Publish agent work from a clean repository

.github/workflows/sandbox-isolation.yml

@@ -234,8 +234,8 @@ jobs:
           executed=$(grep -oE 'executed="[0-9]+"' "$trx" | head -1 | grep -oE '[0-9]+')
           passed=$(grep -oE 'passed="[0-9]+"' "$trx" | head -1 | grep -oE '[0-9]+')
           echo "executed=${executed:-0} passed=${passed:-0}"
-          if [ "${executed:-0}" -lt 97 ]; then
-            echo "::error::Expected >=97 sandbox isolation tests to run (bwrap/prlimit confinement + cap-drop + cgroup-namespace re-root + egress-allowlist filter + cgroup resource cap + durable-launch cgroup wiring + argv/envp per-string kernel ceiling + a prompt past it riding stdin + a read-only workspace mount + a network-off run reaching its broker through the relay and nothing else + an allowlist run relayed to its broker + a read-only reviewer reading its diff with the real CLIs + a bwrap probe that runs the launch argv + the MCP helper bound file by file behind a read-only socket dir + a CLI reaching its broker socket through the relay + a severed child reaching its broker over the lease socket across a worker restart + a pre-relay namespaced run re-bound at its gateway and torn down with its seal + an allowlist run's veth guarded both ways, a flow the worker opened before the run included + forwarding a root worker may not write named before an allowlist is planned + an allowlist run's port 53 open only at the resolvers of the resolv.conf its namespace reads, and still to a resolver address the worker's own NAT rewrites before its forward and its input hooks + a target repository's own CLI config kept out of the run with the real CLIs, every repository's memory read in a multi-repo workspace included + a multi-repo Codex run starting at a workspace root that is no git repository and loading no config from it + a repo-less Codex run starting in a scratch directory that is no git repository + a goal handed to the real Claude CLI as text it cannot act on, fresh and resumed, against the text channel as its control + a repository clean filter the capture runs with its egress severed), but only ${executed:-0} did — the Category=Sandbox filter matched too few (trait regression?). If a case was deliberately removed, lower this number in the same PR."
+          if [ "${executed:-0}" -lt 98 ]; then
+            echo "::error::Expected >=98 sandbox isolation tests to run (bwrap/prlimit confinement + cap-drop + cgroup-namespace re-root + egress-allowlist filter + cgroup resource cap + durable-launch cgroup wiring + argv/envp per-string kernel ceiling + a prompt past it riding stdin + a read-only workspace mount + a network-off run reaching its broker through the relay and nothing else + an allowlist run relayed to its broker + a read-only reviewer reading its diff with the real CLIs + a bwrap probe that runs the launch argv + the MCP helper bound file by file behind a read-only socket dir + a CLI reaching its broker socket through the relay + a severed child reaching its broker over the lease socket across a worker restart + a pre-relay namespaced run re-bound at its gateway and torn down with its seal + an allowlist run's veth guarded both ways, a flow the worker opened before the run included + forwarding a root worker may not write named before an allowlist is planned + an allowlist run's port 53 open only at the resolvers of the resolv.conf its namespace reads, and still to a resolver address the worker's own NAT rewrites before its forward and its input hooks + a target repository's own CLI config kept out of the run with the real CLIs, every repository's memory read in a multi-repo workspace included + a multi-repo Codex run starting at a workspace root that is no git repository and loading no config from it + a repo-less Codex run starting in a scratch directory that is no git repository + a goal handed to the real Claude CLI as text it cannot act on, fresh and resumed, against the text channel as its control + a repository clean filter the capture runs with its egress severed + a real Codex agent that tampers its clone's .git while the platform publishes the branch from a clean repo, its Claude counterpart running in the non-root lane), but only ${executed:-0} did — the Category=Sandbox filter matched too few (trait regression?). If a case was deliberately removed, lower this number in the same PR."
             exit 1
           fi
 
@@ -290,6 +290,15 @@ jobs:
           assert len(clean_filter) == 1 and clean_filter[0].get('outcome') == 'Passed', 'the clean-filter capture case must run once and pass'
           print('The clean-filter capture case ran and passed.')
 
+          # The publish-isolation E2E runs a REAL Codex agent that plants push vectors in its .git, then the platform
+          # publishes from a clean repo; it is armed by the same CLI pins and returns early the same way. Require its
+          # marker (confined on this lane) and that it passed. The Claude arm runs in the non-root lane: the pinned CLI
+          # refuses bypassPermissions, a Standard run's mode, to uid 0.
+          assert '[publish-isolation-e2e] ran codex-cli uid=0 confined=True' in text, 'publish-isolation E2E arm "codex-cli" did not run confined as root — check CODESPACE_REQUIRE_REVIEW_CLIS and the CLI install step'
+          publish_iso = [r for r in results if 'AgentPublishIsolationE2ETests.' in r.get('testName', '')]
+          assert len(publish_iso) == 1 and publish_iso[0].get('outcome') == 'Passed', 'the Codex publish-isolation arm must run once and pass'
+          print('The Codex publish-isolation E2E arm ran and passed.')
+
           # The sealed-egress E2E returns early on a host that cannot confine, which reads as Passed; require each arm's marker.
           for arm in ('durable', 'non-durable', 'relay-ipv6', 'restart', 'relay-refused', 'relay-policy-route'):
               assert f'[sealed-egress-e2e] ran {arm}' in text, f'sealed-egress E2E arm "{arm}" did not run — this lane is root with bwrap and the relay helper, so it must relay'
@@ -402,9 +411,9 @@ jobs:
           root = ET.parse(path).getroot()
           counters = root.find('.//{*}Counters')
           executed, passed = int(counters.get('executed')), int(counters.get('passed'))
-          assert executed >= 15 and passed == executed, f'expected all 15 non-root arms to run and pass, got executed={executed} passed={passed}'
+          assert executed >= 16 and passed == executed, f'expected all 16 non-root arms to run and pass, got executed={executed} passed={passed}'
           text = open(path, encoding='utf-8').read()
-          for marker in ('[non-root-e2e] ran admission uid=1654', '[sealed-egress-e2e] ran non-root durable uid=1654', '[sealed-egress-e2e] ran non-root non-durable uid=1654', '[sealed-egress-e2e] ran non-root restart uid=1654', '[sealed-egress-e2e] ran non-root relay-refused uid=1654', '[sealed-egress-e2e] ran non-root relay-ipv6', '[broker-socket-e2e] ran non-root socket-channel uid=1654', '[review-diff-e2e] ran non-root network-off-relayed claude-code uid=1654', '[review-diff-e2e] ran non-root network-off-relayed codex-cli uid=1654', '[durable-egress-e2e] ran non-root allowlist-severed uid=1654', '[repo-config-e2e] ran non-root claude-code single-repo Standard uid=1654', '[goal-channel-e2e] ran non-root mentions claude-code Standard uid=1654 confined=True', '[goal-channel-e2e] ran non-root resume claude-code Standard uid=1654 confined=True', '[goal-channel-e2e] ran non-root slash /fix claude-code Standard uid=1654 confined=True', '[goal-channel-e2e] ran non-root slash /security-review claude-code Standard uid=1654 confined=True'):
+          for marker in ('[non-root-e2e] ran admission uid=1654', '[sealed-egress-e2e] ran non-root durable uid=1654', '[sealed-egress-e2e] ran non-root non-durable uid=1654', '[sealed-egress-e2e] ran non-root restart uid=1654', '[sealed-egress-e2e] ran non-root relay-refused uid=1654', '[sealed-egress-e2e] ran non-root relay-ipv6', '[broker-socket-e2e] ran non-root socket-channel uid=1654', '[review-diff-e2e] ran non-root network-off-relayed claude-code uid=1654', '[review-diff-e2e] ran non-root network-off-relayed codex-cli uid=1654', '[durable-egress-e2e] ran non-root allowlist-severed uid=1654', '[repo-config-e2e] ran non-root claude-code single-repo Standard uid=1654', '[goal-channel-e2e] ran non-root mentions claude-code Standard uid=1654 confined=True', '[goal-channel-e2e] ran non-root resume claude-code Standard uid=1654 confined=True', '[goal-channel-e2e] ran non-root slash /fix claude-code Standard uid=1654 confined=True', '[goal-channel-e2e] ran non-root slash /security-review claude-code Standard uid=1654 confined=True', '[publish-isolation-e2e] ran non-root claude-code uid=1654 confined=True'):
               assert marker in text, f'non-root arm marker "{marker}" is missing — the arm returned early or did not run as the worker uid'
           print(f'All {executed} non-root arms ran as uid 1654 and passed.')
           PY

backend/src/CodeSpace.Core/Services/Agents/Workspace/AgentCloneGitCommand.cs

@@ -4,10 +4,13 @@ namespace CodeSpace.Core.Services.Agents.Workspace;
 
 /// <summary>
 /// Builds every <c>git</c> spec the platform runs over an agent's clone after the agent's turn: the capture
-/// (<c>add -A</c> and the <c>diff --cached</c> trio), the re-attach capture, and the branch steps (<c>checkout -B</c>,
-/// <c>add -A</c>, <c>commit</c>, <c>diff --quiet</c>, <c>rev-parse HEAD</c>). The agent can write its own <c>.git</c>
-/// during the run, so by then its config, hooks and attributes are the agent's. Each spec built here makes sure a
-/// tampered <c>.git</c> cannot run code with anything the agent does not already have:
+/// (<c>add -A</c> and the <c>diff --cached</c> trio), the re-attach capture, the branch steps (<c>checkout -B</c>,
+/// <c>add -A</c>, <c>commit</c>, <c>diff --quiet</c>), and the publish's steps there: the <c>update-ref</c> that names the
+/// cloned base, the <c>merge-base --is-ancestor</c> that asks whether the branch adds anything to it, and the
+/// <c>bundle create</c>s that carry the base and the branch out to the platform-owned publish repo (the clone bound
+/// read-only, the bundles written outside it). The agent can write its own <c>.git</c> during the run, so by then its
+/// config, hooks and attributes are the agent's. Each spec built here makes sure a tampered <c>.git</c> cannot run code
+/// with anything the agent does not already have:
 /// <list type="bullet">
 ///   <item><c>-c core.hooksPath=/dev/null</c> — a command-line value beats the repo's own, so neither a planted
 ///   <c>.git/hooks/*</c> nor an agent-set hooks directory runs, and a vetoing pre-commit can no longer lose the