Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Sandbox: protect editor and agent configuration that does not exist yet, and links

Cerrado
  • ¿Algo no está bien?
#262 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
12/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
typescript
Área
desktop-dev, security

Línea de trabajo

Start in src/main/tools/sandbox_config.ts, which lists the protected entries, then read how each backend applies them (bwrap --ro-bind, Seatbelt deny, container read-only mounts, Windows denyWrite) to see where absent paths are missed. The issue leaves the approach open (Seatbelt case-folded regexes, bubblewrap placeholders, post-run undo, or reserved placeholders), so a design decision is needed first. Done means a sandboxed command cannot create an absent protected entry, including case variants and renames, and leaves no stray files.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

enhancement priority: medium security severity: low

Follow-up to #127.

What #127 fixed

Sandboxed commands can no longer change, add files inside, delete or rename the project's existing top-level editor, agent and CI configuration: .vscode, .idea, .claude, .cursor, .agents, .patch, .mcp.json, AGENTS.md, CLAUDE.md, .envrc, .husky, .github and the other entries in src/main/tools/sandbox_config.ts. They are protected on every backend the same way .git is (bwrap --ro-bind, Seatbelt deny, container read-only mounts, Windows denyWrite).

Still open

  1. Entries that do not exist yet. A command can still create .vscode/tasks.json in a project without .vscode, or a new .mcp.json. bubblewrap and containers can only mount over a path that exists, and a Windows ACL needs an object, so an absent path cannot be protected the way .git is without creating something in the project. Options:
    • Seatbelt can deny absent paths by name. Its rules are case-sensitive on a case-insensitive file system, so it needs case-folded regexes ([vV][sS]...) and a Mac to verify.
    • bubblewrap: mount a read-only placeholder at the absent path, which leaves an empty file or folder in the project (srt does this and cleans up after); cleanup must not break overlapping commands.
    • After a sandboxed command, report or undo protected entries it created, before anything else reads them (Patch reads AGENTS.md when a chat starts).
    • Reserve placeholders, as for .git. Probably unacceptable: it would add files to every project.
  2. Links. A top-level protected name that is a symlink (for example CLAUDE.md -> AGENTS.md) is not protected itself, because the sandbox protects paths and a command can replace the link. Its target is protected when it is itself a protected entry.
  3. Nested copies. Only top-level entries are covered. Editors read .vscode from the opened folder, so a subfolder opened on its own is not protected.

Acceptance

On each backend, a command cannot create a protected entry that was absent before it ran, including a case variant (.VSCode) or by renaming a folder into place, and no stray files are left in the project.

Lenguaje dominante
TypeScript
Estrellas
2
Forks
2
Sin PR fusionados en 30 d

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de PierrunoYT/patch

Todos los issues de PierrunoYT/patch

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.