Docs: headless runs' jail on the review, custom command and terminal pages (#173)

Since #172 every headless run is jailed: reviews say their jail reaches
only the package registries and can't read the key or token, a custom
command's base URLs and keys are the jail's proxy and a stand-in, and the
terminal's Go row no longer suggests a task with its own sandbox.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016q5wwBFck8JHq14gHUM2CL

Canberk Demirci authored 12 days ago· GitHub committed 12 days agosigned1 parent f8fef6fcommit 102662fddc504e341648788cd0f4b5f3c2c3aa98Browse files

3 files changed+3−3

modifiedapps/diffinery/docs/agents/review.md+1−1View file

modifiedapps/diffinery/docs/agents/tasks.md+1−1View file

modifiedapps/diffinery/docs/agents/terminal.md+1−1View file

		@@ -126,7 +126,7 @@
126	126	## Who pays, and the risks
127	127
128	128	- Every review spends the model key of the admin who turned reviews on. In an organization's repository, its [agent policy](/docs/agents/organizations#whose-key-pays) can have the organization's key pay instead, while that admin is a member; it can also turn agent review off for all its repositories. Use a dedicated key with a spending limit with your provider as well: Diffinery's [limits](#limits) count reviews, requests and tokens, not money.
129		-- While a review runs, anything in its sandbox, including code from the pull request, can use that key through the model proxy. The proxy forwards only the model endpoints, and the review's model token stops working when the agent exits (see [How your key is protected](/docs/agents/tasks#how-your-key-is-protected)).
	129	+- While a review runs, anything in its jail, including code from the pull request, can use that key through the model proxy, though it can't read the key or the review's model token. The proxy forwards only the model endpoints, and the token stops working when the agent exits (see [How your key is protected](/docs/agents/tasks#how-your-key-is-protected)). Otherwise the jail reaches only the package registries (see [What a run can reach](/docs/agents/tasks#what-a-run-can-reach)).
130	130	- The sandbox can't push or write repository content. Its credential acts as the agent with read access.
131	131
132	132	## REST API

		@@ -98,7 +98,7 @@
98	98	\| Codex \| Your OpenAI API key \| `codex exec --json --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check "$DIFFINERY_TASK_PROMPT"` \|
99	99	\| Claude Code via OpenRouter \| Your OpenRouter key \| The same, with `ANTHROPIC_BASE_URL` on OpenRouter's Anthropic-compatible endpoint (through the proxy), the token as `ANTHROPIC_AUTH_TOKEN`, and the model you choose for every model role (`ANTHROPIC_MODEL`, `ANTHROPIC_DEFAULT_OPUS_MODEL`, `_SONNET_`, `_HAIKU_`, `ANTHROPIC_SMALL_FAST_MODEL`, `CLAUDE_CODE_SUBAGENT_MODEL`) \|
100	100	\| Codex via OpenRouter \| Your OpenRouter key \| The same, with an `openrouter` model provider on OpenRouter's Responses API (`-c model_provider=openrouter -c model_providers.openrouter...`) and `-m "$DIFFINERY_MODEL"` \|
101		-\| Custom command \| Nothing required \| Your command, with the goal in `$DIFFINERY_TASK_PROMPT`, and `ANTHROPIC_BASE_URL` / `ANTHROPIC_API_KEY`, `OPENAI_BASE_URL` / `OPENAI_API_KEY` and `OPENROUTER_BASE_URL` / `OPENROUTER_API_KEY` set for each provider you have a key for \|
	101	+\| Custom command \| Nothing required \| Your command, with the goal in `$DIFFINERY_TASK_PROMPT`, and `ANTHROPIC_BASE_URL` / `ANTHROPIC_API_KEY`, `OPENAI_BASE_URL` / `OPENAI_API_KEY` and `OPENROUTER_BASE_URL` / `OPENROUTER_API_KEY` set for each provider you have a key for. The base URLs point at the jail's model proxy and the keys are a stand-in (see [How your key is protected](#how-your-key-is-protected)) \|
102	102
103	103	### OpenRouter
104	104

		@@ -139,7 +139,7 @@
139	139	\| No Give it a task box, or `the terminal was opened without agent tasks` \| The terminal was opened without Will run agent tasks. End it and open another with the box ticked. \|
140	140	\| `diffinery: refused a connection to <host>:443 from the task (only the hosts in /docs/agents/terminal#what-a-task-can-reach)` in the transcript \| The agent or a tool it ran tried a host outside the [list](#what-a-task-can-reach). Work that needs other hosts belongs in the terminal itself, outside a task. \|
141	141	\| `diffinery: refused a connection to <host>:443 from the task: its TLS ClientHello asks for <other host>` (or `names no single server, or hides it (Encrypted Client Hello)`, or `no TLS ClientHello`) \| The tunnel opens only when the TLS handshake names the host the tool asked the proxy for. A tool that sends a different server name, none, or Encrypted Client Hello, or that doesn't start TLS within 10 seconds, is refused. Point the tool at the allowed host by its own name and turn off Encrypted Client Hello in it. \|
142		-\| `go: ... dial tcp ...` or another Go module download error \| Go modules aren't reachable from a terminal task. Commit them with `go mod vendor`, or run the task in a sandbox of its own. \|
	142	+\| `go: ... dial tcp ...` or another Go module download error \| Go modules aren't reachable from a terminal task, or from any other agent run. Commit them with `go mod vendor`. \|
143	143	\| The task fails with "The task's jail couldn't start in this terminal's sandbox, so nothing ran." \| bubblewrap couldn't start in the sandbox; the transcript has its error. Nothing ran and nothing was pushed. End the terminal, open a new one and run the task again. \|
144	144	\| The terminal's Claude Code or Codex asks you to sign in again after a task \| The CLI refreshed its sign-in inside the task, on its private copy, and the provider retired the old refresh token. Sign in again in the terminal. \|
145	145	\| Codex fails to reach `api.openai.com` in a task \| Codex is signed in with an API key, and only ChatGPT sign-ins work in terminal tasks. Run `codex login` with your ChatGPT plan, or use a task with a sandbox of its own. \|

codician/diffinerypublic

Docs: headless runs' jail on the review, custom command and terminal pages (#173)