero
argszero
commented
Aug 20, 2026
View reviewed changes
@argszeroargszero
left a comment


Copy link


Copy Markdown

OwnerAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ LGTM — cycle (full suite 980 passed + 1 skipped locally; test + test-windows CI green after the Windows drive-less-root fix)
argszero
argszero
commented
Aug 20, 2026
View reviewed changes
@argszeroargszero
left a comment


Copy link


Copy Markdown

OwnerAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ LGTM — cycle 2 (independent re-review: sandbox tiers, static check, honest partial/full enforcement, task wiring all match the design; CI test + test-windows green)
argszero
argszero
commented
Aug 20, 2026
View reviewed changes
@argszeroargszero
left a comment


Copy link


Copy Markdown

OwnerAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ LGTM — cycle 3 (head unchanged since cycle 2, CLEAN/MERGEABLE, CI green) — merging
@argszero
argszero
merged commit 49a02f1
into
masterAug 20, 2026

2 checks passed

@argszeroargszero
mentioned this pull request
Aug 20, 2026
 Merged

argszero added a commit
that referenced
this pull request
Aug 20, 2026
@argszeroEMRG Evolution
emrg: bump version to v0.2.59 (release:#886#887#888#889#890) (#893)
1245362
Co-authored-by: EMRG Evolution <emrg@argszero.dev>
@argszero
argszero
deleted the

feature/bash-sandbox

branch
August 23, 2026 02:26
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@argszero

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
emrg: bash tool sandbox — file-level isolation for task sessions by argszero · Pull Request #886 · argszero/emrg · GitHub
Skip to content
emrg: bash tool sandbox — file-level isolation for task sessions - #886
Merged
argszero merged 2 commits into
masterfrom 
feature/bash-sandbox
Aug 20, 2026
Merged
emrg: bash tool sandbox — file-level isolation for task sessions#886
argszero merged 2 commits into
masterfrom 
feature/bash-sandbox
Conversation
@argszero
@argszeroargszero
commented
Aug 20, 2026•

edited

Loading

Copy link


Copy Markdown

Owner
Implement file-level isolation for the bash tool, per host design-finalized rant 2026-08-20T15:46:50 (learned from DeepSeek Harness's sandbox modes).
Design (EMRG-minimal, per host spec)
Three per-task sandbox tiers, default = danger-full-access (current behavior, zero breakage):
  • danger-full-access — no checks (unchanged)
  • read-only — blocks destructive writes: rm -r/-rf/-R, rmdir, mv, cp -r, and shell redirects (> / >> / 2> / &>) to any non-/dev/null target
  • workspace-write — blocks writes to protected daemon files (~/.emrg/config.toml, emrgd.token, tasks.yml, projects.yml, rants.jsonl), to ~/.emrg itself, and to absolute paths outside the workspace root (OS temp dir allowed — mirrors dsh's workspace + backend-promised temp area)
Enforcement is honestly reported: checked modes report partial (static heuristic scan — no bwrap/Seatbelt/ACL, per host's explicit no-heavy-dependency decision); danger-full-access reports full. Blocked commands return a ⛔ [sandbox:...] ... not executed ToolResult; successful sandboxed runs tag output with [sandbox:<mode> enforcement=partial] ok.
Wiring
  • TaskRequest.sandbox field (protocol) → daemon tool loop injects it into bash tool args (the agent cannot choose its own sandbox — config decides)
  • Scheduler resolves tier per task: explicit sandbox: field in tasks.yml wins; builtin defaults — emrg-task → workspace-write, *-opensource-task → read-only, custom tasks → full access; upgrade sessions run workspace-write
  • task_create / task_update accept and validate the sandbox field; hot-reload diff signature includes it
  • +23 tests (pytest 958 → 981, Agent.md count synced); full suite green (980 passed + 1 skipped), import + CLI OK
Acceptance (from the rant)
  1. ✅ Task-configurable sandbox (3 tiers, default full-access = compatible)
  2. ✅ read-only: obvious destructive writes blocked with explanation
  3. ✅ workspace-write: in-workspace writes fine, protected/outside-workspace blocked
  4. ✅ enforcement honestly reported (full/partial)
  5. ✅ evolution/opensource/upgrade tasks get the suggested default tiers
  6. ✅ unconfigured tasks = danger-full-access = current behavior
  7. ✅ full test suite passes (pytest + import + CLI)
EMRG Evolution
emrg: bash tool sandbox — file-level isolation for task sessions (ran…
98410de
…t 2026-08-20T15:46:50)
Per-task sandbox tier (read-only / workspace-write / danger-full-access,
default = danger-full-access = current behavior) injected into the bash
tool's static command scan:
- read-only: blocks destructive writes (rm -r / rmdir / mv / cp -r and
shell redirects to non-/dev/null targets)
- workspace-write: blocks writes to protected daemon files
(config.toml / emrgd.token / tasks.yml / projects.yml / rants.jsonl),
to ~/.emrg itself, and to absolute paths outside the workspace (OS temp
dir allowed, mirroring dsh's workspace + temp area)
- enforcement honestly reports partial (static heuristic, no OS-level
boundary — no bwrap/Seatbelt/ACL)
Wiring: TaskRequest.sandbox (protocol) → daemon tool loop injects it into
bash args → scheduler resolves tier per task (explicit tasks.yml sandbox
field wins; emrg-task → workspace-write, *-opensource-task → read-only,
custom tasks → full access). Upgrade sessions run workspace-write.
task_create/task_update accept and validate sandbox; hot-reload diffing
includes it. +23 tests (pytest 958 → 981, Agent.md synced).
@argszeroargszero
changed the title
emrg: add DeepSeek Harness to vs-the-competition comparison tableemrg: bash tool sandbox — file-level isolation for task sessionsAug 20, 2026
EMRG Evolution
emrg: sandbox — treat drive-less rooted paths as absolute (Windows CI…
4423069
… fix)
ntpath.isabs('/etc/hosts') returns False (rooted-relative, no drive), so
the workspace-write check treated out-of-workspace absolute targets as
in-workspace relative ones on Windows. _is_absolute_path now also
classifies '/...' and '\...' as absolute (review #886 test-windows ❌).
argszero
argszero
commented
Aug 20, 2026
View reviewed changes
@argszeroargszero
left a comment


Copy link


Copy Markdown

OwnerAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ LGTM — cycle (full suite 980 passed + 1 skipped locally; test + test-windows CI green after the Windows drive-less-root fix)
argszero
argszero
commented
Aug 20, 2026
View reviewed changes
@argszeroargszero
left a comment


Copy link


Copy Markdown

OwnerAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ LGTM — cycle 2 (independent re-review: sandbox tiers, static check, honest partial/full enforcement, task wiring all match the design; CI test + test-windows green)
argszero
argszero
commented
Aug 20, 2026
View reviewed changes
@argszeroargszero
left a comment


Copy link


Copy Markdown

OwnerAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ LGTM — cycle 3 (head unchanged since cycle 2, CLEAN/MERGEABLE, CI green) — merging
@argszero
argszero
merged commit 49a02f1
into
masterAug 20, 2026

2 checks passed

@argszeroargszero
mentioned this pull request
Aug 20, 2026
 Merged

argszero added a commit
that referenced
this pull request
Aug 20, 2026
@argszeroEMRG Evolution
emrg: bump version to v0.2.59 (release:#886#887#888#889#890) (#893)
1245362
Co-authored-by: EMRG Evolution <emrg@argszero.dev>
@argszero
argszero
deleted the

feature/bash-sandbox

branch
August 23, 2026 02:26
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@argszero

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();
emrg: bash tool sandbox — file-level isolation for task sessions by argszero · Pull Request #886 · argszero/emrg · GitHub
Skip to content
emrg: bash tool sandbox — file-level isolation for task sessions - #886
Merged
argszero merged 2 commits into
masterfrom 
feature/bash-sandbox
Aug 20, 2026
Merged
emrg: bash tool sandbox — file-level isolation for task sessions#886
argszero merged 2 commits into
masterfrom 
feature/bash-sandbox
Conversation
@argszero
@argszeroargszero
commented
Aug 20, 2026•

edited

Loading

Copy link


Copy Markdown

Owner
Implement file-level isolation for the bash tool, per host design-finalized rant 2026-08-20T15:46:50 (learned from DeepSeek Harness's sandbox modes).
Design (EMRG-minimal, per host spec)
Three per-task sandbox tiers, default = danger-full-access (current behavior, zero breakage):
  • danger-full-access — no checks (unchanged)
  • read-only — blocks destructive writes: rm -r/-rf/-R, rmdir, mv, cp -r, and shell redirects (> / >> / 2> / &>) to any non-/dev/null target
  • workspace-write — blocks writes to protected daemon files (~/.emrg/config.toml, emrgd.token, tasks.yml, projects.yml, rants.jsonl), to ~/.emrg itself, and to absolute paths outside the workspace root (OS temp dir allowed — mirrors dsh's workspace + backend-promised temp area)
Enforcement is honestly reported: checked modes report partial (static heuristic scan — no bwrap/Seatbelt/ACL, per host's explicit no-heavy-dependency decision); danger-full-access reports full. Blocked commands return a ⛔ [sandbox:...] ... not executed ToolResult; successful sandboxed runs tag output with [sandbox:<mode> enforcement=partial] ok.
Wiring
  • TaskRequest.sandbox field (protocol) → daemon tool loop injects it into bash tool args (the agent cannot choose its own sandbox — config decides)
  • Scheduler resolves tier per task: explicit sandbox: field in tasks.yml wins; builtin defaults — emrg-task → workspace-write, *-opensource-task → read-only, custom tasks → full access; upgrade sessions run workspace-write
  • task_create / task_update accept and validate the sandbox field; hot-reload diff signature includes it
  • +23 tests (pytest 958 → 981, Agent.md count synced); full suite green (980 passed + 1 skipped), import + CLI OK
Acceptance (from the rant)
  1. ✅ Task-configurable sandbox (3 tiers, default full-access = compatible)
  2. ✅ read-only: obvious destructive writes blocked with explanation
  3. ✅ workspace-write: in-workspace writes fine, protected/outside-workspace blocked
  4. ✅ enforcement honestly reported (full/partial)
  5. ✅ evolution/opensource/upgrade tasks get the suggested default tiers
  6. ✅ unconfigured tasks = danger-full-access = current behavior
  7. ✅ full test suite passes (pytest + import + CLI)
EMRG Evolution
emrg: bash tool sandbox — file-level isolation for task sessions (ran…
98410de
…t 2026-08-20T15:46:50)
Per-task sandbox tier (read-only / workspace-write / danger-full-access,
default = danger-full-access = current behavior) injected into the bash
tool's static command scan:
- read-only: blocks destructive writes (rm -r / rmdir / mv / cp -r and
shell redirects to non-/dev/null targets)
- workspace-write: blocks writes to protected daemon files
(config.toml / emrgd.token / tasks.yml / projects.yml / rants.jsonl),
to ~/.emrg itself, and to absolute paths outside the workspace (OS temp
dir allowed, mirroring dsh's workspace + temp area)
- enforcement honestly reports partial (static heuristic, no OS-level
boundary — no bwrap/Seatbelt/ACL)
Wiring: TaskRequest.sandbox (protocol) → daemon tool loop injects it into
bash args → scheduler resolves tier per task (explicit tasks.yml sandbox
field wins; emrg-task → workspace-write, *-opensource-task → read-only,
custom tasks → full access). Upgrade sessions run workspace-write.
task_create/task_update accept and validate sandbox; hot-reload diffing
includes it. +23 tests (pytest 958 → 981, Agent.md synced).
@argszeroargszero
changed the title
emrg: add DeepSeek Harness to vs-the-competition comparison tableemrg: bash tool sandbox — file-level isolation for task sessionsAug 20, 2026
EMRG Evolution
emrg: sandbox — treat drive-less rooted paths as absolute (Windows CI…
4423069
… fix)
ntpath.isabs('/etc/hosts') returns False (rooted-relative, no drive), so
the workspace-write check treated out-of-workspace absolute targets as
in-workspace relative ones on Windows. _is_absolute_path now also
classifies '/...' and '\...' as absolute (review #886 test-windows ❌).
argszero
argszero
commented
Aug 20, 2026
View reviewed changes
@argszeroargszero
left a comment


Copy link


Copy Markdown

OwnerAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ LGTM — cycle (full suite 980 passed + 1 skipped locally; test + test-windows CI green after the Windows drive-less-root fix)
argszero
argszero
commented
Aug 20, 2026
View reviewed changes
@argszeroargszero
left a comment


Copy link


Copy Markdown

OwnerAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ LGTM — cycle 2 (independent re-review: sandbox tiers, static check, honest partial/full enforcement, task wiring all match the design; CI test + test-windows green)
argszero
argszero
commented
Aug 20, 2026
View reviewed changes
@argszeroargszero
left a comment


Copy link


Copy Markdown

OwnerAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ LGTM — cycle 3 (head unchanged since cycle 2, CLEAN/MERGEABLE, CI green) — merging
@argszero
argszero
merged commit 49a02f1
into
masterAug 20, 2026

2 checks passed

@argszeroargszero
mentioned this pull request
Aug 20, 2026
 Merged

argszero added a commit
that referenced
this pull request
Aug 20, 2026
@argszeroEMRG Evolution
emrg: bump version to v0.2.59 (release:#886#887#888#889#890) (#893)
1245362
Co-authored-by: EMRG Evolution <emrg@argszero.dev>
@argszero
argszero
deleted the

feature/bash-sandbox

branch
August 23, 2026 02:26
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@argszero