openmoat 0.8.0

Policy checks for AI coding agents: decides allow, defer, ask or deny for every tool call from Claude Code, Codex and Cursor, configures Claude Code's and Codex's own OS sandboxes from the same policy, and keeps a local audit log.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142

//! `hook_only` deny groups (ADR-034) reach no generated sandbox: the default
//! `build-credentials` files stay readable for `mvn` and `gradle` there.

use openmoat_core::{DEFAULT_POLICY, EvalContext, Policy, SandboxSettings};

use super::{Enforcement, Grants, claude, codex, cursor, landlock, lower_for_hosts, seatbelt};

const FILES: [&str; 3] = [
    ".m2/settings.xml",
    ".m2/settings-security.xml",
    ".gradle/gradle.properties",
];

/// The default policy, and the same with the build tools' homes as read roots,
/// which is how a person lets sandboxed builds read them.
fn policies(home: &str) -> [Policy; 2] {
    let default = Policy::parse(DEFAULT_POLICY).expect("default policy");
    let mut roots = default.clone();
    let sandbox = roots.sandbox.get_or_insert_with(SandboxSettings::default);
    for dir in [".m2", ".gradle"] {
        sandbox.read_roots.push(format!("{home}/{dir}"));
    }
    [default, roots]
}

fn session(policy: &Policy, home: &str) -> Enforcement {
    let project = format!("{home}/proj");
    let ctx = EvalContext {
        home: home.to_owned(),
        project: Some(project.clone()),
        real_home: None,
        real_project: None,
        moved_dirs: Vec::new(),
        cwd: project,
        case_insensitive_paths: false,
    };
    openmoat_core::ir::lower(policy, &ctx).expect("lowers")
}

fn grants() -> Grants {
    Grants {
        proxy_port: Some(18080),
        tmpdir: Some("/private/var/folders/xy/T".into()),
        program: Some("/usr/bin/agent".into()),
        writes: Vec::new(),
    }
}

/// Every host's and tier's output for `policy`, as text.
fn outputs(policy: &Policy) -> Vec<(&'static str, String)> {
    let home = "/Users/me";
    let hosts = lower_for_hosts(policy, home, None, Vec::new(), false).expect("lowers");
    let ir = session(policy, home);
    vec![
        (
            "claude",
            format!("{:?}", claude::generate(&hosts, None, false).unwrap()),
        ),
        (
            "claude linux",
            format!("{:?}", claude::generate(&hosts, None, true).unwrap()),
        ),
        (
            "codex",
            format!(
                "{:?}",
                codex::generate(&hosts, &[home.into()], None).unwrap()
            ),
        ),
        (
            "cursor",
            format!("{:?}", cursor::generate(&hosts, None).unwrap()),
        ),
        (
            "seatbelt",
            format!("{:?}", seatbelt::generate(&ir, &grants())),
        ),
        (
            "landlock",
            format!("{:?}", landlock::generate(&ir, &grants()).unwrap()),
        ),
    ]
}

#[test]
fn build_credentials_are_in_no_generated_sandbox() {
    for (i, policy) in policies("/Users/me").iter().enumerate() {
        for (backend, text) in outputs(policy) {
            for file in FILES {
                assert!(
                    !text.contains(file),
                    "{backend} names {file} (policy {i}): {text}"
                );
            }
            // The outputs do carry `secrets-paths`, so the check above can fail.
            assert!(text.contains(".cargo/credentials"), "{backend}: {text}");
        }
    }
    // With the read roots, the sandboxes let builds read the homes themselves.
    let [_, roots] = policies("/Users/me");
    for (backend, text) in outputs(&roots) {
        assert!(text.contains("/Users/me/.m2"), "{backend}: {text}");
    }
}

#[cfg(unix)]
#[test]
fn bubblewrap_leaves_existing_build_credentials_readable() {
    use super::bwrap::{self, Mount};
    let dir = tempfile::tempdir().unwrap();
    let home = std::fs::canonicalize(dir.path()).unwrap();
    for rel in ["proj/src", ".m2/repository", ".gradle/caches", ".cargo"] {
        std::fs::create_dir_all(home.join(rel)).unwrap();
    }
    for rel in FILES.iter().chain(&[".cargo/credentials.toml"]) {
        std::fs::write(home.join(rel), "x").unwrap();
    }
    let home = home.to_string_lossy().into_owned();
    let [_, mut policy] = policies(&home);
    policy.sandbox = Some(SandboxSettings {
        read_roots: [".m2", ".gradle", ".cargo"]
            .map(|d| format!("{home}/{d}"))
            .to_vec(),
        ..SandboxSettings::default()
    });
    let project = format!("{home}/proj");
    let out = bwrap::generate(&session(&policy, &home), &grants(), &[project]).unwrap();
    let text = format!("{out:?}");
    for file in FILES {
        assert!(!text.contains(file), "bwrap names {file}: {text}");
    }
    let cargo = Mount::Hide {
        path: format!("{home}/.cargo/credentials.toml"),
        dir: false,
    };
    assert!(out.mounts.contains(&cargo), "{:#?}", out.mounts);
    assert!(
        out.mounts.contains(&Mount::ReadOnly(format!("{home}/.m2"))),
        "{:#?}",
        out.mounts
    );
}