feat: log formatted

apparmor/install-ai-coding-tools-apparmor.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+src="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/local-ai-coding-tools"
+dst="/etc/apparmor.d/local-ai-coding-tools"
+
+if [[ ! -f "$src" ]]; then
+  echo "Profile not found: $src" >&2
+  exit 1
+fi
+
+echo "Installing AppArmor profile:"
+echo "  $src"
+echo "  -> $dst"
+echo
+echo "This does not restart ssh, networking, VS Code, or the machine."
+echo "It only loads/reloads the single AppArmor profile file above."
+echo
+
+if [[ -f "$dst" ]]; then
+  backup="/etc/apparmor.d/local-ai-coding-tools.$(date +%Y%m%d%H%M%S).bak"
+  echo "Backing up existing profile to:"
+  echo "  $backup"
+  sudo cp "$dst" "$backup"
+fi
+
+sudo install -m 0644 "$src" "$dst"
+sudo apparmor_parser -r "$dst"
+
+echo
+echo "Loaded $dst"
+echo "Restart Codex/VS Code extension hosts for already-running processes to pick up the new exec profiles."

apparmor/local-ai-coding-tools

@@ -0,0 +1,34 @@
+abi <abi/4.0>,
+include <tunables/global>
+
+# Local allow-list for AI coding tools that need unprivileged user namespaces
+# for their own sandboxes on Ubuntu systems with
+# kernel.apparmor_restrict_unprivileged_userns=1.
+
+profile local-codex-cli /home/f/.codex/packages/standalone/releases/0.142.1-x86_64-unknown-linux-musl/bin/codex flags=(unconfined) {
+  userns,
+
+  include if exists <local/local-codex-cli>
+}
+
+profile local-openai-vscode-codex /home/f/.vscode-server/extensions/openai.chatgpt-26.616.81150-linux-x64/bin/linux-x86_64/codex flags=(unconfined) {
+  userns,
+
+  include if exists <local/local-openai-vscode-codex>
+}
+
+profile local-anthropic-claude-code /home/f/.vscode-server/extensions/anthropic.claude-code-2.1.191-linux-x64/resources/native-binary/claude flags=(unconfined) {
+  userns,
+
+  include if exists <local/local-anthropic-claude-code>
+}
+
+# Cline runs inside the VS Code Server extension host, which is this Node
+# binary in the current Remote SSH server installation. This profile is broader
+# than the tool-specific profiles above because multiple VS Code extensions
+# share this host process.
+profile local-vscode-server-node /home/f/.vscode-server/cli/servers/Stable-7e7950df89d055b5a378379db9ee14290772148a/server/node flags=(unconfined) {
+  userns,
+
+  include if exists <local/local-vscode-server-node>
+}