CLI target management, Docker isolation, config hardening, and App permission docs - #35

Merged

bfulton merged 52 commits into

mainfrom

feat/cli-targets

Sep 6, 2026

Commits on Sep 4, 2026

Add target management to the localmost CLI

bfulton
and
claude
committed
437b420
Keep runtime target changes from being lost on quit

bfulton
and
claude
committed
80f63d7
Address review: validate socket payloads, fix case-variant targets

bfulton
and
claude
committed
5d6565f
Document the Contents: Read permission the App now requests

bfulton
and
claude
committed
5f90f90
Check the permission docs against one declared list

bfulton
and
claude
committed
0290714
Design doc: opt-in Docker daemon access for approved repos

bfulton
and
claude
committed
d61892d
Implementation plan for docker access

bfulton
and
claude
committed
7ebdef4
Add docker access level to the policy schema

bfulton
and
claude
committed
38c623c
Resolve the Docker endpoint outside the sandbox

bfulton
and
claude
committed
1ffbce5
Map each docker level to the paths it opens

bfulton
and
claude
committed
be577cb
Emit docker grants in the runner sandbox profile

bfulton
and
claude
committed
451bfb8
Emit docker grants in the localmost test profile

bfulton
and
claude
committed
e7c47ec
Carry the docker level from approved policy into the worker profile

bfulton
and
claude
committed
5329d6c
Remove the sockets key, superseded by docker

bfulton
and
claude
committed
bdcb924
Surface docker level changes in the policy diff

bfulton
and
claude
committed
50c6e34
Document docker access and what it gives up

bfulton
and
claude
committed
e8fb6d0
Correct what the dangling-socket test claims to cover

bfulton
and
claude
committed
ea61db8

Commits on Sep 5, 2026

Exercise docker access for real, locally and in CI

bfulton
and
claude
committed
f48ad4e
Merge branch 'docs/app-contents-permission' into feat/cli-targets
bfulton
committed
a0d7359
Merge branch 'feat/docker-access' into feat/cli-targets
bfulton
committed
1f83e8b
Skip the seatbelt suite where seatbelt cannot be applied

bfulton
and
claude
committed
5a976e1
Assert the ambient sandbox where a profile cannot be constructed

bfulton
and
claude
committed
bb82552
Address review: escape docker paths, quote them in the test suite

bfulton
and
claude
committed
a8ad31d
Say plainly what docker access disables, not just what it adds

bfulton
and
claude
committed
632623c
Design docker isolation: own the socket, then the daemon

bfulton
and
claude
committed
5ae03d2
Reclaim the slot of a worker that never gets its job

bfulton
and
claude
committed
46ae9b8

Commits on Sep 6, 2026

Stop a bad config read from becoming permanent data loss

bfulton
and
claude
committed
8d2a1d3
Report a job's repository instead of 'unknown' in notifications

bfulton
and
claude
committed
a2d6d7c
Plan docker isolation stage 1 from the design spec

bfulton
and
claude
committed
0614ea4
Extract the broker's GitHub job-info parse into a testable helper

bfulton
and
claude
committed
8f6c883
Bind per-workflow policy to the real workflow name

bfulton
and
claude
committed
3955c0e
Add the docker policy grammar types

bfulton
and
claude
committed
94905ee
Parse and classify Docker Engine API requests

bfulton
and
claude
committed
0bb102a
Add the DockerBackend seam and the desktop backend

bfulton
and
claude
committed
7f13292
Document the filtering docker socket and the policy migration

bfulton
and
claude
committed
6ab1697
Validate the docker action grammar and reject the old levels

bfulton
and
claude
committed
0730907
Make docker policy compose across shared and workflow

bfulton
and
claude
committed
7673da7
Diff and serialize the docker policy block

bfulton
and
claude
committed
8ef5214
Filter Docker requests against the repository's docker policy

bfulton
and
claude
committed
669f4f2
Serve a filtering Docker socket per worker

bfulton
and
claude
committed
63e0d58
Mint a per-worker docker socket and bind it on claim

bfulton
and
claude
committed
b5ac154
Grant the worker's own docker socket, drop the daemon-socket hole

bfulton
and
claude
committed
222e802
Remove the superseded docker access-level API

bfulton
and
claude
committed
20c751a
Extract the --updaterc merge into a testable helper

bfulton
and
claude
committed
6642bd2
Suggest docker policy from filtered denials in --updaterc

bfulton
and
claude
committed
0da928b
End-to-end test a workflow through the filtering socket

bfulton
and
claude
committed
acd2ac3
Fail, never skip, when the docker e2e has no daemon to run against

bfulton
and
claude
committed
772774d
Migrate this repo's docker policy to the action grammar

bfulton
and
claude
committed
fc3aabb
Run docker-localmost on every push instead of skipping

bfulton
and
claude
committed
0b4d382
Run the docker e2e inside a localmost job too

bfulton
and
claude
committed
73928cc
Answer an HTTP/1.0 client that half-closes, instead of dropping the response

bfulton
and
claude
committed
eafd871
Scope container reads and writes to this job's own containers

bfulton
and
claude
committed
9fe5d5a