Skip to content

fix(agent_launch): bwrap-sandbox the headless coding-agent subprocess (#420's sandboxing never reaches autonomous dispatch) #445

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
getappz merged 4 commits into from
Aug 11, 2026
Merged

fix(agent_launch): bwrap-sandbox the headless coding-agent subprocess (#420's sandboxing never reaches autonomous dispatch) #445

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
efe8652
fix(agent_launch): bwrap-sandbox the headless coding-agent subprocess
Aug 10, 2026
1c6d647
Merge branch 'master' into task/67
getappz Aug 11, 2026
588beb9
Merge branch 'master' into task/67
getappz Aug 11, 2026
096b438
Merge branch 'master' into task/67
getappz Aug 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion crates/agentflare-jobs/src/lib.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
pub mod executor;
pub mod queue;
mod sandbox;
pub mod sandbox;
pub mod supervisor;
pub mod types;
pub mod worker;
Expand Down
13 changes: 11 additions & 2 deletions src/agent_launch.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -383,8 +383,17 @@ pub fn run_headless(
spec.display_name
));
};
let mut cmd = Command::new(&argv[0]);
cmd.args(&argv[1..]);
// Native Linux and WSL2 run the agent CLI inside a bwrap sandbox, same as
// `Supervisor::spawn`; Windows and macOS get argv back unchanged (see
// `agentflare_jobs::sandbox`). Uses the ambient cwd since neither this
// function nor `run_captured` below ever calls `Command::current_dir` —
// the child inherits whatever directory the caller already chdir'd into
// (e.g. `execute_work`'s worktree chdir for autonomous dispatch).
let cwd = std::env::current_dir().ok();
let (sandboxed_command, sandboxed_args) =
agentflare_jobs::sandbox::wrap(&argv[0], &argv[1..], cwd.as_deref());
let mut cmd = Command::new(&sandboxed_command);
cmd.args(&sandboxed_args);
Comment on lines +386 to +396

@coderabbitai coderabbitai Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

Fail closed when sandbox wrapping fails.

In crates/agentflare-jobs/src/sandbox/mod.rs, Lines 17-19, agentflare_jobs::sandbox::wrap returns the original command and arguments when wrapping fails. Lines 393-396 then spawn that tuple without reporting the fallback. A native Linux or WSL2 headless launch can run without sandbox isolation, despite the guarantee in Lines 386-388.

Use a strict wrapper result for this path. Return HeadlessOutcome::Failed when sandbox setup fails. Keep the current fallback only for platforms or call sites that explicitly allow unsandboxed execution.

Proposed direction 
-    let (sandboxed_command, sandboxed_args) =
-        agentflare_jobs::sandbox::wrap(&argv[0], &argv[1..], cwd.as_deref());
+    let Some((sandboxed_command, sandboxed_args)) =
+        agentflare_jobs::sandbox::try_wrap(&argv[0], &argv[1..], cwd.as_deref())
+    else {
+        return HeadlessOutcome::Failed(format!(
+            "{} could not be sandboxed",
+            spec.display_name
+        ));
+    };
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/agent_launch.rs` around lines 386 - 396, Update the headless launch flow
around agentflare_jobs::sandbox::wrap and Command::new so sandbox setup failures
on native Linux or WSL2 are detected and return HeadlessOutcome::Failed instead
of spawning the unsandboxed fallback tuple. Preserve unchanged-argv behavior for
platforms and call sites that explicitly permit unsandboxed execution, and use a
strict wrapper result for this launch path.

// See the matching strip in `run_launch_env` above (item #139) — same
// rationale applies to headless child processes.
cmd.env_remove("CARGO_TARGET_DIR");
Expand Down
Loading