Skip to content

v0.2.42

v0.2.42: Patch release: add Linux OS sandbox enforcement and folder trust without
@echoVic echoVic tagged this 17 Jul 06:19 
changing the existing permission, capability-mode, or managed-proxy contracts.

- **Linux OS sandbox**: Linux shell execution now prefers `bwrap` for private
  mount, user, PID, IPC, UTS, and network namespaces with dropped capabilities.
  It applies writable binds, protected metadata rebinds, and deny masks in
  policy order.
- **Landlock fallback**: when bubblewrap is unavailable, compatible policies
  use Landlock filesystem rules plus a seccomp filter. The filter blocks
  ptrace, process-memory access, io_uring, and disallowed network syscalls.
- **Fail closed strict mode**: restricted-read policies require an enforceable
  backend. Missing or incompatible backends return exit code 126 instead of
  executing the user command unsandboxed.
- **Folder trust**: trust decisions live in user-owned `folder_trust.toml`.
  Unknown folders are untrusted by default. Project `.orca/config.toml`,
  `AGENTS.md`, `.orca/rules`, project skills, mentions, and named workflows
  load only after trust is granted.
- **Trust controls**: `orca trust show|add|remove --cwd <path>` and the TUI
  `/trust` commands manage folder decisions. An untrusted folder receives a
  strict read-only, no-network default, while explicit sandbox policies and
  permission profiles retain their existing behavior.
- **Release test stability**: saved-workflow, process-group, and protocol
  fixtures now establish their required trust and readiness conditions before
  asserting runtime behavior.
- **Runtime lifecycle CI**: normal shell-execution contract tests now select
  the explicit `danger-full-access` capability profile. This verifies that
  established explicit capability overrides remain authoritative without
  weakening the strict Linux default for unknown folders.
- **Linux CI backend**: the release test runner installs bubblewrap, so
  workspace metadata and sensitive-directory deny masks are enforced by the
  namespace backend instead of forcing a no-backend rejection.
- **Approval contract coverage**: shell-allowance tests explicitly trust their
  temporary configured workspace before asserting permission-rule behavior,
  leaving unknown-folder strict defaults covered independently.

Existing approval rules, capability modes, permission profiles, managed network
proxy behavior, server JSONL shapes, CLI arguments, TUI flows, and persisted
history remain compatible. Folder trust only constrains the implicit default;
an explicit sandbox policy or permission profile still takes precedence.

Pre-publish validation:

```bash
cargo fmt --all -- --check
git diff --check
cargo test -- --test-threads=1
cargo clippy --manifest-path /tmp/orca-linux-sandbox-check/Cargo.toml \
  --target x86_64-unknown-linux-gnu -- -D warnings
node --check npm/orca/bin/orca.js
node scripts/release/test-stage-npm.mjs
node scripts/release/test-verify-published.mjs
```

Post-publish verification:

```bash
node scripts/release/verify-published.mjs --version 0.2.42 \
  --repo echoVic/blade-deepseek --package @blade-ai/orca --bin orca
```

```bash
npm install -g @blade-ai/orca@0.2.42
```

or:

```bash
curl -fsSL https://orcaagent.dev/install.sh | \
  INSTALL_DIR=/usr/local/bin ORCA_VERSION=0.2.42 sh
```
Assets 2
Loading