Keep forwarded toolchain homes accessible inside the jail

Forwarding RUSTUP_HOME and CARGO_HOME exposes host paths such as ~/.rustup and ~/.cargo to local jailed commands, but the jail only grants the workspace and explicitly configured mounts. A command using the inherited rustup/cargo toolchain can therefore fail with permission errors or be unable to locate its toolchain. Either add narrowly scoped mounts for these directories with the required access mode, or configure toolchain homes inside an accessible sandbox directory instead of forwarding the host values.

Additional e2e observation

Cover toolchain-home passthrough with an end-to-end shell run

[RULE] e2e-uncovered

The behavioural change makes sandboxed shell commands inherit RUSTUP_HOME and CARGO_HOME on the host. The only test exercising it is crates/openhuman-core/src/sandbox/ops_tests.rs, a colocated Rust test that needs cargo installed on the runner and silently skips otherwise ("SKIP cargo: not installed on this host"), and the docs add only a manual RELEASE-MANUAL-SMOKE step. No Playwright spec or Rust E2E job drives a shell command through the agent sandbox and asserts the toolchain environment, so the candidate e2e hit (tests/agent_harness_e2e.rs mentioning tools_agent) is lexical only. An end-to-end test would have to run a shell command via the running agent (e.g. extend app/test/e2e/specs/tool-shell-git-flow.spec.ts or the Rust mock-backend E2E) with RUSTUP_HOME/CARGO_HOME set in the harness environment and assert the command observes them, so that a regression in either spawn path fails CI instead of shipping.

[RULE] sandbox-path-access ·

The native jail resolves default toolchain grants in sandbox/grants.rs before building its command. These include the Rust home and Cargo executable/configuration paths as read-only, Cargo registry/git paths with their existing write access, and read-only /usr/local and /opt roots. The pinned CI homes /usr/local/rustup and /usr/local/cargo fall within that existing system-root grant.

ShellTool::run_sandboxed passes RuntimeConfig::default() to grant resolution. The added sandboxed_shell_forwards_host_toolchain_homes_and_confines_writes E2E captures the installed homes before activating its private HOME, then maps its HOME toolchain entries to the captured Rust home and Cargo executable directory. It exercises this existing default policy and credential floor.

The test drives web-chat RPC through the running sandboxed orchestrator and real shell tool, asserts the observed host homes, Cargo startup, scratch files, workspace writes and outside-write denial, and checks delivery of the shell result to the subsequent model request. Pinned Linux run 37562063126 passed for the exact source in 3ecf0d656d9cf7d74c8260a070c5c30924766630: 1 actual agent-shell E2E, all 70 sandbox tests, whole-workspace and Tauri Rust formatting, core-library Clippy with product features and warnings denied, and fresh changed-line coverage at 100% over 8 measured executable lines. The tested patch and all five source hashes match the candidate.

Resolved — the reply explains why it is not a problem (advisory), as of 3ecf0d6.

_{If this is wrong, reopen the conversation and say so; the finding will be re-raised on the next push if it still reproduces.}

Resolved — the reply explains why it is not a problem (advisory), as of 2285292.

_{If this is wrong, reopen the conversation and say so; the finding will be re-raised on the next push if it still reproduces.}

Resolved — the reply explains why it is not a problem (advisory), as of 493ffcb.

_{If this is wrong, reopen the conversation and say so; the finding will be re-raised on the next push if it still reproduces.}

Resolved — the reply explains why it is not a problem (advisory), as of d76c232.

_{If this is wrong, reopen the conversation and say so; the finding will be re-raised on the next push if it still reproduces.}

Grant or isolate the forwarded toolchain homes

execute_local_jail now sets RUSTUP_HOME and CARGO_HOME to the host values, commonly paths such as ~/.rustup and ~/.cargo, but the jail only grants the workspace and explicitly configured mounts. A local Landlock command therefore receives paths it cannot read or write; rustup shims and cargo operations can fail with permission errors or be unable to locate the installed toolchain. Either add narrowly scoped mounts for these directories with an appropriate access mode, or avoid forwarding them and configure toolchain homes inside an accessible sandbox directory.

[RULE] sandbox-path-access ·

The native-jail grant resolver already includes the default Rust/Cargo toolchain paths and read-only system roots /usr/local and /opt. The pinned CI homes are covered by /usr/local; this change retains those grants while forwarding the host's selected homes. The new agent-shell E2E exercises default grant resolution through its private HOME toolchain entries, including Cargo startup and write confinement. Pinned Linux run 37562063126 passed for the exact source in 3ecf0d656d9cf7d74c8260a070c5c30924766630: 1 actual agent-shell E2E, all 70 sandbox tests, whole-workspace and Tauri Rust formatting, core-library Clippy with product features and warnings denied, and fresh changed-line coverage at 100% over 8 measured executable lines. The tested patch and all five source hashes match the candidate.

Resolved — the reply explains why it is not a problem (advisory), as of 3ecf0d6.

_{If this is wrong, reopen the conversation and say so; the finding will be re-raised on the next push if it still reproduces.}

Resolved — the reply explains why it is not a problem (advisory), as of 2285292.

_{If this is wrong, reopen the conversation and say so; the finding will be re-raised on the next push if it still reproduces.}

Resolved — the reply explains why it is not a problem (advisory), as of 493ffcb.

_{If this is wrong, reopen the conversation and say so; the finding will be re-raised on the next push if it still reproduces.}

Resolved — the review agent found this finding fixed in the new code, as of d76c232.

_{If this is wrong, reopen the conversation and say so; the finding will be re-raised on the next push if it still reproduces.}

Skip or provision missing host toolchain homes

On a Linux runner with Cargo installed system-wide, or with rustup configured outside the conventional home directories, these assertions panic before the orchestrator is started. The test therefore makes the Linux test suite depend on RUSTUP_HOME and CARGO_HOME both existing as directories, even though those paths are not required by Cargo's installation contract. Detect the actual toolchain layout and skip when the required host homes are unavailable, or provision isolated homes for the test instead of failing the suite during setup.

[RULE] environment-assumption ·

On local machines without initialized Rustup/Cargo homes, the portable test reports SKIP with a reason. In CI (GITHUB_ACTIONS=true), the required toolchain prerequisites are enforced and missing components fail explicitly. Once the selected toolchain is initialized, execution faults remain hard failures. This keeps local test discovery portable while preserving strict CI coverage for the real shell path. 1 real agent-shell E2E and 77 sandbox regressions passed, with 0 failures and 0 ignored; https://github.com/SayrWolfridge/openhuman/actions/runs/37570238760.

Resolved — the review agent found this finding fixed in the new code, as of 2285292.

_{If this is wrong, reopen the conversation and say so; the finding will be re-raised on the next push if it still reproduces.}

Resolved — the review agent found this finding fixed in the new code, as of 493ffcb.

_{If this is wrong, reopen the conversation and say so; the finding will be re-raised on the next push if it still reproduces.}

Resolved — the review agent found this finding fixed in the new code, as of d76c232.

_{If this is wrong, reopen the conversation and say so; the finding will be re-raised on the next push if it still reproduces.}

Define or import the agent stack test runner

run_on_agent_stack is not defined in tests/agent_harness_e2e.rs or elsewhere in the repository search results, so this new test target will fail to compile on Linux. Replace the call with an existing runner or add/import the helper before merging.

[RULE] undefined-symbol ·

run_on_agent_stack is defined in the published test file at line 765. It creates the existing large-stack thread and Tokio runtime used throughout this harness.

The exact published source compiled on the pinned Linux runner, and sandboxed_shell_forwards_host_toolchain_homes_and_confines_writes completed with 1 passed, 0 failed and 0 ignored. Compilation and E2E result.

Resolved — the reply explains why it is not a problem (advisory), as of 2285292.

_{If this is wrong, reopen the conversation and say so; the finding will be re-raised on the next push if it still reproduces.}

Resolved — the reply explains why it is not a problem (advisory), as of 493ffcb.

_{If this is wrong, reopen the conversation and say so; the finding will be re-raised on the next push if it still reproduces.}

Resolved — the reply explains why it is not a problem (advisory), as of d76c232.

_{If this is wrong, reopen the conversation and say so; the finding will be re-raised on the next push if it still reproduces.}

Keep forwarded toolchain homes accessible inside the jail

This test only links the temporary HOME entries to the real host Rust directories; it does not change the sandbox implementation that must make those locations available. The underlying forwarded RUSTUP_HOME and CARGO_HOME handling therefore remains unresolved, and the production shell path can still fail when Cargo/rustup is invoked inside the jail. Update the sandbox's explicit grants or forwarding mechanism rather than relying on this fixture's symlinks.

[RULE] sandbox-path-isolation ·

The shell test now stages toolchain inputs at isolated absolute paths outside HOME and the standard system roots, then exercises the real jail against those paths. It captures the active Rustup selection and Cargo version and verifies the shell uses the same toolchain; the fixture has a hardlink/copy fallback for portable staging. This directly exercises the configured-path grant policy. 1 real agent-shell E2E and 77 sandbox regressions passed, with 0 failures and 0 ignored; https://github.com/SayrWolfridge/openhuman/actions/runs/37570238760.

Resolved — the review agent found this finding fixed in the new code, as of 2285292.

_{If this is wrong, reopen the conversation and say so; the finding will be re-raised on the next push if it still reproduces.}

Resolved — the review agent found this finding fixed in the new code, as of 493ffcb.

_{If this is wrong, reopen the conversation and say so; the finding will be re-raised on the next push if it still reproduces.}

Resolved — the review agent found this finding fixed in the new code, as of d76c232.

_{If this is wrong, reopen the conversation and say so; the finding will be re-raised on the next push if it still reproduces.}

Grant or isolate the forwarded toolchain homes

The fixture works around the missing host-toolchain grants by placing symlinks under the temporary HOME. That does not provide a production-safe policy: canonicalizing these links can either deny the toolchain entirely or grant access to the real host directories without a narrowly defined read/write boundary. The sandbox should explicitly grant the required toolchain paths with the intended permissions, or provide isolated copies, and the test should exercise that implementation rather than install symlink-based privileges.

[RULE] sandbox-path-isolation ·

Grant resolution canonicalizes configured and default/fallback Cargo roots and applies the credential floor to credential paths, including credentials.toml. Rustup read-only candidates are filtered for overlap with Cargo roots or credentials. Cargo read-write candidates are rejected when they overlap bin, config.toml, config, or env, preserving those entries as read-only. Regression cases cover registry-to-Cargo-root overlap, config-to-credentials overlap, a broad Rustup parent, and registry-to-bin read-write promotion; the dedicated external-cache alias remains admitted. Generic extra and system grants retain their existing behavior. 1 real agent-shell E2E and 77 sandbox regressions passed, with 0 failures and 0 ignored; https://github.com/SayrWolfridge/openhuman/actions/runs/37570238760.

Resolved — the review agent found this finding fixed in the new code, as of 2285292.

_{If this is wrong, reopen the conversation and say so; the finding will be re-raised on the next push if it still reproduces.}

Resolved — the review agent found this finding fixed in the new code, as of 493ffcb.

_{If this is wrong, reopen the conversation and say so; the finding will be re-raised on the next push if it still reproduces.}

Resolved — the review agent found this finding fixed in the new code, as of d76c232.

_{If this is wrong, reopen the conversation and say so; the finding will be re-raised on the next push if it still reproduces.}

Make the toolchain-home probe set the homes it asserts

The probe asserts the sandboxed process sees exactly the host's RUSTUP_HOME/CARGO_HOME, but when the test host has neither variable set, unwrap_or_default() makes both the expected values and the sandboxed output empty strings, so the assertion passes without exercising the HOST_TOOLCHAIN_ENV_PASSTHROUGH forwarding at all — the very contract this test claims to pin. Set the two variables explicitly for the duration of the test (the e2e test does this with EnvVarGuard::set_to_path) so the assertion actually fails if the passthrough regresses.

[RULE] vacuous-assertion ·

The unit probe sets explicit nonempty RUSTUP_HOME and CARGO_HOME values for the test duration and verifies those exact values in the child environment after native command construction. 1 real agent-shell E2E and 77 sandbox regressions passed, with 0 failures and 0 ignored; https://github.com/SayrWolfridge/openhuman/actions/runs/37570238760.

Resolved — the review agent found this finding fixed in the new code, as of 2285292.

_{If this is wrong, reopen the conversation and say so; the finding will be re-raised on the next push if it still reproduces.}

Resolved — the review agent found this finding fixed in the new code, as of 493ffcb.

_{If this is wrong, reopen the conversation and say so; the finding will be re-raised on the next push if it still reproduces.}

Resolved — the review agent found this finding fixed in the new code, as of d76c232.

_{If this is wrong, reopen the conversation and say so; the finding will be re-raised on the next push if it still reproduces.}

Grant or isolate toolchain homes forwarded from outside HOME

The new e2e test covers the HOME-based defaults only: it comments 'The shell's default local jail grants HOME/.rustup and HOME/.cargo/bin' and works by symlinking the host homes into the fixture's temporary HOME. For a user who sets RUSTUP_HOME or CARGO_HOME explicitly to a path outside HOME — the very case the passthrough exists for, per the docs' isolated-profile smoke step — the variable is now forwarded into the Landlock jail but the jail has no grant for that path, so Cargo fails with a confusing permission error instead of either working or not receiving the variable at all. Either extend the jail grants to include the configured homes when they are forwarded, or only forward a home variable when its path falls under an existing grant.

[RULE] forwarded-env-without-jail-grant ·

With toolchain_homes enabled, configured absolute Rustup and Cargo paths pass through canonicalization and the existing credential floor. Rustup paths receive read-only access; Cargo executable/configuration paths receive read-only access, and registry/Git caches receive read-write access subject to the overlap checks. The shell regression exercises a selected toolchain outside HOME through the real jail. 1 real agent-shell E2E and 77 sandbox regressions passed, with 0 failures and 0 ignored; https://github.com/SayrWolfridge/openhuman/actions/runs/37570238760.

Resolved — the reply explains why it is not a problem (advisory), as of 2285292.

_{If this is wrong, reopen the conversation and say so; the finding will be re-raised on the next push if it still reproduces.}

Resolved — the reply explains why it is not a problem (advisory), as of 493ffcb.

_{If this is wrong, reopen the conversation and say so; the finding will be re-raised on the next push if it still reproduces.}

Resolved — the reply explains why it is not a problem (advisory), as of d76c232.

_{If this is wrong, reopen the conversation and say so; the finding will be re-raised on the next push if it still reproduces.}

Define or import the agent stack test runner

The row relies on tests/agent_harness_e2e.rs and describes an agent-shell RPC/model-loop E2E, but the prior review found that the agent stack test runner is not defined or imported. Without a runnable harness, this path does not provide the claimed integration coverage and the ✅ status is false.

[RULE] missing-test-runner ·

run_on_agent_stack is defined in tests/agent_harness_e2e.rs at line 767 and is called by sandboxed_shell_forwards_host_toolchain_homes_and_confines_writes. Exact-head Linux run https://github.com/SayrWolfridge/openhuman/actions/runs/37570238760 compiled and passed the real agent-shell E2E (1 passed) and sandbox suite (77 passed, 0 failed, 0 ignored). The fixture checks the shell result in the subsequent model request. Please reassess the coverage-matrix finding against head 2285292 and this execution evidence.

Resolved — the review agent found this finding fixed in the new code, as of d76c232.

_{If this is wrong, reopen the conversation and say so; the finding will be re-raised on the next push if it still reproduces.}

Keep forwarded toolchain homes accessible inside the jail

This row now claims that the real Landlock and agent-harness tests cover forwarded custom toolchain homes, Cargo startup, and write confinement, but the prior review found that forwarded homes are not accessible inside the jail. Unless the harness provisions or explicitly grants those homes, the named E2E cannot demonstrate the behavior claimed here and the ✅ status is misleading.

[RULE] inaccurate-coverage-claim ·

At head 2285292, add_host_toolchain_homes admits absolute existing configured homes through the credential floor. The E2E stages Rustup and Cargo outside HOME and system roots, then runs Cargo through the real jail and checks the selected toolchain and cache behavior. The grant-unit and Landlock tests assert the read-only and writable boundaries. Exact-head Linux run https://github.com/SayrWolfridge/openhuman/actions/runs/37570238760 compiled and passed the real agent-shell E2E (1 passed) and sandbox suite (77 passed, 0 failed, 0 ignored).

Resolved — the reply explains why it is not a problem (advisory), as of 493ffcb.

_{If this is wrong, reopen the conversation and say so; the finding will be re-raised on the next push if it still reproduces.}

Resolved — the review agent found this finding fixed in the new code, as of d76c232.

_{If this is wrong, reopen the conversation and say so; the finding will be re-raised on the next push if it still reproduces.}

Grant or isolate forwarded toolchain homes

The documentation says the integration and E2E layers verify selective access to forwarded toolchain homes, yet the earlier finding that those homes must be granted or isolated remains unresolved. A test that cannot access the forwarded paths cannot validate read-only access, cache writes, or Cargo startup for them.

[RULE] inaccurate-coverage-claim ·

The configured-home admission is implemented in sandbox/grants.rs::add_host_toolchain_homes and add_cargo_home. The actual E2E runs shell commands against the staged external homes, checking Rustup selection, Cargo version, cache/workspace writes, outside-write denial, and delivery of the shell result to the model. Grant-unit and Landlock tests separately assert the read-only, writable-cache, and credential boundaries. Exact-head Linux run https://github.com/SayrWolfridge/openhuman/actions/runs/37570238760 compiled and passed the real agent-shell E2E (1 passed) and sandbox suite (77 passed, 0 failed, 0 ignored).

Resolved — the reply explains why it is not a problem (advisory), as of 493ffcb.

_{If this is wrong, reopen the conversation and say so; the finding will be re-raised on the next push if it still reproduces.}

Resolved — the review agent found this finding fixed in the new code, as of d76c232.

_{If this is wrong, reopen the conversation and say so; the finding will be re-raised on the next push if it still reproduces.}