Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Sandbox: protect editor and agent configuration that does not exist yet, and links

クローズ
  • 何か問題がありますか？
#262 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
5/5
見積もり時間
1週間以上
初心者へのやさしさ
12/100
issue の種類
機能追加
明瞭さ
おおむね明確
活発さ
活発
技術スタック
typescript
領域
desktop-dev, security

調査の方向性

Start in src/main/tools/sandbox_config.ts, which lists the protected entries, then read how each backend applies them (bwrap --ro-bind, Seatbelt deny, container read-only mounts, Windows denyWrite) to see where absent paths are missed. The issue leaves the approach open (Seatbelt case-folded regexes, bubblewrap placeholders, post-run undo, or reserved placeholders), so a design decision is needed first. Done means a sandboxed command cannot create an absent protected entry, including case variants and renames, and leaves no stray files.

索引モデルが issue の本文から書いたものです。

説明

enhancement priority: medium security severity: low

Follow-up to #127.

What #127 fixed

Sandboxed commands can no longer change, add files inside, delete or rename the project's existing top-level editor, agent and CI configuration: .vscode, .idea, .claude, .cursor, .agents, .patch, .mcp.json, AGENTS.md, CLAUDE.md, .envrc, .husky, .github and the other entries in src/main/tools/sandbox_config.ts. They are protected on every backend the same way .git is (bwrap --ro-bind, Seatbelt deny, container read-only mounts, Windows denyWrite).

Still open

  1. Entries that do not exist yet. A command can still create .vscode/tasks.json in a project without .vscode, or a new .mcp.json. bubblewrap and containers can only mount over a path that exists, and a Windows ACL needs an object, so an absent path cannot be protected the way .git is without creating something in the project. Options:
    • Seatbelt can deny absent paths by name. Its rules are case-sensitive on a case-insensitive file system, so it needs case-folded regexes ([vV][sS]...) and a Mac to verify.
    • bubblewrap: mount a read-only placeholder at the absent path, which leaves an empty file or folder in the project (srt does this and cleans up after); cleanup must not break overlapping commands.
    • After a sandboxed command, report or undo protected entries it created, before anything else reads them (Patch reads AGENTS.md when a chat starts).
    • Reserve placeholders, as for .git. Probably unacceptable: it would add files to every project.
  2. Links. A top-level protected name that is a symlink (for example CLAUDE.md -> AGENTS.md) is not protected itself, because the sandbox protects paths and a command can replace the link. Its target is protected when it is itself a protected entry.
  3. Nested copies. Only top-level entries are covered. Editors read .vscode from the opened folder, so a subfolder opened on its own is not protected.

Acceptance

On each backend, a command cannot create a protected entry that was absent before it ran, including a case variant (.VSCode) or by renaming a folder into place, and no stray files are left in the project.

主要言語
TypeScript
スター
2
フォーク
2
平均マージ
8時間 28分
マージ済み PR（30日）
26

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

PierrunoYT/patch のほかの issue

PierrunoYT/patch の issue をすべて見る

似ている issue

TypeScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。