Q117: commands run in an allowlisted environment, and records and approvals say host isolation is advisory

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/unit/domain-services.test.ts

@@ -24,7 +24,7 @@ describe("domain services", () => {
     const connection = createConnection();
 
     const rows = connection.db.prepare("select version from schema_migrations order by version asc").all() as Array<{ version: number }>;
-    expect(rows.map((row) => row.version)).toEqual([1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87]);
+    expect(rows.map((row) => row.version)).toEqual([1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88]);
     connection.close();
   });
 

tests/unit/execution-modes.test.ts

@@ -11,7 +11,7 @@ import { ApprovalService } from "../../src/main/services/approval-service";
 import { runJournalLines } from "../../src/main/services/run-journal";
 import { DocumentService } from "../../src/main/services/document-service";
 import { approvalDrifts } from "../../src/main/services/approval-drift";
-import { executionApprovalProblem, requireAssignedAgent } from "../../src/main/services/task-run-preparation";
+import { createIsolationContext, executionApprovalProblem, loadWorkspace, requireAssignedAgent } from "../../src/main/services/task-run-preparation";
 import { TASK_PRIORITY } from "../../src/shared/domain";
 import type { TaskExecutionTaskRow } from "../../src/main/services/task-prompts";
 
@@ -202,6 +202,22 @@ describe("execution modes", () => {
     }
   });
 
+  test("file access is approved with its true reach, and the run's records call host isolation advisory", () => {
+    const h = harness("ai_cofounder");
+    const db = h.connection.db;
+    const taskId = h.connection.transaction(() => h.deps.organization.createTask({
+      orgId: h.orgId, title: "Fix the build", description: "Make CI green.", status: "backlog", assigneeAgentId: h.ceoId, risk: "low",
+      projectId: null, goalId: null, workspaceId: h.ctx.workspace!.id, priority: TASK_PRIORITY.NORMAL, requiresFilesystem: true,
+    }));
+    const approval = db.prepare("select details from approvals where source_entity_id = ?").get(taskId) as { details: string };
+    expect(approval.details).toBe("Make CI green.\n\nApproving lets this task run commands on this computer with your user's file access: they can read and change files outside the workspace. Only their environment is cleaned of keys and your profile.");
+    const task = db.prepare("select * from tasks where id = ?").get(taskId) as unknown as Parameters<typeof createIsolationContext>[2];
+    const agent = db.prepare("select * from agents where id = ?").get(h.ceoId) as unknown as Parameters<typeof createIsolationContext>[3];
+    const provider = db.prepare("select * from providers where id = (select model_provider_id from agents where id = ?)").get(h.ceoId) as unknown as Parameters<typeof createIsolationContext>[4];
+    const isolation = createIsolationContext(db, h.orgId, task, agent, provider, loadWorkspace(db, h.ctx.workspace!.id));
+    expect(JSON.parse(isolation.workspaceMountJson)[0]).toMatchObject({ mode: "read_write", hostEnforcement: "advisory", commandEnvironment: "allowlisted" });
+  });
+
   test("AI CEO mode ships deliverables without review", () => {
     const h = harness("ai_ceo");
     const wrote = dispatchAgentTool(h.deps, h.ctx, call("write_deliverable", { path: "plan/business-plan.md", content: "# Plan" }));

tests/unit/host-access-note-migration.test.ts

@@ -0,0 +1,26 @@
+import { randomUUID } from "node:crypto";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+import { describe, expect, test } from "vitest";
+import { hostAccessNoteSchema } from "../../src/main/database/migrations/088-host-access-note";
+import { HOST_ACCESS_NOTE } from "../../src/main/services/task-approval";
+
+describe("host access note migration", () => {
+  test("pending file-access approvals from before the warning get it; others stay as they were", () => {
+    const db = new DatabaseSync(join(tmpdir(), `agentcompany-host-note-${randomUUID()}.db`));
+    db.exec(`
+      create table schema_migrations(version integer primary key, name text not null, applied_at text not null);
+      create table tasks(id text primary key, requires_filesystem integer not null);
+      create table approvals(id text primary key, kind text not null, state text not null, details text not null, source_entity_type text, source_entity_id text);
+      insert into tasks values ('tsk_fs', 1), ('tsk_plain', 0);
+      insert into approvals values
+        ('app_pending', 'task_execution', 'pending', 'Make CI green.', 'task', 'tsk_fs'),
+        ('app_decided', 'task_execution', 'approved', 'Old.', 'task', 'tsk_fs'),
+        ('app_plain', 'task_risk', 'pending', 'Risky.', 'task', 'tsk_plain');
+    `);
+    db.exec(hostAccessNoteSchema);
+    const details = Object.fromEntries((db.prepare("select id, details from approvals").all() as Array<{ id: string; details: string }>).map((row) => [row.id, row.details]));
+    expect(details).toEqual({ app_pending: `Make CI green.\n\n${HOST_ACCESS_NOTE}`, app_decided: "Old.", app_plain: "Risky." });
+  });
+});

tests/unit/workspace-command.test.ts

@@ -1,5 +1,5 @@
 import { mkdtempSync, readFileSync } from "node:fs";
-import { tmpdir } from "node:os";
+import { homedir, tmpdir } from "node:os";
 import { join } from "node:path";
 import { describe, expect, test, vi } from "vitest";
 import { BoundedOutput, formatCommandResult, runCommand } from "../../src/main/services/workspace-command";
@@ -75,3 +75,20 @@ describe("command results", () => {
     expect(formatCommandResult(null, null, "")).toBe("ERROR: the command ended without an exit code; treat it as failed.\n(no output)");
   });
 });
+
+describe("the environment a command runs in", () => {
+  test("a command sees no inherited secrets and a home of its own, while PATH still finds tools", async () => {
+    const root = mkdtempSync(join(tmpdir(), "ac-env-"));
+    process.env.AGENTCOMPANY_TEST_SECRET = "sk-should-not-leak";
+    try {
+      const output = await runCommand(root, "node -e \"console.log(process.env.AGENTCOMPANY_TEST_SECRET ?? 'none'); console.log(require('os').homedir())\"");
+      const [code, secret, home] = output.split(/\r?\n/);
+      expect(code).toBe("exit code 0");
+      expect(secret).toBe("none");
+      expect(home).not.toBe(homedir());
+      expect(home).toContain("agentcompany-home-");
+    } finally {
+      delete process.env.AGENTCOMPANY_TEST_SECRET;
+    }
+  });
+});