agent-dev

#!/usr/bin/env bash
# claude-code-isolated: Secure bubblewrap wrapper for running commands in isolation
#
# Provides isolated environment with:
# - ~/aihome mounted at your actual $HOME path (mostly writable)
# - Current repo mounted with overlayfs (changes isolated for review)
# - All paths preserved to avoid hardcoded path issues
# - No access to sensitive files (~/.ssh, ~/.aws, ~/.gnupg, etc.)
#
# Overlay security model:
# - Repository changes are written to ~/aihome/.overlay/<repo-full-path>/upper
# - Original repository remains untouched (read-only lower layer)
# - After session, review and merge changes with: ./merge-overlay
#
# Setup:
#   1. Create isolated home: mkdir -p ~/aihome
#   2. Login to Claude in the sandbox:
#      cd /path/to/your/repo
#      ./agent-dev bash
#      claude   # Follow login prompts
#      exit
#   3. (Optional) Disable auto-updates in isolated home:
#      mkdir -p ~/aihome/.claude
#      echo '{"autoUpdates": false}' > ~/aihome/.claude/settings.local.json
#
# Usage:
#   cd /path/to/your/repo
#   ./agent-dev                    # Runs claude
#   ./agent-dev bash               # Inspect the environment
#   ./agent-dev vim file           # Run any command
#
# After session - review changes:
#   ./merge-overlay /path/to/repo ~/aihome/.overlay/path/to/repo/upper

set -euo pipefail

# Configuration
AI_HOME="${AI_HOME:-$HOME/aihome}"
REPO_DIR="$(pwd)"

# Overlay directories for repository isolation (using full path to avoid conflicts)
OVERLAY_BASE="$AI_HOME/.overlay$(realpath "$REPO_DIR")"
OVERLAY_UPPER="$OVERLAY_BASE/upper"
OVERLAY_WORK="$OVERLAY_BASE/work"

# ===== Protected paths in repository (read-only if exist, defense-in-depth) =====
PROTECTED_REPO_FILES=(
  ".git/config"
  ".git/info/exclude"  # Prevent sneaking ignore rules (not visible in git status)
  ".gitconfig"
  ".gitmodules"
  ".ripgreprc"
  ".project"
  ".classpath"
)

PROTECTED_REPO_DIRS=(
  ".git/hooks"
  ".vscode"
  ".idea"
  ".settings"
  ".claude/commands"
  ".claude/agents"
)

# ===== Protected paths in agent home (read-only if exist) =====
PROTECTED_AGENT_HOME_FILES=(
  ".gitconfig"      # Safe config created during setup
  ".bashrc"
  ".bash_profile"
  ".zshrc"
  ".zprofile"
  ".profile"
  ".npmrc"
  ".gemrc"
  ".inputrc"
)

PROTECTED_AGENT_HOME_DIRS=(
  ".ssh"            # If accidentally created, keep read-only
  ".bashrc.d"       # Bash config scripts sourced by .bashrc
  ".zshrc.d"        # Zsh config scripts (if used)
)

# ===== Whitelisted paths from real home (read-only mounts) =====
WHITELISTED_HOME_FILES=(
  .tool-versions
)

WHITELISTED_HOME_DIRS=(
  ".asdf"
  ".npm"
  ".bundle"
  ".gem"
  ".cargo"
  ".rustup"
  ".local"
  "bin"
  "local"
)

# Validate environment
if [[ ! -d "$AI_HOME" ]]; then
  echo "⚠️  AI home directory does not exist: $AI_HOME"
  echo ""
  echo "This directory will be used as Claude Code's isolated home."
  echo "Create it with: mkdir -p $AI_HOME"
  echo ""
  exit 1
fi

if [[ ! -d .git ]]; then
  echo "Error: Must run from a git repository root"
  exit 1
fi

# Create overlay directories for repository isolation
mkdir -p "$OVERLAY_UPPER" "$OVERLAY_WORK"

# Update Claude before entering sandbox (via npm, not trusting claude update)
echo "🔄 Checking for Claude updates via npm..."
npm update -g @anthropics/claude-code 2>&1 | grep -E "(changed|up to date)" || true
echo ""

# Prepare Claude settings: create permissive default in temp file
CLAUDE_SETTINGS_TEMP=$(mktemp)

# https://code.claude.com/docs/en/settings
cat > "$CLAUDE_SETTINGS_TEMP" << 'EOF'
{
  "permissions": {
     "allow": [
       "Bash",
       "WebSearch",
       "WebFetch",
       "Read",
       "Write",
       "Edit",
       "Glob",
       "Grep",
       "Task",
       "NotebookEdit",
       "Skill"
     ]
  }
}
EOF

# Cleanup function: remove temp files
cleanup() {
  rm -f "$CLAUDE_SETTINGS_TEMP"
}

# Register cleanup on exit (handles normal exit, errors, and interrupts)
trap cleanup EXIT

# Resolve DNS configuration (handles symlinks like /etc/resolv.conf -> /run/systemd/resolve/stub-resolv.conf)
RESOLV_CONF_TARGET=$(readlink -f /etc/resolv.conf)

# Build bwrap arguments for protected repo paths
BWRAP_REPO_PROTECTIONS=()

# Protected files: ro-bind if exists (overlayfs will catch any creation attempts in upper)
for file in "${PROTECTED_REPO_FILES[@]}"; do
  if [[ -f "$REPO_DIR/$file" ]]; then
    BWRAP_REPO_PROTECTIONS+=(--ro-bind "$REPO_DIR/$file" "$REPO_DIR/$file")
  fi
done

# Protected directories: ro-bind if exists (overlayfs will catch any creation attempts in upper)
for dir in "${PROTECTED_REPO_DIRS[@]}"; do
  if [[ -d "$REPO_DIR/$dir" ]]; then
    BWRAP_REPO_PROTECTIONS+=(--ro-bind "$REPO_DIR/$dir" "$REPO_DIR/$dir")
  fi
done

# Build bwrap arguments for whitelisted real home paths
BWRAP_HOME_WHITELIST=()

# Whitelisted files from real home: ro-bind if exists
for file in "${WHITELISTED_HOME_FILES[@]}"; do
  if [[ -f "$HOME/$file" ]]; then
    BWRAP_HOME_WHITELIST+=(--ro-bind "$HOME/$file" "$HOME/$file")
  fi
done

# Whitelisted directories from real home: ro-bind if exists
for dir in "${WHITELISTED_HOME_DIRS[@]}"; do
  if [[ -d "$HOME/$dir" ]]; then
    BWRAP_HOME_WHITELIST+=(--ro-bind "$HOME/$dir" "$HOME/$dir")
  fi
done

# Build bwrap arguments for protected agent home paths
BWRAP_AGENT_HOME_PROTECTIONS=()

# Protected files in agent home: ro-bind if exists
for file in "${PROTECTED_AGENT_HOME_FILES[@]}"; do
  if [[ -f "$AI_HOME/$file" ]]; then
    BWRAP_AGENT_HOME_PROTECTIONS+=(--ro-bind "$AI_HOME/$file" "$HOME/$file")
  fi
done

# Protected directories in agent home: ro-bind if exists
for dir in "${PROTECTED_AGENT_HOME_DIRS[@]}"; do
  if [[ -d "$AI_HOME/$dir" ]]; then
    BWRAP_AGENT_HOME_PROTECTIONS+=(--ro-bind "$AI_HOME/$dir" "$HOME/$dir")
  fi
done

echo "🔒 Starting Claude Code in isolated environment..."
echo "   Home: $HOME → $AI_HOME (isolated, mostly writable)"
echo "   Repo: $REPO_DIR (overlayfs - changes go to overlay)"
echo ""
echo "📂 Overlay directories:"
echo "   Lower:  $REPO_DIR (original, read-only)"
echo "   Upper:  $OVERLAY_UPPER"
echo "   Work:   $OVERLAY_WORK"
echo ""

# Count protections by category
REPO_PROTECTED=$((${#PROTECTED_REPO_FILES[@]} + ${#PROTECTED_REPO_DIRS[@]}))
AGENT_HOME_PROTECTED=$((${#BWRAP_AGENT_HOME_PROTECTIONS[@]}))
WHITELIST_COUNT=$((${#BWRAP_HOME_WHITELIST[@]}))

echo "🛡️  Protection summary:"
echo "   • Repo: $REPO_PROTECTED existing paths (read-only)"
echo "   • Agent home: $AGENT_HOME_PROTECTED config files (read-only)"
echo "   • Real home: $WHITELIST_COUNT dev tools (read-only)"
echo ""
echo "💡 All repo changes isolated in overlay (review with merge-overlay)"
echo "💡 After session: merge-overlay will run automatically"
echo "💡 To restore home: rm -rf $AI_HOME"
echo ""

exit_code=0
bwrap \
  `# ===== System directories (read-only) =====` \
  --ro-bind /usr /usr \
  --ro-bind /etc /etc \
  --ro-bind-try /opt /opt \
  --ro-bind-try /nix /nix \
  \
  `# Symlinks for compatibility` \
  --symlink /usr/lib /lib \
  --symlink /usr/lib64 /lib64 \
  --symlink /usr/bin /bin \
  --symlink /usr/sbin /sbin \
  \
  `# ===== Pseudo-filesystems =====` \
  --proc /proc \
  --dev /dev \
  --tmpfs /run \
  --tmpfs /sys \
  \
  `# ===== DNS resolution =====` \
  `# Mount the actual resolv.conf file at its real location (handles /etc/resolv.conf -> /run/systemd/... symlinks)` \
  --ro-bind "$RESOLV_CONF_TARGET" "$RESOLV_CONF_TARGET" \
  \
  `# ===== Temporary directories (isolated, writable) =====` \
  --tmpfs /tmp \
  --tmpfs /var/tmp \
  \
  `# ===== AI Home mounted at real home path (WRITABLE) =====` \
  `# This ensures hardcoded paths to $HOME work correctly` \
  `# Agent can write anywhere here - easy to restore if corrupted` \
  --bind "$AI_HOME" "$HOME" \
  \
  `# ===== Protected agent home paths (read-only overlays) =====` \
  `# Config files created during setup - prevent tampering/persistence attacks` \
  "${BWRAP_AGENT_HOME_PROTECTIONS[@]}" \
  \
  `# ===== Whitelisted real home paths (read-only overlays) =====` \
  `# Dev tools and files from real home mounted read-only` \
  "${BWRAP_HOME_WHITELIST[@]}" \
  \
  `# ===== Current repository with overlayfs (isolated writes) =====` \
  `# Lower: original repo (read-only), Upper: changes go to overlay, Work: overlayfs internal` \
  `# If under $HOME, this overlays the aihome mount at this specific location` \
  --overlay-src "$REPO_DIR" \
  --overlay "$OVERLAY_UPPER" "$OVERLAY_WORK" "$REPO_DIR" \
  --chdir "$REPO_DIR" \
  \
  `# ===== Protected repo paths (read-only defense-in-depth) =====` \
  `# Existing protected files/dirs are ro-bind (extra layer over overlayfs)` \
  `# Non-existent paths can be created in overlay and rejected during merge` \
  "${BWRAP_REPO_PROTECTIONS[@]}" \
  \
  `# ===== Claude settings override (permissive, non-persistent) =====` \
  `# Writable temp file overlays repo settings - changes don't persist to host` \
  --bind "$CLAUDE_SETTINGS_TEMP" "$REPO_DIR/.claude/settings.local.json" \
  \
  `# ===== Isolation and security =====` \
  --unshare-all \
  --share-net \
  --die-with-parent \
  --new-session \
  \
  `# ===== Environment variables =====` \
  `# --setenv HOME "$HOME"` \
  `# --setenv USER "$(whoami)"` \
  `# --setenv LOGNAME "$(whoami)"` \
  `# --setenv SHELL "/bin/bash"` \
  `# --setenv TERM "${TERM:-xterm-256color}"` \
  `# --setenv PATH "$HOME/.asdf/shims:$HOME/.asdf/bin:$HOME/bin:$HOME/.local/bin:/usr/local/bin:/usr/bin:/bin"` \
  `# --setenv ASDF_DIR "${HOME}/.asdf"` \
  `# --setenv ASDF_DATA_DIR "${HOME}/.asdf"` \
  \
  `# Clean environment - remove potentially dangerous vars` \
  --unsetenv DBUS_SESSION_BUS_ADDRESS \
  --unsetenv XDG_RUNTIME_DIR \
  --unsetenv SSH_AUTH_SOCK \
  --unsetenv GPG_AGENT_INFO \
  \
  `# ===== Execute command (defaults to claude) =====` \
  "${@:-claude}" || exit_code=$?

# After bwrap exits, run merge-overlay to review changes
echo ""
echo "============================================"
echo "  Session ended - reviewing changes"
echo "============================================"
echo ""

# Check if there are any changes in overlay
if [[ -n "$(ls -A "$OVERLAY_UPPER" 2>/dev/null)" ]]; then
  merge-overlay "$REPO_DIR" "$OVERLAY_UPPER"
else
  echo "✓ No changes in overlay - nothing to merge"
fi

exit $exit_code