fix access to sockets

README.md

@@ -250,7 +250,7 @@ CoreDesktop installs the AI coding agents opencode, Hermes Agent and Claude Code
 - can't read your SSH keys, password stores, browser profiles, Flatpak apps' data (browsers, Signal, Telegram and the rest), your Nextcloud password, cloud and Git credentials, or the other agents' logins
 - can reach only AI providers and common developer sites: GitHub, Gitea, npm, PyPI, crates.io, RubyGems, the Go module proxy and archlinux.org
 
-Typing `opencode`, `hermes` or `hermes-agent` runs it in the sandbox. To run one without it, type `unsandboxed opencode`. Hermes' gateway, the background service that lets you talk to Hermes through Matrix and other messaging apps, runs in the sandbox too, and can reach the Matrix server in Hermes' settings. For other messaging services, add their domains as shown below. Claude Code uses its own built-in sandbox for every command it runs (see `/sandbox` inside Claude).
+Typing `opencode`, `hermes` or `hermes-agent` runs it in the sandbox. To run one without it, type `unsandboxed opencode`. Hermes' gateway, the background service that lets you talk to Hermes through Matrix and other messaging apps, runs in the sandbox too, and can reach the Matrix server in Hermes' settings. For other messaging services, add their domains as shown below. Hermes talks to its gateway through a local socket, so its sandbox allows local sockets but hides the ones that would let it act outside the sandbox: your session's D-Bus and SSH agent, Docker, Tailscale, X11, tmux and browsers. Claude Code uses its own built-in sandbox for every command it runs (see `/sandbox` inside Claude).
 
 Before using an agent the first time, sign in and choose a model provider with `configure` (see below).
 

packages.conf

@@ -70,6 +70,9 @@ DEV_TOOLS=(
   asdf-vm
   base-devel
   bat
+  # Hermes' Matrix support builds python-olm, which needs clang++ and cmake
+  clang
+  cmake
   dart-sass
   docker
   docker-compose

sandbox/config/hermes.json

@@ -1,8 +1,21 @@
 {
   "network": {
-    "allowedDomains": []
+    "allowedDomains": [],
+    "allowAllUnixSockets": true
   },
   "filesystem": {
+    "denyRead": [
+      "/run/user",
+      "/run/dbus",
+      "/run/docker.sock",
+      "/run/podman",
+      "/run/tailscale",
+      "/run/ssh-unix-local",
+      "/tmp/.X11-unix",
+      "/tmp/tmux-*",
+      "/tmp/ssh-*",
+      "/tmp/*/SingletonSocket"
+    ],
     "allowRead": [
       "~/.hermes"
     ],