ai-sandbox: encrypt snapshot blobs at rest with an encrypting blob store wrapper

Aperta
  • Qualcosa non va?
#2,062 0 commenti 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@AlemTuzlak ci sta già lavorando.

Dal 5/11/2026.

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

waiting-on: maintainer

Add an encrypting wrapper for snapshot blob stores in @tanstack/ai-sandbox, so that snapshot files are encrypted at rest with one option:

const snapshots = createSandboxSnapshots({
  persistence: withEncryptedBlobs(persistence, { key }),
  checkpoints,
})

Why

A sandbox snapshot can hold secrets. In #1982, sandboxComputer({ snapshots }) saves a Chromium profile, and the profile holds the session cookies of every site that the agent signed in to. A person with the cookies can use those accounts.

Today the docs only say "keep the blob store secret, and encrypt it in production" (docs/computer-use/drivers.md). Each user must write their own encryption. That is easy to get wrong.

How it fits

  • The snapshot code writes each file to stores.blobs at sandbox-files/sha256/<hash of the plain bytes>.
  • On restore, it reads the blob and checks the hash of the bytes (packages/ai-sandbox/src/snapshots.ts).
  • So a wrapper can encrypt in put and decrypt in get. The keys and the hash check do not change.

Work

  1. Add withEncryptedBlobs(persistence, { key }). It returns the same persistence with a wrapped stores.blobs.
  2. Use AES-GCM from Web Crypto, with a new random IV for each blob. Store the IV with the ciphertext. Run in Node, Workers, and browsers.
  3. Accept a CryptoKey, or a function that returns one, so the key can come from a KMS. Add a key id to the blob metadata, for key rotation.
  4. Make get work for every body type and for range. A range read must decrypt the whole blob, then slice it. size and etag describe the ciphertext.
  5. Fail with a clear error when a blob cannot be decrypted (wrong key, changed data). Do not return the ciphertext.
  6. Update docs/computer-use/drivers.md and the snapshot docs. Use the wrapper in examples/react/computer-use-login.

Open questions

  • The blob key holds the SHA-256 of the plain file. A person who can list the store can check if a known file is in a snapshot. Is that acceptable, or does the snapshot code need keyed hashes (HMAC) when encryption is on?
  • Other metadata stays plain: file paths, sizes, and the checkpoint records. List this in the docs.

Context

  • #1982: computer use sign-in example with profile snapshots.
  • #1108: portable file snapshots.
Lingua principale
TypeScript
Stelle
3.3k
Fork
378
Merge medio
1g 2h
PR unite (30g)
254

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di TanStack/ai

Tutte le issue di TanStack/ai

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.