Preserve custom Rust homes in local grants and native shell execution

[SayrWolfridge]

Summary

Native shell execution currently drops configured RUSTUP_HOME and CARGO_HOME, while grant discovery only considers default homes. Preserve the selected OS paths through both boundaries, including non-UTF8 Unix paths. Keep Rustup and selected Cargo executable, configuration and cache state read-only under the existing protected-path floor.

Related issue

Follow-up to OpenHuman #7037, whose affected execution and grant discovery now live in TinyBox. The original routing contribution was OpenHuman #6978.

API or behavior changes

Updated against upstream v0.1.34 (bcea8a7), including the rustls 0.23.46 security patch. Upstream contract 1.19 retains its network policy and event vocabulary; the Rust-home transport is additive in contract 1.20.

• Contract 1.20 adds ResolveLocalGrantsRequest.allow_unix_paths (default false) and optional unix_paths groups in LocalGrants and NativeJailConfig. Empty optional values retain the established serialized payloads; opted-in Unix callers carry non-UTF8 paths as byte vectors.
• Rust callers constructing these public structs initialize the new fields. Byte-grant consumers require contract 1.20 before sending them. The decoder checks absolute/canonical paths, NUL, parent traversal, byte limits and the combined 64-grant limit.
• Nonempty RUSTUP_HOME and CARGO_HOME values retain their OS encoding in the native child environment; approved request overrides keep precedence. Empty toolchain values behave as unset.
• With toolchain_homes enabled, existing absolute configured homes enter selective discovery. Rustup and Cargo bin, configuration, env, registry and git remain read-only. Fixed requested/canonical aliases are reserved before admission; the credential floor and writable-extra checks apply throughout. Fetching dependencies requires separately approved disposable Cargo state.

Validation

Commands passed on the exact Linux candidate:

• cargo fmt --all -- --check
• cargo clippy --all-targets --all-features -- -D warnings
• cargo build --all-targets --all-features
• cargo test --all-features
• bash scripts/check-coverage.sh (90% per-file gate)
• bash scripts/test-e2e.sh

The baseline reproduction runs new regression tests over untouched 7ceaf5c: two public configured-home discovery tests and one actual shell-child environment test fail at runtime. Exact candidate 9955f6da15ec passed Linux validation: the canonical commands, compiled-module Rust-home scenarios, packaged-module E2E, and the 90% per-file coverage gate (85 crate files, lowest file 90.00%). The canonical pinned cargo-deny action also passed on the exact source. The same source passed macOS strict Clippy, public resolver regressions, all seven native-jail checks, byte-exact shell-child execution, compiled-module admission, and the default/all-features workspace test matrix.

Tests

Public resolver tests use subprocess-seeded environments and actual UTF8 paths; Unix filesystems accepting non-UTF8 names also exercise actual byte-path grants. macOS asserts EILSEQ for invalid UTF8 fixture names and omission of those unavailable homes. Missing custom homes are checked through the public resolver on every platform. Grant tests cover missing/relative homes, disabled discovery, selective cache access, protected descendants and aliases, whole-Cargo-root refusal and unrelated safe extra grants. Serialization tests cover legacy defaults and byte preservation; jail tests cover malformed paths, combined bounds and enforcement. Native-jail byte-vector decoding and flag preservation use existing Unicode paths on all Unix platforms; macOS also checks rejection of unavailable non-UTF8 paths, and other Unix platforms retain the real non-UTF8 path case.

The compiled-module regression admits the actual dynamic artifact and calls discovery and native shell execution through the public bus. UTF8 and Unix-byte scenarios check byte-exact child environment values, including the rejected filesystem names on macOS. Linux runs the installed Cargo/Rust toolchain with a custom UTF8 Rustup path and Unix-byte Cargo path. A second confined case uses Unix-byte paths for both homes. Both cases read admitted fixtures, write the workspace, and require kernel denial of host-state writes, credential reads and an outside sentinel.

Documentation

Updated local-grants and native-shell specs/plans, grant and native-shell module READMEs, and the TinyBus module's contract history. Constructor examples and existing integration fixtures initialize the additive fields.

Checklist

• The change is focused on one logical change
• No new #[allow(...)], #[ignore], or relaxed lints
• No secrets, tokens, or .env contents in the diff or the description

Prepared with OpenAI Codex and submitted from SayrWolfridge. Lisa approved the contribution and the read-only shared-cache policy.

[tinysweeper]

Tiny Sweeper review

⚠️ Review failed for 9955f6da15ec. the review of #84 did not finish within 900s

Last completed report

Tiny Sweeper review

Tiny Sweeper reviewed this change across 5 lane(s) and found 0 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below.

State: Incomplete
Priority: none
Reviewed head: b1f310f19007
Updated: 2026-10-14T14:53:05Z

Review snapshot

Change surface	Files	Review signal	Count
Production	9	Active findings	0
Tests	11	Noted findings	0
Documentation	7	Resolved findings	0
Configuration	0	Pending checks/questions	3

Completeness: Incomplete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

Features

None identified with supported citations.

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Could not review: crates/tinybox-jail/tests/toolchain_homes.rs, crates/tinybox-module/src/tinybus_module/native_jail_tests.rs

Before merge

• Complete the critique review for crates/tinybox-jail/tests/toolchain_homes.rs.
• Complete the security review for crates/tinybox-jail/tests/toolchain_homes.rs, crates/tinybox-module/src/tinybus_module/native_jail_tests.rs.

How this fits together

flowchart LR
  n0["LocalGrants<br/>changed"]:::changed
  n1["ResolveLocalGrantsRequest<br/>changed"]:::changed
  n2["NativeJailConfig<br/>changed"]:::changed
  n3["...est_keeps_explicit_enforcement_and_grants<br/>changed"]:::changed
  n4["..._vocabulary_is_typed_bounded_and_additive<br/>changed"]:::changed
  n5["...ker_facts_are_additive_and_default_safely<br/>changed"]:::changed
  n6["...nfiguration_defaults_and_floor_round_trip<br/>changed"]:::changed
  n7["Error"]:::impacted
  n8["resolve_local_grants"]:::impacted
  n9["LocalGrantConfig"]:::impacted
  n10["ProtectedPaths"]:::impacted
  n1 -->|uses| n9
  n1 -->|uses| n10
  n3 -->|uses| n2
  n3 -->|uses| n7
  n4 -->|uses| n7
  n5 -->|uses| n7
  n6 -->|uses| n1
  n6 -->|uses| n7
  n6 -->|uses| n9
  n6 -->|uses| n10
  n8 -->|uses| n0
  n8 -->|uses| n1
  classDef changed fill:#0d4429,stroke:#238636,color:#e6edf3
  classDef impacted fill:#161b22,stroke:#6e7681,color:#c9d1d9
  classDef flagged fill:#5a1e02,stroke:#d93f0b,color:#ffffff
  classDef blocking fill:#67060c,stroke:#f85149,color:#ffffff

Loading

Agent review details

critique

• Conclusion: Success
• Scope reviewed: incomplete; unanswered: crates/tinybox-jail/tests/toolchain_homes.rs
• Lane summary: Reviewed 4 files; 2 findings. 1 file could not be reviewed: crates/tinybox-jail/tests/toolchain_homes.rs. _The code index is behind this pull request (indexed at `7f0571a388bb`), so retrieved context may be out of date._

security

• Conclusion: Success
• Scope reviewed: incomplete; unanswered: crates/tinybox-jail/tests/toolchain_homes.rs, crates/tinybox-module/src/tinybus_module/native_jail_tests.rs
• Lane summary: This is a new self-contained end-to-end integration test for the compiled tinybox module, exercising grant discovery and native shell execution through the in-memory bus. Process spawning is limited to the harness's own test binary, `cargo build`, and platform ACL helpers, and all environment variables the child reads are set by the test itself, so there is no untrusted input path to a dangerous sink. The environment-clearing child spawn matches the pattern already used elsewhere in the workspace, and no repository rule in the supplied instruction files is violated. No defects found. 2 files could not be reviewed: crates/tinybox-jail/tests/toolchain_homes.rs, crates/tinybox-module/src/tinybus_module/native_jail_tests.rs. 2 files were not security-reviewed: docs/plans/local-grants.md (prose or tabular data), docs/plans/native-shell-execution.md (prose or tabular data). _The code index is behind this pull request (indexed at `7f0571a388bb`), so retrieved context may be out of date._

tests

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Contract 1.19 adds opt-in byte-preserving Unix grant transport, custom RUSTUP_HOME/CARGO_HOME discovery, and OsString toolchain-home passthrough for the native shell. The new decode path (`unix_grants`) validates absolute, NUL-free, non-traversing, sized paths and canonicalizes them, and it is covered by new unit tests plus subprocess-seeded integration tests that assert real failures (malformed bytes, macOS EILSEQ omission, legacy non-UTF-8 refusal, combined grant bounds). I found no reportable defect in the added behaviour; the one behavioural asymmetry I noticed — the byte-grant path length check measures raw bytes on Unix while the string path measures the UTF-8 encoding — is unreachable on Unix, where `Path::as_os_str()` bytes and string bytes coincide, so it is not a defect. _The code index is behind this pull request (indexed at `7f0571a388bb`), so retrieved context may be out of date._

commits

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: Nothing sensitive found in what this pull request commits.

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The added tests and documentation in this revision (public resolver toolchain-home regressions, native-jail byte-grant tests, the compiled-module Rust-homes E2E, and the plan/spec updates) line up with the implementation they exercise and with the PR description: they cover opt-in non-UTF-8 byte grants, configured RUSTUP_HOME/CARGO_HOME discovery, read-only enforcement of selected Cargo state, and byte-preserved shell environments. I found no defect introduced by this change. _The code index is behind this pull request (indexed at `7f0571a388bb`), so retrieved context may be out of date._

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash, glm-5.3-flash,
• Spend: $0.004683
• Tokens: 979477 input · 58805 output · 141440 cached · 777 embedding

Head	State	Pass summary
c70c0ea3729f	incomplete	0 active finding(s), 0 resolved finding(s) (at 2026-10-14T13:29:25Z)
b1f310f19007	incomplete	0 active finding(s), 0 resolved finding(s) (at 2026-10-14T14:53:05Z)

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 75aba4fc-e4e2-48ca-9eda-f8a5478c1521

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

tinysweeper found nothing blocking, but could not review everything, so this is not an approval: crates/tinybox-jail/src/grants/mod.rs, crates/tinybox-jail/src/grants/mod_tests.rs, crates/tinybox-module/tests/rust_homes_manifest_e2e.rs.

             $0.0142 · 1,866,000 in / 179,063 out · 193,024 cached (10%) · ladder/vectors-oai3, glm-5.3-flash, , deepseek-v4.1-flash · 770 embedded
critique:    $0.0090 · 925,696 in   / 114,017 out · 125,184 cached (14%) · glm-5.3-flash,
security:    $0.0047 · 737,093 in   / 60,825 out  · 58,624 cached (8%)   · deepseek-v4.1-flash
tests:       $0.0001 · 90,194 in    / 616 out     · 4,352 cached (5%)    · deepseek-v4.1-flash
description: $0.0000 · 75,838 in    / 463 out     · 4,864 cached (6%)    · deepseek-v4.1-flash

[SayrWolfridge]

The supply-chain failure also reproduces on untouched base 7ceaf5c3bdf62928955d00547aa47cd399ba7ba3 with the canonical pinned cargo-deny action: baseline replay, PR job.

Both report RUSTSEC-2026-0346 through RUSTSEC-2026-0349 for rustls 0.23.45, via ureq 3.4.0 and tinybus 0.1.5; bans, licenses and sources pass. The base and PR Cargo.lock hashes match. cargo-deny identifies rustls >=0.23.46 as the patched version. Could you update the baseline dependency lock and rerun the supply-chain check?

[tinysweeper]

tinysweeper found nothing blocking, but could not review everything, so this is not an approval: crates/tinybox-jail/tests/toolchain_homes.rs, crates/tinybox-module/src/tinybus_module/native_jail_tests.rs.

             $0.0047 · 979,477 in / 58,805 out · 141,440 cached (14%) · ladder/vectors-oai3, deepseek-v4.1-flash, glm-5.3-flash,  · 777 embedded
critique:    $0.0027 · 501,254 in / 31,580 out · 53,376 cached (11%)  · deepseek-v4.1-flash, glm-5.3-flash,
security:    $0.0016 · 160,494 in / 23,028 out · 42,496 cached (26%)  · deepseek-v4.1-flash
tests:       $0.0001 · 149,477 in / 1,015 out  · 5,376 cached (4%)    · deepseek-v4.1-flash
description: $0.0001 · 127,813 in / 955 out    · 40,192 cached (31%)  · deepseek-v4.1-flash

[SayrWolfridge]

All 13 module-ci checks pass on 9955f6da15ec, including Linux, macOS and Windows tests, module E2E, coverage and supply-chain checks. The TinySweeper review timed out after 900 seconds. Could a maintainer rerun TinySweeper for this head? Thank you!