ai-sandbox: encrypt snapshot blobs at rest with an encrypting blob store wrapper

Abierto
  • ¿Algo no está bien?
#2,062 0 comentarios 0 reacciones 1 asignado Ver en GitHub

Los mantenedores suelen responder en 1 día

@AlemTuzlak ya está trabajando en esto.

Desde el 5/11/2026.

Evaluación

Este issue todavía no se ha evaluado.

Descripción

waiting-on: maintainer

Add an encrypting wrapper for snapshot blob stores in @tanstack/ai-sandbox, so that snapshot files are encrypted at rest with one option:

const snapshots = createSandboxSnapshots({
  persistence: withEncryptedBlobs(persistence, { key }),
  checkpoints,
})

Why

A sandbox snapshot can hold secrets. In #1982, sandboxComputer({ snapshots }) saves a Chromium profile, and the profile holds the session cookies of every site that the agent signed in to. A person with the cookies can use those accounts.

Today the docs only say "keep the blob store secret, and encrypt it in production" (docs/computer-use/drivers.md). Each user must write their own encryption. That is easy to get wrong.

How it fits

  • The snapshot code writes each file to stores.blobs at sandbox-files/sha256/<hash of the plain bytes>.
  • On restore, it reads the blob and checks the hash of the bytes (packages/ai-sandbox/src/snapshots.ts).
  • So a wrapper can encrypt in put and decrypt in get. The keys and the hash check do not change.

Work

  1. Add withEncryptedBlobs(persistence, { key }). It returns the same persistence with a wrapped stores.blobs.
  2. Use AES-GCM from Web Crypto, with a new random IV for each blob. Store the IV with the ciphertext. Run in Node, Workers, and browsers.
  3. Accept a CryptoKey, or a function that returns one, so the key can come from a KMS. Add a key id to the blob metadata, for key rotation.
  4. Make get work for every body type and for range. A range read must decrypt the whole blob, then slice it. size and etag describe the ciphertext.
  5. Fail with a clear error when a blob cannot be decrypted (wrong key, changed data). Do not return the ciphertext.
  6. Update docs/computer-use/drivers.md and the snapshot docs. Use the wrapper in examples/react/computer-use-login.

Open questions

  • The blob key holds the SHA-256 of the plain file. A person who can list the store can check if a known file is in a snapshot. Is that acceptable, or does the snapshot code need keyed hashes (HMAC) when encryption is on?
  • Other metadata stays plain: file paths, sizes, and the checkpoint records. List this in the docs.

Context

  • #1982: computer use sign-in example with profile snapshots.
  • #1108: portable file snapshots.
Lenguaje dominante
TypeScript
Estrellas
3.3k
Forks
378
Merge medio
1 d 2 h
PR fusionados (30 d)
254

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de TanStack/ai

Todos los issues de TanStack/ai

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.