[pull] main from LibreChat-AI:main

.github/workflows/ci.yml

@@ -155,6 +155,22 @@ jobs:
       - name: Tests
         run: npm test
 
+  macos-storage-tests:
+    name: macOS Storage ACL Tests
+    runs-on: macos-14
+    defaults:
+      run:
+        working-directory: packages/code
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: 24.16.0
+      - run: npm ci
+      - run: npm run build
+      - name: Native ACL and credential lifecycle tests
+        run: node --test dist/macos-storage.test.js dist/private-storage.test.js dist/storage.test.js dist/github.test.js
+
   lambda-microvm-provisioning:
     name: Lambda MicroVM Provisioning
     runs-on: ubuntu-latest

CONTRIBUTING.md

@@ -7,7 +7,7 @@ Thanks for your interest in Code Interpreter!
 This repository is published from an internal ClickHouse monorepo, which is
 the source of truth. Internal changes that are not already public are mirrored
 here as a snapshot commit on the `sync/main` branch (spot them by the
-`Source: ClickHouse/ai@<sha>` trailer); a maintainer merges the resulting sync
+`Source: ClickHouse/ai@<sha>` trailer); a maintainer merges the resulting sync <!-- leak-check:allow -->
 pull request to release it to `main`.
 
 Practical consequences:

packages/code/README.md

@@ -35,10 +35,40 @@ LIBRECHAT_CODE_SANDBOX_ENDPOINT=http://127.0.0.1:2000/api/v2 \
 librechat-code run
 ```
 
+Credential and quarantine storage supports macOS and Linux (including WSL2).
+On macOS, native descriptor-based ACL calls remove inherited ACLs from new
+credential/state files before writing secrets and verify the result. Reads reject
+ACL-exposed identities and GitHub App keys; ancestor checks reject ACL write
+grants and inheritable allow entries before any child is created. Removing an
+ACL after creation cannot revoke descriptors opened while the grant existed. Existing sharing ACLs on parent directories
+are never silently removed. Default application-owned workspace directories have
+their ACLs removed and modes restricted to `0700`.
+
+macOS requires the packaged Koffi native dependency (prebuilt for Apple Silicon
+and Intel); no Python interpreter or local compiler is needed with those builds.
+If it cannot load or ACL inspection fails, storage fails closed before pairing.
+Native Windows remains explicitly unsupported until DACL removal and verification
+are implemented. Use WSL2 with storage on a native Linux filesystem, not a Windows
+drive under `/mnt`. Linux retains ownership and POSIX mode/ACL-mask checks.
+
+Every storage ancestor, including intermediate symlink entries and targets, must
+be owned by this account or root and must not allow group/other writes unless
+protected by the sticky bit. A private directory inside a shared writable parent
+is insufficient: that parent can replace the directory. This also applies when
+loading GitHub App keys or clearing quarantine state.
+
 Use `--identity <path>` while pairing and
 `LIBRECHAT_CODE_IDENTITY_FILE=<path>` while running to override the identity
 file location.
 
+The identity file itself must not be a bind-mount target: saving a paired
+credential atomically replaces that entry. Mount its containing directory
+instead. Pairing preflight checks `/proc/self/mountinfo` before redeeming the
+one-time code and fails closed if mount information cannot be verified (including
+a mount table larger than 4 MiB). Existing identity reads remain supported.
+The check describes the current mount namespace; administrators must keep mount
+configuration stable during pairing.
+
 ## Native BYOM sandbox (default)
 
 The MVP command sandbox runs directly on the user's chosen laptop or VM. It
@@ -86,6 +116,12 @@ policy: an allowed destination can receive workspace data. The normalized
 allowlist is included in the worker policy digest. Tool approval hooks remain
 the user-facing allow/deny boundary for each invocation.
 
+The native sandbox preserves standard `HTTP_PROXY`, `HTTPS_PROXY`, `ALL_PROXY`,
+and `NO_PROXY` names (including lowercase forms), plus Windows process and profile
+variables on Windows. SRT remains responsible for the final sandbox environment
+and can replace proxy values with its filtered proxy endpoints. This does not
+expand the allowed domains or expose unrelated inherited credentials.
+
 ### GitHub authentication
 
 The native BYOM worker can provide Git HTTPS authentication without exposing a
@@ -104,8 +140,9 @@ read only by the trusted worker, which mints and refreshes short-lived
 installation tokens. A personal access token is supported as a fallback with
 `LIBRECHAT_CODE_GITHUB_TOKEN`, but the GitHub App is the safer default because
 its repository access and permissions can be narrowly installed and revoked.
-Native Windows currently requires token mode because the worker cannot
-reliably validate private-key ACLs there; use WSL2 for GitHub App mode.
+Native Windows credential storage is unavailable until native DACL removal and
+verification are implemented; use macOS, Linux, or WSL2. This also applies to GitHub App
+private keys.
 
 Git receives authentication through process-scoped `GIT_CONFIG_*` variables.
 The same isolated config supplies the standard Git LFS filters; hosts using LFS