Skip to content

Repository navigation

v0.7.0

Choose a tag to compare

View all tags
@tmaiaroto tmaiaroto released this 01 Nov 00:03
· 4 commits to main since this release
v0.7.0
47bf276

Phosphor v0.7.0

This release ships kernel-enforced OS-level sandboxing for agent-executed
commands across Linux, macOS, and Windows, along with a broad set of security
hardening and usability enhancements.

OS-level sandboxing

The bash tool and MCP stdio servers now run inside kernel-enforced sandboxes
instead of relying on tool-layer path checks alone:

  • Linux: seccomp-based filtering of child processes, with a hardened
    denylist and safely floored resource limits.
  • macOS: Seatbelt profiles with rlimit-based resource caps; DNS and TLS
    trust Mach services are granted so toolchains keep working inside the
    sandbox.
  • Windows: restricted-token + Job Object sandboxing, with an AppContainer
    tier for confined children, capability probing, and container ACE grants
    that are revoked on shutdown.
  • Kernel resource limits (CPU, memory, file size, and more) are applied to
    sandboxed bash and MCP children on all platforms.
  • ProxyOnly network tier: egress through a proxy only, with denial
    messages that point at the config needed to allow a host (the refused host
    is logged, never the full URL).
  • Sandbox escalation UX: commands that legitimately need to leave the
    sandbox prompt the user for a one-off pre-grant; escalation prompts cannot
    be bypassed by YOLO mode, allowlists, or hook pre-approvals. YOLO pin and
    escalation pre-grants are available for recurring workflows.
  • Escape-hatch gating: host binaries that could bypass the sandbox are
    denied while it is active, and nested shells on degraded hosts are closed
    off.
  • The sandbox mode and resource caps are floored against workspace overrides,
    so project settings cannot silently weaken them.

Security hardening

  • Agent commands are denied read access to well-known credential locations
    (.env, SSH keys, service-account files, etc.).
  • MCP stdio servers no longer inherit ambient credentials from the parent
    process.
  • Workspace config files and .git are read-only for the agent, and the
    sandbox defaults to workspace mode.
  • URL credential checks were hardened; secret scans on URLs or network
    hiccups no longer abort agent runs.
  • Dependency upgrades: echo v5.4.2 (clears a critical vulnerability gate),
    plus routine dependency bumps.

Toolchain & developer experience

  • Opt-in, cache-scoped trust for language toolchain caches (e.g. GOMODCACHE)
    shared by the sandbox and path guard, so module inspection and local docs
    lookups work out of the box.
  • Agents are steered toward local toolchain documentation (go doc, pydoc,
    man, ...) instead of web fetches when the local toolchain can answer.
  • New allow_commands permission opt-in and an OTel endpoint probe.

Fixes

  • Runs that end on a spoken but unexecuted next step now continue instead of
    stalling.
  • Windows job resource limits are attached only when sandboxing is active.
  • Shutdown waits on in-flight workspace runs are now bounded, terminal Kitty
    graphics-protocol probes are gated, and rendered Mermaid diagram links follow
    the active theme.

Documentation

  • New ADR for in-binary OS sandboxing, sandbox escalation/limits/toolchain
    trust in the config reference, and expanded security-hardening docs
    (including vibe-coding guidance).
Assets 10
Loading