Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Sandbox: protect editor and agent configuration that does not exist yet, and links

Closed
  • Is something wrong?
#262 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
12/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
typescript
Domain
desktop-dev, security

Research direction

Start in src/main/tools/sandbox_config.ts, which lists the protected entries, then read how each backend applies them (bwrap --ro-bind, Seatbelt deny, container read-only mounts, Windows denyWrite) to see where absent paths are missed. The issue leaves the approach open (Seatbelt case-folded regexes, bubblewrap placeholders, post-run undo, or reserved placeholders), so a design decision is needed first. Done means a sandboxed command cannot create an absent protected entry, including case variants and renames, and leaves no stray files.

Written by the indexing model from the issue text.

Description

enhancement priority: medium security severity: low

Follow-up to #127.

What #127 fixed

Sandboxed commands can no longer change, add files inside, delete or rename the project's existing top-level editor, agent and CI configuration: .vscode, .idea, .claude, .cursor, .agents, .patch, .mcp.json, AGENTS.md, CLAUDE.md, .envrc, .husky, .github and the other entries in src/main/tools/sandbox_config.ts. They are protected on every backend the same way .git is (bwrap --ro-bind, Seatbelt deny, container read-only mounts, Windows denyWrite).

Still open

  1. Entries that do not exist yet. A command can still create .vscode/tasks.json in a project without .vscode, or a new .mcp.json. bubblewrap and containers can only mount over a path that exists, and a Windows ACL needs an object, so an absent path cannot be protected the way .git is without creating something in the project. Options:
    • Seatbelt can deny absent paths by name. Its rules are case-sensitive on a case-insensitive file system, so it needs case-folded regexes ([vV][sS]...) and a Mac to verify.
    • bubblewrap: mount a read-only placeholder at the absent path, which leaves an empty file or folder in the project (srt does this and cleans up after); cleanup must not break overlapping commands.
    • After a sandboxed command, report or undo protected entries it created, before anything else reads them (Patch reads AGENTS.md when a chat starts).
    • Reserve placeholders, as for .git. Probably unacceptable: it would add files to every project.
  2. Links. A top-level protected name that is a symlink (for example CLAUDE.md -> AGENTS.md) is not protected itself, because the sandbox protects paths and a command can replace the link. Its target is protected when it is itself a protected entry.
  3. Nested copies. Only top-level entries are covered. Editors read .vscode from the opened folder, so a subfolder opened on its own is not protected.

Acceptance

On each backend, a command cannot create a protected entry that was absent before it ran, including a case variant (.VSCode) or by renaming a folder into place, and no stray files are left in the project.

Dominant language
TypeScript
Stars
2
Forks
2
Avg merge
5h 28m
Merged PRs (30d)
24

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from PierrunoYT/patch

All issues in PierrunoYT/patch

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.