Skip to content

Give swarm external voices file-read + web research (0.6.0)#46

Merged
gering merged 6 commits into
mainfrom
task/open-swarm-external-exploration
Jul 24, 2026
Merged

Give swarm external voices file-read + web research (0.6.0)#46
gering merged 6 commits into
mainfrom
task/open-swarm-external-exploration

Conversation

@gering

@gering gering commented Jul 23, 2026

Copy link
Copy Markdown
Owner

Summary

  • External review voices (codex, grok) can now read project files and research online, finding out-of-diff bugs (callers, config, types, CVE/library knowledge) — previously they reviewed the inlined diff blind.
  • The OS secret-jail stays and grows: repo-root .env*/data//key files join the HOME denylist; fail closed — without sandbox-exec/bwrap the externals degrade to the 0.5.x tool-less/no-web flags instead of running read+web bare.
  • Egress hardened by prompt (outside the untrusted-diff fence): web is for external general knowledge only, never repo content in a query/URL. Honestly documented as model-cooperation-dependent — the jail is the hard boundary.
  • Hardened further by an ensemble self-review: the new voices reviewed their own implementation (/swarm:review dogfooding); 15 findings applied, incl. the fail-closed gap (cross-family consensus critical).

Changes

  • agents.sh: grok --tools read_file,list_dir,grep,web_search,web_fetch --cwd <repo> (was --tools "" --disable-web-search); codex -C <repo> -c tools.web_search=true under unchanged -s read-only; _jail_available() fail-closed gate; repo-root secret globs in _sandbox_deny_paths; named residuals in comments.
  • SKILL.md: exploration permission + HIGH-PRIORITY egress guard in the external prompt header (outside the diff fence); all tool output declared untrusted DATA; once-per-run notice (web + egress + jail + SWARM_DENY_PATHS hint).
  • test_sandbox_deny.py (new): denylist unit asserts + macOS e2e with positive control (non-denied read must pass — "jail never ran" can't masquerade as "jail denied").
  • Docs: adapter knowledge doc posture rewrite (read+web table, residual risks incl. unfenced file-read channel + own-token readability, grok tool-id leniency), pipeline doc, blueprint, both READMEs, CLAUDE.md, CHANGELOG; swarm 0.5.1 → 0.6.0 (plugin.json + marketplace.json in sync).

Readiness

  • ✅ Rebase: up-to-date with origin/main
  • ✅ README (root + plugin), version 0.6.0 synced, CHANGELOG entry, knowledge docs updated
  • ✅ Tests: 6/6 pass (incl. new sandbox regression suite)
  • ✅ check-structure.py: 0 errors

Test plan

  • python3 plugins/swarm/scripts/test_sandbox_deny.py — denylist + e2e green on macOS
  • bash plugins/swarm/scripts/agents.sh list — codex + grok ready
  • /swarm:review on any diff: run-start notice appears; externals return findings (file-read + web live)
  • Optional: on a host without sandbox-exec/bwrap, verify the fail-closed degrade warnings

🤖 Generated with Claude Code

https://claude.ai/code/session_01B2y4GsnrE87L89uGHE5dGX

@gering
gering force-pushed the task/open-swarm-external-exploration branch from ae77504 to 2ce9a15 Compare July 23, 2026 12:52
gering and others added 3 commits July 24, 2026 10:28
@gering @claude
Give swarm external voices file-read + web research (0.6.0)
276b36f 
Externals (codex, grok) were tool-less/inline-only — blind to out-of-diff
bugs (callers, config, types, CVE/library knowledge). Grant file-read + web
without re-opening the secret-exfil hole:

- codex: `-s read-only -C <repo> -c tools.web_search=true` (web is
  model-native, works under read-only — no sandbox loosen).
- grok: strict `--tools read_file,list_dir,grep,web_search,web_fetch`
  allowlist + `--cwd <repo>`; drop `--tools ""` / `--disable-web-search`.
  No write/shell tools for either voice.
- Keep + extend the OS secret-jail: repo-root `.env*`/`data/`/key files join
  the HOME denylist (root-level only — nested via SWARM_DENY_PATHS).
- Egress guard (prompt policy, outside the diff fence): web is for external
  general knowledge only, never put repo content into a query/URL. Model-
  cooperation-dependent, not transport-enforced — the jail is the hard
  boundary; scrub_secrets/output gate stay as output-only backstops.
- Run-start notice once per review when external voices are live.
- New test_sandbox_deny.py: denylist unit asserts + macOS e2e (sandboxed cat
  of a temp .env is blocked). Docs/knowledge rewritten off the old posture.

Bumps swarm 0.5.1 → 0.6.0.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B2y4GsnrE87L89uGHE5dGX
@gering @claude
Harden swarm 0.6.0 posture after ensemble self-review
8270bfa 
15 findings from a /swarm:review dogfooding run over the 0.6.0 diff
(2 critical consensus among them), applied:

- FAIL CLOSED without the OS jail (the critical): on hosts with neither
  sandbox-exec nor bwrap, run_codex/run_grok now degrade to the 0.5.x
  flags (grok tool-less/no-web, codex without web search) via the new
  _jail_available() gate, with an audible warning — read+web never runs
  without its hard boundary. 0.5.x was safe there by flags; 0.6.0 now is
  again.
- E2E sandbox test gains a positive control (non-denied read must pass,
  rc asserted) so "jail never ran" can no longer pass as "jail denied".
- Prompt hardening: all tool output declared untrusted DATA (file-read
  channel cannot be nonce-fenced — now a named residual); EPERM on
  secret paths flagged as expected; run-start notice names the root-only
  deny scope + SWARM_DENY_PATHS and no longer mis-renders as a bullet.
- Named residuals documented: unfenced file-read channel, own-backend
  token readability; grok tool-id leniency (live-verified) replaces the
  stale degrade-promise in the adapter doc.
- Cleanups: _repo_root() reused in _sandbox_deny_paths, redundant
  nullglob block dropped, honest test-runner comment, CLAUDE.md + root
  README posture sync, knowledge frontmatter per curate convention.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B2y4GsnrE87L89uGHE5dGX
@gering @claude
Close worktree deny gap + per-voice fail-closed after review round 2
4d29c18 
Second /swarm:review dogfooding pass (11 findings, 3 critical consensus
— grok contributed 12 raw findings this round), applied:

- Worktree-aware jail (the critical): deny globs now also cover the MAIN
  checkout's root via --git-common-dir — untracked .env/data/ never
  propagate into a linked worktree, so the standard /kickoff layout left
  the real secrets readable as a sibling path. New regression test.
- Per-voice fail-closed, honestly: codex web HARD-disabled
  (tools.web_search=false, not omitted) on jail-less hosts; FS reads
  remain inside codex's own read-only sandbox (no no-read tier exists) —
  docs no longer over-claim "tool-less" for codex.
- Functional jail probe: _init_sandbox test-runs the wrapper; a
  present-but-broken sandbox-exec/bwrap now degrades instead of failing
  every run opaquely.
- Degrade made audible: new `agents.sh jail` subcommand; the skill
  brands its run-start notice AND the externals' prompt capability lines
  on it (no promised reads/web on a jail-less host).
- Deny-glob quality: root set extended (.npmrc, .pypirc,
  credentials.json, .git/config); SSH-key globs narrowed (id_rsa* etc.
  instead of id_* which jailed legit id_*.py files); bwrap silent-empty
  caveat documented.
- bwrap e2e deferred to add-sandbox-regression-tests (noted); stale
  "diff-scoped externals" comment refreshed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B2y4GsnrE87L89uGHE5dGX
@gering
gering force-pushed the task/open-swarm-external-exploration branch from c87aa54 to 4d29c18 Compare July 24, 2026 08:28
gering and others added 3 commits July 24, 2026 11:01
@gering @claude
Fix git-common-dir bug + broaden jail after review round 3
0a90508 
Third /swarm:review pass (14 findings, 2 critical), applied 9 ✅ + 2 🟨:

- Fix the round-2 worktree deny (critical, live-verified): `--git-common-dir`
  is CWD-relative, so resolving it against $repo mis-targeted the tree
  (over-denied a sibling / missed the main checkout). Switch to
  `--path-format=absolute --git-common-dir`.
- Broaden the HOME denylist (critical): ~/.gitconfig, ~/.config/git,
  ~/.cargo/credentials.toml (PAT via url.insteadOf, cargo token). git keeps
  working via GIT_CONFIG_GLOBAL/SYSTEM=/dev/null — the denied global config is
  never opened by git, yet stays unreadable to a direct read_file.
- Stop denying the repo's own .git/config: git treats an EPERM on it as fatal
  (sandbox-exec), which silently broke the externals' git-based exploration —
  the whole point of 0.6.0. Documented as an accepted residual.
- EGRESS guard now emitted UNCONDITIONALLY in the external prompt (a spurious
  jail=no must never drop it).
- Tests: e2e gates on a FUNCTIONAL sandbox probe (not PATH presence),
  matching the runtime degrade; new fail-closed degrade-argv tests (the
  load-bearing behavior — grok tool-less/no-web, codex web=false vs =true);
  git-works-in-jail assertion. Source guard added to agents.sh so tests
  `source` it instead of sed-extraction surgery.
- Honest residual doc: the jail is a denylist, not a path allowlist —
  absolute-path reads outside the deny set are readable.
- New `agents.sh jail` verb documented; degrade + narrowed id-globs synced
  across CHANGELOG / blueprint / README / knowledge (were contradictory).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B2y4GsnrE87L89uGHE5dGX
@gering @claude
Harden jail edge cases from --loop round 0
58f7562 
Loop round 0 review (10 findings, 3 refuted), applied 9 agreed:

- Version-proof the worktree main-checkout resolution: drop the git>=2.31
  `--path-format=absolute` (silently failed → fail-OPEN on old git) for a
  bash-only `git -C "$repo" --git-common-dir` + cd/pwd -P anchor.
- bwrap deny paths now readlink -f'd (final symlink component too): a
  symlinked secret (~/.gitconfig → dotfiles/…) was maskable only by link
  name on Linux, readable via its real path. sandbox-exec already realpaths.
- Exclude conventionally non-secret .env templates (.env.example/.sample/
  .template/.dist/.defaults) from the deny — under bwrap they read as empty
  (no EPERM), feeding reviewers false "config is empty" findings.
- Keep the untrusted-tool-output rule in the jail-less prompt branch (a
  degraded codex still reads files); reword the jailed note so a bwrap
  empty-read (not just EPERM) is flagged as expected, not a finding.
- Extract _scope_args helper: run_codex/run_grok no longer duplicate the
  resolve-root-or-warn block (drift risk).
- Docs/tests: assert the new HOME denies (.gitconfig/.config/git/
  .cargo/credentials.toml) in the regression test; document that write/exec
  is a CLI-level barrier, not OS-enforced (accepted residual); refresh the
  always-loaded _index.md adapter summary to the 0.6.0 posture.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B2y4GsnrE87L89uGHE5dGX
@gering @claude
Fail closed on unresolvable repo root; converge --loop round 1
a7641a7 
Loop round 1 review (10 findings, 2 refuted). Applied the actionable set;
the recurring 🟡 core (denylist-not-allowlist + web) is the user's accepted,
now-more-fully-documented posture, not a new defect:

- Fail closed when the repo root can't resolve (new _read_web_safe gate): the
  HOME denylist alone kept _jail_available true, so a run from outside the work
  tree previously granted read+web with NO repo-local denies and no scoping.
  Web now requires a working jail AND a resolvable root; the `jail` subcommand
  reports the same condition so the skill's prompt can't over-promise.
- Memoize _repo_root (per-process) — was resolved 2–3× per run.
- bwrap: dedup the link/target bind when a path isn't a symlink; keep it
  space-safe via an array.
- Tests: pin that .env templates stay OFF the denylist; replace the vacuous
  `/id_*` assertion with the real narrowed globs.
- Docs: correct CHANGELOG/knowledge to the actual bare `--git-common-dir`
  mechanism (not `--path-format`, my round-0 doc drift); README lists the
  `jail` verb; residual-risk section now names the in-diff-secret and --pr
  attacker-diff cases explicitly.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B2y4GsnrE87L89uGHE5dGX
@gering
gering merged commit 314a2b1 into main Jul 24, 2026
1 check passed
@gering
gering deleted the task/open-swarm-external-exploration branch July 24, 2026 09:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@gering