[PR] feat(agent-isolation): expose harness-agnostic agent-iso entry point [magpie]

["justinmclean (via GitHub)" <gi...@apache.org>]

justinmclean opened a new pull request, #764:
URL: https://github.com/apache/magpie/pull/764

   ## Summary
   
   The env-isolation core of agent-iso.sh already worked for any CLI; this makes that capability explicit and documented:
   
   - Add `agent-iso()` shell function (sourced) and a sub-command mode `bash agent-iso.sh agent-iso <cli> [args]` (direct exec) so any harness CLI can be launched with the same credential-strip posture that claude-iso and opencode-iso provide.  A symlink named `agent-iso` (no .sh extension) also works — first positional arg is the CLI name.
   - The Claude-specific --settings sandbox allowRead injection continues to be skipped for all non-claude agents (guard was already in place).
   - Change `**Harness:** Claude Code, OpenCode` → `**Harness:** agnostic` in tools/agent-isolation/README.md; the env-isolation layer is now available for Codex, Cursor, Gemini CLI, Aider, and any future CLI.
   - Update docs/vendor-neutrality.md harness table and harness index to reflect agent-isolation moving from portable to agnostic; the hook regenerates the score section automatically.
   - Update docs/adapters/add-a-harness.md Step 2 and Step 4 to document `agent-iso <cli>` as the ready-made layer-0 wrapper for runtimes without a built-in hook API.
   - Add tests/test_generic_iso.py covering both the direct-exec and sourced entry points: credential strip, no --settings injection, banner, missing-CLI exit-127, no-CLI-arg usage message, and multiple harness names (codex/cursor/gemini).
   
   All 72 agent-isolation tests pass; vendor-neutrality-score and skill-and-tool-validate both pass.
   
   Generated-by: Claude (claude-sonnet-4-6)
   
   ## Type of change
   
   - [ ] Skill change (`.claude/skills/<name>/`) — eval fixtures updated below
   - [ ] Tool / bridge contract (`tools/<system>/*.md`)
   - [X] Python package (`tools/*/` with `pyproject.toml`)
   - [ ] Groovy reference impl
   - [ ] Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
   - [ ] Documentation (`docs/`, `README.md`, `CONTRIBUTING.md`)
   - [ ] Project template (`projects/_template/`)
   - [ ] CI / dev loop (`prek`, workflows, validators)
   - [ ] Other:
   
   ## Test plan
   
   - [X] `prek run --all-files` passes
   - [X] For Python packages touched: `uv run pytest` / `ruff check` / `mypy` passes
   - [ ] For Groovy bridges touched: command-line invocation tested end-to-end
   - [ ] For skill changes: eval suite passes for the affected skill
         (`PYTHONPATH=tools/skill-evals/src python3 -m skill_evals.runner tools/skill-evals/evals/<skill>/`)
   - [ ] For skill *behaviour* changes: a new or updated eval fixture is included in this PR
         (a regression test for the bug fixed / the behaviour added — see CONTRIBUTING.md)
   - [ ] Other:
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] feat(agent-isolation): expose harness-agnostic agent-iso entry point [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk commented on code in PR #764:
URL: https://github.com/apache/magpie/pull/764#discussion_r3538991397


##########
tools/agent-isolation/agent-iso.sh:
##########
@@ -198,6 +203,22 @@ agent_iso_run() {
     esac
   done
 
+  # `-w` / `--worktree` is an agent-iso control flag understood only by the
+  # Claude sandbox-grant path below (it widens the allowRead set to the main
+  # repo). For any other harness it is meaningless, and forwarding it into the
+  # launched CLI's argv risks it being misparsed as a native flag. Strip it for
+  # non-Claude agents so the generic entry point stays transparent.
+  if [[ "$agent" != "claude" && "$has_worktree" -eq 1 ]]; then
+    local -a _passargs=()
+    for arg in "$@"; do
+      case "$arg" in
+        -w|--worktree|-w=*|--worktree=*) ;;   # drop the control flag
+        *) _passargs+=("$arg") ;;
+      esac
+    done
+    set -- "${_passargs[@]}"
+  fi

Review Comment:
   **Optional fixup.** Once `-w` is stripped for a non-Claude agent, `has_worktree` is still `1`, so the `main_repo` block just below runs `git rev-parse --git-common-dir` + `cd` + `pwd` and then discards the result (settings injection is claude-gated). Resetting here skips that dead work:
   
   ```suggestion
       has_worktree=0   # main-repo resolution below is claude-only — skip the git calls
     fi
   ```



##########
tools/agent-isolation/agent-iso.sh:
##########
@@ -119,7 +119,12 @@ agent_iso_run() {
     XDG_DATA_HOME
     DISPLAY              # for OAuth flows that pop a browser
     WAYLAND_DISPLAY
-    SSH_AUTH_SOCK        # for git push (the agent gates push behind ASK; the socket alone is harmless)
+    # SSH_AUTH_SOCK is a fixed member of the Layer 0 passthrough (RFC-AI-0002
+    # § "Layer 0 — Clean-env wrapper"): git push/pull needs the ssh-agent socket.
+    # Layer 0 stays harness-agnostic. Gating the push itself is a *separate* layer
+    # (Layer 3 — permissions.ask / agent-guard), wired per-harness; a runtime with
+    # no Layer 3 adapter is responsible for providing its own push gate.

Review Comment:
   Good that the Layer 0 vs Layer 3 split is spelled out here. One ask: surface the *net* consequence just as prominently in the README's generic-entry-point section and the PR body — a harness with no Layer 3 adapter (`codex`/`aider` via `agent-iso`) receives this live ssh-agent socket with **no push gate**. "Same credential-strip posture" is true for the strip but shouldn't be read as "same net protection." A one-line ⚠️ callout at the generic entry point would prevent the misread.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] feat(agent-isolation): expose harness-agnostic agent-iso entry point [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk commented on PR #764:
URL: https://github.com/apache/magpie/pull/764#issuecomment-4915130724

   I applied both review fixups directly and rebased onto latest `main`:
   1. `agent-iso.sh` now resets `has_worktree=0` after stripping `-w` for non-Claude agents, so the Claude-only main-repo git resolution is skipped (no dead `git rev-parse`/`cd`/`pwd`).
   2. The README now carries a prominent ⚠️ callout that generic harnesses (`agent-iso <cli>`) get Layer 0 only — the live `SSH_AUTH_SOCK` with no Layer 3 push gate.
   
   Resolving my threads and merging. Thanks @justinmclean.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] feat(agent-isolation): expose harness-agnostic agent-iso entry point [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk merged PR #764:
URL: https://github.com/apache/magpie/pull/764


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org