[senamakel]

Summary

Wave 2: move the generic shell-scanning code to tinybox and delete an old sandbox stack that nothing called. The net change is −1.7k lines (39 added, 1,755 deleted).

Stacked on #6789 (then #6786, #6785, #6781). All four are merged into this branch. Upstream branch creation is restricted, so the base is main.

Shell-scanning code moved to tinybox-core::shell::scan (tinybox#13, stacked on #12)

• What moved:
  • splitting a command on unquoted separators;
  • the unquoted &, background-& and unquoted-character checks;
  • blanking the body of a quoted heredoc;
  • command_basename and normalized_command_name;
  • has_leading_env_assignment and skip_env_assignments.
• Why no seam was needed: these functions are pure, so OpenHuman now imports tinybox_core::shell::scan directly.
• What stays in OpenHuman (policy, not mechanism):
  • classify_segment and has_hidden_execution;
  • is_command_executor;
  • the dangerous-env list;
  • SecurityPolicy, is_always_forbidden and approvals.
• Tests:
  • The existing policy_*_tests.rs in OpenHuman are untouched and still pass.
  • 21 new upstream tests pin the tricky cases: quotes and escapes hiding separators, && vs &, 2>&1 / &>, quoted vs unquoted heredoc delimiters, here-strings, unterminated heredocs, and .exe and letter-case normalisation.
• policy_command/quoting.rs (445 lines) is deleted, and command_name.rs and env_guard.rs are trimmed.

Old sandbox stack deleted

• security::{traits, detect, bubblewrap, firejail, landlock, docker} had no callers anywhere in core, cli, embed, tinyhumans, app or tests. The only references were the pub use lines, docs and their own tests. The live path is sandbox/ops.rs plus tinybox-jail (from refactor(core): move tool/harness leaves, cwd jail, flow helpers and hotkey into vendor crates #6786), so runtime sandbox behaviour does not change.
• Why delete instead of switching to tinybox backends: the old trait wraps a std::process::Command in place. The tinybox Sandbox trait is an async lifecycle for whole boxes, so it is not a drop-in replacement.
• Deleted: 6 source files and 6 test files, about 1.2k lines. The public security::{Sandbox, NoopSandbox, create_sandbox} go with them.
• Cargo:
  • the direct landlock dependency is dropped;
  • sandbox-landlock now only enables tinybox-jail/landlock;
  • sandbox-bubblewrap is kept as an empty feature so the feature-forwarding chain stays unchanged. It can be removed in a later cleanup.
• Docs updated: gitbooks/developing/architecture/security.md and the two READMEs.
• Kept: sandbox/docker.rs, because it is the only live Docker path (docker run --rm, tied to SandboxPolicy and DockerOverrides). tinybox-docker manages long-lived boxes through a Host, so moving it would be a redesign.

Pin

tinybox is a registry module at v0.1.8. OpenHuman pins oh-w2-tinybox-on-v0.1.8, which is v0.1.8 plus #12 and #13 and describes as v0.1.8-7-ga1b5bf0a. The expect in the existing tinybox exemption is updated to match. The module and bus source are unchanged.

Verification

• cargo check --tests -p openhuman -p openhuman-cli --features "$(bash scripts/ci/product-features.sh)" is clean.
• The app manifest, openhuman-embed + openhuman-tinyhumans --tests and --no-default-features builds all compile.
• Full lib suite with the product features: 10338 passed, 0 failed.
• tinybox-core: 153 + 6 + 9 tests pass. fmt and clippy -D warnings are clean.
• These all pass: pnpm rust:layout, check-agent-runtime-boundary, check-feature-forwarding, check-gated-test-allowlist and check-submodule-monotonic.
• check-module-pins passes tinybox through its exemption. The tinywallet and tinychannels failures are inherited from test: drop 45 quarantined raw-coverage files, dedupe vendor-covered tests, repoint vendor pins #6781.

Merge order

tinybox#12, then tinybox#13, then a tinybox release. After that, re-pin and drop the exemption. This PR lands after #6789.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: a046fee8-3d09-4b69-9231-0343a42e25d1

📥 Commits

Reviewing files that changed from the base of the PR and between e43974c and cd5017d.

⛔ Files ignored due to path filters (2)

• Cargo.lock is excluded by !**/*.lock
• crates/openhuman-app/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (25)

• crates/openhuman-core/Cargo.toml
• crates/openhuman-core/src/sandbox/README.md
• crates/openhuman-core/src/security/README.md
• crates/openhuman-core/src/security/bubblewrap.rs
• crates/openhuman-core/src/security/bubblewrap_tests.rs
• crates/openhuman-core/src/security/detect.rs
• crates/openhuman-core/src/security/detect_tests.rs
• crates/openhuman-core/src/security/docker.rs
• crates/openhuman-core/src/security/docker_tests.rs
• crates/openhuman-core/src/security/firejail.rs
• crates/openhuman-core/src/security/firejail_tests.rs
• crates/openhuman-core/src/security/landlock.rs
• crates/openhuman-core/src/security/landlock_tests.rs
• crates/openhuman-core/src/security/mod.rs
• crates/openhuman-core/src/security/policy/command_checks.rs
• crates/openhuman-core/src/security/policy/policy_command/classification.rs
• crates/openhuman-core/src/security/policy/policy_command/command_name.rs
• crates/openhuman-core/src/security/policy/policy_command/env_guard.rs
• crates/openhuman-core/src/security/policy/policy_command/mod.rs
• crates/openhuman-core/src/security/policy/policy_command/quoting.rs
• crates/openhuman-core/src/security/traits.rs
• crates/openhuman-core/src/security/traits_tests.rs
• gitbooks/developing/architecture/security.md
• scripts/ci/module-pin-exemptions.json
• vendor/tinybox

 ____________________________________________________________________________________________________________________________________
< Put abstractions in code, details in metadata. Program for the general case, and put the specifics outside the compiled code base. >
 ------------------------------------------------------------------------------------------------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

---

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

Tiny Sweeper review

⚠️ Review failed for ffd3a0fdfc43. pull request exceeds review limits: 320 changed files (limit 500), 65565 changed lines (limit 50000)