fix: mask credential files from Compose agent tools

Author: zhanghanduo

apodex/tests/test_deployment_config.py

@@ -42,6 +42,9 @@ def test_default_compose_pulls_release_image_and_preserves_cli_state() -> None:
     assert agent["environment"]["FRONTIER_AGENT_REQUIRE_TOOL_USER"] == "1"
     assert "security_opt" not in agent
     assert ".:/project" in agent["volumes"]
+    # Compose injects these files into the harness environment, but the
+    # project bind must not expose their on-disk contents to tool commands.
+    assert "/dev/null:/project/.env:ro" in agent["volumes"]
     assert agent["working_dir"] == "/project"
     assert "./.apodex/runs:/apodex-runs" in agent["volumes"]
     assert "frontier-agent-inputs:/inputs:ro" in agent["volumes"]
@@ -63,6 +66,14 @@ def test_default_compose_pulls_release_image_and_preserves_cli_state() -> None:
     assert evaluator["environment"]["SANDBOX_BACKEND"] == "bwrap"
     assert evaluator["environment"]["SANDBOX_PROFILE"] == "service"
 
+    for overlay, filename in (
+        ("compose.sglang.yaml", ".env.sglang"),
+        ("compose.transformers.yaml", ".env.transformers"),
+    ):
+        assert f"/dev/null:/project/{filename}:ro" in (
+            _yaml(overlay)["services"]["agent"]["volumes"]
+        )
+
 
 def test_development_compose_is_the_only_compose_file_that_builds() -> None:
     compose = _yaml("compose.yaml")

compose.sglang.yaml

@@ -65,6 +65,8 @@ services:
         max-file: "3"
 
   agent:
+    volumes:
+      - /dev/null:/project/.env.sglang:ro
     depends_on:
       model:
         condition: service_healthy

compose.transformers.yaml

@@ -44,6 +44,8 @@ services:
     restart: unless-stopped
 
   agent:
+    volumes:
+      - /dev/null:/project/.env.transformers:ro
     depends_on:
       model:
         condition: service_healthy

compose.yaml

@@ -35,6 +35,9 @@ services:
       APODEX_HOST_GID: ${APODEX_HOST_GID:-}
     volumes:
       - .:/project
+      # The harness receives .env through env_file above. Hide the on-disk
+      # copy from model commands, whose host-mapped UID can read /project.
+      - /dev/null:/project/.env:ro
       - ./.apodex/runs:/apodex-runs
       - frontier-agent-inputs:/apodex-inputs
       - frontier-agent-inputs:/inputs:ro

docs/install/docker.md

@@ -34,6 +34,11 @@ Compose writes session records and deliverables to `.apodex/runs/<session-id>/`.
 Its named state volume is retained for legacy sessions. Attached inputs are
 copied into a separate volume that tools can only read. See
 [run artifacts and timestamps](../run-artifacts.md) for the on-disk layout.
+The agent receives `.env` through its process environment; Compose masks the
+on-disk file inside `/project` so model commands cannot read it. The SGLang and
+Transformers overrides also mask their respective env files. Keep any custom
+credential file outside the mounted project, since project files are available
+to the agent by design.
 
 The convenience helper wraps the same thing:
 
@@ -63,6 +68,7 @@ docker run --rm -it \
   --env-file .env \
   -e APODEX_IN_CONTAINER=1 \
   -e SANDBOX_BACKEND=container \
+  -e FRONTIER_AGENT_REQUIRE_TOOL_USER=1 \
   -e FRONTIER_AGENT_WORKSPACE_DIR=/workspace \
   -e APODEX_RUNS_ROOT=/apodex-runs \
   -e APODEX_RUNS_ROOT_PINNED=1 \
@@ -71,6 +77,7 @@ docker run --rm -it \
   -e APODEX_INPUT_STAGING_ROOT=/apodex-inputs \
   -e FRONTIER_AGENT_INPUTS_ROOT=/inputs \
   -v "$(pwd):/workspace" \
+  -v /dev/null:/workspace/.env:ro \
   -v "$(pwd)/.apodex/runs:/apodex-runs" \
   -v frontier-agent-inputs:/apodex-inputs \
   -v frontier-agent-inputs:/inputs:ro \