# Direct access to all forge credentials
ssh -T git@forge-a.com          # Authenticated
gh api user                     # Full token scope

# Can shell into sandbox host
ssh sandbox-host

# Cannot install packages or modify system
sudo pkg install foo            # DENIED (no sudo)

# Manage jails
sudo bastille list              # See all jails
sudo bastille console agent-N   # Enter a jail
sudo bastille cmd agent-N CMD   # Run command in jail

# Switch to agent Unix user (non-jailed, for testing)
sudo su - agent-N               # Full host access as that user

# Install packages, manage services
sudo pkg install foo            # Works (has sudo)

# Scoped forge access
gh api user                     # Only sees agent's forge org
git clone https://...           # Works (HTTPS allowed by pf)

# AI agent sessions
claude                          # Runs with jailed credentials

# Cannot escape
ps aux                          # Only sees jail's own processes (~5)
ls /home                        # Empty (host /home not mounted)
ping anything                   # DENIED (raw sockets disabled)
mount anything                  # DENIED (jail restriction)

sudo bastille pkg <jail> install -y bash
sudo bastille cmd <jail> chsh -s /usr/local/bin/bash root
echo 'export SHELL=/usr/local/bin/bash' >> /root/.profile
echo 'export SHELL=/usr/local/bin/bash' >> /root/.bashrc

sudo bastille pkg <jail> install -y gmake
# In jail: gmake check, gmake build, etc.
# Or: echo 'alias make=gmake' >> /root/.bashrc

mkdir -p ~/.npm-global
npm config set prefix '~/.npm-global'
echo 'export PATH=~/.npm-global/bin:$PATH' >> ~/.bashrc

#!/bin/sh
# ghq-sync.sh - run inside jail
repos=$(gh repo list <org> --json name --jq '.[].name')
for repo in $repos; do
    ghq get https://github.com/<org>/$repo 2>/dev/null || true
done

sudo bastille cmd <jail> sh -c 'echo "nameserver 8.8.8.8" > /etc/resolv.conf'

# Install Bastille
sudo pkg install -y bastille

# Configure ZFS-backed jails
sudo sysrc bastille_enable=YES
sudo sysrc -f /usr/local/etc/bastille/bastille.conf \
    bastille_zfs_enable=YES bastille_zfs_zpool=zroot

# Create loopback interface for jails
sudo sysrc cloned_interfaces='lo1' ifconfig_lo1_name='bastille0'
sudo service netif cloneup

# Enable pf and IP forwarding
sudo sysrc pf_enable=YES gateway_enable=YES
sudo kldload pf

# Bootstrap base system (~200MB, ~23 seconds)
sudo bastille bootstrap 14.3-RELEASE

# /etc/pf.conf
ext_if="re0"                     # Adjust to your interface
jail_net="10.0.0.0/24"
restricted_host="192.168.x.x"   # Restricted host IP

set skip on lo0

nat on $ext_if from $jail_net to any -> ($ext_if)

block in all
block out all

pass in on $ext_if proto tcp from $restricted_host to any port 22
pass out on $ext_if proto { tcp udp } from ($ext_if) to any
pass out on $ext_if proto udp from $jail_net to any port 53
pass out on $ext_if proto tcp from $jail_net to any port { 22 80 443 }
pass on bastille0 all

sudo pfctl -e -f /etc/pf.conf
sudo sysctl net.inet.ip.forwarding=1

# Create Unix user
sudo pw useradd agent-alpha -m -s /bin/sh -c 'Agent Alpha'

# Generate SSH key
sudo -u agent-alpha ssh-keygen -t ed25519 \
    -f /home/agent-alpha/.ssh/id_ed25519 -N '' -C 'agent-alpha@sandbox'

# Create gitconfig
cat <<'EOF' | sudo tee /home/agent-alpha/.gitconfig
[user]
    name = Agent Alpha
    email = agent-alpha@example.com
[init]
    defaultBranch = main
EOF

# Create thin jail (~3 seconds)
sudo bastille create agent-alpha 14.3-RELEASE 10.0.0.20

# Install toolchain -- bash and gmake are REQUIRED
sudo bastille pkg agent-alpha install -y git gh ghq node npm-node24 \
    bash gmake guile3 emacs-nox python311 curl

# Install Go on the sandbox HOST (not inside jails)
sudo pkg install -y go

# Build bd (beads issue tracker) on the host, copy static binary into jails
# Go builds a single static binary -- no runtime deps needed inside the jail
go install github.com/steveyegge/beads/cmd/bd@latest
sudo cp ~/go/bin/bd /usr/local/bastille/jails/agent-alpha/root/usr/local/bin/bd

# CRITICAL: Set bash as root shell and export SHELL
# Claude Code requires bash -- FreeBSD jails default to /bin/sh
# which causes: "No suitable shell found. Claude CLI requires a
# Posix shell environment."
sudo bastille cmd agent-alpha chsh -s /usr/local/bin/bash root
echo 'export SHELL=/usr/local/bin/bash' | \
    sudo tee -a /usr/local/bastille/jails/agent-alpha/root/root/.profile
echo 'export SHELL=/usr/local/bin/bash' | \
    sudo tee -a /usr/local/bastille/jails/agent-alpha/root/root/.bashrc

# Install AI agent CLI
sudo bastille cmd agent-alpha npm install -g @anthropic-ai/claude-code

# Copy credentials into jail
sudo mkdir -p /usr/local/bastille/jails/agent-alpha/root/root/.config/gh
sudo cp /home/agent-alpha/.config/gh/* \
    /usr/local/bastille/jails/agent-alpha/root/root/.config/gh/
sudo cp /home/agent-alpha/.gitconfig \
    /usr/local/bastille/jails/agent-alpha/root/root/.gitconfig

# Copy Claude Code credentials (if agent uses Claude)
sudo mkdir -p /usr/local/bastille/jails/agent-alpha/root/root/.claude
sudo cp /home/agent-alpha/.claude/.credentials.json \
    /usr/local/bastille/jails/agent-alpha/root/root/.claude/
sudo cp /home/agent-alpha/.claude.json \
    /usr/local/bastille/jails/agent-alpha/root/root/.claude.json

# Set ZFS quota
sudo zfs set quota=5G zroot/bastille/jails/agent-alpha/root

# Interactive shell
sudo bastille console agent-alpha

# Or run a single command
sudo bastille cmd agent-alpha claude --print "explain this codebase"

# Or clone and work
sudo bastille cmd agent-alpha git clone https://forge.example/org/repo /tmp/work
sudo bastille cmd agent-alpha sh -c 'cd /tmp/work && claude'

# From host: agent can't see host processes
sudo bastille cmd agent-alpha ps aux | wc -l   # Should be ~5

# From host: agent can't see host filesystem
sudo bastille cmd agent-alpha ls /home          # Should be empty

# From host: agent can't see other jails
sudo bastille cmd agent-alpha ls /usr/local/bastille  # No such file

# From host: agent identity is correct
sudo bastille cmd agent-alpha gh api user --jq '.login'

# Pre-task snapshot
sudo zfs snapshot zroot/bastille/jails/agent-alpha/root@pre-task-42

# ... agent does work ...

# Review what changed
sudo zfs diff zroot/bastille/jails/agent-alpha/root@pre-task-42

# If bad, rollback (destroys all changes since snapshot)
sudo bastille stop agent-alpha
sudo zfs rollback zroot/bastille/jails/agent-alpha/root@pre-task-42
sudo bastille start agent-alpha

# If good, destroy snapshot
sudo zfs destroy zroot/bastille/jails/agent-alpha/root@pre-task-42

# Cron: 0 3 * * * /usr/local/bin/jail-snap-daily.sh
for jail in $(bastille list | tail -n +2 | awk '{print $2}'); do
    zfs snapshot "zroot/bastille/jails/${jail}/root@daily-$(date +%Y-%m-%d)"
done