jars ~ Jorge A. Rodriguez Suarez j4rs

Hardening a host for autonomous coding agents

A runbook from moving an unattended coding-agent setup (an orchestrator that picks issues from a tracker and runs a coding agent on each, opening PRs) from "agents run as a user on a VM" to "each agent works in its own disposable dev machine and holds no secrets". It is written from a real migration of one VM: an orchestrator (Symphony-style), the Codex CLI as the agent, a Rails + React monorepo, GitHub, and a Linear tracker. The names are ours; the shape applies to any agent that runs shell commands.

Everything below was done in small, reviewed steps, each one tried on a throwaway workspace before it went live, and each change to a trust boundary got an adversarial review and a re-review of its fixes. The order matters more than any single setting.

1. Threat model

Treat the agent as untrusted code that runs with whatever you give it. It reads issue text, PR comments, web pages and repo files, any of which can car

	# Given some text, write a function to find the max word letter span and list of words with that span

	# Word letter span is defined as the alphabetical distance in between the first and last letters of the word

	# Rules
	# The same two letters produce the same span regardless of their order in the word
	#. “PAT” and “TAP” have span 4
	# Capitalization does not matter
	#. “Pat” and “pat” have span 4
	# Words that begin and end with the same letter have a word span of 0

	task :review_app_setup do
	GOB_DEV_DOMAIN = #<our-custom-domain-for-dev>
	require "dnsimple"
	require "platform-api"

	heroku_app_name = ENV["HEROKU_APP_NAME"]
	dnsimple_account_id = ENV["DNSIMPLE_DEV_ACCOUNT_ID"]

	type = { type: 'CNAME' }

	export PS1="\[\033[36m\]\u:\[\033[32m\]\w\[\033[33m\]\$(markup_git_branch \$(parse_git_branch))\[\033[00m\]$ "

	parse_git_branch() {
	git branch --no-color 2> /dev/null \| sed -e '/^[^]/d' -e 's/ (\([^)]\))*/\1/'
	}

	markup_git_branch() {
	if [[ -n $@ ]]; then
	if [[ -z $(git status --porcelain 2> /dev/null) ]]; then
	echo -e ":\001\033[32m\002($@)\001\033[0m\002"

	# This snippet can be included in ApplicationController.rb
	if Rails.env.production?
	rescue_from StandardError do \|error\|
	# if it is an unrecoverable error, send a signal to heroku
	# to restart the infrastructure
	if error.message =~ /deadlock; recursive locking/
	hclient = PlatformAPI.connect_oauth(ENV["HEROKU_API_TOKEN"])
	heroku_app, dyno = "name-of-your-app", hclient.dyno
	# avoid sending the signal more than once
	if dyno.list(heroku_app).dig(0, "state") === "up"

	/**
	*
	*/
	package com.bwuit.app.activities;

	import java.io.BufferedReader;
	import java.io.InputStreamReader;
	import java.net.HttpURLConnection;
	import java.net.URL;

	class Instagram < PM::WebScreen
	title "Instagram"

	CLIENT_ID = 'your client id'
	REDIRECT_URI = 'http://your.domain.com/auth/instagram/callback'
	FAILURE_URL = 'http://your.domain.com/auth/failure'
	AUTH_URI = "https://instagram.com/oauth/authorize/?client_id=#{CLIENT_ID}&redirect_uri=#{REDIRECT_URI}&response_type=token"

	class << self
	def api

	# add next to your Rakefile
	app.info_plist['UIViewControllerBasedStatusBarAppearance'] = false
	app.info_plist['UIStatusBarStyle'] = 'UIStatusBarStyleLightContent'

	var GCM = require('./gcm');

	var gcm = new GCM(<YOUR GOOGLE API KEY>); // https://code.google.com/apis/console

	// create the message
	var msg = {
	registration_ids: [token], // this is the device token (phone)
	collapse_key: "your_collapse_key", // http://developer.android.com/guide/google/gcm/gcm.html#send-msg
	time_to_live: 180, // just 30 minutes
	data: {