feat: nested ptys, forward sigwinch, keychain access

[caarlos0]

📖 Description

Three independent fixes that together unblock interactive agent workflows under the macOS seatbelt backend. The baseline profile breaks anything that needs to spawn a real shell (tests, git, gh, REPLs) or talk to the system Keychain, and the pty bridge corrupts TUIs whenever the host wraps mxc-exec-mac in its own pty.

feat(seatbelt): add nestedPty + keychainAccess experimental options

Two new opt-in/opt-out fields under experimental.seatbelt:

• nestedPty (default true): allow the inner workload to call posix_openpt. Emits (allow pseudo-tty), (allow iokit-open), and read/write/ioctl on /dev/ptmx. Default-on because almost any agent shell tool needs it.
• keychainAccess (default false): allow Security.framework/keytar to reach the system keychain stack. Emits Mach lookups for SecurityServer, securityd, trustd, cfprefsd.daemon, xpcd, and the com.apple.lsd.* family (via global-name-regex); read access to /Library/Keychains + /private/var/db/mds; read+write on $HOME/Library/Keychains + /private/var/folders; and (allow iokit-open).

Both blocks are emitted before write_ui_rules so the HID iokit-open deny still wins under Seatbelt's last-match-wins semantics. nestedPty is suppressed when guiAccess already emits a strict superset.

fix(pty): make nested ptys work end-to-end under macOS

Four gaps in mxc_pty::run_with_pty that broke any nested-pty workload under a host-allocated outer pty:

• Outer pty slave was left in cooked mode → input bytes echoed back, control chars rendered as ^X. Added a RAII RawSlaveGuard that puts the outer slave into raw mode and restores termios on drop. No-op when fd 0 isn't a tty.
• Inner pty was created at the kernel default 0×0. Now inherits the outer pty's TIOCGWINSZ.
• SIGWINCH was never propagated. Added a self-pipe SIGWINCH handler + a forwarder thread that re-reads the outer winsize and pushes it to the inner pty master via TIOCSWINSZ. Self-pipe rather than sigwait so we don't depend on which thread the runtime lets the signal land on.
• Inner child inherited the parent's sigmask (signal_cleanup blocks signals via sigwait). pre_exec now unconditionally adds SIGWINCH to the unblock set — execve resets the handler but preserves the inherited mask.

🔗 References

https://github.com/github/copilot-agent-runtime/issues/164

🔍 Validation

• cargo fmt --all -- --check clean.
• cargo clippy -p mxc_pty -p seatbelt_common -p wxc_common -p mxc_darwin --all-targets -- -D warnings clean.
• cargo test -p mxc_pty -p seatbelt_common -p wxc_common — 4 + 33 + 190 = 227 tests pass. New unit tests cover: nestedPty defaults / on / off / interaction with guiAccess / HID deny ordering; keychainAccess mach + FS + iokit + HID deny ordering; parser pass-through of both fields.
• Manual: ran Copilot CLI inside the seatbelt sandbox on macOS — gh, git, node REPLs, and resize-on-the-fly all work; keytar reads/writes Keychain entries with keychainAccess: true.

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated documentation (if applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)

📋 Issue Type

• Bug fix
• Feature
• Task

[Copilot]

Pull request overview

This PR extends the macOS Seatbelt backend with nested PTY and optional Keychain access support, and improves the shared Unix PTY bridge to propagate terminal sizing and raw-mode behavior for nested interactive sessions.

Changes:

• Adds nestedPty and keychainAccess config fields for Seatbelt in Rust models, parser tests, schema, and macOS docs.
• Emits additional Seatbelt profile rules for nested PTY allocation and Keychain-related Mach/filesystem access.
• Updates mxc_pty to inherit window size, forward SIGWINCH, and set the outer PTY slave to raw mode.

Show a summary per file

File	Description
src/wxc_common/src/models.rs	Adds Seatbelt config fields and manual defaults.
src/wxc_common/src/config_parser.rs	Parses new Seatbelt fields and adds parser tests.
src/seatbelt_common/src/profile_builder.rs	Adds profile rules and tests for nested PTYs and Keychain access.
src/mxc_pty/src/lib.rs	Adds raw-mode handling, initial window sizing, and SIGWINCH forwarding.
schemas/dev/mxc-config.schema.0.6.0-dev.json	Documents new Seatbelt schema fields.
docs/macos-support/seatbelt-backend.md	Documents new Seatbelt options.

Copilot's findings

Comments suppressed due to low confidence (2)

src/mxc_pty/src/lib.rs:342

• The SIGWINCH self-pipe is created in blocking mode, but the signal handler writes to it directly. If resize events arrive while the pipe is full or the reader is stalled, write(2) can block inside the signal handler and hang the process. Please make the write end non-blocking (and handle EAGAIN) before installing the handler.

    let (read_end, write_end) = nix::unistd::pipe().ok()?;
    let read_fd = read_end.as_raw_fd();
    let write_fd = write_end.as_raw_fd();
    // Leak the OwnedFds — they live for the rest of the process.
    // Closing them would race the signal handler.
    std::mem::forget(read_end);
    std::mem::forget(write_end);
    SIGWINCH_PIPE_WRITE_FD.store(write_fd, std::sync::atomic::Ordering::Release);

src/mxc_pty/src/lib.rs:352

• Each run_with_pty call installs a new global SIGWINCH handler and overwrites the single static pipe fd. Previous resize threads and pipe fds are never shut down, and only the most recent invocation will receive future resize notifications. This makes repeated or concurrent pty runs leak resources and breaks resize forwarding for any earlier active session; the handler/pipe state needs to be installed once with per-session registration or cleaned up when the pty run completes.

    SIGWINCH_PIPE_WRITE_FD.store(write_fd, std::sync::atomic::Ordering::Release);

    // SIGWINCH's default action is "ignore", so without an installed
    // handler the kernel drops the signal entirely. SA_RESTART so we
    // don't break unrelated syscalls.
    unsafe {
        let mut sa: libc::sigaction = std::mem::zeroed();
        sa.sa_sigaction = sigwinch_handler as *const () as usize;
        libc::sigemptyset(&mut sa.sa_mask);
        sa.sa_flags = libc::SA_RESTART;
        if libc::sigaction(libc::SIGWINCH, &sa, std::ptr::null_mut()) != 0 {

• Files reviewed: 6/6 changed files
• Comments generated: 5

[caarlos0]

Addressed Copilot reviewer feedback:

• SIGWINCH self-pipe blocking write (mxc_pty/src/lib.rs:342): fixed in bf9baa0 — set O_NONBLOCK on the write end before installing the handler, so the handler can't deadlock if the pipe fills. The existing "drop on full pipe" comment now matches actual behavior.

• Per-invocation global SIGWINCH state (mxc_pty/src/lib.rs:352): not addressing in this PR. The function lives in a single-shot binary (mxc-exec-mac and lxc-exec both call run_with_pty exactly once before exiting); there is no concrete caller doing repeated or concurrent runs. Fixing it correctly means either a once-init module-level handler or per-session registration, both of which add real complexity for no current user. Happy to revisit when there's a concrete caller that needs it.

Also fixed the x64 WXC CI failure in 6eb69e7 — the keychain tests need $HOME which isn't set on Windows CI; gated them to cfg(target_os = "macos") since the feature is macOS-only anyway.

[richiemsft]

isn't this too broad? Is it possible to narrow it down to only what's needed?

[caarlos0]

Yes — verified empirically and dropped entirely in cb21f36. I tested on macOS 15 (Apple Silicon) under sandbox-exec with (allow pseudo-tty) + /dev/ptmx but no iokit-open: posix_openpt → grantpt → unlockpt → ptsname → slave open all succeed. Then end-to-end through mxc-exec-mac itself with the new profile builder — posix_openpt returns OK slave=/dev/ttys014, opened slave fd=7. So the rule is removed from write_nested_pty_rules along with the now-stale ordering test and build_profile comment.

[richiemsft]

same comment about iokit-open in here.

[caarlos0]

Same fix in cb21f36. Verified SecItemAdd + SecItemCopyMatching on a generic-password item under sandbox-exec with the keychain Mach surface (securityd, trustd, ocspd, cfprefsd, xpcd, lsd.*) and the FS surface (~/Library/Keychains, /private/var/folders, /private/var/db/mds) but no iokit-open — both return status 0. Dropped the rule. Also dropped the redundant /Library/Keychains and /System/Library/Keychains reads since the baseline (subpath "/Library") and (subpath "/System") already cover them, and updated the docs to match.