Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Sandbox: protect editor and agent configuration that does not exist yet, and links

Chiusa
  • Qualcosa non va?
#262 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
12/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
typescript
Ambito
desktop-dev, security

Direzione di ricerca

Start in src/main/tools/sandbox_config.ts, which lists the protected entries, then read how each backend applies them (bwrap --ro-bind, Seatbelt deny, container read-only mounts, Windows denyWrite) to see where absent paths are missed. The issue leaves the approach open (Seatbelt case-folded regexes, bubblewrap placeholders, post-run undo, or reserved placeholders), so a design decision is needed first. Done means a sandboxed command cannot create an absent protected entry, including case variants and renames, and leaves no stray files.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

enhancement priority: medium security severity: low

Follow-up to #127.

What #127 fixed

Sandboxed commands can no longer change, add files inside, delete or rename the project's existing top-level editor, agent and CI configuration: .vscode, .idea, .claude, .cursor, .agents, .patch, .mcp.json, AGENTS.md, CLAUDE.md, .envrc, .husky, .github and the other entries in src/main/tools/sandbox_config.ts. They are protected on every backend the same way .git is (bwrap --ro-bind, Seatbelt deny, container read-only mounts, Windows denyWrite).

Still open

  1. Entries that do not exist yet. A command can still create .vscode/tasks.json in a project without .vscode, or a new .mcp.json. bubblewrap and containers can only mount over a path that exists, and a Windows ACL needs an object, so an absent path cannot be protected the way .git is without creating something in the project. Options:
    • Seatbelt can deny absent paths by name. Its rules are case-sensitive on a case-insensitive file system, so it needs case-folded regexes ([vV][sS]...) and a Mac to verify.
    • bubblewrap: mount a read-only placeholder at the absent path, which leaves an empty file or folder in the project (srt does this and cleans up after); cleanup must not break overlapping commands.
    • After a sandboxed command, report or undo protected entries it created, before anything else reads them (Patch reads AGENTS.md when a chat starts).
    • Reserve placeholders, as for .git. Probably unacceptable: it would add files to every project.
  2. Links. A top-level protected name that is a symlink (for example CLAUDE.md -> AGENTS.md) is not protected itself, because the sandbox protects paths and a command can replace the link. Its target is protected when it is itself a protected entry.
  3. Nested copies. Only top-level entries are covered. Editors read .vscode from the opened folder, so a subfolder opened on its own is not protected.

Acceptance

On each backend, a command cannot create a protected entry that was absent before it ran, including a case variant (.VSCode) or by renaming a folder into place, and no stray files are left in the project.

Lingua principale
TypeScript
Stelle
2
Fork
2
Merge medio
5h 28m
PR unite (30g)
24

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di PierrunoYT/patch

Tutte le issue di PierrunoYT/patch

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.