|
3 | 3 | <head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="theme-color" content="#f4f5f7"><title>Overrule</title><link rel="icon" href="/favicon.svg"><link rel="stylesheet" href="/styles.css"><script src="/theme.js"></script><script type="module" src="/app.js"></script></head> |
4 | 4 | <body> |
5 | 5 | <aside class="sidebar"> |
6 | | - <a class="brand" href="/"><img src="/favicon.svg" alt="" width="28" height="28"><span>Model <span class="brand-light">Mesh</span><small>Your AI council</small></span></a> |
| 6 | + <a class="brand" href="/"><img src="/favicon.svg" alt="" width="28" height="28"><span>Overrule<small>Your AI council</small></span></a> |
7 | 7 | <button id="new-discussion" class="button primary wide"><span>＋</span> New meeting</button> |
8 | 8 | <nav aria-label="Main navigation"><button class="nav-item active" id="workspace-nav"><span>◈</span> Meetings</button><button class="nav-item" id="connections-nav"><span>⌘</span> Connections <span id="connection-count" class="count">2</span></button><button class="nav-item" id="security-nav"><span>⛨</span> Security</button></nav> |
9 | 9 | <div class="history-heading">Recent meetings</div><div id="history" class="history"></div> |
|
52 | 52 | <div class="workspace-row"><label>Blast-radius budget (agentsec score from 0 to 100; blank for none)<input id="workspace-budget" type="number" min="0" max="100" placeholder="No budget" autocomplete="off"></label><button type="button" id="budget-save" class="button secondary">Save</button></div> |
53 | 53 | <div id="agentsec-help" class="install-help hidden"><p>agentsec-pack is not installed on the host, so levels get only the built-in canary and no blast-radius score.</p><div class="install-row"><button type="button" id="agentsec-install" class="button primary">Install agentsec-pack</button><span id="agentsec-install-note">Unpacks the bundle shipped with this app into <code>~/agentsec-pack</code> on the host and creates its Python environment. Takes about a minute.</span></div><pre id="agentsec-install-log" class="install-log hidden"></pre><p>Or do it by hand on the host, then restart the app:</p><pre>git clone https://github.com/binary-knight/agentsec-pack ~/agentsec-pack |
54 | 54 | cd ~/agentsec-pack |
55 | | -python3 -m venv .venv && .venv/bin/pip install -e .</pre><p>The app looks for <code>~/agentsec-pack/.venv/bin/agentsec</code> or <code>~/.local/bin/agentsec</code>; set <code>MESH_AGENTSEC</code> to the binary’s path if it lives elsewhere.</p></div> |
| 55 | +python3 -m venv .venv && .venv/bin/pip install -e .</pre><p>The app looks for <code>~/agentsec-pack/.venv/bin/agentsec</code> or <code>~/.local/bin/agentsec</code>; set <code>OVERRULE_AGENTSEC</code> to the binary’s path if it lives elsewhere.</p></div> |
56 | 56 | <div id="workspace-acks" class="hidden"><label id="ack-secrets-label" class="check-label hidden"><input id="ack-secrets" type="checkbox">Files that look like secrets are in this tree. I accept that anything a member reads can reach its provider.</label><label id="ack-dirty-label" class="check-label hidden"><input id="ack-dirty" type="checkbox">Start the candidate branch from HEAD without my uncommitted changes.</label></div> |
57 | 57 | <p class="workspace-risk">This runs code chosen by models with whatever access you grant. Text in the repository and messages from other members can steer a member into commands you never asked for. Anything in the tree can reach the model providers, so point it at a scratch clone and never at a tree holding secrets. Workspace-write is an operating-system boundary only where the app proves one, and the meeting shows which members sit inside it. Git rollback and the activity log limit damage; they do not guarantee safety.</p> |
58 | 58 | </div> |
|
66 | 66 | <main id="security" class="hidden"><div class="page-heading"><div class="eyebrow"></div><h1>Security</h1><p>Measure the boundary each council member actually runs inside, then measure and harden any sandbox you build. Uses agentsec-pack on the host.</p></div> |
67 | 67 | <div id="security-off" class="install-help hidden"><p>agentsec-pack is not installed on the host, so nothing here can be measured yet.</p><div class="install-row"><button type="button" id="security-install" class="button primary">Install agentsec-pack</button><span id="security-install-note">Unpacks the bundle shipped with this app into <code>~/agentsec-pack</code> on the host and creates its Python environment. Takes about a minute.</span></div><pre id="security-install-log" class="install-log hidden"></pre><p>Or do it by hand on the host, then restart the app:</p><pre>git clone https://github.com/binary-knight/agentsec-pack ~/agentsec-pack |
68 | 68 | cd ~/agentsec-pack |
69 | | -python3 -m venv .venv && .venv/bin/pip install -e .</pre><p>The app looks for <code>~/agentsec-pack/.venv/bin/agentsec</code> or <code>~/.local/bin/agentsec</code>; set <code>MESH_AGENTSEC</code> to the binary’s path if it lives elsewhere.</p></div> |
| 69 | +python3 -m venv .venv && .venv/bin/pip install -e .</pre><p>The app looks for <code>~/agentsec-pack/.venv/bin/agentsec</code> or <code>~/.local/bin/agentsec</code>; set <code>OVERRULE_AGENTSEC</code> to the binary’s path if it lives elsewhere.</p></div> |
70 | 70 | <section class="card security-card"><div class="section-heading"><h2>Member boundaries</h2><span id="security-status" class="chip">Idle</span></div><p class="field-hint">One row per member per way this app launches it. Measure runs agentsec’s probe through the exact launcher a meeting would use. Claude Code rows ask the member itself to run the probe, which spends one call.</p><div id="member-boundaries" class="boundaries"></div></section> |
71 | 71 | <section class="card security-card"><div class="section-heading"><h2>Sandbox lab</h2><a id="security-report" class="text-button" href="/api/security/report.html" target="_blank" rel="noreferrer">Open HTML report</a></div><p class="field-hint">Measure, harden, measure again. Pick a named configuration; container presets also take an image. Free-form launchers are not accepted from a browser, on purpose.</p><div class="workspace-row"><label>Configuration<select id="lab-preset"></select></label><label id="lab-image-label">Container image<input id="lab-image" placeholder="python:3.12-slim" autocomplete="off"></label><button type="button" id="lab-run" class="button primary">Measure</button></div><p id="lab-rationale" class="field-hint"></p><div id="security-results" class="results"></div></section> |
72 | 72 | </main> |
|
0 commit comments