Network permission rule sets never match; explicit permission objects also bypass the documented merge-over-default

[ragnorc]

Problem

A network permission rule set ({ default: 'deny', rules: [...] }) never allows anything — every outbound connection fails with EACCES even when a rule explicitly allows the host, while the plain scope string 'allow' works. This makes the documented per-host egress allowlist (the recommended posture for agent VMs) unusable:

ERR TypeError: fetch failed Error: EACCES: EACCES: permission denied,
tcp://api.openai.com:443: blocked by network.http policy

Reproduced on 0.2.15 and 0.2.16-rc.1, macOS arm64, Node 25, via the Core path (AgentOs.create(), no actor layer involved).

Reproduction

Exit codes: 42 = HTTP reached (any status), 43 = blocked.

import { AgentOs } from '@rivet-dev/agentos';

const PROBE = `fetch('https://api.openai.com/v1/models')
  .then(() => process.exit(42)).catch(() => process.exit(43));`;

const CASES: [string, unknown][] = [
  ['scope-allow', 'allow'],
  ['rules-exact-host', { default: 'deny', rules: [{ mode: 'allow', patterns: ['api.openai.com'] }] }],
  ['deny-control', 'deny'],
];

for (const [name, network] of CASES) {
  const vm = await AgentOs.create({
    permissions: { fs: 'allow', childProcess: 'allow', process: 'allow', env: 'allow', binding: 'allow', network } as never,
  });
  await vm.filesystem.writeFile('/tmp/t.js', PROBE);
  const r = await vm.process.exec('node /tmp/t.js', { captureStdio: true });
  console.log(name, '→', r.exitCode);
  await vm.dispose();
}

Observed:

scope-allow        → 42   (reached)
rules-exact-host   → 43   (blocked — should be 42)
deny-control       → 43   (blocked, correct)

Also tried: patterns: ['api.openai.com:443'], patterns: ['*'], patterns: ['**'], explicit operations: ['fetch','http','dns','connect'] — all blocked identically.

Related: explicit permission objects skip the documented merge and the binding auto-grant

The permissions docs say a partial policy is "merged over a secure default" and that binding is auto-granted when bindings are registered. In agentos-core/dist/agent-os.js the actual behavior is wholesale replacement:

const hostPermissions = options?.permissions ?? { ...allowAll, binding: "allow" };

Any explicit permissions object replaces the default entirely — so { network: 'allow' } alone silently denies fs/childProcess/process/env, and registering bindings while passing any explicit policy leaves binding undefined→denied. Either the merge should be implemented as documented, or the docs should state replacement semantics.

Expected behavior

• A matching mode: 'allow' rule permits the connection (at minimum for a bare-host pattern, per the documented patterns: ["api.example.com"] example).
• Partial permission objects merge over the documented secure default, or the docs are corrected.
• binding auto-grant behavior is consistent between the no-permissions and explicit-permissions paths.

[tianyiswufeng]

Independent repro on 0.2.15 — Node 22.22.3, darwin-arm64, via javascript.execute rather than process.exec. So this reproduces on a different Node major and a different execution path than yours, if that's useful for ruling either out.

Everything above reproduces exactly. Three things to add.

1. The rules are inert in both directions — so this fails open, not closed

Your matrix asks whether an allow rule ever matches under default: 'deny'. The mirror case turns out to be worse: a mode: 'deny' rule under default: 'allow' is also ignored, and the connection goes through.

permissions.network	result
{default:'deny', rules:[{mode:'allow', patterns:['example.com']}]}	BLOCKED — fetch failed cause=EACCES (your case)
{default:'allow', rules:[{mode:'deny', patterns:['example.com']}]}	ALLOWED — OK status=200
{default:'allow', rules:[{mode:'deny', patterns:['*']}]}	ALLOWED — OK status=200

So rules isn't failing closed on a match miss — the list looks dropped outright, with only default surviving. Worth separating from the allowlist symptom because the failure mode is different in kind: an unusable allowlist is loud and you find it in five minutes, whereas a policy written as an egress blocklist silently permits every host and looks like it's working.

2. It's specific to the network scope

Identical rule shapes on the other scopes, same run (fs rules take paths rather than patterns):

scope / policy	expected	result
childProcess {default:'deny', rules:[allow '**']}	runs	ALLOWED — ran
childProcess {default:'allow', rules:[deny '**']}	blocked	BLOCKED — EACCES: permission denied, spawn 'node': blocked by child_process.spawn policy
fs {default:'deny', rules:[allow paths ['**']]}	all ok	ALLOWED — read=OK write=OK readdir=OK
fs {default:'allow', rules:[deny paths ['**']]}	all denied	BLOCKED — read=EACCES write=EACCES readdir=EACCES

Rule-set evaluation itself works, and honours both modes. Looks like a single-scope regression rather than anything policy-wide.

3. Likely below agent-os.js

dist/sidecar/permissions.js serializes rule sets faithfully, and fills in exactly the defaults you'd want:

operations: rule.operations ?? ALL_OPERATIONS,  // ["*"]
patterns:   rule.patterns   ?? ALL_RESOURCES,   // ["**"]

binding is also the only scope evaluated on the JS side (bindingPermissionMode), which lines up with the auto-grant inconsistency you flagged in the second half of your report. Between that and the childProcess/fs results, the native sidecar's network evaluator seems the likeliest place for the rule list to go missing. I don't have a sidecar build to confirm, but the matrix below is wired up and I'm happy to run a patch against it.

Repro

Zero credentials, neutral host. Verified from a clean install just now.

// npm i @rivet-dev/agentos-core@0.2.15 && node repro.mjs
import { AgentOs } from "@rivet-dev/agentos-core";

const HOST = "example.com";
// Pinned open so the scope under test is the only variable (per the merge issue you noted).
const BASE = { fs: "allow", network: "allow", childProcess: "allow", process: "allow", env: "allow", binding: "allow" };

// 42 = allowed through, 43 = blocked.
const NET = `
fetch("https://${HOST}/")
  .then((r) => { console.log("OK status=" + r.status); process.exit(42); })
  .catch((e) => { console.log("ERR " + e.message + " cause=" + (e.cause && e.cause.code)); process.exit(43); });
`;
const CP = `console.log("ran"); process.exit(42);`;
const FS = `
import { readFileSync, writeFileSync, readdirSync } from "node:fs";
const r = [];
for (const [name, fn] of [
  ["read", () => readFileSync("/etc/hostname", "utf8")],
  ["write", () => writeFileSync("/workspace/t.txt", "x")],
  ["readdir", () => readdirSync("/")],
]) { try { fn(); r.push(name + "=OK"); } catch (e) { r.push(name + "=" + (e.code || e.message)); } }
console.log(r.join(" "));
process.exit(r.every((x) => x.endsWith("=OK")) ? 42 : 43);
`;

const rules = (mode, patterns, key = "patterns") => [{ mode, operations: ["*"], [key]: patterns }];

const CASES = [
  ["network {default:'deny',  rules:[allow  example.com]}", { ...BASE, network: { default: "deny",  rules: rules("allow", [HOST]) } }, NET],
  ["network {default:'allow', rules:[deny   example.com]}", { ...BASE, network: { default: "allow", rules: rules("deny",  [HOST]) } }, NET],
  ["network {default:'allow', rules:[deny   '*']}",         { ...BASE, network: { default: "allow", rules: rules("deny",  ["*"]) } }, NET],
  ["childProcess {default:'deny',  rules:[allow '**']}",    { ...BASE, childProcess: { default: "deny",  rules: rules("allow", ["**"]) } }, CP],
  ["childProcess {default:'allow', rules:[deny  '**']}",    { ...BASE, childProcess: { default: "allow", rules: rules("deny",  ["**"]) } }, CP],
  ["fs {default:'deny',  rules:[allow paths ['**']]}",      { ...BASE, fs: { default: "deny",  rules: rules("allow", ["**"], "paths") } }, FS],
  ["fs {default:'allow', rules:[deny  paths ['**']]}",      { ...BASE, fs: { default: "allow", rules: rules("deny",  ["**"], "paths") } }, FS],
];

const dec = new TextDecoder();
for (const [label, permissions, src] of CASES) {
  let vm, verdict = "?", detail = "";
  const out = [];
  try {
    vm = await AgentOs.create({ permissions });
    const res = await vm.javascript.execute(src, {
      onStdout: (c) => out.push(typeof c === "string" ? c : dec.decode(c)),
      onStderr: (c) => out.push(typeof c === "string" ? c : dec.decode(c)),
    });
    verdict = res.exitCode === 42 ? "ALLOWED" : res.exitCode === 43 ? "BLOCKED" : `exit=${res.exitCode}`;
    if (/blocked by .*policy|EACCES/.test(res.error?.message ?? "")) { verdict = "BLOCKED"; detail = res.error.message; }
  } catch (e) {
    verdict = "THREW";
    detail = `${e?.constructor?.name}: ${e?.message}`;
  } finally {
    try { await vm?.dispose?.(); } catch {}
  }
  console.log(`${verdict.padEnd(8)} ${label}`);
  const g = [out.join("").trim(), detail].filter(Boolean).join(" | ").replace(/\s+/g, " ");
  if (g) console.log(`         ${g.slice(0, 180)}`);
}
process.exit(0);

Output

BLOCKED  network {default:'deny',  rules:[allow  example.com]}
         ERR fetch failed cause=EACCES
ALLOWED  network {default:'allow', rules:[deny   example.com]}
         OK status=200
ALLOWED  network {default:'allow', rules:[deny   '*']}
         OK status=200
ALLOWED  childProcess {default:'deny',  rules:[allow '**']}
         ran
BLOCKED  childProcess {default:'allow', rules:[deny  '**']}
         EACCES: permission denied, spawn 'node': blocked by child_process.spawn policy
ALLOWED  fs {default:'deny',  rules:[allow paths ['**']]}
         read=OK write=OK readdir=OK
BLOCKED  fs {default:'allow', rules:[deny  paths ['**']]}
         read=EACCES write=EACCES readdir=EACCES